TABLE OF CONTENTS

Introduction Risk Informed Inspection Piping Failure Potential Assessment Risk Categorization Inspection for Cause Risk Impact of Inspection Role of Inspection Effectiveness Role of Damage Mechanisms Insights for NDE Qualification Role of NDE in RPV Integrity Assessment BWR Example PWR Example Posterior Flaw Number Distribution Flaw Size Distribution Flaw Size Distribution for Found Flaws Flaw Size Distribution for Potentially Missed Flaws Role of Performance Demonstration Implementation of Effective NDE Technology Conclusions References

Safety and Reliability of Plant Technology
24. MPA-Seminar 8-9 October, 1998 Stuttgart, Germany
Table of Contents

Introduction

Protection of the health and safety of the public is a basic principle throughout the world applied to all aspects of nuclear power plant operation. Power plant designers, plant owners, and regulators have developed inservice inspection (ISI) programs as part of their comprehensive approach to ensuring nuclear safety. ISI is relied upon to detect and characterize degradation before it can pose a treat to safety-related component and systems. In addition to this vital mission, inspection provides plant owners with accurate information necessary to support utility strategic decisions regarding repairs, replacements, degradation and aging management, license renewal, efficiency improvements, and personnel safety. NDE designers and implementers, therefore, have an obligation to ensure that NDE techniques and systems have the capabilities to achieve these objectives.

Nuclear plant NDE has reached a high level of sophistication, precision, automation, and efficiency. Innovative technologies and tooling have been developed, demonstrated, and proven on many actual plant examinations. Extensive qualification efforts worldwide have confirmed the high quality that can be attained by dedicated inspection teams. Qualification results have also shown varied capabilities among inspection techniques and teams, confirming the need for improvement in ISI effectiveness and the importance of realistic and effective inspection qualifications.

The contribution of NDE to reactor safety is a complex issue requiring careful study. A thorough assessment of the contribution of ISI to reactor safety provides assurance that safety is addressed effectively and efficiently without wasting costly inspection resources or incurring unnecessary radiation exposure to inspection personnel. Tools are now available for systematic assessments of the role of ISI in reactor safety that provide guidance for setting realistic and relevant inspection performance targets. Recent developments in risk methodology, for example, have provided useful guidance to plant owners, regulators, and inspection staff for planning and executing inservice inspection programs with significantly improved effectiveness. This guidance includes valuable insights into the contribution of inspection to safety. Assessment of the contribution of NDE to safety also provides clear direction to those responsible for designing and implementing effective inspection and inspection qualification programs that enhance safety, reduce radiation exposure to workers, and maximize utilization of costly inspection resources. Without this in-depth assessment, it would be difficult to demonstrate conclusively that safety significant locations, systems, and components are identified and inspected adequately.

This paper examines the role of ISI in reactor safety through several examples drawn from recent industry initiatives to address implementation of effective examination technology for nuclear power plant piping, and BWR and PWR reactor pressure vessels. These examples also illustrate the importance of well designed performance demonstration activities to support application of effective ISI. Finally, the efforts required to implement effective ISI technology for field inspection is addressed.

Risk Informed Inspection

Nuclear power plant operating experience accumulated over more than 3 decades provides a rich database for assessing the contribution of ISI to reactor safety and to build more effective inspection strategies. This experience shows conclusively that traditional inspection strategies, such as ASME Section XI, do not always effectively identify locations most susceptible to degradation or those systems most important to plant risk (1). Accordingly, important new initiatives are in progress in several countries to improve the effectiveness of inspection programs though use of risk insights. Plant owners and regulators have recognized the value of risk informed inspection (RISI) alternatives to current, prescriptive, rule-based approaches. Benefits realized from this approach include improved safety, reduced cost, and reduced radiation exposure.

Risk informed methods have been developed and applied to define an effective piping inspection strategy for several US nuclear plants (2). Pilot studies are in progress aimed at demonstrating the method, identifying the risk reduction associated with inspection strategies, and obtaining data and experience needed for regulatory review and acceptance. This effort has resulted in development and demonstration of useful models and databases for evaluating the risk reduction that can be achieved through application of alternative inspection strategies. The inspection effectiveness, defined as the effectiveness of selecting the most risk significant locations, applying appropriate inspection methods, and performing corrective actions is a key element of the model. The method focuses on identifying damage mechanisms that may be operative in safety-significant piping systems and provides engineering criteria for determining where these mechanisms may be active. Actual field experience is used in the model to estimate pipe leak and rupture frequencies for the various damage mechanisms.

