Reliability and Probabilistic Risk Assessment and Materials and Metallurgy
UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
***
MEETING: RELIABILITY AND PROBABILISTIC RISK
ASSESSMENT AND MATERIALS AND METALLURGY
***
U.S. NRC
Room T-2B3
11545 Rockville Pike
Rockville, Maryland
Wednesday, May 5, 1999
The subcommittee met, pursuant to notice, at 8:30 a.m.
MEMBERS PRESENT:
WILLIAM L. SHACK, Chairman, ACRS
JOHN BARTON, Member, ACRS
MARIO BONACA, Member, ACRS
MARIO FONTANA, Member, ACRS
THOMAS S. KRESS, Member, ACRS
DON W. MILLER, Member, ACRS
DANA A. POWERS, Member, ACRS
ROBERT L. SEALE, Member, ACRS
ROBERT E. UHRIG, Member, ACRS
GRAHAM B. WALLIS, Member, ACRS
P R O C E E D I N G S
[8:30 a.m.]
DR. SHACK: The meeting will now come to order. This is a
meeting of the ACRS Subcommittees on Reliability and Probabilistic Risk
Assessment and on Materials and Metallurgy.
I am Dr. William Shack, Chairman of the Subcommittee on
Materials and Metallurgy. Dr. Apostolakis is the Chairman of the
Subcommittee on Reliability and Probabilistic Risk Assessment.
ACRS members in attendance are John Barton, Mario Bonaca,
Mario Fontana, Tom Kress, Donald Miller, Dana Powers, Robert Seale,
Robert Uhrig, Graham Wallis.
The focus of this meeting is to review those topical reports
prepared by the Electric Power Research Institute for risk-informed
in-service inspection.
The subcommittees will gather information, analyze relevant
issues of facts, and formulate proposed positions and actions as
appropriate for deliberation by the full committee.
Michael T. Markley is the cognizant ACRS staff engineer for
this meeting.
The rules for participation in today's meeting have been
announced as part of the notice of this meeting previously published in
the Federal Register on April 14, 1999.
A transcript of the meeting is being kept and will be made
available as stated in the Federal Register notice. It is requested
that speakers first identify themselves and speak with sufficient
clarity and volume so that they can readily be heard.
We have received no written comments or requests for time to
make oral statements from members of the public.
This, again, is the second presentation on risk-informed in-service
inspection that we've seen. We've previously reviewed, a few months
ago, a proposal from the ASME on one approach to risk-informed
inspection. This is another alternate.
We will now proceed with the meeting and I will call upon
Dr. Jeff Mitman of EPRI to begin.
MR. MITMAN: Good morning. My name is Jeff Mitman and I'm
the EPRI project manager for risk-informed ISI. I would like to turn it
over initially to Ham Fish of the New York Power Authority and let him
begin the introductory remarks.
MR. FISH: Good morning. I'd like to introduce the members
of our team.
DR. SHACK: Please use the microphone.
MR. FISH: Beginning at your left, we've got Carl Fleming,
from ERIN Engineering. Next in, Vesna Dimitrijevic, from Duke
Engineering Services, a major contributor to this work on the project;
Jeff Mitman, whom you've met, our EPRI project manager; myself, from the
New York Power Authority, where I manage the research and development
program for the nuclear effort.
Next, Peter Riccardella, from Structural Integrity; and,
Glen Smith, the New York Power Authority Project Manager at the
Fitzpatrick plant. Sitting in the back, Pat O'Regan, working with us on
this project, with EPRI.
Our objectives today are to facilitate your review and
concurrence of the EPRI risk-informed in-service inspection methodology,
in support of a safety evaluation report expected in September of this
year.
The agenda, the organization of our presentation today will
be the status of the topical report, the status of the various pilot
plants which are participating in this, an overview of the technical
methodology for the risk-informed inspections, and, finally, our summary
and conclusions of what we have drawn from where we are to date and what
we look forward to.
At this point, I'd like to turn it over to our EPRI
technical manager, Jeff Mitman.
MR. MITMAN: Thank you, Ham. What we're going to talk about
first is the status of the topical, just a couple slides on -- or one
slide on the topical, one slide on the pilot projects, and the vast
majority of the discussion will be about the technical details of the
methodology.
The original topical was submitted to the NRC for review in
June of 1996. We reviewed extensive RAIs on that, due to the
preliminary nature of that, and from there we've been working on RAI
responses, which went into the topical or went into the NRC staff back
in November of last year.
We've also spent a lot of time revising the topical. That
came to the staff on April 15, copies of which were also supplied to the
ACRS.
The topical revision has included extensive enhancements of
the procedure and basis description, quite a bit of lessons learned
information from the pilot programs, resolutions of questions and
comments from the NRC, and we've also incorporated quite a bit of
related EPRI research information.
The expectations are for a draft SER in June of this year,
with a final SER in September of this year.
A quick discussion of the related ASME code cases. There
are two that are applicable to the EPRI methodology. There is a third
that the WOG Westinghouse ASME research uses. The one that's used there
is N-577, but we won't be talking about that today.
N-560 was approved or code case N-560 was approved in 1996.
It applies to BJ welds in the Class I system only. It excludes socket
welds and it allows for inspection, ten percent of the inspection
sampling of the Class I BJ welds.
A revision to that code case was started this year and it's
about halfway through the approval process and our expectations are for
approval of that this year.
N-578 is an alternate code case that also uses the EPRI
methodology. It was approved in 1997. It applies to Class I, II, III
piping and may include non-code piping.
Inspection criteria there are 25 percent of the high risk
welds, ten percent of the medium risk welds, and zero percent of the low
risk welds.
Likewise, a revision was started on that this year. It's
about halfway through the approval process and, again, we're expecting
approval this year.
The differences are a comparison of the two code cases, the
risk assessment process is the same. The consequence analysis is the
same. The degradation analysis is the same. The distinction is in the
element selection process.
As noted on the slide, for the N-560, we do ten percent of
the BJ welds. For N-578, we do 25 percent of the high, ten percent of
the medium, and zero percent of the low. Both methodologies yield
comparable risk results.
DR. WALLIS: Is it ever good to do zero percent of anything?
MR. MITMAN: The way we pick welds, and we'll get into that
a little bit later, you'll see why we feel it's okay to pick zero
percent of the low risk welds.
DR. WALLIS: In case you were wrong, you might want to have
at least some sample from what you called low risk.
MR. MITMAN: As I said, let's go on with the degradation and
consequence analysis and you'll see where that comes from.
I want to talk about the pilot plants at this point. There
has been quite a bit of work that's been done already and the work
continues. As I said, there are two code cases, two different scopes,
if you will, that we've applied the methodology to. Vermont Yankee was
the first plant to use the methodology and we received the first
industry SER on that back in November of last year. That's an N-560
case and it was done on Class I piping only.
ANO-2 is Combustion Engineering PWR. We did a full plant
evaluation of that under code case N-578. Likewise, Entergy received an
SER approving that in December of last year.
ANO-1 is an N-560 application. It was submitted last year
and we're currently finalizing responses to RAIs that the staff sent us
in the last month or so.
Fitzpatrick is other full plant application, GE boiling
water reactor. We did 14 systems there and we're in final preparation
of the submittal for that.
The following plants are all Class I only applications and
they're in various stages of completion. Braidwood is about 80 percent
complete, South Texas 70-75 percent complete, River Bend and Waterford
haven't started yet, but we expect to do those later this year.
At this point, I'd like to start to talk about the
methodology itself. We'll go through the -- initially, I just want to
go through the process itself at a very high level and then we'll take a
closer look at each of the steps.
The first step is to determine the scope. Do you want to do
BJ welds only? Do you want to do full plant evaluation? How many
systems do you want to include? Where do you want to draw the system
boundaries and stop? That's determination of the scope.
Then there are two independent analyses that need to be
performed, the consequence analysis and the damage mechanism analysis.
They can be done in either order, they can be done in parallel. The
output of both of those is -- neither of those output is input to the
other one. So they can be done in parallel. And probably 50 or 60
percent of the total work is involved in the two analyses, the
consequence analysis and the damage mechanism analysis.
Once that's completed, we do a second check looking at plant
history, what we call a service review of the plant. From there, we do
segment risk categorization, where we take the output from the
consequence analysis and the damage mechanism analysis, put those
together and categorize our welds into high, medium and low risk
regions.
From there, we decide which specific welds we want to --
welds or elements we want to inspect and we also determine the
inspection methods, what kind of NDE we want to perform.
Afterwards, we go after the -- we do a risk impact
assessment and then we finalize the program. There is a feedback --
there are two feedback loops, one coming out of the risk assessment,
whereby if we decide that the risk impacts are unacceptable, we can go
back and add welds, re-allocate elements, do what's necessary to ensure
that we have acceptable risk impacts.
Also, there is a feedback loop at the end of the project,
where we do long-term performance monitoring, whereby we watch what's
going on in the plant, what's going on in the industry, and, if
necessary and as appropriate, we modify -- go back and modify the
various analyses to make sure that we're looking in the right places and
we're looking for the right things.
The heart to the process is the risk matrix and I will show
that in the next slide. But before I bring up the matrix itself, I'd
like to talk a little bit about the two -- some of the concepts behind
the risk matrix.
On one axis, we have the consequence evaluation, where we're
looking at core damage in large early release and the input to that is
both probabilistic insights and deterministic insights. There are four
impact groups that we're considering; initiating events, degradation of
systems and/or trains, degradation of the containment, or combinations
of the three above. The output for that is a consequence ranking of
high, medium, low or none.
On the other side, we have the degradation analysis, where
we're looking at pipe rupture potential and here we're looking at
degradation mechanisms, which damage mechanisms apply or are potentially
applicable to each piping segment.
We do extensive service experience evaluations there and the
output for that is a rupture potential ranking of high, medium and low.
That goes into the risk evaluation matrix and here we have
the matrix, we have the consequences across the X axis, degradation
across the Y. We end up with three consequence rankings, high, medium,
low and none, and, again, the degradation analysis of high, medium and
low. Then we divide into three risk regions high, medium and none,
again.
DR. KRESS: Your conditional probabilities, I assume, are
weighted by the initiating events or added up for all initiating events.
MS. DIMITRIJEVIC: The conditional pipe failure. So given
the -- if we have a pipe failure, what would be the conditional core
damage.
DR. KRESS: You do a conditional for each pipe segment, for
example.
MS. DIMITRIJEVIC: Right.
DR. SHACK: But then he has a frequency of challenge that
determines whether it's high or medium.
DR. KRESS: So the frequency does enter into it.
MR. MITMAN: Frequency does enter into that classification.
MS. DIMITRIJEVIC: Frequency of challenge for the system,
yes. But actually frequency enters through the pipe failure frequency.
DR. APOSTOLAKIS: It's similar to the component, is it not?
MS. DIMITRIJEVIC: Yes. If there is no need for surrogate
component, because we are looking at actual pipe.
DR. APOSTOLAKIS: Jeff, what was the logic behind this
matrix? I mean, this is a decision matrix here. You've given the
categorization of the consequences of a pipe break and the degradation
category, you decide that something is low, medium. What was the logic
of that? For example, how did you decide that if the degradation
category is high and the consequences are low, then it becomes a medium.
MR. MITMAN: The logic behind the matrix concept itself was
driven by a desire to back away from having to do detailed probabilistic
calculations or detailed calculations of the damage mechanisms. We
wanted to come up with a process that was easier to apply, yet was
accurate and gave valid results.
So that led us to the concept of a matrix where we can bend
things easily.
DR. APOSTOLAKIS: Well, we can talk about easy easy is, but
this -- the purpose of this risk evaluation, this matrix is to lead you
to a decision how to treat a pipe segment, is that correct?
MR. MITMAN: Right.
DR. APOSTOLAKIS: So given now that you have done the
consequence evaluation and all that, whether that's easy or not is a
separate issue, the logic of this decision-making process, what was it?
I mean, why is medium degradation category and low consequence category
leads to a low category six segment?
MR. MITMAN: Vesna?
MS. DIMITRIJEVIC: What we tried to decide in this category,
we said, okay, well, let's assume the old pipe in the plant breaks and
CCBP. If they're going to go in danger of ten-to-the-minus-six, which
is the danger where you're actually making the decision, if we're
expecting that we can be above the ten-to-the-minus-six, because those
CCBPs have the ranges between ten-to-the-minus-four and above, then we
said this is a high.
If we say we're expecting the piping in the plant breaks,
it's still be under ten-to-the-minus-six, and then for this region
between, we say, okay, between ten-to-the-minus-six, eight, and
ten-to-the-minus six, if we don't really -- we're going to put the
medium because we were not sure really which way because of all the
answers in this.
