Reliability and Probabilistic Risk Assessment and Materials and Metallurgy

                       UNITED STATES OF AMERICA
                        U.S. NRC
                        Room T-2B3
                        11545 Rockville Pike
                        Rockville, Maryland
                        Wednesday, May 5, 1999
         The subcommittee met, pursuant to notice, at 8:30 a.m.
         WILLIAM L. SHACK, Chairman, ACRS
         JOHN BARTON, Member, ACRS
         MARIO BONACA, Member, ACRS
         MARIO FONTANA, Member, ACRS
         THOMAS S. KRESS, Member, ACRS
         DON W. MILLER, Member, ACRS
         DANA A. POWERS, Member, ACRS
         ROBERT L. SEALE, Member, ACRS
         ROBERT E. UHRIG, Member, ACRS
         GRAHAM B. WALLIS, Member, ACRS
                         P R O C E E D I N G S
                                               [8:30 a.m.]
         DR. SHACK:  The meeting will now come to order.  This is a
     meeting of the ACRS Subcommittees on Reliability and Probabilistic Risk
     Assessment and on Materials and Metallurgy.
         I am Dr. William Shack, Chairman of the Subcommittee on
     Materials and Metallurgy.  Dr. Apostolakis is the Chairman of the
     Subcommittee on Reliability and Probabilistic Risk Assessment.
         ACRS members in attendance are John Barton, Mario Bonaca,
     Mario Fontana, Tom Kress, Donald Miller, Dana Powers, Robert Seale,
     Robert Uhrig, Graham Wallis.
         The focus of this meeting is to review those topical reports
     prepared by the Electric Power Research Institute for risk-informed
     in-service inspection.
         The subcommittees will gather information, analyze relevant
     issues of facts, and formulate proposed positions and actions as
     appropriate for deliberation by the full committee.
         Michael T. Markley is the cognizant ACRS staff engineer for
     this meeting.
         The rules for participation in today's meeting have been
     announced as part of the notice of this meeting previously published in
     the Federal Register on April 14, 1999.
         A transcript of the meeting is being kept and will be made
     available as stated in the Federal Register notice.  It is requested
     that speakers first identify themselves and speak with sufficient
     clarity and volume so that they can readily be heard.
         We have received no written comments or requests for time to
     make oral statements from members of the public.
     This, again, is the second presentation on risk-informed in-service
     inspection that we've seen.  We've previously reviewed, a few months
     ago, a proposal from the ASME on one approach to risk-informed
     inspection.  This is another alternate.     
         We will now proceed with the meeting and I will call upon
     Dr. Jeff Mitman of EPRI to begin.
         MR. MITMAN:  Good morning.  My name is Jeff Mitman and I'm
     the EPRI project manager for risk-informed ISI.  I would like to turn it
     over initially to Ham Fish of the New York Power Authority and let him
     begin the introductory remarks.
         MR. FISH:  Good morning.  I'd like to introduce the members
     of our team.
         DR. SHACK:  Please use the microphone.
         MR. FISH:  Beginning at your left, we've got Carl Fleming,
     from ERIN Engineering.  Next in, Vesna Dimitrijevic, from Duke
     Engineering Services, a major contributor to this work on the project;
     Jeff Mitman, whom you've met, our EPRI project manager; myself, from the
     New York Power Authority, where I manage the research and development
     program for the nuclear effort.
         Next, Peter Riccardella, from Structural Integrity; and,
     Glen Smith, the New York Power Authority Project Manager at the
     Fitzpatrick plant.  Sitting in the back, Pat O'Regan, working with us on
     this project, with EPRI.
         Our objectives today are to facilitate your review and
     concurrence of the EPRI risk-informed in-service inspection methodology,
     in support of a safety evaluation report expected in September of this
         The agenda, the organization of our presentation today will
     be the status of the topical report, the status of the various pilot
     plants which are participating in this, an overview of the technical
     methodology for the risk-informed inspections, and, finally, our summary
     and conclusions of what we have drawn from where we are to date and what
     we look forward to.
         At this point, I'd like to turn it over to our EPRI
     technical manager, Jeff Mitman.
         MR. MITMAN:  Thank you, Ham.  What we're going to talk about
     first is the status of the topical, just a couple slides on -- or one
     slide on the topical, one slide on the pilot projects, and the vast
     majority of the discussion will be about the technical details of the
         The original topical was submitted to the NRC for review in
     June of 1996.  We reviewed extensive RAIs on that, due to the
     preliminary nature of that, and from there we've been working on RAI
     responses, which went into the topical or went into the NRC staff back
     in November of last year.
         We've also spent a lot of time revising the topical.  That
     came to the staff on April 15, copies of which were also supplied to the
         The topical revision has included extensive enhancements of
     the procedure and basis description, quite a bit of lessons learned
     information from the pilot programs, resolutions of questions and
     comments from the NRC, and we've also incorporated quite a bit of
     related EPRI research information.
         The expectations are for a draft SER in June of this year,
     with a final SER in September of this year.
         A quick discussion of the related ASME code cases.  There
     are two that are applicable to the EPRI methodology.  There is a third
     that the WOG Westinghouse ASME research uses.  The one that's used there
     is N-577, but we won't be talking about that today.   
         N-560 was approved or code case N-560 was approved in 1996. 
     It applies to BJ welds in the Class I system only.  It excludes socket
     welds and it allows for inspection, ten percent of the inspection
     sampling of the Class I BJ welds.
         A revision to that code case was started this year and it's
     about halfway through the approval process and our expectations are for
     approval of that this year.
         N-578 is an alternate code case that also uses the EPRI
     methodology.  It was approved in 1997.  It applies to Class I, II, III
     piping and may include non-code piping.
         Inspection criteria there are 25 percent of the high risk
     welds, ten percent of the medium risk welds, and zero percent of the low
     risk welds.
         Likewise, a revision was started on that this year.  It's
     about halfway through the approval process and, again, we're expecting
     approval this year.
         The differences are a comparison of the two code cases, the
     risk assessment process is the same.  The consequence analysis is the
     same.  The degradation analysis is the same.  The distinction is in the
     element selection process.
         As noted on the slide, for the N-560, we do ten percent of
     the BJ welds.  For N-578, we do 25 percent of the high, ten percent of
     the medium, and zero percent of the low.  Both methodologies yield
     comparable risk results.
         DR. WALLIS:  Is it ever good to do zero percent of anything?
         MR. MITMAN:  The way we pick welds, and we'll get into that
     a little bit later, you'll see why we feel it's okay to pick zero
     percent of the low risk welds.
         DR. WALLIS:  In case you were wrong, you might want to have
     at least some sample from what you called low risk.
         MR. MITMAN:  As I said, let's go on with the degradation and
     consequence analysis and you'll see where that comes from.
         I want to talk about the pilot plants at this point.  There
     has been quite a bit of work that's been done already and the work
     continues.  As I said, there are two code cases, two different scopes,
     if you will, that we've applied the methodology to.  Vermont Yankee was
     the first plant to use the methodology and we received the first
     industry SER on that back in November of last year.  That's an N-560
     case and it was done on Class I piping only.
         ANO-2 is Combustion Engineering PWR.  We did a full plant
     evaluation of that under code case N-578.  Likewise, Entergy received an
     SER approving that in December of last year.
         ANO-1 is an N-560 application.  It was submitted last year
     and we're currently finalizing responses to RAIs that the staff sent us
     in the last month or so.
         Fitzpatrick is other full plant application, GE boiling
     water reactor.  We did 14 systems there and we're in final preparation
     of the submittal for that.
         The following plants are all Class I only applications and
     they're in various stages of completion.  Braidwood is about 80 percent
     complete, South Texas 70-75 percent complete, River Bend and Waterford
     haven't started yet, but we expect to do those later this year.
         At this point, I'd like to start to talk about the
     methodology itself.  We'll go through the -- initially, I just want to
     go through the process itself at a very high level and then we'll take a
     closer look at each of the steps.
         The first step is to determine the scope.  Do you want to do
     BJ welds only?  Do you want to do full plant evaluation?  How many
     systems do you want to include?  Where do you want to draw the system
     boundaries and stop?  That's determination of the scope.
         Then there are two independent analyses that need to be
     performed, the consequence analysis and the damage mechanism analysis. 
     They can be done in either order, they can be done in parallel.  The
     output of both of those is -- neither of those output is input to the
     other one.  So they can be done in parallel.  And probably 50 or 60
     percent of the total work is involved in the two analyses, the
     consequence analysis and the damage mechanism analysis.
         Once that's completed, we do a second check looking at plant
     history, what we call a service review of the plant.  From there, we do
     segment risk categorization, where we take the output from the
     consequence analysis and the damage mechanism analysis, put those
     together and categorize our welds into high, medium and low risk
         From there, we decide which specific welds we want to --
     welds or elements we want to inspect and we also determine the
     inspection methods, what kind of NDE we want to perform.
         Afterwards, we go after the -- we do a risk impact
     assessment and then we finalize the program.  There is a feedback --
     there are two feedback loops, one coming out of the risk assessment,
     whereby if we decide that the risk impacts are unacceptable, we can go
     back and add welds, re-allocate elements, do what's necessary to ensure
     that we have acceptable risk impacts.
         Also, there is a feedback loop at the end of the project,
     where we do long-term performance monitoring, whereby we watch what's
     going on in the plant, what's going on in the industry, and, if
     necessary and as appropriate, we modify -- go back and modify the
     various analyses to make sure that we're looking in the right places and
     we're looking for the right things.
         The heart to the process is the risk matrix and I will show
     that in the next slide.  But before I bring up the matrix itself, I'd
     like to talk a little bit about the two -- some of the concepts behind
     the risk matrix.
         On one axis, we have the consequence evaluation, where we're
     looking at core damage in large early release and the input to that is
     both probabilistic insights and deterministic insights.  There are four
     impact groups that we're considering; initiating events, degradation of
     systems and/or trains, degradation of the containment, or combinations
     of the three above.  The output for that is a consequence ranking of
     high, medium, low or none.
         On the other side, we have the degradation analysis, where
     we're looking at pipe rupture potential and here we're looking at
     degradation mechanisms, which damage mechanisms apply or are potentially
     applicable to each piping segment.
         We do extensive service experience evaluations there and the
     output for that is a rupture potential ranking of high, medium and low.
         That goes into the risk evaluation matrix and here we have
     the matrix, we have the consequences across the X axis, degradation
     across the Y.  We end up with three consequence rankings, high, medium,
     low and none, and, again, the degradation analysis of high, medium and
     low.  Then we divide into three risk regions high, medium and none,
         DR. KRESS:  Your conditional probabilities, I assume, are
     weighted by the initiating events or added up for all initiating events.
         MS. DIMITRIJEVIC:  The conditional pipe failure.  So given
     the -- if we have a pipe failure, what would be the conditional core
         DR. KRESS:  You do a conditional for each pipe segment, for
         MS. DIMITRIJEVIC:  Right.
         DR. SHACK:  But then he has a frequency of challenge that
     determines whether it's high or medium.
         DR. KRESS:  So the frequency does enter into it.
         MR. MITMAN:  Frequency does enter into that classification.
         MS. DIMITRIJEVIC:  Frequency of challenge for the system,
     yes.  But actually frequency enters through the pipe failure frequency.
         DR. APOSTOLAKIS:  It's similar to the component, is it not?
         MS. DIMITRIJEVIC:  Yes.  If there is no need for surrogate
     component, because we are looking at actual pipe.
         DR. APOSTOLAKIS:  Jeff, what was the logic behind this
     matrix?  I mean, this is a decision matrix here.  You've given the
     categorization of the consequences of a pipe break and the degradation
     category, you decide that something is low, medium.  What was the logic
     of that?  For example, how did you decide that if the degradation
     category is high and the consequences are low, then it becomes a medium.
         MR. MITMAN:  The logic behind the matrix concept itself was
     driven by a desire to back away from having to do detailed probabilistic
     calculations or detailed calculations of the damage mechanisms.  We
     wanted to come up with a process that was easier to apply, yet was
     accurate and gave valid results.
         So that led us to the concept of a matrix where we can bend
     things easily.
         DR. APOSTOLAKIS:  Well, we can talk about easy easy is, but
     this -- the purpose of this risk evaluation, this matrix is to lead you
     to a decision how to treat a pipe segment, is that correct?
         MR. MITMAN:  Right.
         DR. APOSTOLAKIS:  So given now that you have done the
     consequence evaluation and all that, whether that's easy or not is a
     separate issue, the logic of this decision-making process, what was it? 
     I mean, why is medium degradation category and low consequence category
     leads to a low category six segment?
         MR. MITMAN:  Vesna?
         MS. DIMITRIJEVIC:  What we tried to decide in this category,
     we said, okay, well, let's assume the old pipe in the plant breaks and
     CCBP.  If they're going to go in danger of ten-to-the-minus-six, which
     is the danger where you're actually making the decision, if we're
     expecting that we can be above the ten-to-the-minus-six, because those
     CCBPs have the ranges between ten-to-the-minus-four and above, then we
     said this is a high.
         If we say we're expecting the piping in the plant breaks,
     it's still be under ten-to-the-minus-six, and then for this region
     between, we say, okay, between ten-to-the-minus-six, eight, and
     ten-to-the-minus six, if we don't really -- we're going to put the
     medium because we were not sure really which way because of all the
     answers in this.
         So we did this in order to cover our certainty ranges.
