NUREG-2247, Extremely Low Probability of Rupture Version 2 Probabilistic Fracture Mechanics Code

NUREG-2247,Extremely Low Probability of Rupture Version 2 Probabilistic Fracture Mechanics Code

ML21225A736
Person / Time
Issue date:	08/31/2021
From:	Michael Benson, Erickson M, Giovanni Facco, Harrington C, Matthew Homiack Office of Nuclear Regulatory Research
To:
Malone Tina
References
NUREG-2247
Download: ML21225A736 (202)

Text

NUREG-2247 Extremely Low Probability of Rupture Version 2 Probabilistic Fracture Mechanics Code Office of Nuclear Regulatory Research

AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material Non-NRC Reference Material As of November 1999, you may electronically access Documents available from public and special technical NUREG-series publications and other NRC records at the libraries include all open literature items, such as books, NRCs Library at www.nrc.gov/reading-rm.html. Publicly journal articles, transactions, Federal Register notices, released records include, to name a few, NUREG-series Federal and State legislation, and congressional reports.

publications; Federal Register notices; applicant, licensee, Such documents as theses, dissertations, foreign reports and vendor documents and correspondence; NRC and translations, and non-NRC conference proceedings correspondence and internal memoranda; bulletins and may be purchased from their sponsoring organization.

information notices; inspection and investigative reports; licensee event reports; and Commission papers and their Copies of industry codes and standards used in a attachments. substantive manner in the NRC regulatory process are maintained at NRC publications in the NUREG series, NRC regulations, The NRC Technical Library and Title 10, Energy, in the Code of Federal Regulations Two White Flint North may also be purchased from one of these two sources: 11545 Rockville Pike Rockville, MD 20852-2738

1. The Superintendent of Documents U.S. Government Publishing Office These standards are available in the library for reference Washington, DC 20402-0001 use by the public. Codes and standards are usually Internet: www.bookstore.gpo.gov copyrighted and may be purchased from the originating Telephone: (202) 512-1800 organization or, if they are American National Standards, Fax: (202) 512-2104 from American National Standards Institute

2. The National Technical Information Service 11 West 42nd Street 5301 Shawnee Road New York, NY 10036-8002 Alexandria, VA 22312-0002 Internet: www.ansi.org Internet: www.ntis.gov (212) 642-4900 1-800-553-6847 or, locally, (703) 605-6000 Legally binding regulatory requirements are stated only in A single copy of each NRC draft report for comment is laws; NRC regulations; licenses, including technical available free, to the extent of supply, upon written specifications; or orders, not in NUREG-series publications.

The views expressed in contractor prepared publications in request as follows:

this series are not necessarily those of the NRC.

Address: U.S. Nuclear Regulatory Commission The NUREG series comprises (1) technical and Office of Administration administrative reports and books prepared by the staff (NUREG-XXXX) or agency contractors (NUREG/CR-XXXX),

Division of Resource Management & Analysis (2) proceedings of conferences (NUREG/CP-XXXX),

Washington, DC 20555-0001 (3) reports resulting from international agreements E-mail: distribution.resource@nrc.gov (NUREG/IA-XXXX),(4) brochures (NUREG/BR-XXXX), and Facsimile: (301) 415-2289 (5) compilations of legal decisions and orders of the Commission and the Atomic and Safety Licensing Boards and of Directors decisions under Section 2.206 of the NRCs regulations (NUREG-0750).

Some publications in the NUREG series that are posted at the NRCs Web site address www.nrc.gov/reading-rm/ DISCLAIMER: This report was prepared as an account doc-collections/nuregs are updated periodically and may of work sponsored by an agency of the U.S. Government.

differ from the last printed version. Although references to Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, material found on a Web site bear the date the material or assumes any legal liability or responsibility for any third was accessed, the material available on the date cited partys use, or the results of such use, of any information, may subsequently be removed from the site. apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.

NUREG-2247 Extremely Low Probability of Rupture Version 2 Probabilistic Fracture Mechanics Code Manuscript Completed: July 2021 Date Published: August 2021 Prepared by:

Matthew Homiack, Giovanni Facco, Michael Benson, Marjorie Erickson, and Craig Harrington Matthew Homiack, NRC Project Manager Office of Nuclear Regulatory Research

DISCLAIMER THIS PUBLICATION WAS PREPARED AS AN ACCOUNT OF WORK JOINTLY SPONSORED BY THE ELECTRIC POWER RESEARCH INSTITUTE (EPRI) AND AN AGENCY OF THE U.S.

GOVERNMENT. NEITHER EPRI NOR THE U.S. GOVERNMENT NOR ANY AGENCY THEREOF, NOR ANY EMPLOYEE OF ANY OF THE FOREGOING, MAKES ANY WARRANTY, EXPRESSED OR IMPLIED, OR ASSUMES ANY LEGAL LIABILITY OR RESPONSIBILITY FOR ANY THIRD PARTY'S USE, OR THE RESULTS OF SUCH USE, OF ANY INFORMATION, APPARATUS, PRODUCT, OR PROCESS DISCLOSED IN THIS PUBLICATION, OR REPRESENTS THAT ITS USE BY SUCH THIRD PARTY COMPLIES WITH APPLICABLE LAW.

EPRI RETAINS COPYRIGHT IN EPRI-GENERATED MATERIALS CONTAINED IN THIS PUBLICATION.

THIS PUBLICATION DOES NOT CONTAIN OR IMPLY LEGALLY BINDING REQUIREMENTS.

NOR DOES THIS PUBLICATION ESTABLISH OR MODIFY ANY REGULATORY GUIDANCE OR POSITIONS OF THE U.S. NUCLEAR REGULATORY COMMISSION AND IS NOT BINDING ON THE COMMISSION

ABSTRACT xLPR Version 2 is a probabilistic fracture mechanics code for piping applications. The code was developed jointly by the U.S. Nuclear Regulatory Commissions (NRCs) Office of Nuclear Regulatory Research and the Electric Power Research Institute (EPRI). They engaged in a multiyear code development effort that built on the results of a successful pilot study. The code, which was designed, programmed, and tested under a rigorous software quality assurance program, provides regulators, industry, researchers, and the public with new quantitative capabilities to analyze the risks associated with nuclear power plant piping systems subject to active degradation mechanisms. Core capabilities of the code include modeling fatigue, stress-corrosion cracking, inservice inspection, chemical and mechanical mitigation, leak rates, and seismic effects. This report outlines how the NRCs Office of Nuclear Regulatory Research and EPRI approached code development. It describes the basic design and operation of the software and the underlying models and theory. Results from verification and validation testing and independent reviews are provided. The report also covers sample code inputs and analysis results and provides recommendations for future development.

iii

TABLE OF CONTENTS ABSTRACT ................................................................................................................... iii TABLE OF CONTENTS.................................................................................................. v LIST OF FIGURES......................................................................................................... ix LIST OF TABLES ........................................................................................................ xiii EXECUTIVE

SUMMARY

.............................................................................................. xv ACKNOWLEDGMENTS .............................................................................................. xix ABBREVIATIONS AND ACRONYMS ......................................................................... xxi 1 INTRODUCTION ..................................................................................................... 1-1 1.1 Purpose and Organization of This Report ...................................................................... 1-1 1.2 Introduction to Probabilistic Fracture Mechanics ........................................................... 1-1 1.3 xLPR Pilot Study ............................................................................................................ 1-3 1.4 xLPR V2 Project Overview ............................................................................................. 1-5 1.4.1 Project Objectives ............................................................................................ 1-5 1.4.2 Project Team .................................................................................................... 1-6 2 CODE STRUCTURE, OPERATION, AND THEORY ............................................... 2-1 2.1 Introduction to the xLPR V2 Code .................................................................................. 2-1 2.1.1 Features ........................................................................................................... 2-1 2.1.2 Problem Representation .................................................................................. 2-2 2.1.3 Basic Design and Operation ............................................................................ 2-9 2.2 Physical Models ........................................................................................................... 2-11 2.2.1 Welding Residual Stresses ............................................................................ 2-11 2.2.2 Crack Initiation ............................................................................................... 2-16 2.2.3 Operational Stress-Intensity Factors .............................................................. 2-21 2.2.4 Transient Stress-Intensity Factors ................................................................. 2-26 2.2.5 Crack Growth ................................................................................................. 2-30 2.2.6 Crack Coalescence ........................................................................................ 2-35 2.2.7 Crack Opening Displacement ........................................................................ 2-40 2.2.8 Crack Transition ............................................................................................. 2-44 2.2.9 Leak Rate ....................................................................................................... 2-46 2.2.10 Crack Stability ................................................................................................ 2-52 2.2.11 Inservice Inspection ....................................................................................... 2-58 2.3 Computational Framework ........................................................................................... 2-63 2.3.1 Computational Core ....................................................................................... 2-63 2.3.2 Input Set ......................................................................................................... 2-85 2.3.3 Preprocessor .................................................................................................. 2-90 3 QUALITY ASSURANCE ......................................................................................... 3-1 3.1 Background .................................................................................................................... 3-1 3.2 Approach ........................................................................................................................ 3-2 3.3 Implementation ............................................................................................................... 3-2 v

3.4 Technical Processes ...................................................................................................... 3-3 3.4.1 Software Development Process ....................................................................... 3-3 3.4.2 Decisionmaking Processes .............................................................................. 3-7 3.5 Supporting Processes .................................................................................................... 3-9 3.5.1 Training ............................................................................................................ 3-9 3.5.2 Procurement Management............................................................................... 3-9 3.5.3 Document Control .......................................................................................... 3-10 3.5.4 Reviews and Audits........................................................................................ 3-10 3.6 Verification and Validation ............................................................................................ 3-11 3.6.1 Process .......................................................................................................... 3-11 3.6.2 Verification Testing......................................................................................... 3-12 3.6.3 Validation Testing........................................................................................... 3-15 3.6.4 Conclusion ..................................................................................................... 3-22 3.7 External Reviews ......................................................................................................... 3-22 3.7.1 Advisory Committee on Reactor Safeguards ................................................. 3-22 3.7.2 External Review Board................................................................................... 3-23 4 UNCERTAINTIES .................................................................................................... 4-1 4.1 Background .................................................................................................................... 4-1 4.2 General Assumptions and Simplifications ...................................................................... 4-2 4.3 Framework Uncertainties ............................................................................................... 4-4 4.4 Model Uncertainties ....................................................................................................... 4-4 4.5 Implicit Uncertainties ...................................................................................................... 4-9 4.6 Summary ........................................................................................................................ 4-9 5 TRIAL INPUTS AND ANALYSES ........................................................................... 5-1 5.1 Scope ............................................................................................................................. 5-1 5.2 Inputs Development ....................................................................................................... 5-2 5.3 Analyses ......................................................................................................................... 5-3 5.3.1 Methodology..................................................................................................... 5-3 5.3.2 Selection of Results ......................................................................................... 5-5 5.3.3 Summary .......................................................................................................... 5-8 6 RECOMMENDATIONS ........................................................................................... 6-1 6.1 Framework ..................................................................................................................... 6-1 6.2 Physical Models ............................................................................................................. 6-1 6.2.1 Crack Initiation ................................................................................................. 6-2 6.2.2 Crack Growth ................................................................................................... 6-3 6.2.3 Stress-Intensity Factors ................................................................................... 6-3 6.2.4 Crack Coalescence .......................................................................................... 6-4 6.2.5 Crack Transition ............................................................................................... 6-4 6.2.6 Crack Stability .................................................................................................. 6-4 6.2.7 Crack Opening Displacement .......................................................................... 6-5 6.2.8 Leak Rate ......................................................................................................... 6-5 6.2.9 Inservice Inspection ......................................................................................... 6-5 6.2.10 Welding Residual Stresses .............................................................................. 6-6 7 CONCLUSIONS ...................................................................................................... 7-1 8 REFERENCES ........................................................................................................ 8-1 vi

GLOSSARY ..................................................................................................... A-1 CONTRIBUTORS ............................................................................................ B-1 SUPPORTING DOCUMENTATION ................................................................ C-1 vii

LIST OF FIGURES Figure 1-1 Illustration of PFM analysis................................................................................. 1-2 Figure 1-2 xLPR V2 project organizational structure ........................................................... 1-7 Figure 2-1 Typical nickel-alloy dissimilar metal weld configuration...................................... 2-2 Figure 2-2 Basic physical representation of piping connection showing the left pipe, right pipe, and weld components ........................................................................ 2-3 Figure 2-3 Cutaway illustration of xLPR V2 components representing inlay and overlay ................................................................................................................ 2-4 Figure 2-4 Illustration of weld component divided into subunits for spatial discretization purposes ....................................................................................... 2-5 Figure 2-5 Model for transition of a surface crack to a TRC to a TWC for (a) circumferential cracks and (b) axial cracks ................................................... 2-6 Figure 2-6 Venn diagrams illustrating the confluence of the three conditions required for (a) general stress-corrosion cracking and (b) PWSCC in PWRs .................. 2-7 Figure 2-7 Division of the plant operating time during a simulation for temporal discretization purposes ....................................................................................... 2-8 Figure 2-8 xLPR V2 modular software architecture ............................................................. 2-9 Figure 2-9 Axial WRS predictions from 14 different analyses and two measurements ..... 2-15 Figure 2-10 Westinghouse steam generator inlet nozzle dissimilar metal weld WRS profile with uncertainties based on analysis of FEA data from four analyses ........................................................................................................... 2-16 Figure 2-11 Experimentally observed and predicted fatigue lives of carbon steels in light-water reactor (LWR) environments without adjustments for actual plant operation .................................................................................................. 2-21 Figure 2-12 Idealized geometry of a cracked pipe: (a) axial surface crack, (b) circumferential surface crack, (c) axial TWC, and (d) circumferential TWC ................................................................................................................. 2-23 Figure 2-13 Predicted and observed crack shapes used for validation of SCSIF and TWC SIF modules ............................................................................................ 2-25 Figure 2-14 Crack geometry predictions compared to laboratory results for surface cracks ............................................................................................................... 2-26 Figure 2-15 Through-wall temperature profile comparison of TIFFANY and FEA results 100 seconds into a transient ................................................................. 2-29 Figure 2-16 Hoop stress profile comparison between TIFFANY and FEA results 100 seconds into a transient ............................................................................ 2-30 Figure 2-17 Illustration of crack coalescence terminology ................................................... 2-36 Figure 2-18 Illustration of convention for a surface crack and a TWC (a) coalescing into a TRC (b) ................................................................................................... 2-37 Figure 2-19 COD model for circumferential TWC in a pipe subject to tension and bending ............................................................................................................. 2-40 ix

Figure 2-20 Typical FEA model (a) with closeup of spider mesh at crack tip (b) used for developing influence functions for the CCOD model................................... 2-41 Figure 2-21 Comparison of ACOD analytical model predictions against FEA results ......... 2-43 Figure 2-22 Comparison of ACOD analytical model predictions against literature values ............................................................................................................... 2-44 Figure 2-23 Four-regime leak rate model with crack morphology effects mapped onto volumetric flow rate versus crack-opening area ............................................... 2-47 Figure 2-24 Two-phase flow through a long narrow crack channel: (a) flow regimes and (b) modeled geometry of flow path ............................................................ 2-48 Figure 2-25 Predicted versus measured leak rates ............................................................. 2-52 Figure 2-26 Example net section collapse geometry and stress conditions for multiple circumferential surface cracks .......................................................................... 2-53 Figure 2-27 Geometry for circumferential TWC stability using net section collapse approach .......................................................................................................... 2-54 Figure 2-28 Representation of reduced section analogy for circumferential TWC stability using EPFM approach ......................................................................... 2-55 Figure 2-29 General POD curve characteristics and notation ............................................. 2-59 Figure 2-30 Example of sizing models for flaws in reactor pressure vessel nozzles showing linear distributions (black lines) with 95-percent confidence intervals (dotted lines) and 1:1 relationships (red lines) ................................... 2-60 Figure 2-31 Graphical summary of POR evaluation ............................................................ 2-61 Figure 2-32 Illustration of nested sampling loop structure ................................................... 2-65 Figure 2-33 Indicator function plot for circumferential cracks .............................................. 2-83 Figure 2-34 Error tracking dashboard for circumferential cracks ......................................... 2-85 Figure 2-35 System Properties worksheet of the input set .................................................. 2-87 Figure 3-1 Spiral model for software development .............................................................. 3-4 Figure 3-2 Service test results for Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld where an axial crack resulted in leakage after 17 years of operation .............................................................. 3-19 Figure 3-3 Benchmark test results comparing time to TWC at North Anna Power Station, Unit 1, steam generator inlet nozzle to safe end weld as predicted by (a) FEA simulation (4.75 years) and (b) xLPR V2 deterministic calculation (3.75 years) .................................................................................... 3-20 Figure 3-4 Benchmark test results comparing xLPR V2, beyond-PRAISE, and PROMETHEUS probabilities of occurrence of first circumferential crack and leak for the Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld .................................................... 3-21 Figure 4-1 Crack morphology at the intersection of axial and circumferential cracks on the inside surface of the reactor pressure vessel outlet nozzle to piping dissimilar metal weld at Virgil C. Summer Nuclear Station, Unit 1 ..................... 4-3 Figure 5-1 Scenario analysis simulation workflow template ................................................ 5-4 x

Figure 5-2 Mean probabilities of circumferential crack rupture with no leak rate detection or ISI for Scenario 3 using various sampling strategies ...................... 5-6 Figure 5-3 Comparison of the mean probabilities of circumferential crack rupture with no leak rate detection or ISI for Scenarios 3 and 10 .......................................... 5-7 xi

LIST OF TABLES Table 2-1 Illustration of spatially variable samples ........................................................... 2-69 Table 3-1 Extent of module verification testing ................................................................. 3-13 Table 3-2 Select PWSCC events in PWR butt welds in the 2000s................................... 3-16 Table 4-1 Key sources of model bias and uncertainty ........................................................ 4-5 xiii

EXECUTIVE

SUMMARY

This report summarizes development of the Extremely Low Probability of Rupture (xLPR)

Version 2 (V2) probabilistic fracture mechanics computer code. The U.S. Nuclear Regulatory Commissions (NRCs) Office of Nuclear Regulatory Research and the Electric Power Research Institute (EPRI) cooperatively developed xLPR V2 to analyze risks associated with nuclear power plant piping systems subject to active degradation mechanisms. xLPR V2 improves significantly upon the initial, proof-of-concept version of the code, which is described in NUREG-2110, xLPR Pilot Study Report, issued May 2012. xLPR V2 is the full-featured version developed and tested under a rigorous quality assurance program and independently reviewed.

The codes core capabilities include modeling of crack initiation and growth due to fatigue and primary water stress-corrosion cracking (PWSCC). The motivation for code development stemmed in part from NRC staff and industry interests in effectively managing PWSCC, a degradation mechanism that can occur in dissimilar metal welds in pressurized-water reactor primary coolant piping systems, and its implications for prior leak-before-break analyses.

Licensees have used these analyses to exclude the dynamic effects of postulated pipe ruptures as allowed by the requirements of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic licensing of production and utilization facilities, Appendix A, General Design Criteria for Nuclear Power Plants, Criterion 4, Environmental and dynamic effects design bases.

The physical piping system is represented in xLPR V2 by a simplified geometry consisting of three main components: one for the weld and the other two for the piping base metals joined by the weld. Optional components are also included to represent inlays and overlays for repairing or mitigating PWSCC. xLPR V2 models the degradation process using two-dimensional cracks with both axial and circumferential orientations. The crack growth process is represented by three idealized crack types. Surface cracks break the inside surface of the pipe only, do not leak, but could still lead to rupture of the pipe. Through-wall cracks extend from the inside surface of the pipe to the outside surface. They may leak, which could lead to detection if the leak rate is high enough, before a rupture of the pipe occurs. The last type, transitioning cracks, are also through-wall and serve as an analytical transfer mechanism between surface cracks and through-wall cracks. Ultrasonic testing during simulated inservice inspections may also detect these three crack types.

The physical processes defining the lifecycle of a weld are simulated within xLPR V2 by sampling from input distributions and propagating the sampled values through a set of deterministic, best estimate models. The crack initiation models calculate the times to when surface cracks would appear in the weld because of fatigue and PWSCC. The crack growth models then calculate propagation of surface cracks through the pipe thickness and around its circumference by these same two mechanisms. Models for calculating stress-intensity factors provide the key fracture mechanics inputs necessary for the crack growth rate calculations.

Because the weld may have multiple cracks, the crack coalescence model determines when smaller cracks should be combined into one larger crack. The crack opening displacement models calculate the width of cracks on the surfaces of the pipe. The leak rate model uses the results to estimate the amount of leakage from each through-wall crack. The transition from a surface to a through-wall crack in fracture mechanics represents an analytical discontinuity that leads to a step change in the calculated leak rates. The crack transition model gradually adjusts the stress-intensity factor and crack opening displacements to more closely approximate the actual behavior of transitioning cracks. The crack stability models calculate whether the pipe xv

ruptures, given the sizes of the cracks present, applied loading, and the strength and resistance to fracture of the piping and weld materials. Finally, the inservice inspection models calculate whether scheduled ultrasonic tests will detect cracks and if they are large enough to require repairs of the weld.

xLPR V2 has a modular design in which a central computational framework links a set of self-contained software modules that implement these physical models. The framework controls the overall simulation and performs the Monte Carlo sampling and accounting tasks necessary for probabilistic analysis. This simulation technique uses multiple trials with randomly sampled inputs to calculate the effects of these uncertainties after they are propagated through the generally deterministic models. The framework, developed in the GoldSim simulation software environment, supports the key probabilistic features of xLPR V2. For instance, the framework provides a wide selection of probability distributions to describe the distributed inputs and provide the capability to specify which inputs are sampled. It also allows for the classification of uncertainties in the inputs as either aleatory, which cannot be reduced, or epistemic, which can be reduced (for example, with additional data). The framework also supports advanced sampling techniques, such as Latin hypercube sampling and importance sampling, which can make the probabilistic simulation more efficient. Finally, the framework serves as the interface with the end user for execution of xLPR V2.

xLPR V2 uses mature, best estimate physical models with well-quantified uncertainties.

However, such models are rarely perfect representations of the underlying physical phenomenon, and the complex nature of the computational processes often requires simplifications to streamline the calculations and to even make the problem tractable. These simplifications contribute to additional model uncertainty, which describes the scatter in model predictions about some mean value, and potential bias, which describes whether a model tends to over- or under-predict the expected mean value. The Monte Carlo sampling technique used in the xLPR V2 framework primarily accounts for uncertainties though the user-defined inputs, but model bias is typically treated as a conservative and deterministic factor. Based on a detailed assessment of model uncertainty within xLPR V2, the primary sources were determined to be associated with the fundamental definition of the modeled effects, limitations in the understanding of how to estimate certain model attributes, and limitations in the underlying data on which the models are based (e.g., number and range of data points). A simplification throughout most of xLPR V2 is that all cracks are assumed to be fully open with a rather simple geometry. This assumption is inconsistent with actual PWSCC, which tends to exhibit a highly discontinuous three-dimensional network of tight cracks, often following grain boundaries.

These differences in actual crack characteristics as compared to the assumed planar, open cracks could lead to overpredictions of crack opening displacements. Complex crack morphology like PWSCC is, however, addressed using semiempirical adjustments to the leak rate model. All circumferential cracks are also conservatively assumed to be coplanar. This assumption made the coalescence proximity rules simpler to apply and meet, and thereby, larger cracks are predicted. Finally, the available PWSCC initiation test data reflect a reasonably high degree of scatter, which corresponds to the current level of mechanistic understanding and the stochastic nature of the underlying phenomena, especially the difference between field and laboratory test results. It is important that these sources of bias and uncertainty be considered within the context of the xLPR V2 validation testing results, field of application, and target acceptance criteria.

Testing of xLPR V2 was conducted for both verification and validation requirements.

Verification testing demonstrated that the computational models accurately represent the underlying mathematical models and their solutions. Validation testing determined whether the xvi

implemented models are a sufficiently accurate representation of the real world within the context of their intended uses. Testing was performed first on all the modules independently and then, to the extent practical, on the computational framework by itself. Finally, the framework and modules were tested together as an integrated software system. This integrated system validation testing involved direct comparisons of xLPR V2 results against PWSCC observed in operating nuclear power plants throughout the world. It also involved benchmarking xLPR V2 results against results from comparable probabilistic fracture mechanics codes and selective comparisons to more accurate finite element analysis simulations of specific crack growth progressions. In total, the code was subject to thousands of tests, with any anomalies being reported, evaluated, and corrected as necessary to support final acceptance of the software system.

xLPR V2 was developed under a rigorous software quality assurance program to support use of the codes results in licensing, rulemaking, design and operating change, and regulatory activities by either industry or the NRC. The quality assurance program was based on requirements in 10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, and was implemented in accordance with the guidance in NRC Regulatory Guide 1.28, Revision 4, Quality Assurance Program Criteria (Design and Construction), issued June 2010. Supplemental guidance and best practices were adopted from internationally recognized software engineering standards. The quality assurance program controlled definition of the software requirements, design, implementation, and testing activities.

These activities are extensively documented in a series of technical reports, which are organized and referenced in Appendix C and summarized in the body of this report.

A diverse team of nearly 80 subject matter experts organized into various work groups contributed to the xLPR V2 developmental effort under the direction of the NRCs Office of Nuclear Regulatory Research and EPRI. The Models Group and the Computational Group completed the bulk of the code development work. Technical subgroups under the Models Group selected the best available physical models and coded them into the appropriate software modules. The Computational Group developed the framework and integrated the modules into the complete software system. Several other groups supported the main software development effort. The Quality Assurance Administration Group prepared, maintained, and oversaw the quality assurance program requirements that governed development of the software and the associated documentation. The Inputs Group developed sample input sets representative of welds susceptible to PWSCC in pressurized-water reactor primary coolant piping systems. The Acceptance Group proposed a set of criteria so that results from xLPR V2 could be evaluated for decisionmaking purposes. These criteria were based on the requirements of 10 CFR Part 50, Appendix A, Criterion 4, to support anticipated initial applications of the code. A Project Integration Board served as an independent review and advisory committee within the project. Finally, an External Review Board provided technical review by nationally and internationally recognized experts who were not directly involved in the codes development.

Many areas were identified for future code enhancements. For example, the simplified crack shape assumptions could be evaluated to determine if more realistic assumptions would reduce the associated biases. Also, the current models for an idealized butt-weld configuration could be expanded to cover other component configurations susceptible to active degradation.

Finally, certain limitations on the computational framework imposed by the GoldSim software should be addressed. Although the NRCs Office of Nuclear Regulatory Research and EPRI carefully decided to use GoldSim software at the conclusion of the xLPR Pilot Study, as the complexity of the framework grew over the course of xLPR V2 development, continued use of xvii

the GoldSim software presented several technical challenges. Overcoming these challenges requires inefficient or elaborate workaround procedures for users and developers. In particular, the framework should be enhanced to (1) support automated software testing, (2) facilitate quick export of sampled input and output values so that they can be examined externally using sensitivity analysis techniques, and (3) increase data storage capabilities to accommodate single-simulation analyses with broader scope and more detail. The framework enhancements should be pursued as a first priority; however, wholesale changes to the framework architecture may be needed to realize these enhancements.

The NRCs Office of Nuclear Regulatory Research and EPRI initiated the xLPR program to develop a probabilistic assessment computer code with results that could be used to demonstrate consistency with the requirements of 10 CFR Part 50, Appendix A, Criterion 4.

This included accounting for the effects of any relevant active degradation mechanisms, such as PWSCC, and associated mitigation activities. The software was intended to be comprehensive with respect to known challenges, vetted with respect to the scientific adequacy of its models and their input parameters, flexible to permit analyses of a variety of inservice situations, and able to accommodate any needed changes as a result of evolving and improving knowledge.

These objectives were fully accomplished as detailed in the balance of this report. The result is a broadly applicable and robust software tool that reflects the state of practice in probabilistic fracture mechanics. Finally, although xLPR V2 was developed with leak-before-break applications in mind, the modular and flexible design of the code also allows it to be used for a wide variety of other piping integrity applications. Examples include use in studying boiling-water reactor piping systems, optimization of inspection and repair or replacement strategies, and study of loss-of-coolant accident frequencies. Further, through modifications, the code could be extended beyond piping applications to other components such as reactor pressure vessels, steam generators, and dry storage cask containers.

xviii

ACKNOWLEDGMENTS The U.S. Nuclear Regulatory Commission (NRC) and the Electric Power Research Institute (EPRI) would first like to thank all the dedicated individuals who served as members of the development team. Development of the xLPR V2 probabilistic fracture mechanics code was a significant endeavor that would not have been possible without the contributions of nearly 80 individuals spanning some 20 different organizations. A complete listing of these individuals and organizations is in Appendix B.

Special gratitude is extended to Dr. David Rudland and Mr. Matthew Homiack of the NRC Office of Nuclear Regulatory Research and to Dr. Craig Harrington of EPRI for their efforts in leading the code development activities. Special thanks also go to Dr. Remi Dingreville of Sandia National Laboratories for his efforts in leading the Computational Group, to Dr. Marjorie Erickson of Phoenix Engineering Associates, Inc., for her efforts in leading the Models Group, and to Ms. Nancy Kyle of Theseus Professional Services for her efforts in leading the Quality Assurance Administration Group.

Additionally, the authors acknowledge the key contributions made by the following members of the development team: Dr. Cedric Sallaberry formerly of Sandia National Laboratories; Mr. Paul Mariner of Sandia National Laboratories; Mr. Kyle Schmitt formerly of Dominion Engineering, Inc.; Mr. Chris Casarez of Dominion Engineering, Inc.; and Mr. Bruce Bishop of Phoenix Engineering Associates, Inc. The authors also appreciate the independent reviews and advice provided by the members of the External Review Board and the Program Integration Board.

Finally, the authors thank the staff of the NRC Office of Nuclear Reactor Regulation for its indepth reviews of the xLPR V2 technical bases. Mr. Robert Hardies, formerly a member of the NRC Office of Nuclear Reactor Regulation staff, is acknowledged for both championing the project and for his efforts in leading the development of the proposed risk acceptance criteria for probabilistic leak-before-break assessments made with xLPR V2.

xix

ABBREVIATIONS AND ACRONYMS ACOD axial crack opening displacement ACRS Advisory Committee on Reactor Safeguards ADAMS Agencywide Documents Access and Management System ASCS axial surface crack stability ASME American Society of Mechanical Engineers ATWCS axial through-wall crack stability AWS American Welding Society C Celsius CCC circumferential crack coalescence CCOD circumferential crack opening displacement CFR Code of Federal Regulations CDF core damage frequency CGR crack growth rate COD crack opening displacement CTWCS circumferential through-wall crack stability DPD discrete probability distribution EFPY effective full-power year EPFM elastic-plastic fracture mechanics EPRI Electric Power Research Institute ERB External Review Board F Fahrenheit FCI fatigue crack initiation FEA finite element analysis FSWOL full structural weld overlay GDC general design criterion GE General Electric Co.

gpm gallons per minute IEEE Institute of Electrical and Electronics Engineers in2 square inches ISI inservice inspection kg/s kilograms per second kPa kilopascal LHS Latin hypercube sampling LOCA loss-of-coolant accident LWR light-water reactor MCSCS multiple circumferential surface crack stability mm millimeter MPa megapascal MSIP Mechanical Stress Improvement Process xxi

NRC U.S. Nuclear Regulatory Commission OWOL optimized weld overlay PCI PWSCC crack initiation PDI Performance Demonstration Initiative PIB Project Integration Board PFM probabilistic fracture mechanics PNR probability of nonrepair POD probability of detection POR probability of repair PRAISE Piping Reliability Analysis Including Seismic Events PROMETHEUS Probabilistic Methods for Evaluating and Understanding Structures PWR pressurized-water reactor PWSCC primary water stress-corrosion cracking QAA quality assurance administration RES Office of Nuclear Regulatory Research SCSCS single circumferential surface crack stability SCSIF surface crack stress-intensity factor SDD software design description SIF stress-intensity factor SRD software requirements description SRP Standard Review Plan SRS simple random sampling SSE safe-shutdown earthquake STP software test plan STRR software test results report TIFFANY Thermal Stress Intensity Factors for ANY Coolant History TRC transitioning crack TWC through-wall crack WRS welding residual stress xLPR Extremely Low Probability of Rupture xxii

1 INTRODUCTION 1.1 Purpose and Organization of This Report Extremely Low Probability of Rupture (xLPR) Version 2 (V2) is a probabilistic fracture mechanics (PFM) code. Its core capabilities focus on the modeling of service-related degradation mechanisms affecting nuclear power plant piping components. The code was jointly developed by the U.S. Nuclear Regulatory Commissions (NRCs) Office of Nuclear Regulatory Research (RES) and the Electric Power Research Institute (EPRI).

This report outlines the process used by the NRC/RES and EPRI to develop the code and describes its underlying theory, basic operation, and applications. Section 1 provides background information on the motivation for undertaking the project. Section 2 presents an overview of the codes structure, operations, and theory. Section 3 describes the software quality assurance approach. Section 4 summarizes the sources and treatment of uncertainties within the code. Section 5 describes the development of trial input sets along with their analyses using the completed code. Section 6 provides recommendations for future development. Section 7 presents conclusions on the effort. Finally, a list of references appears in Section 8. Appendix A provides a glossary of terms used throughout this report. Appendix B lists the individual contributors to the project. Appendix C outlines the supporting documentation and detailed technical bases.

1.2 Introduction to Probabilistic Fracture Mechanics Fracture mechanics is concerned with the basic methods for predicting the load-carrying capabilities of components containing cracks [1]. The technology of fracture mechanics has been applied to fatigue crack growth rate (CGR) assessments, environmental and stress-corrosion cracking, dynamic fracturing, and other problems. These developments have led to the broad use of fracture mechanics and to greater confidence in the design and analysis of fracture-critical structures, such as piping components in nuclear power plants. Historically, fracture mechanics analyses have most commonly been performed deterministically. With this approach, a defined set of fixed input conditions and a single value of fracture toughness are used to estimate the failure stress or critical crack size in a structure. Uncertainties are dealt with through conservative treatments and margins or safety factors.

NRC Standard Review Plan (SRP) Section 3.6.3, Leak-Before-Break Evaluation Procedures, Revision 1, issued March 2007 [2], provides an example of a deterministic fracture mechanics application. The described approach may be used to demonstrate that the probability of piping system rupture is extremely low, thereby permitting the dynamic effects associated with postulated pipe ruptures to be excluded from a plants design basis as permitted under Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic licensing of production and utilization facilities, Appendix A, General Design Criteria for Nuclear Power Plants, General Design Criterion (GDC) 4, Environmental and dynamic effects design bases [3]. Following the guidance in SRP Section 3.6.3, a deterministic leak-before-break analysis is based on the least favorable combination of stress and material properties, and the analysis uses a margin of 10 to determine the detectable leak rate. Under a deterministic framework, which first appeared in NUREG-1061, Report of the U.S. Nuclear Regulatory Commission Piping Review Committee, Volume 3, Evaluation of Potential Pipe Breaks, issued November 1984 [4], and was later incorporated into SRP Section 3.6.3 [5], the NRC staff approved plant-specific leak-before-break analyses for the reactor coolant system main loop piping in all pressurized-water reactors 1-1

(PWRs) as discussed in Regulatory Issue Summary 2010-07, Regulatory Requirements for Application of Weld Overlays and Other Mitigation Techniques in Piping Systems Approved for Leak-Before-Break, dated June 8, 2010 [6]. The NRC has also approved plant-specific leak-before-break analyses for some reactor coolant system branch piping at a limited number of PWRs (e.g., pressurizer surge, safety injection system, residual heat removal system, and reactor coolant loop bypass piping).

Much of what happens in the real world, however, is not so readily represented deterministically with acceptable accuracy, and many factors may introduce uncertainty into a fracture mechanics analysis. For example, as noted in the 2005 Fracture Mechanics Fundamentals and Applications [7], there is often scatter in fracture toughness data such that it is not always appropriate to view the fracture toughness as a single-valued material constant. A structure may also contain several flaws of various sizes, orientations, and locations. In addition, advances in finite element analysis (FEA) of welding processes have led to improved estimates of residual stresses, but there are uncertainties associated with such estimates. To more completely understand these and other uncertainties, stochastic fracture mechanics analyses should be performed rather than only deterministically derived, single-point evaluations. This is the field of application of PFM codes like xLPR.

Figure 1-1 illustrates a simplistic PFM analysis approach. The curve on the left represents the distribution of crack-driving force or applied stress-intensity factor (SIF), which depends on the uncertainties in stress and flaw size. The curve on the right represents the toughness distribution or critical (i.e., allowable) SIF of the material. When the two distributions overlap, there is a finite probability of failure, which is indicated by the shaded area. Time-dependent crack growth, such as from fatigue or stress-corrosion cracking or both, can be considered by applying the appropriate growth laws to the flaw distribution. Flaw growth can cause the applied SIF distribution to shift to the right with time, thereby increasing the probability of failure.

Figure 1-1 Illustration of PFM analysis Source: Adapted from [7, Fig. 9.39]

1-2

As described in the 2005 Fracture Mechanics Fundamentals and Applications [7], the overlap of the two probability distributions shown in Figure 1-1 represents a simple case. In most practical situations, however, there is randomness or uncertainty associated with many variables. Monte Carlo simulation can estimate failure probability in such cases by propagating input values, sampled from distributions representing the uncertainty in those variables, through a deterministic model using numerous trials. The results can then be analyzed using statistical methods to assess the risk of such failures occurring. This is the basic approach used in the xLPR code.

1.3 xLPR Pilot Study In 2009, NRC/RES and EPRI began working to develop technically sound, quality-assured, PFM software (i.e., computer code) with a modular design that could calculate rupture probabilities in reactor coolant system piping. NRC/RES and EPRI formally agreed to implement a cooperative project to define, design, and develop such a PFM code under an addendum to their general memorandum of understanding for cooperative nuclear safety research [8].

The advent of primary water stress-corrosion cracking (PWSCC) was part of the motivation for this project. PWSCC is a degradation mechanism that affects nickel-based alloys in PWRs (e.g., Unified Number System N06082 [9] (American Welding Society (AWS) Classification ERNiCr-3) and W86182 (AWS Classification ENiCrFe-3) [10], collectively called Alloy 82/182).

The mechanism is characterized by a long crack initiation time and a relatively fast CGR.

Activities that highlight the significance of PWSCC around this time include the following:

• The NRC issued several generic communications [11] [12] [13] about PWSCC.

• The NRC revised SRP Section 3.6.3 [2] to clarify that it considers PWSCC to be an active degradation mechanism in Alloy 82/182 materials in PWRs. To qualify for deterministic leak-before-break analysis, direct failure mechanisms like PWSCC, which could challenge the integrity of a piping system, should not be potential sources of piping rupture.

• EPRI completed a comprehensive butt-weld safety assessment [14] in 2006, followed by the issuance of inspection and evaluation guidelines [15] [16]. Industry voluntarily implemented these guidelines under the Nuclear Energy Institutes materials aging management initiative [17], an action that the NRC staff viewed positively and that facilitated the staffs decision to codify requirements following stakeholder input, rather than initiating other reactive regulatory actions [18].

• At the request of the NRC staff [19], the American Society of Mechanical Engineers (ASME) developed alternatives to the requirements in the ASME Boiler and Pressure Vessel Code (ASME Code),Section XI, Rules for Inservice Inspection and Tests of Nuclear Power Plant Components [20], on inspection frequencies for reactor coolant system butt welds containing Alloy 82/182 [12]. ASME subsequently developed and approved ASME Code Case N-770-1 [21], and the NRC incorporated it directly into 10 CFR 50.55a, Codes and standards, in 2011 as an augmented examination requirement [22].

• The effectiveness of ultrasonic testing was increased significantly by incorporating lessons learned from operating experience into examination planning and 1-3

implementation of ASME Code,Section XI, Appendix VIII, Supplement 10, requirements for qualified dissimilar metal weld examinations.

Given the greater NRC and industry emphasis on effectively managing PWSCC, it was fitting to make it an area of focus for modeling with the new PFM code. The code, however, was envisioned to have many uses and could easily accommodate other models and capabilities because of its modular design. Such a code could thus be used to support a wide variety of regulatory and plant operational decisions.

At the outset of the project, NRC/RES and EPRI recognized that development of a sophisticated PFM code that met quality assurance and technical requirements was a complex and challenging undertaking. To support long-term success, they first conducted a pilot study as a proof-of-concept effort. The broad goals for the xLPR Pilot Study were threefold:

(1) Assess the proposed management structures ability to support cooperative and efficient code development and implementation.

(2) Assess the feasibility of developing a modular PFM code that can calculate the probability of rupture for a reactor coolant nozzle weld while properly accounting for problem uncertainties.

(3) Determine the appropriate probabilistic framework for constructing the modular PFM code.

The initial product of this effort was the xLPR Version 1 (V1) code, the name for which was taken from the language in GDC 4 (i.e., extremely low probability of rupture). The basic flow of operations for xLPR V1 centered on a time-based history of events in which PWSCC initiates a crack that grows until failure. It included mathematical models of aspects such as crack initiation, crack growth, crack coalescence, crack stability, crack opening displacement (COD),

leakage, and inspection as detailed in EPRI Report 1022528, Models and Inputs Developed for Use in the xLPR Pilot Study, issued in 2011 [23]. The mathematical models were programmed into software modules, which were linked together through a central computational framework that controlled the progression of the analysis through time and accounted for uncertainties via a Monte Carlo approach. Through the xLPR Pilot Study, NRC/RES and EPRI learned more about the complexity of the problem and the organizational structure needed for successful completion of a more comprehensive software product (i.e., xLPR V2).

With respect to the first goal of the pilot study, the following important project management needs were identified:

• the need for more efficient project organization, management, and decisionmaking processes with specific attention paid to revisiting the review and approval role of the Project Integration Board (PIB)

• the need for a robust quality assurance program covering the entire software development lifecycle with a focus on development of clearly written requirements to use as the basis for subsequent software design, implementation, and testing 1-4

With respect to the second goal of the pilot study, the following important technical needs were identified:

• the need to include models for axial cracks, preexisting surface cracks, and fatigue crack initiation (FCI) and growth for completeness

• the need for more realistic models for welding residual stress (WRS), crack transition, surface crack stability, inspection, and mitigation to produce best estimate predictions

• in such a complex system, the need to consider uncertainty at all levels of development (e.g., model uncertainty and aleatory and epistemic input uncertainties)

• the need for importance sampling to calculate extremely low probabilities and associated processes and procedures for identifying which input variables should be importance sampled To address the third goal of the pilot study, the developers built and evaluated two competing computational frameworks. One framework was built using GoldSim, a commercially available Monte Carlo simulation software. The other framework was built using Structural Integrity Assessment ModularProbabilistic Fracture Mechanics, open source software under development at Oak Ridge National Laboratory. Reports by Sandia National Laboratories [24]

and Oak Ridge National Laboratory [25] describe the two frameworks. The developers used a test case following the work in EPRI Report 1015400, Materials Reliability Program: Advanced FEA Evaluation of Growth of Postulated Circumferential PWSCC Flaws in Pressurizer Nozzle Dissimilar Metal Welds (MRP-216, Rev. 1), issued August 2007 [26], to demonstrate the feasibility of conducting probabilistic rupture analyses with the code and to compare results from the two computational frameworks. The test case results are described in detail in the NRC report xLPR Version 1.0 ReportTechnical Basis and Pilot Study Problem Results, issued February 2011 [27]. Both frameworks were found to produce approximately the same values.

Ultimately, based on an independent comparison of the two potential computational frameworks

[28], a cost analysis, and consideration of the long-term prospects for the code, the project team recommended that future versions of the software be developed using GoldSim.

The completed xLPR Pilot Study, which included not only code development but also trial of the project team structure and detailed analyses of a test problem, demonstrated that it would be feasible for NRC/RES and EPRI to jointly develop a modular PFM code. Based on the success of this effort, NRC/RES and EPRI decided to continue to develop the code, incorporating lessons learned from the pilot study, into the comprehensive xLPR V2, which is the subject of this report. A complete summary of the xLPR Pilot Study is available [29] [30].

1.4 xLPR V2 Project Overview 1.4.1 Project Objectives In 2013, the NRC/RES and EPRI formally launched a project to develop xLPR V2, building on the successes of the xLPR Pilot Study. Under the auspices of a new addendum to their general memorandum of understanding for cooperative nuclear safety research [8], the two organizations established the following objectives at the start of the project:

(1) Develop a robust analysis methodology for evaluating reactor coolant system piping rupture probabilities.

1-5

(2) Select appropriate, technically sound inputs and models to produce best estimate output results with quantified uncertainties.

(3) Develop a computational software tool that applies the inputs and models and appropriately treats epistemic and aleatory uncertainties.

(4) Verify, validate, benchmark, and document the software tool to enable its use in support of licensing, rulemaking, design, and regulatory decisions by both industry and the NRC.

(5) Apply an appropriate set of quality assurance measures to control software development and support future NRC and industry uses of the software in regulatory matters.

The first four objectives were identical to those of the xLPR Pilot Study. Whereas these objectives may have been only partially fulfilled in the pilot study, they were expected to be fully addressed during the xLPR V2 development effort. The fifth goal was added to reflect the transition from a proof of concept to a formal analytical tool.

1.4.2 Project Team Figure 1-2 depicts the structure of the joint NRC/RES-EPRI project team. The team was divided into several functional groups jointly overseen by an NRC/RES project manager and an EPRI project manager. The groups primarily responsible for technical development of xLPR V2 were the following:

• Models Group

• Computational Group

• Inputs Group These groups worked together to identify the necessary mathematical models and input data, develop the detailed analytical methodologies, and assemble all the components into a functioning computational tool. The following groups provided support and oversight:

• Quality Assurance Administration (QAA) Group

• PIB

• External Review Board (ERB)

• Acceptance Group Sections 1.4.2.1 through 1.4.2.7 describe the roles of each group in more detail.

The structure of the project team facilitated effective management and did not prevent team members from raising and resolving dissenting technical opinions. Each group generally had a designated lead who shared responsibilities with a co-lead who also acted as the leads designee when required. Group leadership was balanced such that, if an EPRI-affiliated representative served as the lead, an NRC-affiliated representative served as the co-lead, and vice versa. The remaining participants of each group consisted of representatives appointed by both organizations.

The NRC/RES and EPRI project managers were chiefly responsible for overall project coordination, documentation, communication, and management. They established the customer needs, defined the project team structure and decisionmaking processes, identified resources for the work groups, set and reviewed schedules and milestones, facilitated resolution of technical issues, established the project review structure, and oversaw the quality assurance 1-6

process. They also ensured consistency in the various work groups recommendations for code development, facilitated code verification and validation testing, and otherwise coordinated among the various groups. In the latter part of the project, they were supported by an independent project scheduler who created and maintained a master schedule; implemented other tools for tracking and updating progress, resource allocation, and budget performance; and provided regular progress and status reports.