So we did this in order to cover our certainty ranges.
DR. APOSTOLAKIS: But that was the uncertainty on the
consequences?
MS. DIMITRIJEVIC: Both, because when we estimate the pipe
failure ranges, also, based on the presence of the degradation
mechanism. So this is built to cover uncertainties. If we expect,
based on our knowledge, that potential for the total CDF to be above
ten-to-the-minus-six, we put it in high.
DR. APOSTOLAKIS: And then what does it mean? If a segment
is medium, what do you do to it?
MS. DIMITRIJEVIC: You're going to see this through the --
it's coming. We will have a different selection for this. Carl, would
you like to add something? Did I miss something?
MR. FLEMING: Carl Fleming, from ERIN. I think that part of
George's questions could be answered that the logic is really risk
equals frequency times consequence. And if this were done in a fully
quantitative way, we'd simply take the frequency of the pipe rupture,
multiply it by the conditional probability of core damage, and then get
the risk.
In the EPRI risk matrix approach, uncertainties are
addressed by looking at this in a very course, discreet way. Instead of
numerically quantifying the conditional core damage probability in each
case and numerically quantifying the frequency of pipe rupture, they're
put into broad categories.
So the logic of high, medium and low stems from the concept
of risk equals frequency times consequence.
DR. APOSTOLAKIS: I understand that. But my question is
this; presumably, there is a certain frequency of inspections and so on
that corresponds to medium, high of these entries.
MS. DIMITRIJEVIC: Of risk.
DR. APOSTOLAKIS: Of risk. Now, you don't have a
quantitative estimate of the impact --
MS. DIMITRIJEVIC: Of inspection.
DR. APOSTOLAKIS: -- of the inspection on these two
categories.
MR. FLEMING: No.
DR. APOSTOLAKIS: So this is purely judgment now. You are
hoping that --
MS. DIMITRIJEVIC: We're estimating total risk from those
locations.
DR. APOSTOLAKIS: Yes, but --
MS. DIMITRIJEVIC: So let's say that not one of those
locations is ever inspected, this is the total risk.
DR. APOSTOLAKIS: That's right. So now the question is, if
the degradation category is medium and the consequence category is
medium, then you say medium.
MS. DIMITRIJEVIC: Right.
DR. APOSTOLAKIS: But you don't know now what the impact of
what you're doing on risk is. You just guess that this would be a
reasonable thing to do.
MS. DIMITRIJEVIC: At this moment, the only thing which we
are trying to do is to divide locations -- I mean, valves and the
piping, based on the risk significance. We are not looking at
inspections yet at all.
DR. APOSTOLAKIS: Yes, but in order to decide that something
is medium, high or low, you have to have some idea of what the impact
is.
MS. DIMITRIJEVIC: Yes. We have some idea of what
probability of failure is and what is the consequence.
DR. APOSTOLAKIS: Without inspection.
MS. DIMITRIJEVIC: Without.
DR. APOSTOLAKIS: And you don't have any idea what happens
to these probabilities with inspection.
MS. DIMITRIJEVIC: No.
DR. APOSTOLAKIS: No.
MS. DIMITRIJEVIC: Neither do we and neither does anybody.
I mean, this is a very difficult thing to estimate. So basically, in
this moment, we are not really trying. When we try to calculate back to
risk, we will try to do that.
DR. APOSTOLAKIS: So there is a judgment here that by doing
high or medium, you know this is good enough. That's really what it
comes down to.
DR. SEALE: Are you going to show us a little later that all
three mediums are comparable in risk and that all of the mediums are
discernibly greater risk than low?
MR. MITMAN: Yes.
DR. SEALE: And conversely, mediums and high.
MR. MITMAN: Right. We'll go into that a little bit later.
DR. SEALE: Okay.
MR. MITMAN: You wanted to add something?
MR. RICCARDELLA: Let me just make a comment. There was a
judgment, as you said, George, made in the beginning, when we set up
these categories, and that judgment was based on looking at what we
currently do under ASME code requirements and coming up with something
which we think is at least equivalent or better.
There was a judgment at that end. But as you will see as we
get on with the presentation, we have now implemented this in a number
of pilot studies and when we complete those pilot studies, we've done
delta risk calculations and quantified the difference between what we
were doing before and what we're doing after.
DR. APOSTOLAKIS: Including the impact of inspections.
MR. MITMAN: Yes.
MS. DIMITRIJEVIC: Yes.
MR. RICCARDELLA: Yes.
DR. APOSTOLAKIS: And it's in this report?
MS. DIMITRIJEVIC: It's Section 3.7.
MR. DINSMORE: This is Stephen Dinsmore, from the staff.
I'd like to add something. When EPRI first came in, they just had this
matrix and ever since then, we've been pushing them to at least estimate
the delta risk. So at the end, they've come up with this methodology to
estimate the delta risk. So they use this process to select and to
guide their inspection selections and then they use this delta risk
calculation to make sure that things are okay.
DR. SHACK: Just a sort of related question. You have sort
of a conditional or damage probability associated with these things,
that you don't really calculate. You calculate from the guidelines that
you've given based sort of on the number of backup trains and you
associate a numerical value of the conditional core damage probability
with those.
How robust is that? I mean, how many PRAs did you look at
before you decided you could really bend them this way and have a
conditional core damage probability that was in the range that you were
assigning to each of those categories?
MS. DIMITRIJEVIC: It's plant-specific, so we look in the
specific plant PRA when we do this. Every plant, different events will
fit into different categories. It's not really so diverse. You will
see also the pipes which result in the LOCA lead to the high
consequences and things like that.
But this matrix is generally applicable to the methodology,
but you apply it on specific plants, you look at specific events and
specific conditional core damage probabilities.
DR. SHACK: Okay. Maybe I misunderstood it. I thought when
you looked at the plant specific, you were really deciding, with this
particular event, you had 2.5 backup trains.
MS. DIMITRIJEVIC: Yes.
DR. SHACK: And that was the plant-specific thing, but you
really didn't calculate the conditional core damage probability.
MS. DIMITRIJEVIC: But that translates --
DR. SHACK: Yes. That translates, but not from that plant's
PSA. Isn't that sort of arbitrarily assigned?
MS. DIMITRIJEVIC: How many backup trains is plant-specific.
What you can count as a train is plant-specific. If some plant keeps a
train with a probability of failure that's ten-to-the-minus-two, that
counts as a train. If that is ten-to-the-minus-one --
DR. SHACK: It doesn't count.
MS. DIMITRIJEVIC: -- it doesn't count as half-train. So
what do you count as a train is plant-specific. So basically, it's a
completely equivalent if as you were running the PRA. Basically, this
table was validated with a lot of PRA runs and always gives the same
category, because it's basically principles of PRA are concentrated in
this table, because this is what PRA sequences are, how many times you
call for something, how many backup trains you have, and what are their
values.
DR. SHACK: Okay. And you say lots of PRA runs, and I guess
my question is, is that lots of PRA runs on two plants or how many
plants did we look at?
MS. DIMITRIJEVIC: We looked at four plants and it depended
on the plant as to what was the number, between five and 20 PRA runs per
plant. We didn't have any disagreements.
DR. APOSTOLAKIS: Yes, I went through 3.7. You say that
while there can be a bounding analysis or if it doesn't work, then you
do a more realistic quantitative analysis, but then you go on and say
that this can be done, but then there is a whole paragraph why it cannot
be done, because it's very difficult, and I agree.
Then in the examples that you have in here somewhere from
the actual plants, I didn't see the impact, the quantitative estimate of
the impact of the in-service inspection.
So is that really something that you have done or something
that could be done in principal, but it's not really done?
MR. MITMAN: On VY ANO-2, ANO-1, we've done realistic
analysis on some of the systems, as required, where we couldn't show
qualitatively that risk was improving.
On ANO-2, we've also done some Markovian analysis that
further, in more detail, looked at several systems in the ANO-2 plant.
So those analyses have been done.
DR. SHACK: And when you say you did that, you actually
computed the conditional core damage probability for that plant from the
PSA, not from the binding value of the CCDP that you have.
MR. MITMAN: Vesna, correct me if I'm wrong, but if I
remember correctly, we actually looked at each of the pipe segments on
VY and ANO-2, calculated the conditional core damage probability, and
then used those to validate the delta CDF calculations.
MS. DIMITRIJEVIC: But we do also use a bounding if you're
in the medium range, because we can have a lot of else with the
different CCDPs in that train and we used the upper value. In every
range, we will use the upper value in bounding, because then it's
considered. So we don't go to every specific valve that refers to CCDP.
We will take the highest value for this range.
DR. APOSTOLAKIS: So did you see a significant input?
MS. DIMITRIJEVIC: Of?
DR. APOSTOLAKIS: Of the inspection?
MR. MITMAN: No.
MS. DIMITRIJEVIC: We didn't see it. We just saw
ten-to-the-minus-six and ten-to-the-minus-nine.
DR. APOSTOLAKIS: So inspection did not help in any way.
MR. MITMAN: No.
DR. APOSTOLAKIS: So why are we doing all this?
MR. RICCARDELLA: It started out as negligible.
DR. APOSTOLAKIS: Why are we doing all this?
MS. DIMITRIJEVIC: We asked ourselves from the beginning
this question a lot of times and basically the answer that I got most
often is that so we take a look and we don't miss something. But
risk-wise, there is no justification for doing it.
DR. KRESS: It's defense-in-depth.
DR. APOSTOLAKIS: So in-service inspection can be dropped.
DR. KRESS: It's defense-in-depth. There is large
uncertainty in this area.
DR. APOSTOLAKIS: That's very good.
MR. MITMAN: They have a value impact analysis.
DR. APOSTOLAKIS: In the report, in several places, you say
that the service experience to date provides a strong indication that
the frequency of pipe ruptures is only very weakly correlated to the
inspection processes. So that's a general statement then. Even if you
use this more sophisticated approach, that's still true.
MR. MITMAN: That's true.
MS. DIMITRIJEVIC: Very true.
MR. ALI: This is Syed Ali from the staff. I just wanted to
clarify one thing. When you say that the experience is that the
in-service inspection has real flaws, that's basically related to the
Section 11, ASME Section 11 inspections.
Based on the actual experience that the plants had and the
regulations actually followed, there are several augmented inspection
programs, for example, for IGSCC and FAC, which have indeed found flaws.
DR. APOSTOLAKIS: Well, originally, I thought myself that
this statement referred to experience, so ASME Code Section 11 didn't
help us. But now they're saying that even with this, they don't expect
to see an impact, which is a very interesting conclusion.
MR. MITMAN: The methodology is there to help you decide
where to do the ASME Section 11 inspections. Now, we continue and we
work with the augmented programs and there is a lot of value in
particularly the FAC programs and the IGSCC programs. But the ASME
Section 11 required inspections, I think it's safe to say, we feel has
very little impact on the safety of the plant.
DR. APOSTOLAKIS: But you are also saying that this thing
does not have a significant impact, not just -- I want to make that
clear, in my mind. Not just the current Section 11. But even if you do
this methodology, which is more sophisticated, includes additional
failure modes, it's hard to see an impact.
MR. MITMAN: That's correct. Pat, you wanted to add
something?
MR. O'REGAN: Pat O'Regan, from EPRI. I just want to
emphasize what Jeff said. This methodology takes credit for and
integrates the augmented inspection programs. As Syed mentioned, IGSCC
and FAC do actually have a substantial safety impact and we are taking
credit for that.
So the delta you're seeing is actually on the Section 11
portion, not crediting the augmented programs.
MR. MITMAN: And Carl?
MR. FLEMING: George, with regard to the insights from
service experience that back up this conclusion about the benefit of
inspection, the underlying reason for that statement or that conclusion
is that when we look at service experience, we find that we find piping,
some small number of pipe failures and ruptures due to two general
classes of failure mechanisms.
The degradation mechanisms, some of which are actually
amenable to inspection, and also we have loading conditions, like water
hammer, vibration fatigue, over-pressurization, frozen pipes, things
like that. And if you look at the whole piping service experience, only
a fraction of those failure mechanisms provide you enough warning time
that a ten-year interval inspection process is going to give you an
opportunity to prevent the failure.
So that's one of the reasons for that conclusion. A second
reason --
DR. APOSTOLAKIS: Ten years is too long, you're saying?
MR. O'REGAN: No. Some mechanisms don't give you warning
times such that if you did an inspection today, you could prevent a
failure tomorrow. Then another basis for this insight is that a large
fraction of the Class I pipe and Class II and III pipe out there isn't
being subject to inspection. The inspection programs that we do have
from Section 11 are only looking at a small fraction, a small sample of
the existing welds.