         DR. APOSTOLAKIS:  But that was the uncertainty on the
         MS. DIMITRIJEVIC:  Both, because when we estimate the pipe
     failure ranges, also, based on the presence of the degradation
     mechanism.  So this is built to cover uncertainties.  If we expect,
     based on our knowledge, that potential for the total CDF to be above
     ten-to-the-minus-six, we put it in high.
         DR. APOSTOLAKIS:  And then what does it mean?  If a segment
     is medium, what do you do to it?
         MS. DIMITRIJEVIC:  You're going to see this through the --
     it's coming.  We will have a different selection for this.  Carl, would
     you like to add something?  Did I miss something?
         MR. FLEMING:  Carl Fleming, from ERIN.  I think that part of
     George's questions could be answered that the logic is really risk
     equals frequency times consequence.  And if this were done in a fully
     quantitative way, we'd simply take the frequency of the pipe rupture,
     multiply it by the conditional probability of core damage, and then get
     the risk.
         In the EPRI risk matrix approach, uncertainties are
     addressed by looking at this in a very course, discreet way.  Instead of
     numerically quantifying the conditional core damage probability in each
     case and numerically quantifying the frequency of pipe rupture, they're
     put into broad categories.
         So the logic of high, medium and low stems from the concept
     of risk equals frequency times consequence.
         DR. APOSTOLAKIS:  I understand that.  But my question is
     this; presumably, there is a certain frequency of inspections and so on
     that corresponds to medium, high of these entries.
         MS. DIMITRIJEVIC:  Of risk.
         DR. APOSTOLAKIS:  Of risk.  Now, you don't have a
     quantitative estimate of the impact --
         MS. DIMITRIJEVIC:  Of inspection.
         DR. APOSTOLAKIS:  -- of the inspection on these two
         MR. FLEMING:  No.
         DR. APOSTOLAKIS:  So this is purely judgment now.  You are
     hoping that --
         MS. DIMITRIJEVIC:  We're estimating total risk from those
         DR. APOSTOLAKIS:  Yes, but --
         MS. DIMITRIJEVIC:  So let's say that not one of those
     locations is ever inspected, this is the total risk.
         DR. APOSTOLAKIS:  That's right.  So now the question is, if
     the degradation category is medium and the consequence category is
     medium, then you say medium.
         MS. DIMITRIJEVIC:  Right.
         DR. APOSTOLAKIS:  But you don't know now what the impact of
     what you're doing on risk is.  You just guess that this would be a
     reasonable thing to do.
         MS. DIMITRIJEVIC:  At this moment, the only thing which we
     are trying to do is to divide locations -- I mean, valves and the
     piping, based on the risk significance.  We are not looking at
     inspections yet at all.
         DR. APOSTOLAKIS:  Yes, but in order to decide that something
     is medium, high or low, you have to have some idea of what the impact
         MS. DIMITRIJEVIC:  Yes.  We have some idea of what
     probability of failure is and what is the consequence.
         DR. APOSTOLAKIS:  Without inspection.
         MS. DIMITRIJEVIC:  Without.
         DR. APOSTOLAKIS:  And you don't have any idea what happens
     to these probabilities with inspection.
         MS. DIMITRIJEVIC:  No.
         DR. APOSTOLAKIS:  No.
         MS. DIMITRIJEVIC:  Neither do we and neither does anybody. 
     I mean, this is a very difficult thing to estimate.  So basically, in
     this moment, we are not really trying.  When we try to calculate back to
     risk, we will try to do that.
         DR. APOSTOLAKIS:  So there is a judgment here that by doing
     high or medium, you know this is good enough.  That's really what it
     comes down to.
         DR. SEALE:  Are you going to show us a little later that all
     three mediums are comparable in risk and that all of the mediums are
     discernibly greater risk than low?
         MR. MITMAN:  Yes.
         DR. SEALE:  And conversely, mediums and high.
         MR. MITMAN:  Right.  We'll go into that a little bit later.
         DR. SEALE:  Okay.
         MR. MITMAN:  You wanted to add something?
         MR. RICCARDELLA:  Let me just make a comment.  There was a
     judgment, as you said, George, made in the beginning, when we set up
     these categories, and that judgment was based on looking at what we
     currently do under ASME code requirements and coming up with something
     which we think is at least equivalent or better.
         There was a judgment at that end.  But as you will see as we
     get on with the presentation, we have now implemented this in a number
     of pilot studies and when we complete those pilot studies, we've done
     delta risk calculations and quantified the difference between what we
     were doing before and what we're doing after.
         DR. APOSTOLAKIS:  Including the impact of inspections.
         MR. MITMAN:  Yes.
         MS. DIMITRIJEVIC:  Yes.
         MR. RICCARDELLA:  Yes.
         DR. APOSTOLAKIS:  And it's in this report?
         MS. DIMITRIJEVIC:  It's Section 3.7.
         MR. DINSMORE:  This is Stephen Dinsmore, from the staff. 
     I'd like to add something.  When EPRI first came in, they just had this
     matrix and ever since then, we've been pushing them to at least estimate
     the delta risk.  So at the end, they've come up with this methodology to
     estimate the delta risk.  So they use this process to select and to
     guide their inspection selections and then they use this delta risk
     calculation to make sure that things are okay.
         DR. SHACK:  Just a sort of related question.  You have sort
     of a conditional or damage probability associated with these things,
     that you don't really calculate.  You calculate from the guidelines that
     you've given based sort of on the number of backup trains and you
     associate a numerical value of the conditional core damage probability
     with those.
         How robust is that?  I mean, how many PRAs did you look at
     before you decided you could really bend them this way and have a
     conditional core damage probability that was in the range that you were
     assigning to each of those categories?
         MS. DIMITRIJEVIC:  It's plant-specific, so we look in the
     specific plant PRA when we do this.  Every plant, different events will
     fit into different categories.  It's not really so diverse.  You will
     see also the pipes which result in the LOCA lead to the high
     consequences and things like that.
         But this matrix is generally applicable to the methodology,
     but you apply it on specific plants, you look at specific events and
     specific conditional core damage probabilities.
         DR. SHACK:  Okay.  Maybe I misunderstood it.  I thought when
     you looked at the plant specific, you were really deciding, with this
     particular event, you had 2.5 backup trains.
         MS. DIMITRIJEVIC:  Yes.
         DR. SHACK:  And that was the plant-specific thing, but you
     really didn't calculate the conditional core damage probability.
         MS. DIMITRIJEVIC:  But that translates --
         DR. SHACK:  Yes.  That translates, but not from that plant's
     PSA.  Isn't that sort of arbitrarily assigned?
         MS. DIMITRIJEVIC:  How many backup trains is plant-specific. 
     What you can count as a train is plant-specific.  If some plant keeps a
     train with a probability of failure that's ten-to-the-minus-two, that
     counts as a train.  If that is ten-to-the-minus-one --
         DR. SHACK:  It doesn't count.
         MS. DIMITRIJEVIC:  -- it doesn't count as half-train.  So
     what do you count as a train is plant-specific.  So basically, it's a
     completely equivalent if as you were running the PRA.  Basically, this
     table was validated with a lot of PRA runs and always gives the same
     category, because it's basically principles of PRA are concentrated in
     this table, because this is what PRA sequences are, how many times you
     call for something, how many backup trains you have, and what are their
         DR. SHACK:  Okay.  And you say lots of PRA runs, and I guess
     my question is, is that lots of PRA runs on two plants or how many
     plants did we look at?
         MS. DIMITRIJEVIC:  We looked at four plants and it depended
     on the plant as to what was the number, between five and 20 PRA runs per
     plant.  We didn't have any disagreements.
         DR. APOSTOLAKIS:  Yes, I went through 3.7.  You say that
     while there can be a bounding analysis or if it doesn't work, then you
     do a more realistic quantitative analysis, but then you go on and say
     that this can be done, but then there is a whole paragraph why it cannot
     be done, because it's very difficult, and I agree.
         Then in the examples that you have in here somewhere from
     the actual plants, I didn't see the impact, the quantitative estimate of
     the impact of the in-service inspection.
         So is that really something that you have done or something
     that could be done in principal, but it's not really done?
         MR. MITMAN:  On VY ANO-2, ANO-1, we've done realistic
     analysis on some of the systems, as required, where we couldn't show
     qualitatively that risk was improving.
         On ANO-2, we've also done some Markovian analysis that
     further, in more detail, looked at several systems in the ANO-2 plant. 
     So those analyses have been done.
         DR. SHACK:  And when you say you did that, you actually
     computed the conditional core damage probability for that plant from the
     PSA, not from the binding value of the CCDP that you have.
         MR. MITMAN:  Vesna, correct me if I'm wrong, but if I
     remember correctly, we actually looked at each of the pipe segments on
     VY and ANO-2, calculated the conditional core damage probability, and
     then used those to validate the delta CDF calculations.
         MS. DIMITRIJEVIC:  But we do also use a bounding if you're
     in the medium range, because we can have a lot of else with the
     different CCDPs in that train and we used the upper value.  In every
     range, we will use the upper value in bounding, because then it's
     considered.  So we don't go to every specific valve that refers to CCDP. 
     We will take the highest value for this range.
         DR. APOSTOLAKIS:  So did you see a significant input?
         MS. DIMITRIJEVIC:  Of?
         DR. APOSTOLAKIS:  Of the inspection?
         MR. MITMAN:  No.
         MS. DIMITRIJEVIC:  We didn't see it.  We just saw
     ten-to-the-minus-six and ten-to-the-minus-nine.
         DR. APOSTOLAKIS:  So inspection did not help in any way.
         MR. MITMAN:  No.
         DR. APOSTOLAKIS:  So why are we doing all this?
         MR. RICCARDELLA:  It started out as negligible.
         DR. APOSTOLAKIS:  Why are we doing all this?
         MS. DIMITRIJEVIC:  We asked ourselves from the beginning
     this question a lot of times and basically the answer that I got most
     often is that so we take a look and we don't miss something.  But
     risk-wise, there is no justification for doing it.
         DR. KRESS:  It's defense-in-depth.
         DR. APOSTOLAKIS:  So in-service inspection can be dropped.
         DR. KRESS:  It's defense-in-depth.  There is large
     uncertainty in this area.
         DR. APOSTOLAKIS:  That's very good.
         MR. MITMAN:  They have a value impact analysis.
         DR. APOSTOLAKIS:  In the report, in several places, you say
     that the service experience to date provides a strong indication that
     the frequency of pipe ruptures is only very weakly correlated to the
     inspection processes.  So that's a general statement then.  Even if you
     use this more sophisticated approach, that's still true.
         MR. MITMAN:  That's true.
         MS. DIMITRIJEVIC:  Very true.
         MR. ALI:  This is Syed Ali from the staff.  I just wanted to
     clarify one thing.  When you say that the experience is that the
     in-service inspection has real flaws, that's basically related to the
     Section 11, ASME Section 11 inspections.
         Based on the actual experience that the plants had and the
     regulations actually followed, there are several augmented inspection
     programs, for example, for IGSCC and FAC, which have indeed found flaws.
         DR. APOSTOLAKIS:  Well, originally, I thought myself that
     this statement referred to experience, so ASME Code Section 11 didn't
     help us.  But now they're saying that even with this, they don't expect
     to see an impact, which is a very interesting conclusion.
         MR. MITMAN:  The methodology is there to help you decide
     where to do the ASME Section 11 inspections.  Now, we continue and we
     work with the augmented programs and there is a lot of value in
     particularly the FAC programs and the IGSCC programs.  But the ASME
     Section 11 required inspections, I think it's safe to say, we feel has
     very little impact on the safety of the plant.
         DR. APOSTOLAKIS:  But you are also saying that this thing
     does not have a significant impact, not just -- I want to make that
     clear, in my mind.  Not just the current Section 11.  But even if you do
     this methodology, which is more sophisticated, includes additional
     failure modes, it's hard to see an impact.
         MR. MITMAN:  That's correct.  Pat, you wanted to add
         MR. O'REGAN:  Pat O'Regan, from EPRI.  I just want to
     emphasize what Jeff said.  This methodology takes credit for and
     integrates the augmented inspection programs.  As Syed mentioned, IGSCC
     and FAC do actually have a substantial safety impact and we are taking
     credit for that.
         So the delta you're seeing is actually on the Section 11
     portion, not crediting the augmented programs.
         MR. MITMAN:  And Carl?
         MR. FLEMING:  George, with regard to the insights from
     service experience that back up this conclusion about the benefit of
     inspection, the underlying reason for that statement or that conclusion
     is that when we look at service experience, we find that we find piping,
     some small number of pipe failures and ruptures due to two general
     classes of failure mechanisms.
         The degradation mechanisms, some of which are actually
     amenable to inspection, and also we have loading conditions, like water
     hammer, vibration fatigue, over-pressurization, frozen pipes, things
     like that.  And if you look at the whole piping service experience, only
     a fraction of those failure mechanisms provide you enough warning time
     that a ten-year interval inspection process is going to give you an
     opportunity to prevent the failure.
         So that's one of the reasons for that conclusion.  A second
     reason --
         DR. APOSTOLAKIS:  Ten years is too long, you're saying?
         MR. O'REGAN:  No.  Some mechanisms don't give you warning
     times such that if you did an inspection today, you could prevent a
     failure tomorrow.  Then another basis for this insight is that a large
     fraction of the Class I pipe and Class II and III pipe out there isn't
     being subject to inspection.  The inspection programs that we do have
     from Section 11 are only looking at a small fraction, a small sample of
     the existing welds.