The members of the project team represented a diverse group of widely recognized experts from the NRC staff, EPRI staff, and contractors to NRC/RES and EPRI. They included engineers, scientists, and mathematicians with expertise in the technical specialties necessary to develop the detailed analytical methodology, identify the necessary input data and mathematical models, and assemble it all into a functioning computational tool. Specific areas of expertise included nuclear power plant design, component geometry, environmental and loading conditions, flaw inspection and assessment, degradation modeling, critical flaw stability and leak rate modeling, software development, and probabilistic acceptance criteria. Other members of the team provided expertise in areas such as project management, quality assurance, and administrative functions. Appendix B lists the individual contributors.

Because they were in different places, the project team members had limited ability to physically interact day to day. Accordingly, the team worked together primarily through conference calls, Web casts, e-mail, and other virtual collaboration tools. Face-to-face meetings were held at important junctures of the project as needed. The team members were encouraged to engage in open, frank, and unrestricted professional discussions of technical issues across the groups and to use structured decisionmaking processes when necessary. Overall, the groups worked well individually and collectively in a collegial manner.

NRC Project Manager EPRI Project Manager Quality Assurance Project Integration Administration Group Board External Review Board Models Computational Inputs Acceptance Group Group Group Group Figure 1-2 xLPR V2 project organizational structure 1-7

1.4.2.1 Models Group The Models Group selected the necessary physical models, documented and coded them into computer subroutines (software modules), then tested each one, all in accordance with the established software quality assurance requirements. xLPR V2 relies on these models to collectively represent the relevant physical phenomena, such as crack initiation, growth, and stability for both fatigue and PWSCC degradation mechanisms, as well as leak rates and inservice inspection (ISI). The Models Group also identified and quantified uncertainties in the models.

To select and develop the necessary models, the Models Group was split into the following subgroups that focused on specific technical topics:

• WRS Subgroup

• Crack Initiation Subgroup

• K-Solutions Subgroup

• Thermal Stress Intensity Factors for ANY Coolant History (TIFFANY) Subgroup

• Crack Growth Subgroup

• COD Subgroup

• Crack Transition Subgroup

• Leak Rate Subgroup

• Crack Stability Subgroup

• ISI Subgroup The subgroups identified the most relevant models available to suit the requirements of the xLPR V2 developmental effort. In selecting models, the subgroups primarily considered the extent to which the model was supported by data and quantified uncertainties that would support validation activities, and whether any intermediate or final results would be sensitive to the model. The subgroups also considered whether the models had been vetted by standards development organizations or published in peer-reviewed journals. These activities would supplement the formal quality assurance activities and enhance the overall quality of the code.

Secondary considerations focused on efficiency (e.g., whether the model had already been implemented into software and whether it had a quick runtime, especially when iterative solutions were required). If an existing model was not available, the subgroup developed a best estimate model based on the state of practice. Each subgroup implemented the selected physical models into one or more software modules. The exception was the WRS Subgroup, which developed input tables of through-thickness WRS values for various dissimilar metal weld configurations and conditions. Section 2.2 further describes the Models Groups contributions to the project.

1.4.2.2 Computational Group The Computational Group defined the requirements for, documented, developed, and tested the central computational framework (the Framework) for the code in accordance with the established software quality assurance requirements. It developed and implemented the logic to appropriately link all the models together, passing the required inputs and outputs between all elements of the code throughout the simulation. It also identified uncertainties within the Framework and developed the sampling techniques used to account for uncertainties in the inputs and model parameters. Section 2.3 further describes the Computational Groups contributions to the project.

1-8

1.4.2.3 Inputs Group The Inputs Group developed sample input sets representative of several dissimilar metal welds in actual PWR coolant systems, primarily to support code development and testing but also to support code applications, as appropriate. It collected data and developed associated distributions to quantify uncertainties in the various input parameters. These input parameters included thermal and mechanical steady-state and transient loads, piping geometry, weld fabrication methods, operating conditions, and material properties. The group was also responsible for determining the best format for supplying input data to the code. Section 5 further describes the Inputs Groups contributions to the project.

1.4.2.4 Quality Assurance Administration Group The QAA Group prepared and maintained the software quality assurance program documentation and supported program implementation. It was also primarily responsible for the electronic configuration management system. In addition, the QAA Group oversaw implementation of the quality assurance program and verified that all team members followed the established quality assurance protocols. Section 3 describes the QAA Groups contributions to the project.

1.4.2.5 Project Integration Board The PIB served as an internal review and advisory committee. Whereas a 12-member PIB provided general project oversight and direction for the xLPR Pilot Study, because of the inefficiencies in this approach, these responsibilities were reassigned to the NRC/RES and EPRI project managers, and the PIB was repurposed as an advisory committee for xLPR V2 development. The PIB was given a broad mandate to review all aspects of the codes technical bases and to advise on developmental, procedural, or technical issues it identified as being important to the success of the project. The board consisted of five senior-level individuals who had the knowledge and experience needed to advise such an effort. Some of the PIBs important contributions included a vertical slice review of the treatment of uncertainties, identifying the need for improved schedule tracking, assessing options for code maintenance and distribution, and developing the alternative professional view resolution process described in Section 3.4.2. The PIB report presents a detailed description of the PIBs activities [31].

1.4.2.6 External Review Board The ERB provided additional technical review by nationally and internationally recognized experts who were not directly involved in the code development. The review board consisted of five members with expertise in nuclear power plant piping system design, metallurgy, structural integrity assessment, development of large-scale computer codes, probabilistic and risk modeling, and welding. Section 3.7.2 further describes the ERBs contributions to the project.

1.4.2.7 Acceptance Group The Acceptance Group used the framework in Regulatory Guide 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, issued May 2011 [32], to explore the development of potential failure frequency acceptance criteria for assessing xLPR V2 analysis results against the requirements of GDC 4. However, these recommendations were prepared only to inform the xLPR V2 developmental effort. The NRC will establish the acceptance criteria for GDC 4 and 1-9

other xLPR V2 applications separately. For reference, Acceptance Criteria, dated October 28, 2016, contains the Acceptance Groups recommendations and rationale [33].

1-10

2 CODE STRUCTURE, OPERATION, AND THEORY This section describes the design, operations, and underlying theory of xLPR V2.

2.1 Introduction to the xLPR V2 Code 2.1.1 Features xLPR V2 is a feature-rich PFM code for piping applications. For both axially and circumferentially oriented cracks, it can model the following:

• fatigue initiation and growth

• stress-corrosion cracking (i.e., PWSCC) initiation and growth

• preexisting surface cracks (e.g., crack-like manufacturing defects present before plant operation)

• effects of WRS

• seismic events

• thermal and mechanical transients

• chemical mitigation by changes to the concentrations of zinc and hydrogen

• mechanical mitigation by application of inlay, overlay, or the Mechanical Stress Improvement Process (MSIP)

• leak rates and leak detection

• ISI from ultrasonic inspections accounting for probabilities of detection and repair

• changes to normal operating conditions (e.g., temperature, pressure, and applied loads) that may occur over a plants operating history Probabilistic features of xLPR V2 include the following:

• wide range of available probability distributions for inputs

• separation of aleatory and epistemic uncertainties

• advanced sampling techniques, such as Latin hypercube sampling (LHS) and importance sampling

• spatial variability

• input correlation 2-1

2.1.2 Problem Representation 2.1.2.1 Problem of Interest The class of real-world problems that xLPR V2 was designed to study involves failure probabilities associated with butt-weld degradation in nuclear power plant piping caused by stress-corrosion cracking and fatigue. Physically, these problems are complex. As illustrated in Figure 2-1, they involve multiple materials of construction and complex fabrication sequences with potentially adverse implications for crack initiation and growth mechanisms that are active given the environments and loading conditions of interest. In addition, the role of leak detection, crack stability, inspection, mitigation, and repair must also be considered. The relevant physical elements of these degradation mechanisms have been heavily studied. However, there is a general lack of leak and rupture events caused by these mechanisms in operating nuclear power plant piping systems. Some leaks caused by PWSCC have been observed, but not enough is known about all the material, fabrication, and service factors contributing to those leaks to properly support model development and benchmarking.

Figure 2-1 Typical nickel-alloy dissimilar metal weld configuration Source: Adapted from [26, Fig. 1-2]

To model such phenomena, the developers of xLPR V2 had to rely on studies of postulated cracks and data from cracks initiated and grown in laboratory conditions. This involved decisions on which physical mechanisms to include in the models in the code, how best to mathematically represent these mechanisms, and what level of granularity in the models was necessary to include without overwhelming the computational system. Additionally, accounting for the stochastic nature of the problems required definition of probability distributions to represent all significant input variables, including model parameter uncertainty, and knowledge of how these distributions could change over a plants operating time. Faced with the possibility of tracking and saving a significant amount of information during a simulation, it was essential 2-2

for the developers to make choices, assumptions, and simplifications in defining the problem in a way that would provide confidence in the results without the models being either too simplistic or computationally excessive.

2.1.2.2 Problem as Represented Geometry and Materials xLPR V2 represents the real-world piping connection using a basic, three-component geometry as shown in Figure 2-2. One component represents the weld and the other two represent the piping components joined by the weld (base metals). The base metals are termed left pipe and right pipe. Two additional components are available for modeling inlays and overlays, as depicted in Figure 2-3, which can be used for PWSCC mitigation as described in Section 2.1.2.2.7. All the components have a uniform thickness and diameter. A distinct material type can be represented on each component, which facilitates the modeling of dissimilar metal welds. Material behavior is characterized by a set of parameters covering strength, including Ramberg-Osgood stress-strain parameters, fracture toughness, crack initiation, and crack growth.

Weld Left Pipe Right Pipe Figure 2-2 Basic physical representation of piping connection showing the left pipe, right pipe, and weld components 2-3

Overlay Inlay Figure 2-3 Cutaway illustration of xLPR V2 components representing inlay and overlay Principal Orientations All the mechanics in xLPR V2 are modeled in two dimensions, and there are two principal orientations, circumferential and axial.

The circumferential orientation is a single plane parallel to the transverse section of the pipe located at the center of the weld. The axial orientation includes multiple planes extending radially from the center of the pipe. These conventions mean that circumferential cracks are limited to the weld component. Axial cracks begin in the weld component but may grow into the adjoining base metals.

Spatial Discretization To model the effects of multiple cracks, the weld component is divided circumferentially into a user-defined number of subunits, which is limited to 30 for computational performance considerations. Figure 2-4 shows this spatial discretization as illustrated in the Crack Initiation Subgroup report [34]. Each of the subunits can contain one axial crack and one circumferential crack; therefore, up to 60 cracks could be modeled in a single simulation. This discretization is also used to represent the inherent heterogeneity in the materials.

2-4

Equal Length Subunits Figure 2-4 Illustration of weld component divided into subunits for spatial discretization purposes Source: [34, Fig. 1]

Crack Shapes Cracks are represented in xLPR V2 with three simplified shapes: (1) surface crack, (2) transitioning crack (TRC), and (3) through-wall crack (TWC).

Figure 2-5 illustrates these shapes in both the circumferential and axial orientations as described in the Crack Transition Subgroup report [35]. The developers chose not to include embedded cracks because they are not as influential as surface cracks in welds susceptible to PWSCC. However, embedded cracks are more influential in components where fatigue is the dominant degradation mechanism.

2-5

(a)

(b)

Figure 2-5 Model for transition of a surface crack to a TRC to a TWC for (a) circumferential cracks and (b) axial cracks Source: [35, Fig. 2]

All the crack shapes are also modeled two dimensionally. The surface crack breaks the inside surface of the pipe and has an idealized, semielliptical shape. This type of crack can eventually cause leakage if it progresses into a TRC or TWC, but while it is modeled as a surface crack, there is no pathway for leakage. Thus, this type of crack cannot leak. The TWC extends from the inside surface of the pipe to the outside surface and has an idealized shape with equal inner and outer crack angles in the case of circumferential cracks, and equal inner and outer lengths in the case of axial cracks. The TRC serves as an analytical bridge from a surface crack to a TWC to better represent the transitional behavior of actual cracks. Both a TWC and a TRC can cause leakage, and all three crack types can be detected by ultrasonic testing techniques or can cause a rupture of the pipe.

Applied Loads The applied loads or stresses include steady-state normal operating, transient, and safe-shutdown earthquake (SSE) conditions. The steady-state normal operating conditions include pressure from the fluid inside the piping, deadweight, and sustained thermal loads.

They also include the WRS at steady-state normal operating temperatures, which is defined in both the axial and circumferential orientations using up to 26 points through the thickness of the weld. This approach provides enough accuracy for the crack initiation and growth calculations by including key points on both the inside and outside surfaces of the weld and at intermediate points every 4 percent through the thickness of the weld. The transient conditions include cyclic thermal and mechanical events (e.g., an operating-basis earthquake) expected to occur over the plant operating time and are thus conservatively bounded in the plant design basis. These transients contribute to both crack initiation and growth. SSE conditions are treated separately 2-6

from these transients because they are assumed not to contribute to crack initiation or subcritical crack growth; they are considered in only some of the crack stability calculations.

Crack Evolution After a crack initiates, it grows because of the applied loads and other conditions until a rupture occurs or the simulated plant operating time ends. Circumferential and axial cracks grow strictly in their respective planes. This representation means that an axial crack can never grow into another axial crack. Growth of axial cracks is symmetrical, such that the center of the crack is always coincident with the weld center plane, as further explained in Section 2.3.1.2.8. As an analytical simplification, all circumferential cracks are assumed to initiate in a single plane and thus can coalesce. Coalescence may occur more readily because of this assumption. As an additional simplification, there is no interaction between circumferential and axial cracks.

Finally, PWSCC and fatigue crack growth are assumed to occur independently, with the separate effects of each added together.

Mitigation The industry has developed several PWSCC management strategies for reactive application, as in a repair scenario, and for proactive application, as in a mitigation scenario. Each strategy addresses at least one of the three key parameters required for PWSCC initiation and growth (see Figure 2-6), involving either changes to the material exposed to the environment, the reactor coolant system environment itself, or the local stresses experienced by the susceptible material. xLPR V2 can model the effects of applying these mitigation techniques.

(a) (b)

Figure 2-6 Venn diagrams illustrating the confluence of the three conditions required for (a) general stress-corrosion cracking and (b) PWSCC in PWRs MSIP [36] employs a hydraulically operated clamp to generate a favorable compressive stress pattern. Laboratory testing and service experience demonstrate that nickel-alloy weld metals made of Unified Number System N06052 (AWS Classification ERNiCrFe-7) [9], W86152 (AWS Classification ENiCrFe-7) [10], and N06054 (AWS Classification ERNiCrFe-7A) [9] materials, commonly called Alloy 52/152, are less susceptible to PWSCC. An inlay [37] removes a 2-7

shallow band of the original Alloy 82/182 PWSCC-susceptible material around the inside surface of the piping and replaces it with weld deposited with Alloy 52/152 material, which acts as a barrier to the reactor coolant. Overlays act in the opposite manner. A full structural weld overlay (FSWOL) [38] retains the original Alloy 82/182 PWSCC-susceptible weld material but deposits on the outside surface of the piping a welded reinforcement that is fully capable of supporting the design loads. An optimized weld overlay (OWOL) [39] is similar but relies on the outer 25 percent of the original piping wall thickness to support the design loads and imposes inspection requirements to verify and maintain that design assumption. FSWOL and MSIP are the most widely used techniques in U.S. PWRs; OWOL and inlay techniques are used to a much lesser extent. Finally, zinc injection and hydrogen concentration optimization alter the environment inside the pipe to respectively reduce PWSCC initiation and growth rates.

Temporal Discretization The user sets the plant operation time, typically to reflect the calendar time over which the weld would be expected to be in service. It reflects the period over which cracks could initiate, grow, leak, rupture, and be detected by ISI. The plant operation time is divided in several ways, as illustrated in Figure 2-7 using a hypothetical plant operation time of 1 year for simplicity. The most granular division is the time step. At every time step, xLPR V2 performs calculations to simulate the crack evolution process. The size or state of the crack is updated as a result of these calculations, and then the simulation advances to the next time step. The default time step is 1 month based on sensitivity studies [24]; however, it can be set to more coarse or more granular values (e.g., 1 year or 1 day) to accommodate specific analysis needs or to investigate the temporal convergence of the results of interest. Higher level divisions of the plant operating time are made to accommodate long-term changes in normal operating conditions and applied mitigations. During these intervals, the operating conditions are assumed to be constant.

Based on the user-defined normal operating period and mitigation settings, appropriate fixed time intervals are assigned within the code for use in the simulation.

Plant Operation 1

Time, yr Time Step, mon 1 2 3 4 5 6 7 8 9 10 11 12 Normal Operating 1 2 3 Period Zinc Mitigation Zn1 Zn2 Concentration, Zn Mechanical Unmitigated Mitigated Mitigation Time Interval 1 2 3 4 5 Figure 2-7 Division of the plant operating time during a simulation for temporal discretization purposes 2-8

2.1.3 Basic Design and Operation xLPR V2 has a modular architecture with a central Framework supported by a suite of modules.

These modules implement the mathematical models used to represent various physical and assessment aspects of the relevant cracking processes and associated analytical calculations.

Figure 2-8 illustrates the modular design of xLPR V2.

Crack Initiation Modules ISI SIF Module Modules Crack CGR Stability Modules Module Framework Crack Leak Rate Coalescence Module Module COD Crack Transition Modules Module Figure 2-8 xLPR V2 modular software architecture The Framework links the modules together, provides the logic for code execution, and houses the data generated during code execution. It also provides the interface between the user and the code for both inputs and outputs. Perhaps more importantly, the Framework implements the probabilistic features of xLPR V2 by propagating uncertainties from the user-defined probability distributions through the physical models in accordance with the user-defined sampling strategy, uncertainty characterizations, and specified number of realizations. The Framework also performs postprocessing operations on the data generated from a simulation.

The Framework has three main components: (1) computational core, (2) input set, and (3) preprocessor. The computational core is primarily implemented through the GoldSim commercial off-the-shelf software. GoldSim, developed by GoldSim Technology Group, provides a user-friendly, feature-rich Monte Carlo simulation software solution for dynamically modeling complex systems in engineering, science, and business [40]. GoldSim provides a highly graphical, object-oriented programming environment that displays the program logic and linkage between code elements in a readily understood manner. The developers selected GoldSim for the xLPR V2 Framework because of its range of available features, general compatibility with the goals of the project, ease of use and code maintenance, and ability to 2-9

easily incorporate externally coded modules [41]. The input set provides the structure for setting options and defining the inputs for a simulation. The input set is implemented in Excel, which is an industry-standard spreadsheet application developed by Microsoft Corporation [42].

The Excel Add-In feature is used to run the preprocessor, which retrieves certain data from the input set and generates leak rate and transient SIF data lookup tables. The computational core interpolates values from these lookup tables during the simulation. The preprocessor is written in C#, which is a general-purpose, multiparadigm programming language also developed by Microsoft Corporation [43]. Section 2.3 provides further information on the components of the Framework. These components were developed and tested under the quality assurance program described in Section 3.

The modules are identified below and organized by topic of the deterministic physical models that each one implements:

• crack initiation models:

o PWSCC crack initiation (PCI) module o fatigue crack initiation (FCI) module

• SIF models for crack growth:

o surface crack SIF (SCSIF) module o TWC SIF module o TIFFANY

• crack growth models: CGR module

• crack coalescence models: circumferential crack coalescence (CCC) module

• COD models:

o axial COD (ACOD) module o circumferential COD (CCOD) module

• crack transition models: crack transition module

• leak rate models: leak rate module

• crack stability models:

o axial surface crack stability (ASCS) module o axial TWC stability (ATWCS) module o single circumferential surface crack stability (SCSCS) module o multiple circumferential surface crack stability (MCSCS) module o circumferential TWC stability (CTWCS) module

• ISI: ISI module The modules are all written in Fortran 77 and Fortran 90. Fortran is a general-purpose, compiled, imperative programming language that is especially suited to numeric computation and scientific computing [44]. Additional information on the physical models is available in Section 2.2. The modules also were developed and tested under the quality assurance program described in Section 3.

Basic operation of the code proceeds as follows:

• The user inputs simulation options and other parameters in the input set.

• The user runs the preprocessor to produce additional input data in the form of lookup tables.

• The user sets certain simulation options and runs the simulation using the computational core.

2-10

• The computational core reads in the inputs.

• The computational core samples the input values and performs the necessary calculations for each realization by calling the various modules.

• The computational core performs postprocessing statistical calculations.

• The user views the results and any simulation errors or warnings through dashboards in the computational core.

2.2 Physical Models The physical models are all deterministic and implemented across 17 modules, except for the WRS models which are implemented within the Framework. Sections 2.2.1 through 2.2.11 describe the models by topic area. The descriptions summarize the underlying theory for each model, important assumptions and their effects, implementation of theory into software, connection to other components of the software, and validation. Each module was also subject to a host of verification tests, as summarized in Section 3.6.2.1. The exception was the WRS profiles, as they are included in xLPR V2 as user inputs as opposed to an actual model. Thus, there was no module verification testing.

2.2.1 Welding Residual Stresses Because WRS can drive crack initiation and growth, its characterization and quantification are dominant factors in calculating probabilities of leak and rupture. WRS measurements are difficult to conduct, not generally suitable for components in service, and include a high degree of uncertainty. There are several generally accepted methodologies that use FEA models for predicting WRS profiles. However, even for rigorously controlled and documented welding processes, there is large modeler-to-modeler variability in results, and field weld documentation in operating plants is much less detailed. In summary, there is no single, generally accepted methodology for defining a WRS profile, and the user is responsible for determining an appropriate WRS profile to input for a given xLPR V2 analysis.

In defining WRS profiles and associated uncertainties for select configurations, the WRS Subgroup applied rigorously developed guidance to minimize the impacts of these inherent uncertainties, as discussed in the following subsections. The reader is referred to the WRS Subgroup report [45] for a more detailed description.

2.2.1.1 Theory Using FEA models, four experienced analysts developed WRS profile estimates. The analysts developed WRS profiles for three generic PWR dissimilar metal weld configurations, including weld repair effects. The specific configurations were as follows:

• Case 1: a reactor pressure vessel outlet nozzle to safe end weld in a Westinghouse four-loop PWR

• Case 2: a cold-leg piping to reactor coolant pump inlet safe end weld in a Babcock and Wilcox PWR

• Case 3: a safe end to steam generator inlet nozzle weld in a Westinghouse four-loop PWR 2-11

These generic configurations were chosen because they are representative of a large portion of the relevant weld configurations and enough information was available to provide the analysts with the necessary detailed component drawings, weld deposition details, and material properties for the thermal and structural analysis.

The WRS Subgroup formulated modeling procedures for the analysts to follow when creating their FEA models. These procedures were informed by experience in related research programs by NRC [46] and EPRI [47] [48]. The analysts adherence to these procedures ensured that the analysts were consistent in handling the details that the WRS Subgroup considered important, such as heat input, thermal boundary conditions, weld bead geometries, and materials. Other modeling details were left to the discretion of the individual analysts.

WRS profiles, including repairs, were developed for each of these welds using commercial FEA software. Repairs in this context refer to grinding out the initial weld to a certain depth and then rewelding it before the component is put into service. Each analyst defined and modeled the repairs independently, but all repairs were modeled as originating from the inside surface to depths of 15 percent and 50 percent of the pipe thickness. Each analyst used his or her own numerical techniques to solve for the WRS. The recommended WRS profiles for each component were then compiled by taking a weighted average of the four predictions and associated uncertainties.

Finally, the effects on WRS were estimated based on literature solutions for the mechanical mitigation methods used in PWRs, namely FSWOL, OWOL, MSIP, and inlay. The mitigated WRS profiles were developed by applying a set of rules to the corresponding, unmitigated WRS profiles. WRS profiles were also obtained from the literature on other welds exhibiting field experience with observed cracking to enable validation testing as discussed in Section 3.6.3.2.

These WRS profiles were for welds at Virgil C. Summer Nuclear Station, Unit 1; Ringhals Nuclear Power Plant, Unit 4; North Anna Power Station, Unit 1; and Tsuruga Nuclear Power Plant, Unit 2.

Uncertainty in the WRS profiles was estimated from the FEA data using statistical approaches.

The WRS profiles were represented at 26 locations evenly distributed through the thickness of the weld. Analysis of the data showed that a normal distribution best represents the uncertainty at each of these locations. The expected value at each location was then estimated as the arithmetic mean from the FEA data. The standard deviation was similarly evaluated at each location; however, the average standard deviation for all locations was determined to be a more appropriate measure of uncertainty. A weighting approach was used in a few cases to reduce unrealistically large uncertainties resulting from outlier data.

2.2.1.2 Assumptions and Their Effects Several sources of uncertainty affect the analytical determination of WRS that are not directly accounted for in the WRS profile characterization methods used by the WRS Subgroup. These sources of uncertainty include the following:

• thermal and physical material constant variability for the thermal analyses

• heat input and weld torch speed

• weld bead sequence and size

• structural material property variability (e.g., nonlinear stress strain curves)

• elastic property variations along with coefficient of thermal expansion

• weld interpass temperature 2-12

• strain hardening law (e.g., kinematic, isotropic, or mixed)

Based on the experience of the WRS Subgroup members, along with results from sensitivity studies performed as part of previous studies [49] [50], the subgroup determined that the weld bead sequence, heat input, and structural material property variability were the most important sources of uncertainty. The WRS Subgroup performed a series of additional sensitivity studies to understand their effects.

Structural material property variability was found to be the most important source of uncertainty; however, it could not be included because of a lack of data at high temperatures. Statistically significant yield stress data were available only at room and plant operating temperatures, and the temperature-dependent stress-strain curves used in the FEA models were estimated from these data. Although structural material property variability was found to be important, the WRS Subgroup considered it to be smaller by an order of magnitude when compared to the modeler-to-modeler uncertainty. Thus, the subgroup recommended structural material property variability estimated from ultimate stresses and based on high-temperature data, should this information become available, as a potential area of further study.

The choice between kinematic and isotropic strain hardening is known to play a role in WRS development. The WRS Subgroup decided that a mixed hardening solution most accurately represented the material behavior, so each analyst provided separate solutions using isotropic and kinematic hardening. The average of the two solutions was then used to provide results that are representative of mixed hardening.

A key, generic assumption involved the use of two-dimensional, axisymmetric FEA models to develop the WRS profiles. In the actual welding process, the weld bead traverses the full circumference of the pipe as each pass is deposited, whereas in the axisymmetric model, each pass is deposited all at once. However, results from three-dimensional analyses show that the WRS fields away from the welding start and stop locations compare reasonably well with results from two-dimensional, axisymmetric analyses. This is also the case for weld repairs, except near the start and stop locations of the repair.

2.2.1.3 Interfaces All the WRS profiles are user-defined inputs expressed as a function of depth through the thickness of the weld from the inside to outside surfaces of the weld. The Framework then combines the WRS with the other normal operating stresses and executes all the necessary stress calculations; therefore, there is no module for WRS. The final stress state is then passed via the Framework to these modules:

• PCI module

• FCI module

• SCSIF module

• TWC SIF module

• ACOD module Note that WRS is considered only in surface crack growth and axial TWC growth. In contrast to the surface crack growth stresses, the through-wall axial stresses for circumferential crack growth do not include WRS because of the self-balancing behavior of the assumed axisymmetric model. Likewise, WRS is not included in the CCOD calculations. It is included in 2-13

the ACOD calculations, but the effect is reduced as the size of the crack approaches the full extent of the weld area.

All WRS profiles are input in tabular form representing up to 26 points through the weld thickness. Based on scoping studies, it was decided that representing the WRS profiles with uncertainty at 26 points at the weld centerline provides sufficient resolution for crack-driving force calculations. A point-to-point correlation is enforced to eliminate the possibility of an unrealistic sawtooth profile that could result from independently sampling the distributions of values at each of the points. For scenarios involving mechanical mitigation, the user must provide both a pre- and post-mitigation WRS profile. The Framework handles sampling and updates to the WRS profile for mitigation events, as appropriate.

2.2.1.4 Validation Measurements were not directly used to validate the WRS profiles developed by the WRS Subgroup. Rather, the four analysts experience in accurately determining WRS profiles was validated against predictions of a larger group of 14 analysts and several deep hole-drilling measurements made on a nozzle mockup. It was expected that the results from the 14 analysts would bound the predictions of the four analysts from the WRS Subgroup.

FEA modeling of the welding processes accounts for stress at points through the pipe thickness that result from the thermal cycling as weld beads are deposited and cooled. The following are several key parameters for performing the calculations:

• heat input

• number of weld passes

• weld pass deposition sequence

• material property statistical variations

• hardening laws For older plants, there are often no data on the first three items, and therefore, the choices made for an analysis depend on the analyst. Material properties have a smaller impact, but different analysts will have differing material property data, which can introduce additional uncertainty. Perhaps the largest impact is the choice of the hardening law, either isotropic, kinematic, or a mixture of the two. From a theoretical standpoint, mixed hardening best represents measured stresses most of the time, especially for multiple pass welds typical in nuclear power plants. However, the material parameters necessary for mixed modeling are often not known with confidence. These factors contributed to the scatter observed in the data collected from the 14 analysts, while the WRS Subgroup took care to eliminate these sources of variability.

Figure 2-9 shows the results from the 14 analysts, and Figure 2-10 shows typical results from the four subgroup analysts. The range of variability observed for the 14 analysts is approximately 400 megapascals (MPa) at all points through the thickness, whereas the range for the 4 analysts is closer to 50 MPa. In both cases, few of the results showed any consistent bias through the thickness. Instead, the results showed large point-to-point variability. The much lower range in point-to-point variability observed in the results from the four analysts is expected because of the more prescriptive methodology they applied. The variability observed in results from the four analysts is also expected to better represent the variability in point-to-point, through-thickness WRS profiles arising from weld process and material property variability.

2-14

The variability in the data from the 14 analysts provided valuable information that was used as the basis for devising the more prescriptive process by which the WRS profiles on components of interest were developed for use in xLPR V2. The data from the 14 analysts also provided the basis for developing the methods used to characterize uncertainty in WRS profile predictions and for determining the sampling strategy used to account for this uncertainty in the Framework.

Figure 2-9 Axial WRS predictions from 14 different analyses and two measurements Source: Adapted from [45, Fig. 113]

2-15

Figure 2-10 Westinghouse steam generator inlet nozzle dissimilar metal weld WRS profile with uncertainties based on analysis of FEA data from four analyses Source: Adapted from [45, Fig. 58]

2.2.2 Crack Initiation The ability to forecast crack initiation times and locations is critical when predicting leaks and ruptures in piping systems. That is, to properly predict crack growth and eventual leakage, an accurate representation of the formation of cracks is necessary. The modeling of the crack initiation process represents a significant enhancement over prior deterministic leak-before-break methods. In xLPR V2, crack initiation by PWSCC and fatigue are calculated by the PCI and FCI modules, respectively. The reader is referred to the Crack Initiation Subgroup report [34] for a more detailed description of these modules.

2.2.2.1 Theory The crack initiation modules determine when a crack will initiate for a specific volume of material and crack orientation (i.e., axial or circumferential). Within xLPR, initiation refers to formation of a crack of engineering scale that is amenable to analysis using fracture mechanics principles.

As part of determining the times to crack initiation, the Framework partitions the plant operating time into intervals. These intervals are established based on user-defined changes in simulation parameters that are relevant to crack initiation, such as operating pressure and temperature, WRS, and zinc concentration in the reactor coolant. Multiple crack initiations are handled by dividing the weld circumference into multiple subunits as shown in Figure 2-4. The Framework simulates crack initiation by calling the appropriate crack initiation module at least once for each subunit. The initiation modules can calculate initiation times for axial or circumferential cracks, but they can consider only a single orientation at a time. The calculation 2-16

accommodates conditions that change from interval to interval by calculating the initiation time under fixed conditions representing each interval (normalized to one) and then determining the fraction of the total time to initiation represented by the current interval. The resulting damage accrues in time until the cumulative damage becomes greater than or equal to unity, which indicates that crack initiation has occurred. The partial damage in the interval is then used to calculate the initiation time.

The PCI module includes three different models for PWSCC initiationDirect Model 1, Direct Model 2, and a Weibull model:

(1) Direct Model 1 calculates initiation time as a function of temperature and surface stress.

This model uses an Arrhenius equation and has a power law relationship to surface stress to calculate the time to crack initiation for a given set of parameters [51] [52] [53].

If the surface stress is less than a given stress threshold, then no damage accumulates, and a crack does not initiate.

(2) Direct Model 2 is based on EPRI Report 1019032, Stress Corrosion Cracking Initiation Model for Stainless Steel and Nickel Alloys, issued November 2009 [54]. It calculates initiation time directly as a function of temperature, surface stress, level of cold work, and other mechanical properties of the material. As with Direct Model 1, this relationship uses an Arrhenius model but incorporates surface stress through a logarithmic relationship. In this model, a threshold stress is calculated based on the materials yield and ultimate tensile strengths. If the surface stress is less than the stress threshold, then no damage accumulates, and a crack does not initiate. Similarly, this model calculates a maximum stress. If the surface stress is greater than the maximum stress, a crack initiates immediately at the start of the time interval. Otherwise, if the surface stress is greater than or equal to the threshold stress and less than or equal to the maximum stress, the time to crack initiation is calculated for the given parameters.

(3) The Weibull model calculates initiation time by sampling from a Weibull distribution [55]

with parameters that are a function of temperature, surface stress, and the number of subunits. For this model, the initiation time within a subunit is determined by sampling from the Weibull distribution defined by a parameter developed in accordance with analysis from the 1996 edition of The New Weibull Handbook [56]. An initiation time is always calculated if the surface stress is greater than zero.

The FCI module calculates initiation by determining the number of cycles needed for a fatigue crack to initiate, given the material parameters and component conditions. The underlying models are based on the probabilistic fatigue life curves developed by Argonne National Laboratory [57] [58] [59] [60]. From these curves, a probabilistic relationship is derived to determine the number of cycles needed to achieve initiation. Once the number of cycles needed to initiate a crack is determined, an initiation time can then be calculated using a Miners Rule method based on the number of cycles in each time interval and the duration of the interval.

The Framework populates an initiation table at the beginning of each realization for all subunits, degradation mechanisms, and crack orientations selected by the user. When both fatigue and PWSCC initiation are selected, they are determined independently, and the earliest initiation in each subunit by either mechanism is applied. Subsequent growth is considered independently from the initiation mechanism. Each subunit may have only a single initiation in each orientation. The circumferential locations of the initiated crack centerlines within a subunit are 2-17

calculated by sampling uniformly over the circumferential bounds of the subunit. The axial location of the initiated circumferential and axial cracks is assumed to be at the weld center.

2.2.2.2 Assumptions and Their Effects The models employed by the PCI and FCI modules are based on several simplifying assumptions. The developers viewed most of these assumptions as having no or negligible impact on the results of the modules, given their roles within the overall context of the xLPR V2 software, especially when the models are used with the calibrated model parameters. Of note, however, are two assumptions that affect the overall uncertainty of the PCI module:

(1) The initial crack size distribution was either taken directly or inferred from measured inspection data used to develop the PCI model parameters. The smaller cracks were assumed to be planar and congruent such that they could be represented by one continuous crack that is idealized by the maximum depth and length. This assumption is expected to underpredict the initiation time.

(2) The PCI module was calibrated to a set of combined field and laboratory data assuming 19 subunits [61]. Use of the module outside the range of calibration may increase bias and uncertainty.

2.2.2.3 Interfaces The initiation modules accept inputs for several initiation-relevant, potentially time-dependent conditions (e.g., surface stress, temperature, and water chemistry) and return the initiation time and location for each resulting crack. The Framework calls the modules to develop initiation times and circumferential locations within each subunit for the orientations and degradation mechanisms selected by the user. These calls occur before entering the time loop.

Before calling the PCI or FCI modules, the Framework partitions the simulation time into intervals corresponding with user-defined changes in relevant operating conditions, such as operating temperature, pressure, and normal operating loads; WRS; component thickness; and zinc concentration. For each call to the crack initiation modules, several inputs and model parameters are required for defining component and environmental attributes for each specific subunit during the specific time interval. Some of the model parameters vary spatially and are sampled several times per realization to represent the inherent heterogeneity in the material.

Without such representation, cracks could occur at the same time within all subunits. The Framework calculates these inputs, passes them, and receives the results by subunit for the time interval. Incremental damage is calculated for each subunit and time interval and is then used to calculate the accumulated damage over time.

The user can specify whether to model PWSCC initiation, fatigue initiation, or both. Along with the specific inputs required for each model, some inputs are required for all the initiation models.

These inputs include the number of subunits, number and duration of the time intervals, and the component material and properties. For PWSCC initiation, the user-defined inputs include zinc concentration, surface stress, and temperature. Additionally, the user can edit the model parameters for each of the three PWSCC initiation models. However, recommended model parameters based on a calibration study [61] are provided. For fatigue initiation, the user-defined inputs include the number of subunits, number and duration of the time intervals, component material properties, sulfur content, and the number of transients and their parameters. Additionally, the user can edit all fatigue initiation model parameters; however, 2-18

recommended model parameters are provided [34]. The outputs of the crack initiation modules are the crack initiation time and location within each subunit for each active orientation.

2.2.2.4 Validation The crack initiation models were separately validated.

PCI Models Validation of the PWSCC initiation model parameter inputs included subset analyses and sensitivity analyses. Goodness-of-fit analyses were also completed to validate that the fitted distributions represent the underlying data. In addition, validation was performed against international field experience and laboratory data. The technical report on PWSCC initiation model parameter development, confirmatory analyses, and validation [61] contains more information on these statistical analyses, the datasets used, and the results.

The subset analyses examined aspects of the U.S. PWSCC field detection data to determine whether alternative failure time model parameters might better predict initiation times, where failure time is defined as the time to crack initiation. These subsets were used to consider crack orientation, component, and geometry as possible factors affecting initiation model parameter definition. In all three cases assessed, the best estimate parameters for the subsets were not statistically different from the parameters developed from the full dataset; therefore, use of the parameters developed from the full dataset (i.e., U.S. and international field and laboratory data) was recommended.

The sensitivity analyses included several tests to investigate the sensitivity of base case results to selected input and modeling assumptions. Various input and modeling conventions were used to test the base case and were demonstrated to have only limited influence on the model predictions. However, it was found that the conventions used to determine near-surface stress are critically important to the resulting model parameters. The convention of calculating the near-surface stress as a function of key component parameters and including near-surface stress uncertainty is superior to neglecting such stress effects altogether or assuming a fixed, near-surface stress.

Goodness-of-fit analyses were performed to validate the models by comparing their results to those of industry detection data. Two goodness-of-fit analyses were used on all three models, and a Weibull plot confirmation was used for the Weibull model. The goodness-of-fit analyses included Kaplan-Meier and Kolmogorov-Smirnov statistical tests. A common qualitative check for goodness-of-fit for failure time models is to compare the derived failure time model survival function against the Kaplan-Meier survival function. The Kaplan-Meier survival function is a nonparametric empirical estimate for the survival function of censored failure time data [62].

Kolmogorov-Smirnov tests were completed to render quantitative results. The Kolmogorov-Smirnov test is a nonparametric test of equality for cumulative distribution functions or, likewise, survival functions [63]. These tests showed good agreement out to 100 years. The Weibull plot analysis showed that the confidence intervals of the model appropriately bound the data and that there is a slight bias relative to the data. A greater under-prediction bias is present for the earliest initiations.

The model parameters were also validated through statistical analyses of an independent dataset composed of international operating experience. The results of these statistical analyses show that, for all three models, initiation is generally predicted more often by the model than by the international operating experience data out to 100 years. Finally, validation 2-19

included an investigation of initiation data from laboratory tests. This validation effort was like that used for the international data. Because of the inherent differences in the data, agreement between the models developed using field data and the laboratory initiation time data is generally poor. This outcome can be attributed to the drastically different crack detection capabilities of the two datasets. In addition, the use of cold-worked specimens in the laboratory tests contributed to the disparity in the initiation times.

FCI Models Because of the lack of fatigue cracking operating experience, the dataset used for validation of the FCI models for low-alloy steels, carbon steels, wrought and cast austenitic stainless steels, and nickel alloys was taken directly from NUREG/CR-6909, Effect of LWR Coolant Environments on the Fatigue Life of Reactor Materials, issued February 2007 [64]. Argonne National Laboratory used the experimental results in NUREG/CR-6909 to develop independent fatigue life models for these materials. For validation purposes, NUREG/CR-6909 provides plots of the experimental data which can then be compared against the predicted lifetimes, where fatigue life is defined as the number of cycles a specimen can sustain before the formation of a crack. Of note, the effects of surface finish, load history, and calibration were not included in NUREG/CR-6909; however, these model parameters are available in xLPR V2 to address uncertainties associated with actual plant operating conditions. Figure 2-11 shows the validation results for the carbon steel model. The lifetimes predicted by the model show good agreement with the experimental values, with more than 95 percent of the data falling within a factor of 2. The models for low-alloy, stainless, and nickel alloy steels showed similar agreement between the test data and model predictions.

2-20

Figure 2-11 Experimentally observed and predicted fatigue lives of carbon steels in light-water reactor (LWR) environments without adjustments for actual plant operation Source: [34, Fig. 15]

2.2.3 Operational Stress-Intensity Factors The SIF represents the driving force for crack growth in a linear-elastic material. It is mathematically related to the stress field local to a crack tip and often denoted by the variable K. After a crack has initiated, the SIF is a necessary input to the CGR module, which determines the CGR. Under normal operating conditions, the SCSIF and TWC SIF modules calculate the SIFs. The reader is referred to the K-Solutions Subgroup report [65] for a more detailed description of the modules.

2.2.3.1 Theory Fracture mechanics is based on a mathematical description of the characteristic stress field that surrounds any crack in linear-elastic material [1]. If the region of plastic or permanent deformation around a crack is small, the SIF characterizes the stress field around the crack tip.

The SIF is a function of the remotely applied stress, characteristic crack size dimension, and a geometry factor as determined from linear-elastic stress analysis. The SIF is thus a single parameter that captures the effects of the applied stress and the crack size. The SIF can be considered as the driving force for crack growth. The material fracture toughness resists this driving force. When the applied SIF exceeds the material toughness, crack growth and failure 2-21

may occur. However, in most metallic materials, yielding at the crack tip occurs before failure, and analysis of small-scale yielding can be used to define a unique factor that is proportional to the local crack tip stress field outside the small crack tip plastic zone. This concept provides a basis for defining a critical SIF for the onset of crack growth that depends on a material property. In general, when the in-plane dimensions of the crack are large enough relative to the size of the plastic zone, the value of the SIF at which crack growth begins is referred to as the plane strain fracture toughness of the material. The plane strain fracture toughness is a true material property in the same sense as is the yield strength. Subcritical crack growth, that is, crack extension without immediate failure, can take place under certain conditions when the applied SIF is less than the critical SIF for the material. Such conditions include fatigue loading (including corrosion fatigue) and stress-corrosion cracking.

Many SIF solutions found in handbooks, such as American Petroleum Institute (API) 579-1/ASME FFS-1, Fitness-for-Service, issued June 2007 [66], are based on FEA results.

Finite element modeling is a resource-intensive process, so the handbook solutions allow for the accurate, practical application of linear-elastic fracture mechanics to engineering problems.

Within the context of a PFM code, closed-form solutions like those found in handbooks are ideal for achieving computational efficiency. Figure 2-12 schematically illustrates the crack geometries that are of interest for xLPR V2. The handbook solutions provide the SIF at the deepest point and surface point of surface cracks. The figure also illustrates that the crack geometries are idealized. That is, surface cracks are represented as semielliptical shapes, and TWCs are represented as rectangles.

2-22

Deepest point Surface point Deepest point Surface point (a) (b)

(c) (d)

Figure 2-12 Idealized geometry of a cracked pipe: (a) axial surface crack, (b) circumferential surface crack, (c) axial TWC, and (d) circumferential TWC Source: Adapted from [65, Figs. 2-6 and 2-7]

The SCSIF module calculates the operational SIFs for surface cracks. By calculating the SIFs at the deepest and surface points, a surface crack may be grown in both the length and depth directions based on the driving force at the respective locations. This approach has been compared with more advanced crack growth simulations and has gained widespread industry acceptance [67]. The SIF solutions are based on a weight function approach [68] and existing handbook solutions [66]. The weight function approach is desirable because it eliminates the need for a polynomial fit to the WRS profile, which can be inaccurate [69].

The TWC SIF module calculates the operational SIFs for TWCs. Here, the SIF is taken to be the average of the SIF values at five points: (1) inside surface, (2) 25-percent through-wall 2-23

depth, (3) 50-percent through-wall depth, (4) 75-percent through-wall depth, and (5) outside surface. The validity of a single, thickness-averaged SIF in this application is closely related to the assumption of straight crack fronts for TWCs. The data supporting the TWC SIF module include FEA results and influence coefficients from handbook solutions [70]. For TWCs, the normal operating stresses dominate crack growth. Thus, the required stress input is a uniform hoop stress for axial cracks and membrane and bending stresses for circumferential cracks.

For axial cracks, the hoop WRS is averaged over the wall thickness and included in the uniform hoop stress input. For circumferential cracks, the axial WRS is not included because of the self-balancing behavior of the assumed axisymmetric WRS profile.

2.2.3.2 Assumptions and Their Effects The models employed by the SCSIF and TWC SIF modules are based on several simplifying assumptions. The developers viewed most of these assumptions as having no or negligible impact on the results of the modules, given their roles within the overall context of the xLPR V2 software. Of note, however, are three assumptions that have unknown effects:

(1) For TWCs, the SIF is averaged through the wall thickness. This treatment is based on engineering judgment and expected to have a negligible effect.

(2) For TWCs, the effect of stress gradients, such as from WRS and thermal gradients, on the SIF is not considered. This treatment is based on engineering judgment because, within the constraints of the project, it was not practical to develop closed-form equations to account for stress gradients.

(3) The SCSIF and TWC SIF modules were validated against only experimental data for subcritical crack growth due to fatigue for circumferential cracks. The results showed good agreement, but they were limited by the experimental data available at the time.

No validation was performed for axial cracks.

2.2.3.3 Interfaces The Framework executes the SCSIF and TWC SIF modules from within the time loop. The SCSIF module is called for both circumferential and axial cracks when the crack type is registered as a surface crack. The TWC SIF module is called for both circumferential and axial cracks when the crack type is registered as a TRC or TWC. After performing a series of validity checks on the inputs, the module calculates the geometry-dependent influence coefficients through closed-form equations produced from curves fit to discrete data. Otherwise, the module would have to perform more computationally expensive linear interpolation from lookup tables.

User-defined inputs to the SCSIF and TWC SIF modules consist of the pipe geometry, crack geometry, and the loads or stresses including WRS. While the user may define these inputs initially, the Framework may also manipulate the inputs as the simulation advances. For instance, the crack geometry may change because of PWSCC, or fatigue crack growth, or both.

As another example, a specified mitigation event may alter the WRS profile or even the pipe geometry in the case of an overlay. The Framework tracks these events and supplies the updated input values to the SCSIF and TWC SIF modules as appropriate.