So when we go out and look at the service experience, you
find the vast majority of the pipe that produces the service experience
has never been inspected for ASME Section 11 purposes, because the
percentages are 25 percent for Class I, 7.5 percent for Class II, and so
forth.
So these are some of the underlying reasons to support that
conclusion.
DR. APOSTOLAKIS: So just to close this. In your opinion,
is this a good idea or not?
MS. DIMITRIJEVIC: Is it a good idea to do these?
DR. APOSTOLAKIS: To inspect. Not the EPRI approach. I
know this is a good idea.
MS. DIMITRIJEVIC: They don't inspect at all in the Section
11.
DR. APOSTOLAKIS: What?
MS. DIMITRIJEVIC: Is your question, is it would they be
able to inspect at all?
DR. APOSTOLAKIS: Yes.
MS. DIMITRIJEVIC: Well, we have a different opinion. My
opinion is no, but basically the people who -- because I am a PRA
person. The people who are actually engineers and who work on
inspection, they think it's a good idea to take a look at what is going
on.
DR. APOSTOLAKIS: Now, even for a PRA person, though, maybe
your conclusion is based on the fact that you looked at core damage
frequency and large early release frequency. I mean, if one has other
objectives, like I don't want to see any pipe breaks, that's my
objective, then perhaps it would be a different conclusion, because we
see that by the way the new oversight program, that the objectives now
are spread all over the cornerstones.
Would that change your conclusion?
MS. DIMITRIJEVIC: No.
DR. APOSTOLAKIS: Still it would not.
MS. DIMITRIJEVIC: No, because what Carl just mentioned, we
don't claim the risk from pipe breaks is equal to zero or small. What
we are claiming what inspection does, that is negligible. And where
you're going to see the breaks, like vibration and everything,
inspection doesn't do a thing.
MR. MITMAN: Pat, did you want to add something here?
MR. O'REGAN: Yes, just a point of clarification. Pat
O'Regan, from EPRI. When we're talking inspections here, at least the
discussion, it was just focusing on volumetric examinations. We are
still doing and still recommending doing leak testing and what service
experience has showed us is that's where we find most of our leaks, not
from the volumetric exams, but the leak testing.
And even on a low risk location, that's still recommended to
be done.
DR. APOSTOLAKIS: So if we were completely rational, we
would keep doing those inspections, but we would drop this other stuff.
MR. MITMAN: I think rational, you'd probably want to go
back and, at the very beginning of your design process, beef up your
leak detection capability.
DR. APOSTOLAKIS: Okay.
DR. SHACK: I guess I'm not convinced that that would be
true if you include the augmented inspections; that is, flow assisted
corrosion and stress --
MS. DIMITRIJEVIC: No, we don't change anything.
DR. SHACK: You're from a PWR, where maybe, in your primary
system, that probably is true. That's a rather broad conclusion.
MR. MITMAN: You're absolutely right. You want to continue
to do the augmented programs. It's very clear with the FAC program --
DR. SHACK: The augmented programs are, in many ways, much
like this; that is, you're looking where you know you have a problem.
MR. MITMAN: Exactly.
DR. SHACK: That's why it's augmented.
MR. MITMAN: And that's why this methodology blends very
nicely with the currently existing augmenting programs, because of the
similarities in the approach, where you're looking where you expect to
find problems.
DR. SHACK: Without some random selection.
MR. MITMAN: Right.
MR. RICCARDELLA: Jeff, let me make a point on that.
Historically, what happened, and I think I said this like two years ago
in this same group, is we had these ASME Section 11 requirements to do
25 percent of Class I, ten percent of Class II, which we came up with
those 20 years ago when we had very little operating experience.
So as we went through the years and did that, those things
didn't find much, but we did find problems and where we found problems,
we implemented augmented programs.
But what happened was the 25 percent type stuff never went
away. So we were inspecting more, but we're doing the augmented, plus
we're doing this additional 25 percent.
The attempt here is to integrate those into a single
rational program that looks at the areas where we expect problems and
doesn't look at the areas where we don't expect problems.
MR. SULLIVAN: This is Ted Sullivan. I wonder if I could
add a couple of points. One of the reasons why I think traditionally
in-service inspection has not found problems is because the inspection
methods were not qualified until after a problem revealed itself.
The Appendix 8 approaches, which we plan to adopt in the
next revision of 50.55(a), should go a long way in resolving that.
Another brief comment having to do with if we were
completely rational. I think being completely rational, I think we want
to keep in mind defense-in-depth and that's part of the reason why the
staff really wouldn't agree with a position that we should just look at
this purely from a risk perspective and maybe only focus on the areas of
augmented inspection.
One final point. I'm not sure that this came out explicitly
in the presentations, I guess, last week to the ACRS on license renewal,
but to some extent, license renewal is taking credit for Section 11 in
the sense that there is a potential for degradation mechanisms to occur
over the long haul and the inspection methods are supposed to be geared
to using appropriately qualified techniques to be able to detect those
degradation mechanisms should they arise. That's another reason why I
don't think we should take a view too strongly that we should just look
at this from a risk perspective and possibly just rely on the numbers to
say we don't need in-service inspection.
DR. POWERS: Could I understand better why you want to
appeal the defense-in-depth here? Why isn't this just completely and
adequately resolved on a probabilistic basis?
MR. SULLIVAN: I guess there might be others that might care
to answer from the staff, but I would say I don't think that we want to
see failures occurring in piping just because the risk numbers say that
we can handle those failures.
DR. POWERS: Thou shalt not have pipe failures.
MR. SULLIVAN: I think that's the whole defense-in-depth
approach, which may sound circular.
DR. SHACK: The general design criteria call for the
integrity of the reactor coolant system.
DR. POWERS: Yes, but it does not say thou shalt never have
a pipe failure.
DR. SHACK: It's embedded in the whole regulatory system.
MR. SULLIVAN: There are places in the GDC that say
extremely low probability.
DR. POWERS: I don't know, ten-to-the-minus-four,
ten-to-the-minus-five is certainly what I would call extremely low.
DR. APOSTOLAKIS: But, also, let's make it clear that their
conclusion is not based on the numbers alone. I mean, it's the whole
report and analysis that supports all that and the judgments and so on.
It's not that they got the number of ten-to-the-minus-five and say, my
god, you know, this is insignificant. It's the whole process that has
led --
DR. POWERS: I will grant that. What I want to understand
is why -- I mean, very specific here. We say we should look at and
think about defense-in-depth, a very important concept in reactor
safety. Yet, this seems to be a topic that's susceptible to
probabilistic analysis and I'm trying to understand why.
MR. DINSMORE: This is Steve Dinsmore, from the staff. I
guess I have to review a lot of this probabilistic analysis that come in
regarding this stuff and the numbers are actually quite uncertain and
one of the problems is when they say from experience data, they haven't
seen much, there isn't that much experience to get
ten-to-the-minus-seven, ten-to-the-minus-eight, statistical numbers from
the experience data. So they have to do some type of interpretations
and Bayesian updates and engineering judgments to get the numbers which
they are using to support this process.
And even though you could say that the numbers indicate that
if we stopped inspecting, there would be no great increase in CDF or
LERF, the numbers that they're using, again, there is a lot of judgment
in those numbers and there is not enough data to support them really at
a statistical pace.
DR. APOSTOLAKIS: There are two things that come to mind
from this comment. First of all, I think if you want to defend
defense-in-depth in this context, you have to tell us where the big
uncertainties are that you just mentioned that perhaps could invalidate
this conclusion.
But second, I will come back to Carl's comment, that for
most of these failures, you don't have enough warning time to catch them
by inspection, which doesn't sound like a PRA argument, to me.
That's really the physics of the problem. So I inspect just
to feel better. That's really what is going on. In the name of
defense-in-depth.
MR. ALI: Syed Ali, from the staff. Carl, correct me if I'm
wrong, but I think the kind of mechanism that he was referring to that
do not give you warning are loading type mechanisms, such as water
hammer or fatigue. But the mechanisms which are time-related,
degradation type mechanisms, they do give you time and augmented, like
IGSCC, erosion/corrosion.
DR. APOSTOLAKIS: But we're not referring to all the
augmented programs. Just this one. We're not saying that we should
drop other programs, right?
MR. MITMAN: First of all, I want to make something clear.
EPRI has not recommended that we drop all Section 11 inspections.
DR. APOSTOLAKIS: That's fine. Other people might.
MR. MITMAN: You asked an opinion --
MR. BARTON: We'll deal with them when they come before us.
MR. MITMAN: You asked an opinion --
DR. APOSTOLAKIS: Let me tell you what's going on, because
probably you think this is a discussion that -- we are facing a major
problem now as to what the role of defense-in-depth should be in a
risk-informed regulatory system. That's why you're getting all this.
That makes more sense now to you probably.
MR. DINSMORE: Could I just quickly respond to something?
When you asked me if the uncertainty doesn't or why we can't accept the
results because of uncertainty, I would say we can accept the results of
what EPRI is doing in spite of the uncertainty. It's because of the
uncertainty that we are -- that we can accept what they're trying to do
and not say, well, you have to do even more or even less.
DR. APOSTOLAKIS: So what you're saying essentially is that
their numerical assessment of the impact of this, which led them to the
conclusion that it doesn't matter, is really not correct.
MR. DINSMORE: Probably not supportable.
DR. SEALE: They're not sure about that.
MR. DINSMORE: Not supportable from the statistical data.
DR. APOSTOLAKIS: But anyway, I think we've covered this
enough. At least for me.
DR. POWERS: I still haven't gotten an answer. I may never
get an answer.
DR. APOSTOLAKIS: That's my bet.
MR. MITMAN: I've put up a slide that's not in your package
and it looks at each of the damage mechanisms and --
DR. APOSTOLAKIS: It's in the report, though.
MR. MITMAN: It's in the report, if I remember correctly.
DR. APOSTOLAKIS: Yes.
MR. MITMAN: But it's not in the presentation. It shows
each of the damage mechanisms and our calculated rupture frequency per
the damage mechanisms. There are two categories of those damage
mechanisms, the dark ones and the light ones. The light ones are those
that we feel are not amenable to inspection, things like they include
vibration, water hammer, unknown and other causes.
DR. WALLIS: Just for clarification. Your rupture frequency
is based on how many reactors?
MR. MITMAN: It's based on over 2,000 operating years of
reactor.
DR. WALLIS: This is the total rupture frequency of all the
reactor population.
MR. MITMAN: In the United States. Yes.
DR. WALLIS: Otherwise, it looks pretty lousy. If you
multiply it by a hundred, it gets scary.
MR. MITMAN: Right.
MR. FLEMING: But these are on a per reactor year basis.
These are on a per reactor year basis.
DR. WALLIS: Per reactor year?
MR. FLEMING: Yes.
DR. WALLIS: No, it's not. It's per a hundred reactor
years.
DR. APOSTOLAKIS: Anywhere in the population.
DR. WALLIS: Anywhere in the population. So I don't
multiply by a hundred.
DR. APOSTOLAKIS: No, you shouldn't. That's correct. This
is per calendar year anywhere in the United States.
MR. FLEMING: No. This is per reactor year.
DR. WALLIS: So I multiply it by a hundred.
MR. FLEMING: This is for each reactor, on the average for
each reactor, but it covers the entire plant. It covers all the piping
systems in the entire plant. Only a small portion of this is in the
safety-related systems.
DR. APOSTOLAKIS: You're right, because you had 1,511 total
number.
MR. FLEMING: That's right.
DR. APOSTOLAKIS: Now it makes sense.
DR. WALLIS: So this is per reactor year.
MR. FLEMING: These are per reactor year, yes. So you do
multiply by a hundred.
DR. WALLIS: So I do multiply.
MR. FLEMING: Yes.
DR. WALLIS: Thank you.
DR. APOSTOLAKIS: But this is all pipes.
MS. DIMITRIJEVIC: All pipes, all sizes.
DR. APOSTOLAKIS: By the way, this number, which is in
several places in the report, ultimately is not used. Is that correct?
The ten-to-the-minus-two, I was looking very hard to find a place where
you actually use it. It's just an indication, but you don't really use
it.
MR. MITMAN: It's part of the design basis of the
degradation categorization and it is available to us if we need it to do
the risk impact analysis.
DR. APOSTOLAKIS: Well, you can't really use it, though,
because this is anywhere in the plant. I mean, if you go to your pages
3-1 and 3-2, then you have to specialize it.
MR. MITMAN: You're right.
MR. FLEMING: It requires further analysis.