         So when we go out and look at the service experience, you
     find the vast majority of the pipe that produces the service experience
     has never been inspected for ASME Section 11 purposes, because the
     percentages are 25 percent for Class I, 7.5 percent for Class II, and so
         So these are some of the underlying reasons to support that
         DR. APOSTOLAKIS:  So just to close this.  In your opinion,
     is this a good idea or not?
         MS. DIMITRIJEVIC:  Is it a good idea to do these?
         DR. APOSTOLAKIS:  To inspect.  Not the EPRI approach.  I
     know this is a good idea.
         MS. DIMITRIJEVIC:  They don't inspect at all in the Section
         DR. APOSTOLAKIS:  What?
         MS. DIMITRIJEVIC:  Is your question, is it would they be
     able to inspect at all?
         DR. APOSTOLAKIS:  Yes.
         MS. DIMITRIJEVIC:  Well, we have a different opinion.  My
     opinion is no, but basically the people who -- because I am a PRA
     person.  The people who are actually engineers and who work on
     inspection, they think it's a good idea to take a look at what is going
         DR. APOSTOLAKIS:  Now, even for a PRA person, though, maybe
     your conclusion is based on the fact that you looked at core damage
     frequency and large early release frequency.  I mean, if one has other
     objectives, like I don't want to see any pipe breaks, that's my
     objective, then perhaps it would be a different conclusion, because we
     see that by the way the new oversight program, that the objectives now
     are spread all over the cornerstones.
         Would that change your conclusion?
         MS. DIMITRIJEVIC:  No.
         DR. APOSTOLAKIS:  Still it would not.
         MS. DIMITRIJEVIC:  No, because what Carl just mentioned, we
     don't claim the risk from pipe breaks is equal to zero or small.  What
     we are claiming what inspection does, that is negligible.  And where
     you're going to see the breaks, like vibration and everything,
     inspection doesn't do a thing.
         MR. MITMAN:  Pat, did you want to add something here?
         MR. O'REGAN:  Yes, just a point of clarification.  Pat
     O'Regan, from EPRI.  When we're talking inspections here, at least the
     discussion, it was just focusing on volumetric examinations.  We are
     still doing and still recommending doing leak testing and what service
     experience has showed us is that's where we find most of our leaks, not
     from the volumetric exams, but the leak testing.
         And even on a low risk location, that's still recommended to
     be done.
         DR. APOSTOLAKIS:  So if we were completely rational, we
     would keep doing those inspections, but we would drop this other stuff.
         MR. MITMAN:  I think rational, you'd probably want to go
     back and, at the very beginning of your design process, beef up your
     leak detection capability.
         DR. APOSTOLAKIS:  Okay.
         DR. SHACK:  I guess I'm not convinced that that would be
     true if you include the augmented inspections; that is, flow assisted
     corrosion and stress --
         MS. DIMITRIJEVIC:  No, we don't change anything.
         DR. SHACK:  You're from a PWR, where maybe, in your primary
     system, that probably is true.  That's a rather broad conclusion.
         MR. MITMAN:  You're absolutely right.  You want to continue
     to do the augmented programs.  It's very clear with the FAC program --
         DR. SHACK:  The augmented programs are, in many ways, much
     like this; that is, you're looking where you know you have a problem.
         MR. MITMAN:  Exactly.    
         DR. SHACK:  That's why it's augmented.
         MR. MITMAN:  And that's why this methodology blends very
     nicely with the currently existing augmenting programs, because of the
     similarities in the approach, where you're looking where you expect to
     find problems.
         DR. SHACK:  Without some random selection.
         MR. MITMAN:  Right.
         MR. RICCARDELLA:  Jeff, let me make a point on that. 
     Historically, what happened, and I think I said this like two years ago
     in this same group, is we had these ASME Section 11 requirements to do
     25 percent of Class I, ten percent of Class II, which we came up with
     those 20 years ago when we had very little operating experience.
         So as we went through the years and did that, those things
     didn't find much, but we did find problems and where we found problems,
     we implemented augmented programs.
         But what happened was the 25 percent type stuff never went
     away.  So we were inspecting more, but we're doing the augmented, plus
     we're doing this additional 25 percent.
         The attempt here is to integrate those into a single
     rational program that looks at the areas where we expect problems and
     doesn't look at the areas where we don't expect problems.
         MR. SULLIVAN:  This is Ted Sullivan.  I wonder if I could
     add a couple of points.  One of the reasons why I think traditionally
     in-service inspection has not found problems is because the inspection
     methods were not qualified until after a problem revealed itself.
         The Appendix 8 approaches, which we plan to adopt in the
     next revision of 50.55(a), should go a long way in resolving that.
         Another brief comment having to do with if we were
     completely rational.  I think being completely rational, I think we want
     to keep in mind defense-in-depth and that's part of the reason why the
     staff really wouldn't agree with a position that we should just look at
     this purely from a risk perspective and maybe only focus on the areas of
     augmented inspection.
         One final point.  I'm not sure that this came out explicitly
     in the presentations, I guess, last week to the ACRS on license renewal,
     but to some extent, license renewal is taking credit for Section 11 in
     the sense that there is a potential for degradation mechanisms to occur
     over the long haul and the inspection methods are supposed to be geared
     to using appropriately qualified techniques to be able to detect those
     degradation mechanisms should they arise.  That's another reason why I
     don't think we should take a view too strongly that we should just look
     at this from a risk perspective and possibly just rely on the numbers to
     say we don't need in-service inspection.
         DR. POWERS:  Could I understand better why you want to
     appeal the defense-in-depth here?  Why isn't this just completely and
     adequately resolved on a probabilistic basis?
         MR. SULLIVAN:  I guess there might be others that might care
     to answer from the staff, but I would say I don't think that we want to
     see failures occurring in piping just because the risk numbers say that
     we can handle those failures.
         DR. POWERS:  Thou shalt not have pipe failures.
         MR. SULLIVAN:  I think that's the whole defense-in-depth
     approach, which may sound circular.
         DR. SHACK:  The general design criteria call for the
     integrity of the reactor coolant system.
         DR. POWERS:  Yes, but it does not say thou shalt never have
     a pipe failure.
         DR. SHACK:  It's embedded in the whole regulatory system.
         MR. SULLIVAN:  There are places in the GDC that say
     extremely low probability.
         DR. POWERS:  I don't know, ten-to-the-minus-four,
     ten-to-the-minus-five is certainly what I would call extremely low.
         DR. APOSTOLAKIS:  But, also, let's make it clear that their
     conclusion is not based on the numbers alone.  I mean, it's the whole
     report and analysis that supports all that and the judgments and so on. 
     It's not that they got the number of ten-to-the-minus-five and say, my
     god, you know, this is insignificant.  It's the whole process that has
     led --
         DR. POWERS:  I will grant that.  What I want to understand
     is why -- I mean, very specific here.  We say we should look at and
     think about defense-in-depth, a very important concept in reactor
     safety.  Yet, this seems to be a topic that's susceptible to
     probabilistic analysis and I'm trying to understand why.
         MR. DINSMORE:  This is Steve Dinsmore, from the staff.  I
     guess I have to review a lot of this probabilistic analysis that come in
     regarding this stuff and the numbers are actually quite uncertain and
     one of the problems is when they say from experience data, they haven't
     seen much, there isn't that much experience to get
     ten-to-the-minus-seven, ten-to-the-minus-eight, statistical numbers from
     the experience data.  So they have to do some type of interpretations
     and Bayesian updates and engineering judgments to get the numbers which
     they are using to support this process.
         And even though you could say that the numbers indicate that
     if we stopped inspecting, there would be no great increase in CDF or
     LERF, the numbers that they're using, again, there is a lot of judgment
     in those numbers and there is not enough data to support them really at
     a statistical pace.
         DR. APOSTOLAKIS:  There are two things that come to mind
     from this comment.  First of all, I think if you want to defend
     defense-in-depth in this context, you have to tell us where the big
     uncertainties are that you just mentioned that perhaps could invalidate
     this conclusion.
         But second, I will come back to Carl's comment, that for
     most of these failures, you don't have enough warning time to catch them
     by inspection, which doesn't sound like a PRA argument, to me.
         That's really the physics of the problem.  So I inspect just
     to feel better.  That's really what is going on.  In the name of
         MR. ALI:  Syed Ali, from the staff.  Carl, correct me if I'm
     wrong, but I think the kind of mechanism that he was referring to that
     do not give you warning are loading type mechanisms, such as water
     hammer or fatigue.  But the mechanisms which are time-related,
     degradation type mechanisms, they do give you time and augmented, like
     IGSCC, erosion/corrosion.
         DR. APOSTOLAKIS:  But we're not referring to all the
     augmented programs.  Just this one.  We're not saying that we should
     drop other programs, right?
         MR. MITMAN:  First of all, I want to make something clear. 
     EPRI has not recommended that we drop all Section 11 inspections.
         DR. APOSTOLAKIS:  That's fine.  Other people might.
         MR. MITMAN:  You asked an opinion --
         MR. BARTON:  We'll deal with them when they come before us.
         MR. MITMAN:  You asked an opinion --
         DR. APOSTOLAKIS:  Let me tell you what's going on, because
     probably you think this is a discussion that -- we are facing a major
     problem now as to what the role of defense-in-depth should be in a
     risk-informed regulatory system.  That's why you're getting all this.
         That makes more sense now to you probably.
         MR. DINSMORE:  Could I just quickly respond to something? 
     When you asked me if the uncertainty doesn't or why we can't accept the
     results because of uncertainty, I would say we can accept the results of
     what EPRI is doing in spite of the uncertainty.  It's because of the
     uncertainty that we are -- that we can accept what they're trying to do
     and not say, well, you have to do even more or even less.
         DR. APOSTOLAKIS:  So what you're saying essentially is that
     their numerical assessment of the impact of this, which led them to the
     conclusion that it doesn't matter, is really not correct.
         MR. DINSMORE:  Probably not supportable.
         DR. SEALE:  They're not sure about that.
         MR. DINSMORE:  Not supportable from the statistical data.
         DR. APOSTOLAKIS:  But anyway, I think we've covered this
     enough.  At least for me.
         DR. POWERS:  I still haven't gotten an answer.  I may never
     get an answer.
         DR. APOSTOLAKIS:  That's my bet.
         MR. MITMAN:  I've put up a slide that's not in your package
     and it looks at each of the damage mechanisms and --
         DR. APOSTOLAKIS:  It's in the report, though.
         MR. MITMAN:  It's in the report, if I remember correctly.
         DR. APOSTOLAKIS:  Yes.
         MR. MITMAN:  But it's not in the presentation.  It shows
     each of the damage mechanisms and our calculated rupture frequency per
     the damage mechanisms.  There are two categories of those damage
     mechanisms, the dark ones and the light ones.  The light ones are those
     that we feel are not amenable to inspection, things like they include
     vibration, water hammer, unknown and other causes.
         DR. WALLIS:  Just for clarification.  Your rupture frequency
     is based on how many reactors?
         MR. MITMAN:  It's based on over 2,000 operating years of
         DR. WALLIS:  This is the total rupture frequency of all the
     reactor population.
         MR. MITMAN:  In the United States.  Yes.
         DR. WALLIS:  Otherwise, it looks pretty lousy.  If you
     multiply it by a hundred, it gets scary.
         MR. MITMAN:  Right.
         MR. FLEMING:  But these are on a per reactor year basis. 
     These are on a per reactor year basis.
         DR. WALLIS:  Per reactor year?
         MR. FLEMING:  Yes.
         DR. WALLIS:  No, it's not.  It's per a hundred reactor
         DR. APOSTOLAKIS:  Anywhere in the population.
         DR. WALLIS:  Anywhere in the population.  So I don't
     multiply by a hundred.
         DR. APOSTOLAKIS:  No, you shouldn't.  That's correct.  This
     is per calendar year anywhere in the United States.
         MR. FLEMING:  No.  This is per reactor year.
         DR. WALLIS:  So I multiply it by a hundred.
         MR. FLEMING:  This is for each reactor, on the average for
     each reactor, but it covers the entire plant.  It covers all the piping
     systems in the entire plant.  Only a small portion of this is in the
     safety-related systems.
         DR. APOSTOLAKIS:  You're right, because you had 1,511 total
         MR. FLEMING:  That's right.
         DR. APOSTOLAKIS:  Now it makes sense.
         DR. WALLIS:  So this is per reactor year.
         MR. FLEMING:  These are per reactor year, yes.  So you do
     multiply by a hundred.
         DR. WALLIS:  So I do multiply.
         MR. FLEMING:  Yes.
         DR. WALLIS:  Thank you.
         DR. APOSTOLAKIS:  But this is all pipes.
         MS. DIMITRIJEVIC:  All pipes, all sizes.
         DR. APOSTOLAKIS:  By the way, this number, which is in
     several places in the report, ultimately is not used.  Is that correct? 
     The ten-to-the-minus-two, I was looking very hard to find a place where
     you actually use it.  It's just an indication, but you don't really use
         MR. MITMAN:  It's part of the design basis of the
     degradation categorization and it is available to us if we need it to do
     the risk impact analysis.
         DR. APOSTOLAKIS:  Well, you can't really use it, though,
     because this is anywhere in the plant.  I mean, if you go to your pages
     3-1 and 3-2, then you have to specialize it.
         MR. MITMAN:  You're right.
         MR. FLEMING:  It requires further analysis.