The SCSIF module outputs SIFs for the surface and deepest points for surface cracks. The TWC SIF module outputs average SIF values for TWCs. The Framework provides these SIF values to the CGR module to perform the crack growth calculations. However, for TRCs, the Framework first applies a correction factor determined by the crack transition module to account 2-24

for the nonidealized crack shape. The Framework also outputs the calculated SIFs directly to the user for the first five axial and circumferential cracks.

2.2.3.4 Validation The developers validated the SCSIF and TWC SIF modules by comparing fatigue crack growth predictions using these modules and the crack transition module against experimental data from circumferentially cracked pipes. Figure 2-13 shows examples of how the predicted circumferential crack front shapes in red compare with measurements from the literature [71]

[72] in grey. While SIF calculations cannot be validated directly, comparisons of crack growth predictions using the SCSIF and TWC SIF modules against laboratory results provide an indirect means of validation.

Figure 2-13 Predicted and observed crack shapes used for validation of SCSIF and TWC SIF modules Source: [35, Fig. 27]

Figure 2-14 shows example results from the validation exercise for surface cracks. The various curves shown in the figures correspond to tests with varying pipe geometries, initial crack sizes, and loading conditions. Overall, the validation work demonstrated that fatigue crack growth predictions using the SCSIF and TWC SIF modules are reasonable compared to the experimental data.

2-25

Figure 2-14 Crack geometry predictions compared to laboratory results for surface cracks Source: [35, Fig. 25]

2.2.4 Transient Stress-Intensity Factors Temperature gradients resulting from changes in fluid temperature cause stresses within the walls of the reactor coolant system piping. These stresses, referred to as radial gradient thermal stresses, are a significant contributor to fatigue crack growth. The Thermal Stress Intensity Factors for Any Coolant History (TIFFANY) code [73] was designed to calculate radial gradient thermal stresses due to a change in the fluid temperature as a function of time, which are used by the FCI module. It also determines the cyclic SIFs, which are used by the CGR module. TIFFANY uses the same code of the SCSIF and TWC SIF modules for calculation of the SIFs and is implemented as a preprocessor that outputs lookup tables that are imported by the Framework. The reader is referred to the TIFFANY Subgroup report [74] for a more detailed description of the module.

2.2.4.1 Theory The necessary information for calculation of the cyclic SIFs due to reactor coolant temperature excursions is typically the temperature-time history of the coolant. From this information, the time history of the radial variation of temperature within the pipe wall can be determined by accounting for the heat conduction aspect of the problem. The stresses are calculated using relationships derived from elasticity theory for axisymmetric bodies subject to axisymmetric temperature fields. Once the stresses are known, the resulting SIFs for surface cracks are evaluated using influence functions. Both axial and circumferential cracks are treated. The cyclic SIFs are found from the temporal variation of the SIFs. Important additional features of TIFFANY include consideration of convective heat transfer and the ability to treat the influences of cladding, inlays, or overlays on both the temperature fields and stresses.

The TIFFANY analysis for a given transient is composed of many discrete steps. The first of these steps computes the transient temperature field. When the reactor coolant temperature changes, a temperature gradient in the pipe wall is created and changes with time. To define this temperature field, TIFFANY assumes the temperature is constant along the length of a pipe and that the gradient is axisymmetric. This leads to the formulation of a one-dimensional heat 2-26

conduction problem that is a function of time and radial distance from the pipe inner surface.

For this heat conduction problem, a convection heat transfer boundary condition is applied at the inner surface of the pipe, and an insulated boundary condition is applied at the outer surface. With these assumptions and boundary conditions, the temperature in the pipe wall can be numerically calculated using a finite difference procedure that utilizes second-order correct differing for spatial terms and a first-order correct backward differing of the temporal term.

Using this method and considering material interfaces (e.g., cladding, inlay, or overlay) with continuity conditions, a system of simultaneous equations for the current temperature at each radial node is derived. These equations, which are based on material properties, geometry, and temperature from the previous time step, are then solved by the method of successive substitutions.

Once the time-dependent temperature gradient has been calculated, the next step in the TIFFANY analysis is to evaluate the stresses induced in the pipe wall because of these gradients. The stresses are evaluated by use of elasticity theory from the transient temperature field. Because of the simplification used in the thermal solutions reducing the problem to a one-dimensional radial relationship, the thermal stress calculation becomes a relatively simple, one-dimensional, quasi-static elasticity problem as defined by Timoshenko and Goodier [75].

For these calculations, the axial strain is taken to be constant (not zero) at any instant and equal to a value that produces a zero net axial load. Additionally, TIFFANY uses the boundary condition of zero radial stress at the inner and outer pipe wall and continuity of displacements and radial stress at the material interfaces. Finally, for multiple pipe materials, the effective elastic modulus and Poissons ratio are calculated as a weighted average of the cross-sectional areas and corresponding property values for the materials.

TIFFANY also includes the cyclic stress effects of thermal transients other than the radial gradient stresses. These temperature-dependent thermal stresses consider the effects of restraint of thermal expansion, which can change during a thermal transient due to a change in the average temperature through the pipe wall. These additional thermal stresses include only the deviation from the stresses at normal operating temperature. TIFFANY takes the inputs of a tension stress and a bending stress for a given temperature along with the temperature at which these values are applicable and uses them as the nonpressure global stresses at the given temperature. The circumference of the pipe is then broken down into a user-defined number of subunits, and the global bending stress is varied from subunit to subunit.

TIFFANY also accounts for the stresses due to two additional transients. The first are stratification transient stresses, or the global change in membrane and bending stresses due to thermal stratification. TIFFANY accounts for stratification transients by determining the change in SIFs due to the bending stress at each angular location around the pipe. Finally, the stresses due to mechanical transients, such as an operating-basis earthquake, are accounted for by input of maximum and minimum membrane and bending stresses, which are then used to generate tables of the changes in maximum and minimum SIFs for the selected crack sizes and for the angular location of each subunit.

Once the effect of the radial gradient thermal stresses and other transients (e.g., pressure, mechanical, and stratification) are evaluated, the SIFs for surface cracks and TWCs are then assessed. SIF values are evaluated for any crack size and for any time at which the stresses are evaluated during the transient for the deepest and surface points of both surface cracks and TWCs. Once these values are calculated, the minimum and maximum SIFs are tabulated for each set of crack sizes and at each angular location (for circumferential cracks only).

2-27

2.2.4.2 Assumptions and Their Effects The models employed by TIFFANY are based on several simplifying assumptions. The developers viewed most of these assumptions as having no or negligible impact on the results of the module, given its role within the overall context of the xLPR V2 software. However, there are three assumptions that have more notable effects:

(1) Material behavior is linear-elastic. The effects of through-wall thermal gradients and pressure-driven stresses are impacted by highly constrained material behavior, which can increase the stresses. The effect is an overprediction of the SIF values.

(2) Certain material properties are independent of temperature. This assumption may result in some bias with temperature, but the effect is expected to be minimal.

(3) The SIF solutions are for long cylinders with axisymmetric boundary conditions. This assumption neglects the thickness variability in actual nozzle-to-pipe dissimilar metal welds, which provides additional constraint.

2.2.4.3 Interfaces TIFFANY is called by the preprocessor. The output of TIFFANY is used as input for the fatigue initiation and growth calculations.

The user must provide the inputs for TIFFANY for each transient in the simulation. These inputs include the thermal and mechanical material properties, component geometry, reactor coolant thermal properties, reactor coolant flow rate, and the initial and final temperatures and pressures of the transient. The preprocessor provides the number, geometry, and location of the cracks to be evaluated.

The outputs of TIFFANY consist primarily of arrays of the maximum and minimum SIF for each crack evaluated. These arrays account for every allowed crack geometry at every location and include the SIFs for both the deepest and surface points of the crack. Additional outputs include the rise times; maximum and minimum inside surface stresses and times at which they occur; maximum and minimum inside surface temperatures and times at which they occur; and the maximum membrane, bending, and pressure stresses.

The preprocessor organizes the TIFFANY outputs into lookup tables, and the Framework interpolates from the lookup tables during the simulation. The interpolated SIF values are used in the CGR module to perform the fatigue crack growth calculations. In the case of TRCs, correction factors calculated by the crack transition module are applied to account for the nonidealized crack shape. The rise times, temperatures, and stresses are used in the FCI module to perform the fatigue initiation calculations.

2.2.4.4 Validation To validate the TIFFANY models, the stress and temperature results were compared with FEA results. Two different thermal transients were modeled using FEA, and the temperatures and radial gradient thermal stresses were compared against the TIFFANY results. Excellent agreement between the two set of results was observed; Figure 2-15 and Figure 2-16 show examples.

2-28

Figure 2-15 Through-wall temperature profile comparison of TIFFANY and FEA results 100 seconds into a transient 2-29

Figure 2-16 Hoop stress profile comparison between TIFFANY and FEA results 100 seconds into a transient 2.2.5 Crack Growth In xLPR V2, the CGR module calculates the CGRs. It predicts CGRs due to stress-corrosion cracking and fatigue in various materials of interest using the SIFs calculated by the SCSIF, TWC SIF, and TIFFANY modules. Extensive efforts were made to derive best estimate model parameters and uncertainties for each model. The reader is referred to the Crack Growth Subgroup report [76] for a more detailed description of the CGR module and the factors included in the models.

2.2.5.1 Theory Stress-Corrosion Cracking According to the 1996 ASM Handbook [77], stress-corrosion cracking occurs when three conditions are met simultaneously: (1) a specific crack-promoting environment must be present, (2) the metallurgy of the material must be susceptible to stress-corrosion cracking in that environment, and (3) the tensile stresses must be above a practical threshold value. Material factors such as the alloy composition and microstructure have a great effect on the susceptibility of a material to stress-corrosion cracking in an environment. For instance, the alloy composition may affect the formation and stability of a protective film on the surface. Because susceptibility to stress-corrosion cracking for any given alloy is environment specific, environmental parameters must also be in specific ranges for cracking to occur. These include, but are not 2-30

limited to, temperature, pH, electrochemical potential, and solute species and their concentrations. Changing any of these environmental parameters may significantly affect the crack nucleation process or the rate of crack propagation. Also, conditions inside the crack tip are often quite different from the bulk environmental parameters. Mechanical factors, such as residual stresses, are also important in determining the susceptibility to stress-corrosion cracking. In PWR reactor coolant systems, the stress-corrosion cracking phenomenon affecting nickel-based alloys is called PWSCC.

The general functional form of the stress-corrosion cracking CGR model in xLPR V2 incorporates the dependence on the magnitude of the crack tip SIF beyond the threshold SIF raised to an exponent with a classical Arrhenius relationship to describe the CGR temperature dependence. Additional semiempirical factors, such as for dissolved hydrogen, component-to-component variability, within-component variability, alloy, and crack orientation, have been included to accommodate known CGR effects in Alloy 82/182 and Alloy 52/152 materials. The PWSCC growth factors are based primarily on investigations performed under the EPRI Materials Reliability Program [78] [79] [80] [81]. These factors can be set to unity when not present or when otherwise not applicable. Each model factor was developed independently, resulting in differences in the scaling factors used to account for material, alloying, and orientation variability. As the model has a general functional form, it is also capable of evaluating CGRs in other materials (e.g., austenitic stainless steels) that can be described by a similar thermally activated stress-intensity-driven CGR dependency.

Fatigue According to the 1996 ASM Handbook [82], fatigue is the progressive, localized, and permanent structural change that occurs in a material subjected to repeated or fluctuating (e.g., cyclic) strains at nominal stresses that have maximum values less than, and often much less than, the static yield strength of the material. Fatigue may culminate in crack initiation and growth that may cause fracture after enough cycles. Macroscopically, the simultaneous action of cyclic stress, tensile stress, and plastic strain causes fatigue damage. If these conditions are not present, a fatigue crack will not initiate and grow. The sequence of fatigue failure in a metal initially free of cracklike flaws starts with the formation of microcracks followed by coalescence and growth into macrocracks that grow until the fracture toughness of the intact material is exceeded and final fracture occurs. Additionally, as described in the ASM Handbook [83],

corrosion-assisted fatigue refers to the phenomenon of cracking in materials under the combined actions of fatigue loading and a corrosive environment. The primary characteristic of corrosion-assisted fatigue is that the CGRs may be substantially elevated by many chemical and electrochemical variables not present in a benign environment (e.g., air). In xLPR V2, fatigue CGRs are evaluated for mechanical and thermal corrosion-fatigue conditions.

The xLPR V2 fatigue CGR model includes distinct forms for three material classes: (1) nickel alloys, (2) wrought and cast austenitic stainless steels and associated weld metals, and (3) general ferritic steels. The origins of these three model forms are also different. Like the PWSCC CGR models, the fatigue CGR models were developed semiempirically using data from controlled laboratory studies. The fatigue CGR models all use a Paris power-law relationship with an SIF range that includes a scaling factor. The differences in the models arise from other dependencies accounted for within each model and how those dependencies are defined.

The fatigue CGR model for nickel alloys has submodels for fatigue in air and corrosion-assisted fatigue. The fatigue in air submodel accounts for dependencies on alloying, temperature, and 2-31

load ratio. The corrosion-assisted fatigue submodel modifies the fatigue CGR in air to account for the effects of the environment in enhancing the CGR. Like the nickel-based alloy CGR model, the fatigue CGR model for austenitic stainless steels uses the Paris power-law relationship with SIF and includes temperature, load ratio, and alloy-specific adjustments.

Different from the nickel-based alloy CGR model, the model does not have separate submodels for fatigue in air and corrosion-assisted fatigue. Instead, the contribution of environmental conditions is built into the scaling factor and the loading rise time effect term. The fatigue CGR model for ferritic steels is generally applicable to carbon steels, low-alloy steels, and their associated weld metals. The model uses a Paris power-law dependency on SIF range and includes terms to account for environmental effects, load ratio, loading rise time, and the sulfur content of the steel. The environmental factor, Paris power-law exponent, and sulfur-dependent load ratio exponent are varied to represent the differences in CGRs between that observed for fatigue in air and that observed for corrosion-assisted fatigue. The underlying analysis included a wide range of CGR measurement data spanning various temperatures, loading rise times, and sulfur contents.

General Additional modeling steps are required to combine the CGR predictions for stress-corrosion cracking and fatigue and to calculate the resulting amount of crack growth. The mathematical models for stress-corrosion cracking CGR constitute nonlinear ordinary differential equations for crack extension because the SIF is a nonlinear function of crack shape and size. These equations are solved numerically using an explicit fixed-time forward Euler method where the nominal integration time step for solving the equations is user defined. The mathematical models for fatigue CGR defined for different material classes give crack extension on a per cycle basis, which can be converted to CGRs by multiplying by the number of cycles per unit time. After this conversion, the same time integration method as described for stress-corrosion cracking is applied. The net CGR at each integration time step is the sum of the stress-corrosion cracking and the fatigue CGRs for each active transient component. In general, the net CGR is then integrated over time by the Framework to determine the amount of crack growth. To permit practical runtimes, CGRs and the resulting crack growth are modeled at only a few key locations along the crack front, using three idealized crack shapes. For surface cracks, the key locations are at the inside surface and deepest points. TRCs are defined using a trapezoidal shape, and the key locations are at the two inside surface tips and at the two outside surface tips. Together, these four locations are enough to update the crack shape. For TWCs, the key locations are at the inside surface and outside surface crack tips, and an average is taken.

2.2.5.2 Assumptions and Their Effects Many of the assumptions made in the development of the CGR module arose to simplify the problem being addressed. In some cases, the simplifying assumptions were made to address areas in which information may have been lacking (e.g., knowledge of the exact field conditions being represented). The primary assumptions and their effects on the output of the CGR module are described below.

All the CGR models are physically based and empirically derived. As such, they are only as accurate and representative of field conditions as the underlying datasets used in model development. The physical problem of PWSCC and fatigue crack growth in PWR environments is complex, and not all dependencies are known or can be modeled. Thus, there may be missing functional dependencies in the models. For example, cold work affects the CGR, but 2-32

specific levels of cold work may not be known for field components. Therefore, the models did not directly account for cold work. While such factors were not explicitly included as model parameters, the data used in model development span a range of material properties and cold work, and thus these factors are implicitly included in the uncertainty of the CGR calculations.

Despite a lack of validation, low SIFs are assumed to have little effect on crack growth because the initial crack depths are representative of macroscopic flaws. Using idealized crack shapes and limiting CGR solutions to a few, specific crack front locations are assumed appropriate for modeling CGR around the entire crack front length. This assumption significantly reduces the time required to solve for crack growth in each crack and is appropriate for capturing the maximum CGRs. The crack shapes defined in xLPR V2 are sufficiently representative of the physical stages of cracking to ensure little bias in CGR values resulting from this assumption.

Stress-corrosion cracking and fatigue are assumed to act independently. In materials susceptible to both mechanisms, the CGR due to each is calculated separately, and the results are summed to obtain a total CGR. This approach is consistent with ASME Code,Section XI, guidelines for flaw evaluation, as well as with laboratory data in which both fatigue loading and steady-state PWSCC conditions were used.

Axial and circumferential crack growth is assumed to occur independently, and out-of-plane crack growth is not considered. Realistically, loading is mixed mode, and crack growth will occur along the paths of highest loading and greatest susceptibility to result in a highly branched, three-dimensional structure. However, these assumptions are expected to have a minimal effect.

Material interfaces are treated as absolute in that the material at the crack front is treated as either entirely weld metal or base metal relative to properties and models used. No special considerations are made for crack growth along interfaces of the weld and base metal.

2.2.5.3 Interfaces The CGR module accepts inputs that describe the material at the crack tips, loading conditions, environmental conditions, and model calibration parameters. The user-defined material controls which CGR model is used for calculating the total CGR at the current crack tip locations. The loading conditions of interest include the normal operating load SIFs, minimum and maximum SIFs, loading rise time, and number of cycles per unit time. The environmental conditions include the transient time, operating temperature, minimum and maximum transient temperatures, reactor coolant hydrogen concentration, number of transients, and time step.

The model parameters and some input variables are sampled and provided by the Framework directly to the CGR module. The SCSIF and TWC SIF modules calculate the SIFs needed to determine the stress-corrosion cracking CGRs. The minimum and maximum SIFs, minimum and maximum temperatures, and loading rise times needed for the fatigue CGR calculations are calculated from the TIFFANY lookup tables generated by the preprocessor. In addition, the crack transition module calculates scaling factors to apply to the SIFs for TRCs.

The stress-corrosion cracking CGR model comprises many parameters that define its trends and uncertainties. The model has a general form irrespective of the material, and stress-corrosion cracking behavior of different materials can be simulated by varying the model parameters appropriately. The user can specify stress-corrosion cracking CGR model parameters for each distinct material group involved in the simulation. However, extensive efforts were made to derive best estimate quantities and uncertainties for the model parameters for PWSCC in nickel-alloys due to its significance. The Framework performs the bookkeeping 2-33

necessary to ensure that the CGR module is called with the appropriate stress-corrosion cracking CGR parameters for the different crack tip material locations.

The CGR module includes three independent, material-specific models describing fatigue crack growth, each with unique model parameters. The CGR module applies the model that is appropriate for the material at the current crack tip location, as specified by the user-defined material group input. The model parameters are varied to simulate fatigue behavior of different materials within a material group. The user can specify fatigue CGR model parameters for each distinct material group involved in the simulation. The Framework performs the bookkeeping to ensure that the CGR module is called with the appropriate fatigue CGR parameters for the different crack tip material locations.

2.2.5.4 Validation The PWSCC CGR models were validated with both field and laboratory data not used in model development. These sources included the following:

• Ringhals Nuclear Power Plant, Unit 3, PWSCC growth experience recorded between 2000 and 2002 at a reactor pressure vessel outlet nozzle-to-safe-end Alloy 182 butt weld

• PWSCC growth experience recorded by Électricité de France S.A. between 1991 and 1996 at Alloy 600 reactor pressure vessel head penetration nozzles

• U.S. plant PWSCC growth experience recorded from 1994 at Alloy 600 control rod drive mechanism penetration nozzles

• laboratory PWSCC CGR testing in Alloy 600 and Alloy 82/182 performed outside the EPRI Materials Reliability Program, with the exception that some of the laboratory data used for validation were employed in developing the hydrogen effects term in the model for Alloy 82/182 The conclusion of the validation activities was that the PWSCC CGR models, if used within their range of applicability, provide CGR predictions that strongly agree with instances of PWSCC in field components and an extensive database of laboratory PWSCC simulation. This applies not only to the net CGR prediction, but also to the several modeled dependencies, including material variability and changes in SIF, temperature, and hydrogen concentration.

While the Alloy 600 PWSCC CGR model gives CGR predictions that are largely consistent with the data collected for the validation study, there are instances in which the model generally underpredicts data for certain heats (i.e., Babcock and Wilcox tubular products and French top head penetration nozzles, measured via both field and laboratory experience). These instances are believed to reflect material heats with relatively high susceptibility to PWSCC. For instance, this susceptibility is demonstrated by the relatively frequent occurrence of cracking detected in nozzles fabricated using these heats, such that general underprediction by the median CGR model for these heats is expected.

The nickel-based alloy fatigue CGR model was validated by comparison to laboratory CGR test data recorded by Mitsubishi Heavy Industries [84]. These data comprise findings for Alloy 600, Alloy 690, and their associated weld metals. In general, the CGR model predictions were in good agreement with these data. Specifically, (1) there was little systematic bias of the median prediction relative to data across various conditions, (2) the probabilistic bounds of the model captured the data reasonably well, and (3) underlying model trends were similar.

2-34

The austenitic stainless steel fatigue CGR model was validated by comparison to a database of laboratory testing from EPRI and Argonne National Laboratory. This comparison demonstrated acceptable agreement. Specifically, there was (1) little systematic bias of the median prediction relative to data across various conditions, (2) to the extent that there was a bias, it was conservatively high, (3) the probabilistic bounds of the model captured the data reasonably well, and (4) the independent data exhibit the Paris power-law trend. The austenitic stainless steel fatigue CGR model was also validated by comparing results to that of an alternate model described in NUREG/CR-2189, Probability of Pipe Fracture in the Primary Coolant Loop of a PWR Plant, Volume 5, Probabilistic Fracture Mechanics Analysis, Load Combination Program, Project I Final Report, issued August 1981 [85]. That model was derived as a best estimate from laboratory data that were independent from the EPRI and Argonne National Laboratory data. The two models were in acceptable agreement. Specifically, (1) the CGR model is generally higher than or consistent with the alternate model, and (2) while the CGR model demonstrates a lower Paris power-law exponent and less sensitivity to load ratio, it is considered more accurate because the alternate model was based on a much smaller dataset and included some data from boiling-water reactor environments. The alternate model also includes an independently derived model for the SIF range threshold. The SIF range threshold predictions were in very good agreement.

The ferritic steel fatigue CGR model was validated by comparison with a reference curve from the ASME Code,Section XI, Article A-4300 [86]. The reference curve bounds data that were available at the time it was developed. It does not separate fatigue in air from corrosion-assisted fatigue and, in effect, is considered a mixture of the two distinct crack growth modes because it is based on a combined dataset of fatigue crack growth tests from both modes. As expected, the fatigue in air predictions are consistent with or less than the reference curve, whereas the corrosion-assisted fatigue predictions are consistent with or greater than the reference curve. In addition, the Paris power-law exponents of the independent models are in good agreement.

2.2.6 Crack Coalescence Coalescence of proximal cracks is important when multiple circumferential cracks are present.

Axial cracks do not coalesce because only one axial crack is permitted per subunit. In xLPR V2, crack coalescence is calculated by the CCC module based on crack growth as calculated by the CGR module. The reader is referred to the Crack Growth Subgroup report

[76] for a more detailed description of the CCC module.

2.2.6.1 Theory The coalescence model represents the situation in which two adjacent macro-cracks of engineering significance (i.e., 1 to 3 millimeters (0.04 to 0.1 inches) or more in depth) that are growing via an SIF-controlled subcritical crack growth regime (e.g., stress-corrosion cracking or fatigue) are predicted to merge into a single, larger crack. The coalescence model is a set of rule-based conventions for simulating the coalescence of circumferential cracks based on their sizes, shapes, and locations. These conventions are more computationally efficient than a more complex model, and therefore, better suited to a probabilistic simulation. The prediction of coalescence is contingent on the length of the inside surface ligament separating the two cracks, as illustrated in Figure 2-17. When the length of this ligament becomes less than some value, which is referred to as the coalescence distance, coalescence is imminent, and the two original cracks are replaced with a single, coalesced crack.

2-35

Leftmost crack tips Rightmost crack tips Crack A becomes the coalesced crack; it inherits updated properties Crack B Crack A Ligament length Crack B becomes absorbed crack; it inherits properties to designate it as such Longer ligament Pairwise coalescence length occurs when the coalescence distance of two cracks is greater than the minimum ligament length between those two cracks Figure 2-17 Illustration of crack coalescence terminology Source: [76, Fig. 4-1]

The common physical driver for coalescence of two surface cracks is crack interaction, whereby stress intensities experienced at the crack front are amplified because of local stress fields radiating from a nearby crack, resulting in accelerated growth.

User inputs control key attributes of coalescence in xLPR V2. For the case of two surface cracks, the user can specify one of two conventions to determine the coalescence distance.

The first convention employs a user-defined coalescence distance, irrespective of the crack sizes. The second convention scales the maximum crack depth by a user-defined scaling factor to obtain the coalescence distance. The latter convention approximates the known dependency between crack interaction and crack depth and is consistent with ASME Code,Section XI, when a scaling factor of 0.5 is chosen. The resulting coalesced crack is a surface crack. The depth of the coalesced crack is either the minimum, maximum, or average of the original two crack depths, as specified by the user. The maximum depth option is generally recommended based on the physical expectation that the SIF in the re-entrant sector between the two original cracks will be amplified from the time crack interaction becomes significant until the coalesced crack regains a roughly symmetric shape.

For TRCs and TWCs, the common physical driver for coalescence is ligament collapse, where stresses are high enough to result in fully plastic failure of the ligament. The coalescence distance in this case is a user-defined value. The resulting coalesced crack is a TRC for two TRCs, a TWC for two TWCs, and a TRC for a TRC and TWC. These rules were developed based on physical expectations and logical considerations when constrained to the three crack types recognized by the Framework.

For a coalescing crack pair consisting of one surface crack and one TWC, the coalescence distance is zero, meaning that the two cracks do not coalesce until they touch each other. This arrangement has no ASME Code corollary, as in the case of two surface cracks, and no true ligament formation, as in the case of two TWCs. The resulting crack is a TWC.

The CCC module iteratively evaluates all active circumferential crack pairs to identify those pairs that satisfy the coalescence criteria. The CCC module updates the attributes associated with each pair of cracks to result in (1) a coalesced crack with attributes determined as a 2-36

function of the attributes of the two original cracks, and (2) an absorbed crack, which is effectively ignored throughout the remainder of the realization. This procedure continues until no pair of active cracks satisfies the coalescence criteria, at which point the CCC module returns control to the Framework.

In all cases, the center of the new crack is set to the center of the arc that circumscribes the inside surface lengths of the original cracks. For two surface cracks or two TWCs, the inside surface length of the new crack is set to the length of the arc that circumscribes the inside surface lengths of the original cracks. This convention is physically consistent with the simulated modes of coalescence. For coalescence of a TWC and a surface crack, the inside surface length is set such that the area of the coalesced crack is equivalent to the sum of the areas of the original two cracks. Figure 2-18 illustrates such a combination. This convention promotes continuity of the crack stability prediction immediately before and after coalescence.

The outside surface length of the new crack is set to the length of the arc that circumscribes the outside surface lengths of the original cracks. For a surface crack and a TWC, this length is the outside surface length of the original TWC. This convention is consistent with physical expectations and should result in acceptable leak rate continuity immediately before and after coalescence.

(a) (b)

Figure 2-18 Illustration of convention for a surface crack and a TWC (a) coalescing into a TRC (b)

Source: Adapted from [76, Fig. 4-2]

2.2.6.2 Assumptions and Their Effects The foremost simplification in the crack coalescence model is the use of simplified, convention-based modeling in lieu of more accurate mechanistic or phenomenological modeling of coalescence. The model includes a range of different conventions, or rules, for coalescence so that the sensitivity to these simplifications can be explored.

In xLPR V2, cracks are idealized as one of three crack types: surface cracks, TRCs, and TWCs. This code-wide approximation allowed for tractable development of analytical models.

However, cracks caused by PWSCC and fatigue possess complex geometries with spatial variation on many different scales. Despite use of the simplified crack shapes, the CCC module provides reasonable predictions for complex crack geometries for observed time to coalescence and observed depth and length after coalescence, provided that the model parameters are appropriately selected.

All circumferential cracks are assumed to be coplanar in xLPR V2. This means that circumferential cracks that more realistically might remain offset axially and independent are combined. The conservatism of this approach varies depending on the crack configuration. For example, axially offset cracks with little to no circumferential overlap would coalesce to produce a single, larger crack. This would somewhat increase the probability of occurrence of a leak, 2-37

significantly increase leak rates, and significantly increase susceptibility to rupture, depending on the degree of axial offset. For axially offset cracks with substantial circumferential overlap, this assumption would tend to result in a slightly reduced probability of leak as one of the two cracks may grow more quickly than the other, decrease leak rates by approximately one half, and somewhat decrease susceptibility to rupture. However, further analysis would be required to assess the effects of the coplanar assumption more rigorously.

Although intersection of axial and circumferential cracks could result in crack blunting that arrests one of the cracks, xLPR V2 does not model such interaction. The effect is an overprediction of leak and rupture.

Higher order analytical predictions suggest that coalescence distance may be sensitive to crack length and component thickness, especially for coalescence of very large cracks where the ligament stress between them is substantially elevated relative to the intact condition. This systematic variation is not addressed in the coalescence model, but it is expected to result in generally earlier coalescence for short-length cracks and generally later coalescence for long-length cracks as compared to higher order analytical predictions. The overall conservatism of the prediction depends on the selection of the coalescence distance inputs.

Finally, all validation data available are for coalescence of cracks in flat plate geometries. In many applicable components, the characteristic length of the inside surface curvature is much longer than typical crack lengths; therefore, extension of the flat plate data is reasonable. For smaller radius components or for particularly large cracks, the inside surface curvature may affect crack interaction and susceptibility to ligament collapse. Uncertainty in this effect can be considered in the coalescence distance distributions.

2.2.6.3 Interfaces Inputs to the CCC module include the type, size, and location of all active circumferential cracks. Input of component radius and thickness is also required to verify the range of crack geometries at both the input and output of the module. All other inputs define the set of rules to be used in determining whether two adjacent cracks coalesce. Since the CCC module can consider coalescence of only two cracks at a time, coalescence determinations are made sequentially around the circumference if more than two cracks are present. This sequence can occur in either a clockwise or counterclockwise direction, as specified by the user.

Several requirements are enforced to define the coalescence distance. If both cracks are surface cracks, the user can select from one of two possible conventions: (1) the coalescence distance is set to a user-defined input irrespective of the crack sizes, and (2) the coalescence distance is calculated by scaling the maximum crack depth by a user-defined input. The user also specifies whether the resulting surface crack depth is the maximum, minimum, or average of the original crack depths. If both cracks are TWCs, the coalescence distance is set to a user-defined distance input. The CCC module returns to the Framework the updated crack type, updated crack geometry, number of pairwise coalescences, and an error flag to communicate any anomalies encountered.

2-38

2.2.6.4 Validation To validate interaction and coalescence rules for two circumferential cracks, the CCC module capabilities were compared to the following:

• CGRs investigated experimentally, including conclusions drawn regarding SIFs driving crack growth

• crack-tip SIFs investigated analytically for adjacent cracks as they approach one another, as well as for the combined crack from the time that the two cracks first touch

• criteria for collapse of a ligament between a pair of TWCs based on analytical models These comparisons showed the crack coalescence phenomena to be reasonably well represented by the CCC module provided that the model parameters are within the range of applicability. The following should also be noted:

• The recommended coalescence distance for surface cracks is between zero and 75 percent of the maximum depth of the two cracks involved in potential coalescence.

Experimental evidence suggested little to no intensification of the SIFs until cracks are at least this close. There was not enough validation data to determine a more precise range for this parameter, so a probability distribution was recommended.

• Higher order modeling suggested a low likelihood of rapid tearing leading to ligament collapse until the ligament between two cracks is less than the length of the cracks.

• The recommended rule for calculating the depth of the coalesced surface crack is to use the maximum depth of the two cracks involved in coalescence. This convention was supported by the rapid growth of the re-entrant sector at the intersection of the two coalescing cracks due to elevated SIFs in that region until the bounding crack shape is obtained. While there were no data to validate the convention for two surface cracks of different depths, this convention was expected to bound the resulting flaw.

• The conventions for establishing the crack type after coalescence are fixed in the CCC module. Available data generally validated these conventions. Furthermore, the set of conventions was the most logical, given the three idealized crack shapes available in xLPR V2.

• The convention for establishing the inside and outside surface lengths of the coalesced crack was determined to be the most logical choice among possible alternatives. In general, the inside surface length will circumscribe the inside surface lengths of the original cracks, and the outside surface length will circumscribe the outside surface lengths of the original cracks. This convention was generally validated with experimental and higher order modeling. The inside surface length of a coalesced crack resulting from a TWC and a surface crack is based on the assumption that the resulting crack maintains the same area as the sum of the areas of the original cracks with the outside surface length of the original TWC.

• The convention for establishing the location of the coalesced crack is the most logical choice among possible alternatives, given the three idealized crack shapes available in xLPR V2.

2-39

2.2.7 Crack Opening Displacement The ability to estimate COD is an important element in determining leakage rates and therefore the detectability of cracks during plant operation. Accordingly, models for estimating the COD for both circumferentially and axially oriented TWCs were developed. These models are based on prior methods developed by the General Electric Co. (GE) and EPRI [87]. The reader is referred to the COD Subgroup report [88] for a more detailed description of the modules.

2.2.7.1 Theory The GE/EPRI method for predicting CODs uses elastic and plastic influence functions that are fit to FEA results that account for differences in pipe geometry and material properties. The total COD is then the sum of the elastic and plastic contributions.

Figure 2-19 illustrates the basic CCOD model. The model calculates the total elastic COD as the sum of the elastic contributions determined by calculating displacements due to tension, bending, and crack face pressure separately. The CCOD model does not incorporate the effect of WRS on COD. Each of the components of the elastic contribution to COD is calculated using a relationship referencing elastic influence functions developed for each of the loading conditions (i.e., tension, bending, and crack face pressure). Similarly, the plastic component is determined by summing the contributions due to bending and tension calculated using a relationship referencing plastic influence functions for each of the associated loading conditions (i.e., tension and bending). These influence functions were developed using FEA of the different loading conditions on a variety of component geometries and material properties.

Figure 2-20 illustrates the typical FEA model. Independent analyses for xLPR V2 increased the applicability of the original GE/EPRI solutions through the inclusion of elastic and plastic influence functions for a wider range of pipe mean radius-to-thickness ratios and normalized crack sizes.

Figure 2-19 COD model for circumferential TWC in a pipe subject to tension and bending Source: [88, Figs. 2 and 3]

2-40

(a) (b)

Figure 2-20 Typical FEA model (a) with closeup of spider mesh at crack tip (b) used for developing influence functions for the CCOD model Source: [88, Figs. 4 and 6]

The ACOD model includes the contributions to COD from internal pipe pressure and WRS.

Although the GE/EPRI method does not address axial COD, the ACOD model calculates COD using similar methods by way of a linear summation of the elastic and plastic contributions due to the associated loads. The ACOD module uses relationships for the elastic and plastic contributions as developed by Kim et al. [89] and mirrors the methods used in developing the CCOD model. Each component of the ACOD model also references an elastic or plastic influence function. Each of the influence functions was developed using FEA to fit the COD relationships for a variety of component geometries and crack lengths. Finally, because a through-wall WRS profile was not explicitly considered in ACOD FEA analyses, an additional stress corresponding to the integral of the through-wall WRS is added to the pressure term to approximate the WRS effect on ACOD.

2.2.7.2 Assumptions and Their Effects The models used by the COD modules are based on a few simplifying assumptions. The developers viewed most of these assumptions as having no or negligible impact on the results of the COD module, given its role within the context of the xLPR V2 software. Of note, however, are three assumptions that have significant effects on the uncertainty of the COD calculations:

(1) Both COD modules assume a planar crack, which is an idealized representation. Actual PWSCC is not planar and does not have a simple leak path. Thus, for a given leak rate, PWSCC would present a more diffuse configuration than would a planar crack. PWSCC is characterized by a distributed, connected network of cracks in three dimensions rather than a single, idealized planar crack in two dimensions. A model for the COD of such a diffuse and connected set of cracks (i.e., flow through porous media) is very different from the idealized representation used in xLPR V2. The effect of this assumption is to overpredict COD and the subsequently calculated leak rate.

(2) WRS is only approximated using an effective pressure term in the ACOD module calculations. Also, the CCOD module captures only the effects of the applied loads on COD and ignores WRS. WRS may open or close the crack more than is calculated by the CCOD module, leading to a large effect of uncertainty on the overall COD.

2-41

(3) The CCOD module analysis assumes that the ends of the pipe are free to rotate, thereby negating any effects that restraint of pressure-induced bending and system stiffness would have on the COD. This assumption is expected to result in the calculated COD being larger than the results from analyses in which restraint of pressure-induced bending is assumed. These COD overestimations lead to an underprediction of the length of a leakage-size crack.

2.2.7.3 Interfaces The Framework initially calls the COD modules when the criteria for a TRC are met. The modules are then called at each subsequent time step to calculate updated COD values. The COD values are then used as input for the leak rate calculations. Each of the COD modules takes appropriate loading, crack geometry, and pipe geometry inputs and calculates the CODs for TRCs and TWCs at the inside surface, midwall, and outside surface of the pipe for use in the leak rate calculations. The algorithms in the modules are explicit, deterministic equations, and no numerical solutions are required to reach a solution. In the case of TRCs, the calculated COD incorporates the COD correction factors as provided by the crack transition module.

Inputs to the COD modules are either the standard user inputs or are generated by the Framework in the course of a simulation. The user-defined inputs include the pipe geometry, material properties, applied loads, and internal pressure. All other inputs required by the COD modules are provided or calculated by the Framework and include the half-crack length and average hoop WRS for the ACOD module and the half-crack angle for the CCOD module.

2.2.7.4 Validation The CCOD models were validated by comparing the CODs predicted by the model with available experimental data from full-scale pipe experiments. In total, 36 individual through-wall cracked pipe experiments were used to validate the model. These validation efforts were accomplished by comparing the full-scale experimental pipe fracture COD data against 36 input files for the CCOD module created to match the conditions of the experimental test cases.

These test cases involved a variety of conditions including a range of pipe sizes, materials, and loading conditions. The predicted COD values were compared with the experimental COD values at both crack initiation and maximum moment. On average, the CCOD model overpredicted the experimental COD values by about 23 percent at crack initiation, with a standard deviation of 0.75. For the maximum moment cases, the average ratio of the predicted to experimental COD values was 1.41 with a standard deviation of 0.80. Part of the large standard deviation has to do with the uncertainty associated with the model itself, while part of it stems from the uncertainty associated with the inputs to the model, most notably, the choice of tensile data used in the analyses. When using quasi-static, monotonic, stress-strain data in the analyses, the predictions and the experimental results were in closer agreement when the cyclically loaded pipe experiments were excluded from the evaluation. There was also better agreement between the predictions and the experimental results when dynamic stress-strain data were used to analyze the pipe experiments that were loaded dynamically.

Because of a lack of ACOD experimental data, the ACOD model was validated using a combination of comparing the predicted COD values from the ACOD model with FEA results and engineering judgment. To illustrate the fidelity of the influence functions, Figure 2-21 shows a comparison of the analytical COD values as calculated using the ACOD module versus the values determined using FEA. These validation efforts determined that, if the internal pipe pressure was less than 60 percent of the pressure at the limit load, then the predicted COD 2-42

values agreed well with the FEA results. The value of 60 percent of the pressure at the limit load represents the upper limit of the models range of applicability, so the validation results demonstrate that this range is appropriate. The ACOD module outputs a warning message when the pressure passed to the module is greater than this value.

0.4 finite element model 0.3 COD [mm]

0.2 0.1 0

0 0.2 0.4 0.6 0.8 1 p/pL Figure 2-21 Comparison of ACOD analytical model predictions against FEA results Source: [88, Fig. 51]

Engineering judgment describes a range of activities not covered by validation against the FEA results. As part of this effort, the elastic and plastic influence functions as determined through FEA were compared against previously reported values [89]. As an example, Figure 2-22 shows a comparison of the plastic influence functions as determined using the ACOD module and as reported in the literature for a given pipe geometry and material behavior. These results show that the literature solutions match well with those from the ACOD module at the midthickness location. The overall results of these comparisons show that the ACOD values compare well with those reported by Kim et al. [89]. As a final measure of engineering judgment, it was recognized that the CCOD and ACOD models are rooted in identical methodologies. Therefore, it could be expected that the ACOD model would perform similarly to the CCOD model, if independent experimental data were available to validate the model, as is the case for the CCOD model.

2-43

14 Kim et al., R/t = 5, n = 7 12 ID h2, R/t = 5, n = 7 Mid h2, R/t = 5, n = 7 10 OD h2, R/t = 5, n = 7 8

h2 6

4 2

0 0 0.5 1 1.5 2 2.5 3 Figure 2-22 Comparison of ACOD analytical model predictions against literature values Source: [88, Fig. 52]

2.2.8 Crack Transition Modeling how a surface crack transitions into an idealized TWC is important for accurately calculating the leak rate. Previous leak-before-break analyses have assumed that an idealized TWC is formed once the surface crack penetrates the wall thickness. For this idealized TWC, the length is determined by equating the TWC area to be equal to the surface crack area at leakage. However, it has been demonstrated that this crack transition method yields nonconservative results in terms of leak rate calculations for both PWSCC and fatigue cracks

[67] [72] [90]. The crack transition model in xLPR V2 more accurately models the transition to and growth of nonidealized TWCs (i.e., TRCs) by assuming an initial, idealized TWC geometry and subsequently applying correction factors to the values calculated by the SIF and COD modules. The corrections are applied until the TRC becomes a TWC. The reader is referred to the Crack Transition Subgroup report [35] for a more detailed description of the module.

2.2.8.1 Theory The crack transition model uses a TRC to more accurately capture crack transition behavior [91]

[92] [93]. Figure 2-5 illustrates the three crack types used in xLPR V2. This crack geometry was used to model growth of TRCs using FEA [94] [95]. The analyses were performed over a range of applicable pipe configurations and crack sizes. From these models, SIF and COD values were determined for the TRCs as they grew. Based on the results from these analyses, correction factors were developed and tabulated so that the crack growth and COD could be calculated from the TWC formulations.

2-44

The procedure in xLPR V2 to model growth of TRCs can be described in three steps:

(1) transition from surface crack to TRC (2) calculate corrected SIF and COD values (3) calculate crack growth In the first step, the Framework determines the geometry of the TRC as the final surface crack transitions through-wall using the criterion from the 2001 British Energy Generation report R6, Assessment of the Integrity of Structures Containing Defects [96]. Under this criterion, the transition occurs once the surface crack depth reaches 95 percent of the wall thickness. At this point, the inner diameter crack length is set equal to the final surface crack length, and the outer diameter crack length is determined as either the pipe wall thickness or a quarter of the final surface crack length, whichever is less. This step occurs only once in the transition from surface crack to TWC.

In the second step, the crack transition module determines SIF and COD correction factors based on the inner and outer diameter crack lengths and the loading conditions. The Framework applies these correction factors to the inner and outer diameter SIF and COD values that are calculated assuming that the crack is a fully developed TWC.

In the third step, the SIF values calculated for both the inner and outer surface points of the TRC are provided to the CGR module to calculate growth at these points to obtain the next TRC geometry. The new geometry is then input back to the crack transition module in the next time step, and new SIF and COD correction factors are calculated for the updated crack geometry, as previously described. The process is repeated, and the crack grows until the ratio of the inner to outer crack lengths is less than or equal to 1.05. At this point, the crack becomes a TWC, and no further corrections are necessary.

2.2.8.2 Assumptions and Their Effects The models employed by the crack transition module are based on several simplifying assumptions. The developers viewed most of these assumptions as having no or negligible impact on the results of the crack transition module, given its role within the overall context of the xLPR V2 software. Of note, however, is one assumption that significantly affects the overall uncertainty of the module.

Specifically, linear elasticity was assumed in the development of the COD correction factors. As the applied stress increases, the inner diameter COD values will tend to be overpredicted, and the outer diameter COD values will be underpredicted. These values are expected to somewhat compensate for each other in the leak rate calculations; however, they contribute to uncertainty in the leak rate calculations.

2.2.8.3 Interfaces The Framework calls the crack transition module within the time loop at each time step for each surface crack that is more than 95 percent through-wall and for any TRCs. In each of these cases, the crack transition module calculates the COD and SIF correction factors and passes those values back to the Framework to be used in the crack growth and COD calculations.

User-defined inputs to the crack transition module are limited to the pipe wall thickness and diameter. The Framework provides all the required crack geometry inputs including the orientation (i.e., axial or circumferential) and inner and outer lengths for an axial TRC or angles 2-45

for a circumferential TRC. The only outputs of the crack transition module are the SIF and COD correction factors, which are passed back to the Framework.

2.2.8.4 Validation Since SIFs cannot be physically measured, it was decided to validate the SIF and crack transition modules together by using them in crack growth calculations and by comparing the predicted crack shape evolution with observed crack shapes. Since growth rate data for TWCs from operating plants are scarce, a laboratory dataset of circumferential fatigue crack growth in pipes under bending was used for the validation [71] [72]. These comparisons show good agreement between the experimental results and the crack transition module crack growth and shape predictions.

The COD correction factors were not validated since no experimental data were available.

Additionally, because of the lack of available data, SIFs and crack transition behavior for axial cracks were not validated against experimental data. However, the methods used to develop the axial crack transition model employ the same FEA methods used to develop the circumferential model, and the same rules for crack transition are applied to both crack orientations. Therefore, it is reasonable to expect that the axial crack transition model would show similar agreement with experimental data.

2.2.9 Leak Rate The ability to predict leak rates from potential TRCs and TWCs is central to the concept of leak before break. That is, the leakage detection system should be able to detect fluid leaking from a crack before the crack can rupture the pipe, leading to a loss-of-coolant accident (LOCA). In xLPR V2, the leak rate module calculates leak rates by using the COD values. The reader is referred to the Leak Rate Subgroup report [97] for a more detailed description of the leak rate module.

2.2.9.1 Theory The leak rate module calculates the leak rate of reactor coolant fluid in a liquid state that is flashing to vapor as it flows from a high-temperature, high-pressure environment inside the pipe, through a crack, to a low-temperature, low-pressure environment outside the pipe. The leak rate module uses a four-regime model to represent this process. Such a model was originally created under the Maximizing Enhancements in Risk-Informed Technology Program [98], which was an international effort to further develop the Probabilistic Loss of Coolant Accident code.

The different regimes model the spectrum of leak rates from tight to wide cracks. The ratio of the effective flow path length to the hydraulic diameter defines the boundaries of each regime.

Figure 2-23 depicts the four regimes graphically.