DR. APOSTOLAKIS: Further analysis, right. So right now
it's not used. In your calculations, ultimately, the
ten-to-the-minus-two from there is not used and I think that should be
made clear in the report.
MR. FLEMING: At this level, they are not used.
DR. APOSTOLAKIS: It is not.
MR. FLEMING: This is just a presentation of general
experience.
DR. APOSTOLAKIS: I understand. It took me a while to
figure it out. It's not stated in the report that it's not used.
MR. FLEMING: But I think it's worthwhile -- it's just an
intermediate step along the way towards breaking the data down so that
we could confirm that these high, medium and low categories that were
developed on the deterministic degradation mechanism basis do correlate
to order of magnitude estimates of pipe rupture frequency, and that's --
DR. APOSTOLAKIS: I think in your viewgraphs you have the
equations. So maybe you can go to them right now. Equations 3-1 and
3-2, on page 3-8. You didn't expect that, Jeff?
MR. MITMAN: We're ready.
DR. APOSTOLAKIS: Okay. It says pipe break frequency, is
that what it is, PBF?
MR. FLEMING: Yes.
DR. APOSTOLAKIS: This is page 3-8. This is what you would
-- you would need this number, which is really now segment-specific, to
do the calculations.
MR. FLEMING: Yes.
DR. APOSTOLAKIS: Do you actually get a number like that?
In principal, I know you can get something.
MR. FLEMING: Yes.
CHAIRMAN JACKSON: You do?
MR. FLEMING: We had developed a number, segment-specific.
DR. APOSTOLAKIS: And it's discussed in the report how you
do that?
MR. MITMAN: It's not discussed in this report. It's
discussed in a supporting document.
DR. APOSTOLAKIS: Can I have a copy of the supporting
document?
MR. MITMAN: The staff already has a copy of it.
DR. APOSTOLAKIS: Okay. We might have it already.
MR. MARKLEY: Which document are you talking about, Jeff?
MR. MITMAN: TR111880, which is in the references. It's
currently in a final draft, but the staff does have copies of that.
DR. APOSTOLAKIS: So then what you do is you take the
ten-to-the-minus-two and you can see that the number of systems and you
judge subjectively then, like we specialize the fire frequencies for
critical locations. You start with a building and slowly go down to the
location.
MR. FLEMING: Yes. And very briefly, what we do is we break
the whole population of piping failure statistics up into PWR and BWR
vendor groups. We break the system populations into several system
sizes and then we look at all the different failure mechanisms. So we
can look at it on a conditional segment base type of analysis.
DR. APOSTOLAKIS: So this is one of the major uncertainties
that Steve Dinsmore probably referred to. Say yes, Steve.
MR. DINSMORE: Yes.
MR. FLEMING: And by the way, I wanted to respond to what
Steve said earlier about the uncertainties, because I agree in his
comment to some extent, but I also wanted to clarify that. We have done
a detailed Bayesian uncertainty analysis of the attempts to make pipe
failure rates and rupture frequencies from the service data and when you
look at -- if you look at these results on an order of magnitude basis,
on a logarithmic basis, you have very, very broad distributions that
characterize large uncertainties, and it's a true statement, what Steve
said.
But if you try to take that and then develop a conclusion
about what do those uncertainties say about the impact on risk, it's
still possible to develop very robust conclusions that in spite of the
large uncertainty, it's still a very, very small fraction of the risk.
But there is one other -- but I think coming around to
support what I think the -- and the concern about defense-in-depth is
that these PRA calculations that we can do today based on looking at
historical data, I think, are good for making current estimates of what
we think the rupture frequencies are today, but we'd be on very shaky
ground if we tried to project these 20, 30 or 40 years out into the
future, and I think therein would lie the difficulty in trying to make
conclusions about life extension without having some kind of way to keep
monitoring possible trends in performance.
Because we can't see the future in yesterday's data.
DR. APOSTOLAKIS: Now, in the report, you say something
that's not quite the same as what Carl said a few minutes ago. Right
under equations 3.1 and 3.2, you say based on the expressions, they're
using a conservative estimate of the total PBF frequency of
ten-to-the-minus-two, where it calculates the CCDP and so on.
So that's why I raise the issue. When I read this, I
thought, my god, they're using something that is a frequency of type of
break anywhere to make judgments, and so the report perhaps is not
written very well on that point.
MR. FLEMING: The sections you're looking at right now
explain the logic in deriving the original matrix to start with and then
back in Section 2, with the benefit of more detailed analysis of the
service data, we took another look at that question and confirmed that
the order of magnitude assessments were --
DR. APOSTOLAKIS: That's not here.
MR. FLEMING: If you get to Section 3-7, for example, you
finally -- if a pipe is classified as having a medium rupture potential,
it's one-times-ten-to-the-minus-four per year.
DR. APOSTOLAKIS: Right.
DR. SHACK: They sort of assign conservative pipe break
frequencies based on essentially degradation mechanisms. If it's got a
high degradation mechanism, medium or low.
MR. FLEMING: But in Section 2 of the report, this other
more detailed look at applying the service data to look at these
calculations is presented and it confirms the order of magnitude
assumptions that were originally made.
DR. APOSTOLAKIS: I'm talking about the specialization.
Section 2 is very general. It doesn't say how you go down the system.
Section 2 is an analysis of the existing failures.
MR. FLEMING: Right.
DR. APOSTOLAKIS: I would have covered that. And there is
equation 2-1 that bothers me, too, on page 2-8. The probability of
rupture given failure. I don't know what that means. Page 2-8.
MR. FLEMING: That was a simple model that we used to
analyze the service data for those failure mechanisms that have a strong
leak-before-break characteristic. We define failure as the whole
package of failure modes, including small leaks and ruptures.
So the model basically says we have a rupture frequency
which is equal to the failure frequency times the conditional
probability that it's a large failure.
DR. APOSTOLAKIS: So that's what is missing from the report,
though. I didn't see that. So it wasn't clear to me what the
difference between the rupture and the failure.
MR. FLEMING: The way we defined it --
DR. APOSTOLAKIS: A leak is a failure?
MR. FLEMING: A failure is any fluid going through the
boundary, including a leak. A rupture we defined at 50 gpm and larger
flow areas.
DR. APOSTOLAKIS: That would have saved me a lot of time.
MR. FLEMING: Sorry.
DR. APOSTOLAKIS: Back to your presentation.
MR. MITMAN: Next, the next slide is on the pipe service
experience, which we've already talked a little bit about. There is
over 2,000 reactor operating years of experience --
DR. WALLIS: You better put in the word reactor there, too.
MR. MITMAN: Fair enough. In that database, there is 1,145
events, 1,145 failures. Here, failures are defined as either leaks or
ruptures. The vast majority, 1,076 of those were leaks. Most of those
were less than five gpm and most are due to corrosion mechanisms.
Out of the total database, there are 69 events that were
categorized as ruptures. The failure mechanisms are well understood and
the conditions necessary to produce the failures are generally known.
DR. APOSTOLAKIS: Now, where are the numbers, on another
table?
MR. MITMAN: Which?
DR. APOSTOLAKIS: Table 2-2 and 2-1.
MR. FLEMING: They're consistent.
DR. APOSTOLAKIS: You said 1,100-something total failures
and I don't see that here. I see 1,500.
MR. MITMAN: If I remember correctly --
DR. APOSTOLAKIS: Oh, 1,145. I'm sorry. In the database.
Okay. You have to look elsewhere.
MR. FLEMING: It's consistent. It's confusingly presented,
but it's consistent.
DR. APOSTOLAKIS: Speaking of that, what's the difference
between the degradation mechanism and severe loading?
MR. FLEMING: Degradation mechanisms are degradation
mechanisms like thermal fatigue, stress corrosion cracking that occur
over long periods of time due to physical degradation mechanisms, where
severe loading conditions are the imposition of loads in excess of the
capacity of the pipe due to water hammer, impact, external impact on the
pipe, frozen pipes, over-pressurization of the pipe beyond its design
capacity and things like that.
DR. APOSTOLAKIS: So what you're saying is that in the
severe mechanism, there was no aging mechanism acting. It's just that
you had the load that exceeded the design capacity.
MR. FLEMING: In the vast majority of cases. Now, in
principal, you can have a failure due to a combination of degradation.
DR. APOSTOLAKIS: That was my next question.
MR. FLEMING: But in the analysis of the service data, this
was not evident.
DR. APOSTOLAKIS: So when you had the degradation mechanism,
you didn't see any failures because there was degradation and then there
was a load.
MR. FLEMING: We didn't see any evidence of that, although
in principal, we know it's possible. We didn't see any evidence of
that. The severe loading condition failures were, according to the
reports that we analyzed, the loads were sufficient to cause the
failure.
DR. APOSTOLAKIS: So let's look at the rupture. You say
erosion/corrosion or flow accelerated corrosion, there were 18 ruptures,
on table 2-1.
MR. FLEMING: Right, in large pipes.
DR. APOSTOLAKIS: So you're saying that these were due to
the steady-state pressure in the pipe and you simply had deterioration.
MR. FLEMING: Yes.
DR. APOSTOLAKIS: Wow.
MR. FLEMING: Or if there was any variation --
DR. SHACK: EC will do that to you.
MR. FLEMING: Or if there was any variation to the loading,
it was not of any -- it wasn't of any significance that was noted in the
report. There might have been some small pressure transient.
MR. MITMAN: Keep in mind this is Class I, II and III
piping, not just Class I.
MR. FLEMING: It's the whole plant.
DR. BONACA: Do you make an analysis of the difference
between the systems that normally run and systems that don't run? The
reason why that's an important question is that most safety systems are
standby. They don't run.
MR. MITMAN: Well, some of the damage mechanisms behave
differently whether the system is running or not. In our analysis, we
go ahead and we look at operating conditions of the plant or of the
system and of the portion of the system, and that helps us decide
whether that segment is subject to the damage mechanism.
DR. SEALE: Could I ask a somewhat different question? My
impression is that one of the things that gets us off the hook on a lot
of our concerns is the validity of the idea of leak-before-break. Is
that equally valid for what I will call degradation versus load-induced
failures?
MR. MITMAN: It's true for some of the damage mechanisms.
IGSCC, it is. It's not true for FAC. So it depends upon the damage
mechanism, whether leak-before-break is valid.
DR. SEALE: But in general, you can't make a generalization
that would say that load-induced failures are less likely to exhibit
leak-before-break.
MR. FLEMING: That's correct.
MR. RICCARDELLA: I think that's a true statement.
DR. SEALE: So the ones you're not -- that inspection
doesn't help you with are the ones that are most likely to be severe
immediately on occurrence.
MR. FLEMING: That's right.
DR. SEALE: Okay.
MR. FLEMING: And looking at your question from the service
data standpoint is that we can look at this second parameter in that one
equation, given the failure, what's the conditional probability that
it's a rupture given a failure. And looking at that parameter for the
degradation mechanisms other than FAC, that number tends to be very low,
on the order of a few percent, but for flow accelerated corrosion and
the severe loading conditions, it tends to be much higher, water hammer
events, over pressure events, which stands to reason, I think.
DR. WALLIS: I'm wondering if it's true that if inspection
doesn't help you, I'm thinking of the fire-line break in Washington,
where they had something like 17 water hammers they didn't pay any
attention to and then the 18th broke the pipe, and probably this is
because it's a loosened thing. The other water hammers have loosened
things up. So paying attention to the history and inspecting would
perhaps have prevented the failure due to sudden loading.
MR. MITMAN: I don't think we're trying to say that you
should ignore what's going on in the system, but doing an ultrasonic
inspection or volumetric inspection of a weld probably isn't going to
keep you out of trouble with a water hammer.
DR. WALLIS: Something like a water hammer, minor water
hammers have happened before in that component and no one has paid much
attention maybe and then there is a big one.
MR. MITMAN: And that's one of the things we will discuss a
little it later, is that we do take into consideration water hammer in
our categorization of the degradation mechanisms.
DR. BONACA: Just to complete my thought. I had a question
before. So you feel that that statement, failure mechanism, well
understood, it's still applicable also for those piping by systems that
don't run.
MR. MITMAN: Absolutely.
DR. BONACA: That's fully understood.
MR. MITMAN: Yes.
DR. BONACA: And for those, also, inspections doesn't have
preferential value.
MR. MITMAN: That is correct. In the database, there are 69
rupture events where rupture is defined as greater than 50 gpm. Again,
the failure mechanisms are understood. Some of the mechanisms are not
amenable to inspection. There is only one event in the RCS and several
events in steam water and feed water systems.