         DR. APOSTOLAKIS:  Further analysis, right.  So right now
     it's not used.  In your calculations, ultimately, the
     ten-to-the-minus-two from there is not used and I think that should be
     made clear in the report.
         MR. FLEMING:  At this level, they are not used.
         DR. APOSTOLAKIS:  It is not.
         MR. FLEMING:  This is just a presentation of general
         DR. APOSTOLAKIS:  I understand.  It took me a while to
     figure it out.  It's not stated in the report that it's not used.
         MR. FLEMING:  But I think it's worthwhile -- it's just an
     intermediate step along the way towards breaking the data down so that
     we could confirm that these high, medium and low categories that were
     developed on the deterministic degradation mechanism basis do correlate
     to order of magnitude estimates of pipe rupture frequency, and that's --
         DR. APOSTOLAKIS:  I think in your viewgraphs you have the
     equations.  So maybe you can go to them right now.  Equations 3-1 and
     3-2, on page 3-8.  You didn't expect that, Jeff?
         MR. MITMAN:  We're ready.
         DR. APOSTOLAKIS:  Okay.  It says pipe break frequency, is
     that what it is, PBF?
         MR. FLEMING:  Yes.
         DR. APOSTOLAKIS:  This is page 3-8.  This is what you would
     -- you would need this number, which is really now segment-specific, to
     do the calculations.
         MR. FLEMING:  Yes.
         DR. APOSTOLAKIS:  Do you actually get a number like that? 
     In principal, I know you can get something.
         MR. FLEMING:  Yes.
         CHAIRMAN JACKSON:  You do?
         MR. FLEMING:  We had developed a number, segment-specific.
         DR. APOSTOLAKIS:  And it's discussed in the report how you
     do that?
         MR. MITMAN:  It's not discussed in this report.  It's
     discussed in a supporting document.
         DR. APOSTOLAKIS:  Can I have a copy of the supporting
         MR. MITMAN:  The staff already has a copy of it.
         DR. APOSTOLAKIS:  Okay.  We might have it already.
         MR. MARKLEY:  Which document are you talking about, Jeff?
         MR. MITMAN:  TR111880, which is in the references.  It's
     currently in a final draft, but the staff does have copies of that.
         DR. APOSTOLAKIS:  So then what you do is you take the
     ten-to-the-minus-two and you can see that the number of systems and you
     judge subjectively then, like we specialize the fire frequencies for
     critical locations.  You start with a building and slowly go down to the
         MR. FLEMING:  Yes.  And very briefly, what we do is we break
     the whole population of piping failure statistics up into PWR and BWR
     vendor groups.  We break the system populations into several system
     sizes and then we look at all the different failure mechanisms.  So we
     can look at it on a conditional segment base type of analysis.
         DR. APOSTOLAKIS:  So this is one of the major uncertainties
     that Steve Dinsmore probably referred to.  Say yes, Steve.
         MR. DINSMORE:  Yes.
         MR. FLEMING:  And by the way, I wanted to respond to what
     Steve said earlier about the uncertainties, because I agree in his
     comment to some extent, but I also wanted to clarify that.  We have done
     a detailed Bayesian uncertainty analysis of the attempts to make pipe
     failure rates and rupture frequencies from the service data and when you
     look at -- if you look at these results on an order of magnitude basis,
     on a logarithmic basis, you have very, very broad distributions that
     characterize large uncertainties, and it's a true statement, what Steve
         But if you try to take that and then develop a conclusion
     about what do those uncertainties say about the impact on risk, it's
     still possible to develop very robust conclusions that in spite of the
     large uncertainty, it's still a very, very small fraction of the risk.
         But there is one other -- but I think coming around to
     support what I think the -- and the concern about defense-in-depth is
     that these PRA calculations that we can do today based on looking at
     historical data, I think, are good for making current estimates of what
     we think the rupture frequencies are today, but we'd be on very shaky
     ground if we tried to project these 20, 30 or 40 years out into the
     future, and I think therein would lie the difficulty in trying to make
     conclusions about life extension without having some kind of way to keep
     monitoring possible trends in performance.
         Because we can't see the future in yesterday's data.
         DR. APOSTOLAKIS:  Now, in the report, you say something
     that's not quite the same as what Carl said a few minutes ago.  Right
     under equations 3.1 and 3.2, you say based on the expressions, they're
     using a conservative estimate of the total PBF frequency of
     ten-to-the-minus-two, where it calculates the CCDP and so on.
         So that's why I raise the issue.  When I read this, I
     thought, my god, they're using something that is a frequency of type of
     break anywhere to make judgments, and so the report perhaps is not
     written very well on that point.
         MR. FLEMING:  The sections you're looking at right now
     explain the logic in deriving the original matrix to start with and then
     back in Section 2, with the benefit of more detailed analysis of the
     service data, we took another look at that question and confirmed that
     the order of magnitude assessments were --
         DR. APOSTOLAKIS:  That's not here.
         MR. FLEMING:  If you get to Section 3-7, for example, you
     finally -- if a pipe is classified as having a medium rupture potential,
     it's one-times-ten-to-the-minus-four per year.
         DR. APOSTOLAKIS:  Right.
         DR. SHACK:  They sort of assign conservative pipe break
     frequencies based on essentially degradation mechanisms.  If it's got a
     high degradation mechanism, medium or low.
         MR. FLEMING:  But in Section 2 of the report, this other
     more detailed look at applying the service data to look at these
     calculations is presented and it confirms the order of magnitude
     assumptions that were originally made.
         DR. APOSTOLAKIS:  I'm talking about the specialization. 
     Section 2 is very general.  It doesn't say how you go down the system. 
     Section 2 is an analysis of the existing failures.
         MR. FLEMING:  Right.
         DR. APOSTOLAKIS:  I would have covered that.  And there is
     equation 2-1 that bothers me, too, on page 2-8.  The probability of
     rupture given failure.  I don't know what that means.  Page 2-8.
         MR. FLEMING:  That was a simple model that we used to
     analyze the service data for those failure mechanisms that have a strong
     leak-before-break characteristic.  We define failure as the whole
     package of failure modes, including small leaks and ruptures.
         So the model basically says we have a rupture frequency
     which is equal to the failure frequency times the conditional
     probability that it's a large failure.
         DR. APOSTOLAKIS:  So that's what is missing from the report,
     though.  I didn't see that.  So it wasn't clear to me what the
     difference between the rupture and the failure.
         MR. FLEMING:  The way we defined it --
         DR. APOSTOLAKIS:  A leak is a failure?
         MR. FLEMING:  A failure is any fluid going through the
     boundary, including a leak.  A rupture we defined at 50 gpm and larger
     flow areas.
         DR. APOSTOLAKIS:  That would have saved me a lot of time.
         MR. FLEMING:  Sorry.
         DR. APOSTOLAKIS:  Back to your presentation.
         MR. MITMAN:  Next, the next slide is on the pipe service
     experience, which we've already talked a little bit about.  There is
     over 2,000 reactor operating years of experience --
         DR. WALLIS:  You better put in the word reactor there, too.
         MR. MITMAN:  Fair enough.  In that database, there is 1,145
     events, 1,145 failures.  Here, failures are defined as either leaks or
     ruptures.  The vast majority, 1,076 of those were leaks.  Most of those
     were less than five gpm and most are due to corrosion mechanisms.
         Out of the total database, there are 69 events that were
     categorized as ruptures.  The failure mechanisms are well understood and
     the conditions necessary to produce the failures are generally known.
         DR. APOSTOLAKIS:  Now, where are the numbers, on another
         MR. MITMAN:  Which?
         DR. APOSTOLAKIS:  Table 2-2 and 2-1.
         MR. FLEMING:  They're consistent.
         DR. APOSTOLAKIS:  You said 1,100-something total failures
     and I don't see that here.  I see 1,500.
         MR. MITMAN:  If I remember correctly --
         DR. APOSTOLAKIS:  Oh, 1,145.  I'm sorry.  In the database. 
     Okay.  You have to look elsewhere.
         MR. FLEMING:  It's consistent.  It's confusingly presented,
     but it's consistent.
         DR. APOSTOLAKIS:  Speaking of that, what's the difference
     between the degradation mechanism and severe loading?
         MR. FLEMING:  Degradation mechanisms are degradation
     mechanisms like thermal fatigue, stress corrosion cracking that occur
     over long periods of time due to physical degradation mechanisms, where
     severe loading conditions are the imposition of loads in excess of the
     capacity of the pipe due to water hammer, impact, external impact on the
     pipe, frozen pipes, over-pressurization of the pipe beyond its design
     capacity and things like that.
         DR. APOSTOLAKIS:  So what you're saying is that in the
     severe mechanism, there was no aging mechanism acting.  It's just that
     you had the load that exceeded the design capacity.
         MR. FLEMING:  In the vast majority of cases.  Now, in
     principal, you can have a failure due to a combination of degradation.
         DR. APOSTOLAKIS:  That was my next question.
         MR. FLEMING:  But in the analysis of the service data, this
     was not evident.
         DR. APOSTOLAKIS:  So when you had the degradation mechanism,
     you didn't see any failures because there was degradation and then there
     was a load.
         MR. FLEMING:  We didn't see any evidence of that, although
     in principal, we know it's possible.  We didn't see any evidence of
     that.  The severe loading condition failures were, according to the
     reports that we analyzed, the loads were sufficient to cause the
         DR. APOSTOLAKIS:  So let's look at the rupture.  You say
     erosion/corrosion or flow accelerated corrosion, there were 18 ruptures,
     on table 2-1.
         MR. FLEMING:  Right, in large pipes.
         DR. APOSTOLAKIS:  So you're saying that these were due to
     the steady-state pressure in the pipe and you simply had deterioration.
         MR. FLEMING:  Yes.
         DR. APOSTOLAKIS:  Wow.
         MR. FLEMING:  Or if there was any variation --
         DR. SHACK:  EC will do that to you.
         MR. FLEMING:  Or if there was any variation to the loading,
     it was not of any -- it wasn't of any significance that was noted in the
     report.  There might have been some small pressure transient.
         MR. MITMAN:  Keep in mind this is Class I, II and III
     piping, not just Class I.
         MR. FLEMING:  It's the whole plant.
         DR. BONACA:  Do you make an analysis of the difference
     between the systems that normally run and systems that don't run?  The
     reason why that's an important question is that most safety systems are
     standby.  They don't run.
         MR. MITMAN:  Well, some of the damage mechanisms behave
     differently whether the system is running or not.  In our analysis, we
     go ahead and we look at operating conditions of the plant or of the
     system and of the portion of the system, and that helps us decide
     whether that segment is subject to the damage mechanism.
         DR. SEALE:  Could I ask a somewhat different question?  My
     impression is that one of the things that gets us off the hook on a lot
     of our concerns is the validity of the idea of leak-before-break.  Is
     that equally valid for what I will call degradation versus load-induced
         MR. MITMAN:  It's true for some of the damage mechanisms. 
     IGSCC, it is.  It's not true for FAC.  So it depends upon the damage
     mechanism, whether leak-before-break is valid.
         DR. SEALE:  But in general, you can't make a generalization
     that would say that load-induced failures are less likely to exhibit
         MR. FLEMING:  That's correct.
         MR. RICCARDELLA:  I think that's a true statement.
         DR. SEALE:  So the ones you're not -- that inspection
     doesn't help you with are the ones that are most likely to be severe
     immediately on occurrence.
         MR. FLEMING:  That's right.
         DR. SEALE:  Okay.
         MR. FLEMING:  And looking at your question from the service
     data standpoint is that we can look at this second parameter in that one
     equation, given the failure, what's the conditional probability that
     it's a rupture given a failure.  And looking at that parameter for the
     degradation mechanisms other than FAC, that number tends to be very low,
     on the order of a few percent, but for flow accelerated corrosion and
     the severe loading conditions, it tends to be much higher, water hammer
     events, over pressure events, which stands to reason, I think.
         DR. WALLIS:  I'm wondering if it's true that if inspection
     doesn't help you, I'm thinking of the fire-line break in Washington,
     where they had something like 17 water hammers they didn't pay any
     attention to and then the 18th broke the pipe, and probably this is
     because it's a loosened thing.  The other water hammers have loosened
     things up.  So paying attention to the history and inspecting would
     perhaps have prevented the failure due to sudden loading.
         MR. MITMAN:  I don't think we're trying to say that you
     should ignore what's going on in the system, but doing an ultrasonic
     inspection or volumetric inspection of a weld probably isn't going to
     keep you out of trouble with a water hammer.
         DR. WALLIS:  Something like a water hammer, minor water
     hammers have happened before in that component and no one has paid much
     attention maybe and then there is a big one.
         MR. MITMAN:  And that's one of the things we will discuss a
     little it later, is that we do take into consideration water hammer in
     our categorization of the degradation mechanisms.
         DR. BONACA:  Just to complete my thought.  I had a question
     before.  So you feel that that statement, failure mechanism, well
     understood, it's still applicable also for those piping by systems that
     don't run.
         MR. MITMAN:  Absolutely.
         DR. BONACA:  That's fully understood.
         MR. MITMAN:  Yes.
         DR. BONACA:  And for those, also, inspections doesn't have
     preferential value.
         MR. MITMAN:  That is correct.  In the database, there are 69
     rupture events where rupture is defined as greater than 50 gpm. Again,
     the failure mechanisms are understood.  Some of the mechanisms are not
     amenable to inspection.  There is only one event in the RCS and several
     events in steam water and feed water systems.