Risk is defined in this application as the potential to cause damage to the reactor core or to release large quantities of radioactive species to the atmosphere (3). Risk is the product of the frequency of pipe rupture and the consequence of that rupture. The pipe rupture frequency is evaluated according to the likelihood of specific damage mechanisms being active that could lead to rupture. The consequence is evaluated as the conditional probability of core damage given that a pipe rupture has occurred.

RISI, therefore, represents a shift from traditional safety classification (Class 1, 2, 3) to risk classification. It is attractive for several reasons.

• RISI involves a systematic assessment of piping systems by plant personnel most familiar with plant operations, history, and conditions conducive to degradation.
• It provides a basis for assessing the value of inspection and for reducing risk through effective inspection.
• RISI identifies specific damage mechanisms and locations where they may be operative, thus providing essential information to NDE personnel who must develop procedures to detect and characterize specific forms of degradation.
• RISI methodology provides specific information on the reliability requirements for inspection which is needed for designing effective NDE procedures and inspection qualification programs.
• The methodology includes feedback of field experiences to continually refine the process.
• Diverse degradation management and inspection programs such as IGSCC, thermal fatigue, flow accelerated corrosion, and normal Code required examinations can be integrated and evaluated for their safety contributions.

Piping Failure Potential Assessment
EPRI has sponsored studies to document the service experience with piping systems in U.S. commercial nuclear power plants (4). Examination of this data shows an important relationship between failure frequency and operative damage mechanisms as illustrated in Figure 1. These relationships provide a technical basis for focusing on damage mechanisms as the relevant input to designing effective inspections.

Fig 1: Piping Rupture Frequencies Associated With Occurrence of Various Damage Mechanisms According To Reactor Type (4)

These insights led to a natural set of three categories of failure potential--HIGH, MEDIUM, and LOW. While absolute failure frequencies are not estimated, the service experience available to support these assumptions indicates that the boundary between each of these categories is about an order of magnitude. In this analysis, the degradation mechanisms listed in the HIGH category were found to have average rupture frequencies around 10^-2/ reactor- year. The remaining degradation mechanisms amenable to inspection were found to have an average frequency of one to two orders of magnitude less than this value. These frequency estimates are averaged over the population of U.S. LWRs across four reactor vendor groups.

The categories referred to as "Design and Construction errors" and "Unreported" were found to have significant frequencies of causing ruptures, in the range of 10^-3 to 10^-2/ per reactor year. None of these latter categories is considered as addressed by ISI since there is no basis to know how to look for such causes of pipe rupture. The inspection reliability to find the associated precursor flaws, if any, could not be assured.

The major ruptures in the data base in which the leakage flow area approached or exceeded the diameter of the pipe in a large pipe were primarily due to flow accelerated corrosion (FAC). Hence, of those damage mechanisms that are amenable to inspection, FAC was considered relatively more likely than other mechanisms to cause pipe rupture, especially large ruptures in large pipes. Accordingly, pipe segments with the conditions necessary for FAC are placed in the HIGH category, and those subject to any other identifiable damage mechanism were placed in the MEDIUM category for assessing pipe rupture potential. Obviously, if a segment has no identifiable damage mechanism, it would have a LOW failure potential, all other conditions being equal.

It is important to note that in no circumstance is a pipe segment assumed to have no potential for pipe rupture. Even in the absence of an identifiable damage mechanism, there is a finite probability of pipe rupture due to causes that may be unrelated to a damage mechanism or to unexpected situations.

There are several reasons for this qualitative ranking of failure potential rather than calculating failure potential explicitly with probabilistic fracture mechanics methods. The state of the art in piping reliability assessment for developing quantitative estimates of pipe failure and rupture frequency is subject to large uncertainties and requires numerous assumptions and expert judgments to obtain meaningful results. It is recognized that experts in fracture mechanics supported by sound engineering judgments and data can develop realistic estimates of pipe rupture frequency. The EPRI approach was designed with the intention to avoid complex calculations of every pipe segment in a system. It is believed that technically sound assessments could be made of the relative failure potential using a qualitative approach that could be applied economically. A specific goal of the EPRI program is to demonstrate that full quantification of pipe rupture frequencies was not needed to support a sound program. The method is being refined and validated in the pilot plant studies. These studies have produced results closely matching those obtained using quantitative calculational methods.