EPRI has a program to periodically update the database, keep
an eye on what's going on in the industry, and make sure that the
methodology doesn't need to be revised.
The next slide is an example of the deterministic criteria
that we used to do the damage mechanism analysis. In this particular
example, we're looking at thermal --
DR. APOSTOLAKIS: Can I interrupt? Because I have to go
somewhere at 10:00 and I have a couple of questions that jump ahead and
I wanted to ask them.
You didn't really expect that we would let you finish your
presentation the way you have prepared it.
Would you go to your slide 19? Consequence ranking
criteria. Now, the conditional core damage probability, this is
calculated as shown in one of the equations here as the new CDF,
assuming the system is down, minus the baseline, times the exposure of
time, and the exposure of time can be anywhere from a year to maybe a
few days.
Now, as far as I know, the NRC does not have and nor does
the industry criteria as to what's high or low with respect to the
conditional core damage probability, except for temporary outages, where
they give a ten-to-the-minus-seven number.
So where did the ten-to-the-minus-four come from? The
ten-to-the-minus-four is used for the core damage frequency, not the
core damage probability over a period of three months.
MS. DIMITRIJEVIC: This was this equation three you just
asked us about, CDF.
DR. APOSTOLAKIS: Yes.
MS. DIMITRIJEVIC: Where as that equation?
DR. APOSTOLAKIS: There were two equations on page 3-8.
MS. DIMITRIJEVIC: Yes.
DR. APOSTOLAKIS: But it doesn't --
MS. DIMITRIJEVIC: It tells you that that was very
conservative, assuming the --
DR. APOSTOLAKIS: But I don't know whether it's
conservative, is it?
MS. DIMITRIJEVIC: If you look in the explanation after,
because if you assume that we are going to look in every location and
segment, if we assume that we're going to have a thousand segments at
the top of a plant, it's ten-to-the-minus-two, which we think is a
conservative estimate. Then ten-to-the-minus-two for pipe failure
frequency, times ten-to-the-minus-four, will give you
ten-to-the-minus-six CDF, which corresponds to that failure for CDF.
MR. FLEMING: So it was derived from a CDF limit and working
backwards to come up with a conservative estimate of what that would
mean.
DR. APOSTOLAKIS: So if I don't do anything for a year, then
you say the NRC's goal of ten-to-the-minus-four per year times one year
becomes a probability.
MR. FLEMING: No, no, no, no, no.
MS. DIMITRIJEVIC: The frequency CCDP here is conditional
given pipe failure.
DR. APOSTOLAKIS: I understand that. That's why I'm --
MS. DIMITRIJEVIC: So we take the five FAC yearly frequency
and we say the worst we can have is five yearly frequency of
ten-to-the-minus-two if every segment is in the high risk area.
DR. APOSTOLAKIS: Okay.
MS. DIMITRIJEVIC: And then ten-to-the-minus-two per year
times ten-to-the-minus-four is ten-to-the-minus-six per year.
DR. APOSTOLAKIS: But where did the ten-to-the-minus-four
come from? That's my question.
MS. DIMITRIJEVIC: Well, we selected that so that we get
that ten-to-the-minus-six per year.
DR. APOSTOLAKIS: You selected it.
DR. SHACK: Took ten-to-the-minus-six and divided by
ten-to-the-minus-two.
MS. DIMITRIJEVIC: That's it. We took the
ten-to-the-minus-six and divided it by ten --
DR. APOSTOLAKIS: And they did it correctly. Where did the
ten-to-the-minus-six come from?
MS. DIMITRIJEVIC: That came from the NRC criteria of
ten-to-the-minus-six not allowing any changes and things like this, Reg
Guide 1.174.
MR. FLEMING: Which we anticipated before it was published.
MS. DIMITRIJEVIC: It's very conservative because that means
they actually accept changes, but we still have a medium region.
DR. APOSTOLAKIS: So the delta CDF -- actually, it
ten-to-the-minus-six is negligible. Ten-to-the-minus-five was even
allowed.
MS. DIMITRIJEVIC: So that's why I say we are very
conservative, because of uncertainty, we said, okay, everything which is
ten-to-the-minus-six we're going to look at, that's our basis. And we
say even in ten-to-the-minus-six, we're still going to take a little
look.
DR. APOSTOLAKIS: The report could have been written a much
better way. I really tried to understand it and, boy, every sentence is
loaded with --
MS. DIMITRIJEVIC: Meaning.
DR. APOSTOLAKIS: With meaning, yes. I mean, Carl had to
explain a few things, you had to explain a few things. Anyway, that
makes sense. What you just said makes sense. But it's not easy to
understand that from this.
DR. WALLIS: Are you suggesting a report in which the
sentences were loaded with less meaning would be better?
DR. APOSTOLAKIS: Yes, because then you would have more of
those and it would be easier. The total sum would be the same.
If I have to spend three-quarters of an hour understanding
each sentence, that's a pretty thick report, that doesn't help. There
was a whole rationale that Vesna just gave us that is not evident from
this paragraph. That's what I'm saying.
DR. SHACK: Right.
MR. MITMAN: You wanted to ask additional questions?
DR. APOSTOLAKIS: Gee, now you're catching me. Oh, yes. A
general question. You used the word "easy" earlier. Now, I must say
this business of the trains and giving a worth of one-half and all that,
why is that easier from having your PRA, your PC, and saying, you know,
put this down, get the new number.
I mean, we have the software now that does these
calculations very quickly and get conditional core damage frequencies.
And to go through this exercise of deciding the worth of each train and
going through -- in other words, you are redoing part of the PRA. What
is the reason for that?
MS. DIMITRIJEVIC: I will tell you why it was designed. It
was designed so that people who are not PRA analysts can come up with --
DR. APOSTOLAKIS: But they have to do PRA-type analysis,
Vesna, anyway, because they have to look for trains that will save you.
MS. DIMITRIJEVIC: That's true, but they have to -- and they
can be provided with them in the beginning and then they can do the
analysis. But if you really know PRA, which can be done fast, if you
know something --
DR. APOSTOLAKIS: You don't really have to know PRA, you
don't have to be a PRA analyst to use it. You have your PC and you do
your sensitivity calculations. Otherwise, if you know nothing --
MS. DIMITRIJEVIC: Let me give you two reasons to let you
even forgetting that PRA, in my opinion, really don't run them fast yet.
It always takes some time.
But independent of that, let me tell you what's the main
reason. When you run the PRA, you come with a number. It gives you a
number, but it doesn't tell you what it is and why it is.
When you look in this, you know exactly why and what's
happening and it really helps you to understand the heart of this. We
went in the heart of the PRA. So they know that this is -- if they have
this pipe failure, that this is because they are HPSI is going to know
how -- instead of getting the number three times putting
four-times-ten-to-the-minus-four.
We thought they would be more valuable for analysts to
understand why are some failures and the other thing is also we have to
rank the initiating events. So we can really use importance measures
for that.
We thought that it will give more insight and will help
people who are not PRA analysts do this estimate.
DR. APOSTOLAKIS: That's the right word. But, Vesna, I
think you have a valid point there, that you shouldn't really get a
number alone. But it seems to me you can easily get those insights from
a good PRA, because a good PRA doesn't give you numbers only.
MS. DIMITRIJEVIC: You can look at sequences.
DR. APOSTOLAKIS: It gives you the sequences, the minimal
cut sets and so on.
MS. DIMITRIJEVIC: Yes.
DR. APOSTOLAKIS: And maybe you can develop a small software
package to compliment what you already have to get these insights. But
this reluctance on the part of the industry to say PRA is useful and we
will do things using the PRA is a mystery to me. It's mystifying.
MS. DIMITRIJEVIC: The one thing which I have to say is the
misconception that this method doesn't use PRA, it uses it very well.
DR. APOSTOLAKIS: Of course it does.
MS. DIMITRIJEVIC: And uses it perfectly, in my opinion,
because it's break is what actually PRA is all about and shows exactly.
So it shows the safety function, it shows you backup trains, it shows
you the sequences. So it's basically really uses PRA.
It doesn't use it as being -- it gives you the importance
measures and things like that, but that is what PRA is all about. So,
therefore, PRA is very -- and I did a lot of analysis. You can believe
me that this really makes it very easy and clean-cut. You look in the
PRA, you see there the success criteria, you put the safety functions
diagrams, you look in there, the ability of the trains and their
initiating events and there you are.
Then you have ten pages and you can just run through the
events very nicely.
DR. APOSTOLAKIS: Who did that? Did a guy with no
experience with a PRA actually figure out what are the trains that are
available and gave the weights?
MS. DIMITRIJEVIC: No. That was -- that's done with the PRA
specialist. But once when you have them, everybody can do the analysis.
DR. APOSTOLAKIS: And this is an analysis you do only once,
right?
MS. DIMITRIJEVIC: Yes.
DR. APOSTOLAKIS: It could be done off-line by somebody who
knows something about the PRA. It's not that you are asking your
average --
MS. DIMITRIJEVIC: No.
DR. APOSTOLAKIS: -- doing this every month.
MS. DIMITRIJEVIC: It's always done with the people who know
PRA.
DR. APOSTOLAKIS: I am really mystified by this reluctance
to say we now have the PRA, here is what you can do with it, here is
what you need for this kind of analysis, here is a way to get it.
Instead of doing that, we're saying we'll develop these mysterious
tables, that give a wroth of .5. I don't know how to do that.
MS. DIMITRIJEVIC: Well, because we are working in actually
in the intervals, not with the actual number. We do have a section on
--
DR. APOSTOLAKIS: And I don't even know what the train is
sometimes. You're asking a poor guy to make all these judgments when
the PRA has already provided you with answers. I'm not saying that what
you did was incorrect, but I'm just mystified by this reluctance on the
part of the industry to say here is a tool that's useful, let's use it,
and not try to dance around it all the time.
And, my god, if we ever demand a PRA, it's a major crime.
MS. DIMITRIJEVIC: We added it --
DR. APOSTOLAKIS: I've made my case.
MS. DIMITRIJEVIC: But we did it add it in our report
section 3.36, which tells you really how PRA --
DR. APOSTOLAKIS: Page? I always give you the page.
MS. DIMITRIJEVIC: Page 3.32.
DR. APOSTOLAKIS: 3.32.
MS. DIMITRIJEVIC: Yes.
MR. FLEMING: I want to just augment something, if I may, on
what Vesna just said. I think there may be a little bit of
misunderstanding here.
It is the role of the PSA analyst to figure out these train
relationships and that is only for a qualified PRA analyst to do. But
the idea here was to give the piping engineer a tool that he could put
segments on the risk matrix without himself doing the PRA calculations
to put them on the matrix.
And since it didn't require him to come up with a numerical
estimate, just to figure out which of the bins to put it in, which are
four decades wide, there was a question of whether you want to use a
surgical instrument or a screwdriver to do the appropriate tests.
DR. APOSTOLAKIS: Well, all right.
DR. SEALE: Can I ask a related question?
DR. APOSTOLAKIS: Am I going to say no? Go ahead.
DR. SEALE: You have here an application of a PRA and it's
clear in coming up with your simplified algorithms that consciously or
unconsciously, you're responding to the fact that not all PRAs are
equal. There is another effort going on, quite separate from this, that
the Commission has a commitment to, and that is the development of
criteria for what constitutes an adequate PRA.
I'm going to ask the staff. Do you guys who find these
kinds of applications for PRAs talk to those guys who are worried about
what constitutes an adequate PRA?
MR. DINSMORE: This is Steve Dinsmore.
DR. SEALE: You've got your hat in both rings. But you see
the question. I mean, clearly, there are other applications like this
where people are using PRAs and there is not necessarily that nexus made
to this other effort, which is supposedly graduating the level of the
PRA, the product, to what we would hope would be the workable all things
for all people version. It's just a caution.
MR. DINSMORE: Okay.
DR. APOSTOLAKIS: Mr. Fleming, by the way, is intimately
involved with that effort.
DR. SEALE: Okay, fine. Fine.
DR. APOSTOLAKIS: But it's a more general comment that I
wanted to make. Every time we see something, for heavens sake, let's
not ask them to use a PRA. So we go out of our way to produce tables
and things, like the five methodology, again, PRA, my god, no tables.
People are not stupid and finally --
DR. SEALE: You only get there, though, if you make the
effort.
MR. MITMAN: Another thing to keep in mind is this
methodology was started back in '92-'93 and the capabilities of the
machines and the capabilities of the codes and the PRAs isn't what it is
today. And if we started today, we might do it differently.
DR. APOSTOLAKIS: Or you wouldn't do it at all, based on
your conclusions. If somebody took defense-in-depth away, you wouldn't
do it at all.