         EPRI has a program to periodically update the database, keep
     an eye on what's going on in the industry, and make sure that the
     methodology doesn't need to be revised.
         The next slide is an example of the deterministic criteria
     that we used to do the damage mechanism analysis.  In this particular
     example, we're looking at thermal --
         DR. APOSTOLAKIS:  Can I interrupt?  Because I have to go
     somewhere at 10:00 and I have a couple of questions that jump ahead and
     I wanted to ask them.
         You didn't really expect that we would let you finish your
     presentation the way you have prepared it.
         Would you go to your slide 19?  Consequence ranking
     criteria.  Now, the conditional core damage probability, this is
     calculated as shown in one of the equations here as the new CDF,
     assuming the system is down, minus the baseline, times the exposure of
     time, and the exposure of time can be anywhere from a year to maybe a
     few days.
         Now, as far as I know, the NRC does not have and nor does
     the industry criteria as to what's high or low with respect to the
     conditional core damage probability, except for temporary outages, where
     they give a ten-to-the-minus-seven number.
         So where did the ten-to-the-minus-four come from?  The
     ten-to-the-minus-four is used for the core damage frequency, not the
     core damage probability over a period of three months.
         MS. DIMITRIJEVIC:  This was this equation three you just
     asked us about, CDF.
         DR. APOSTOLAKIS:  Yes.
         MS. DIMITRIJEVIC:  Where as that equation?
         DR. APOSTOLAKIS:  There were two equations on page 3-8.
         MS. DIMITRIJEVIC:  Yes.
         DR. APOSTOLAKIS:  But it doesn't --
         MS. DIMITRIJEVIC:  It tells you that that was very
     conservative, assuming the --
         DR. APOSTOLAKIS:  But I don't know whether it's
     conservative, is it?
         MS. DIMITRIJEVIC:  If you look in the explanation after,
     because if you assume that we are going to look in every location and
     segment, if we assume that we're going to have a thousand segments at
     the top of a plant, it's ten-to-the-minus-two, which we think is a
     conservative estimate.  Then ten-to-the-minus-two for pipe failure
     frequency, times ten-to-the-minus-four, will give you
     ten-to-the-minus-six CDF, which corresponds to that failure for CDF.
         MR. FLEMING:  So it was derived from a CDF limit and working
     backwards to come up with a conservative estimate of what that would
         DR. APOSTOLAKIS:  So if I don't do anything for a year, then
     you say the NRC's goal of ten-to-the-minus-four per year times one year
     becomes a probability.
         MR. FLEMING:  No, no, no, no, no.
         MS. DIMITRIJEVIC:  The frequency CCDP here is conditional
     given pipe failure.
         DR. APOSTOLAKIS:  I understand that.  That's why I'm --
         MS. DIMITRIJEVIC:  So we take the five FAC yearly frequency
     and we say the worst we can have is five yearly frequency of
     ten-to-the-minus-two if every segment is in the high risk area.
         DR. APOSTOLAKIS:  Okay.
         MS. DIMITRIJEVIC:  And then ten-to-the-minus-two per year
     times ten-to-the-minus-four is ten-to-the-minus-six per year.
         DR. APOSTOLAKIS:  But where did the ten-to-the-minus-four
     come from?  That's my question.
         MS. DIMITRIJEVIC:  Well, we selected that so that we get
     that ten-to-the-minus-six per year.
         DR. APOSTOLAKIS:  You selected it.
         DR. SHACK:  Took ten-to-the-minus-six and divided by
         MS. DIMITRIJEVIC:  That's it.  We took the
     ten-to-the-minus-six and divided it by ten --
         DR. APOSTOLAKIS:  And they did it correctly.  Where did the
     ten-to-the-minus-six come from?
         MS. DIMITRIJEVIC:  That came from the NRC criteria of
     ten-to-the-minus-six not allowing any changes and things like this, Reg
     Guide 1.174.
         MR. FLEMING:  Which we anticipated before it was published.
         MS. DIMITRIJEVIC:  It's very conservative because that means
     they actually accept changes, but we still have a medium region.
         DR. APOSTOLAKIS:  So the delta CDF -- actually, it
     ten-to-the-minus-six is negligible.  Ten-to-the-minus-five was even
         MS. DIMITRIJEVIC:  So that's why I say we are very
     conservative, because of uncertainty, we said, okay, everything which is
     ten-to-the-minus-six we're going to look at, that's our basis.  And we
     say even in ten-to-the-minus-six, we're still going to take a little
         DR. APOSTOLAKIS:  The report could have been written a much
     better way.  I really tried to understand it and, boy, every sentence is
     loaded with --
         MS. DIMITRIJEVIC:  Meaning.
         DR. APOSTOLAKIS:  With meaning, yes.  I mean, Carl had to
     explain a few things, you had to explain a few things.  Anyway, that
     makes sense.  What you just said makes sense.  But it's not easy to
     understand that from this.
         DR. WALLIS:  Are you suggesting a report in which the
     sentences were loaded with less meaning would be better?
         DR. APOSTOLAKIS:  Yes, because then you would have more of
     those and it would be easier.  The total sum would be the same.
         If I have to spend three-quarters of an hour understanding
     each sentence, that's a pretty thick report, that doesn't help.  There
     was a whole rationale that Vesna just gave us that is not evident from
     this paragraph.  That's what I'm saying.
         DR. SHACK:  Right.
         MR. MITMAN:  You wanted to ask additional questions?
         DR. APOSTOLAKIS:  Gee, now you're catching me.  Oh, yes.  A
     general question.  You used the word "easy" earlier.  Now, I must say
     this business of the trains and giving a worth of one-half and all that,
     why is that easier from having your PRA, your PC, and saying, you know,
     put this down, get the new number.
         I mean, we have the software now that does these
     calculations very quickly and get conditional core damage frequencies. 
     And to go through this exercise of deciding the worth of each train and
     going through -- in other words, you are redoing part of the PRA.  What
     is the reason for that?
         MS. DIMITRIJEVIC:  I will tell you why it was designed.  It
     was designed so that people who are not PRA analysts can come up with --
         DR. APOSTOLAKIS:  But they have to do PRA-type analysis,
     Vesna, anyway, because they have to look for trains that will save you.
         MS. DIMITRIJEVIC:  That's true, but they have to -- and they
     can be provided with them in the beginning and then they can do the
     analysis.  But if you really know PRA, which can be done fast, if you
     know something --
         DR. APOSTOLAKIS:  You don't really have to know PRA, you
     don't have to be a PRA analyst to use it.  You have your PC and you do
     your sensitivity calculations.  Otherwise, if you know nothing --
         MS. DIMITRIJEVIC:  Let me give you two reasons to let you
     even forgetting that PRA, in my opinion, really don't run them fast yet. 
     It always takes some time.
         But independent of that, let me tell you what's the main
     reason.  When you run the PRA, you come with a number.  It gives you a
     number, but it doesn't tell you what it is and why it is.
         When you look in this, you know exactly why and what's
     happening and it really helps you to understand the heart of this.  We
     went in the heart of the PRA.  So they know that this is -- if they have
     this pipe failure, that this is because they are HPSI is going to know
     how -- instead of getting the number three times putting
         We thought they would be more valuable for analysts to
     understand why are some failures and the other thing is also we have to
     rank the initiating events.  So we can really use importance measures
     for that.
         We thought that it will give more insight and will help
     people who are not PRA analysts do this estimate.
         DR. APOSTOLAKIS:  That's the right word.  But, Vesna, I
     think you have a valid point there, that you shouldn't really get a
     number alone.  But it seems to me you can easily get those insights from
     a good PRA, because a good PRA doesn't give you numbers only.
         MS. DIMITRIJEVIC:  You can look at sequences.
         DR. APOSTOLAKIS:  It gives you the sequences, the minimal
     cut sets and so on.
         MS. DIMITRIJEVIC:  Yes.
         DR. APOSTOLAKIS:  And maybe you can develop a small software
     package to compliment what you already have to get these insights.  But
     this reluctance on the part of the industry to say PRA is useful and we
     will do things using the PRA is a mystery to me.  It's mystifying.
         MS. DIMITRIJEVIC:  The one thing which I have to say is the
     misconception that this method doesn't use PRA, it uses it very well.
         DR. APOSTOLAKIS:  Of course it does.
         MS. DIMITRIJEVIC:  And uses it perfectly, in my opinion,
     because it's break is what actually PRA is all about and shows exactly. 
     So it shows the safety function, it shows you backup trains, it shows
     you the sequences.  So it's basically really uses PRA.
         It doesn't use it as being -- it gives you the importance
     measures and things like that, but that is what PRA is all about.  So,
     therefore, PRA is very -- and I did a lot of analysis.  You can believe
     me that this really makes it very easy and clean-cut. You look in the
     PRA, you see there the success criteria, you put the safety functions
     diagrams, you look in there, the ability of the trains and their
     initiating events and there you are.
         Then you have ten pages and you can just run through the
     events very nicely.
         DR. APOSTOLAKIS:  Who did that?  Did a guy with no
     experience with a PRA actually figure out what are the trains that are
     available and gave the weights?
         MS. DIMITRIJEVIC:  No.  That was -- that's done with the PRA
     specialist.  But once when you have them, everybody can do the analysis.
         DR. APOSTOLAKIS:  And this is an analysis you do only once,
         MS. DIMITRIJEVIC:  Yes.
         DR. APOSTOLAKIS:  It could be done off-line by somebody who
     knows something about the PRA.  It's not that you are asking your
     average --
         MS. DIMITRIJEVIC:  No.
         DR. APOSTOLAKIS:  -- doing this every month.
         MS. DIMITRIJEVIC:  It's always done with the people who know
         DR. APOSTOLAKIS:  I am really mystified by this reluctance
     to say we now have the PRA, here is what you can do with it, here is
     what you need for this kind of analysis, here is a way to get it. 
     Instead of doing that, we're saying we'll develop these mysterious
     tables, that give a wroth of .5.  I don't know how to do that.
         MS. DIMITRIJEVIC:  Well, because we are working in actually
     in the intervals, not with the actual number.  We do have a section on
         DR. APOSTOLAKIS:  And I don't even know what the train is
     sometimes.  You're asking a poor guy to make all these judgments when
     the PRA has already provided you with answers.  I'm not saying that what
     you did was incorrect, but I'm just mystified by this reluctance on the
     part of the industry to say here is a tool that's useful, let's use it,
     and not try to dance around it all the time.
         And, my god, if we ever demand a PRA, it's a major crime.
         MS. DIMITRIJEVIC:  We added it --
         DR. APOSTOLAKIS:  I've made my case.
         MS. DIMITRIJEVIC:  But we did it add it in our report
     section 3.36, which tells you really how PRA --
         DR. APOSTOLAKIS:  Page?  I always give you the page.
         MS. DIMITRIJEVIC:  Page 3.32.
         DR. APOSTOLAKIS:  3.32.
         MS. DIMITRIJEVIC:  Yes.
         MR. FLEMING:  I want to just augment something, if I may, on
     what Vesna just said.  I think there may be a little bit of
     misunderstanding here.
         It is the role of the PSA analyst to figure out these train
     relationships and that is only for a qualified PRA analyst to do. But
     the idea here was to give the piping engineer a tool that he could put
     segments on the risk matrix without himself doing the PRA calculations
     to put them on the matrix.
         And since it didn't require him to come up with a numerical
     estimate, just to figure out which of the bins to put it in, which are
     four decades wide, there was a question of whether you want to use a
     surgical instrument or a screwdriver to do the appropriate tests.
         DR. APOSTOLAKIS:  Well, all right.
         DR. SEALE:  Can I ask a related question?
         DR. APOSTOLAKIS:  Am I going to say no?  Go ahead.
         DR. SEALE:  You have here an application of a PRA and it's
     clear in coming up with your simplified algorithms that consciously or
     unconsciously, you're responding to the fact that not all PRAs are
     equal.  There is another effort going on, quite separate from this, that
     the Commission has a commitment to, and that is the development of
     criteria for what constitutes an adequate PRA.
         I'm going to ask the staff.  Do you guys who find these
     kinds of applications for PRAs talk to those guys who are worried about
     what constitutes an adequate PRA?
         MR. DINSMORE:  This is Steve Dinsmore.
         DR. SEALE:  You've got your hat in both rings.  But you see
     the question.  I mean, clearly, there are other applications like this
     where people are using PRAs and there is not necessarily that nexus made
     to this other effort, which is supposedly graduating the level of the
     PRA, the product, to what we would hope would be the workable all things
     for all people version.  It's just a caution.
         MR. DINSMORE:  Okay.
         DR. APOSTOLAKIS:  Mr. Fleming, by the way, is intimately
     involved with that effort.
         DR. SEALE:  Okay, fine.  Fine.
         DR. APOSTOLAKIS:  But it's a more general comment that I
     wanted to make.  Every time we see something, for heavens sake, let's
     not ask them to use a PRA.  So we go out of our way to produce tables
     and things, like the five methodology, again, PRA, my god, no tables. 
     People are not stupid and finally --
         DR. SEALE:  You only get there, though, if you make the
         MR. MITMAN:  Another thing to keep in mind is this
     methodology was started back in '92-'93 and the capabilities of the
     machines and the capabilities of the codes and the PRAs isn't what it is
     today.  And if we started today, we might do it differently.
         DR. APOSTOLAKIS:  Or you wouldn't do it at all, based on
     your conclusions.  If somebody took defense-in-depth away, you wouldn't
     do it at all.