2-46

Figure 2-23 Four-regime leak rate model with crack morphology effects mapped onto volumetric flow rate versus crack-opening area Source: Adapted from [97, Fig. 6]

The model for Regime 1 is based on the empirically adjusted, homogeneous equilibrium model originally developed by Henry and Fauske [99] [100] [101] [102] for choked two-phase flow through tight cracks. Figure 2-24 illustrates the different regions of fluid flow and simplified geometry assumed in the model as described in the 1983 EPRI Report NP-3395, Calculation of Leak Rates through Cracks in Pipes and Tubes [103]. Henry and Fauske considered the two-phase mixture to be a pseudo-fluid, which can be described by the same conservation law principles that are valid for single-phase flow. The two phases are assumed to be everywhere in a state of both thermal and mechanical equilibrium. From the one-dimensional conservation of momentum law, Henry and Fauske derived an equation for the mass flow rate. The solution to this equation is constrained by a force balance, which is reflected in a pressure drop equation. Together, the mass flow rate equation and the pressure drop equation, along with several supporting equations, represent a set of two nonlinear equations with two unknowns (the mass flow rate and pressure at the exit plane) to be solved.

2-47

(a)

(b)

Figure 2-24 Two-phase flow through a long narrow crack channel: (a) flow regimes and (b) modeled geometry of flow path Source: Adapted from [103, Figs. 3-1 and 3-2]

The pressure drop equation separates the total pressure drop along the flow path into five contributing mechanisms:

(1) Pressure loss due to entrance effects. These are calculated for a fixed discharge coefficient of 0.95, which reflects a rounded crack channel entrance dimension relative to the crack opening.

(2) Pressure loss due to acceleration by vaporization. As the subcooled liquid vaporizes, the two-phase volume increases dramatically, and the flow must accelerate to maintain mass balance along the crack length.

2-48

(3) Pressure loss due to acceleration by the changing cross-sectional flow area. As the crack cross-sectional area changes, the velocity must change to maintain mass balance.

(4) Pressure loss due to frictional effects. The Darcy friction factor used to calculate the friction loss is a function of the hydraulic diameter, two fitting parameters, and crack morphology parameters.

(5) Pressure loss due to flow path tortuosity. The velocity head loss is a function of crack morphology parameters and changing flow directions along the crack path.

The individual contributing mechanisms are extensions to the Henry-Fauske model. The first four are described in EPRI Report NP-3395 [103], and the fifth is described in NUREG/CR-5128, Revision 1, Evaluation and Refinement of Leak-Rate Estimation Models, issued June 1994 [104]. Equations for the five pressure losses are generally dependent on the mass flow rate at the exit plane, geometry of the crack channel, and various thermodynamic properties of the fluid. In the leak rate module, the crack opening shape is assumed to be an ellipse and the hydraulic diameter is 4 times the crack area divided by the crack perimeter. The crack morphology parameters are dependent on the ratio of global surface roughness to COD.

The technical basis for this implementation is a series of computational fluid dynamics experiments, which are presented in Appendix C to NUREG/CR-6861, Barrier Integrity Research Program Final Report, issued December 2004 [105].

The models for Regimes 2 and 3 use the Henry-Fauske approach of Regime 1 with some additional constraints. In Regime 2, the mass flux (leak mass per area per second) is assumed to be constant and calculated at the ratio of the effective flow path length to the hydraulic diameter equal to 30, the value that defines the boundary between Regimes 1 and 2.

Regime 3 is a linear interpolation of the square of the mass flux between Regime 2 and Regime 4 using the ratio of the effective flow path length to the hydraulic diameter as the interpolant variable. This approach produces a reasonably smooth transition between Regimes 1 and 4 and is consistent with the final report on the Maximizing Enhancements in Risk-Informed Technology Program [98].

The model for Regime 4 for the ratio of the effective flow path length to the hydraulic diameter less than or equal to 4.6 is based on Bernoullis equation for an inviscid fluid along a streamline, which is derived from the principle of conservation of mechanical energy. Here, the wide crack is treated as a thin, square-edged orifice, where the single-phase liquid is assumed to be incompressible. The flow is fully turbulent at the crack entrance, and upon entering the crack, it accelerates through a vena contracta (i.e., location with the minimum diameter and maximum flow rate) that can be modeled as a circular orifice. Bernoullis equation generally overestimates the actual flow rate because it neglects viscous losses, so a discharge coefficient is introduced to add an empirical correction. The resultant mass flow rate is a function of a fixed discharge coefficient, effective flow path length, hydraulic diameter, various thermodynamic properties of the fluid, and an entry loss coefficient which represents the ratio of the diameter at the assumed vena contracta to the effective diameter of the crack entrance.

The leak rate module calculates the mass flow rate. The volumetric flow rate is calculated from the mass flow rate using the specific volume of water at 20 degrees Celsius (C)

(68 degrees Fahrenheit (F)) and a pressure of 101.35 kilopascals (14.7 pounds per square inch absolute), as specified in Instrument Society of America (ISA)-67.03-1982, Standard for Light-Water Reactor Coolant Pressure Boundary Leak Detection [106], a standard cited in NRC 2-49

Regulatory Guide 1.45, Revision 1, Guidance on Monitoring and Responding to Reactor Coolant System Leakage, issued May 2008 [107].

The crack opening area is modeled as an ellipse with the crack length on the major axis and COD on the minor axis. The crack opening area on the inside of the pipe is not always equal to the crack opening area on the outside of the pipe. In Regime 1 where the leak rate is comparatively small, studies conducted by the Leak Rate Subgroup showed that using an average of the leak rates calculated from the crack opening area values at the inside and outside surfaces of the pipe provides a good estimate. In Regimes 2, 3, and 4 where the leak rate is comparatively large, this effect has been shown to be insignificant, and the crack opening area values on the inside of the pipe are used.

2.2.9.2 Assumptions and Their Effects The models used by the leak rate module are based on several simplifying assumptions. The developers viewed most of these assumptions as having no or negligible impact on the results of the leak rate module, given its role within the overall context of the xLPR V2 software. Of note, however, are three assumptions that have known effects and four assumptions that have unknown effects.

The three assumptions with known effects are the following:

(1) All cracks are assumed to be distinct and planar or a set of planar cracks that act as a single crack. However, actual PWSCC is characterized by a distributed, connected network of cracks in three dimensions. This assumption is expected to result in overprediction of the leak rate.

(2) In Regime 1, an average is taken of the leak rates calculated using the inner and outer surface crack properties. In effect, this approach applies a correction that may produce a slight overprediction of the leak rate.

(3) The correction for uncertainty due to the crack morphology parameters is applied only when the leak rate is less than 0.63 kilograms per second (kg/s) (10 gallons per minute (gpm)). The effect is that the leak rate may be underpredicted if the difference between the inner and outer crack opening areas is very large.

The following four assumptions have unknown effects:

(1) It is assumed that the isentropic rate of vapor generation is reduced by exponentially relaxing the evolution of the vapor quality through an empirically derived coefficient.

This empirical adjustment moves the model towards a more physically realistic, nonequilibrium model.

(2) The fluid is assumed to transition from single- to two-phase flow at the point when the ratio of the total flow path length to the hydraulic diameter at the exit plane is equal to 12.

This assumption results in different calculations for the frictional pressure drop above and below this threshold.

(3) The equation for the Darcy friction factor is assumed to be valid. This equation was appropriated from the predecessor leak rate code, but the developers found that codes technical documentation lacking in details on the two coefficients used in the equation.

Accordingly, future efforts are recommended to further validate the equation.

2-50

(4) The equation for the velocity head loss is assumed to be valid. This equation was also appropriated from the predecessor leak rate code, but the developers found that codes technical documentation lacking in details on the equation. Accordingly, future efforts are recommended to further validate the equation.

2.2.9.3 Interfaces The leak rate module is executed through the preprocessor to produce a set of lookup tables.

Each table contains a range of leak rates as a function of various potential crack lengths, CODs, and pipe wall thicknesses. There are four such tables for volumetric flow rates and four more for mass flow rates. The four table types are based on combinations of the pressure and temperature ranges specified by the user: (1) minimum pressure and minimum temperature, (2) minimum pressure and maximum temperature, (3) maximum pressure and minimum temperature, and (4) maximum pressure and maximum temperature. A set of these tables is also generated for each degradation mechanism using the recommended crack morphology parameters. Thus, there are 8 tables for PWSCC and 8 tables for fatigue, for a total of 16 tables in the case of both mechanisms. During preprocessor execution, user-defined inputs to the leak rate module include the pipe geometry and the fluid pressure and temperature ranges used as boundaries for generation of the leak rate tables.

The leak rate module also requires the accurate and computationally efficient determination of various thermodynamic properties of water as a subcooled liquid, saturated liquid, wet and saturated steam, and dry or superheated steam. The module interfaces with software developed by a third party to calculate these properties.

During the time loop, the Framework interpolates from the lookup tables to calculate the leak rate for a given crack size. If the user opts to include uncertainty in leak rates below 0.63 kg/s (10 gpm), the Framework modifies the interpolated leak rates using the coefficient of variation equations and sampled uncertainties. The Framework uses the leak rates to calculate several outputs during its postprocessing operations (e.g., probability of rupture with leak rate detection). During Framework execution, user-defined inputs affecting the leak rate calculations include the operating temperature and pressure, pipe geometry, and cracking mechanism. The user may also define the detectable leak rate and whether to include uncertainty in leak rates of 0.63 kg/s (10 gpm) and below. Based on the calculations performed by other modules, the Framework provides other variables affecting the leak rate calculations, such as the current crack lengths and CODs on the inside and outside of the pipe.

2.2.9.4 Validation The developers validated the leak rate module against available experimental data, which can be divided into three categories: (1) flow through pipes, (2) flow through artificially produced slits, and (3) flow through naturally occurring cracks. The first category is based on data from Sozzi and Sutherland [108]. Their experiments represent flow through a horizontal pipe vented to atmosphere with no roughness or crack morphology parameters. These data were used to validate the basic Henry-Fauske model. The second category is based on data from Collier et al. [109]; NUREG/CR-3475, Critical Discharge of Initially Subcooled Water Through Slits, issued September 1983 [110]; and Yano et al. [111]. The leak rate module was validated against these data using a rectangular instead of an elliptical crack opening area and only global roughness as the crack morphology parameter. The third category is also based on data from Collier et al. [109]. Here, the leak rate module was validated using an elliptical crack opening area and the default crack morphology parameters.

2-51

Figure 2-25 shows how the leak rate module predictions compare with all the experimental datasets. Most of the predictions are within a reasonable degree of error, and there is good agreement with the second category of experimental data, with an average error of 18 percent.

Even the comparisons against the third category of experimental data where some of the crack morphology parameters were used show reasonable predictions with an average of 37 percent error. Overall, the results show good confidence in the use of the Henry-Fauske model. There is clearly uncertainty in the crack morphology parameters since the error increases when the leak rate module predictions are compared to the third category of experimental data. However, this result is expected since the crack morphology parameters are based on a limited set of data. Nevertheless, these results demonstrate good confidence in the use of the crack morphology parameters given the lack of bias in the calculations.

Figure 2-25 Predicted versus measured leak rates Source: Adapted from [97, Fig. 14]

The developers focused additional validation work on the behavior of the leak rate models in the transition from Regime 2 to 4. This work was done because there was no comparable leak rate software or experimental data against which the leak rate module results could be validated for this transition region. To validate the leak rate module, test cases were created that varied the crack length and COD to ensure that the modeled flow fell into all four leak rate regimes. The results show a smooth transition from Regime 1 to Regime 4. Based on engineering judgment, the developers determined that this behavior is expected and therefore valid.

2.2.10 Crack Stability Assessing crack stability determines whether a component with a crack of a specific size, orientation, and morphology will remain stable during specified operating conditions and is essential in determining whether detection and repair precede rupture. In xLPR V2, a suite of modules evaluates the stability of cracks. The reader is referred to the Crack Stability Subgroup report [112] for a more detailed description of these modules.

2-52

2.2.10.1 Theory To assess crack stability, xLPR V2 uses the following five modules to determine the critical crack size, depending on the orientation and extent of the cracking:

(1) ASCS module (2) ATWCS module (3) SCSCS module (4) MCSCS module (5) CTWCS module The SCSCS and MCSCS modules calculate the maximum sustainable load of a pipe with consideration of one or more circumferential surface cracks subjected to bending and tension loads. These modules use a net section collapse analysis as described by Li et al. [113]. In this analysis, the pipe dimensions, crack parameters (e.g., circumferential location, length, and depth), and material strength properties are used to define a neutral axis. Once the neutral axis is determined, a collapse moment can be calculated assuming thin shell behavior and applying moment and force equilibrium. This formulation accounts for cracks that may be asymmetric in nature or may be partially or completely in the compression zone. From this analysis, the effect of multiple cracks can be determined. The modules then assess the stability of the circumferentially oriented surface cracks based on the applied loads. Figure 2-26 illustrates the net section collapse geometry and loading used in the model.

Figure 2-26 Example net section collapse geometry and stress conditions for multiple circumferential surface cracks Source: [112, Fig. 2]

The CTWCS module uses two models to evaluate circumferential TWC stability. The first model uses a net section collapse analysis for an idealized TWC [114] [115]. It is like the previously described approach for surface cracks, except that the crack depth is equal to the pipe wall thickness. The analysis considers the crack to have radially directed crack faces symmetric about the principal bending axis. Then, if the stress in the uncracked ligament is equal to the flow stress in tension at the crack face and compression opposite the crack centerline, by 2-53

applying moment and force equilibrium, the collapse moment can be calculated. Figure 2-27 illustrates the net section collapse model. In cases where part of the crack lies in the compressive zone, the model applies appropriate adjustments.

Originally, the technology of fracture mechanics was limited to relatively high-strength materials that could be tested in sizes that met certain requirements for linear-elastic displacement during testing of specimens of certain configurations. More recent advances in the state of the art, such as R-curve and J-integral tests, have extended the use of fracture mechanics to elastic-plastic conditions that are associated with ductile materials and smaller section sizes.

Under these conditions, the stress field surrounding the crack departs from that of plane strain, and the enlarged crack tip plastic zone generally enhances fracture toughness. With increasing load, slow stable crack extension (tearing) may accompany the increasing plastic zone size.

Onset of rapid fracture occurs when the increase in crack tip deformation, measured by an increase in SIF due to increased nominal stress and crack length, equals or exceeds the resistance to crack extension.

The second model uses an elastic-plastic fracture mechanics (EPFM) approach to take advantage of these advances. This model assumes that the crack grows by ductile tearing caused by remotely applied tension and bending loads. A reduced section geometric analogy for the cracked pipe and a Ramberg-Osgood description of the elastic and plastic contributions to the applied J-integral for the tension and bending loads are used, as developed by Brust and Giles [116]. Figure 2-28 illustrates the EPFM model. Both models are used to calculate the critical crack size, and the more conservative (smaller) value is then selected as the one that governs rupture.

Figure 2-27 Geometry for circumferential TWC stability using net section collapse approach Source: [112, Fig. 3]

2-54

Figure 2-28 Representation of reduced section analogy for circumferential TWC stability using EPFM approach Source: [112, Fig. 5]

The ASCS module uses a plastic collapse analysis to evaluate axial surface crack stability. The module determines the critical pressure of a pipe with a given crack using a constant depth plastic collapse solution as described in the 1989 EPRI Report NP-6301-D, Ductile Fracture Handbook [117]. This analysis equates the semielliptical crack area to the area of a constant-depth (i.e., rectangular) surface crack to arrive at the effective half-crack length, where the area is divided by the maximum depth of the semielliptical crack.

The ATWCS module uses both limit load and EPFM models to evaluate each axial TWC individually. The limit load model calculates crack stability using only the crack geometry, yield strength, and ultimate tensile strength applying the net section collapse analysis described in the Ductile Fracture Handbook [117]. This analysis determines an initial critical crack length estimate and then iteratively solves for the critical crack length and critical pressure until the difference from one iteration to the next is less than a tenth of a percent. The EPFM model uses a J-tearing analysis to estimate the critical crack size for the input pressure specified based on the approach developed by Kim et al. [89]. The model uses the nondimensional crack length parameter and influence functions to obtain parametric coefficients for calculating the plastic component of the crack-driving force. A plastic zone correction is added to the half-crack length to obtain the effective half-crack length in the estimation of the elastic component of the crack-driving force. During the solution process, the hoop stress, elastic component of the crack-driving force, plastic limit pressure, and plastic component of the crack-driving force are used to obtain the total crack-driving force for an applied pressure and crack length. Both models are used to calculate the critical crack size, and the more conservative (smaller) value is then selected as the one that governs rupture.

2.2.10.2 Assumptions and Their Effects The crack stability modules each have limitations.

The MCSCS and SCSCS modules include only constant depth surface cracks for the limit load solutions because limit load solutions do not perform well for short, deep surface cracks when 2-55

the assumption that the cross section becomes fully plastic cannot be realized before the crack breaks through-wall. No EPFM solution has been implemented into these modules because the high constraint of the circumferential surface crack drives the apparent toughness higher than that measured by a compact tension specimen, so in most cases the limit load controls.

For the CTWCS module, both net section collapse and EPFM methods are included. The EPFM method is sensitive to the choice of material behavior curve (i.e., deformation J-integral or modified J-integral) used in the analysis. From experimental results, the ratio of the crack angle at maximum moment to the critical crack angle varied by 60 percent based strictly on the choice of the formulation of the material behavior curve used in the analysis. Another limitation is that both the limit load and EPFM methods underpredict the amount of ductile tearing that occurs between the subcritical crack to the final, unstable crack. The CTWCS module will predict a crack to be unstable before such an instability would be observed in an experiment.

For the ASCS and ATWCS modules, the most significant limitations are that the experimental datasets for comparison are limited and that the validation of the EPFM methodology for TWCs relied on correlations rather than on actual measured material property inputs. However, axial cracks are not expected to dominate failure probabilities for nuclear power plant piping, so these limitations are not expected to be critical.

Additionally, in all the stability models and the validation experiments, the cracks are planar with two distinctly parallel crack faces. However, PWSCC has no single, distinct crack. Rather, it has many smaller branching and interconnected cracks with ligaments of metal connecting the crack faces in places. Accordingly, the stability models can be considered only an approximation of PWSCC from a geometry perspective. Furthermore, no fracture experiments had been performed on pipes with PWSCC, so it was not possible to quantify the bias and uncertainty in the models.

2.2.10.3 Interfaces The Framework calls the appropriate stability modules from within the time loop. User-defined inputs to the modules include the pipe geometry, operating pressure, and axial loads. They also include the material strength and fracture toughness properties. The user may also specify the mixture ratio for dissimilar metal welds. The Framework determines other inputs to the modules. These inputs include the number, location, morphology, and geometry of the cracks.

In addition, the Framework calculates the Ramberg-Osgood parameters, which characterize the nonlinear relationship between stress and strain related to material strength.

All the modules return flags to indicate whether they predict rupture. The MCSCS and SCSCS modules flags indicate whether the surface crack or cracks will cause a rupture based on the applied loads. These modules also provide the ratio of the applied bending moment to the bending moment that would result in rupture. The CTWCS module flags indicate whether the TWC will cause a rupture based on the applied loads. The module also outputs the ratio of the current crack included angle to the critical crack included angle that would result in rupture. The ASCS module flag shows whether the input pressure is greater than or equal to the critical pressure, which is indicative of rupture. The module also outputs the margin to rupture by computing the ratio of the input pressure to the critical pressure. The ATWCS module flag indicates whether the pressure load is great enough to cause the TWC to fail. The module also outputs the crack size margin by computing the ratio of the current crack size to the critical crack size.

2-56

2.2.10.4 Validation Each of the models underwent separate validation.

The MCSCS and SCSCS modules were validated through comparison of the module outputs with an extensive database of single surface crack pipe fracture experiments and with a single set of multiple surface crack experiments. In total, 169 full-scale single surface crack pipe experiments were used for validation. The average value of the ratio of the predicted bending moment to the critical bending moment determined by experiment, where a value of 1.0 indicates perfect agreement, was 0.987 with a standard deviation of 0.268, which was within an acceptable uncertainty tolerance. In addition, the MCSCS module was validated against three multiple surface crack experiments. Although the sample size was small and thus there is more uncertainty, the module satisfied the validation requirements with a bending moment ratio of 1.04 with a standard deviation of 0.01, thus predicting a lower critical bending moment than that observed in the experiments.

The CTWCS module was validated through comparison of the module outputs with an extensive database of TWC pipe fracture experiments. In total, 32 full-scale experiments were used to validate this module by comparing the included crack angles. The average value of the ratio of the crack angle at maximum moment in the pipe experiments to the module-predicted crack angles, where a value of 1.0 indicates perfect agreement, was 1.34 with a standard deviation of 0.53. During the validation, one key difference was highlighted: the net section collapse method does not account for crack extension, while the ductile tearing assumption of the EPFM method significantly underpredicts crack extension due to ductile tearing, resulting in some significant deviations from the experimental behavior. However, as implemented, the instability predictions are conservative on average. That is, the module will predict that a crack being evaluated at some moment, pressure, and axial load will fail before such a rupture is observed in an experiment.

A total of 17 axial surface crack pipe experiments were used to validate the ASCS module. The ratio of the experimental pressure to the pressure predicted using the Ductile Fracture Handbook [117] method was obtained by running the module with the computation of an effective half-crack length for a semielliptical surface crack turned off because the axial surface cracks used in these experiments were constant-depth surface cracks. The average value of the ratio of the experimental pressure to the predicted critical pressure was 1.070 with a standard deviation of 0.190. For most cases, the module overpredicted rupture.

A total of 26 axial TWC pipe experiments were used to validate the ATWCS module. The results show that the limit load and EPFM solutions are within 10 percent for most cases, with a maximum difference of 15 percent. For the experiments in which it was possible to estimate the EPFM critical crack half-length, the average value of the ratio of the experimental critical half-length to the predicted critical half-length was 0.875 with a standard deviation of 0.111.

Consequently, the EPFM solution tends to underpredict rupture, and a similar outcome is observed for the axial TWC limit load solution. When using the smaller value of critical crack sizes from the limit load and EPFM analyses to define the ratio of the experimental crack length to that of the module, the ratio is 0.879 with a standard deviation of 0.112, meaning that the module somewhat underpredicts rupture.

2-57

2.2.11 Inservice Inspection The ISI program is a vital component in protecting against degradation that can lead to pipe rupture in nuclear power plants. The ability to preemptively identify and repair cracks can effectively decrease the likelihood of component failure due to leakage or rupture. Therefore, it is necessary to model the effectiveness of the ISI program to detect and size cracks in nuclear power plant components to properly evaluate the probabilities of a crack forming, growing, and leading to pipe rupture. In xLPR V2, the ISI module models the effectiveness of the ISI program. The reader is referred to the ISI Subgroup report [118] for a more detailed description of the module.

The ISI model parameters were derived and validated using data from the EPRI Performance Demonstration Initiative (PDI) database. PDI is an industry initiative, and the PDI database for inspection and evaluation of dissimilar metal weld locations with ultrasonic testing technologies is the largest known nuclear power inspection performance dataset. EPRI Report 3002008636, Materials Reliability Program: Development of Probability of Detection Curves for Ultrasonic Examination of Dissimilar Metal Welds (MRP-262, Revision 3)Typical PWR Leak-Before-Break Line Locations, issued May 2017 [119], describes in detail the ISI model development and the data analysis to define appropriate model parameters.

2.2.11.1 Theory To properly model the effectiveness of the ISI program, the ISI module separates the aspects of detection and repair into two separate models. The first is designed to model how effectively cracks are found by determining the probability of detection (POD). The second model then determines the probability of repair (POR) by evaluating how well cracks are sized and comparing those results to repair thresholds.

To address the needs of the initial application of xLPR V2 to welds subject to PWSCC, four dissimilar metal weld categories of specific interest were identified for which sufficient PDI data were available, and separate model parameters were developed for each:

(1) pressurizer surge and hot-leg surge nozzles (2) reactor pressure vessel inlet and outlet nozzles (3) steam generator inlet and outlet nozzles (4) weld overlays These categories were developed to capture differences in key attributes like weld geometry, inspection surface, and scan mode.

The nominal POD is calculated by a logistic equation valid for all crack depths greater than a small crack threshold based on available detection data over the crack size range and measurement capabilities for each weld configuration. The small crack threshold is applied to reflect limitations in the PDI dataset due to a restriction in nondestructive examination qualification requirements imposed by ASME Code,Section XI, Rules for Inservice Inspection of Nuclear Power Plant Components, Mandatory Appendix VIII [120]. Specifically, for most categories of welds, the lower limit for crack detection is defined as a crack depth less than 10 percent of the pipe wall thickness. For cracks smaller than the small crack threshold, the ISI module allows the user to either set the POD to zero or calculate it using a linear approximation.

In the former case, no cracks less than the small crack threshold will be detected. In the latter case, the linear approximation is based on the user-defined lower-bound POD and the POD as determined by the logistic equation at the small crack threshold. Finally, a user-defined 2-58

effectiveness factor can be applied to the POD to adjust for potential differences between field and test performance. It is applied as a constant scaling factor to the POD as otherwise calculated. Figure 2-29 illustrates the general POD model.

Figure 2-29 General POD curve characteristics and notation Source: Adapted from [118, Fig. 2-1]

The POR is determined independently of the POD and uses a complementary cumulative distribution function. To calculate this function, a nominal crack depth is first determined using a linear relationship with respect to the actual crack depth. Then, a sizing error distribution is applied to the nominal measured crack depth using a normal distribution. Figure 2-30 illustrates the sizing error.

2-59

Figure 2-30 Example of sizing models for flaws in reactor pressure vessel nozzles showing linear distributions (black lines) with 95-percent confidence intervals (dotted lines) and 1:1 relationships (red lines)

Source: [118, Fig. 2-8]

Using the measured crack depth and the associated distribution, a cumulative distribution function can be developed, which determines the probability that a given crack will be measured as larger or smaller than actual. Thus, when compared to the repair threshold crack size, the as-measured crack may respectively be repaired and not progress to possible leak and rupture or left in service for continued growth. Because of the nature of the distribution in the measured crack size, which could lead to unrealistic crack sizes, this cumulative distribution function can be modified to either truncate or saturate at given upper and lower bounds. Figure 2-31 illustrates the general POR model.

2-60

Figure 2-31 Graphical summary of POR evaluation Source: Adapted from [118, Fig. 2-6]

The POD and POR are calculated for each crack at each inspection interval during the simulation, thereby creating an incremental POR by multiplying the probabilities. These incremental PORs can be calculated either where the POD is independent of previous inspections or where the ability to detect a crack has some dependence on whether it was previously detected. Using the incremental PORs, a cumulative POR can be calculated for each inspection interval by combining the PORs from each previous inspection interval.

Similarly, a cumulative POR can be calculated for a single component with multiple flaws.

These cumulative PORs are then used to adjust the risk likelihoods. The Framework performs these calculations. Additional details are in Section 2.3.1.4.10.

2.2.11.2 Assumptions and Their Effects As part of model development, certain assumptions were made, and limitations arose because of the available data and the techniques used in the models. These are summarized below.

The ISI models are fully empirical. The model parameters and their uncertainties were developed to fit inspection and sizing data developed from the PDI. Although care is taken to ensure that the PDI mockups and testing procedures adequately reflect actual plant components and ISI processes, there is still some bias between test and actual inspection conditions.

The models take a simplified approach to describe detection and sizing in that crack depth adjusted by component thickness is the only independent variable. Detection and sizing techniques are dependent on attributes that are not modeled including, but not limited to, the component geometry and materials and the crack length, location, orientation, and COD.

Additionally, the models do not account for the nature of the crack, but instead assume that the PDI data are representative of all crack types.

2-61

Modeling assumptions are used to simplify the treatment of uncertainties. In lieu of more detailed modeling to delineate different sources of uncertainty, all sources of model uncertainty are allocated as component-to-component uncertainty, as opposed to examination-to-examination or flaw-to-flaw uncertainty. This approach suggests that most of the variation in the detection and sizing processes is the result of component-to-component differences. Some variation is likely due to all three of these sources of uncertainty and potentially others. However, because the objectives of the PDI program do not extend to development of probabilistic models, different sources of variation were not quantified.

Because the ASME Code does not require flaws less than 10-percent through-wall for vendor qualification [120], the current PDI data are not extensive enough to accurately quantify POD performance for small cracks. Although the detection model allows for specifying the POD for small cracks, and such an approach may be considered valid according to engineering practices, it is still not based on a robust dataset.

The PDI-based parameter estimates for the POD and POR models may not perfectly describe field performance. The extent of the difference is difficult to quantify because some field flaws may be undetected, and detected flaws are usually repaired without destructive examination.

Therefore, given that parameter estimates are likely to be based on controlled conditions, there is an underlying assumption that the PDI-based results accurately reflect field performance.

In addition, there are some restrictions on the applicability of the ISI models. Because of data limitations and other project constraints, reliable ISI model parameters could not be developed for some component configurations. Therefore, the user must supply the technical basis when applying the ISI model parameters to these configurations, which include stainless steel welds, reactor coolant pump nozzle welds, weld inlay or onlay repairs, OWOLs, and stress improvement mitigation techniques. Also, ISI model parameters could not be developed for axial cracks in both steam generator nozzle welds and components with FSWOLs. The limitation with respect to axial flaw parameters is due to insufficient data to support validation of the model for these components.

2.2.11.3 Interfaces The Framework calls the ISI module inspection and evaluation routines within the time loop at each time step for each crack at each user-scheduled inspection during the simulation.

User-defined inputs to the inspection routine include the logistic equation parameters, small flaw threshold, lower-bound POD, and POD effectiveness factor. The user may also specify whether to include interpolation for detecting small flaws. User-defined inputs to the evaluation routine include the depth-sizing parameters, upper and lower depth bounds of the cumulative distribution function, depth repair threshold, and small flaw threshold. The user may also specify whether to truncate the measured crack sizes, which can prevent unrealistic results.

For both the inspection and evaluation routines, the user may also specify whether the remaining ligament is used in lieu of the through-wall depth. Use of the remaining ligament provides a better fit to available data for some configurations, such as components with FSWOL. The Framework provides other inputs to the routines, such as the crack depth and component thickness. In addition, there are separate sets of user-defined inputs for premitigation, post-overlay, post-inlay, and post-MSIP conditions. The outputs of the ISI module are the POD and POR for each crack, which are passed back to the Framework to calculate the probability of nonrepair (PNR).

2-62

2.2.11.4 Validation The ISI module was validated by comparing the fitted models to data attained from the PDI program. Whereas data from 2009 and earlier were used for model development, data from then until 2014 were used for model validation. Thus, the data used for validation were strictly independent from the data used for development. Validation was performed with respect to the best estimate model parameter values.

For the detection model, the goodness-of-fit statistic used for the validation analysis was the standardized sum-of-squares for a logistic model [121]. Under the hypothesis that the model is correct, the goodness-of-fit statistic converges to a normal distribution with a mean of zero and a standard deviation of 1 as the total number of unique flaws in the dataset increases.

Additionally, the goodness-of-fit statistic can be converted to represent the probability that a value at least as extreme as the measured value could be observed. A probability of 0.05 was used for the POD model parameters, meaning that the model recording a detection event with a likelihood of less than 5 percent was not considered valid, but values above this threshold were considered to lead to validation of the model. Using this approach, the POD model parameters were validated for pressurizer surge nozzle, reactor pressure vessel nozzle, steam generator nozzle, and weld overlay configurations based on axial and circumferential orientations and PDI examination qualification results.

For the sizing model, under the hypothesis that the model is correct, the goodness-of-fit statistic would follow a chi-squared distribution with the number of degrees of freedom equal to the number of data points in the validation dataset. As in the detection model, the goodness-of-fit statistic can be converted to represent a probability, and a probability of 0.05 was used. In this approach, the sizing model parameters were validated for the same configurations as the POD model parameters. Exceptions were for reactor pressure vessel nozzle and weld overlay axial flaws, where a single outlier point in each dataset was removed to validate the models.

2.3 Computational Framework The Framework is the hub of xLPR V2. Its major components are the computational core, input set, and preprocessor.

The following subsections summarize the operation of the Framework, underlying probabilistic theory, and its connection to other components of the software. The reader is referred to the Computational Group report [122] for a more detailed description of the Framework.

2.3.1 Computational Core The computational core is implemented through GoldSim. Within it, the landing platform provides the necessary structure for the correct flow of data throughout an xLPR V2 simulation.

The landing platform is the link between the input set, lookup tables generated by the preprocessor, deterministic model, probabilistic structure, and outputs. The deterministic model includes the modules, which are executed when called by the computational core. Thus, the landing platform also serves as the interface between the various modules.

The specific functions of the landing platform are integral to the calculations performed within the deterministic model. The primary purpose of the deterministic model is to step the crack evolution process through time. It includes pre-time-loop calculations, crack initiation calculations, and time-loop calculations as described in Sections 2.3.1.2, 2.3.1.3, and 2.3.1.4, respectively. Completion of one crack evolution process is called a realization. The 2-63

computational core probabilistic structure, described in Section 2.3.1.1, performs the Monte Carlo simulation using the deterministic model by executing the prescribed number of realizations. After all realizations are complete, the computational core aggregates the results and displays them to the user as outputs of the code, as described in Section 2.3.1.5.

2.3.1.1 Probabilistic Structure Uncertainty is primarily accounted for in xLPR V2 through the user-defined sampling strategy.

The probabilistic structure implements the selected sampling strategy to propagate uncertainty through the deterministic model. The probabilistic structure uses the sampling capabilities native to GoldSim. It is structured in two nested loops: (1) an outer loop that corresponds to epistemic uncertainty and (2) an inner loop that corresponds to aleatory uncertainty. Figure 2-32 illustrates the basic structure of the sampling algorithm.

Aleatory uncertainty is classified as natural, random variation in the input considered and is deemed to be irreducible. Epistemic uncertainty is classified as lack of knowledge about the behavior of an input, which could theoretically be reduced with more information. In probabilistic analyses aiming to characterize the likelihood of an adverse event (e.g., pipe rupture), aleatory uncertainty represents the risk of the event occurring, whereas epistemic uncertainty represents the confidence about that risk.

The characterization of the uncertainty in the inputs as being aleatory or epistemic is not absolute; it depends on the context and granularity of the problem. While separating aleatory and epistemic uncertainties can provide additional insights into the problem, it comes at an increased computational cost. It is important to note that the uncertainty classification does not affect the mean for a given quantity of interest. A more traditional, single-loop Monte Carlo analysis may be performed in xLPR V2 using either the epistemic loop or the aleatory loop.

2-64

Epistemic (Outer) Loop)

Aleatory (Inner) Loop Deterministic Model Figure 2-32 Illustration of nested sampling loop structure Probability Distributions Implementation of uncertainty in the computational core begins with the user-defined input uncertainties and sampling options. For each input that can be uncertain, the user must select from the following designations for uncertainty implementation: constant, aleatory, or epistemic.

If constant is selected, no uncertainty is applied. If aleatory is selected, the sampled aleatory quantile values will be used to determine the values passed to the deterministic model. If epistemic is selected, the sampled epistemic quantile values will be used. Additionally, if aleatory or epistemic is selected, the user must also specify a probability distribution. xLPR V2 supports several distribution types; the more common ones are as follows:

• normal

• log-normal

• uniform

• discrete

• triangular

• Weibull The user specifies the probability distribution via input parameters entered in the input set. For example, for a normal distribution, the user would enter the parameters of mean and standard deviation. The user also has the option to truncate the tails of certain distribution types. This 2-65

option would be used, for instance, to ensure that the sampled input values are physically realistic.

The user also specifies the sampling options primarily using the input set. These options include the following:

• simple random sampling (SRS)

• Latin hypercube sampling (LHS)

• discrete probability distribution (DPD) sampling

• importance sampling

• spatial variability

• correlations Section 2.3.1.1.2 describes how basic sampling is performed within the computational core assuming the use of SRS. The remaining and more advanced sampling capabilities are described in Sections 2.3.1.1.3 through 2.3.1.1.7.

Simple Random Sampling SRS is the most basic sampling method. Here, the user simply specifies the number of sample sets (realizations) for each loop. Different numbers of realizations may be specified for each loop. A single loop analysis may also be performed on either loop by specifying that only one realization be run on the other loop. For each realization and for each loop, the computational core samples from a uniform distribution between zero and unity, in which each sample has equal probability. Two such samples are taken for each uncertain input (one for the epistemic loop and one for the aleatory loop), and the users selection determines which sample will be used. Thus, if an input is set to epistemic, the sampled epistemic value will be used, and if an input is set to aleatory, the sampled aleatory value will be used. These samples represent the quantile values.

The quantile values may be subsequently affected by importance sampling and correlation as set by the user. Importance sampling stretches and concentrates some of the quantile values to oversample in the user-defined region of interest. If the input is correlated with another, then the quantile values may be changed to match the user-defined correlation. Sections 2.3.1.1.5 and 2.3.1.1.7 discuss importance sampling and correlation, respectively. After adjusting the initial quantile values based on importance sampling and correlation, as applicable, the computational core uses them as inputs to the inverse distribution functions to estimate the sampled values for the parameters. The sampled values are then passed to the deterministic model via the landing platform.

GoldSim performs the random sampling by using a system of random seeds and a linear congruential generator. Samples are generated using the model, element, run, realization, and combined random seeds. The model seed was generated randomly based on the system clock when the computational core was created and remains fixed thereafter. Like the model seed, the element seeds for each GoldSim stochastic element were generated randomly when the elements were created and remain fixed thereafter as well. The user sets the run seeds, one for the aleatory loop and one for the epistemic loop. They can be changed at the beginning of the simulation but remain the same for all realizations within a simulation. At the beginning of the simulation, the realization seed is generated by combining the model seed and run seed.

Then, at the beginning of each realization, the realization seed is joined with the element seed to create the combined seed, which is used by the random number generator for sampling and 2-66

to create a new combined seed for the next random number. Hence, the realization seed changes for each realization, and the combined seed changes every time a random sample is taken. Since the model and element seeds are fixed and, because of the dependencies between seeds, the run seeds alone allow for exact repetition of a simulation.

In PFM analyses, the concept of statistical convergence is important. It is intrinsically linked to the decision that the analysis is intended to inform and how much confidence is required in that decision, which is often linked to the seriousness or magnitude of the consequences. Once the decision and degree of confidence are defined, a solution is considered converged if the uncertainty is low enough that it does not change the conclusion drawn from the analysis.

With SRS, many realizations may be required to achieve a final set of results that is sufficiently converged. SRS may also fail to sample sufficiently in the tails of the probability distributions, which can lead to results that do not include extreme but possible input combinations. For example, a probability distribution on operating pressure might be centered around the design pressure. Very high pressures that could lead to rupture, though possible, may never be sampled using SRS because the sample size is simply too small to ensure samples of high operating pressures. In this case, SRS would fail to capture potentially important crack behaviors and subsequent ruptures in estimates of uncertainty. A related concern when selecting sampling methods is obtaining a collection of samples that is fully representative of the desired distribution. Additional sampling options available within the computational core address these issues by promoting faster convergence and forcing samples to be drawn in the extreme regions of the probability distributions. These options are LHS, DPD sampling, and importance sampling, and they are described in Sections 2.3.1.1.3, 2.3.1.1.4, and 2.3.1.1.5, respectively.

Latin Hypercube Sampling The first and most straightforward sampling method that can be used to improve on SRS is LHS. LHS is a stratified sampling technique that forces random samples to be drawn in such a way that each stratum is equally likely and contains one sample, though the sample is randomly located within the stratum. For example, if the sample size is 10 and the distribution is uniform between zero and unity, LHS will draw one sample randomly between 0 and 0.1, one between 0.1 and 0.2, and so on. Use of this technique leads to samples that are more representative of the specified distribution with smaller sample sizes and, hence, leads to faster convergence.

The user may apply LHS to the epistemic loop, aleatory loop, or both, but it cannot be applied to individual inputs. The sampling range is divided into equally likely strata based directly on the number of user-defined realizations up to a maximum of 10,000 strata. The user sets the sample sizes in the same manner as for SRS.

Discrete Probability Distribution Sampling DPD sampling is another stratified sampling method. However, there are two primary differences between LHS and DPD sampling. First, DPD sampling employs a user-defined number to stratify the range for sampling. The number of strata is typically smaller than the sample size and it is reused (e.g., on average, 50 values per strata are sampled using 200 strata and a sample size of 10,000). Second, after partitioning the sample space, LHS samples randomly within each stratum, whereas DPD samples the conditional mean of the stratum. As a result, samples drawn using LHS are, on average, more uniformly distributed than those from SRS, whereas samples drawn using DPD sampling are always uniformly distributed, but they take on fewer unique values. This technique can be useful when the 2-67

simulation sample size is limited; however, replicate simulations cannot be used to improve estimates in the tails of the distributions.

Importance Sampling To obtain samples in regions of the input space that are of interest but are not highly probable, the computational core includes the option to use importance sampling. The user may apply importance sampling to individual inputs on the epistemic loop, aleatory loop, or both. With the other sampling techniques, the computational core generally obtains samples from distributions by generating a uniformly distributed random sample between zero and unity and then applying a transformation to obtain a sample from the desired probability distribution. Importance sampling differs from this method because it draws samples from a distribution that is not uniform between zero and unity. For example, half of the samples are drawn from the interval between 0 and 0.9, and the other half are drawn from the interval between 0.9 and 1.0. These samples are then transformed, just as they would be if they were sampled uniformly, to obtain samples from the desired probability distribution. In this example, if the target distribution were normal, half of the resulting samples would fall above the 90th percentile of the normal distribution (i.e., the samples would be concentrated in the upper tail of the distribution).

The importance sampling distribution implemented in the computational core employs a user-defined quantile for each input selected for importance sampling. Half of the samples are taken within an interval about the user-defined quantile, and the width of the sampling interval is a function of the number of inputs for which importance sampling has been specified. This implementation ensures that, if a user selects too many variables for importance sampling (generally greater than five), the importance sampling will be rendered effectively insignificant to avoid skewing the simulation results. For this reason, importance sampling requires much more analysis by the user. Sensitivity analysis techniques can be used to determine the inputs where importance sampling would have the most effect.

Finally, because importance sampling is used to obtain a greater number of samples within a specific region of the input space, the estimate of the probability of an event will be incorrect if the samples are used directly as if they were drawn using SRS. For this reason, the computational core also calculates an importance sampling weight. The weights are used to correct for the bias introduced by importance sampling when the computational core calculates the results.

Spatial Variability Spatial variability describes the inherent heterogeneity in a material or in conditions that affect crack initiation and evolution at a specific location. A classical way to represent spatial variability is with a probabilistic framework in which spatially varying inputs are represented with distributions supported by observation and measurements. In xLPR V2, several inputs are required to be represented in this way to capture what is called the within-weld variability.

Without such a representation, cracks could occur at the same time within each subunit and grow at the same rates. This leads to another important observation that spatially variable distributions are dependent on the discretization of the problem. As an example, if a weld is divided into 1,000 subunits instead of 10, one would expect the likelihood of a crack initiating in each subunit to be reduced accordingly by a factor of 100.

Implementation of spatial variability requires a different sampling structure because the values are sampled several times per realization, as compared to nonspatially varying inputs, which are 2-68

only sampled once per realization. xLPR V2 includes a set of predetermined, spatially varying inputs. Each of these inputs has two components. The first component represents the uncertainty or component-to-component variability and is sampled only once per realization.

The second component represents the within-weld spatial variability and is sampled several times (generally corresponding to the number of subunits) per realization. The computational core then multiplies the two components to generate different values for each subunit that capture both uncertainty and spatial variability. Table 2-1 illustrates the concept for sampled crack lengths in five subunits. When spatial variability is not implemented, the resultant crack lengths are shown to be the same in all subunits; however, when spatial variability is implemented, the crack lengths are shown to vary from subunit to subunit.

Table 2-1 Illustration of spatially variable samples Implementation Spatial Variability No Spatial Variability Subunit 1 2 3 4 5 1 2 3 4 5 Sampled Multiplier 0.9 0.9 0.9 0.9 0.9 1.02 1.02 1.02 1.02 1.02 (Component-to-Component Variability)

Sampled Crack Lengths, 3.0 2.9 2.5 3.1 3.5 3.2 3.2 3.2 3.2 3.2 mm (Within-Component Uncertainty)

Resultant Crack Lengths 2.7 2.6 2.3 2.8 3.2 3.3 3.3 3.3 3.3 3.3 for Simulation, mm The separation of uncertainty and variability is also necessary to facilitate application of importance sampling on the spatially varying inputs. It allows importance sampling to be applied on the uncertainty component. If importance sampling were applied to the spatially varying component, the sample region defined for importance sampling would become so small that it would no longer be representative. The user can specify whether the spatially varying inputs are treated as uncertain and, if so, what distributions to apply and whether the inputs are treated as aleatory or epistemic. Section 2.3.1.2.5 provides additional information on spatial variability and the inputs to which it is applied.

Correlations Most of the inputs in xLPR V2 are assumed to be statistically independent from one another.

This independence means that the sampled value for one input does not impact the likelihood of another input. However, a subset of inputs can be made statistically dependent, meaning that they must be sampled such that their dependencies are preserved. The association between input variables is needed to ensure a physically realistic input set or to preserve the physical laws that drive the problem being modeled. This approach is desirable to avoid underestimating the influence of correlated variables. For example, if two variables are highly correlated with an output variable, it is likely that they are also correlated with each other, possibly even more strongly than they are correlated with the output of interest. If so, putting both inputs in the 2-69

model will result in some multicollinearity, risking both being declared insignificant, and skewing the correlation coefficient estimates.

Statistical dependence is implemented in the computational core using mathematical relationships to correlate predetermined pairs of inputs. Inputs that may be correlated include certain ISI, fatigue and PWSCC initiation and growth, and material strength and toughness parameters. The user specifies the strengths of the pairwise correlations in the input set.

Uncertainty is propagated through the deterministic model via a sample of uniform distributions between zero and unity whose results are used to define quantile values for the input probability distributions. The user-defined correlations are applied to these quantile values. The sampled quantile value for the first correlated input is unmodified. The modified quantile value for the second correlated input is a function of the correlation and the sampled quantile values for the first and second correlated inputs. The modified quantile value is then used to calculate the sampled value that will be used in deterministic model calculations.

2.3.1.2 Pre-Time-Loop Calculations Before the computational core can begin simulating crack initiation and growth, it must first perform many calculations related to the following:

• space and time discretization

• operating conditions and time periods

• geometry

• material properties

• spatial variability

• stresses

• load limits

• crack properties

• other pre-time-loop calculations The following subsections summarize these calculations.

Discretize Space and Time The computational core discretizes space around the circumference of the weld into equally sized subunits as shown in Figure 2-4. The number of subunits is a user input. Only one crack of each orientation type may initiate in each subunit. The computational core arranges the subunits such that the first is located at the top dead center of the weld and all subsequent subunits are numbered in order in a clockwise direction.