MR. MITMAN: We would discuss it with the appropriate
industry --
DR. APOSTOLAKIS: I understand that, yes.
MR. MITMAN: -- bodies and see what we would come up with.
As we were saying at slide 14. Slide 14 shows some of the
damage mechanism attributes that we use to determine whether a weld
segment is susceptible to those damage mechanisms.
What we're looking at here is thermal fatigue and some of
those damage mechanisms that are there. Deterministic rules that we
apply to determine whether the segments are susceptible or not.
DR. WALLIS: I was looking at the bottom there. You don't
often inject cold fluid in the hot pipes, so in infrequent even which
will lead to fatigue, but there are sometimes situations where cold is
somewhere close to hot and there are circulation patterns set up which
are unstable and a piece of piping is bathed in hot, cold, hot, cold,
over a long period of time, and that's a classical thermal fatigue
mechanisms. I don't see it here.
MR. RICCARDELLA: That's what we call tasks.
DR. WALLIS: That's what you call tasks?
MR. RICCARDELLA: Yes. Tasks is thermal --
DR. WALLIS: Maybe I didn't -- okay.
MR. RICCARDELLA: -- and stratification --
DR. WALLIS: It's rather hard to figure out, as I remember,
and sometimes it happens, sometimes it doesn't.
MR. RICCARDELLA: But we've looked -- EPRI has done a very,
very large study on tasks. They had a task force to put together a
large thick report, and we've gone through that and we've attempted to
come up with some conservative rules that if you have any of these
conditions, we say it's susceptible to thermal fatigue. All of these
are very conservative.
It's not often that a delta T of 200 or 150 is going to
cause you a problem. But if there is even the potential that a system
could get a delta of that much, we say it's potentially thermal fatigue
susceptible.
Now, we could go in with a finer screen, and sometimes we
do. It's no good to prioritize if everything comes out. So if we get
too many locations, then we'll go in with a finer screen and find out
what the actual delta T is.
DR. WALLIS: So this is a case where one could call
understanding of the thermal hydraulics is important to risk assessment.
MR. RICCARDELLA: To selecting in-service inspection
locations.
DR. SHACK: Whether that's important to the risk assessment
is another question.
DR. WALLIS: Well, presumably it is. If you don't -- if
there is some physical mechanism which you completely ignored which can
break a pipe, then it can seem that that's important to the risk and
whether you assess it or not is perhaps up to you as a responsible
professional.
MR. RICCARDELLA: Yes. Well, part of what you're getting at
is the reason for this performance monitoring feedback loop; that if
there is some mechanism that we've just forgotten about or didn't know
about and it occurs in one plant, then it's going to work its way into
our methodology and will be picked up.
MR. MITMAN: The outcome of the damage mechanism assessment
is categorization into three categories, high, medium and low. Where we
end up is to get into high, you have to have flow accelerated corrosion.
Medium is any other damage mechanism and if there are no damage
mechanisms present, then that gets you into low.
Now, there is one caveat with this. It doesn't show on this
slide. It's discussed in the report. That is, there is another way to
get into the high category, which came up in earlier discussions, and
that is if you have another damage mechanism, plus water hammer.
So if you've got some degradation of a pipe due to MIC and
you know that the system is subject to -- is susceptible to water
hammer, that would also put you into the high category.
In practice, what we see happening most of the times is if a
system is susceptible to water hammer, most plants will go out and try
and resolve the question on water hammer, which would drop it back down
into the medium category.
DR. SHACK: I would assume that water hammer would -- if
it's susceptible to water hammer, it's high, degradation or no
degradation mechanism.
MR. MITMAN: It would be high, but you can inspect all you
want with volumetric inspections and you're not going to find water
hammer.
DR. SEALE: Okay. These are for leaks then.
MR. MITMAN: This is leak --
DR. SEALE: For inspection, I beg your pardon.
MR. MITMAN: The whole methodology is to help you decide
where to do your volumetric inspections per Section 11.
DR. SEALE: So in general, that's why load-induced failures
don't show up here.
MR. MITMAN: That's right.
DR. SHACK: We were scheduled for a break at ten and since
we're about to go to the consequence, maybe this is a good time to do
it. Does that seem reasonable?
MR. MITMAN: That sounds reasonable.
DR. SHACK: A 15-minute break then.
[Recess.]
DR. SHACK: I guess we have enough members back, so that we
can resume the meeting.
MR. MITMAN: Okay. We want to start in on the consequence
analysis at this point. The first thing we do is there are four types
of -- four considerations that we have when we go into the consequence
analysis. We're looking at initiating events, events that affect the
mitigating ability of systems and trains, both from a loss of the system
or train or degradation of the system or the train.
We're looking at containment effects, both loss and
degradation of containment, and then we also look at combination events,
something that will affect both a mitigating system and containment or
could be initiating event and affect a standby safety system also.
We've seen this slide already. The consequence ranking is
-- there is a four-tier consequence ranking, high, medium, low, and not
shown here is none. There is -- none is the easiest to deal with.
There are a couple of abandoned in-place piping systems that we've found
here and there that have no consequence whatsoever on the analysis, and
that's why they show up on the matrix.
The high category is conditional core damage probability
greater than 1e-to-the-minus-four and conditional large early release
probability of greater than 1e-to-the-minus-five.
These are severe initiating events or severe loss of
mitigation capability or high risk of containment bypass. Medium
category is conditional core damage probability, greater -- greater than
1e-to-the-minus-six, but less than 1e-to-the-minus-four. It should be
less than or equal to.
Also, conditional large early release probability between
1e-to-the-minus-seven and 1e-to-the-minus-five, and these are moderate
type events.
Then on the low side is conditional core damage probability
less than 1e-to-the-minus-six and conditional large early release
probably less than 1e-to-the-minus-seven.
These are for mild type events.
DR. SHACK: Again, I guess I asked this question before, I
mean, you -- when I look at this guideline for assigning the consequence
category, there is some sort of generic PRA that decides that when I
have one unaffected backup train, that I'm in the
ten-to-the-minus-four/ten-to-the-minus-five category, and it's high.
The guy doesn't actually do that calculation.
MR. MITMAN: Initially, it's generic. The tables were set
up generically, but the expectation is that the plant will recalibrate
those tables with the plant-specific PRA.
DR. SHACK: And they will bend it this way, then.
MR. MITMAN: This is the criteria for bending it and you may
-- if you go to South Texas, with a three-train system, you'll probably
move everything to the --
MS. DIMITRIJEVIC: Medium.
MR. MITMAN: Yes. Everything will drop down to medium
instead of having it in the high category. But, yes, you do that
plant-specific calibration.
DR. SHACK: What it could mean is that for some plants with
one and a half backup trains, you could be in the medium instead of the
high for some very plant-specific reason.
MR. MITMAN: Yes. You could have some susceptibilities or
some weaknesses in the plant design.
MS. DIMITRIJEVIC: You could have a different number of
backup trains and the load would be different.
MR. DINSMORE: This is Steve Dinsmore, from the staff. Our
understanding is that the table won't change, because we're going to be
moving the table. What will change is the number of trains that they
can take credit for.
If they have two HPSI trains, but, again, if it was
ten-to-the-minus-three, in one plant, they can only credit one and a
half trains. In another plant, maybe because it's better designed,
they'd be able to credit it two trains.
DR. SHACK: So the table stays the same.
MS. DIMITRIJEVIC: The same.
DR. SHACK: It's how you credit --
MR. MITMAN: The number of trains.
DR. SHACK: -- the number of trains.
MR. MITMAN: The remaining tasks in the methodology, we'll
go in and do segment risk categorization, selection of inspection
locations, selection of the appropriate inspection techniques. We do a
risk impact assessment. We document and finalize the project, put
together the submittal, and then there is a performance monitoring where
we have a long-term process to monitor the plant and also EPRI will
continue to monitor the industry to make sure that there is no new
mechanism that appears or an increase in the frequency of a degradation
mechanism because of aging effects that we haven't seen yet.
DR. SHACK: Now, one of the things that the WOG ASME thing
does that doesn't seem to come in here is they make an effort to
estimate the leakage, also, as well as the failure, and their goal was
essentially to maintain the leakage rates about what they've observed.
That doesn't seem to be -- that's nothing you're addressing
here.
MR. MITMAN: We are not trying to calculate any leakage
rate. What we essentially see, if you go back and look at the risk
matrix, the medium category tends to be those damage mechanisms, medium
category here tends to be those damage mechanisms that typically leak.
The only way you're going to get into -- or getting into
high, you tend to have a damage mechanism that can fail on your, can
have a large rupture. So that's probably the only place that the
leakage rate figures into the analysis. But we're not trying to --
DR. SHACK: You don't have a target leak rate for --
MR. MITMAN: No.
DR. SHACK: In a general sense, who ends up with more
inspection locations following which process?
MR. MITMAN: I think we end up with --
DR. SHACK: With more.
MR. MITMAN: No. We end up about the same. About the same.
MS. DIMITRIJEVIC: We don't really know.
MR. MITMAN: Well, we've looked a little bit at Surry,
comparing Surry to the work we've done, and I think if you look at
what's done on Surry and what's done on -- what's coming out of the
ANO-2 analysis and the Fitzpatrick analysis, that they're approximately
the same order of magnitude of inspections.
MR. ALI: This is Syed Ali from the staff. Just to clarify.
Although the comparison is really not valid because one is a PWR, Surry
is a PWR, and some of the ones you have done are BWR. But for Class I,
this methodology, the EPRI methodology, the sample size went down from
25 percent in ASME-11 to about ten percent, whereas the Westinghouse
methodology is about six and a half or seven percent. So that's the
order of magnitude difference.
MR. MITMAN: Okay. The next step in the methodology is to
do the risk evaluation. At this point, we have completed the
degradation analysis and the conditional -- or the consequence
evaluation and that allows us to bend the segments into the appropriate
boxes on the matrix.
DR. SHACK: Another question. You're also building 0313
into this also, aren't you? In the sense that that's how you bend
things into high, medium and low.
MR. MITMAN: At this point, 0313 is -- we're only building
in the category A 0313 welds for IGSCC. We feel and it's part of the
evaluation that's going on now with BWRs that with a category A weld,
that we can justify that we need no additional inspection beyond what
the risk-informed process is requesting.
Now, there is a dialogue, a discussion and some analysis
going on in the industry to revisit 0313 and that's not part of the
methodology right now. However, the methodology is set up so that if
and when that happens, we'll be able to take advantage of it.
One of the big concerns that we've addressed in the last
year or so was to take a harder look at the risk impact of the analysis
and that's -- well, once we've done the element, the risk-ranking and we
go out and do element selection and then we go ahead and look at
inspection for cause and decide what methodology should be looked at in
the various segments.
One of the questions that was asked earlier in the
discussion that we have deferred was what do you do with the segments in
the low categories and the methodology calls for no inspections in those
low risk regions.
You should keep in mind here that that's not to say we're
not doing any inspections on the systems. We continue to do inspections
in the medium and the high risk regions of those systems and we haven't
found any systems yet where we're recommending doing no inspection.
In addition to that, we continue to do the augmented
inspection for FAC, IGSCC and whatnot. So it's not like we're walking
away from large segments of the plant and not performing any assessments
for those.
DR. SHACK: And, again, you're doing leak tests. Everything
but volumetric inspection.
MR. MITMAN: And we continue to do leak tests on all Class
I, II and III.
MR. RICCARDELLA: Another aspect of that, too, is if you
look at the lower right-hand corner, things with low or essentially no
degradation mechanism identified, we still are inspecting some subset of
those, because some of them do fall over into the medium category.
If they have a high failure consequence potential, then they
do get a medium and we see that we do a lot of category four -- there
are category four inspections. So it's not like we're ignoring things
just because we haven't identified any mechanism.
MR. MITMAN: Now, in the earlier -- in the beginning slides,
we talked about the two code cases that apply here, N-560 for Class I
only and N-578, which applies to the full plant. This is the one place
where we come up with a slight distinction between how you select welds
and elements between the two code cases.
In N-578, we do 25 percent of the high risk category
elements. In the medium risk category, we do ten percent. In the low,
we do none, no volumetric inspections.
In N-560, we start at the category one, category here, and
start going and applying welds, looking at welds and adding them to our
list. But when we get approximately to ten percent, then we'll pull up
and stop.
In practice, what we see is we don't do all the high
category welds. We do -- for instance, if we have a BWR with four steam
lines and we have four welds on each of the steam lines, we might take
half of those welds, so we capture representative inspections for all of
the steam lines and then save some of those other inspections for other
places in the Class I system, so that we get a more representative and a
better, broader perspective of what's happening in the Class I system.