         MR. MITMAN:  We would discuss it with the appropriate
     industry --
         DR. APOSTOLAKIS:  I understand that, yes.
         MR. MITMAN:  -- bodies and see what we would come up with.
         As we were saying at slide 14.  Slide 14 shows some of the
     damage mechanism attributes that we use to determine whether a weld
     segment is susceptible to those damage mechanisms.
         What we're looking at here is thermal fatigue and some of
     those damage mechanisms that are there.  Deterministic rules that we
     apply to determine whether the segments are susceptible or not.
         DR. WALLIS:  I was looking at the bottom there.  You don't
     often inject cold fluid in the hot pipes, so in infrequent even which
     will lead to fatigue, but there are sometimes situations where cold is
     somewhere close to hot and there are circulation patterns set up which
     are unstable and a piece of piping is bathed in hot, cold, hot, cold,
     over a long period of time, and that's a classical thermal fatigue
     mechanisms.  I don't see it here.
         MR. RICCARDELLA:  That's what we call tasks.
         DR. WALLIS:  That's what you call tasks?
         MR. RICCARDELLA:  Yes.  Tasks is thermal --
         DR. WALLIS:  Maybe I didn't -- okay.
         MR. RICCARDELLA:  -- and stratification --
         DR. WALLIS:  It's rather hard to figure out, as I remember,
     and sometimes it happens, sometimes it doesn't.
         MR. RICCARDELLA:  But we've looked -- EPRI has done a very,
     very large study on tasks.  They had a task force to put together a
     large thick report, and we've gone through that and we've attempted to
     come up with some conservative rules that if you have any of these
     conditions, we say it's susceptible to thermal fatigue.  All of these
     are very conservative.
         It's not often that a delta T of 200 or 150 is going to
     cause you a problem.  But if there is even the potential that a system
     could get a delta of that much, we say it's potentially thermal fatigue
         Now, we could go in with a finer screen, and sometimes we
     do.  It's no good to prioritize if everything comes out.  So if we get
     too many locations, then we'll go in with a finer screen and find out
     what the actual delta T is.
         DR. WALLIS:  So this is a case where one could call
     understanding of the thermal hydraulics is important to risk assessment.
         MR. RICCARDELLA:  To selecting in-service inspection
         DR. SHACK:  Whether that's important to the risk assessment
     is another question.
         DR. WALLIS:  Well, presumably it is.  If you don't -- if
     there is some physical mechanism which you completely ignored which can
     break a pipe, then it can seem that that's important to the risk and
     whether you assess it or not is perhaps up to you as a responsible
         MR. RICCARDELLA:  Yes.  Well, part of what you're getting at
     is the reason for this performance monitoring feedback loop; that if
     there is some mechanism that we've just forgotten about or didn't know
     about and it occurs in one plant, then it's going to work its way into
     our methodology and will be picked up.
         MR. MITMAN:  The outcome of the damage mechanism assessment
     is categorization into three categories, high, medium and low.  Where we
     end up is to get into high, you have to have flow accelerated corrosion. 
     Medium is any other damage mechanism and if there are no damage
     mechanisms present, then that gets you into low.
         Now, there is one caveat with this.  It doesn't show on this
     slide.  It's discussed in the report.  That is, there is another way to
     get into the high category, which came up in earlier discussions, and
     that is if you have another damage mechanism, plus water hammer.
         So if you've got some degradation of a pipe due to MIC and
     you know that the system is subject to -- is susceptible to water
     hammer, that would also put you into the high category.
         In practice, what we see happening most of the times is if a
     system is susceptible to water hammer, most plants will go out and try
     and resolve the question on water hammer, which would drop it back down
     into the medium category.
         DR. SHACK:  I would assume that water hammer would -- if
     it's susceptible to water hammer, it's high, degradation or no
     degradation mechanism.
         MR. MITMAN:  It would be high, but you can inspect all you
     want with volumetric inspections and you're not going to find water
         DR. SEALE:  Okay.  These are for leaks then.
         MR. MITMAN:  This is leak --
         DR. SEALE:  For inspection, I beg your pardon.
         MR. MITMAN:  The whole methodology is to help you decide
     where to do your volumetric inspections per Section 11.
         DR. SEALE:  So in general, that's why load-induced failures
     don't show up here.
         MR. MITMAN:  That's right.
         DR. SHACK:  We were scheduled for a break at ten and since
     we're about to go to the consequence, maybe this is a good time to do
     it.  Does that seem reasonable?
         MR. MITMAN:  That sounds reasonable.
         DR. SHACK:  A 15-minute break then.
         DR. SHACK:  I guess we have enough members back, so that we
     can resume the meeting.
         MR. MITMAN:  Okay.  We want to start in on the consequence
     analysis at this point.  The first thing we do is there are four types
     of -- four considerations that we have when we go into the consequence
     analysis.  We're looking at initiating events, events that affect the
     mitigating ability of systems and trains, both from a loss of the system
     or train or degradation of the system or the train.
         We're looking at containment effects, both loss and
     degradation of containment, and then we also look at combination events,
     something that will affect both a mitigating system and containment or
     could be initiating event and affect a standby safety system also.
         We've seen this slide already.  The consequence ranking is
     -- there is a four-tier consequence ranking, high, medium, low, and not
     shown here is none.  There is -- none is the easiest to deal with. 
     There are a couple of abandoned in-place piping systems that we've found
     here and there that have no consequence whatsoever on the analysis, and
     that's why they show up on the matrix.
         The high category is conditional core damage probability
     greater than 1e-to-the-minus-four and conditional large early release
     probability of greater than 1e-to-the-minus-five.
         These are severe initiating events or severe loss of
     mitigation capability or high risk of containment bypass.  Medium
     category is conditional core damage probability, greater -- greater than
     1e-to-the-minus-six, but less than 1e-to-the-minus-four.  It should be
     less than or equal to.
         Also, conditional large early release probability between
     1e-to-the-minus-seven and 1e-to-the-minus-five, and these are moderate
     type events.
         Then on the low side is conditional core damage probability
     less than 1e-to-the-minus-six and conditional large early release
     probably less than 1e-to-the-minus-seven.
         These are for mild type events.
         DR. SHACK:  Again, I guess I asked this question before, I
     mean, you -- when I look at this guideline for assigning the consequence
     category, there is some sort of generic PRA that decides that when I
     have one unaffected backup train, that I'm in the
     ten-to-the-minus-four/ten-to-the-minus-five category, and it's high.
         The guy doesn't actually do that calculation.
         MR. MITMAN:  Initially, it's generic.  The tables were set
     up generically, but the expectation is that the plant will recalibrate
     those tables with the plant-specific PRA.
         DR. SHACK:  And they will bend it this way, then.
         MR. MITMAN:  This is the criteria for bending it and you may
     -- if you go to South Texas, with a three-train system, you'll probably
     move everything to the --
         MS. DIMITRIJEVIC:  Medium.
         MR. MITMAN:  Yes.  Everything will drop down to medium
     instead of having it in the high category.  But, yes, you do that
     plant-specific calibration.
         DR. SHACK:  What it could mean is that for some plants with
     one and a half backup trains, you could be in the medium instead of the
     high for some very plant-specific reason.
         MR. MITMAN:  Yes.  You could have some susceptibilities or
     some weaknesses in the plant design.
         MS. DIMITRIJEVIC:  You could have a different number of
     backup trains and the load would be different.
         MR. DINSMORE:  This is Steve Dinsmore, from the staff.  Our
     understanding is that the table won't change, because we're going to be
     moving the table.  What will change is the number of trains that they
     can take credit for.
         If they have two HPSI trains, but, again, if it was
     ten-to-the-minus-three, in one plant, they can only credit one and a
     half trains.  In another plant, maybe because it's better designed,
     they'd be able to credit it two trains.
         DR. SHACK:  So the table stays the same.
         MS. DIMITRIJEVIC:  The same.
         DR. SHACK:  It's how you credit --
         MR. MITMAN:  The number of trains.
         DR. SHACK:  -- the number of trains.
         MR. MITMAN:  The remaining tasks in the methodology, we'll
     go in and do segment risk categorization, selection of inspection
     locations, selection of the appropriate inspection techniques.  We do a
     risk impact assessment.  We document and finalize the project, put
     together the submittal, and then there is a performance monitoring where
     we have a long-term process to monitor the plant and also EPRI will
     continue to monitor the industry to make sure that there is no new
     mechanism that appears or an increase in the frequency of a degradation
     mechanism because of aging effects that we haven't seen yet.
         DR. SHACK:  Now, one of the things that the WOG ASME thing
     does that doesn't seem to come in here is they make an effort to
     estimate the leakage, also, as well as the failure, and their goal was
     essentially to maintain the leakage rates about what they've observed.
         That doesn't seem to be -- that's nothing you're addressing
         MR. MITMAN:  We are not trying to calculate any leakage
     rate.  What we essentially see, if you go back and look at the risk
     matrix, the medium category tends to be those damage mechanisms, medium
     category here tends to be those damage mechanisms that typically leak.
         The only way you're going to get into -- or getting into
     high, you tend to have a damage mechanism that can fail on your, can
     have a large rupture.  So that's probably the only place that the
     leakage rate figures into the analysis.  But we're not trying to --
         DR. SHACK:  You don't have a target leak rate for --
         MR. MITMAN:  No.
         DR. SHACK:  In a general sense, who ends up with more
     inspection locations following which process?
         MR. MITMAN:  I think we end up with --
         DR. SHACK:  With more.
         MR. MITMAN:  No.  We end up about the same.  About the same.
         MS. DIMITRIJEVIC:  We don't really know.
         MR. MITMAN:  Well, we've looked a little bit at Surry,
     comparing Surry to the work we've done, and I think if you look at
     what's done on Surry and what's done on -- what's coming out of the
     ANO-2 analysis and the Fitzpatrick analysis, that they're approximately
     the same order of magnitude of inspections.
         MR. ALI:  This is Syed Ali from the staff.  Just to clarify. 
     Although the comparison is really not valid because one is a PWR, Surry
     is a PWR, and some of the ones you have done are BWR.  But for Class I,
     this methodology, the EPRI methodology, the sample size went down from
     25 percent in ASME-11 to about ten percent, whereas the Westinghouse
     methodology is about six and a half or seven percent.  So that's the
     order of magnitude difference.
         MR. MITMAN:  Okay.  The next step in the methodology is to
     do the risk evaluation.  At this point, we have completed the
     degradation analysis and the conditional -- or the consequence
     evaluation and that allows us to bend the segments into the appropriate
     boxes on the matrix.
         DR. SHACK:  Another question.  You're also building 0313
     into this also, aren't you?  In the sense that that's how you bend
     things into high, medium and low.
         MR. MITMAN:  At this point, 0313 is -- we're only building
     in the category A 0313 welds for IGSCC.  We feel and it's part of the
     evaluation that's going on now with BWRs that with a category A weld,
     that we can justify that we need no additional inspection beyond what
     the risk-informed process is requesting.
         Now, there is a dialogue, a discussion and some analysis
     going on in the industry to revisit 0313 and that's not part of the
     methodology right now.  However, the methodology is set up so that if
     and when that happens, we'll be able to take advantage of it.
         One of the big concerns that we've addressed in the last
     year or so was to take a harder look at the risk impact of the analysis
     and that's -- well, once we've done the element, the risk-ranking and we
     go out and do element selection and then we go ahead and look at
     inspection for cause and decide what methodology should be looked at in
     the various segments.
         One of the questions that was asked earlier in the
     discussion that we have deferred was what do you do with the segments in
     the low categories and the methodology calls for no inspections in those
     low risk regions.
         You should keep in mind here that that's not to say we're
     not doing any inspections on the systems.  We continue to do inspections
     in the medium and the high risk regions of those systems and we haven't
     found any systems yet where we're recommending doing no inspection.
         In addition to that, we continue to do the augmented
     inspection for FAC, IGSCC and whatnot.  So it's not like we're walking
     away from large segments of the plant and not performing any assessments
     for those.
         DR. SHACK:  And, again, you're doing leak tests.  Everything
     but volumetric inspection.
         MR. MITMAN:  And we continue to do leak tests on all Class
     I, II and III.
         MR. RICCARDELLA:  Another aspect of that, too, is if you
     look at the lower right-hand corner, things with low or essentially no
     degradation mechanism identified, we still are inspecting some subset of
     those, because some of them do fall over into the medium category.
         If they have a high failure consequence potential, then they
     do get a medium and we see that we do a lot of category four -- there
     are category four inspections.  So it's not like we're ignoring things
     just because we haven't identified any mechanism.
         MR. MITMAN:  Now, in the earlier -- in the beginning slides,
     we talked about the two code cases that apply here, N-560 for Class I
     only and N-578, which applies to the full plant.  This is the one place
     where we come up with a slight distinction between how you select welds
     and elements between the two code cases.
         In N-578, we do 25 percent of the high risk category
     elements.  In the medium risk category, we do ten percent.  In the low,
     we do none, no volumetric inspections.
         In N-560, we start at the category one, category here, and
     start going and applying welds, looking at welds and adding them to our
     list.  But when we get approximately to ten percent, then we'll pull up
     and stop.
         In practice, what we see is we don't do all the high
     category welds.  We do -- for instance, if we have a BWR with four steam
     lines and we have four welds on each of the steam lines, we might take
     half of those welds, so we capture representative inspections for all of
     the steam lines and then save some of those other inspections for other
     places in the Class I system, so that we get a more representative and a
     better, broader perspective of what's happening in the Class I system.