The computational core discretizes time with a time step. By default, the time step is 1 month, but the user may change it. It remains constant during a simulation. The length of the simulation is the plant operation time entered by the user in calendar time. The FCI, PCI, and CGR modules calculate crack initiation times and growth rates in effective full-power years (EFPYs). The computational core converts these calculations to calendar time by dividing by the plant capacity factor. EFPY is a user input, and the computational core calculates the plant capacity factor by dividing the EFPY by the plant operation time.

2-70

Calculate Operating Conditions and Time Periods Discrete time periods within the plant operation time accommodate different normal operating conditions and mitigation. The user may define up to three normal operating periods. These periods correspond with constant conditions for operating temperature and pressure, dissolved oxygen concentration, and deadweight and thermal expansion loads and stresses. Mitigations may be defined for any time during the simulation and may occur within any part of an operating period. For chemical mitigation, the concentrations of zinc, hydrogen, or both may change. For mechanical mitigation, changes in WRS occur, new materials may be involved in the cases of inlay and overlay, and the weld thickness may also change if there is an overlay. The computational core accommodates changes to conditions due to these mitigation techniques by calculating the new conditions after the mitigation is applied. Because the computational core calculates crack initiation times before the time loop, the FCI and PCI modules require further division of the time periods when mitigations are applied. As an example, when simulating PCI, the computational core defines a maximum of five periods: three normal operating periods plus a potential division due to mechanical mitigation and another potential division due to zinc mitigation. Figure 2-7 illustrates the various divisions for an example simulation using a hypothetical plant operation time of 1 year for simplicity.

Calculate Geometry The computational core performs several geometry calculations using the following user-defined inputs:

• pipe outer diameter

• pipe wall thickness

• weld thickness

• weld overlay thickness

• weld inlay thickness Example calculations include the pipe cross-sectional area and moment of inertia. In addition, some geometry parameters may change during a simulation. For instance, the computational core re-performs the calculations as necessary to reflect the additional thickness imparted by an overlay.

Calculate Material Strength Properties The basic building block for the material strength properties in xLPR V2 is the Ramberg-Osgood stress-strain model [123]. This model includes the yield strength, ultimate strength, and elastic modulus, which are user inputs. The computational core ensures that the yield strength does not exceed the ultimate strength because such a situation is not physically realistic. The computational core then uses the yield strength, ultimate strength, and elastic modulus values to calculate the other Ramberg-Osgood model parameters, particularly the hardening coefficient and exponent. For dissimilar metal welds, the computational core calculates weighted averages of the strength properties based on the left and right pipe component materials. The user can adjust the weighting by employing a mixture ratio input. An equal weighting is recommended for cracks in the center of the weld. The weighted averages of the strength properties are used in the COD and stability module calculations. This approach has been shown to best predict circumferential cracks when compared to experimental data [124].

2-71

Calculate Spatial Variability Spatial variability reflects differences in the crack geometry and material behavior across the subunits of the weld. The computational core accounts for this variability by populating spatial distributions for each realization. The user may define spatial variability for a predefined set of inputs. These inputs include the initial depths and lengths of axial and circumferential cracks, certain fatigue initiation and growth model parameters, and certain PWSCC initiation and growth model parameters. The applicable inputs are identified in the input set.

Calculate Stresses The computational core applies the following primary types of stresses as required during the simulation:

• membrane stress due to fluid pressure inside the pipe

• deadweight membrane and bending stresses

• thermal membrane and bending stresses

• WRS

• transient stresses

• seismic stresses These stresses are combined and passed to the appropriate modules as required. The computational core may also update the stresses during a realization, such as when a different normal operating period begins or when a mechanical mitigation is applied as specified by the user.

The pressure, deadweight, and thermal stresses and WRS are generally combined to produce the normal operating stresses for the circumferential crack calculations. The user has the option to enter the deadweight and thermal stresses either directly or as forces and moments, in which case the computational core converts them to stresses using the component geometry.

Also, the bending moments in each of the three orthogonal directions are resolved into a single equivalent bending moment using the root of the sum of squares of each component. The pressure and WRS are generally combined to produce the normal operating stresses for the axial crack calculations.

For PWSCC initiation, the applied stress is the normal operating stress at the inside surface of the weld. For fatigue initiation, the minimum and maximum transient stress changes calculated from TIFFANY are added to the normal operating stresses at the inside surface of the weld.

The user may also define additional stresses to account for very shallow surface stresses due to grinding or other surface treatments. These additional surface stresses are applied only in the crack initiation calculations.

For stress-corrosion cracking growth, the applied stress is the normal operating stress through the thickness of the weld. However, for circumferential TWCs, the WRS is not included because of the self-balancing behavior of the assumed axisymmetric WRS profile. The through-thickness stresses and global bending stresses are separated to support the SIF calculations for circumferential cracks. TIFFANY uses the same stresses to calculate the SIF changes for transients, which are used in the fatigue crack growth calculations. For the COD calculations, the normal operating stresses are applied.

2-72

The crack stability calculations generally use the normal operating stresses, seismic stresses, and maximum stress change from all the transients scheduled to occur in the time step. The seismic stresses are omitted if they cause instability, as further described in Section 2.3.1.4.9.

The seismic stresses are intended to model SSEs only and are treated separately from the other transients because they are assumed to not contribute to crack initiation or growth. WRS is not considered in the stability calculations because the plasticity generated during failure would overwhelm it.

In piping subject to bending, the stress varies around the circumference such that one portion of the weld could be in tension while the other is in compression. It is important to model this stress variation in the fracture mechanics analysis because cracks will not initiate and grow under compression, whereas they will under tension. The computational core accounts for the circumferential variation in bending stress by scaling the effective bending moment (assumed to be at the top dead center of the weld) according to the azimuthal location of the crack centers relative to top dead center. The variation in bending stress is used in the circumferential crack initiation, crack growth, COD, and stability calculations. It is also important to model the stress variation through the weld thickness. The hoop stress due to pressure varies through the thickness of the weld based on the standard Lamé solution for thick-walled cylinders. The number and positions and points through the weld thickness are the same as defined by the user for the hoop WRS profile. The depth variation in the hoop stress is used in the axial crack initiation and crack growth calculations. The average hoop stress is used in the axial crack stability calculations.

Calculate Load Limits The computational core checks for limit load conditions on the uncracked pipe to determine if the user has specified physically unrealistic loads that would lead to module errors in the time-loop calculations. The check is performed based on the combined effects of tension and bending as determined from the applied forces, moments, flow stress, and basic geometry of the pipe following the approach described in work by Lei et al. [125]. Two checks are made, one based on the normal operating loads and the second based on the normal operating plus seismic loads. If the normal operating loads exceed the general limit load of the pipe, the computational core issues an error and terminates the realization. If the normal operating loads plus seismic loads exceed the general limit loads, the computational core issues a warning and records a seismic instability.

Calculate Crack Properties The computational core tracks certain crack properties to characterize each potential circumferential and axial crack in the simulation. These include the following:

• crack type

• crack position

• crack depth

• crack length The crack type property indicates whether there is a crack and, if so, whether it is a surface crack, a TRC, or a TWC in the subunit. No crack is the initial status, and surface crack is the status when a crack is initiated. The crack type also indicates if a rupture occurred during the realization. Additionally, it indicates if a circumferential crack coalesced with another 2-73

circumferential crack. In this case, the computational core does not track the history of the subsumed crack further because the subsuming crack maintains the information.

The crack position property tracks the radial locations of the crack centers. The initial positions depend on the crack initiation method, as further described in Section 2.3.1.3. The initial positions of axial cracks always remain fixed throughout a realization because growth occurs entirely along the length of the pipe perpendicular to the radial direction. Due to symmetry assumptions, the initial positions of circumferential cracks change over the course of a realization only if they coalesce with another circumferential crack. The axial locations of both circumferential and axial cracks are not tracked because they always remain fixed at the weld center plane. For circumferential cracks, growth occurs entirely in the radial direction, so no tracking is necessary in the axial direction. In similar metal welds, the axial locations of axial cracks do not change because of symmetry assumptions. In the case of a dissimilar metal weld, if an axial crack grows beyond the weld into the left and right pipe materials which have different CGRs, then the computational core maintains symmetry about the weld center plane by averaging the crack growth in the two base metals. The computational core also tracks the deviation from symmetry as the offset between the axial crack center and the weld center plane prior to averaging the CGRs.

The crack depth represents the maximum extent of the crack as measured radially outward from the inside of the pipe. It is a nondimensional value created by normalizing the crack depth by the thickness of the pipe plus the thickness of an overlay, if present. The computational core tracks only the depth of surface cracks. For TRCs and TWCs, it sets the crack depth to unity, and the depth does not change thereafter.

The crack length represents the length of a crack as measured either on the inside or the outside of the pipe. It is a nondimensional value created by normalizing the half-length by pi for circumferential cracks or by the half-width of the weld for axial cracks.

Other Actions Other actions performed before executing the time loop include the following:

• For the PCI module, the computational core converts the operating temperature to Kelvin. It also converts several material strength properties from operating to room temperature based on the user-defined conversion factors.

• For the FCI module, the computational core calculates the number of cycles per year for each transient based on the user inputs.

• For the CGR module, the computational core sets the power law constant to zero for the left pipe and right pipe components if the user selects the option to not allow PWSCC growth into the base materials in the case of axial cracks.

• For the leak rate calculations, the computational core checks whether the operating pressure is within the bounds of the leak rate module lookup tables. The computational core also samples from a normal distribution to introduce an uncertainty factor into the leak rate calculations, if the user selects this option. The uncertainty factor is determined independently for axial and circumferential cracks. The uncertainty factors are used to correct the leak rate values interpolated from the lookup tables generated by the preprocessor.

2-74

2.3.1.3 Crack Initiation Calculations After completing the pre-time-loop calculations, the computational core executes the crack initiation calculations. Here, the timing and locations of all cracks that initiate during the plant operation time are determined. The user selects the method of crack initiation from initiation by PWSCC as calculated by the PCI module, initiation by fatigue as calculated by the FCI module, or both. Alternatively, the user may specify preexisting cracks, but this option cannot be combined with PWSCC or fatigue initiation. In all options, no more than one axial and one circumferential crack may initiate or be placed in each subunit.

Inputs to the PCI and FCI modules include stresses, loads, material properties, operating temperature, and various material-specific initiation model parameters. Several of these inputs are discretized by subunit, time period, or both. Discretization by subunit is necessary to account for spatial variability in the crack initiation model parameters and for differences in stresses around the circumference. Discretization by time period is necessary to account for any mitigations or changes to the normal operating conditions. The outputs of the modules are initiation times and locations. The initiation time is returned in EFPYs, and the computational core converts it to calendar time by dividing by the plant capacity factor.

When both fatigue and PWSCC initiation processes are modeled, the computational core calls each initiation module independently. It then resolves any conflicts. Conflicts arise when both PWSCC and fatigue initiation are predicted within the plant operation time for the same crack orientation in the same subunit. When this happens, the computational core selects the earlier of the two initiation times. The computational core also records the initiation process associated with each crack for the users reference; however, the initiation process distinction has no bearing on the subsequent crack evolution or evaluation calculations. The computational core performs additional calculations when the simulation includes inlay because an inlay creates a new surface for crack initiation. The computational core accomplishes this by performing crack initiation calculations for inlay in parallel with the crack initiation calculations for the premitigated weld. In this manner, two complete sets of crack initiation times and locations are produced.

In the case of the preexisting cracks option, the user must specify the number of preexisting cracks. These cracks are then placed in the first time step of the simulation and no additional cracks occur thereafter. Regardless of the number of cracks, the first is always located in the subunit at the top dead center of the weld. The computational core then randomly locates the remaining cracks in the other subunits and determines the specific locations of all preexisting cracks within their designated subunit.

Finally, before execution of the time loop, the computational core reorders the cracks. The cracks are reordered for efficiency purposes so that the computational core only needs to loop through the time-loop calculations for cracks that exist at that point in the simulation. For PWSCC and fatigue initiation, the computational core reorders the array containing the initiation times, locations, and initiation mechanisms by initiation time. To support the pair-wise sequential coalescence calculations for circumferential cracks, the computational core also maps the reordered cracks to their corresponding subunits of origin. Since all preexisting cracks are placed at the same time, the computational core orders them in ascending order of radial position.

2-75

2.3.1.4 Time-Loop Calculations After it completes the crack initiation calculations, the computational core executes the time loop. The general flow of operations in the time loop proceeds as follows:

(1) Update system properties and conditions.

(2) Seed new cracks.

(3) Calculate SIFs.

(4) Calculate CGRs.

(5) Calculate crack coalescence.

(6) Calculate crack transition.

(7) Calculate crack stability.

(8) Calculate COD.

(9) Calculate leak rate.

(10) Calculate ISI results.

These operations are summarized in the subsections that follow. At the end of the time loop, the computational core advances the time step and continues the realization.

Update System Properties and Conditions At the beginning of each time step, the computational core updates the time-dependent piping system properties and conditions as needed. More specifically, the computational core does the following to define the input conditions for the time step:

• adjusts the operating temperature, pressure, and dissolved oxygen concentration when a new operating period begins

• updates the hydrogen concentration when it is applied as a form of chemical mitigation

• updates the hoop and axial WRS profiles, material thicknesses, and crack properties when overlay, inlay, or MSIP are applied for mitigation purposes

• performs calculations for each active transient

• calculates stresses that are not a function of crack properties, for instance, certain membrane and bending stresses, hoop WRS, stresses for circumferential crack growth due to PWSCC, and hoop stresses for crack stability calculations.

Seed New Cracks The first cracking process that the computational core simulates is the seeding of new cracks depending on the crack initiation times calculated, as discussed in Section 2.3.1.3. In this process, the computational core determines the initial, nondimensional depth and half-length for any new cracks. These values may be sampled from distributions defined by the user. The computational core sets the nondimensional depth of initiated cracks to 0.95 if the sampled depth results in a value greater than 0.95. The computational core also issues a warning to the user in this case because this is the threshold for when a surface crack becomes a TRC. Also, if the sampled depth of an initiated crack is greater than the half-length, the initial half-length is set equal to the initial depth. These constraints are not imposed when using the preexisting cracks option to give the user more flexibility (for example, to model an as-found crack with defined dimensions).

2-76

Calculate Stress-Intensity Factors For crack growth due to PWSCC, the computational core calculates the SIFs by calling the SCSIF and TWC SIF modules, as appropriate. The specific module called depends on the types of cracks that exist at this point in the realization. The SIF values due to normal operating loads for surface cracks and TWCs are calculated by the SCSIF and TWC SIF modules, respectively. For fatigue crack growth, the computational core linearly interpolates the minimum and maximum SIF values for each transient from the TIFFANY lookup tables generated by the preprocessor. The interpolation is performed according to pressure, temperature, and thickness for both surface cracks and TWCs. The results are passed to the CGR module to calculate a SIF range for use in the fatigue growth calculations. In the case of TRCs for both PWSCC and fatigue crack growth, the computational core multiplies the TWC SIF values by the correction factors calculated by the crack transition module, as described in Section 2.3.1.4.6. These correction factors have the effect of reducing the applied SIF for TRCs.

Calculate Crack Growth Rates Before calculating the CGR, the computational core calculates the precise locations of the crack tips in terms of radians for circumferential cracks and a nondimensional distance for axial cracks. The precise crack tip locations are needed because the computational core must determine the materials in which the cracks are growing. The precise crack tip locations are also needed for other calculations, such as determining the subunit number and within-weld variability factors. In the case of axial cracks, the tips are assumed to reach the base metals at the same time.

The computational core then calculates the CGRs by calling the CGR module with the appropriate material property inputs and SIF values for the time step. The SIF values passed to the CGR module are combinations of both transient and normal operating values. The CGR module loops through all cracks and transients. The cracks are ordered by initiation time so that the module performs calculations only for cracks that have initiated. The transients may be sporadically active within a set of time steps based on the user-defined frequencies of occurrence and other scheduling options.

The outputs of the CGR module include the crack depth and length growth rates. These growth rates are output in meters per EFPY. The computational core converts them to dimensionless CGRs in calendar time and then multiplies the result by the time step to calculate the total, dimensionless crack growth. The user has the option to not allow axial crack growth due to PWSCC in the base metals. In this case, the computational core corrects the axial CGRs.

The computational core adds the total crack growth that occurred during the time step to the existing crack dimensions to update the crack size. Through crack growth, a surface crack may become a TRC and a TRC may become a TWC. Thus, immediately after the crack dimensions are updated, the computational core determines whether the crack types have changed and, if so, updates them accordingly. For circumferential cracks, the computational core resets the nondimensional half-lengths to unity if they become greater than unity. The computational core also sets the initial TRC dimensions in accordance with the recommendations in the 2001 British Energy Generation report R6, Assessment of the Integrity of Structures Containing Defects [96]. For circumferential cracks, the outer half-length is set to 25 percent of the inner half-length or to the ratio of the pipe thickness to the outer radius, whichever is smaller. For axial cracks that become TRCs, the computational core sets the outer half-length to 25 percent of the inner half-length or the pipe thickness, whichever is smaller.

2-77

Calculate Crack Coalescence At this point, if there are multiple circumferential cracks, the computational core calls the CCC module to determine whether the cracks coalesce. Inputs passed to the CCC module primarily include the crack properties, such as type, depth, position, and length. The computational core also passes the user-defined coalescence options, such as the minimum distance between two cracks before they coalesce. As a result, the CCC module will create the following:

• a single surface crack from two coalescing surface cracks

• a single TWC from two coalescing TWCs

• a single TRC from two coalescing TRCs, a surface crack coalescing with a TRC or a TWC, or a TRC coalescing with a TWC If no coalescence occurs, the outputs of the module are the same as the inputs, and the computational core makes no changes to the crack properties. However, if the computational core detects that the module changed any of the crack types, it replaces all the crack properties with the values returned by the CCC module.

Calculate Crack Transition If there is at least one TRC, the computational core calls the crack transition module. The crack transition module determines the correction factors to apply when calculating the SIF and COD values for TRCs. The computational core passes the current crack properties and other inputs to the crack transition module. The outputs of the module include two sets of correction factors for hoop, axial, and bending stresses. One set is for correcting the SIF values, and the other is for correcting the COD values. The computational core applies the correction factors applicable to SIFs in the subsequent time step. The correction factors applicable to CODs are applied in the current time step.

Calculate Crack Opening Displacement At this point in the time step, if there are any TRCs or TWCs, the computational core calculates their CODs by calling the ACOD and CCOD modules, as appropriate. For circumferential cracks, the computational core makes separate calls to the CCOD module: one for membrane stress and one for bending stress. Inputs to these modules include the crack type, length, applied bending moment and axial membrane force, material toughness parameters, operating pressure, and pipe geometry. If the inside length of a circumferential crack is greater than 99 percent of the inside circumference of the pipe, the computational core sets the crack length to that value because it is outside the range of validity of the CCOD model.

For circumferential cracks, the CCOD module outputs separate COD components due to membrane and bending stresses at both the inside and outside locations of the pipe. The computational core combines these components to determine the resulting COD. For TRCs, the combination occurs after applying the correction factors calculated by the crack transition module. For axial cracks, the ACOD module just outputs the CODs at the inside and outside locations of the pipe. The computational core uses the CODs as inputs to the leak rate calculations as described next.

2-78

Calculate Leak Rate For TRCs and TWCs, the computational core linearly interpolates the leak rate values from the leak rate module lookup tables generated by the preprocessor. There are different sets of lookup tables based on PWSCC and fatigue crack morphology parameters. The computational core interpolates from the set of tables based on the PWSCC morphology parameters when the user selects the crack growth mechanisms as PWSCC only or as both PWSCC and fatigue.

Otherwise, when fatigue is the only selected crack growth mechanism, the computational core interpolates from the set of tables based on the fatigue crack morphology parameters. The interpolation is performed according to COD, crack length, and pipe thickness. To perform the interpolations, the computational core also calculates the hydraulic diameter, which is a commonly used term when handling flow in noncircular tubes and channels. One set of interpolations is always performed using the crack length and COD on the inside of the pipe.

Another set of interpolations is performed using the crack length and COD on the outside of the pipe. When the leak rate is in Regime 1 as described in 2.2.9.1, the computational core calculates the actual leak rate by averaging the values. In Regimes 2, 3, and 4, the leak rate is calculated based only on the crack length and COD on the inside of the pipe. Axial crack leak rates are calculated using the axial crack COD and length, and circumferential crack leak rates are calculated using the circumferential crack COD and length.

The computational core also includes an option to adjust the interpolated leak rates to account for crack morphology parameter uncertainties. If the user activates this option, the adjustments are applied to leak rates less than 0.63 kg/s (10 gpm) where uncertainties in the crack morphology parameters have a significant impact on the leak rate estimates. The adjustments are made within the computational core using models developed by the Leak Rate Subgroup.

These models are based on data generated by separate probabilistic simulations where the crack morphology parameter distributions in NUREG/CR-6861, Barrier Integrity Research Program, issued December 2004 [126], were sampled and used to generate distributions of leak rates. Leak rate uncertainties considering the combined effects of several uncertain crack morphology parameters were then characterized using coefficients of variation defined as the ratio of the standard deviation of the leak rate to the mean leak rate. To provide context, if there is no crack morphology (i.e., polished crack surfaces), the coefficient of variation is zero.

Because of temperature dependence, there are two coefficient of variation equations: (1) for 280 degrees C (536 degrees F) and (2) for 340 degrees C (644 degrees F). The computational core obtains the coefficient of variation at the user-defined operating temperature by interpolating between values generated from these two equations. If the leak rate is less than 0.63 kg/s (10 gpm), the computational core applies the resultant adjustment factor after making any adjustments due to crack length and COD differences on the inside and outside of the pipe.

Calculate Crack Stability The computational core calculates crack stability by calling the various crack stability modules.

The general order of operations is to call the modules in the following sequence for axial cracks:

(1) ASCS module (2) ATWCS module 2-79

For circumferential cracks, the modules are called in this order:

(1) MCSCS module (2) SCSCS module (3) CTWCS module The order of operations for circumferential cracks is more complex because of seismic and coalescence considerations. Specifically, whereas seismic conditions are considered for circumferential cracks, they are not considered for axial cracks because the predominant driver of stability is the internal pressure. Because the stresses under seismic conditions are greater than those under normal operating conditions, seismic stability necessarily implies stability under normal operating conditions. Thus, stability under normal operating conditions can be assumed without explicit evaluation, and for computational efficiency, the stability modules are initially called with the seismic stresses for circumferential cracks.

In the first stage of the workflow for circumferential cracks, the computational core calls the MCSCS module if there are any surface cracks or if there are multiple cracks regardless of crack type. This includes any TRCs or TWCs, which for the purposes of the multiple crack stability assessment only, are treated as surface cracks with depths equal to 99 percent of the thickness of the pipe. This implementation is an assumption to support use of the MCSCS module net section collapse analysis, which is the only validated stability model for multiple cracks. If the MCSCS module determines that instability occurs under seismic conditions, a seismic instability event is recorded for use in later postprocessing rupture calculations. If the MCSCS module determines that rupture occurs under nonseismic conditions (i.e., normal operating loads plus the maximum transient load), a rupture is recorded, and the realization is ended.

In the next stage of the workflow, which is the first stage for axial cracks, the computational core calls the SCSCS and ASCS modules if there are any surface cracks. For each circumferential surface crack, if the SCSCS module determines that instability occurs under seismic conditions, a seismic instability is recorded. In addition, the computational core calls the CTWCS module under seismic conditions, treating the seismically unstable circumferential surface crack as a TWC to determine if a pipe rupture is caused by a seismic event. For each circumferential or axial surface crack, if rupture is determined to occur under nonseismic conditions, the surface crack is converted to a TWC, bypassing the crack transition module. The computational core effects the transition from surface crack to TWC by setting the TWC inner and outer half-lengths equal to the inner-half length of the surface crack.

In the last stage of the workflow, the computational core calls the CTWCS and ATWCS modules if there is at least one TRC or TWC, including any new TWCs created by an unstable surface crack, as described in the previous stage of the workflow. Seismic instability of a circumferential TRC or TWC is recorded if the CTWCS module determines that failure occurs under seismic conditions for use in later postprocessing rupture calculations. If failure is determined to occur by the single CTWCS module under nonseismic conditions, a rupture is recorded, and the realization is ended. If there is no rupture under nonseismic conditions, then the TRC or TWC proceeds through the time loop again in the subsequent time step.

Because calling the stability modules in every time step slows a realization that has a crack, and stability calculations are typically not necessary in every time step, the computational core includes an option for the user to increase the speed of the simulation by skipping some calls to the stability modules. If the user elects to take such an approach, the computational core still alerts the user to any crack stability evaluations that were skipped and that could impact the 2-80

results. No stability module calls are skipped if the user sets these settings such that the computational core calls the stability modules in every time step.

Calculate Inservice Inspection Results Finally, if an inspection is scheduled in the time step, the computational core calculates the ISI results by calling the ISI module. The ISI module determines the POD and POR for each crack.

POD is the probability of detecting a crack using ultrasonic testing, and POR is the probability of repairing the crack based on sizing using ultrasonic testing. The computational core determines whether an inspection is scheduled based on the user inputs. Inspection timing can either be entered as a frequency or as a fixed set of up to 10 inspection times. In simulations that include inlay, overlay, or MSIP mitigation, inspections can be scheduled both pre- and post-mitigation.

The computational core selects the appropriate input parameters for the ISI module based on when the inlay, overlay, or MSIP is applied. It then calls the module separately to calculate POD and POR.

The underlying assumption of this approach is that, if a crack is detected and its sizing leads to repair, then all existing and potential cracks are repaired at the same time, and the weld will have no subsequent cracks for the remainder of the realization. With the values for POD and POR returned by the ISI module, the computational core proceeds to calculate the PNR. The relevant simulation results (e.g., probabilities of leakage and rupture) are multiplied by the PNR to estimate the probabilities conditional on the combined effects of inspection and sizing. The PNR multiplier is set to unity when there are no cracks, when all the cracks are shallower than the depth detection threshold, or when no inspection occurs.

The user may choose to calculate the PNR for each crack using two available methods. In the first method, each inspection has an independent chance of detecting the crack. Thus, if a crack was not detected in an initial inspection, it could be detected in a subsequent inspection.

In the second method, interdependence between inspections is considered. In this method, a crack that was not detected in an initial inspection would also not be detected in later inspections. This method simulates the potential impacts of cracks that are difficult to detect. In addition, the computational core calculates the PNR differently depending on the option selected by the user for the number of cracks detected. If the user sets this option such that only the deepest crack is detected, the computational core calculates the PNR based on the largest POR among all the cracks. If the user sets this option such that all cracks are detected independently, the PNR is calculated based on the product of the POR values for all the cracks.

2.3.1.5 Outputs and Postprocessing Outputs from the computational core fall into the following categories:

• combined axial and circumferential crack results

• orientation-specific crack results

• errors The outputs are displayed to the user through a set of dashboards that use GoldSim time-history result elements. These elements allow the user to display the results over the simulation time. They can be viewed as either individual time histories, a set of time histories, or as probabilities and statistics of all the time histories. Because of the dual-loop sampling structure, the time histories are averaged over the aleatory realizations for each epistemic 2-81

realization and stored at the epistemic level. The user can view the results from individual epistemic realizations or statistics of the results (e.g., mean and 95th percentile).

Many of the general outputs are time-history indicator functions, which the computational core uses to track whether a specific event occurs (e.g., occurrence of rupture). Within a single aleatory realization, the computational core designates these occurrences as either zero if the event does not occur or unity if the event does occur. Most of the general outputs are also available under specific conditions (e.g., occurrence of rupture with leak rate detection). The computational core calculates these results using a postprocessing algorithm at the end of each aleatory realization. This approach allows for many different conditions to be considered without the need for multiple simulations, a process that would quickly become computationally prohibitive. The computational core can also be easily modified to extract custom results depending on the users analysis needs.

Combined Outputs By default, the computational core provides the following plots for the combination of both circumferential and axial cracks:

• detection effect

• LOCAs

• PNR

• total leak rate

• leak rate jump The detection effect plots show a comparison of the effects of the various detection methods.

This plot shows indicator function results for the cumulative probabilities of crack, leak, and rupture before and after adjustment to account for the effects of leak rate detection, ISI, or both.

The results also include the seismic contributions to rupture. The detection effect results also provide some indicator functions that are useful for identifying errors, such as whether the pipe system without cracks cannot sustain the normal operating loads, transient loads, or normal operating and seismic loads together.

The LOCA plots show indicator functions for LOCAs. Results are provided for small-break, medium-break, and large-break LOCAs based on whether they exceed the threshold leak rates or crack opening areas defined by the user. The effects of leak rate detection, ISI, or both on the occurrence of the LOCA events are also output.

The PNR plots show the combined probability of not repairing a weld. These values always start from unity because the weld will never be repaired before an inspection. After an inspection, the PNR for a single crack will depend on whether the user has selected the option for independent chance of detection. In the case of multiple cracks, the result is either the value for the deepest crack only or the product of the PNRs for all the cracks, also depending on the option selected by the user.

The total leak rate plot shows the sum of leak rates from all the active axial and circumferential cracks. The leak rate jump indicator plot shows whether the leak rate increases from below the user-defined lower threshold to above the user-defined upper threshold in the subsequent time step. If a rupture occurs during this subsequent time step, the corresponding leak rate is assumed to be greater than the user-defined upper threshold and thus counted as a leak rate 2-82

jump event. The effects of leak rate detection, ISI, or both on the occurrence of leak rate jump events are also provided.

Crack Orientation-Specific Outputs By default, the computational core provides the following plots for each crack orientation:

• indicator functions

• fractional area cracked and total area cracked

• total number of cracks

• PNR The indicator function plots show the cumulative probabilities of occurrence of rupture, leak, and crack over time. Figure 2-33 shows an example indicator function plot for circumferential cracks.

The plots of fractional area cracked and total area cracked show the extent of damage caused by all the cracks. For circumferential cracks, the computational core calculates the fractional area cracked as the sum of the total cracked areas divided by the weld cross-sectional area.

For axial cracks, the computational core calculates the total area cracked as simply the sum of the areas of all the axial cracks.

Figure 2-33 Indicator function plot for circumferential cracks 2-83

The plots of the total number of cracks show the numbers of active axial and circumferential cracks at any time in the simulation. The total number of cracks in a simulation may increase over time because of initiations that may occur at various times. However, the total number of circumferential cracks may decrease as the result of crack coalescence. The PNR plots provide the PNR considering the effects of ISI.

In addition, the computational core provides certain results for the first five axial and circumferential cracks. The computational core numbers the cracks sequentially according to their initiation times. The first five cracks will have relatively longer time histories from initiation to rupture and are thus assumed to be of interest to the user. These results include the crack properties (i.e., type, position, length, and depth) and volumetric leak rates. They also include the SIF values due to normal operating loads. For surface cracks, the SIF values are for the locations that correspond to the deepest point of the crack and the inside surface tips. Because of the assumed symmetrical surface crack shape, the SIF values are the same at both the inside surface tips; thus, the provided SIF value represents both locations. For TWCs, the provided SIF values are identical on the inside and outside surfaces because the TWC SIF module calculates the SIF from a single crack half-length. For TRCs, the SIF values on the inside and outside surfaces are different because of the corrections applied by the crack transition module that take into account the different crack half-lengths at the inside and outside surfaces.

Error Tracking The computational core tracks errors for axial and circumferential cracks separately. Each of the modules returns error codes, which are generally reported as either 100-, 200-, or 300-level errors:

• 100-level errors are typically reported by a module when it receives an input value that is outside the valid range. Generally, these errors are fatal, and the user should resolve them by stopping the simulation and checking the associated inputs.

• 200-level errors are typically associated with a module runtime error. Generally, these errors are fatal, and the user should resolve them by stopping the simulation and determining the cause of the error.

• 300-level errors are typically warnings. These errors may impact the validity of the results. The simulation may be continued, but the user should review the warning.

Dashboards display the errors for each module so that the user can determine their source.

Figure 2-34 is a screenshot of the error tracking dashboard for circumferential cracks. A time history is available so that the user can determine when the error occurred during the simulation. Another feature indicates the modules that were not called by the computational core and thus could not have experienced any errors. In addition, an indicator is displayed if a module experienced unique error codes for different cracks. By default, if the computational core encounters a 100- or 200-level error, then it will interrupt the simulation and alert the user.

The alert identifies the exact realization, time step, element, and location where the computational core encountered the error. The user may then pause the simulation at that point to easily investigate the cause. There are some exceptions, however, as certain modules were developed with 100- or 200-level warnings instead of fatal errors. The user may turn off this error-handling option.

2-84

Figure 2-34 Error tracking dashboard for circumferential cracks 2.3.2 Input Set The input set is an Excel workbook that contains nearly all the inputs needed to run an xLPR V2 simulation. The remaining inputs pertain to a few sampling option settings that must be set in the computational core; these settings can be recorded in the input set but only for documentation purposes. The input set contains 13 worksheets. Each of these worksheets is designated by the type of inputs it contains. The worksheets show the input names, identification numbers, and descriptions. They are organized to assist the user with entry of the various options, values, and distributions. They also contain features to facilitate data entry.

For example, color-coding indicates important information about the content of various input 2-85

cells, and the acceptable ranges for each input are also displayed. The descriptions of these worksheets are grouped into the following areas:

• user options

• system properties

• material properties

• WRS

• fatigue

• supporting functions and information 2.3.2.1 User Options The user enters all the options and attributes that define the scope of a given simulation on the User Options worksheet. Important categories of inputs on this worksheet include the following:

• general options: used to specify the calendar time of the simulation, number of subunits, and whether to model axial cracks, circumferential cracks, or both.

• looping and sampling options: used to specify the numbers of epistemic and aleatory realizations; random seeds; and whether to use LHS, DPD sampling, and importance sampling. A few of these sampling options cannot be set on this worksheet and must instead be set in the computational core; however, the user may note the settings here.

• weld type options: used to specify whether the weld is similar or dissimilar metal; the mixture ratio, which is used to average certain material properties for the left pipe and right pipe components; and whether to include PWSCC growth in the left pipe and right pipe components for axial cracks.

• mitigation options: used to specify whether and when chemical mitigation using zinc or hydrogen or mechanical mitigation using inlay, overlay, or MSIP occurs.

• load and stress options: used to specify the number of normal operating periods and whether the normal operating loads are input using stresses or forces and moments.

Here the user also activates and specifies the types of any active transients.

• crack modeling options: used to specify whether crack initiation and growth occur by fatigue, PWSCC, or both. The option for preexisting cracks may also be selected. For PWSCC initiation, the user also specifies the specific model to use. Other options here control the behavior of the crack coalescence models.

• ISI and leak rate detection options: used to specify the detectable leak rate and how and when inspections are performed including both before and after inlay, overlay, or MSIP mitigation. Here the user also specifies how to handle sizing uncertainty and how to calculate the POD and PNR.

• leak rate module inputs and options: used to view the crack morphology parameters for PWSCC and fatigue and to specify the temperature and pressure ranges used to create the leak rate module lookup tables. Here the user may also specify whether uncertainty will be applied to leak rate calculations less than or equal to 0.63 kg/s (10 gpm).

2-86

• crack stability options: used to reduce the number of calls to the various crack stability modules to speed up calculation times.

• LOCA options: used to define the thresholds in terms of leak rate or crack-opening area for the occurrences of small-break, medium-break, and large-break LOCA outputs.

• error handling options: used to specify whether the computational core stops the simulation in the case of a fatal error to facilitate tracing of the error.

• leak rate jump indicator thresholds: used to specify the lower and upper bounds for the leak rate jump indicator output.

2.3.2.2 System Properties The user generally enters the input variables associated with the piping system, excluding the material properties, on the System Properties worksheet. The inputs on this worksheet can be defined as either constants or as probability distributions to be sampled in either the epistemic or aleatory loops. Figure 2-35 provides a screenshot of this worksheet.

Figure 2-35 System Properties worksheet of the input set Important categories of inputs on this worksheet include the following:

• general properties: used to specify the geometry of the pipe, weld, inlay, and overlay, as applicable. Here the user also specifies the sizes of either the preexisting cracks or cracks initiated by PWSCC or fatigue. The lengths and depths of the initiated cracks are spatially variable around the circumference of the weld, and each has a corresponding 2-87

multiplier to facilitate the use of importance sampling. The total number of EFPYs over the entire simulation period is also specified.

• operating conditions: used to specify the operating pressures and temperatures and the dissolved oxygen concentrations for each of the three normal operating periods. Here the user also enters the rate of fluid flow through the pipe and the pre- and post-mitigation concentrations of hydrogen and zinc.

• loads and stresses: used to specify loads and stresses for each of the three normal operating periods, seismic loading conditions, such as stresses and probability of occurrence, and any additional surface stresses to apply at the inside surface of the weld. Here the user also specifies whether the WRS profile inputs are to be treated as constant, aleatory, or epistemic, and whether importance sampling is applied to the first WRS profile point. The WRS profiles themselves are specified on the Hoop WRS and Axial WRS worksheets.

• ISI properties: used to specify the ISI model parameters (for example, the depth-sizing slope and logistic regression model slope terms used respectively in the ISI module evaluation and inspection routines). Separate sets of inputs are required for premitigation and postmitigation using inlay, overlay, or MSIP. Correlations for some of these inputs may also be specified.

2.3.2.3 Material Properties The user enters the material properties for the various components on the Left Pipe, Right Pipe, Weld, and Mitigation worksheets. As in the System Properties worksheet, the inputs on these worksheets can be defined as either constants or as probability distributions to be sampled in either the epistemic or aleatory loops. The material property worksheets are all identically organized with the same input types, although the input elements used vary from sheet to sheet.

Important categories of inputs on these worksheets include the following:

• general properties: used to specify the material strength and fracture toughness parameters.

• TIFFANY properties: used to specify TIFFANY model parameter inputs, such as the thermal expansion coefficient. Because TIFFANY is a deterministic preprocessor, these inputs can be defined only as constant.

• crack initiation properties: used to specify the PCI and FCI model parameter inputs for various material types. The sets of inputs used depend on the material flag settings and on the PWSCC initiation model selected by the user.

• crack growth properties: used to specify CGR model parameter inputs for various material types. As with the crack initiation properties, the sets of inputs used depend on the material flag settings.

• miscellaneous properties: deterministic inputs used to specify the material flags and a few other miscellaneous properties.

• correlations: used to correlate specific combinations of material property inputs.

2-88

Of note, even though the Left Pipe and Right Pipe worksheets have the same input elements as the Weld and Mitigation worksheets, fewer of these elements are actively used. For instance, because the computational core does not initiate cracks in the base metals, the crack initiation properties on the Left Pipe and Right Pipe worksheets are generally not used. Also, TIFFANY uses only the TIFFANY properties from the Weld worksheet. The Mitigation worksheet is used only in case of inlay or overlay.

2.3.2.4 Welding Residual Stresses The user enters the WRS profiles on the Hoop WRS and Axial WRS worksheets. They are identically organized with the same input types. Each worksheet contains two tables: one for entry of the WRS profile premitigation and the other for entry of the WRS profile postmitigation using inlay, overlay, or MSIP. The user defines each of the WRS profiles using up to 26 points through the thickness of the weld, where the first point corresponds to the location on the inside surface. For information purposes, the display shows the user whether the WRS profile points are treated as constant, aleatory, or epistemic, as set on the System Properties worksheet. If set as aleatory or epistemic, the computational core requires a normal distribution, which is also displayed to the user for information purposes. The only remaining input is the coefficient for the point-to-point correlation. This input acts to correlate sampled WRS values at adjacent points to ensure that the sampled values represent a physically reasonable, smooth profile. A feature is also included to aid the user in visualizing the WRS profile by showing a plot of the deterministic stress values by location.

2.3.2.5 Fatigue The user enters additional fatigue inputs on the Transient Definitions and TIFFANY Inputs worksheets. The Transient Definitions worksheet contains tables for defining up to 20 possible Type I transients. In these tables, the user specifies the changes in temperature and pressure relative to normal operating conditions as a function of time. TIFFANY uses these deterministic inputs to calculate SIF values, maximum and minimum stresses, and the transient rise times.

The TIFFANY Inputs worksheet is used to specify other deterministic inputs, such as the frequencies and scheduling of all transient types and the stresses for Type III transients and the Type II portion of Type I and II transients. The TIFFANY Inputs worksheet is also used to specify the transient uncertainty multipliers for each transient. The computational core uses these multipliers to apply uncertainty to the SIF values calculated by TIFFANY. The uncertainty multipliers can be defined as either constants or as probability distributions to be sampled in either the epistemic or aleatory loops.

2.3.2.6 Supporting Functions and Information The remaining worksheets, namely Options, Drop-List Options, and Material Flags, provide supporting functions and information. They are read-only and cannot be changed by the user.

The Options worksheet is used to communicate the user inputs from the User Options, System Properties, Left Pipe, Right Pipe, Weld, Mitigation, Hoop WRS, Axial WRS, Transient Definitions, and TIFFANY Inputs worksheets to the computational core. The Drop-List Options and Material Flags worksheets provide reference information to the user. The Drop-List Options worksheet lists all the options for the various drop-down lists used throughout the input set.

This worksheet also lists the order and definition of the probability distribution parameter entries expected by the computational core. This parameterization must be used when specifying probability distributions throughout the input set so that the distributions are sampled correctly.

The Material Flags worksheet is informational. It lists the available material type flags used by 2-89

the PCI, FCI, and CGR modules. The user must determine the appropriate flags and input them on the Left Pipe, Right Pipe, Weld, and Mitigation worksheets.

2.3.3 Preprocessor The user runs the preprocessor to execute the leak rate module and TIFFANY and to create the associated lookup tables. The calculations performed by these modules are deterministic. The computational core imports the lookup tables and interpolates values from them when needed within a realization. All the inputs for the preprocessor come from the input set. Color coding in the input set identifies which inputs are required for the leak rate module, TIFFANY, or both.

The leak rate module calculates leak rates for TRCs and TWCs as a function of COD, crack length, and pipe thickness. TIFFANY is required to be run only when fatigue initiation, fatigue growth, or both are modeled. It calculates SIF values, rise times, and maximum and minimum stresses. The user must run TIFFANY once for premitigation conditions and once for postmitigation using inlay, overlay, or MSIP, as applicable. A feature in the preprocessor allows the user to compare two sets of lookup files, check the inputs used to generate them, and plot the leak rates from a completed preprocessor run. This feature is useful for examining the outputs of the preprocessor.

2-90

3 QUALITY ASSURANCE Quality assurance was integral to the xLPR V2 development process. In fashioning the quality assurance program for the project, the developers followed NRC requirements and internationally recognized standards of software engineering.

3.1 Background

Appendix B to 10 CFR Part 50 [3] establishes quality assurance requirements for the design, manufacture, construction, and operation of systems, structures, and components in nuclear power plants. As defined in this regulation, quality assurance comprises all the planned and systematic actions necessary to provide adequate confidence that systems, structures, and components will perform satisfactorily in service. The Atomic Energy Commission, the predecessor agency to the NRC, promulgated these requirements in 1970 [127] to ensure that (1) applicable regulatory requirements and the design basis for systems, structures, and components are correctly translated into specifications, drawings, procedures, and instructions, (2) systems and components fabricated and tested in manufacturers facilities conform to the specifications, drawings, procedures, and instructions, (3) systems, structures, and components constructed and tested at the nuclear power plant site conform to the specifications, drawings, procedures, and instructions, and (4) succeeding activities, such as operating, testing, refueling, repairing, maintaining, and modifying nuclear power plants, are conducted in accordance with quality assurance practices consistent with those used during design and construction.

Appendix B to 10 CFR Part 50 contains 18 criteria:

(1) organization (2) quality assurance program (3) design control (4) procurement document control (5) instructions, procedures, and drawings (6) document control (7) control of purchased material, equipment, and services (8) identification and control of materials, parts, and components (9) control of special processes (10) inspection (11) test control (12) control of measuring and test equipment (13) handling, storage, and shipping (14) inspection, test, and operating status (15) nonconforming materials, parts, or components (16) corrective action (17) quality assurance records (18) audits Regulatory Guide 1.28, Revision 4, Quality Assurance Program Criteria (Design and Construction), issued June 2010 [128], describes methods that the NRC staff considers acceptable for complying with the provisions of 10 CFR Part 50, Appendix B, for establishing and implementing a quality assurance program for the design and construction of nuclear power plants. Specifically, this regulatory guide states that the Part I and Part II requirements included in ASME NQA-1-2008, Quality Assurance Requirements for Nuclear Facility Applications [129]

and the NQA-1a-2009 Addenda [130] are acceptable to the NRC staff, subject to certain 3-1

additions and modifications identified in the regulatory guide. Part I establishes requirements for the development and implementation of a quality assurance program for nuclear facility applications. It is arranged by the same 18 criteria as in 10 CFR Part 50, Appendix B. Part II contains additional quality assurance requirements for the planning and conduct of specific work activities under a quality assurance program developed in accordance with Part I. These work activities include, but are not limited to, management, planning, site investigation, design, computer software use, commercial-grade dedication, procurement, fabrication, installation, inspection, and testing.

3.2 Approach EPRI develops software for use in nuclear safety applications following a quality assurance program that meets the requirements of 10 CFR Part 50, Appendix B. However, the NRC does not impose the same requirements upon itself. Instead, the NRC issued guidance on the development and maintenance of software for use by the NRC staff in NUREG/BR-0167, Software Quality Assurance Program and Guidelines, in February 1993 [131]. This document is based on various industry standards, but it does not address the complex issue of quality for software used in nuclear power plants.

These differences in approach and the jointly managed nature of the virtual project organization dictated certain limitations in achieving full consistency with 10 CFR Part 50, Appendix B, requirements. To bridge the differences, the developers established a quality assurance program specifically for the xLPR V2 developmental effort. This program fulfilled the software work practice requirements of ASME NQA-1-2008 and NQA-1a-2009 Addenda, Part I, Requirement 3, Paragraph 800; Requirement 11, Paragraphs 100, 200, 400, 500, and 600; and Part II, Subpart 2.7. The nonsoftware requirements, or general requirements, applicable to the project were Part I, Requirements 1, 2, 4, 5, 6, 7, 17, and 18. In summary, the xLPR V2 quality assurance program satisfied most of the requirements in 10 CFR Part 50, Appendix B. Some of the important exceptions that the program did not include were a corrective action program or method to handle nonconformances. Also, suppliers were not required to be qualified in accordance with the requirements of 10 CFR Part 50, Appendix B, since services procured by the NRC are not subject to these requirements. Accordingly, implementing xLPR V2 to be fully consistent with 10 CFR Part 50, Appendix B, would require additional actions.

3.3 Implementation The xLPR V2 quality assurance program was implemented through the project control plans, specifically the following:

• xLPR Software Project Management Plan

• xLPR Software Quality Assurance Plan

• xLPR Software Configuration Management Plan The xLPR Software Project Management Plan provided the developers with the requirements for overall execution of the project. It specified the project organization, technical processes, and supporting processes, which are summarized in Sections 1.4.2, 3.4, and 3.5, respectively.

This plan addressed the applicable supporting quality assurance requirements that were not specific to software, that is ASME NQA-1-2008 and NQA-1a-2009 Addenda, Part I, Requirements 1, 2, 4, 5, 6, 7, 17, and 18. The developers aligned it with software engineering best practices from Institute of Electrical and Electronics Engineers (IEEE) 1058-1998, IEEE Standard for Software Project Management Plans [132].