DR. SHACK: Now, the description in the report actually says
it's considered more prudent, but there is nothing that says you have to
do it that way.
MR. MITMAN: To do it?
DR. SHACK: To split your ten percent.
MR. MITMAN: It's a very strong recommendation. To date,
EPRI has been involved with all the applications of this methodology and
we very carefully ensure that it's not being misapplied.
DR. SHACK: Why isn't there just a step that says do some of
them, 25 percent?
MR. MITMAN: Didn't want to get too prescriptive, wanted to
be able to use engineering judgment and a little bit of flexibility to
decide exactly where to get those ten percent.
Pat, you wanted to add something?
MR. O'REGAN: Pat O'Regan, EPRI. One of the reasons we
didn't want to be too prescriptive is there are other considerations
that go in when you select locations, such as high rad areas and
accessibility and stuff like that. We wanted to make sure that still
carried weight when we went through the element selection process.
MR. MITMAN: One of the last steps we do is to do a risk
impact assessment. The process itself was designed as a risk-informed
process. So there are risk considerations taken into account from the
beginning. The risk impacts are -- we see risk impacts in three areas.
Allocation of inspections at the high risk locations, we
have inspection for cause impacts, and we have impacts from elimination
of inspections in the low risk segments.
The risk assessment process is a three-tiered process,
essentially. Initially, we want to eliminate as much quantitative
analysis as is appropriate and we bring to bear some qualitative tools
to do that.
If we have regions that are -- if we have low risk regions,
we can qualitatively show that it has no impact on -- no unacceptable
impact on risk. If we're doing -- if we're increasing the number of
inspections, we can qualitatively show that we have a positive or an
improvement in the risk consequences.
So first of all, if we want to do the qualitative analysis,
and we can do that in most cases. Where we can't, we want to go ahead
and apply some bounding estimates to help us decide that the risk
impacts are acceptable. If the bounding estimates are not sufficient,
then we bring to bear realistic quantitative analysis to help us assure
ourselves that we're having appropriate impact on risk
DR. SHACK: It seemed to me that it was almost a "gimme" if
I believed your -- that one-times-ten-to-the-minus-four was really a
bounding CCDP for a medium risk thing, that I was almost set up to get a
controllable delta C-P, because I'm looking at the important stuff and
I'm neglecting the unimportant stuff, and I'm just going to get the
answer to come out.
I guess the question is, can I really be confident that the
one-times-ten-to-the-minus-four is a bounding CCDP for a guy with a
medium classification, a two-train system with anticipated transients
MR. MITMAN: I think so, yes.
DR. SHACK: For all plants? I guess that's the part I have
a little trouble with.
MS. DIMITRIJEVIC: What's plant-specific is -- you want to
--
DR. SHACK: For the plant-specific part is how I credit the
two trains.
MS. DIMITRIJEVIC: How many trains you have, yes. Yes.
DR. SHACK: And so I guess the answer is if I have two
credited trains, am I always guaranteed that
one-times-ten-to-the-minus-four is a bounding estimate.
MS. DIMITRIJEVIC: You're going to be -- yes. You could be
a little -- I mean, we cannot really guarantee always, because sometimes
it happens that you're 1.1 because of these estimates,
ten-to-the-minus-four or something in the medium. But you are very
inside this. It is not going to be higher than 5e-minus-four.
DR. SHACK: Guarantee is a strong word to use in a PRA,
right?
MS. DIMITRIJEVIC: That's true. The best of our knowledge.
The best of our knowledge, yes.
MR. MITMAN: Pat, you want to add something?
MR. O'REGAN: Yes. Maybe a point of clarification. Pat
O'Regan, from EPRI. The methodology is set up that if you assign to
medium, you'll always be less than ten-to-the-minus-four. If you have
two trains in the plant, there is no guarantee that you'll always be a
medium.
DR. SHACK: If I have two qualified trains and the matrix is
approved, then I'm going to be a medium.
MR. O'REGAN: If you have two qualified trains, that's true.
MS. DIMITRIJEVIC: Yes.
MR. O'REGAN: But if you have two turbine-driven pumps, that
may not qualify.
DR. SHACK: That's different, right.
MR. O'REGAN: So you may be a high. But the criteria always
is set -- the criteria is set in stone. It's just a question of whether
the plant could meet the criteria or not.
MR. MITMAN: One of the discussions earlier today was a
discussion about questions about supporting documentation and where more
of the analysis is shown. These are most of the published reports that
we've published to date on the methodology. Most of those are
proprietary reports, but we can make the necessary -- we can make them
available for the ACRS to look at.
MR. FLEMING: I wanted to reflect back on the last question.
With regard to the potential issue about how robust are these
conclusions, the battle lines for this argument really are down at the
boundary between medium and low, because the way in which we do our
delta risk evaluations, we entertain the need to do some quantitative
bounding estimates if we're in the medium or high risk regions and we're
suggesting a reduction in the number of locations that are eliminated.
So the question about robustness really gets down to between
the medium and low region. That's where the potential issue would exist
and at that level, we're another two orders of magnitude down the risk
scale.
MS. DIMITRIJEVIC: And an ideal medium region is to escape
those boundaries. This is why we introduced this medium region. So we
don't have to have a clear cut between high and low.
MR. FLEMING: So what I'm saying is that if, for example,
for some error or uncertainty in analysis that a category that belonged
in the high region was miscategorized in the medium region, our delta
risk procedure would still catch that, because if we ended up in this
hypothetical location suggesting a reduction in the number of locations,
and, therefore, there's a potential risk increase, we would go and do a
calculation where we actually go in and do a bounding estimate that
would more than cover that uncertainty.
DR. SHACK: Is that clear to me where I have to do the --
that was the point I couldn't quite figure out, is when you had to do
the quantification. There's the qualitative estimate and the
quantitative.
MR. FLEMING: For any medium or high risk region in which --
or segment in which we're actually suggesting a reduction in the number
of locations, we would come in and do bounding estimates. So we're only
relying on the qualitative arguments for the low risk category
components.
So the robustness issue associated with how we put the
things on the matrix really is the -- the central question is have we
gotten the lows correct. The low-medium issue is more important than
the high issue.
MR. MITMAN: The second to the last slide that I have shows
some results from the pilot studies. We're showing the number of
inspections that were done under the current ASME Section 11
requirements and the number of inspections that we're proposing have
been approved by SERs for the pilot plants.
What we see is in the high risk regions, we have some
increases in the number of inspections, some decreases, but essentially
about the same number of inspections.
For the medium risk regions, we show usually a decrease in
the number of inspections. The one exception to that is on ANO-2, we
were actually showing an increase in the medium risks. Then in the low
risk regions, we're showing a decrease in the number of volumetric
inspections.
DR. SEALE: A couple of questions. First of all, what
percentage of the sites that wind up in the high category are actually
identified for an inspection, in the medium?
MS. DIMITRIJEVIC: In high?
DR. SEALE: What fraction of the highs --
MS. DIMITRIJEVIC: Twenty-five percent.
DR. SEALE: -- are -- what fraction of the ones that are
qualified as high actually wind up candidates for inspection?
MS. DIMITRIJEVIC: Twenty-five percent.
DR. SEALE: Okay.
MS. DIMITRIJEVIC: Twenty-five and ten percent, and that's
for the full scope.
DR. SEALE: For the full scope.
MS. DIMITRIJEVIC: Yes.
DR. SEALE: What about when you do it with your CI-1, Class
I?
MS. DIMITRIJEVIC: Class I, we select ten percent total and
most of them are from high risk.
MR. RICCARDELLA: It comes out to be about 25 percent of the
high risk.
MS. DIMITRIJEVIC: The same.
MR. RICCARDELLA: It's just the way the numbers work out.
And all three of these examples, it's essentially -- in fact --
DR. SEALE: Old Arkansas-2 really inspects the devil out of
things, don't they?
DR. SHACK: Just a question on Vermont Yankee. What is
their IGSCC fix? Have they replaced piping?
MR. RICCARDELLA: Vermont Yankee replaced piping.
DR. SHACK: So basically all their recirc piping is Class A
then.
MR. RICCARDELLA: Yes.
MR. MITMAN: We did put together a backup slide that you do
not have and it is not in the report that shows comparisons between what
we end up with or what we would end up with if we did -- depending if we
did an N-578 or an N-560 analysis. These are all --
MS. DIMITRIJEVIC: N-578 selection criteria.
MR. MITMAN: And this is for Class I only.
MS. DIMITRIJEVIC: This is just for Class I. It shows you
that actually when you apply N-578 criterion to Class I, you always are
around ten percent total. You are either 9.4, 10.6, 13 or 9.8. So
basically even if you use again 578 criteria on Class I, because of the
division between high and medium categories, then it's around ten
percent of total, which is the same as N-560 criteria.
And we keep that in mind with this percentage and we were
not surprised at that.
DR. BONACA: I have a question. Maybe I should ask the NRC.
But if I look at the whole logic, you have some high degradation
category, piping in the high degradation category, with no consequence.
For those, essentially, you're recommending elimination of inspection in
many cases.
MS. DIMITRIJEVIC: Actually, ten percent of inspection in
medium.
MR. MITMAN: No. You're over-hearing the none.
MS. DIMITRIJEVIC: None. Are you saying low or none?
DR. BONACA: None. Just taking an extreme case. That tells
me that you are going to have failures at some point of some of the
piping.
MR. MITMAN: The only thing that we've seen categorized with
no consequence are those abandoned in place piping.
MS. DIMITRIJEVIC: So we never saw high degradation in none.
MR. MITMAN: Now, if you have low consequence, which could
be extremely low, 1e-to-the-minus-ten or whatever, we're still bending
that in a medium risk category.
DR. BONACA: And that is fine. I just was worried more
about the corner, because simply you're going to see more failure. From
a regulatory standpoint, a utility that commits t this program and then
has failures in the field, you get a black eye anyway ultimately.
So I understand now that that box on the top left corner is
not really one that should be of concern.
MR. MITMAN: If we started to see a lot of pipe segments
falling into that segment, we'd have to ask a lot of questions about
whether that's appropriate or whether we should take a harder look at
it.
DR. BONACA: Because although you have -- from a risk
standpoint, it's fully convincing to me that there are other issues that
have to do with how do you deal with actual failures there and how are
they classified and is it part of corrective action programs and how is
that going to fit back into the adequacy of a program of this nature
that you implement.
It will raise all kinds of issues within a power plant if
you begin to have those kind of failures.
MR. RICCARDELLA: I know for the Class I programs, which is
most of the pilot studies we did, nothing has ever fallen in that
category. Every Class I -- all the Class I piping has either low,
medium or high failure consequence.
MR. MITMAN: Carl?
MR. FLEMING: Carl Fleming, from ERIN. With regard to the
earlier discussion we had about the insights from service experience and
the different kinds of loading mechanisms and degradation mechanisms
responsible for service data, those insights are responsible for both
leaks and ruptures.
So the concern that reducing volumetric inspections might
result in an increase in the frequency of leaks in piping does not seem
to be supported by the insights from in-service data. It indicates that
they'll probably occur at about the same rate as we're seeing now,
because they're due to mechanisms that are just not being captured by
the inspection process.
DR. BONACA: Thank you.
MR. MITMAN: My summary and concluding slide. The revised
topical has been submitted recently. It addresses questions and
concerns, lessons learned that we've learned along the way in the
application of the pilot process, the methodologies and compliance with
Reg Guide 1.174 and Reg Guide 1.178.
The methodology has been applied to a diverse and extensive
group of plants, GE BWRs, Westinghouse, B&W, and CE PWRs, multiple AEs,
and both full and partial scope.
So we've got a very broad, diverse, I think a very good
distribution of the pilots and there has been a lot of feedback into the
methodology from that. We are seeing significant rem reductions out of
the application and the pilots and research support the conclusions of
negligible risk impacts by application of the methodology.
DR. SEALE: You mentioned earlier that you had a process by
which you did some follow-up to find out if there are any changes or
wild trends that might show up in the results of the application of
this.
Is there any systematics to that follow-up and if so, what
are they?
MR. MITMAN: The final step in the process is this
performance monitoring that hangs out to the side here on the feedback
loop. EPRI has been doing database analysis. We continue to watch the
industry and the LERs and the reports from the industry. That's all
part of the process. The process really isn't formalized at this point,
but it's there.
There is a discussion about setting up something that might
be equivalent to a user's group that would be also fed into the
monitoring process and we're also expecting each individual plant that
applies the methodology to watch what's happening in their plant and in
the industry and to go back and revise, change, correct their own
application of the methodology.