         DR. SHACK:  Now, the description in the report actually says
     it's considered more prudent, but there is nothing that says you have to
     do it that way.
         MR. MITMAN:  To do it?
         DR. SHACK:  To split your ten percent.
         MR. MITMAN:  It's a very strong recommendation.  To date,
     EPRI has been involved with all the applications of this methodology and
     we very carefully ensure that it's not being misapplied.
         DR. SHACK:  Why isn't there just a step that says do some of
     them, 25 percent?
         MR. MITMAN:  Didn't want to get too prescriptive, wanted to
     be able to use engineering judgment and a little bit of flexibility to
     decide exactly where to get those ten percent.
         Pat, you wanted to add something?
         MR. O'REGAN:  Pat O'Regan, EPRI.  One of the reasons we
     didn't want to be too prescriptive is there are other considerations
     that go in when you select locations, such as high rad areas and
     accessibility and stuff like that.  We wanted to make sure that still
     carried weight when we went through the element selection process.
         MR. MITMAN:  One of the last steps we do is to do a risk
     impact assessment.  The process itself was designed as a risk-informed
     process.  So there are risk considerations taken into account from the
     beginning.  The risk impacts are -- we see risk impacts in three areas.
         Allocation of inspections at the high risk locations, we
     have inspection for cause impacts, and we have impacts from elimination
     of inspections in the low risk segments.
         The risk assessment process is a three-tiered process,
     essentially.  Initially, we want to eliminate as much quantitative
     analysis as is appropriate and we bring to bear some qualitative tools
     to do that.
         If we have regions that are -- if we have low risk regions,
     we can qualitatively show that it has no impact on -- no unacceptable
     impact on risk.  If we're doing -- if we're increasing the number of
     inspections, we can qualitatively show that we have a positive or an
     improvement in the risk consequences.
         So first of all, if we want to do the qualitative analysis,
     and we can do that in most cases.  Where we can't, we want to go ahead
     and apply some bounding estimates to help us decide that the risk
     impacts are acceptable.  If the bounding estimates are not sufficient,
     then we bring to bear realistic quantitative analysis to help us assure
     ourselves that we're having appropriate impact on risk
         DR. SHACK:  It seemed to me that it was almost a "gimme" if
     I believed your -- that one-times-ten-to-the-minus-four was really a
     bounding CCDP for a medium risk thing, that I was almost set up to get a
     controllable delta C-P, because I'm looking at the important stuff and
     I'm neglecting the unimportant stuff, and I'm just going to get the
     answer to come out.
         I guess the question is, can I really be confident that the
     one-times-ten-to-the-minus-four is a bounding CCDP for a guy with a
     medium classification, a two-train system with anticipated transients
         MR. MITMAN:  I think so, yes.
         DR. SHACK:  For all plants?  I guess that's the part I have
     a little trouble with.
         MS. DIMITRIJEVIC:  What's plant-specific is -- you want to
         DR. SHACK:  For the plant-specific part is how I credit the
     two trains.
         MS. DIMITRIJEVIC:  How many trains you have, yes.  Yes.
         DR. SHACK:  And so I guess the answer is if I have two
     credited trains, am I always guaranteed that
     one-times-ten-to-the-minus-four is a bounding estimate.
         MS. DIMITRIJEVIC:  You're going to be -- yes.  You could be
     a little -- I mean, we cannot really guarantee always, because sometimes
     it happens that you're 1.1 because of these estimates,
     ten-to-the-minus-four or something in the medium.  But you are very
     inside this.  It is not going to be higher than 5e-minus-four.
         DR. SHACK:  Guarantee is a strong word to use in a PRA,
         MS. DIMITRIJEVIC:  That's true.  The best of our knowledge. 
     The best of our knowledge, yes.
         MR. MITMAN:  Pat, you want to add something?
         MR. O'REGAN:  Yes.  Maybe a point of clarification.  Pat
     O'Regan, from EPRI.  The methodology is set up that if you assign to
     medium, you'll always be less than ten-to-the-minus-four.  If you have
     two trains in the plant, there is no guarantee that you'll always be a
         DR. SHACK:  If I have two qualified trains and the matrix is
     approved, then I'm going to be a medium.
         MR. O'REGAN:  If you have two qualified trains, that's true.
         MS. DIMITRIJEVIC:  Yes.
         MR. O'REGAN:  But if you have two turbine-driven pumps, that
     may not qualify.
         DR. SHACK:  That's different, right.
         MR. O'REGAN:  So you may be a high.  But the criteria always
     is set -- the criteria is set in stone.  It's just a question of whether
     the plant could meet the criteria or not.
         MR. MITMAN:  One of the discussions earlier today was a
     discussion about questions about supporting documentation and where more
     of the analysis is shown.  These are most of the published reports that
     we've published to date on the methodology.  Most of those are
     proprietary reports, but we can make the necessary -- we can make them
     available for the ACRS to look at.
         MR. FLEMING:  I wanted to reflect back on the last question. 
     With regard to the potential issue about how robust are these
     conclusions, the battle lines for this argument really are down at the
     boundary between medium and low, because the way in which we do our
     delta risk evaluations, we entertain the need to do some quantitative
     bounding estimates if we're in the medium or high risk regions and we're
     suggesting a reduction in the number of locations that are eliminated.
         So the question about robustness really gets down to between
     the medium and low region.  That's where the potential issue would exist
     and at that level, we're another two orders of magnitude down the risk
         MS. DIMITRIJEVIC:  And an ideal medium region is to escape
     those boundaries.  This is why we introduced this medium region.  So we
     don't have to have a clear cut between high and low.
         MR. FLEMING:  So what I'm saying is that if, for example,
     for some error or uncertainty in analysis that a category that belonged
     in the high region was miscategorized in the medium region, our delta
     risk procedure would still catch that, because if we ended up in this
     hypothetical location suggesting a reduction in the number of locations,
     and, therefore, there's a potential risk increase, we would go and do a
     calculation where we actually go in and do a bounding estimate that
     would more than cover that uncertainty.
         DR. SHACK:  Is that clear to me where I have to do the --
     that was the point I couldn't quite figure out, is when you had to do
     the quantification.  There's the qualitative estimate and the
         MR. FLEMING:  For any medium or high risk region in which --
     or segment in which we're actually suggesting a reduction in the number
     of locations, we would come in and do bounding estimates.  So we're only
     relying on the qualitative arguments for the low risk category
         So the robustness issue associated with how we put the
     things on the matrix really is the -- the central question is have we
     gotten the lows correct.  The low-medium issue is more important than
     the high issue.
         MR. MITMAN:  The second to the last slide that I have shows
     some results from the pilot studies.  We're showing the number of
     inspections that were done under the current ASME Section 11
     requirements and the number of inspections that we're proposing have
     been approved by SERs for the pilot plants.
         What we see is in the high risk regions, we have some
     increases in the number of inspections, some decreases, but essentially
     about the same number of inspections.
         For the medium risk regions, we show usually a decrease in
     the number of inspections.  The one exception to that is on ANO-2, we
     were actually showing an increase in the medium risks.  Then in the low
     risk regions, we're showing a decrease in the number of volumetric
         DR. SEALE:  A couple of questions.  First of all, what
     percentage of the sites that wind up in the high category are actually
     identified for an inspection, in the medium?
         MS. DIMITRIJEVIC:  In high?
         DR. SEALE:  What fraction of the highs --
         MS. DIMITRIJEVIC:  Twenty-five percent.
         DR. SEALE:  -- are -- what fraction of the ones that are
     qualified as high actually wind up candidates for inspection?
         MS. DIMITRIJEVIC:  Twenty-five percent.
         DR. SEALE:  Okay.
         MS. DIMITRIJEVIC:  Twenty-five and ten percent, and that's
     for the full scope.
         DR. SEALE:  For the full scope.
         MS. DIMITRIJEVIC:  Yes.
         DR. SEALE:  What about when you do it with your CI-1, Class
         MS. DIMITRIJEVIC:  Class I, we select ten percent total and
     most of them are from high risk.
         MR. RICCARDELLA:  It comes out to be about 25 percent of the
     high risk.
         MS. DIMITRIJEVIC:  The same.
         MR. RICCARDELLA:  It's just the way the numbers work out. 
     And all three of these examples, it's essentially -- in fact --
         DR. SEALE:  Old Arkansas-2 really inspects the devil out of
     things, don't they?
         DR. SHACK:  Just a question on Vermont Yankee.  What is
     their IGSCC fix?  Have they replaced piping?
         MR. RICCARDELLA:  Vermont Yankee replaced piping.
         DR. SHACK:  So basically all their recirc piping is Class A
         MR. RICCARDELLA:  Yes.
         MR. MITMAN:  We did put together a backup slide that you do
     not have and it is not in the report that shows comparisons between what
     we end up with or what we would end up with if we did -- depending if we
     did an N-578 or an N-560 analysis.  These are all --
         MS. DIMITRIJEVIC:  N-578 selection criteria.
         MR. MITMAN:  And this is for Class I only.
         MS. DIMITRIJEVIC:  This is just for Class I.  It shows you
     that actually when you apply N-578 criterion to Class I, you always are
     around ten percent total.  You are either 9.4, 10.6, 13 or 9.8.  So
     basically even if you use again 578 criteria on Class I, because of the
     division between high and medium categories, then it's around ten
     percent of total, which is the same as N-560 criteria.
         And we keep that in mind with this percentage and we were
     not surprised at that.
         DR. BONACA:  I have a question.  Maybe I should ask the NRC. 
     But if I look at the whole logic, you have some high degradation
     category, piping in the high degradation category, with no consequence. 
     For those, essentially, you're recommending elimination of inspection in
     many cases.
         MS. DIMITRIJEVIC:  Actually, ten percent of inspection in
         MR. MITMAN:  No.  You're over-hearing the none.
         MS. DIMITRIJEVIC:  None.  Are you saying low or none?
         DR. BONACA:  None.  Just taking an extreme case.  That tells
     me that you are going to have failures at some point of some of the
         MR. MITMAN:  The only thing that we've seen categorized with
     no consequence are those abandoned in place piping.
         MS. DIMITRIJEVIC:  So we never saw high degradation in none.
         MR. MITMAN:  Now, if you have low consequence, which could
     be extremely low, 1e-to-the-minus-ten or whatever, we're still bending
     that in a medium risk category.
         DR. BONACA:  And that is fine.  I just was worried more
     about the corner, because simply you're going to see more failure.  From
     a regulatory standpoint, a utility that commits t this program and then
     has failures in the field, you get a black eye anyway ultimately.
         So I understand now that that box on the top left corner is
     not really one that should be of concern.
         MR. MITMAN:  If we started to see a lot of pipe segments
     falling into that segment, we'd have to ask a lot of questions about
     whether that's appropriate or whether we should take a harder look at
         DR. BONACA:  Because although you have -- from a risk
     standpoint, it's fully convincing to me that there are other issues that
     have to do with how do you deal with actual failures there and how are
     they classified and is it part of corrective action programs and how is
     that going to fit back into the adequacy of a program of this nature
     that you implement.
         It will raise all kinds of issues within a power plant if
     you begin to have those kind of failures.   
         MR. RICCARDELLA:  I know for the Class I programs, which is
     most of the pilot studies we did, nothing has ever fallen in that
     category.  Every Class I -- all the Class I piping has either low,
     medium or high failure consequence.
         MR. MITMAN:  Carl?
         MR. FLEMING:  Carl Fleming, from ERIN.  With regard to the
     earlier discussion we had about the insights from service experience and
     the different kinds of loading mechanisms and degradation mechanisms
     responsible for service data, those insights are responsible for both
     leaks and ruptures.
         So the concern that reducing volumetric inspections might
     result in an increase in the frequency of leaks in piping does not seem
     to be supported by the insights from in-service data.  It indicates that
     they'll probably occur at about the same rate as we're seeing now,
     because they're due to mechanisms that are just not being captured by
     the inspection process.
         DR. BONACA:  Thank you.
         MR. MITMAN:  My summary and concluding slide.  The revised
     topical has been submitted recently.  It addresses questions and
     concerns, lessons learned that we've learned along the way in the
     application of the pilot process, the methodologies and compliance with
     Reg Guide 1.174 and Reg Guide 1.178.
         The methodology has been applied to a diverse and extensive
     group of plants, GE BWRs, Westinghouse, B&W, and CE PWRs, multiple AEs,
     and both full and partial scope.
         So we've got a very broad, diverse, I think a very good
     distribution of the pilots and there has been a lot of feedback into the
     methodology from that.  We are seeing significant rem reductions out of
     the application and the pilots and research support the conclusions of
     negligible risk impacts by application of the methodology.
         DR. SEALE:  You mentioned earlier that you had a process by
     which you did some follow-up to find out if there are any changes or
     wild trends that might show up in the results of the application of
         Is there any systematics to that follow-up and if so, what
     are they?
         MR. MITMAN:  The final step in the process is this
     performance monitoring that hangs out to the side here on the feedback
     loop.  EPRI has been doing database analysis.  We continue to watch the
     industry and the LERs and the reports from the industry.  That's all
     part of the process.  The process really isn't formalized at this point,
     but it's there.
         There is a discussion about setting up something that might
     be equivalent to a user's group that would be also fed into the
     monitoring process and we're also expecting each individual plant that
     applies the methodology to watch what's happening in their plant and in
     the industry and to go back and revise, change, correct their own
     application of the methodology.