3-2

The xLPR Software Quality Assurance Plan provided the developers with the quality assurance requirements for the development, procurement, maintenance, testing, and configuration management of xLPR V2. It specified the required software documentation and software engineering process. This plan addressed the applicable software work practice requirements of ASME NQA-1-2008 and NQA-1a-2009 Addenda, Part I, Requirement 3, Paragraph 800; Requirement 11, Paragraphs 100, 200, 400, 500, and 600; and Part II, Subpart 2.7. The developers aligned it with software engineering best practices from IEEE 730-2002, IEEE Standard for Software Quality Assurance Plans [133].

The xLPR Software Configuration Management Plan supported the xLPR Software Quality Assurance Plan. It specified the structure and methods for tasks such as identifying the items subject to configuration management (e.g., the software itself and the software documentation);

controlling modification, storage, and release of these items; and ensuring their completeness, consistency, and correctness. The developers aligned it with software engineering best practices from IEEE 828-2005, IEEE Standard for Software Configuration Management Plans

[134].

3.4 Technical Processes 3.4.1 Software Development Process 3.4.1.1 Model The primary functions of a software process model are to determine the order of the stages involved in software development and evolution and to establish the criteria for transitioning from one stage to the next. The developers followed a spiral process model for development of xLPR V2 as illustrated in Figure 3-1. The spiral model was originally described by Boehm [135].

The distinguishing feature of the spiral model is that it creates a risk-driven approach to the software development process rather than a primarily document-driven or code-driven process.

Figure 3-1 illustrates the spiral software development lifecycle process used for xLPR V2.

Starting at the center of the spiral, each cycle progresses through several tasks:

• Determine the objectives, alternatives, and constraints.

• Evaluate alternatives and identify and resolve risks.

• Develop and verify work products.

• Plan the next cycle.

The spiral process facilitates the continuous refinement of key work products, such as those supporting requirements definition and analysis, system and software design, design implementation, and testing. It also allows for the incremental release of work products or for incremental refinements. Work products developed during each cycle are extensions of the work products developed during the previous cycle, with final design, implementation, integration, and testing occurring in the final cycle. The spiral was repeated multiple times for each module, the Framework, and for the modules and Framework together as an integrated software system.

The process also addresses the problem of requirements engineering through development of prototypes and interim deliverables. Requirements activities take place in multiple sections and in multiple cycles. This approach allows for elements of the work product to be added when they become available or known and ensures that there are no conflicts with previous 3-3

requirements and design. Documentation is produced in the spiral process when required, and the content reflects the information necessary at that point in the process. Thus, all the documentation is created neither at the beginning of the process nor at the end. Like the software products they define, the documents themselves are works in progress until the project is declared complete. As such, a continuous stream of documentation is produced and made available for the developers review.

Figure 3-1 Spiral model for software development Source: Adapted from [135, Fig. 2]

3.4.1.2 Lifecycle Phases Five software lifecycle phases were used in developing xLPR V2:

(1) planning phase (2) requirements phase (3) design phase (4) implementation phase (5) test phase 3-4

Following the spiral process model, the developers repeated these phases with each cycle to the extent necessary commensurate with the scope of the cycle. Each module, the computational core, and the fully integrated code progressed through this development process largely independently. The following sections describe the software lifecycle phases and the typical output documentation produced as a result. Appendix C illustrates the relationships among the software lifecycle phases, output documentation, and responsible project groups.

Following the established quality assurance program requirements, all final output documentation was subject to configuration management and independently verified by project team members not involved in development of the documents. The documentation was reviewed, as applicable, by subject matter experts and group leads and approved by the NRC/RES and EPRI project managers.

Planning Phase In the planning phase, the developers undertook a scoping study to identify, prioritize, and ultimately define what would be included in xLPR V2. The functional work groups then addressed the in-scope elements in detailed work plans defining the strategy for execution of the project within their areas of responsibility to meet the project objectives. Implementation of the quality assurance work plan, for example, led to development of the project control plans discussed in Section 3.3. These work plans established the roadmap for all activities required to execute the project.

Requirements Phase In the requirements phase, the developers identified and documented the functions to be performed by the code. These functions were defined with the level of detail as it was known in each iteration of the software lifecycle. In the initial cycle, only a high-level design was defined, which then progressed into a complete and detailed design in the final cycle. The software requirements were tracked through the subsequent design, implementation, and test phases.

The primary outputs of the requirements phase were the software requirements description documents. These documents describe aspects such as the software functions, input and output requirements, interfaces, performance requirements, and design constraints. They also identify applicable references, specifications, codes, standards, regulations, procedures, or instructions that establish the software requirements, test, inspection, and acceptance criteria.

Acceptance criteria include a quantification of specified acceptable error range percentage or a quantitative basis for each required output or feature to be evaluated. In addition, the software requirements description for the Framework specifies the technical and software engineering requirements, including safety and security features. Security requirements were specified commensurate with the risk from unauthorized access or use. The developers criteria for the software requirements were that they be complete, correct, concise, consistent, unambiguous, understandable, relevant, and testable.

An additional output of the requirements phase was the software verification and validation plan.

This document provided the developers with a systematic process for verifying and validating the code. Verification ensured that the work products from each software lifecycle phase complied with previous lifecycle phase requirements; satisfied the standards, practices, and conventions of the phase; and established a basis for initiating the next phase. Validation was defined for the models and Framework to demonstrate that the code fulfills its intended use.

The plan directed that progressive testing occurs. For software verification purposes, unit testing verified the functionality of specific modules or the Framework by themselves, and 3-5

integration testing verified the interfaces. For software validation purposes, acceptance testing validated each model and the Framework-level acceptance testing validated the integrated models within the complete software system.

Design Phase In the design phase, the developers prepared, documented, reviewed, and approved the software designs. The requirements served as the basis for software design, which progressively aligned with those requirements as they matured through each iteration of the software lifecycle.

The primary outputs of the design phase were the software design description documents.

These documents define the computational sequence necessary to meet the software requirements. They include, as applicable, software architecture, numerical methods, mathematical models, physical models, control flow, control logic, data model, data flow, process flow, data structures, process structures, and the applicable relationships between data structures and process structures. They also specify the design of the user interface and design of interfaces with other software. The design also considered the operating environment, as well as measures to mitigate the consequences of problems. These potential problems included external and internal abnormal conditions and events. The developers key criterion for the software design descriptions were that they adequately describe the implemented design.

Typically, the software design descriptions were drafted in parallel with initial coding and informal testing activities.

Implementation Phase In the implementation phase, the code itself was realized. Here, the design, as described in the software design description, was used as the basis for developing the code following documented coding standards and conventions. The primary output of the implementation phase was the collection of products into which the requirements and design, including interfaces, were transformed including the source and executable code. Another output of this phase was the user manual, which describes the use of the code, including hardware and software requirements, installation instructions, description of inputs and outputs, theoretical basis, and sample problems.

Test Phase In the test phase, the developers exercised or evaluated the code by manual or automated means. Test cases and associated acceptance criteria traceable to the software requirements and design documentation were developed and executed in this phase. The objectives were to demonstrate that the code performs all functions in accordance with specified requirements, properly handles abnormal conditions and events as well as credible failures, does not perform adverse or unintended functions, and does not degrade the host system. As the unit and acceptance tests were completed for each module, the modules were incrementally integrated with the Framework and tested during subsequent iterations of the software lifecycle. This process continued until all software requirements had been defined, the software design had been finalized, and all module implementation documentation was completed. At that point, integration and Framework-level acceptance testing were performed. The testers reported any anomalies, such as observations of unexpected results and issues with the test methods, procedures, acceptance criteria, and environment. The developers then evaluated and tracked 3-6

these issues, the resolution of which may have led to modifications to the software requirements, design, implementation, or test plans.

The primary outputs of the test phase were the software test plans and software test results reports. The software test plans describe how the code was tested to verify proper functionality.

The test plans include the verification and validation criteria used to ensure that all software met applicable requirements. They also identify the required tests, appropriate test sequence, testing methods, and stages at which testing was required. Other areas addressed by the software test plans include the required ranges of input parameters and assumptions, expected output values or ranges, and testing necessary to ensure the functionality of critical characteristics of commercial off-the-shelf software used in the design. The software test results reports include evaluations of the test results against the expected results and acceptance criteria. They also include a copy of the software test logs, which capture the results obtained during execution of the software tests.

The final output of the test phase was the software verification and validation report. This document describes the results of implementing the software verification and validation plan by summarizing all the verification and validation activities, test results, anomalies that were reported, and how those anomalies were resolved. It also provides an overall assessment of software quality along with lessons learned and recommendations. It concludes with the developers final determination as to whether xLPR V2 and its associated software lifecycle documentation are technically acceptable and ready for software operations and maintenance.

Acceptance was based on the acceptance criteria being fulfilled as demonstrated through the conduct of the formal verification and validation testing and approval of results.

3.4.2 Decisionmaking Processes Achieving the goals of the project demanded that a challenging and wide array of technical issues be thoroughly discussed with thoughtful decisions made that fully reflected diverse inputs, perspectives, and experiences. In addition, given the constraints of the project, decisions needed to be made promptly with the best possible outcome for overall project success. Because of these needs, NRC/RES and EPRI established an escalating framework for making decisions. This framework consisted of four processes:

(1) consensus decisionmaking (2) structured decisionmaking (3) strategic decisionmaking (4) alternative professional view resolution These processes were based on the expectation that most decisions would have a relatively obvious, practical, and noncontroversial outcome and would be arrived at easily with limited discussion. Some decisions were expected to have a less obvious outcome and would require a modest amount of discussion and consideration of known alternatives before arriving at a practical and noncontroversial outcome. A still smaller number of decisions were expected to address issues that had more significant implications for the success and direction of the project or may have exposed areas of extreme technical complexity with unknown impacts or high levels of uncertainty. The decisionmaking framework was flexible enough to accommodate all these situations and the limited ability of the work groups to interact in face-to-face settings.

The consensus decisionmaking process was the one most commonly used. The process consisted of a work group holding open discussions on an issue to identify the pros and cons of the potential resolutions. For more complex issues, white papers were prepared to more 3-7

rigorously identify the relevant facts and evaluate alternatives. After the issue was thoroughly vetted, the group lead would seek to reach a simple consensus on the optimum resolution. The group lead would then identify the necessary actions and set a schedule for implementation.

Documentation of the consensus decision was typically provided as part of the work groups meeting notes or through e-mail exchanges. These types of decisions were typically arrived at during normal business interactions with a clear majority supporting the selected option and often no one opposed.

In a few cases, a consensus could not be reached, so the work group exercised the structured decisionmaking process. This process was used if the consensus decisionmaking process was unsuccessful and typically applied to issues characterized by small to moderate technical differences among work group members, with a limited number of alternative solutions. The process consisted of the work group holding open discussions to clearly define the alternative solutions and identify the pros and cons of each, along with their expected effects on the projects cost and schedule. The work group members then individually ranked the proposed solutions considering the potential uncertainties or risks in achieving the expected results. The solution with the highest ranking was taken as the preferred solution, which the group lead then integrated into the project work plans and schedules. Documentation consisted of a summary of all the solutions evaluated, the pros and cons of each, and the ranking results provided as part of the work groups meeting notes or through e-mail exchanges. Through this process, the majority and minority typically agreed that the preferred solution resulted in an acceptable technical product; however, the minority may have contended that a different solution was either more efficient or produced a superior technical product. The minority position was not expected to result in an alternative professional view; however, the alternative professional view resolution process was available as a means of appealing the outcome of the structured decisionmaking process.

Although never used, the strategic decisionmaking process was available if the structured decisionmaking process was unsuccessful in developing an acceptable solution and the time and resources were available to complete this more intensive process. The process was intended to be applied for issues characterized by either significant divergence of opinions among members of a work group or by multiple, complex alternative solutions with high uncertainties or risks and potentially significant impacts on the project. The process was modeled after the Kepner-Tregoe approach [136] and designed to remove most of the subjectivity from the decisionmaking. This was to be accomplished by providing a technical description of each alternative solution followed by discussions and a structured evaluation considering both the known and potential consequences and technical attributes of each. The structured evaluation would have required the workgroup to separate necessary attributes from desired attributes and then determine the relative importance of each desired attribute independent of the potential solution. The relative importance of each attribute would then be weighted, taking into consideration the alternative solution that best satisfied each desired attribute. The solution with the highest score would then have been the recommended approach. As with the structured decisionmaking process, an unresolved minority position could have been pursued through the alternative professional view resolution process.

Also never used, the alternative professional view resolution process was available if an individual continued to have a technical disagreement that was not adequately resolved using any of the other decisionmaking processes. The purpose of this process was to encourage and facilitate dialogue and timely resolution of issues that could have affected the technical direction or implementing strategies for the project. An alternative professional view was defined as a differing perspective held by one or more individuals on a project technical decision that was 3-8

perceived as likely to result in a significantly adverse impact on the outcomes of the project.

The process would begin by the holder of the alternative professional view preparing a formal document outlining the technical issue, recommendations, potential impacts, relevant background information, and a description of prior efforts to resolve the issue and the results of those efforts. The NRC/RES and EPRI project managers would then screen the submission to determine if it met the criteria for consideration under the process. If it did, the issue would be referred to the PIB lead to appoint a review panel consisting of the PIB and any subject matter experts necessary to conduct a thorough review. The panel would review the issue to determine whether enough information was supplied and request any additional information as needed. A meeting would then be held with the submitter to discuss the scope of the issue.

After this meeting, the panel would conduct a detailed review of the issue and related records and hold interviews or other discussions necessary to provide a complete, objective, independent, and impartial review. The review panel would then provide a written report of its evaluation including recommendations and any dissenting opinions to the NRC/RES and EPRI project managers to jointly make the final decision.

3.5 Supporting Processes 3.5.1 Training All project team members were selected based on their technical expertise, so training focused on appropriate indoctrination into the quality assurance program. The QAA Group was responsible for the indoctrination process. The QAA Group maintained a roster that reflected the current project team members and their roles. A training matrix was then used to determine what specific training was required for everyone based on their roles. The project team members had a variety of specific work activities and responsibilities and were geographically distributed; therefore, various methods were used to deploy the training. These methods included attending meetings or workshops and reading or reviewing project documents, overview materials, or user manuals. When a project document or tool underwent major revisions, all team members were required to take the associated training. For minor updates, the QAA Group sent a summary of the changes. In addition, an annual review of the basic project processes and procedures was provided. In all scenarios, a record of the completed training was produced and maintained, indicating the title of the training, the version if appropriate, and the date. Throughout the project, the QAA Group assessed training needs by regularly reviewing the project team roster and training records.

3.5.2 Procurement Management Before the award of any contracts for products or services, the NRC/RES or EPRI project manager, as appropriate, evaluated the suppliers capability to provide the products or services in accordance with the requirements of the procurement documents. Supplier evaluations included, for example, review of the suppliers history of providing the product or service as available through industry reports, assessments, or other publicly available information; review of any supplier quality records that could be objectively evaluated; or direct evaluation of the suppliers technical or quality capabilities. The sponsoring organization retained descriptions of each participating organizations qualifications to fulfill its intended roles.

Procurement documents included statements of the scope of work to be performed. The procurement documents specified appropriate requirements for the products or services to be furnished and the acceptance criteria for those products or services. Alternatively, the procurement documents defined a process to specify such requirements. Suppliers of products 3-9

specified the requirements for reporting nonconformances. Suppliers of services were obligated to follow the requirements of the quality assurance program established for the project or an equivalent program. Any requirements imposed on a supplier were also applied to any subtier suppliers. The procurement documents were generated and maintained in accordance with the sponsoring organizations procurement processes and were made available to the project as needed.

3.5.3 Document Control Documents were controlled in accordance with the xLPR Software Configuration Management Plan. This and the other project control plans described in Section 3.3 were regularly reviewed to ensure that they properly addressed current practices and aligned with the projects needs.

Document revisions were initiated whenever deemed necessary, and all documents were required to be identified and tracked using unique version numbers. Technical changes required review and approval by individuals with the roles specified for review and approval of the initial document, whereas editorial changes were approved by the author only. Reviewers and approvers were included early in the revision process and had access to pertinent background information so that they could provide input early in the process. In addition, all changes were described in the revision history included in each document. Documents providing evidence of quality-affecting activities were identified and controlled as records.

Records generated by the developers were maintained in an electronic repository throughout the project in accordance with the xLPR Software Configuration Management Plan.

3.5.4 Reviews and Audits Project reviews were conducted for important project milestones. They assessed the technical adequacy and quality assurance controls as defined in the project documents. Project reviews were considered informal assessments and took the form of management progress reviews, developer peer reviews, or quality assurance reviews. These reviews were used as a method to assess the progress of the project and to identify areas for improvement. Individuals performing the project reviews were part of the project team but were independent from the work being evaluated. Process improvements were typically identified during these project reviews, but they could also be suggested at any time by a member of the project team.

Program audits were conducted to (1) verify compliance with the established project quality assurance requirements, (2) verify that performance criteria were met, and (3) determine the overall effectiveness of the quality assurance program to control and effectively document all phases of the project. A team led by a lead auditor qualified in accordance with ASME NQA-1-2008 and NQA-1a-2009 Addenda formally conducted these audits. The audit team members had experience or training commensurate with the scope, complexity, or special nature of the project and maintained independence from the work being audited. Audit reports, including scope, individuals involved, results, and findings, were written and endorsed by the lead auditor and issued to the project sponsors.

The QAA Group conducted four audits during the project: two project audits, a physical configuration audit, and a product assessment audit. These audits provided for independent reviews to ensure that the quality assurance program was established commensurate with the overall quality assurance approach and that the developers were following the requirements of the quality assurance program for all activities within its scope.

3-10

The first project audit was conducted in 2012 around the outset of the project. Its objective was to confirm that the quality assurance program was established in a manner consistent with the defined quality assurance approach. An independent auditor assessed the progress of the project, compliance with established quality assurance requirements, performance against established performance criteria, and the overall effectiveness of the quality assurance program. The auditor identified findings concerning areas such as the definition of roles and responsibilities, configuration controls placed on third-party software, and software requirements traceability. Several observations were also made on improving documentation for error-handling requirements, checks on software test case coverage against specific requirements, and identification of project risks.

The second project audit was conducted in 2013 while the project was underway. Its objectives were twofold: (1) evaluate activities for compliance with the established project documents, and (2) determine the extent to which aspects of the quality assurance program could be credited for potentially accepting or dedicating xLPR V2 for use in analyses for safety-related systems, structures, and components. A team of independent auditors conducted this audit. The audit team had several findings related to areas such as design verification, documentation of document approvals, training, records storage, and use of project tracking systems for initiating changes to configuration items. The team also provided observations.

A physical configuration audit was conducted in 2014, also while the project was underway. Its objective was to validate that all project deliverables were properly indexed and included in the configuration management system. In response to the observations from this audit, the developers updated the index of deliverables. They also removed duplicate and uncontrolled documents, archived obsolete versions, and otherwise ensured that the required deliverables were properly filed in the configuration management system.

A product assessment audit was conducted near the end of the project. Its objectives were to assess (1) the degree to which the project deliverables met the requirements of the quality assurance plan, (2) implementation of effective configuration management practices, and (3) conduct of the verification and validation activities. The product assessment audit made a few findings concerning areas such as software requirements traceability, provision of evidence of functional and physical configuration reviews, and the process for reviewing and approving major and minor document versions. Several observations were made in areas such as the software inventory, incorporation of a quality assurance standard compliance or cross-reference matrix, specific identification of the independent document reviewers, and the process for completing independent design verification reviews.

In response to the findings from these audits and reviews, the developers implemented corrective actions to update project documents and align project activities with the established project requirements. The developers also acted to address the observations, where appropriate. Observations from the product assessment audit were taken as recommendations to be considered for implementation in the future operations and maintenance phase of the software lifecycle.

3.6 Verification and Validation 3.6.1 Process Because of the complexity of xLPR V2, the developers followed a systematic approach to verify and validate the software. Verification and validation activities were integral throughout the 3-11

entire software development lifecycle process described in Section 3.4.1. A software verification and validation plan documented the approach. The tasks required by this plan were aligned with IEEE software engineering best practices [137], and the overall verification and validation approach was based on ASME standards for engineering computer models [138].

Activities conducted in support of this plan were thoroughly documented in software test plans and software test results reports.

The software test plans were generated first, which required designing the tests and generating the test cases and test procedures. The testers then executed the test plans, identified anomalies, and documented the testing results in the software test results reports. In a final evaluation, the configuration of the xLPR V2 installation package was reviewed, and the developers documented and approved the verification and validation testing results to recommend the software and associated documentation as technically acceptable and ready for distribution.

The tools, techniques, and methodologies that were used for testing included the following:

• manual inspection

• alternate calculations using spreadsheet software or other engineering analysis software

• software execution, debugging, or custom driver code development using a suitable compiler or GoldSim installation

• comparisons to thorough, representative, and reliable datasets Verification testing was performed first on each of the modules by themselves, then on the Framework to test its required attributes and functions, and finally on the Framework and modules together as an integrated software system. Likewise, validation testing was performed for each of the modules and then for the Framework and modules together. Test execution and evaluation of results were performed by a different individual than the one who developed the coding.

3.6.2 Verification Testing As adopted from ASME for the xLPR V2 developmental effort, verification was the process of determining that a computational model accurately represents the underlying mathematical model and its solution [138]. The developers subjected xLPR V2 to over 4,000 verification tests.

The scope included both static and dynamic tests. Static tests involved manual inspection of the source code to verify that a requirement was met. They were generally intended to verify that the intent of the developer matched the requirement. While performing the static tests, the tester also looked for general issues with coding style and programming errors. Dynamic tests involved running the code with a predefined set of inputs and verifying that it met the requirements by comparing the results to a predefined and expected result. The dynamic tests were primarily intended to directly verify correct behavior of the software in cases where there was a significant risk of an error that would not have been apparent through static inspection.

3.6.2.1 Modules Testers independent from the module programmers executed hosts of tests to verify correct operation of each module. The testers checked the modules for proper logic flow, consistency with their supporting software documentation, and proper coding of equations. They also 3-12

verified proper output of error codes and warnings, tested mathematical or logical requirements, verified the numerical accuracy of the calculations, checked for adequate runtime performance, and compared results against independently calculated values. In some cases, the testers elected to perform and document testing to supplement the formal testing required in the testing plans.

The testers reported anomalies encountered during execution of the verification tests. The anomalies were investigated, and the affected configuration items were corrected as necessary.

The required corrections were typically routine. For example, the developers revised documentation to correct discrepancies or to include missing information. In isolated cases, the developers revised the source code to ensure proper operation of the module. Table 3-1 summarizes the extent of the module verification testing.

Table 3-1 Extent of module verification testing Module Static Tests Dynamic Tests Anomalies Found and Corrected PCI 37 72 6 FCI 14 58 4 SCSIF 7 87 4 TWC SIF 6 64 2 TIFFANY 4 66 0 CGR 46 101 5 CCC 51 72 14 crack transition 15 36 1 CCOD 9 1,970 3 ACOD 11 28 0 leak rate 0 424 0 MCSCS 5 40 2 SCSCS 5 40 2 CTWCS 5 62 2 ASCS 4 15 2 ATWCS 4 33 2 ISI 45 57 3 3.6.2.2 Framework Framework-level verification testing was conducted in two parts: unit testing and integration testing. Unit testing served to verify the Framework, by itself, as an individual component of the software system. Integration testing served to verify the integrated software system when the individual components (i.e., the Framework and all the modules) were combined.

3-13

Unit Testing The Framework was statically and dynamically tested as a stand-alone unit to verify conformance with all applicable software requirements. The testing included execution of 92 dynamic and 76 static test cases. Testing was performed in five rounds:

(1) In the first round, the testers reported 73 issues that resulted in 67 failed tests. Of these issues, 56 required updates to the test plan, typically to clarify testing procedures, and 4 were determined after evaluation to be false alarms. Seven of the issues required updates to the software documents, and ten issues required changes to the source code. The developers accepted one issue as a known error as discussed below.

(2) In the second round, the testers reported 47 issues that resulted in 52 failed tests. Of these issues, 39 required updates to the test plan, and 1 was determined to be a false alarm after further evaluation. Five issues required updates to the software documents, and fourteen issues required changes to the source code.

(3) In the third round, the testers reported nine issues, all of which were failed tests. Eight of these issues required updates to the test plan, one required updates to the software documents, and two required changes to the source code.

(4) In the fourth round, the testers reported three issues, all of which were failed tests. One issue required an update to the test plan, and the other two issues required changes to the source code.

(5) No tests failed in the fifth round of testing.

The known error identified in the first round of testing concerned a difference between how forces and moments were required to be calculated and how they are calculated by the Framework. The impact is that the effective bending moments are overpredicted when the user inputs the normal operating loads in terms of forces and moments. Given the complexity involved in resolving the error, the developers chose to accept it because the user may instead input the normal operating loads in terms of the membrane and bending stresses. The user manual documents the error and the recommended workaround.

Integration Testing The Framework was statically and dynamically tested to verify that the interfaces between it and all the modules complied with applicable requirements and design descriptions. It was also verified that the Framework and modules satisfied critical software requirements when integrated together as a complete system. Furthermore, the interfaces between the Framework and the modules were verified for consistency in terms of units, data types, flags, and ordering and lengths of arrays. It was also verified that control flow was implemented correctly at these interfaces.

The testing included execution of 59 dynamic and 94 static test cases. Integration testing was performed in five rounds coinciding with unit testing:

(1) In the first round, the testers reported 50 issues that resulted in 42 failed tests. Of these issues, 37 required updates to the test plan, and 7 were determined after further evaluation to be false alarms. Three issues required updates to the software documents, and three others required changes to the source code.

3-14

(2) In the second round, the testers reported 32 issues that resulted in 34 failed tests. Of these issues, 24 required updates to the test plan, and 3 were determined to be false alarms after further evaluation. One issue required updates to the software documents, three issues required changes to the source code, and one issue required updates to both the software documents and source code.

(3) In the third round, the testers reported four issues, all of which were failed tests. One of these issues required an update to the test plan, and two required updates to the source code. The developers accepted one issue as a known error as discussed below.

(4) No tests failed in the fourth round of testing.

(5) No tests failed in the fifth round of testing.

The known error identified in the third round of testing concerns the Weibull Model for PWSCC initiation. Specifically, one of the test cases was intended to verify that the three PWSCC initiation models returned the same time to first initiation and number of multiple initiations as reflected in the technical report on PWSCC initiation model parameter development, confirmatory analyses, and validation [61] when using the calibrated model parameter inputs.

The test passed for Direct Model 1 and Direct Model 2, but it failed for the Weibull Model.

However, the observed discrepancy was small and bounded by the crack initiation model uncertainty. Section 4 explains this and other types of uncertainties in xLPR V2. Since it was determined that the discrepancy has a minimal effect on the results and can be further investigated in a sensitivity study, the developers determined that the Weibull Model may be used without any modifications or workarounds. The user manual documents the error for the users awareness.

3.6.3 Validation Testing As adopted from ASME for the xLPR V2 developmental effort, validation was the process of determining the degree to which a model accurately represents the real world from the perspective of the intended uses of the model [138].

3.6.3.1 Modules All the modules were validated as discussed in Section 2.2.

3.6.3.2 Framework Acceptance testing served to validate xLPR V2 as a complete software system. The developers established two goals for this testing:

(1) Validate the overall modeling approach for generic applications.

(2) Validate the probability of rupture for GDC 4 applications.

To meet these goals, the level of testing and acceptance criteria were chosen to provide reasonable assurance that xLPR V2 can provide technically defensible results consistent with known operating experience and expert judgment. Acceptance testing was accomplished using a graded approach, where the extent of testing applied to the different functional elements of the software was commensurate with their importance and the risk of functioning improperly.

3-15

Three types of tests were employed in acceptance testing:

(1) service tests (2) benchmark tests (3) model behavior tests The service tests were used to validate xLPR V2 results against operating experience. In the 2000s, PWRs across the world that began operation in the 1970s and 1980s began to experience PWSCC in butt welds in the reactor coolant system and associated branch line piping. Table 3-2 lists some of these events to indicate the nature and impact of the cracking that was observed. All the events involved cracking of nickel-alloy weld metals made of Unified Number System N06082 (American Welding Society (AWS) Classification ERNiCr-3) [9] and W86182 (AWS Classification ENiCrFe-3) [10] materials, collectively called Alloy 82/182.

Although most of the events involved surface cracks that were detected through ultrasonic testing, some involved TWCs that were detected by evidence of leakage. Importantly, however, none of the events led to rupture of the piping systems. The following welds, which had enough data available to permit a meaningful comparison, were selected for service testing:

• Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld

• Ringhals Nuclear Power Plant, Unit 4, hot-leg pipe-to-reactor-pressure-vessel nozzle weld

• North Anna Power Station, Unit 1, steam generator inlet nozzle to safe end weld

• Tsuruga Nuclear Power Plant, Unit 2, pressurizer relief valve nozzle to safe end weld These tests addressed the first goal of the validation testing by demonstrating the validity of the overall modeling approach through direct comparisons with PWSCC observed in operating plants.

Table 3-2 Select PWSCC events in PWR butt welds in the 2000s Year Plant Location Extent of Detection Rupture? Reference Cracking Method 2000 Virgil C. Hot-leg pipe-to- Axial TWC and Leakage No [139]

Summer reactor- axial and Nuclear pressure-vessel circumferential Station, nozzle weld surface cracks Unit 1 2000 Ringhals Hot-leg pipe-to- Axial surface Ultrasonic No [12]

Nuclear reactor- cracks testing Power Plant, pressure-vessel Unit 4 nozzle weld 2003 Tsuruga Pressurizer Axial TWC and Leakage No [11]

Nuclear safety and relief surface cracks Power Plant, nozzles Unit 2 3-16

Table 3-2 Select PWSCC events in PWR butt welds in the 2000s (continued)

Year Plant Location Extent of Detection Rupture? Reference Cracking Method 2003 Three Mile Pressurizer Axial surface Ultrasonic No [11]

Island surge line-to- crack testing Nuclear hot-leg nozzle Station, weld Unit 1 2006 Calvert Cliffs Surge line-to- Axial and Ultrasonic No [140]

Nuclear hot-leg weld, circumferential testing Power Plant, hot-leg drainline surface cracks Unit 1 weld, and pressurizer relief valve nozzle weld 2006 Davis-Besse Cold-leg Axial surface Ultrasonic No [141]

Nuclear drainline weld crack testing Power nozzle-to-elbow Station, weld Unit 1 2006 Wolf Creek Pressurizer Circumferential Ultrasonic No [142]

Generating surge, spray, surface cracks testing Station, relief, and Unit 1 safety nozzle-to-safe-end welds 2007 Joseph M. Pressurizer Axial and Ultrasonic No [143]

Farley surge nozzle circumferential testing Nuclear weld surface cracks Plant, Unit 2 2008 Davis-Besse Decay heat Axial TWC Leakage No [144]

Nuclear removal system Power drop line weld Station, Unit 1 2008 Crystal River Decay heat Circumferential Ultrasonic No [12]

Nuclear removal system surface crack testing Generating drop line weld Plant, Unit 3 2012 North Anna Steam Axial surface Ultrasonic No [145]

Power generator inlet cracks testing Station, nozzle to safe Unit 1 end weld The benchmark tests were used to validate xLPR V2 against other software. These tests addressed both goals of the validation testing by demonstrating that the results produced by xLPR V2 are reasonable and compare well with results from FEA simulations and comparable PFM codes. The model behavior tests were used to validate xLPR V2 against expected system behavior. These tests also addressed both goals of the validation testing, with some tests focused on the first goal and others on the second. The model behavior tests demonstrated that the overall behavior of xLPR V2 is consistent with the understanding of experts and covered model attributes that could not be practically tested in other ways.

3-17

Service Tests Eight service test cases were executed where probabilistic xLPR V2 results were compared to field observations. The results included time to axial crack leakage and circumferential crack depth for the Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld. The results included the number of axial cracks and lack of circumferential cracks for the Ringhals Nuclear Power Plant, Unit 4, hot-leg pipe-to-reactor-pressure-vessel nozzle weld; North Anna Power Station, Unit 1, steam generator inlet nozzle to safe end weld; and Tsuruga Nuclear Power Plant, Unit 2, pressurizer relief valve nozzle to safe end weld.

The comparisons were performed using methods such as determining the percentile of the xLPR V2 distributions within which the field observations fell or by plotting the results together and making a qualitative assessment. In other cases, it was demonstrated that xLPR V2 showed an adequate response (e.g., increase in the mean probability). Acceptance was based on whether xLPR V2 performed as expected based on the judgment of the testers. For instance, it was expected that xLPR V2 would predict fewer circumferential cracks than axial cracks because of the lack of circumferential cracks observed in the field, or it was expected that xLPR V2 predictions of the field observations would yield higher probabilities of failure (e.g., greater numbers of cracks or deeper cracks) as compared to generic analyses of similar components. Most of the service tests passed, meaning that xLPR V2 performed as expected.

Figure 3-2 illustrates some of the test case results for the hot-leg pipe-to-reactor-pressure-vessel nozzle weld axial crack leakage at Virgil C. Summer Nuclear Station, Unit 1. The vertical line at 17 years represents the time at which the leaking cracks were identified in the plant. Also displayed on the figure are estimates for the probability of first leakage over time from four xLPR V2 analyses. Runs X1 and X2 illustrate the effect of different WRS profiles because the welding sequence used during original installation of the weld is unknown. Run X1 is based on a WRS profile generated from an inside-outside welding sequence; Run X2 is based on an outside-inside sequence. The results from Runs X1 and X2 range from 3 to 30 percent probability of first leakage at 17 years, which compare favorably to the actual leak in the plant because the probabilities are sufficiently high that a leak is plausible. However, interpretation of these probabilities should consider that the analyses used generic estimates for some parameters, notably the material properties. Therefore, the results from Runs X1 and X2 were also interpreted relative to results from generic hot-leg pipe-to-reactor-pressure-vessel nozzle weld analyses (i.e., Run X3 with 2,500 realizations and Run X3 with 25,000 realizations). The significant differences between these runs and Runs X1 and X2 are consistent with expectations because the WRS conditions in the subject weld are known to be atypically high compared to conditions in hot-leg pipe-to-reactor-pressure-vessel nozzle welds typical of other plants.

3-18

Figure 3-2 Service test results for Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld where an axial crack resulted in leakage after 17 years of operation Two of the service tests for the Tsuruga Nuclear Power Plant, Unit 2, pressurizer relief valve nozzle to safe end weld were categorized as misses, meaning that the results were not as initially anticipated; however, after further study, they could be explained and were determined not to be linked to any issue in the code itself. For these missed tests specifically, the testers attributed the results to the WRS profiles used in the tests. The WRS profiles were based on best guesses, so there was a high degree of uncertainty in the actual conditions.

Benchmark Tests Eight benchmark test cases were executed. All these benchmark tests passed, meaning that xLPR V2 performed as expected.

Deterministic xLPR V2 results were compared against FEA simulations of axial crack growth in the Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld and the North Anna Power Station, Unit 1, steam generator inlet nozzle to safe end weld.

Figure 3-3 illustrates the comparison for the latter case.

3-19

(a) (b)

Figure 3-3 Benchmark test results comparing time to TWC at North Anna Power Station, Unit 1, steam generator inlet nozzle to safe end weld as predicted by (a) FEA simulation (4.75 years) and (b) xLPR V2 deterministic calculation (3.75 years)

In addition, probabilistic xLPR V2 results were compared with probabilistic results from two other PFM codes:

(1) Probabilistic Methods for Evaluating and Understanding Structures (PROMETHEUS)

[146]

(2) beyond-Piping Reliability Analysis Including Seismic Events (PRAISE), a successor to pc-PRAISE [147]

The comparisons were based on the known limitations and differences associated with each code. For example, while xLPR V2 can model axial cracks, beyond-PRAISE cannot. The comparisons were made against PROMETHEUS results for axial crack leakage and against both PROMETHEUS and beyond-PRAISE results for circumferential crack growth for the Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld.

The comparisons were made against PROMETHEUS results for axial and circumferential crack growth and beyond-PRAISE results for circumferential crack growth for the Ringhals Nuclear Power Plant, Unit 4, hot-leg pipe-to-reactor-pressure-vessel nozzle and North Anna Power Station, Unit 1, steam generator inlet nozzle to safe end welds. Figure 3-4 illustrates good agreement among the xLPR V2, PROMETHEUS, and beyond-PRAISE results for the 3-20

Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld circumferential crack initiation and leakage probabilities with the inner-outer WRS profile. Crack growth behavior is accounted for in the leakage probabilities.

Figure 3-4 Benchmark test results comparing xLPR V2, beyond-PRAISE, and PROMETHEUS probabilities of occurrence of first circumferential crack and leak for the Virgil C. Summer Nuclear Station, Unit 1, hot-leg pipe-to-reactor-pressure-vessel nozzle weld Model Behavior Tests Five model behavior tests were executed with the following goals:

(1) to assess cases that could lead to elevated probabilities of surface crack rupture (2) to assess the effects of increased ISI frequencies on the probability of leakage (3) to verify that modifications to the bending stress and WRS profiles have the expected effect on the probability of break before leak (4) to investigate how importance sampling can increase the convergence of outputs that capture very low-probability events (5) to verify that the modeled behavior for various mitigation options is consistent with the expected results for that mitigation option Most of the model behavior tests passed; however, the third model behavior test was categorized as a miss. The intent of this test was to grow cracks through-wall more quickly by increasing the bending stress, thereby reducing the probability of break before leak; however, the actual results showed the opposite effect of increasing the probability of break before leak.

After further investigation, calculations demonstrated that smaller crack depths, assuming a 3-21

constant crack length, are needed for surface crack rupture when the bending stress is increased. The testers determined that the behavior was reasonable given that this aspect of the failure mechanics was not fully considered when developing the test case. In conclusion, the initially expected behavior was erroneous, and xLPR V2 performed as intended.

3.6.4 Conclusion xLPR V2 was subject to a battery of verification and validation tests. Both types of testing were performed at the software component and system level. Based on the acceptability of the test results, the developers considered xLPR V2 suitable for its intended use and ready for software operations and maintenance.

3.7 External Reviews This section describes external reviews of the xLPR V2 developmental effort that were conducted by the Advisory Committee on Reactor Safeguards (ACRS) and ERB. Input from these bodies supplemented the formal quality assurance activities and enhanced the overall quality of the code.

3.7.1 Advisory Committee on Reactor Safeguards The ACRS is independent of the NRC staff and reports directly to the Commission, which appoints the members. The ACRS is structured as a forum where experts representing many technical perspectives can provide independent advice that is factored into the NRCs decisions

[148]. Individuals with a wide variety of expertise make up the committee. The membership typically includes experts in areas such as nuclear engineering; risk assessment; chemistry; facility operations management; severe accident phenomena; materials science and metallurgy; digital instrumentation and control systems; thermal hydraulics and heat transfer; and mechanical, civil, and electrical engineering.

The developers made three presentations to the ACRS during the project. In these meetings, the scope, plans, outcomes, and key technical aspects of the project were discussed. The first meeting was held with the full committee and focused on the project in general. The other two meetings were held with the Subcommittee on Materials, Metallurgy, and Reactor Fuels and focused on key technical topics, namely WRS and PWSCC initiation modeling.

The first meeting was held in 2012 at the conclusion of the xLPR Pilot Study and before the start of the xLPR V2 developmental effort. At this meeting, participants discussed the overall history and motivations for the project. Specifically, the developers highlighted the significance of leak-before-break analyses and the need for more thorough and quantitative methods to address consistency with the requirements of GDC 4. Next, the developers presented results from the xLPR Pilot Study, including its goals, project organizational structure, and processes for model selection and dual computational framework development. Results from the pilot study and overall lessons learned were also presented. Finally, the developers presented the plans for xLPR V2 development. The ACRS was briefed on how the scope of xLPR V2 would change and expand and how the results of the pilot study informed these decisions. Plans for managing the software development process, quality assurance, and validation were also presented. Finally, the developers provided the benefits and schedule for the xLPR V2 developmental effort, along with plans for additional meetings with the ACRS Subcommittee on Materials, Metallurgy, and Reactor Fuels to discuss specific technical topics of interest. The complete discussion is available in the transcript of the meeting [149]. As a result of the 3-22

discussion, the ACRS concluded that it would be essential for the developers to properly characterize WRS and treat uncertainties and develop a realistic crack initiation model.

The second meeting was held with the ACRS Subcommittee on Materials, Metallurgy, and Reactor Fuels in 2013. This meeting focused on WRS modeling and validation, which served to address the committees recommendation to properly characterize WRS and treat uncertainties in xLPR V2. The developers first presented the background and regulatory significance of the WRS validation program. The handling of the WRS in the ASME Code was discussed, along with recent operating experience concerning PWSCC, subsequent WRS validation studies, and associated regulatory actions. The developers described the handling of WRS in the xLPR Pilot Study and the improved implementation planned for xLPR V2. The discussions then focused on the accomplishments of the WRS validation program. Here, the developers presented the details, results, and conclusions of a multiphase collaborative effort to validate computational WRS models with WRS profile measurements. Sources of uncertainty in WRS modeling and the difficulties in obtaining reliable physical measurements were specifically highlighted. Finally, the developers informed the subcommittee of plans for future validation efforts, including further studies, development of more complex modeling techniques, codification of WRS input guidelines, and investigations to reduce model uncertainty. NUREG-2288, Weld Residual Stress Finite Element Analysis Validation: Part IIProposed Validation ProcedureDraft Report for Comment, issued August 2018 [150], presents a full summary of the results of the WRS validation program. The results from this program were ultimately used to validate the WRS inputs as discussed in the WRS Subgroup report [45]. The complete discussion of these topics is available in the transcript of the meeting [151].

The third meeting was also held with the Subcommittee on Materials, Metallurgy, and Reactor Fuels, again in 2013. This meeting focused on PWSCC initiation modeling and validation, which served to address the committees recommendation to develop a realistic crack initiation model for use in xLPR V2. First, the developers presented the background and current state of knowledge on modeling of PWSCC initiation phenomena. An overview of the PWSCC initiation models used in the xLPR Pilot Study was provided. The developers then presented the PWSCC initiation models for xLPR V2. The outcomes of an expert panel convened to inform the model selection and implementation process were presented, along with an overview of the available models and how they were developed. Finally, the proposed PWSCC initiation research program was introduced. The goal of this program is to produce statistically significant initiation statistics to further improve and validate the models in xLPR V2. The complete discussion is available in the transcript of the meeting [152].

3.7.2 External Review Board The ERB was formed to provide independent assessment of the programmatic and technical aspects of the xLPR V2 developmental effort and to make relevant recommendations to the developers for consideration. Specifically, concerning programmatic adequacy, the ERB assessed the following:

• the appropriateness of the qualifications and capabilities of the project team members to address the identified technical challenges

• the appropriateness of analytical resources, facilities, and laboratory equipment to address the identified technical challenges 3-23

• the adequacy of communications, quality assurance, and other project management practices to ensure the success of the project Concerning technical adequacy, the ERB assessed whether the developmental effort exhibited the following:

• engineering and scientific quality of work comparable to that of leading Federal, university, and industry research and development efforts

• broad understanding of, appropriate accounting for, and appropriate application of underlying scientific principles

• broad understanding of and appropriate accounting for the realities and constraints imposed by nuclear power plant design and operation

• an appropriate mixture of theory, computation, and experimentation

• adequate and appropriate benchmarking of analytical models against independent and rational metrics of truth The ERB held two meetings in support of the project. The scope of the ERBs reviews, resulting recommendations, and actions taken in response to these recommendations are summarized as follows. Full details of the interactions with the ERB are available in the ERB summary documents [153].

3.7.2.1 First Review The first ERB review occurred in 2013 after the planning phase was completed and early in the requirements and design phases. This timing allowed the developers to make changes based on feedback from the ERB. During the first review meeting, the ERB met with the project team for a full day of formal presentations, which was followed by questions and extensive discussion. Presentations by the developers at this meeting offered a retrospective on the goals, implementation details, and assessment of the xLPR Pilot Study [29], in addition to the plans for xLPR V2 development to expand and refine the simulation capabilities, including a summary of all the models planned for inclusion in the code. The project team structure was also presented. Before the meeting, the ERB members reviewed documentation on all aspects of the project leading to completion of xLPR V1. The ERB submitted questions to the project team before this review meeting. In large part, the formal presentations addressed these items.

The ERB agreed that the project was structured and managed in a way that would allow its objectives to be met. This included the project leadership and decisionmaking shared between NRC/RES and EPRI. The ERB also lauded several programmatic aspects. It noted that the technical qualifications and management capabilities of the project team were excellent, and it acknowledged the professional enthusiasm exhibited throughout the review meeting. In addition, the ERB indicated that the alternative professional view resolution process provided an excellent method for handling potential technical disagreements among the project team members. The ERB encouraged the project team to continue to publish conference papers and periodically update the ACRS on the project status.

With respect to the adequacy of the technical aspects of the project, the ERB acknowledged that the scope needed to strike a balance between producing an engineering tool in a practical time and the effort associated with a research and development project. To this end, the ERB 3-24

stated that the project team had succeeded. It found that the approach to integrate the modules together through the Framework was excellent. The ERB noted that the challenge for xLPR V2 development was to successfully transition from the accomplishments of the xLPR Pilot Study where some simplified approaches were used to more complete and sophisticated models and algorithms.

Stemming from the first review, the ERB listed various, more detailed technical observations for consideration by the developers. These observations were carefully evaluated, and responses or actions taken were discussed during the second ERB meeting. The ERBs summary document gives details [153].

3.7.2.2 Second Review The second ERB review occurred in 2014 as the implementation phase was nearing completion and as the developers were planning to execute the test phase. Now familiar with the project from its first review, the ERB focused its second review on giving the developers more specific suggestions, identifying technical issues for further consideration, and making overall recommendations. The ERB evaluated responses to its prior comments, updates to the models, configuration of the Framework, treatment of uncertainties, and verification and validation activities. Before the meeting, the ERB members reviewed technical documentation of the models and Framework and the developers responses to comments stemming from the first review meeting. Since the ERB had greater familiarity with the project at this second meeting, it provided more specific suggestions concerning key technical issues.

The ERB continued to agree that the project was structured and managed in a way that would allow its objectives to be met. This extended to the project leadership and decisionmaking shared between NRC/RES and EPRI. In fact, the ERB noted that the overall project organization, management, and modular design approach could provide a successful template for similar future efforts. The ERB concluded that the analytical resources, facilities, and laboratory equipment were appropriate to address the identified technical challenges. It found that the project team had a solid grounding in the many technical aspects required to develop the modules and Framework, and the members appeared to remain enthusiastic. In addition, the ERB noted that it was impressed with the apparent level of communication across the large number of participants. Further, the software quality assurance plans appeared to be complete, and the ERB noted that completion of the quality assurance activities would be crucial in establishing confidence in xLPR V2.