DR. SEALE: I noticed you mentioned that the owners groups
for the different vendors have been participants.
MR. MITMAN: Well, the CE owners group has not, per se, been
part of this. The vast majority of the CE plants have been part of an
EPRI tailored collaboration, but not, per se, the CE owners group.
DR. SEALE: Okay. But in the other cases, the owners groups
may have their own impromptu groupings or reviews, as well, I guess.
MR. MITMAN: Obviously, Westinghouse and the WOG have their
own methodology and their own process there. There is no discussion at
this point with either the BWR owners group or the B&W owners group
about having any kind of feedback loop between the owners groups and
EPRI. There is -- it's on a plant by plant basis.
That's all I had.
DR. SHACK: Any more questions? They're not scheduled to
start until 11:15. Can we go ahead with them?
MR. MARKLEY: Yes, we can. We're not changing subject here.
So that's fine.
DR. SHACK: Thank you.
MR. ALI: My name is Syed Ali, I am from the Division of
Engineering in NRR. With me is Steve Dinsmore, who is from the Division
of DSSA in NRR.
What we are going to try to do in the short time that we
have is to basically give an overview of the status of the review of the
topical report and also the associated pilot plants, and a little bit of
the changes that EPRI has made in their topical report since we approved
some of their pilots.
Some of these items EPRI may have already discussed this
morning or may have been discussed as a result of questions or just to
complete the picture, we will go over the status of what we have done so
far, again.
EPRI submitted its draft topical report back in '96. At
that time, we were also in the process of developing the regulatory
guide and the standard review plan for the risk-informed ISI.
We issued some questions and requests for additional
information the middle of '97. Subsequent to that, EPRI was involved in
developing the pilot applications and submitting the pilots, so their
priority was more toward the pilot submittals. So they came back with
their responses to the RAIs and the questions and comments that we had
sent near the end of last year.
That was also about the time that we had finished basically
the regulatory guide and the standard review plan and also some of the
pilots. So they were able to utilize the lessons learned not only from
the pilot study they had done, but also from the regulatory documents
that we had issued.
I think since then, this process has picked up and our
interface with EPRI has become much more significant. We had a meeting
back in March to discuss the responses and there were a few additional
issue. EPRI responded to those additional issues and then submitted
their current report or their new version of the topical report 11267,
which is the one that you are reviewing and that we have been reviewing.
Those are the items that have been completed. We are having
the ACRS subcommittee meeting today. We intend to have a follow-up
meeting with EPRI sometime in July.
In addition to that, since right now we are actively
reviewing the EPRI report and some of their backup reports, we have a
weekly telephone sort of update as to the issues and the items that are
ongoing.
We plan another meeting or another presentation to ACRS in
their September meeting and that's when we will be able to present our
SER. One thing that you see different here is that since the ACRS
meeting is in September, we think that we will be able to issue the
final report by the end of October and not the end of September, as you
saw in some of the EPRI slides.
That schedule was based on having an ACRS presentation in
August, which is not on schedule at this time.
DR. SHACK: Are you still going to have a draft SER in June?
MR. ALI: We still plan to have a draft SER in June. So we
should be able to give you a draft SER. Now, whether that draft SER
will be a clean SER in the sense that it may have some open items, we
don't know. But probably it will have some open items, but we will have
a draft SER.
If we proceed the same way that we did with the
Westinghouse, then we will probably have a draft SER with maybe a few
open items and then have the meeting with EPRI to try to resolve those
open items and then have a final SER by the time you have your September
meeting.
The next slide was just a listing of the pilots. EPRI
talked about those already. Also, we have completed two pilots, Vermont
Yankee, which is a GE BWR, and on that it was applied only to Class I
utilizing the code case N-560. We have also completed the review of
ANO-1 Unit 2, which is a CE PWR, and we are currently reviewing the
submittal for ANO Unit 1.
DR. SHACK: Now, those two pilots, the application basically
followed this topical, although this topical didn't show up until April.
MR. ALI: It followed the topical that they initially
submitted.
DR. SHACK: The old topical.
MR. ALI: Old topical, but then there were additional things
done as a result of that review. So a lot of that is reflected in the
changes that were made in this topical.
So basically this topical utilizes the changes or the
lessons learned from the pilot applications and also from the reg guide
and the standard review plan that we issued that was subsequently the
first topical report.
MR. MITMAN: This is Jeff Mitman from EPRI. Both the pilot
plants that have been completed, Vermont Yankee and ANO Unit 2, are
consistent with the new topical that you have in front of you. There is
nothing that they have done in those pilot plants that is different than
what we have proposed in the revised topical.
MR. DINSMORE: This is Steve Dinsmore, from the staff.
There are more things in the topical than were approved in the pilot
plants and I think the next two slides, we're going to go through the
differences between what was approved and what's in the current topical.
So there are some differences.
MR. ALI: What we're going to go through are some of the
major changes in the topical report rather than detailed item by item
changes subsequent to the approval of the pilots.
One change, I would say, an updating of the topical report,
is that in looking at the first version of the EPRI topical report and
also some of the discussions we had and the questions we had been
sending, it was not clear as to how the augmented programs are
integrated with the risk-informed ISI process.
So one thing that they have done in this topical report is
to clarify as to which of the augmented programs are, at this point,
part of the risk-informed ISI process and which of the augmented
programs are still being looked at as the way the licensees had made
commitments to the NRC as a result of the degradations found either on
an industry basis or on a plant-specific basis.
DR. WALLIS: This augmented part means it's increased,
augment is to increase.
MR. ALI: What the topical report and the current EPRI
position is that, for example, for IGSCC, category A will be most into
the risk-informed ISI process, but for category B through G, the
risk-informed ISI process at this time will not change the inspections
that are being done for category B to G.
They are not being increased or decreased. They are just
staying the same.
DR. WALLIS: Augmented implies increased.
MR. ALI: Augmented means in addition to what is in ASME
Section 11.
DR. WALLIS: So that's the implication. It's in addition to
that.
MR. ALI: In addition to ASME-11 inspections.
DR. WALLIS: So on the face of it, it looks as if you're
increasing some demands by augmenting inspection.
MR. ALI: No, that's not what is meant. There were a number
of -- there's a number of degradation mechanisms that were found in the
plants over the last several years. As a result of those, the staff had
issued generic letters asking the licensees to address those issues and
as a result of that, the licensee made certain commitments as to how
they will monitor those degradation mechanisms and inspect for those.
The second item is --
DR. SHACK: Syed?
MR. ALI: Yes.
DR. SHACK: An erosion/corrosion, is that augmented
inspection program now going to be subsumed into the --
MR. ALI: No. That, at this point, is going to remain as it
is in the generic letter. So those IGSCC B through G and the
erosion/corrosion are the two programs that are not being changed as a
result of this program at this time, and other programs are being
changed.
The second item is that as a result of our issuing the
regulatory guide and standard review plan and also reviewing the pilots
and issuing the SER, the staff and the industry felt that once we have
reviewed the pilots and we have reviewed and approved the topical report
for these two methodologies, then the industry and the staff should come
up with a simplified submittal to the staff so that the review process
can be expedited.
We had several meetings with the industry to try to come up
with the contents of that template. As a result of those meetings, we
agreed to a table of contents and what will go into those templates.
The only thing I think that's a little bit different is that
as a result of our meetings with NEI and the industry, there were some
changes that were made to that template, there were some attritions and
the template that we see in this topical report does not reflect the
latest. So I think that's something that we will ask them to do and I
don't think that should be a big change. That can be done easily.
DR. SHACK: Do you have a template for the WOG ASME?
MR. ALI: Yes, we have for both. Actually, the template is
about the same because the high level aspects of the methodologies are
really the same. It's the details. So the template is essentially the
same.
The third item on this slide is that so far, all of the
pilots that we have looked at and approved have been either the whole
plant or Class I. So we have not been asked to review and we have not
reviewed any submittals where there was a change in the inspection on a
system by system basis.
But the topical report presents that as one of the options
that the ISI program may be changed on a system by system basis. They
did not talk about that this morning. The criteria, the risk criteria,
the risk acceptance criteria on a system by system basis is an order of
magnitude more stringent than what it is for the plant basis.
This is something that is different than what we have
approved at this point and so we are still in the process of reviewing
that.
Steve will now go through the next slide.
MR. DINSMORE: This is Steve Dinsmore from the staff. I
will be talking about some of the differences in the -- I guess most of
them are in the delta risk calculations. Again, these differences are
between what was approved in the pilots and what's in the current
topical.
We talked a lot about those tables, but we haven't been
looking at the specific elements in those tables and what those rankings
are and the word grade creep comes to mind. Every pilot has been
submitting their own table and the highs and the mediums are kind of
drifting off to the left-hand side.
So we haven't quite approved the table yet. We're still
looking at it. Some of the elements in there are greater than
ten-to-the-minus-four, which are supposed to be mediums, because they
say it's a bounding calculation. So we're still dealing with that. So
if you look in the table and you see numbers which don't seem to fit
with the criteria, they don't, and we're working on that.
The other big change is these delta risks. Again, earlier,
when they first started this process, they didn't really look at delta
risks and we've been adding that slowly step by step.
What's new in the topical, again, is there is a request to
do no delta risk calculations if you only do Class I. EPRI said that
they had an argument why ten percent would not increase risk and that
there -- if the pilot or if a utility could somehow show that their
service experience is similar to generic service experience, then they
wouldn't have to do the delta risk calculation. So we're still looking
at that.
No delta risk contribution from low safety significant
segments. Carl kind of alluded to that this morning. They don't want
to calculate the change in risk due to low safety significant segments.
They have a reasonable looking argument in the topical where they use
bounding calculations, but we're still looking at that, again.
They added these screening criteria. This is actually the
first time I've seen those. We've only had this thing for about two and
a half weeks. The ten-to-the-minus-seven CDF and the
ten-to-the-minus-eight LERF, these are all reflected in a flow sheet on
the last -- there is a flow sheet right in the back of the chapters.
Evidently, it's a system by system restriction which you use if you've
done either by class or by -- or the whole plant.
Then they added on this extra one where they say if you only
do one system, then you decrease those by a factor of ten. In general,
with the risk-informed stuff, we've been -- we started out by saying you
had to do full scope, everything, and we've been kind of slowly moving
back. Especially if they come in with the argument that it's a risk
decrease, it's hard for us not to accept something that's not a risk
decrease.
Again, these are positive numbers here. So we're still kind
of looking at that.
And the last one that they added was this Markov. There was
a lot of discussion this morning about this Markov and the data
analysis. We didn't use that in the pilots. We used this bounding
option, where they took the highest possible CDF for each category and
the highest possible pipe failure frequency for each category and did
some bounding calculations to show us that without crediting any
increase in inspection efficiency, that there would be a very small risk
increase. If they credited some increase in the inspection frequency,
then it would go down.
So they've been coming in with minus numbers as their best
estimate of the change in risk, which, again, I'm not quite sure what
these positive ten-to-the-seven and ten-to-the-minus-eight boundary
criteria are.
A more mundane problem with the Markov stuff is from Dr.
Apostolakis -- it's spread all over about ten reports and we're trying
to pull it together. So we don't really have a good feel for how the
whole thing fits together with the data.
But our current feeling is that the process seems
reasonable. It's just a matter that we have to really get and
understand it and say that what we understand is okay.
Those are essentially all the differences that we've
identified.
DR. SHACK: Questions from the committee? Do you need
anything from us at the moment? You're still working on your draft SER.
MR. ALI: We kind of talked about that before. We usually
ask for a letter when we write the SER, but we haven't written the SER.
So I think at this point, it's --
DR. SHACK: Unless we have a major problem.
MR. ALI: -- what you write as a result of your meeting or
your deliberations.
DR. SEALE: Strictly information.
MR. BARTON: I don't see any big problem that would require
a letter.
DR. SHACK: Okay.
DR. SEALE: So you're going to talk again this afternoon?
MR. ALI: Yes. We are on schedule again this afternoon.
DR. SHACK: We had some discussion about that, since we've
got a reasonable segment, we basically sort of thought we more or less
had to do it, but we would do it in a fairly abbreviated fashion.
DR. SEALE: Yes. I notice it's just a half-hour.
DR. SHACK: That was more we sort of felt we had to -- you
know, since it was noticed, we would have to do it, but it would be an
abbreviated session.
With that, if there are no other questions or comments, we
close the meeting of the subcommittee.
[Whereupon, at 11:16 a.m., the meeting was concluded.]
Page Last Reviewed/Updated Tuesday, July 12, 2016