         DR. SEALE:  I noticed you mentioned that the owners groups
     for the different vendors have been participants.
         MR. MITMAN:  Well, the CE owners group has not, per se, been
     part of this.  The vast majority of the CE plants have been part of an
     EPRI tailored collaboration, but not, per se, the CE owners group.
         DR. SEALE:  Okay.  But in the other cases, the owners groups
     may have their own impromptu groupings or reviews, as well, I guess.
         MR. MITMAN:  Obviously, Westinghouse and the WOG have their
     own methodology and their own process there.  There is no discussion at
     this point with either the BWR owners group or the B&W owners group
     about having any kind of feedback loop between the owners groups and
     EPRI.  There is -- it's on a plant by plant basis.
         That's all I had.
         DR. SHACK:  Any more questions?  They're not scheduled to
     start until 11:15.  Can we go ahead with them?
         MR. MARKLEY:  Yes, we can.  We're not changing subject here. 
     So that's fine.
         DR. SHACK:  Thank you.
         MR. ALI:  My name is Syed Ali, I am from the Division of
     Engineering in NRR.  With me is Steve Dinsmore, who is from the Division
     of DSSA in NRR.
         What we are going to try to do in the short time that we
     have is to basically give an overview of the status of the review of the
     topical report and also the associated pilot plants, and a little bit of
     the changes that EPRI has made in their topical report since we approved
     some of their pilots.
         Some of these items EPRI may have already discussed this
     morning or may have been discussed as a result of questions or just to
     complete the picture, we will go over the status of what we have done so
     far, again.
         EPRI submitted its draft topical report back in '96.  At
     that time, we were also in the process of developing the regulatory
     guide and the standard review plan for the risk-informed ISI.
         We issued some questions and requests for additional
     information the middle of '97.  Subsequent to that, EPRI was involved in
     developing the pilot applications and submitting the pilots, so their
     priority was more toward the pilot submittals. So they came back with
     their responses to the RAIs and the questions and comments that we had
     sent near the end of last year.
         That was also about the time that we had finished basically
     the regulatory guide and the standard review plan and also some of the
     pilots.  So they were able to utilize the lessons learned not only from
     the pilot study they had done, but also from the regulatory documents
     that we had issued.
         I think since then, this process has picked up and our
     interface with EPRI has become much more significant.  We had a meeting
     back in March to discuss the responses and there were a few additional
     issue.  EPRI responded to those additional issues and then submitted
     their current report or their new version of the topical report 11267,
     which is the one that you are reviewing and that we have been reviewing.
         Those are the items that have been completed.  We are having
     the ACRS subcommittee meeting today.  We intend to have a follow-up
     meeting with EPRI sometime in July.
         In addition to that, since right now we are actively
     reviewing the EPRI report and some of their backup reports, we have a
     weekly telephone sort of update as to the issues and the items that are
         We plan another meeting or another presentation to ACRS in
     their September meeting and that's when we will be able to present our
     SER.  One thing that you see different here is that since the ACRS
     meeting is in September, we think that we will be able to issue the
     final report by the end of October and not the end of September, as you
     saw in some of the EPRI slides.
         That schedule was based on having an ACRS presentation in
     August, which is not on schedule at this time.
         DR. SHACK:  Are you still going to have a draft SER in June?
         MR. ALI:  We still plan to have a draft SER in June.  So we
     should be able to give you a draft SER.  Now, whether that draft SER
     will be a clean SER in the sense that it may have some open items, we
     don't know.  But probably it will have some open items, but we will have
     a draft SER.
         If we proceed the same way that we did with the
     Westinghouse, then we will probably have a draft SER with maybe a few
     open items and then have the meeting with EPRI to try to resolve those
     open items and then have a final SER by the time you have your September
         The next slide was just a listing of the pilots.  EPRI
     talked about those already.  Also, we have completed two pilots, Vermont
     Yankee, which is a GE BWR, and on that it was applied only to Class I
     utilizing the code case N-560.  We have also completed the review of
     ANO-1 Unit 2, which is a CE PWR, and we are currently reviewing the
     submittal for ANO Unit 1.
         DR. SHACK:  Now, those two pilots, the application basically
     followed this topical, although this topical didn't show up until April.
         MR. ALI:  It followed the topical that they initially
         DR. SHACK:  The old topical.
         MR. ALI:  Old topical, but then there were additional things
     done as a result of that review.  So a lot of that is reflected in the
     changes that were made in this topical.
         So basically this topical utilizes the changes or the
     lessons learned from the pilot applications and also from the reg guide
     and the standard review plan that we issued that was subsequently the
     first topical report.
         MR. MITMAN:  This is Jeff Mitman from EPRI.  Both the pilot
     plants that have been completed, Vermont Yankee and ANO Unit 2, are
     consistent with the new topical that you have in front of you.  There is
     nothing that they have done in those pilot plants that is different than
     what we have proposed in the revised topical.
         MR. DINSMORE:  This is Steve Dinsmore, from the staff. 
     There are more things in the topical than were approved in the pilot
     plants and I think the next two slides, we're going to go through the
     differences between what was approved and what's in the current topical. 
     So there are some differences.
         MR. ALI:  What we're going to go through are some of the
     major changes in the topical report rather than detailed item by item
     changes subsequent to the approval of the pilots.
         One change, I would say, an updating of the topical report,
     is that in looking at the first version of the EPRI topical report and
     also some of the discussions we had and the questions we had been
     sending, it was not clear as to how the augmented programs are
     integrated with the risk-informed ISI process.
         So one thing that they have done in this topical report is
     to clarify as to which of the augmented programs are, at this point,
     part of the risk-informed ISI process and which of the augmented
     programs are still being looked at as the way the licensees had made
     commitments to the NRC as a result of the degradations found either on
     an industry basis or on a plant-specific basis.
         DR. WALLIS:  This augmented part means it's increased,
     augment is to increase.
         MR. ALI:  What the topical report and the current EPRI
     position is that, for example, for IGSCC, category A will be most into
     the risk-informed ISI process, but for category B through G, the
     risk-informed ISI process at this time will not change the inspections
     that are being done for category B to G.
         They are not being increased or decreased.  They are just
     staying the same.
         DR. WALLIS:  Augmented implies increased.
         MR. ALI:  Augmented means in addition to what is in ASME
     Section 11.
         DR. WALLIS:  So that's the implication.  It's in addition to
         MR. ALI:  In addition to ASME-11 inspections.
         DR. WALLIS:  So on the face of it, it looks as if you're
     increasing some demands by augmenting inspection.
         MR. ALI:  No, that's not what is meant.  There were a number
     of -- there's a number of degradation mechanisms that were found in the
     plants over the last several years.  As a result of those, the staff had
     issued generic letters asking the licensees to address those issues and
     as a result of that, the licensee made certain commitments as to how
     they will monitor those degradation mechanisms and inspect for those.
         The second item is --
         DR. SHACK:  Syed?
         MR. ALI:  Yes.
         DR. SHACK:  An erosion/corrosion, is that augmented
     inspection program now going to be subsumed into the --
         MR. ALI:  No.  That, at this point, is going to remain as it
     is in the generic letter.  So those IGSCC B through G and the
     erosion/corrosion are the two programs that are not being changed as a
     result of this program at this time, and other programs are being
         The second item is that as a result of our issuing the
     regulatory guide and standard review plan and also reviewing the pilots
     and issuing the SER, the staff and the industry felt that once we have
     reviewed the pilots and we have reviewed and approved the topical report
     for these two methodologies, then the industry and the staff should come
     up with a simplified submittal to the staff so that the review process
     can be expedited.  
         We had several meetings with the industry to try to come up
     with the contents of that template.  As a result of those meetings, we
     agreed to a table of contents and what will go into those templates.
         The only thing I think that's a little bit different is that
     as a result of our meetings with NEI and the industry, there were some
     changes that were made to that template, there were some attritions and
     the template that we see in this topical report does not reflect the
     latest.  So I think that's something that we will ask them to do and I
     don't think that should be a big change.  That can be done easily.
         DR. SHACK:  Do you have a template for the WOG ASME?
         MR. ALI:  Yes, we have for both.  Actually, the template is
     about the same because the high level aspects of the methodologies are
     really the same.  It's the details.  So the template is essentially the
         The third item on this slide is that so far, all of the
     pilots that we have looked at and approved have been either the whole
     plant or Class I.  So we have not been asked to review and we have not
     reviewed any submittals where there was a change in the inspection on a
     system by system basis.
         But the topical report presents that as one of the options
     that the ISI program may be changed on a system by system basis.  They
     did not talk about that this morning.  The criteria, the risk criteria,
     the risk acceptance criteria on a system by system basis is an order of
     magnitude more stringent than what it is for the plant basis.
         This is something that is different than what we have
     approved at this point and so we are still in the process of reviewing
         Steve will now go through the next slide.
         MR. DINSMORE:  This is Steve Dinsmore from the staff.  I
     will be talking about some of the differences in the -- I guess most of
     them are in the delta risk calculations.  Again, these differences are
     between what was approved in the pilots and what's in the current
         We talked a lot about those tables, but we haven't been
     looking at the specific elements in those tables and what those rankings
     are and the word grade creep comes to mind.  Every pilot has been
     submitting their own table and the highs and the mediums are kind of
     drifting off to the left-hand side.
         So we haven't quite approved the table yet.  We're still
     looking at it.  Some of the elements in there are greater than
     ten-to-the-minus-four, which are supposed to be mediums, because they
     say it's a bounding calculation.  So we're still dealing with that.  So
     if you look in the table and you see numbers which don't seem to fit
     with the criteria, they don't, and we're working on that.
         The other big change is these delta risks.  Again, earlier,
     when they first started this process, they didn't really look at delta
     risks and we've been adding that slowly step by step.
         What's new in the topical, again, is there is a request to
     do no delta risk calculations if you only do Class I.  EPRI said that
     they had an argument why ten percent would not increase risk and that
     there -- if the pilot or if a utility could somehow show that their
     service experience is similar to generic service experience, then they
     wouldn't have to do the delta risk calculation.  So we're still looking
     at that.
         No delta risk contribution from low safety significant
     segments.  Carl kind of alluded to that this morning.  They don't want
     to calculate the change in risk due to low safety significant segments. 
     They have a reasonable looking argument in the topical where they use
     bounding calculations, but we're still looking at that, again.
         They added these screening criteria.  This is actually the
     first time I've seen those.  We've only had this thing for about two and
     a half weeks.  The ten-to-the-minus-seven CDF and the
     ten-to-the-minus-eight LERF, these are all reflected in a flow sheet on
     the last -- there is a flow sheet right in the back of the chapters. 
     Evidently, it's a system by system restriction which you use if you've
     done either by class or by -- or the whole plant.
         Then they added on this extra one where they say if you only
     do one system, then you decrease those by a factor of ten.  In general,
     with the risk-informed stuff, we've been -- we started out by saying you
     had to do full scope, everything, and we've been kind of slowly moving
     back.  Especially if they come in with the argument that it's a risk
     decrease, it's hard for us not to accept something that's not a risk
         Again, these are positive numbers here.  So we're still kind
     of looking at that.
         And the last one that they added was this Markov.  There was
     a lot of discussion this morning about this Markov and the data
     analysis.  We didn't use that in the pilots.  We used this bounding
     option, where they took the highest possible CDF for each category and
     the highest possible pipe failure frequency for each category and did
     some bounding calculations to show us that without crediting any
     increase in inspection efficiency, that there would be a very small risk
     increase.  If they credited some increase in the inspection frequency,
     then it would go down.
         So they've been coming in with minus numbers as their best
     estimate of the change in risk, which, again, I'm not quite sure what
     these positive ten-to-the-seven and ten-to-the-minus-eight boundary
     criteria are.
         A more mundane problem with the Markov stuff is from Dr.
     Apostolakis -- it's spread all over about ten reports and we're trying
     to pull it together.  So we don't really have a good feel for how the
     whole thing fits together with the data.
         But our current feeling is that the process seems
     reasonable.  It's just a matter that we have to really get and
     understand it and say that what we understand is okay.
         Those are essentially all the differences that we've
         DR. SHACK:  Questions from the committee?  Do you need
     anything from us at the moment?  You're still working on your draft SER.
         MR. ALI:  We kind of talked about that before.  We usually
     ask for a letter when we write the SER, but we haven't written the SER. 
     So I think at this point, it's --
         DR. SHACK:  Unless we have a major problem.
         MR. ALI:  -- what you write as a result of your meeting or
     your deliberations.
         DR. SEALE:  Strictly information.
         MR. BARTON:  I don't see any big problem that would require
     a letter.
         DR. SHACK:  Okay.
         DR. SEALE:  So you're going to talk again this afternoon?
         MR. ALI:  Yes.  We are on schedule again this afternoon.
         DR. SHACK:  We had some discussion about that, since we've
     got a reasonable segment, we basically sort of thought we more or less
     had to do it, but we would do it in a fairly abbreviated fashion.
         DR. SEALE:  Yes.  I notice it's just a half-hour.
         DR. SHACK:  That was more we sort of felt we had to -- you
     know, since it was noticed, we would have to do it, but it would be an
     abbreviated session.
         With that, if there are no other questions or comments, we
     close the meeting of the subcommittee.
         [Whereupon, at 11:16 a.m., the meeting was concluded.]

Page Last Reviewed/Updated Tuesday, July 12, 2016