With respect to the adequacy of the technical aspects of the project, the ERB indicated that the models were appropriate to meet the project goals. While the board did not assess each module in detail, it indicated that the validation efforts were adequate. Additionally, it noted that the developers had completed additional, applied research since the first review meeting to improve the overall modeling approach (e.g., crack transition module development). Overall, the ERB found that the modules and Framework reflected a high level of technical sophistication.

Stemming from the second review, the ERB once again listed various, more detailed technical observations for consideration by the developers. The developers carefully evaluated each observation, prepared a response, and took any actions they deemed appropriate. The final responses and actions taken were communicated to the ERB. The ERBs summary document gives details [153].

3-25

4 UNCERTAINTIES The appropriate treatment of uncertainties in models and inputs in a probabilistic analysis is key to interpreting the outcome. Recognizing this, the developers prepared a detailed compilation of all known sources of uncertainty within xLPR V2 and the implications of these uncertainties

[154].

4.1 Background

Uncertainty describes the scatter in predictions or measured data about some mean value.

Bias describes the skewness of the residual errors, or whether a model tends to over- or under-predict the expected results. These two terms are used throughout this report to describe the effects of the various assumptions and decisions made throughout xLPR V2 development.

Understanding the factors contributing to bias and uncertainty will aid users in planning analysis cases and interpreting the results from any xLPR V2 analysis.

Uncertainty is inherent in all analytical methods. All models, whether deterministic or probabilistic, represent an approximation of reality and share the following basic elements:

• mathematical equations representing an understanding of the physical reality to be modeled

• series of inputs based on the perception of the factors affecting the physical reality Uncertainty is inherent in model predictions because the model and its inputs are only approximations of physical phenomena. In a simple analysis, it is convenient to assume that all information is known and can be readily described with input of known quantities into an appropriate model. Unfortunately, in many cases, the important variables are not known with a high degree of accuracy, and models tend to be simplified representations of the physical reality to be assessed. Uncertainties in both inputs and models arise because of both inherent randomness and lack of knowledge. Inherent randomness, or aleatory uncertainty, explains why the same physical measurements might result in a distribution of responses. For example, when a structural material is tested to characterize its material properties, the inherent randomness in the microstructure of the tested samples results in a distribution of the measured properties. Epistemic uncertainties arise when making statistical inferences from limited data and, perhaps more significantly, from incompleteness in the collective state of knowledge. For example, WRS cannot be measured directly and thus must be inferred from other, imprecise measurements. The difference between the indirect WRS measurements and the true WRS represents a degree of uncertainty that could, in theory, be reduced if it were possible to obtain a sufficiently large number of direct WRS measurements. This difference represents a lack of knowledge, or epistemic uncertainty. Both aleatory and epistemic uncertainties can be quantified, but only epistemic uncertainties can be reduced by increased knowledge (e.g., data) or study. The distinction between the types of uncertainty can provide important information to the user to enable focused efforts aimed at reducing epistemic uncertainties to refine the output uncertainty and to develop methods to appropriately address aleatory uncertainties.

Aspects of uncertainty include model uncertainty, input variable uncertainty, model parameter uncertainty, and completeness uncertainty. Model uncertainty can be estimated by conducting sensitivity studies on various mathematical forms that could be used to represent the behavior of interest. In a probabilistic application, input variable uncertainty is addressed by defining distributions that characterize the range in expected input values. Model parameter uncertainty 4-1

is addressed by defining distributions for parameters used to calibrate models to specific sets of environmental or other relevant conditions based on statistical analyses. These uncertainties must then be propagated through the model. Completeness uncertainty is due to assumptions and simplifications that are made when developing models to represent complex, real-world problems. Examples include the following:

• defining models that may not include all variables that affect the component behavior of interest

• defining the distribution types and forms for characterizing distributed inputs and model parameters that may not accurately represent those distributions

• treating some inputs as constants, thereby not capturing their true effect on the output

• linking models together in a manner that may distort the flow of information between them If known, areas of completeness uncertainty can be estimated using uncertainty factors or addressed with conservatisms. It is also possible for the degree of completeness to be unknown, and therefore, it cannot be reliably characterized.

It is important to understand the limitations in the model used to represent the behavior of interest and the implications of these limitations on the bias and uncertainty of the model predictions. Also important is understanding how information flows through a probabilistic code comprising multiple models. Information flow through the code controls the cumulative impact of biases and uncertainties on the calculated failure probabilities. In addition, it is important to understand and adequately account for the interactions of models, particularly those that use the same input variables, to ensure that uncertainties in the inputs are not accounted for multiple times. Defining correlated inputs and developing appropriate methods for treating correlated input uncertainties is also important in minimizing repeat-counting of uncertainties.

4.2 General Assumptions and Simplifications In the case of xLPR V2, the real-world problems of interest concern degradation of welds in piping. These problems are complex and involve many factors, including crack initiation and growth by fatigue and PWSCC, leak detection, stability of cracks, WRS, mitigation and repair of the welds, and ISI. Accordingly, development of xLPR V2 involved many decisions. These decisions addressed which physical mechanisms to include in the models, how best to mathematically represent those mechanisms, and what level of granularity is necessary to capture all the details contributing to failure without overwhelming the computational system.

Accounting for the stochastic nature of the problem required definition of distributions to represent all significant input variables and model parameter uncertainty, and knowledge of how these distributions could change over a plants operating time. In addition, certain key variables, such as surface crack size or leak rate, need to be calculated every time step. Faced with the possibility of needing to track and save much information for every simulation, the developers had to make choices, assumptions, and simplifications to define the problem in a way that provided confidence in the results without the models being too simplistic or too computationally excessive. This balance was important as model simplifications can introduce biases and uncertainties that will affect the predicted probabilities.

4-2

Perhaps the most complex and difficult-to-model aspects are PWSCC initiation and crack morphology. While PWSCC initiation is complex, with stochastic tendencies and a lack of well-vetted mechanistic models, its first order impact within a given xLPR V2 realization is generally binary (i.e., a crack either initiates or it does not). In contrast, the impact of crack morphology is distributed throughout a realization. It affects crack growth, leak rate, and crack stability. PWSCC tends to be very tight and cause discontinuous pathways that tend to follow high-angle grain boundaries that are more susceptible to corrosion cracking mechanisms.

Figure 4-1 illustrates PWSCC as shown by Moffatt [155]. This degradation mechanism results in a crack morphology with leak path characteristics like a porous medium, with many ligaments remaining to hold the crack tightly closed behind the main crack front. In contrast, fatigue cracks for normal operating conditions tend to have a simpler morphology with a continuous crack face and do not present the same modeling complexities as PWSCC.

Figure 4-1 Crack morphology at the intersection of axial and circumferential cracks on the inside surface of the reactor pressure vessel outlet nozzle to piping dissimilar metal weld at Virgil C. Summer Nuclear Station, Unit 1 Source: Adapted from [155, Fig. 65]

To deal with these complexities, the developers made several general assumptions and simplifications. Of these, the two assumptions expected to have the most effect are as follows:

(1) All cracks are assumed to be single, fully opened cracks with no remaining ligaments between series of smaller cracks to provide crack face opening constraint. This assumption leads to higher values for crack growth rate (due to higher crack tip stresses and SIFs), leak rate (due to higher predictions of COD and actual crack size), and rupture (due to not accounting for crack opening constraint provided by the ligaments).

4-3

(2) All circumferential cracks are assumed to exist in the same plane such that crack coalescence proximity rules are more easily met.

Each of these assumptions independently results in xLPR V2 overpredicting both leakage and rupture.

4.3 Framework Uncertainties The Frameworks sampling algorithms provide the probabilistic component to account for input variable and model parameter uncertainties. The user may define these uncertainties with distributions and characterize them as either aleatory or epistemic. Correlations between certain inputs may also be defined. The user may select from several sampling schemes when performing a probabilistic analysis, including SRS, LHS, DPD sampling, and importance sampling. The sampling structure then defines the number and order of realizations based on additional user settings and samples the specific values to use for each uncertain variable during each realization.

In this manner, the Framework provides the ability to account for much of the problem uncertainty, but it also contains simplifying assumptions that bias the results. The following three assumptions are expected to have the most effect:

(1) The Framework records a rupture event when a TWC stability run error occurs and the loads are greater than 90 percent of the limit load in the absence of cracks.

(2) The Framework records a certain runtime error output by the surface crack stability modules as a surface crack rupture event.

(3) If the recommended user-defined leak rate jump indicator thresholds are exceeded, or if a rupture occurs, the Framework records a leak rate jump failure.

Each of these assumptions results in xLPR V2 conservatively predicting earlier failures.

Sensitivity studies may be useful in quantifying the effects of these assumptions if a need for such quantification is identified.

4.4 Model Uncertainties The developers made every effort to construct xLPR V2 using mature, best estimate physical models. However, the complex and multiscale nature of the degradation mechanisms and systems being addressed required simplifications to streamline the calculations. Some of these simplifications involved decisions on how to represent the various aspects of the physical problem. Other simplifications involved assumptions made to simplify complex mathematical calculations or to fill information gaps in models or data. These simplifying assumptions, along with the uncertainty inherent in many of the model inputs, result in model biases and uncertainties. Table 4-1 summarizes the key model biases and uncertainties and their implications.

4-4

Table 4-1 Key sources of model bias and uncertainty Model Basis Implications PWSCC initiation xLPR V2 includes three best Previous probabilistic studies [29] [156]

estimate PWSCC initiation have shown that the major contributor to models, all of which contain detectable cracks or very small leak rate parameters defined by probabilities is the time to PWSCC distributions that are sampled by initiation. Sensitivity studies of model the Framework to account for selection and parameter distributions are model parameter uncertainty. recommended.

These parameter distributions were determined by calibrating the models to PDI-qualified inspection results from 2004 to mid-2014. The models were then validated against 25 years of laboratory data and limited international field data independent of the data used in model calibration.

WRS WRS modeler-to-modeler Sensitivity studies are recommended to uncertainty bounds other assess the implications of the WRS uncertainties in the WRS models uncertainty treatment.

and was used as the primary means to develop a method for treating uncertainties in the WRS profiles. Uncertainty over WRS was identified in the xLPR Pilot Study as one of the major contributors to uncertainty in the probabilities of rupture and first leakage, so it is important to ensure that these uncertainties are adequately bounded.

SIF solutions The uncertainties and biases This should have minimal impact on inherent in the SIF models are rupture or leakage prediction bias and largely insignificant as uncertainty.

demonstrated through model validation where the prediction bias and scatter were well within the 5-percent acceptance criterion. Uncertainties in the crack size (i.e., depth and length) that is provided as inputs to the SIF models will have a larger effect on the uncertainty in the calculated results.

4-5

Table 4-1 Key sources of model bias and uncertainty (continued)

Model Basis Implications TIFFANY The most significant factor Because of the conservative nature of contributing to uncertainty in the design-basis transient definitions, it is TIFFANY model predictions is expected that applying a median the variability in the transient uncertainty factor of 0.5 with a 2-sigma temperature and stress factor of 2 uncertainty to the definitions. While these sources TIFFANY-calculated stresses will be more of bias and uncertainty are not realistic but still generate a reasonable treated directly within TIFFANY, overprediction of stresses and SIFs when the uncertainty factors applied by design-based transients are used.

the Framework to the TIFFANY results are expected to bound all sources of bias and uncertainty in the model.

CGR In general, the CGR models for The overprediction bias in CGR both PWSCC and fatigue contain calculations is expected to be minor. The limited bias with respect to real effects on uncertainty are included in the plant conditions. However, the recommended CGR model parameters.

general assumption that cracks grow in one of three idealized planar shapes is expected to result in a small overprediction of the CGR.

Crack transition Bias and uncertainty in the crack There is minimal overprediction bias in transition model arise from SIFs and CODs and thus in subsequent assumptions made in the predictions of leakage or rupture.

underlying FEA models. They are accounted for by the Framework sampling on the inputs provided to the crack transition module. Validation against experimental results showed good agreement for crack shape evolution as well as for predicted CGRs. It is possible that the model tends to overpredict TWC formation because of the assumptions that a TWC forms when the surface crack depth is 95 percent of the pipe wall thickness, that a partial ellipse can be used to represent a semielliptical crack, and that linear-elastic solutions estimate elastic-plastic COD behavior.

4-6

Table 4-1 Key sources of model bias and uncertainty (continued)

Model Basis Implications Crack coalescence Simplifying assumptions are the Overprediction bias modestly favors primary contributors to bias and earlier and more frequent crack uncertainty in the crack coalescence than would naturally occur.

coalescence model. These Uncertainties are accounted for within the assumptions include the use of a model parameter definitions.

rule-based approach instead of a fracture mechanics model and simple, coplanar crack geometries instead of the more complex PWSCC morphologies.

Model and input uncertainty are accounted for by distributions of surface crack and TWC interaction distances that can be defined to reasonably encompass expected uncertainties.

COD The primary assumptions in There is overprediction bias in CODs and COD model development include thus in subsequent predictions of leakage.

a fully open crack instead of a Uncertainty in the COD predictions is discontinuous crack caused by controlled by how well the input material PWSCC. In addition, the FEA properties are known.

modeling used to determine the influence functions assumed that the pipe end rotations are unrestrained and, in the case of the ACOD model, that the average secondary WRS is treated as a primary pressure stress. Assumptions that result in COD model uncertainty include material property variability and the definition of one of the empirical correction factors using a limited number of datasets.

Leak rate Uncertainties due to lack of Uncertainty in leak rate predictions is knowledge of the crack accounted for by an uncertainty morphology parameters, which parameter that is applied by the influence leak rate calculations in Framework to represent the effects of Regime 1 (up to 0.63 kg/s crack morphology variability.

(10 gpm)), are accounted for by the Framework through application of an uncertainty factor.

4-7

Table 4-1 Key sources of model bias and uncertainty (continued)

Model Basis Implications Crack stability Idealization of the crack Results in rupture overprediction bias.

geometry provides an The assumption of idealized cracks will overprediction bias in the surface tend to decrease the scatter observed in crack analyses because the the predicted rupture probabilities relative constant depth crack will be to the actual crack shapes likely to be larger than a natural crack of the encountered in field conditions.

same depth and length. The idealized TWC geometry tends to underestimate the crack-driving force, thereby underpredicting TWC rupture probabilities. This effect is difficult to quantify as the amount by which the idealized crack geometry over- or under-represents a natural crack will vary. With no restriction on the kind of fracture toughness data used for the inputs, there is an underprediction bias in critical crack size of 25 percent.

Additionally, the assumption that pipes with TWCs are free to rotate (i.e., no restraint) also results in an overprediction bias in instability and an increase in the prediction uncertainty over expected field behavior.

4-8

Table 4-1 Key sources of model bias and uncertainty (continued)

Model Basis Implications ISI The ISI models based on PDI The extent of this issue is difficult to data are best estimates with little quantify because some field flaws may be bias in representing dissimilar undetected, and detected flaws are metal weld nozzle configurations usually repaired without destructive and operating and loading examination. However, the differences conditions where PWSCC between the PDI data and field initiation has been observed in performance in ISI effectiveness are the field. The recommended ISI expected to be small.

uncertainties that account for other potential dependencies, such as flaw length, where there was a lack of sufficient data to model them, are reasonable.

The user may adjust the POD effectiveness factor input down from the typical setting of 1.0 to make the nominal POD curves less effective. The primary purpose of this input is to address any potential differences between PDI laboratory results and ISI results measured in the field. Parameter estimates for POD and sizing models that are based on PDI results may not perfectly describe field performance.

4.5 Implicit Uncertainties The developers evaluated the sources of known uncertainties within xLPR V2 by comparing the uncertainties and biases in the model outputs to observed behavior and then rationalizing the differences. However, xLPR V2 does not model the effects of every degradation and failure mechanism and has its own inherent limitations. When the developers decided which effects to include, how to model them, and how to implement those models, these decisions introduced additional implicit uncertainties and biases. For instance, some degradation mechanisms, like high-cycle fatigue or crack growth due to SSE loads, were knowingly omitted because of their perceived low impact or lack of observed effects on failure metrics of interest for the objectives of the xLPR V2 development effort. In other cases, the choice of how to model a given degradation mechanism over another approach can carry its own implicit bias (e.g., SIF-controlled stress-corrosion crack growth). Even fundamental design decisions can affect uncertainty, like the limitations of GoldSim in modeling multiparameter correlations.

Therefore, it is important to understand that decisions like these, explicit or otherwise, can also affect the uncertainty and bias in xLPR V2 in ways that cannot be well quantified.

4.6 Summary Aspects of uncertainty include input variable uncertainty, model uncertainty, model parameter uncertainty, and completeness uncertainty. The Frameworks sampling strategy effectively accounts for many of the uncertainties in inputs and model parameters. In most cases, the user 4-9

can define the input variable and model parameter distributions for the purposes of performing sensitivity studies to better understand the implications of these uncertainties. PWSCC initiation is one of the most complex and difficult aspects to model, and for this reason, xLPR V2 includes three best estimate models to address model uncertainty. Finally, because of necessary assumptions and decisions made during its development, xLPR V2 contains known sources of bias and completeness uncertainty. The two general modeling assumptions expected to have the most effect are as follows:

(1) All cracks are assumed to be single, fully opened cracks with no remaining ligaments between series of smaller cracks to provide crack face opening constraint.

(2) All circumferential cracks are assumed to exist in the same plane such that crack coalescence proximity rules are more easily met.

All other sources of bias and uncertainty in the Framework and models are expected to have a lesser effect than these two general assumptions. However, the developers consider all the models to either be best estimate or biased in a manner such that xLPR V2 will tend to overpredict failure probabilities. Additionally, when considering possible applications, it is important to consider the impact of any implicit biases introduced during development of the code.

It is also important to consider biases and uncertainties within the context of the validation testing results and target acceptance criteria. For instance, the validation testing results, as discussed in Section 3.6.3, demonstrated that xLPR V2 did well in predicting high probabilities of occurrence for cracks or very small leaks using conditions representing both U.S. and international PWRs in which cracks have been observed in service. The results from benchmarking against comparable PFM codes provide further confidence that xLPR V2 performs as expected and provides results that follow expected trends.

4-10

5 TRIAL INPUTS AND ANALYSES At the outset of the project, the developers determined that there would be significant value in gaining early experience using the code by developing complete and realistic input sets and using those input sets to conduct some trial analyses. This section describes the efforts of the Inputs Group to develop the input sets and the resulting analyses using those input sets by the Computational Group.

5.1 Scope The developers selected three study cases for the trial inputs and analyses. These cases covered common large-diameter dissimilar metal weld locations in PWRs that are likely to be susceptible to PWSCC based on the materials, applied loads, and environmental conditions.

The specific configurations were as follows:

(1) Case 1: A reactor pressure vessel outlet nozzle to safe end weld in a Westinghouse four-loop PWR. The outlet nozzle is a low-alloy steel forging, and the safe end is an austenitic stainless steel forging.

(2) Case 2: A cold-leg piping to reactor coolant pump inlet safe end weld in a Babcock and Wilcox PWR. The cold-leg piping is carbon steel, and the safe end is austenitic stainless steel.

(3) Case 3: A safe end to steam generator inlet nozzle weld in a Westinghouse four-loop PWR. The safe end is made from austenitic stainless steel, and the inlet nozzle is a low-alloy steel forging.

In all three cases, the dissimilar metal welds that join the components are Alloy 82/182.

The developers also defined the basic parameters for 11 scenarios to analyze for each study case. The scenarios were intended to address a range of expected failure probability trends under a given set of circumstances for crack initiation, crack orientation, and crack growth. The expected failure probabilities were qualitatively developed based on expert judgment, which considered the relative severity of the degradation mechanisms and the potential offsetting effects from the different mitigation options available in xLPR V2. In some scenarios, mechanical mitigation, chemical mitigation, or both were modeled. The objectives and parameters of the scenarios were as follow:

(1) Scenario 1: Examine the probability of rupture due to fatigue crack growth. A preexisting circumferential crack is assumed, which then grows larger through fatigue.

No mitigation is modeled in this scenario.

(2) Scenario 2: Examine the probability of rupture due to PWSCC without mitigation.

Circumferential cracks are initiated through PWSCC, and any cracks that initiate grow larger through PWSCC.

(3) Scenario 3: Examine the probability of rupture due to PWSCC without mitigation. This scenario is identical to Scenario 2, except that it includes both circumferential and axial cracks.

5-1

(4) Scenario 4: Examine the probability of rupture due to PWSCC when mechanical mitigation is applied. Both circumferential and axial cracks are initiated through PWSCC, and any cracks that initiate grow larger through PWSCC. The mechanical mitigation technique is case specific. For Case 1, MSIP is modeled because this process is commonly applied at similar locations in operating PWRs. For Cases 2 and 3, FSWOLs are modeled because they have been applied at similar locations in some operating PWRs. The FSWOLs are Alloy 52/152. The mitigation nominally takes effect at 20 calendar years of plant operation.

(5) Scenario 5: Examine the probability of rupture due to PWSCC when mechanical mitigation is applied. This scenario is identical to Scenario 4, except that the mitigation nominally takes effect at 40 calendar years of plant operation.

(6) Scenario 6: Examine the probability of rupture due to PWSCC when a chemical-based method of mitigation is applied. Both circumferential and axial cracks are initiated through PWSCC, and any cracks that initiate grow larger through PWSCC. The chemical mitigation in this scenario occurs through zinc injection, and it nominally takes effect at 20 calendar years of plant operation.

(7) Scenario 7: Examine the probability of rupture due to PWSCC when a chemical-based method of mitigation is applied. This scenario is identical to Scenario 6, except that the mitigation occurs through hydrogen injection.

(8) Scenario 8: Examine the probability of rupture due to PWSCC when a chemical-based method of mitigation is applied. This scenario is identical to Scenario 6, except that the mitigation occurs through both zinc and hydrogen injection.

(9) Scenario 9: Examine the probability of rupture due to PWSCC when a weld inlay is applied for mechanical mitigation. Both circumferential and axial cracks are initiated through PWSCC, and any cracks that initiate grow larger through PWSCC. The weld inlay is Alloy 52/152. The mitigation nominally takes effect at 40 calendar years of plant operation.

(10) Scenario 10: Examine the probability of rupture due to PWSCC and fatigue when both mechanical and chemical mitigation is applied. Both circumferential and axial cracks are initiated through PWSCC or fatigue, and any flaws that initiate grow larger by both mechanisms. The mechanical mitigation technique is case specific and consistent with Scenario 4. Chemical mitigation occurs through both zinc and hydrogen injection. All forms of mitigation nominally take effect at 20 calendar years of plant operation.

(11) Scenario 11: Examine the probability of rupture due to fatigue initiation and growth.

Both circumferential and axial cracks are considered. No mitigation is modeled in this scenario.

5.2 Inputs Development Because of the many models within xLPR V2 and the overall complexity of the code, completing the input set for a given simulation can be involved. To gain experience developing inputs for xLPR V2, the Inputs Group developed input sets for the 11 scenarios and 3 study cases, for a total of 33 sets of inputs. The Inputs Group report extensively documents the scope, methodology, and results for the assembled inputs and their bases [157]. The Inputs Group obtained representative plant and weld data from a variety of sources and used it to develop 5-2

input formats and distributions to characterize important aspects of the piping system components defined by the study cases. The Inputs Group also culled information from the other work groups and assembled it to form nearly complete input sets. The only areas of incompleteness were in the sampling options, which the Computational Group sought to fill, as discussed in Section 5.3. Of note, the Inputs Group did not intend to develop or recommend a comprehensive set of inputs for analyzing plants on either a generic or plant-specific basis; however, the results are helpful to users developing input sets for analyzing their own specific problems. Notwithstanding, any use of the inputs in regulatory or safety applications should be subject to further investigation and justification by the user.

5.3 Analyses The failure probabilities that xLPR V2 was developed to estimate are expected to be very small in many applications, which may make it difficult to observe failures in reasonable computational times. For example, with a failure probability of less than 10-6, 1 million realizations on average would be needed to observe a single failure using SRS. Through the scenario analyses, the Computational Group investigated various sampling schemes available in xLPR V2. It also developed experience and insights from running the code. To perform these analyses, the Computational Group used the 11 input sets developed by the Inputs Group for the Case 1 scenarios. The scenario analysis report presents the full results of this effort [158]. A summary follows.

5.3.1 Methodology Analysts from the Computational Group strategically selected the set of simulations that were executed for each scenario. The results were iteratively evaluated so that sampling options could be comprehensively compared. The overall approach followed the simulation workflow template shown in Figure 5-1. Since xLPR V2 includes multiple outputs, specific quantities of interest (e.g., occurrence of circumferential crack leak) were selected for analysis in each scenario.

5-3

Figure 5-1 Scenario analysis simulation workflow template Source: Adapted from [158, Fig. 1]

Progressively more refined use of the sampling schemes in xLPR V2 during this workflow required the analysts to apply statistical analysis methods to properly evaluate the results.

These methods included the following:

• sensitivity analysis

• convergence analysis

• uncertainty analysis Sensitivity analysis aims to understand the relationships between inputs and outputs to identify those inputs that have the most significant impact on the results. The benefits of sensitivity analysis are twofold. First, it can quantify the amount of uncertainty in the outputs that is due to uncertainties in the inputs. Second, the relationship between the most important inputs and the outputs of interest can be examined to determine if there are any regions of the probability distribution inputs that can be targeted for importance sampling, which allows for better estimation of small failure probabilities. The analysts applied statistical regression techniques to conduct the sensitivity analyses.

Convergence analysis assesses whether a large enough sample size has been used to ensure convergence of the results. A large enough sample size means that a larger sample size would not improve estimation of the quantity of interest. To conduct the convergence analyses, the analysts ran xLPR V2 several times using the same sampling options but with different random seeds and then compared the results across the different simulations. Rerunning the code in this fashion acts as an independent check on convergence. If the variability of the quantity of interest across the independent simulations was sufficiently small, then the results were considered to have converged. This approach requires enough independent simulations to characterize the variability among them and, for this effort, the analysts conducted five.

Uncertainty analysis aims to understand uncertainty in the quantity of interest estimates across epistemic samples to quantify knowledge uncertainty. In general, uncertainty analysis consisted 5-4

of calculating quantile values for the quantity of interest over the epistemic samples from a sufficiently converged simulation. The analysts first calculated a quantity of interest estimate for each epistemic realization based on the mean of all the aleatory realizations associated with that epistemic realization. Epistemic quantiles were then determined using the epistemic results. In simulations where there was no importance sampling of the epistemic inputs, calculating the epistemic quantile values was based on the observed order statistics. For instance, with 100 epistemic realizations, the 5th and 95th quantile estimates are simply the 5th and 95th percentile values. However, when importance sampling was used, the analysts applied the importance sampling rates when determining the appropriate quantile values.

5.3.2 Selection of Results 5.3.2.1 Unmitigated PWSCC Behavior Scenario 3 examines the probabilities of axial and circumferential crack ruptures due to PWSCC without mitigation. The primary quantities of interest selected for this scenario were the probabilities of occurrence of cracks, leaks, and ruptures without leak rate detection or ISI (i.e., the standard xLPR V2 indicator functions). In relation to the other scenarios, Scenario 3 was expected to result in the highest probabilities of rupture.

Scenario 3 was used to illustrate the simulation workflow depicted in Figure 5-1. The results from Scenario 3 also served as a basis for comparison with the results from the other scenarios.

Thus, the analysts completed many additional studies and analyses for Scenario 3 that were used to draw larger conclusions about sampling selection. Several of these simulations included importance sampling applied to the probability distribution of the PWSCC initiation proportionality constant multiplier for Direct Model 1. Use of this input for importance sampling was determined using sensitivity analysis techniques. Specifically, regression analyses indicated that this variable explained the most variability in all the outputs of interest.

Figure 5-2 summarizes the Scenario 3 probability of rupture results for circumferential cracks using various sampling strategies. The results show that increasing the epistemic sample size decreases sampling uncertainty in the mean (i.e., best estimate) of the output, especially when the epistemic sample size was increased from 100 to 500 with an aleatory sample size of 50.

The decrease in sampling uncertainty in the mean of the output is also evident when increasing from 500 to 1,000 epistemic samples, again with an aleatory sample size of 50. This result is likely attributable to the relatively high probabilities of occurrence of cracks in this scenario. The results were more strongly impacted using LHS versus SRS. For example, with SRS, an epistemic sample size of 1,000 appeared to produce a converged, best estimate of the outputs; however, a sample of 500 with LHS provided similar results. The analysts found that the use of importance sampling had the most effect in increasing the relative number of ruptures occurring at earlier times in the simulation, allowing for better estimation in this area.

5-5

Figure 5-2 Mean probabilities of circumferential crack rupture with no leak rate detection or ISI for Scenario 3 using various sampling strategies Source: Adapted from [158, Fig. 59]

5.3.2.2 Mitigated Fatigue and PWSCC Behavior Scenario 10 examines the probabilities of axial and circumferential crack ruptures due to fatigue and PWSCC with MSIP, zinc, and hydrogen mitigation applied at 20 years of operation. The primary quantities of interest selected for this scenario were the same as for Scenario 3.

Compared to the other scenarios, Scenario 10 was expected to result in the lowest probabilities of rupture.

Figure 5-3 shows that Scenario 10 has a dramatic reduction in the probability of rupture results for circumferential cracks as compared to Scenario 3. The results in this figure are based on 1,000 epistemic by 50 aleatory samples using LHS and importance sampling on the PWSCC initiation Direct Model 1 proportionality constant multiplier probability distribution with a target quantile of 0.95. The marked decrease is due to the applied mechanical and chemical mitigation. Axial crack ruptures were not seen in either Scenarios 3 or 10, and Scenarios 1 and 11 showed that fatigue does not contribute strongly to crack initiation and growth when compared to PWSCC.

5-6

Figure 5-3 Comparison of the mean probabilities of circumferential crack rupture with no leak rate detection or ISI for Scenarios 3 and 10 Source: Adapted from [158, Fig. 219]

5.3.2.3 Supplemental Studies The broad findings identified from the scenario analyses prompted additional questions, which were further investigated by the analysts. These additional studies explored areas such as aleatory sample size selection, sampling uncertainty using LHS, and an approach for bounding low-probability events.

Because the number of aleatory samples was fixed at 50 for all the scenario simulations, the analysts looked at the impact of the aleatory sample size on the estimation of epistemic uncertainty in the probability of occurrence. Sample sizes of 100 epistemic by 50, 100, and 1,000 aleatory realizations were considered. The analysts found that more than 50 aleatory samples are needed to reduce the amount of uncertainty due to the finite aleatory sample size to get good estimates of the uncertainty due to the epistemic variables; however, an aleatory sample size of 50 is likely enough to estimate the mean probability. In addition, the number of aleatory samples needed depends on the relative uncertainty in the output due to the aleatory and epistemic variables.

In general, LHS should be at least as efficient as SRS, though it was not clear from the scenario analyses how much efficiency can be gained using LHS. Accordingly, the analysts conducted additional studies to compare the efficiency of using LHS versus SRS. Though the scope of these additional studies was limited, the findings suggest that LHS is preferable to SRS for decreasing sampling uncertainty. However, the advantages of SRS include simplicity in 5-7

combining results from different simulations, as well as simplicity in calculating the sampling uncertainty. Of note, since there is not a simple analytic form for an unbiased estimate of sampling uncertainties using LHS [159] [160], the analysts used the SRS uncertainties as a conservative upper bound for the LHS uncertainties in the scenario analyses.

Finally, since no occurrences of rupture with leak rate detection were observed in any of the scenario analysis results, the analysts considered how to give an overall bound on the probability of failure. They considered both single- and dual-loop approaches. Since xLPR V2 contains a dual-loop sampling structure by design, the analysts changed the inputs to run the equivalent of a single-loop sampling structure. Then, they created a composite set of 106 total realizations from 10 simulations with different randomly selected random seeds, with each simulation including an epistemic sample size of 1,000 and an aleatory sample size of 100 with all variables put on the aleatory loop. Using this approach, there were no occurrences of rupture with leak rate detection, so to ensure that the results were not due to a low detectable leak rate (set at 0.063 kg/s (1 gpm)), the simulations were rerun with a detectable leak rate of 0.63 kg/s (10 gpm). Again, there were no occurrences of rupture with leak rate detection. This sampling scheme allowed a large sample size to be generated while also overcoming memory limitations imposed by GoldSim. The analysts determined that such a single-loop approach would be the most efficient for bounding low-probability events; however, its implementation requires some inefficient workarounds by the user.

5.3.3 Summary The scenario analyses served as a proof of concept for similar probabilistic studies using xLPR V2. They exercised many of the simulation options, inputs, and models in the code. The simulation workflow developed to complete these analyses demonstrates the systematic use of the sampling options available in xLPR V2. Executing this workflow requires the user to employ statistical analysis techniques, such as convergence analysis, sensitivity analysis, and uncertainty analysis. Selecting the appropriate sample size depends on the users requirements for characterizing uncertainty in the results, and convergence analyses can be used for this purpose. LHS consistently proved to ensure stable coverage of the input space and produced the most converged results. Sensitivity analysis techniques, coupled with corresponding support from scatter plots showing the relationship between inputs and outputs, were found useful for choosing appropriate variables for importance sampling and for understanding which inputs drive the results. Importance sampling was found to have a positive impact on increasing the number of event occurrences. Using uncertainty analysis, epistemic quantiles can be calculated to bound epistemic uncertainty in the quantities of interest.

5-8

6 RECOMMENDATIONS Throughout the project, the developers identified various areas for improvement, knowledge gaps, and additional research that could lead to future code enhancements. The design of xLPR V2 as a modular code would allow for many of these modifications to be readily incorporated as they become available. The following subsections summarize improvements suggested by the various work groups.

6.1 Framework The developers selected GoldSim for the Framework to take advantage of its many built-in probabilistic tools and ability to visualize the complex structure of the Framework in a graphical environment. However, as the complexity of the Framework grew over the course of development, the use of GoldSim also presented some challenges to implementation, which necessitated either inefficient or elaborate workarounds. Specifically, the Computational Group recommended improvements related to the following:

• investigation of ways to overcome limitations posed by GoldSims inability to accommodate a native structure for nested sampling loops

• implementation of an adaptive time step that would provide for greater or reduced accuracy (i.e., for efficiency purposes) depending on the dynamic conditions present as the realizations progress

• implementation of importance sampling

• investigation of ways to overcome memory limitations, which can limit the number of realizations that may be executed in a simulation

• development of a solution to save and export sampled inputs to be analyzed with the output quantities of interest using sensitivity analysis techniques

• development of automated verification and validation testing The Computational Group report details these recommendations [122]. Since most of these recommendations stem from the limitations posed by GoldSim, discussions with GoldSim Technology Group, LLC, would be required to determine whether it can accommodate such improvements in a future version of GoldSim. If these improvements cannot be effectively and efficiently implemented in GoldSim, particularly to overcome the memory limitations, then the Framework should be recast in a suitable programming language.

6.2 Physical Models Naturally, with respect to modeling, improvements could be made to address some of the general assumptions and simplifications applied in code development. These would include introduction of the following:

• more complicated geometries to account for through-wall material gradients and to represent other components, such as J-groove welds in reactor pressure vessel head penetration nozzles that are susceptible to PWSCC 6-1

• asymmetric crack growth to account for off-axis bending loads and within-weld crack growth variation

• noncoplanar circumferential cracks

• subsurface flaws, which may arise from various mechanisms such as lack of fusion from an overlay The following subsections provide the developers recommendations for the individual physical models.

6.2.1 Crack Initiation Concerning PWSCC, the Crack Initiation Subgroup recommended improvements related to the following:

• revision of the Weibull model form to provide consistency with terminology used in the general statistical literature, reduce the number of defined parameters, and demonstrate a clearer connection between uncertainty in the Weibull model parameters and the effects of model parameters (i.e., the thermal activation energy and stress exponent)

• modification of Direct Model 2 to minimize instances where the upper stress threshold convention can lead to the initiation of cracks in all subunits at the same time

• improvement of model calibration efforts to account for the influence of near-surface stresses

• refinement or validation of the generic conventions for WRS to address the lack of component-specific near-surface stress information

• for Direct Model 1 and the Weibull model, development of a near-surface stress threshold

• implementation of the capability to discretize based on a user-defined wetted surface area per subunit to normalize for size effects

• for Direct Model 1 and the Weibull model, improvement of the verified range for the stress effects models because there is insufficient evidence to confirm that they are applicable to applied stresses below the yield strength

• confirmation that the Arrhenius model dependency holds for PWSCC initiation across the full range of temperatures encountered in PWRs Additionally, concerning fatigue, the Crack Initiation Subgroup recommended improvements related to calibration and refinement of the models based on full-scale component test results.

The Crack Initiation Subgroup report details these recommendations [34].

6-2

6.2.2 Crack Growth Concerning stress-corrosion cracking, the Crack Growth Subgroup recommended improvements related to the following:

• refinement of models for PWSCC in Alloy 82/182 through collection and assessment of data in areas such as SIF dependency, hydrogen dependency, cold work, and heat treatment

• development of CGR models for other materials and environments, such as Alloy 52/152 in PWRs and stainless steels in boiling-water reactors Concerning fatigue cracking, the following improvements were recommended:

• update of fatigue crack growth relationships for austenitic stainless steels

• reducing scatter in the environmental effects for nickel-based alloys by implementing an environmental factor whereby the dispersion could vary with the fatigue CGR prediction in air

• implementation of a material-specific SIF range threshold

• validation against additional laboratory or field CGR data The Crack Growth Subgroup report details these recommendations [76].

6.2.3 Stress-Intensity Factors The K-Solutions Subgroup recommended improvements related to the following:

• use of nonuniform sampling intervals for WRS profiles to increase accuracy while minimizing computational times

• investigation of the impact of allowing the SIF to vary with the depth in TWCs

• investigation of subcritical crack growth for cracks with aspect ratios greater than unity

• SIF coefficients for surface cracks with depths between 80 and 95 percent of the pipe wall thickness because the current equations are based on extrapolations

• investigation of the effect of stress gradients in the WRS profiles on the SIFs for TWCs because the average stress for a given WRS profile is used for axial cracks These recommendations are detailed in the K-Solutions Subgroup report [65].

6-3

6.2.4 Crack Coalescence With respect to crack coalescence, the CGR Subgroup recommended improvements related to the following:

• development of more precise crack interaction predictions using either fracture mechanics solutions implemented in the SIF modules or by introduction of crack length dependencies

• development of more precise ligament collapse predictions using either fracture mechanics solutions implemented in the crack stability or CCC modules or by introduction of crack length dependencies

• interaction of axial and circumferential cracks

• simulation of microfissure coalescence, which is commonly considered part of the crack initiation process The Crack Growth Subgroup report details these recommendations [76].

6.2.5 Crack Transition The Crack Transition Subgroup recommended improvements related to the following:

• development of correction factors for TRCs to capture more complex through-thickness WRS distributions

• investigation of the effect of plastic deformation on the COD correction factors to determine whether the elastic correction factors are adequate These recommendations are detailed in the Crack Transition Subgroup report [35].

6.2.6 Crack Stability The Crack Stability Subgroup recommended improvements related to the following:

• implementation of an EPFM method for short, deep cracks

• if an EPFM solution is implemented for circumferential surface cracks, development of a proper way to characterize a materials fracture resistance that considers the constraint differences between pipes with surface cracks and compact-tension specimens

• inclusion of additional crack profiles because the SCSCS and MCSCS modules consider only surface cracks of constant depth

• modeling ductile tearing between the subcritical crack and the final, unstable crack in the CTWCS module

• consideration of the need for different crack stability models due to the differences between idealized crack geometries and actual cracks caused by PWSCC The Crack Stability Subgroup report details these recommendations [112].

6-4

6.2.7 Crack Opening Displacement The COD Subgroup recommended improvements related to the following:

• for CCOD calculations, inclusion of the effects of restraint on pressure-induced bending to address the assumption that the pipe ends rotate freely

• for CCOD calculations, investigation into the effects of WRS because tensile WRS on the inside surface of the pipe and compressive WRS on the outside surface of the pipe would tend to rotate the crack faces such that the actual COD may be slightly more or less than predicted, respectively

• for ACOD calculations, investigation into more rigorous handling of the contributions due to WRS through inclusion of WRS directly into the underlying FEA solutions These recommendations are detailed in the COD Subgroup report [88].

6.2.8 Leak Rate The Leak Rate Subgroup recommended improvements related to the following:

• validation of the Darcy friction factor coefficients and velocity head loss equation

• update of the procedures for applying corrections (1) when there are different crack opening areas on the inside and outside surfaces of the pipe for Regimes 1 and 2 and (2) for uncertainty of the crack morphology variables

• elimination of the need for the user to input the minimum and maximum pressure and temperature values used to produce the lookup tables such that, if a pressure or temperature value falls outside the user-defined range during a simulation, the calculated leak rate is still accurate

• optimization of the crack length and COD increment size used to produce the lookup tables The Leak Rate Subgroup report details these recommendations [97].

6.2.9 Inservice Inspection The ISI Subgroup recommended improvements related to the following:

• extension of model applicability to other weld configurations, such as similar metal welds and OWOLs

• refinement of the POD models for small flaws

• introduction of a random effects model to more precisely allocate the sources of uncertainty from flaw-to-flaw or inspection-to-inspection variability

• capture of the effects of other influential variables, such as flaw length and COD 6-5

• incorporation of a new independent variable to accommodate validated POD models for overlays

• incorporation of models for other nondestructive examination techniques, such as visual examination, penetrant testing, and radiographic testing

• incorporation of crack growth to calculate repair size thresholds in accordance with acceptance criteria in the ASME Code [120], which could affect the POR The ISI Subgroup report details these recommendations [118].

6.2.10 Welding Residual Stresses The WRS Subgroup recommended improvements related to the following:

• calculation of the mitigation WRS fields directly instead of estimating them from literature

• inclusion of three-dimensional effects

• development of material property uncertainty solutions

• development of additional repair depth results The WRS Subgroup report details these recommendations [45].

6-6

7 CONCLUSIONS Building on the successes of the xLPR Pilot Study, the NRC/RES and EPRI developed xLPR V2 with the following objectives:

(1) Develop a robust analysis methodology for evaluating probabilities of reactor coolant system piping rupture.

(2) Select appropriate, technically sound inputs and models to produce best estimate output results with quantified uncertainties.

(3) Develop a computational software tool that applies the inputs and models and appropriately treats epistemic and aleatory uncertainties.

(4) Verify, validate, benchmark, and document the software tool to enable its use in support of licensing, rulemaking, design, and regulatory decisions by both the industry and the NRC.

(5) Apply an appropriate set of quality assurance measures to control software development and support future NRC and industry uses of the software in regulatory matters.

The Framework was developed using a robust analysis methodology to fulfill the first objective.

It combines a system of expertly developed modules that have been independently verified and validated into a cohesive model capable of estimating crack occurrence, leak, and rupture probabilities. The complex structure of the Framework passes information between these modules and accomplishes all the checking, preprocessing, sampling, calculating, and postprocessing steps necessary to model the entire problem from crack initiation to crack growth to leaks and ruptures. Each component of the Framework was developed and implemented under a rigorous quality assurance program to ensure fidelity, and the modules and the Framework were tested extensively under this program. The entire developmental project was also subject to technical review by nationally and internationally recognized experts who were not directly involved in the codes development.

Best estimate models and representative input data were selected with quantified uncertainties to fulfill the second objective. First, all the physical models were validated by comparing them against experimental data, alternate models, or calculations. The Frameworks sampling strategy effectively accounts for many of the uncertainties in inputs and model parameters. All other sources of bias and uncertainty were evaluated. Uncertainties not accounted for by the Frameworks sampling strategy result from general modeling assumptions deemed necessary to keep the computational system tractable. Every effort was made to construct xLPR V2 using mature, best estimate physical models.

The Framework appropriately accounts for uncertainties to fulfill the third objective. A nested loop structure separates epistemic and aleatory uncertainties and allows model parameter and input uncertainties to be classified as either type to study their impact on the results. Validated model parameters were developed based on underlying data, consideration of the underlying physics, and expert judgment as appropriate. However, the Framework is flexible such that the user may change nearly all the input variables and model parameters to perform sensitivity analyses and sensitivity studies. Distributions on important variables were also realistically truncated to minimize nonphysical effects caused by sampling within the distribution tails.

7-1

Uncertainty sampling has also been evaluated to ensure that uncertainties are not compounded and that correlations are used, as appropriate, for linked uncertainties.

Extensive verification, validation, benchmarking, and documentation efforts were used to fulfill the fourth objective. Verification testing was successfully performed first on all the modules individually, then on the Framework by itself, and finally on the Framework and modules together as an integrated software system. Validation testing was also successfully performed for all the modules individually and then for the Framework and modules as an integrated system. The Framework validation testing included comparisons to operating experience and benchmarking against comparable PFM codes and FEA simulations. For independence, verification and validation testing were performed by individuals separate from the developers.

xLPR V2 has been extensively documented in terms of its software requirements, design, implementation, test plans, and test results, all of which were subject to formal verification, review, and approval.

Finally, a rigorous set of quality assurance procedures and controls were used to fulfill the fifth objective. Quality assurance was integral to the xLPR V2 development process, and it was implemented through project management, quality assurance, and configuration management plans. These plans were fashioned in accordance with NRC quality assurance requirements and guidance and other internationally recognized software engineering standards.

7-2

8 REFERENCES

[1] S. Antolovich and B. Antolovich, An Introduction to Fracture Mechanics, in ASM Handbook, Vol. 19, Fatigue and Fracture, pp. 371-380, ASM International, Materials Park, OH, 1996.

[2] NRC, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 3.6.3, Rev. 1, Leak-Before-Break Evaluation Procedures, March 2007, Agencywide Documents Access and Management System (ADAMS) Accession No. ML063600396.

[3] U.S. Code of Federal Regulations, Domestic Licensing of production and utilization facilities, Part 50, Chapter I, Title 10, Energy.

[4] NRC, NUREG-1061, Report of the U.S. Nuclear Regulatory Commission Piping Review Committee, Vol. 3, Evaluation of Potential Pipe Breaks, November 1984, ADAMS Accession No. ML093170485.

[5] NRC, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 3.6.3, Leak-Before-Break Evaluation Procedures, March 1987, ADAMS Accession No. ML030280295.

[6] NRC, Regulatory Issue Summary 2010-07, Regulatory Requirements for Application of Weld Overlays and Other Mitigation Techniques in Piping Systems Approved for Leak Before Break, June 8, 2010, ADAMS Accession No. ML101380231.

[7] T. Anderson, Fracture Mechanics Fundamentals and Applications, CRC Press, Boca Raton, FL, 2005.

[8] NRC and EPRI, Memorandum of Understanding between U.S. Nuclear Regulatory Commission and Electric Power Research, Inc. on Cooperative Nuclear Safety Research, March 14, 2007, ADAMS Accession No. ML070740114.

[9] ASME,Section II, Materials, Part C, Specifications for Welding Rods, Electrodes, and Filler Metals, SFA-5.14/SFA-5.14M, Specification for Nickel and Nickel-Alloy Bare Welding Electrodes and Rods, in Boiler and Pressure Vessel Code, 2013 Edition, pp.

373-397, New York, NY.

[10] ASME,Section II, Materials, Part C, Specifications for Welding Rods, Electrodes, and Filler Metals, SFA-5.11/SFA-5.11M, Specification for Nickel and Nickel-Alloy Welding Electrodes for Shielded Metal Arc Welding, in Boiler and Pressure Vessel Code, 2013 Edition, pp. 307-337, New York, NY.

[11] NRC, Information Notice 2004-11, Cracking in Pressurizer Safety and Relief Nozzles and in Surge Line Nozzle, May 6, 2004, ADAMS Accession No. ML041260136.

[12] NRC, Regulatory Issue Summary 2008-25, Regulatory Approach for Primary Water Stress Corrosion Cracking of Dissimilar Metal Butt Welds in Pressurized Water Reactor Primary Coolant System Piping, October 22, 2008, ADAMS Accession No. ML081890403.

[13] NRC,Bulletin 2004-01, Inspection of Alloy 82/182/600 Materials Used in the Fabrication of Pressurizer Penetrations and Steam Space Piping Connections at Pressurized-Water Reactors, May 28, 2004, ADAMS Accession No. ML041480034.

[14] EPRI, Report 1009549, Materials Reliability Program: Alloy 82/182 Pipe Butt Weld Safety Assessment for U.S. PWR Plant Designs (MRP-113), Palo Alto, CA, 2006.

[15] EPRI, Report 1010087, Materials Reliability Program: Primary System Piping Butt Weld Inspection and Evaluation Guidelines (MRP-139), Palo Alto, CA, 2005.

8-1

[16] EPRI, Report 1015009, MRP-139 Revision 1: Primary System Piping Butt Welds Inspection and Evaluation Guideline, Palo Alto, CA, 2008.

[17] Nuclear Energy Institute, NEI 03-08, Guideline for the Management of Materials Issues, Washington, DC, 2003.

[18] J. Grobe, Director, Division of Component Integrity, Office of Nuclear Reactor Regulation, NRC, letter to A. Marion, Senior Director of Engineering, Nuclear Energy Institute, Nuclear Generation Division, March 2, 2006, ADAMS Accession No. ML060650193.

[19] J.E. Dyer, Director, Office of Nuclear Reactor Regulation, NRC, letter to Gary C. Park, Chairman, ASME Subcommittee on Nuclear Inservice Inspection, December 20, 2005, ADAMS Accession No. ML053480359.

[20] ASME,Section XI, Rules for Inservice Inspection of Nuclear Power Plant Components, in ASME Boiler and Pressure Vessel Code, New York, NY, 2010 Edition.

[21] ASME, Case N-770-1, Alternative Examination Requirements and Acceptance Standards for Class 1 PWR Piping and Vessel Nozzle Butt Welds Fabricated With UNS N06082 or UNS W86182 Weld Filler Material With or Without Application of Listed Mitigation Activities, in Cases of ASME Boiler and Pressure Vessel Code, New York, NY, December 25, 2009.

[22] NRC, American Society of Mechanical Engineers (ASME) Codes and New and Revised ASME Code Cases, Federal Register, Vol. 76, No. 119, pp. 36232-36279, 2011.

[23] EPRI, Report 1022528, Models and Inputs Developed for Use in the xLPR Pilot Study, Palo Alto, CA, 2011.

[24] P.D. Mattie, et al., SAND2010-8480, Development, Analysis, and Evaluation of a Commercial Software Framework for the Study of Extremely Low Probability of Rupture (xLPR) Events at Nuclear Power Plants, Sandia National Laboratories, Albuquerque, NM, December 2010, ADAMS Accession No. ML110700019.

[25] H.B. Klasky, et al., ORNL/NRC/LTR 248, SIAM-xLPR Version 1.0 Framework Report, Oak Ridge National Laboratory, Oak Ridge, TN, September 2010, ADAMS Accession No. ML110700026.

[26] EPRI, Report 1015400, Materials Reliability Program: Advanced FEA Evaluation of Growth of Postulated Circumferential PWSCC Flaws in Pressurizer Nozzle Dissimilar Metal Weld (MRP-216, Rev. 1), Palo Alto, CA, 2007.

[27] D. Rudland, xLPR Version 1.0 ReportTechnical Basis and Pilot Study Problem Results, February 2011, ADAMS Accession No. ML110660292.

[28] O. Pensado, et al., Assessment of Capabilities of Extremely Low Probability of Rupture (xLPR) SoftwareGoldSim and SIAM Version 1.0, Center for Nuclear Waste Regulatory Analyses, San Antonio, TX, May 2011, ADAMS Accession No. ML111510924.

[29] NRC, NUREG-2110, xLPR Pilot Study Report, May 2012, ADAMS Accession No. ML12145A470.

[30] EPRI, Report 1022860, xLPR Pilot Study Report, Palo Alto, CA, June 2012.

[31] D. Weakland, et al., xLPR Group ReportProject Integration Board, Version 1.0, August 30, 2018, ADAMS Accession No. ML19337B823.

[32] NRC, Regulatory Guide 1.174, Rev. 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, May 2011, ADAMS Accession No. ML100910006.

[33] R. Hardies, et al., xLPR Version 2.0 Technical Basis DocumentAcceptance Criteria, October 28, 2016, ADAMS Accession No. ML16271A436.

8-2

[34] C. Lange, xLPR Models Subgroup ReportCrack Initiation, Version 1.0, August 3, 2016, ADAMS Accession No. ML16341B052.

[35] D.J. Shim, xLPR Models Subgroup ReportCrack Transition, Version 1.0, April 20, 2016, ADAMS Accession No. ML16341B044.

[36] NuVision Engineering, Mechanical Stress Improvement Process (MSIP) Product Profile [online]. Available:

http://www.nuvisioneng.com/portals/0/productprofiles/commercial/msipproductprofile.pdf.

[Accessed April 30, 2018]

[37] ASME, Case N-766-1, Nickel Alloy Reactor Coolant Inlay and Onlay for Mitigation of PWR Full Penetration Circumferential Nickel Alloy Dissimilar Metal Welds in Class 1 Items, in 2013 ASME Boiler and Pressure Vessel Code, Code Cases: Nuclear Components, Supplement 1, New York, NY, 2013.

[38] ASME, Case N-740-2, Full Structural Dissimilar Metal Weld Overlay for Repair or Mitigation of Class 1, 2, and 3 Items, in Cases of ASME Boiler and Pressure Vessel Code, New York, NY, November 10, 2008.

[39] ASME, Case N-754-1, Optimized Structural Dissimilar Metal Weld Overlay for Mitigation of PWR Class 1 Items, in 2013 ASME Boiler and Pressure Vessel Code, Code Cases:

Nuclear Components, Supplement 1, New York, NY, 2013.

[40] GoldSim Technology Group, Monte Carlo Simulation SoftwareGoldSim [online].

Available: https://www.goldsim.com/web/home/. [Accessed November 22, 2019]

[41] D. Rudland, C. Harrington, and R. Dingreville, Development of the Extremely Low Probability of Rupture (xLPR) Version 2.0 Code, in Proceedings of the 2015 ASME Pressure Vessels and Piping Conference, Boston, MA, 2015.

[42] Wikimedia Foundation, Inc., Microsoft Excel, November 8, 2019 [online]. Available:

https://en.wikipedia.org/wiki/Microsoft_Excel. [Accessed November 22, 2019]

[43] Wikimedia Foundation, Inc., C# (programming language), November 21, 2019 [online].

Available: https://en.wikipedia.org/wiki/C_Sharp_(programming_language). [Accessed November 22, 2019]

[44] Wikimedia Foundation, Inc., Fortran, November 16, 2019 [online]. Available:

https://en.wikipedia.org/wiki/Fortran. [Accessed November 22, 2019]

[45] F. Brust, xLPR Models Subgroup ReportWelding Residual Stresses, Version 1.0, October 5, 2016, ADAMS Accession No. ML16341B049.

[46] NRC, NUREG-2162, Weld Residual Stress Finite Element Analysis Validation: Part 1 Data Development Effort, March 2014, ADAMS Accession No. ML14087A118.

[47] EPRI, Report 3002005498, Materials Reliability Program: Finite Element Model Validation for Dissimilar Metal Butt-Welds (MRP-316 Revision 1): Volumes 1 and 2, Palo Alto, CA, 2015.

[48] EPRI, Report 3002005499, Materials Reliability Program: Welding Residual Stress Dissimilar Metal Butt Weld Finite Element Modeling Handbook (MRP-317, Revision 1),

Palo Alto, CA, 2015.

[49] H.J. Rathbun, et al., NRC Welding Residual Stress Validation Program International Round Robin Program and Findings, PVP2011-57642, in Proceedings of ASME Pressure Vessel Piping Conference, Baltimore, MD, 2011.

[50] L.F. Fredette, et al., NRC/EPRI Welding Residual Stress Validation ProgramPhase III Details and Findings, PVP2011-57645, in Proceedings of ASME Pressure Vessel Piping Conference, Baltimore, MD, 2011.

8-3

[51] C. Amzallag, et al., Stress Corrosion Life Assessment of Alloy 600 PWR Components, in Proceedings of the Ninth International Symposium on Environmental Degradation of Materials in Nuclear Power SystemsWater Reactors, Newport Beach, CA, 1999.

[52] EPRI, Report 1012089, Materials Reliability Program: Proceedings of the 2005 International PWSCC of Alloy 600 Conference and Exhibit Show (MRP-154), Palo Alto, CA, 2005.

[53] J. Daret, Initiation of SCC in Alloy 600 Wrought Materials: A Laboratory and Statistical Evaluation, in Proceedings of the 12th International Conference on Environmental Degradation of Materials in Nuclear Power SystemWater Reactors, Salt Lake City, UT, 2005.

[54] EPRI, Report 1019032, Stress Corrosion Cracking Initiation Model for Stainless Steel and Nickel Alloys, Palo Alto, CA, November 2009.

[55] Wikimedia Foundation, Inc., Weibull Distribution, November 3, 2019 [online]. Available:

https://en.wikipedia.org/wiki/Weibull_distribution. [Accessed December 23, 2019]

[56] R.B. Abernethy, The New Weibull Handbook, Second Edition, Robert B. Abernethy, North Palm Beach, FL, 1996.

[57] NRC, NUREG/CR-6583, Effects of LWR Coolant Environments on Fatigue Design Curves of Carbon and Low-Alloy Steels, March 1998, ADAMS Accession No. ML031480391.

[58] NRC, NUREG/CR-6717, Environmental Effects on Fatigue Crack Initiation in Piping and Pressure Vessel Steels, May 2001, ADAMS Accession No. ML011450101.

[59] NRC, NUREG/CR-6237, Statistical Analysis of Fatigue Strain-Life Data for Carbon and Low-Alloy Steels, May 1994, ADAMS Accession No. ML20073C591.

[60] NRC, NUREG/CR-6335, Fatigue Strain-Life Behavior of Carbon and Low Alloy Steels, Austenitic Stainless Steels, and Alloy 600 in LWR Environments, August 1995, ADAMS Accession No. ML20091M888.

[61] K. Schmitt and G. Troyer, xLPR Technical ReportPrimary Water Stress-Corrosion Cracking Initiation Model Parameter Development, Confirmatory Analyses, and Validation, Version 2.0, July 28, 2017, ADAMS Accession No. ML19337C202.

[62] E.L. Kaplan and P. Meier, Nonparametric Estimation from Incomplete Observations, Journal of the American Statistical Association, Vol. 53, No. 282, pp. 457-481, 1958.

[63] M.A. Law and W.D. Kelton, Simulation Modeling and Analysis, 2nd Edition, McGraw Hill, New York, 1991.

[64] NRC, NUREG/CR-6909, Effect of LWR Coolant Environments on the Fatigue Life of Reactor Materials, February 2007, ADAMS Accession No. ML070660620.

[65] R. Cipolla, et al., xLPR Models Subgroup ReportStress Intensity Factors, Version 1.0, June 28, 2016, ADAMS Accession No. ML16341B046.

[66] ASME and American Petroleum Institute, API 579-1/ASME FFS-1, Fitness-For-Service, API Publishing Services, Washington, DC, June 2007.

[67] D. Rudland, A. Csontos, and D.J. Shim, Stress Corrosion Crack Shape Development Using AFEA, Journal of Pressure Vessel Technology, Vol. 132, No. 1, pp. 011406 1 7, February 2010.

[68] S. Xu, D. Scarth, and R. Cipolla, Technical Basis for Application of Weight Function Method for Calculation of Stress Intensity Factor for Surface Flaws Proposed for ASME Section XI Appendix A, Journal of Pressure Vessel Technology, Vol. 135, No. 5, pp.

051209-1-9, October 2013.

8-4

[69] D.J. Shim, S. Xu, and M. Kerr, Effect of Weld Residual Stress Fitting on Stress Intensity Factor for Circumferential Surface Cracks in Pipe, Journal of Pressure Vessel Technology, Vol. 137, No. 1, pp. 011403-1-8, February 2015.

[70] W. Zang, Stress Intensity Factor Solutions for Axial and Circumferential Through Wall Crack in Cylinders, SINTAP/SAQ/02, SAQ Kontroll AB, Sweden, 1997.

[71] Y.S. Yoo, S.H. Ahn, and K. Ando, Fatigue Crack Growth and Penetration Behavior in Pipes Subjected to Bending Moment, in Proceedings of the ASME 1998 Pressure Vessels and Piping Conference, San Diego, CA, 1998.

[72] Y.S. Yoo and K. Ando, Circumferential Inner Fatigue Crack Growth and Prediction Behavior in Pipe Subjected to a Bending Moment, Fatigue and Fracture in Engineering Materials and Structures, Vol. 23, No. 1, pp. 1-8, 2000.

[73] D.D. Dedhia, D.O. Harris, and V.E. Denny, Report SAI-331-82-PA, TIFFANY: A Computer Code for Thermal SIF for Surface Cracks in Clad Piping, Science Applications, Inc., Palo Alto, CA, November 1982.

[74] D. Harris, xLPR Models Subgroup ReportCyclic Stress Intensity Factors, Version 1.0, January 31, 2016, ADAMS Accession No. ML16341B048.

[75] S. Timoshenko and J.N. Goodier, Theory of Elasticity, Second Edition, McGraw Hill Book Co., New York, 1951.

[76] K. Schmitt, xLPR Models Subgroup ReportCrack Growth and Coalescence, Version 1.0, June 29, 2016, ADAMS Accession No. ML16341B051.

[77] G. Koch, Stress-Corrosion Cracking and Hydrogen Embrittlement, in ASM Handbook, Vol. 19, Fracture Mechanics, Damage Tolerance, and Life Assessment, pp. 483-506, ASM International, Materials Park, OH, 1996.

[78] EPRI, Report 1006695, Rev. 1, Materials Reliability Program (MRP) Crack Growth Rates for Evaluating Primary Water Stress Corrosion Cracking (PWSCC) of Thick-Wall Alloy 600 Materials (MRP-55), Palo Alto, CA, 2002.

[79] EPRI, Report 1006696, Materials Reliability Program: Crack Growth Rates for Evaluating Primary Water Stress Corrosion Cracking (PWSCC) of Alloy 82, 182, and 132 Welds (MRP-115), Palo Alto, CA, 2004.

[80] EPRI, Report 1019082, Materials Reliability Program: Technical Bases for the Chemical Mitigation of Primary Water Stress Corrosion Cracking in Pressurized Water Reactors (MRP 263), Palo Alto, CA, 2009.

[81] EPRI, Report 1022852, Materials Reliability Program: Probabilistic Assessment of Chemical Mitigation of Primary Water Stress Corrosion Cracking in Nickel-Base Alloys (MRP 307), Zinc Addition and Hydrogen Optimization to Mitigate Primary Water Stress Corrosion Cracking in Westinghouse Reactor Vessel Outlet Nozzles and Babcock &

Wilcox Reactor Coolant Pump Nozzles, Palo Alto, CA, 2011.

[82] M.E. Fine and Y. Chung, Fatigue Failure in Metals, in ASM Handbook, Vol. 19, Fatigue and Fracture, pp. 63-72, ASM International, Materials Park, OH, 1996.

[83] P. Pao, Mechanisms of Corrosion Fatigue, in ASM Handbook, Vol. 19, Fatigue and Fracture, pp. 185-192, ASM International, Materials Park, OH, 1996.

[84] Y. Nomura, H. Kanasaki, and K. Sakaguchi, Fatigue Crack Growth Rate Curve for Nickel Based Alloys in PWR Environment, PVP2007-26186, in Proceedings of the ASME 2007 Pressure Vessels and Piping Division Conference, San Antonio, TX, July 2007.

[85] NRC, NUREG/CR-2189, Probability of Pipe Fracture in the Primary Coolant Loop of a PWR Plant, Vol. 5, Probabilistic Fracture Mechanics Analysis, Load Combination Program, Project I Final Report, August 1981, ADAMS Accession No. ML15300A304.

8-5

[86] ASME,Section XI, Rules for Inservice Inspection of Nuclear Power Plant Components, in ASME Boiler and Pressure Vessel Code, New York, NY, 2004 Edition.

[87] V. Kumar and M.D. German, NP-5596, Elastic-Plastic Fracture Analysis of Through-Wall and Surface Flaws in Cylinders, Research Project 1237-5, EPRI, Palo Alto, CA, January 1988.

[88] B. Young, et al., xLPR Models Subgroup ReportCrack Opening Displacement, Version 1.0, April 20, 2016, ADAMS Accession No. ML16341B053.

[89] Y.J. Kim, N.S. Huh, and Y.J. Park, Elastic-Plastic J and COD Estimates for Axial Through-Wall Cracked Pipes, International Journal of Pressure Vessels and Piping, Vol.

79, pp. 451-464, 2002.

[90] D.J. Shim, D. Rudland, and D. Harris, Modeling of Subcritical Crack Growth Due to Stress Corrosion CrackingTransition from Surface Crack to Through-Wall Crack, PVP2011-57267, in Proceedings of the 2011 ASME Pressure Vessels and Piping Conference, Baltimore, MD, 2011.

[91] N.S. Huh, et al., Stress Intensity Factors for Slanted Through-Wall Cracks Based on Elastic Finite Element Analyses, Fatigue and Fracture of Engineering Materials and Structures, Vol. 31, No. 2, pp. 197-209, 2008.

[92] N.S. Huh, et al., Stress Intensity Factors and Crack Opening Displacements for Slanted Axial Through-Wall Cracks in Pressurized Pipes, Fatigue and Fracture of Engineering Materials and Structures, Vol. 31, No. 6, pp. 428-440, 2008.

[93] N.S. Huh, et al., Estimates of Elastic Crack Opening Displacements of Slanted Through Wall Cracks in Plate and Cylinder, ASME Journal of Pressure Vessel Technology, Vol.

132, No. 2, p. 021401, 2010.

[94] D.J. Shim, J.S. Park, and D. Rudland, Surface to Through-Wall Crack Transition Model for Circumferential Cracks in Pipes, Fatigue and Fracture of Engineering Materials and Structures, 2015.

[95] D.J. Shim, J.S. Park, and D. Rudland, Non-Idealized Surface to Through-Wall Crack Transition Model for Axial Cracks in Cylinders, ASME Journal of Pressure Vessel Technology, Vol. 138, No. 1, p. 011203, 2016.

[96] British Energy Generation Ltd., R6, Assessment of the Integrity of Structures Containing Defects, III.11.1-III.11.42, British Energy Generation Ltd., 2001.

[97] E. Kurth and P. Williams, xLPR Models Subgroup ReportLeak Rate, Version 1.1, June 7, 2016, ADAMS Accession No. ML16341B047.

[98] P.M. Scott, et al., Development of the PRO-LOCA Probabilistic Fracture Mechanics Code, MERIT Final Report, Number 2010:46, ISSN: 2000-0456, Swedish Radiation Safety Authority, December 2010.

[99] R. Henry, The Two-Phase Critical Discharge of Initially Saturated or Subcooled Liquid, Nuclear Science and Engineering, Vol. 41, pp. 336-342, 1970.

[100] R.E. Henry, H.K. Fauske, and S.T. McComas, Two-Phase Critical Flow at Low Qualities, Part I: Experimental, Nuclear Science and Engineering, Vol. 41, pp. 79-91, 1970.

[101] R.E. Henry, H.K. Fauske, and S.T. McComas, Two-Phase Critical Flow at Low Qualities, Part II: Analysis, Nuclear Science and Engineering, Vol. 41, pp. 92-98, 1970.

[102] R.E. Henry and H.K. Fauske, The Two-Phase Critical Flow of One-Component Mixtures in Nozzles, Orifices, and Short Tubes, Transactions of the ASME Journal of Heat Transfer, Vol. 95, pp. 179-187, 1971.

[103] EPRI, NP-3395, Calculation of Leak Rates through Cracks in Pipes and Tubes, Palo Alto, CA, 1983.

8-6

[104] NRC, NUREG/CR-5128, Evaluation and Refinement of Leak-Rate Estimation Models, Rev. 1, June 1994.

[105] NRC, NUREG/CR-6861, Barrier Integrity Research Program Final Report, December 2004, ADAMS Accession No. ML043580207.

[106] Instrument Society of America, ISA-S67.03-1982, Standard for Light-Water Reactor Coolant Pressure Boundary Leak Detection, Research Triangle Park, NC, 1982.

[107] NRC, Regulatory Guide 1.45, Guidance on Monitoring and Responding to Reactor Coolant System Leakage, Rev. 1, May 2008, ADAMS Accession No. ML073200271.

[108] G.L. Sozzi and W.A. Sutherland, NEDO-13418, Critical Flow of Saturated and Subcooled Water at High Pressure, General Electric Co., San Jose, CA, 1975.

[109] R.P. Collier, et al., NP-3540-LD, Two-Phase Flow Through Intergranular Stress Corrosion Cracks and Resulting Acoustic Emission, EPRI, Palo Alto, CA, 1984.

[110] NRC, NUREG/CR-3475, Critical Discharge of Initially Subcooled Water Through Slits, September 1983, ADAMS Accession No. ML20078E995.

[111] T. Yano, E. Matsushima, and A. Okamoto, Experimental Study of Leak Flow Rate Through Artificial Slits, SMIRT, Vol. G, No. 9, pp. 287-292, 1987.

[112] R. Olson, xLPR Models Subgroup ReportCrack Stability, Version 1.0, June 20, 2016, ADAMS Accession No. ML16341B050.

[113] Y. Li, et al., Prediction of Collapse Stress for Pipes with Arbitrarily Multiple Surface Flaws, Journal of Pressure Vessel Technology, Vol. 132, p. 061204, 2010.

[114] S. Rahman and G. Wilkowski, Net-Section-Collapse Analysis of Circumferentially Cracked CylindersPart I: Arbitrary-Shaped Cracks and Generalized Equations, Engineering Fracture Mechanics, Vol. 61, pp. 191-211, 1998.

[115] S. Rahman, Net-Section-Collapse Analysis of Circumferentially Cracked Cylinders Part II: Idealized Cracks and Closed-Form Equations, Engineering Fracture Mechanics, Vol. 61, pp. 213-230, 1998.

[116] F.W. Brust and P. Gilles, Approximate Methods for Fracture Analysis of Tubular Members Subjected to Combined Tensile and Bending Loads, Journal of Offshore Mechanics and Arctic Engineering, Vol. 116, pp. 221-227, 1994.

[117] A. Zahoor, Report NP-6301-D, Ductile Fracture Handbook, Vol. 3, EPRI, Palo Alto, CA, 1989.

[118] K. Schmitt, xLPR Models Subgroup ReportInservice Inspection, Version 1.0, June 16, 2016, ADAMS Accession No. ML16341B045.

[119] EPRI, Report 3002010988, Materials Reliability Program: Development of Probability of Detection Curves for Ultrasonic Examination of Dissimilar Metal Welds (MRP 262, Revision 3)Typical PWR Leak-Before-Break Line Locations, Palo Alto, CA, May 2017.

[120] ASME,Section XI, Rules for Inservice Inspection of Nuclear Power Plant Components, in ASME Boiler and Pressure Vessel Code, New York, NY, 2013 Edition.

[121] D.W. Hosmer, et al., Applied Logistic Regression, 3rd Edition, Wiley, Hoboken, NJ, 2013.

[122] R. Dingreville, et al., xLPR Group ReportComputational Group, Version 1.0, January 6, 2020, ADAMS Accession No. ML20008D810.

[123] Wikimedia Foundation, Inc., Ramberg-Osgood Relationship, December 14, 2020.

[online]. Available:

https://en.wikipedia.org/wiki/Ramberg%E2%80%93Osgood_relationship. [Accessed December 18, 2020]

8-7

[124] NRC, NUREG/CR-6235, Assessment of Short Through-Wall Circumferential Cracks in PipesExperiments and Analysis, April 1995, ADAMS Accession No. ML20082U145.

[125] Y. Lei, Y. Li, and Z. Gao, Global Limit Load Solutions for Thick-Walled Cylinders with Circumferential Cracks Under Combined Internal Pressure, Axial Force and Bending MomentPart I: Theoretical Solutions, International Journal of Pressure Vessels and Piping, Vols. 114-115, February-March 2014, pp. 23-40, 2013.

[126] NRC, NUREG/CR-6861, Barrier Integrity Research Program, December 2004, ADAMS Accession No. ML043580207.

[127] Atomic Energy Commission, Quality Assurance Criteria for Nuclear Power Plants, Federal Register, pp. 10498-10501, June 27, 1970.

[128] NRC, Regulatory Guide 1.28, Rev. 4, Quality Assurance Program Criteria (Design and Construction), June 2010, ADAMS Accession No. ML100160003.

[129] ASME, NQA-1-2008, Quality Assurance Requirements for Nuclear Facility Applications, New York, NY, 2008.

[130] ASME, NQA-1a-2009, Quality Assurance Requirements for Nuclear Facility Applications, New York, NY, 2009.

[131] NRC, NUREG/BR-0167, Software Quality Assurance Program and Guidelines, February 1993, ADAMS Accession No. ML012750471.

[132] IEEE, Standard 1058-1998, IEEE Standard for Software Project Management Plans, Piscataway, NJ, 1998.

[133] IEEE, Standard 730-2002, IEEE Standard for Software Quality Assurance Plans, Piscataway, NJ, 2002.

[134] IEEE, Standard 828-2005, IEEE Standard for Software Configuration Management Plans, Piscataway, NJ, 2005.

[135] B.W. Boehm, A Spiral Model of Software Development and Enhancement, Computer, Vol. 21, No. 5, pp. 61-72, May 1988.

[136] C.H. Kepner and B.B. Tregoe, The Rational Manager: A Systematic Approach to Problem Solving and Decision-Making, McGraw-Hill Book Company, New York, NY, 1965.

[137] IEEE, Standard 1012-1986, IEEE Standard for Software Verification and Validation Plans, Piscataway, NJ, 1986.

[138] ASME, V&V 10-2006, Standard for Verification and Validation in Computational Solid Mechanics, New York, NY, 2006.

[139] C. Casto, Director, Division of Reactor Safety, U.S. NRC, letter to S. Byrne, Vice President, Nuclear Operations, Virgil C. Summer Nuclear Station, NRC Special Inspection Report No. 50-395/00-08, March 15, 2001, ADAMS Accession No. ML010740293.

[140] J. Spina, Vice President, Constellation Energy Generation Group, letter to U.S. NRC Document Control Desk, Calvert Cliffs Nuclear Power Plant, Unit No. 1, Docket No. 50 317, ASME Code Section XI Flaw Evaluation of Dissimilar Metal Weld Flaws Identified by Ultrasonic Testing, May 31, 2006, ADAMS Accession No. ML061580443.

[141] M. Bezilla, Vice PresidentNuclear, FirstEnergy Nuclear Operating Co., letter to U.S.

NRC Document Control Desk, Licensee Event Report 2006-002-00, May 22, 2006, ADAMS Accession No. ML061440286.

8-8

[142] C. Haney, Director, Division of Operating Reactor Licensing, Office of Nuclear Reactor Regulation, U.S. NRC, letter to R. Muench, President and Chief Executive Officer, Wolf Creek Nuclear Operating Corporation, Wolf Creek Generating StationPressurizer Surge, Spray, Safety, and Relief Nozzle Weld Susceptibility to Primary Water Stress Corrosion Cracking (TAC No. Md4198), May 10, 2007, ADAMS Accession No. ML071160436.

[143] B. George, Manager, Nuclear Licensing, Southern Nuclear Operating Co., Inc., letter to U.S. NRC Document Control Desk, Joseph M. Farley Nuclear Plant Unit 2, Pressurizer Nozzle Full Structural Weld Overlay Evaluation, May 3, 2007, ADAMS Accession No. ML071230402.

[144] M. Bezilla, Vice PresidentNuclear, FirstEnergy Nuclear Operating Co., letter to U.S.

NRC Document Control Desk, Davis-Besse Nuclear Power Station, Docket Number 50-346, License Number NPF-3, Licensee Event Report 2008-0001, Pressure Boundary Leak Found During Decay Heat Removal Drop Line Weld Overlay, February 28, 2008, ADAMS Accession No. ML080640204.

[145] Virginia Electric and Power Company, NDE Results for Steam Generator Hot Leg Nozzle Full Structural Weld Overlays, Virginia Electric and Power Company, Richmond, VA, 2012, ADAMS Accession Nos. ML12143A135 and ML12143A136.

[146] R. Kurth, Probabilistic Mechanics Analysis of the Impact of Stress Corrosion Cracking on Pipeline Leak Before Break, in 62nd Meeting of the Society for Machinery Failure Prevention Technology, Virginia Beach, VA, 2008.

[147] NRC, NUREG/CR-5864, Theoretical and Users Manual for pc-PRAISE, 1992, ADAMS Accession No. ML20099D534.

[148] NRC, NUREG-1350, U.S. Nuclear Regulatory Commission Information Digest 2017-2018, Vol. 29, Rev. 1, December 2017, ADAMS Accession No. ML18037A641.

[149] NRC, Official Transcript of Proceedings, Advisory Committee on Reactor Safeguards 592nd Meeting: Open Session, Rockville, MD, March 8, 2012, ADAMS Accession No. ML12080A125.

[150] NRC, NUREG-2288, Weld Residual Stress Finite Element Analysis Validation: Part II Proposed Validation ProcedureDraft Report for Comment, August 2018, ADAMS Accession No. ML18242A007.

[151] NRC, Official Transcript of Proceedings, Advisory Committee on Reactor Safeguards Materials, Metallurgy and Reactor Fuels, Rockville, MD, February 6, 2013, ADAMS Accession No. ML13154A442.

[152] NRC, Official Transcript of Proceedings, Advisory Committee on Reactor Safeguards Materials, Metallurgy and Reactor Fuels Subcommittee Meeting: Open Session, Rockville, MD, June 4, 2013, ADAMS Accession No. ML13226A544.

[153] R. Iyengar, NRC, Memorandum, Issuance of the External Review Board Summary Documents as Required Under Sub-Task 1.3 of User Need Request NRR-2014-004, December 1, 2017, ADAMS Accession No. ML17276A683.

[154] M. Erickson, xLPR Technical ReportSources and Treatment of Uncertainties, Version 2.0, November 16, 2020, ADAMS Accession No. ML19337C165.

[155] G. Moffatt, V. C. Summer Nuclear Station: Alpha Hot Leg Evaluation and Repair and Industry Direction for PWSCC, in Proceedings: EPRI MRP Alloy 600 Industry Workshop, Atlanta, GA, 2001.

[156] EPRI, Technical Report 1009806, Materials Reliability Program: Probabilistic Risk Assessment of Alloy 82/182 Piping Butt Welds (MRP-116), Palo Alto, CA, 2004.

8-9

[157] M. Homiack, xLPR Group ReportInputs Group, Version 1.0, ADAMS Accession No. ML19337B876, December 19, 2017.

[158] A. Eckert-Gallup, et al., SAND2017-2854, xLPR Scenario Analysis Report, Sandia National Laboratories, Albuquerque, NM, March 2017, ADAMS Accession No. ML19337B979.

[159] M. Stein, Large Sample Properties of Simulations Using Latin Hypercube Sampling, Technometrics, Vol. 29, No. 2, pp. 239-245, 1987.

[160] J.C. Helton and F.J. Davis, Latin Hypercube Sampling and the Propagation of Uncertainty in Analyses of Computer Systems, Reliability Engineering and System Safety, pp. 23-69, 2003.

8-10

GLOSSARY The terminology below appears throughout this document.

Term Description Aleatory A type of uncertainty that is irreducible.

Axial crack A crack that is oriented in a plane extending radially from the center of a pipe.

Base metal Materials located adjacent to a weld joining two sections of pipe.

Butt weld A weld that joins two pipes end to end.

Call Execution of a specific function within software.

Circumferential crack A crack that is oriented in a plane parallel to the transverse section of a pipe.

Configuration management A discipline applying technical and administrative direction and surveillance to identify and document the functional and physical characteristics of a configuration item, control changes to those characteristics, record and report change processing and implementation status, and verify compliance with specified requirements.

Crack coalescence The combination of two cracks into one.

Crack growth A process by which a crack becomes progressively longer or deeper.

Crack initiation Formation of a crack before it is detectable by usual nondestructive examination techniques and before it can be analyzed using fracture mechanics.

Critical ratio An indication of how close a pipe is to rupture.

Epistemic A type of uncertainty that is due to lack of knowledge.

Fatigue A degradation mechanism caused by the simultaneous action of cyclic and tensile stress. Fatigue may culminate in crack initiation and growth that may cause fracture after enough cycles.

Fracture mechanics The field of mechanics concerned with the study of the propagation of cracks in materials.

Idealized surface crack A planar crack on the inside surface of a component that has a semielliptical shape.

Idealized through-wall crack A planar crack that extends from the inside surface of a piping component to the outside surface with equal radial inner and outer lengths.

Indicator function A random variable for an event that equals 1 when the event happens and zero when the event does not happen.

Leak before break The concept that a leaking crack will be detected before it becomes unstable and leads to a rupture.

Limit load The maximum load a pipe with or without cracks can withstand before it is predicted to fail.

A-1

Term Description Model A mathematical representation of a physical process or phenomenon.

Module An individual component of a software product.

Piping Individual pieces that, when joined together, make a piping system. Examples include straight pipes, welds, elbows, tees, nozzles, and valves.

Primary water stress-corrosion A stress-corrosion cracking degradation mechanism to cracking (PWSCC) which certain materials used in nuclear power plant piping systems are susceptible.

Probability distribution A mathematical characterization of uncertainty.

Examples include normal, lognormal, and uniform.

Realization One execution or trial of a probabilistic simulation using a set of deterministic input values sampled from probability distributions.

Rupture A complete break or catastrophic structural failure of a component.

Stress-intensity factor A characterization of the driving force for fracture at the tips of a crack.

Surface crack A crack that is open to the inside of a component and does not penetrate through it.

Through-wall crack A crack that penetrates a component and is open to both the inside and outside.

Transient A change in the reactor coolant system temperature, pressure, or both, attributed to a change in the reactors power output. Transients can be caused by (1) adding or removing neutron poisons, (2) increasing or decreasing electrical load on the turbine generator, or (3) accident conditions.

Transitioning crack A through-wall crack whose shape is nonidealized, meaning that it has different lengths on the inside and outside surfaces of the component.

Uncertainty Characterized by multiple possible values of inputs and outputs, on which statistics may be created.

A-2

CONTRIBUTORS The following table lists the individual contributors to the xLPR Version 2 development effort along with their roles. The listed affiliations reflect the individuals status while a contributor during the project and may have changed since.

Name Affiliation Role Alley, David NRC Acceptance Group member Benson, Michael NRC ACOD module programmer COD Subgroup member Computational Group member Crack Transition Subgroup member CCOD module verification tester Framework verification tester K-Solutions Subgroup co-lead Bishop, Bruce Westinghouse Electric Computational Group co-lead Company Phoenix Engineering PIB member Associates, Inc.

Brickstad, Bjorn Swedish Radiation Safety ERB member Authority Brooks, Dusty Sandia National Computational group member Laboratories Framework programmer Broussard, John Dominion Engineering, Inc. Inputs Group member WRS Subgroup member Brust, Frederick Engineering Mechanics COD Subgroup member Corporation of Columbus Crack Stability Subgroup member Framework acceptance testing lead K-Solutions Subgroup member WRS Subgroup member Burkardt, Markus Dominion Engineering, Inc. Crack Growth Subgroup member Framework validation tester Framework verification tester Inputs Group member Casarez, Christopher Dominion Engineering, Inc. CGR module programmer Crack Growth Subgroup member Crack Initiation Subgroup member Framework verification and validation testing lead ISI module verification tester Cipolla, Russell Intertek Group plc Crack Growth Subgroup member K-Solutions Subgroup member Clark, Andrew Sandia National Computational Group member Laboratories Framework validation tester Clement, Patrick Dominion Engineering, Inc. Framework verification tester Collins, Jay NRC PIB member B-1

Name Affiliation Role Cox, Andrew Battelle Memorial Institute ACOD module verification tester ASCS module verification tester ATWCS module verification tester CCOD module verification tester CTWCS module verification tester WRS Subgroup member Csontos, Aladar NRC Acceptance Group member DeBoo, Guy Exelon Corporation Inputs Group lead Dedhia, Dilip Structural Integrity Computational Group member Associates CCC module programmer Crack Growth Subgroup member Framework validation tester Framework verification tester SCSIF module programmer K-Solutions Subgroup member TWC SIF module programmer Leak Rate Subgroup member TIFFANY programmer TIFFANY Subgroup member Dennis, Mark EPRI ISI Subgroup lead Dingreville, Rémi Sandia National Computational Group lead Laboratories Crack Stability Subgroup member CTWCS module programmer Dinsmore, Stephen NRC Acceptance Group member Dodds, Robert Jr. University of Illinois ERB member Dyle, Robin EPRI Acceptance Group member Eckert-Gallup, Sandia National Computational Group member Aubrey Laboratories Crack Stability Subgroup member Framework programmer Framework validation tester CTWCS module programmer Erickson, Marjorie Phoenix Engineering COD Subgroup lead Associates, Inc. Models Group lead TIFFANY Subgroup co-lead Facco, Giovanni NRC Models Group member Focht, Eric NRC Models Group co-lead Fyfitch, Steve AREVA NP, Inc. Crack Growth Subgroup lead Geelhood, Ken Pacific Northwest National Computational Group member Laboratory Framework verification tester Hackett, Edwin NRC ERB member Hardies, Robert NRC Acceptance Group lead PIB member Harrington, Craig EPRI Acceptance Group member EPRI project manager B-2

Name Affiliation Role Harris, David Structural Integrity Computational Group member Associates Crack Growth Subgroup member TIFFANY verification tester TIFFANY Subgroup member Homiack, Matthew NRC Framework validation tester Framework verification tester Inputs Group lead NRC project manager Hund, Lauren Sandia National Computational Group member Laboratories Jenks, Amanda Dominion Engineering, Inc. Crack Growth Subgroup member Crack Initiation Subgroup member Kalyanam, Engineering Mechanics ASCS module programmer Sureshkumar Corporation of Columbus ATWCS module programmer Crack Stability Subgroup member Crack transition module verification tester Karri, Naveen Pacific Northwest National Computational Group member Laboratory Framework verification tester Kirk, Mark NRC ERB coordinator Contracts management Klasky, Hilda Oak Ridge National QAA Group lead Laboratory Kurth, Robert Engineering Mechanics Computational Group member Corporation of Columbus Crack Transition Subgroup member Framework validation tester Kurth-Twombly, Engineering Mechanics Framework validation tester Elizabeth Corporation of Columbus Leak Rate Subgroup lead Leak rate module verification tester Kusnick, Joshua NRC Inputs Group member Kyle, Nancy Theseus Professional QAA Group lead Services, LLC Lange, Clifford Structural Integrity Crack Initiation Subgroup lead Associates Leech, Nate Demark, Inc. Project management support Lewis, John Sandia National Computational Group member Laboratories Lin, Bruce NRC Contracts management Framework verification tester ISI module verification tester ISI Subgroup member Lupold, Timothy NRC Acceptance Group member Lyons, Sara NRC Models Group member Madrid, Gregory Sandia National Framework programmer Laboratories Malik, Shah NRC Contracts management Mariner, Paul Sandia National Computational Group member Laboratories Framework programmer B-3

Name Affiliation Role Martin, Nevin Sandia National Computational Group member Laboratories Mattie, Patrick Sandia National Computational Group lead Laboratories Modarres, University of Maryland ERB member Mohammad Moroney, Velvet Dominion Engineering, Inc. Computational Group member Olson, Richard Battelle Memorial Institute COD Subgroup lead Crack Stability Subgroup lead CTWCS module programmer Phipps, Deborah Sandia National QAA Group co-lead Laboratories Raynaud, Patrick NRC Framework verification tester Reynolds, John Sandia National Framework programmer Laboratories Rudland, David NRC Acceptance Group member Crack Transition Subgroup member NRC project manager Sallaberry, Cédric Sandia National Computational Group member Laboratories Framework programmer CTWCS module programmer Engineering Mechanics Framework validation tester Corporation of Columbus Sanborn, Scott Pacific Northwest National CGR module verification tester Laboratory FCI module verification tester PCI module verification tester CCC module verification tester Sandia National FCI module verification tester Laboratories PCI module verification tester Computational Group member CCC module verification tester Crack Growth Subgroup member Crack Initiation Subgroup member Crack Stability Subgroup member Framework programmer ISI Subgroup member CTWCS module verification tester Scarth, Douglas Kinectrics, Inc. K-Solutions Subgroup co-lead Schmitt, Kyle Dominion Engineering, Inc. CGR module verification tester FCI module programmer PCI module programmer Crack Growth Subgroup member Crack Initiation Subgroup member ISI module programmer ISI Subgroup member B-4

Name Affiliation Role Scott, Paul Battelle Memorial Institute ACOD module verification tester ASCS module verification tester ATWCS module verification tester COD Subgroup member Crack Stability Subgroup member CTWCS module verification tester Seuaciuc-Osorio, EPRI ISI Subgroup member Thiago Shim, Do Jun Engineering Mechanics Crack Growth Subgroup member Corporation of Columbus Crack Stability Subgroup member Crack Transition Subgroup lead Crack transition module programmer SCSIF module verification testing K-Solutions Subgroup member TWC SIF module verification testing Structural Integrity Crack Transition Subgroup lead Associates K-Solutions Subgroup member Steininger, David EPRI ERB chairman Stevens, Gary NRC Inputs Group co-lead Sullivan, Ted Pacific Northwest National PIB member Laboratory Tregoning, Robert NRC PIB co-lead Troyer, Greg AREVA NP, Inc. Crack Initiation Subgroup member Wallace, Jay NRC Crack Transition Subgroup member Framework verification tester SCSIF module verification testing K-Solutions Subgroup member TWC SIF module verification tester Weakland, Dennis Ironwood Consulting, LLC PIB lead White, Glenn Dominion Engineering, Inc. Crack Growth Subgroup lead Crack Initiation Subgroup member Whitener, Dustin Sandia National Framework programmer Laboratories Williams, Paul Oak Ridge National Computational Group member Laboratory Framework programmer Leak Rate Subgroup member Leak rate module programmer Xu, Steven Kinectrics, Inc. K-Solutions Subgroup member Young, Bruce Battelle Memorial Institute COD Subgroup member Crack Stability Subgroup member CCOD module programmer B-5

SUPPORTING DOCUMENTATION The following charts illustrate the relationships among the xLPR V2 project team units, their key work products, and software lifecycle phases, when applicable. The key work products were the software elements themselves and their associated configuration item documents:

• software requirements description (SRD)

• software design description (SDD)

• software test plan (STP)

• software test results report (STRR)

References to reports listed in Appendix A are included in brackets.

C-1

Computational Group Models Group Project Team Unit Computational Group WRS Crack Initiation K-Solutions TIFFANY Crack Growth Subgroup Subgroup Subgroup Subgroup Subgroup Subgroup Subgroup Group Subgroup Subgroup Subgroup Technical Reports Report Report Report [122] Report [34] Report [65] Report [76]

[45] [74]

SRD SRD SRD SRD SRD SRD SRD SRD Requirements Phase SRD SRD SRD SRD SRD SRD SRD Documentation Software Verification and Validation Plan Design Phase SDD SDD SDD SDD SDD SDD SDD SDD Documentation C-2 Implementation Phase PCI FCI SCSIF TWC SIF CGR CCC Framework User Manual TIFFANY Documentation Module Module Module Module Module Module STP for STP for STP for Unit Integration Acceptance STP STP STP STP STP STP STP Testing Testing Testing STRR for STRR for Test Phase STRR for Integration Acceptance STRR STRR STRR STRR STRR STRR STRR Unit Testing Documentation Testing Testing Software SVVR Verification and Validation Report

Models Group Project Team Unit Crack COD Leak Rate Crack Stability ISI Transition Subgroup Subgroup Subgroup Subgroup Subgroup Subgroup Subgroup Subgroup Subgroup Subgroup Technical Reports Report Report Report Report [88] Report [112]

[35] [97] [118]

Requirements Phase SRD SRD SRD SRD SRD SRD SRD SRD Documentation Design Phase SDD SDD SDD SDD SDD SDD SDD SDD Documentation Crack Implementation Phase ACOD CCOD Leak Rate ASCS ATWCS SCSCS MCSCS CTWCS ISI Transition Module Module Module Module Module Module Module Module Module Documentation Module C-3 STP STP STP STP STP STP STP STP STP STP Test Phase Documentation STRR STRR STRR STRR STRR STRR STRR STRR STRR STRR

Models Group, Computational Project Team Unit Inputs Group Acceptance Group PIB ERB Group, and Inputs Group Sources and Group Group Group Summary Technical Reports Treatment of Report [157] Report [33] Report [31] Documents [153]

Uncertainty [154]

C-4

NUREG-2247 Extremely Low Probability of Rupture Version 2 Probabilistic Fracture Mechanics Code August 2021 Matthew Homiack, Giovanni Facco, Michael Benson, Marjorie Erickson, and Technical Craig Harrington Division of Engineering Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Same as above xLPR Version 2 is a probabilistic fracture mechanics code for piping applications. The code was developed jointly by the U.S. Nuclear Regulatory Commissions (NRCs) Office of Nuclear Regulatory Research and the Electric Power Research Institute (EPRI). They engaged in a multiyear code development effort that built on the results of a successful pilot study. The code, which was designed, programmed, and tested under a rigorous software quality assurance program, provides regulators, industry, researchers, and the public with new quantitative capabilities to analyze the risks associated with nuclear power plant piping systems subject to active degradation mechanisms. Core capabilities of the code include modeling fatigue, stress corrosion cracking, inservice inspection, chemical and mechanical mitigation, leak rates, and seismic effects. This report outlines how the NRCs Office of Nuclear Regulatory Research and EPRI approached code development. It describes the basic design and operation of the software and the underlying models and theory. Results from verification and validation testing and independent reviews are provided. The report also covers sample code inputs and analysis results and provides recommendations for future development.

xLPR probabilistic fracture mechanics leak-before-break PWSCC pipe rupture crack dissimilar metal weld

NUREG-2247 Extremely Low Probability of Rupture Version 2 August 2021 Probabilistic Fracture Mechanics Code