The EPRI RISI classification scheme for assignment of segments to the three general classes of failure potential is depicted in Table 1.

Pipe Rupture Potential	Leak Conditions	Degradation Mechanisms To Which The Segment is Susceptible
HIGH	Large	Erosion Corrosion (FAC) Water Hammer Vibration Fatigue
MEDIUM	Small	Thermal Fatigue Corrosion Fatigue Stress Corrosion Cracking (IGSCC, TGSCC, PWSCC, ECSCC) Corrosion Attack (MIC, Crevice Corrosion and Pitting) Erosion/Cavitation
LOW	None	No Degradation Mechanisms Present

Table 1: EPRI System For Evaluation Of Pipe Failure Potential

The HIGH category includes two severe loading conditions: water hammer and vibration fatigue. Pipe inspections are an ineffective defense against pipe ruptures due exclusively to water hammer and vibration fatigue. However, if the conditions for these mechanisms are accompanied by a degradation mechanism, this combination would produce a high potential for pipe ruptures that may not be apparent in the service data. Engineering criteria are available (5) that can be used to determine whether a pipe segment is particularly susceptible to water hammer or vibration fatigue. It is important to note that when segments are found to be particularly susceptible to water hammer or vibration fatigue, the utility is well advised to address the design or operation issues responsible for this susceptibility and not to rely on NDE as the first line of defense. The primary reason for listing water hammer and vibration fatigue in Table 1 is that if there are other degradation mechanisms also present, the inspections should be geared to find flaws from these degradation mechanisms, not flaws from vibration fatigue or water hammer.

Risk Categorization
Risk categorization is accomplished by combining the results of the consequence and failure potential assessments. This is done on the basis of piping segments, defined as piping sections that:

• Consist of a continuous run of piping
• Are exposed to the same degradation mechanisms
• If failed, have the same consequences

Failure potentials of segments are determined by the degradation mechanism categories applicable for the segment that, in turn, define the leak size potential for that segment. The segment failure consequences are determined by consequence categories that define the relationship between the severity of consequences and the impact on plant safety and performance. These categories are derived from the Probabilistic Risk Assessment (PRA) for the plant that calculates the conditional core damage frequency associated with postulated failures at locations along piping runs. Since the PRA traditionally does not address passive components such as piping welds, supplementary PRA analysis is required to simulate failures at these locations.

A risk matrix, shown in Table 2, illustrates the risk categorization process.

Table 2: EPRI Risk Matrix For Classification Of Pipe Segments For Risk Informed In-Service Inspection

Inspection is performed on a sampling basis only for locations in the HIGH and MEDIUM categories. No inspection is performed for LOW risk category piping locations. As indicated in Table 2, segments with a low potential for rupture and a high assessed consequence are assigned a "MEDIUM" risk classification, in recognition of the fact that pipe rupture cannot be ruled out for such segments. Hence, only when a LOW rupture potential is combined with a LOW or MEDIUM consequence, is the risk associated with the segment considered LOW. Segments classified in the LOW risk category provide the greatest opportunity for reductions in inspections according to a risk informed program.

Inspection for Cause
The RISI approach results in identification of specific damage mechanisms that are likely to be operative and further identifies the specific location where they are most likely to occur. This is critical information to ISI planners and NDE personnel who must then apply the appropriate NDE method. An example of this inspection for cause approach is examination for thermal fatigue. In a pilot study for the ANO-2 plant, a CE designed PWR plant, some segments in the RCS were assessed to be susceptible to thermal fatigue. It was found in the ANO-2 pilot study that the inspection volumes for RCS piping did not include the counterbore, the most likely location near welds where thermal fatigue induced flaws or failures have been found to occur. Thus, the inspection volumes were expanded to explicitly include the counterbore transition area. For thermal fatigue, the piping counterbores are explicitly included in the inspection volume regardless of its location relative to the weld, a departure from Section XI definitions of inspection volume. Thus, inspection effectiveness is increased. For other damage mechanisms, such as IGSCC and FAC, no difference in volumetric inspection methods relative to traditional approaches is anticipated. Surface examination (such as with liquid penetrant examination-PT) is not performed for damage mechanisms known to initiate from the inside surface as it would not be effective in these situations.

Risk Impact of Inspection
A critical issue for regulatory acceptance of RISI is assessing the change in risk associated with application of RISI relative to the current inspection program. In this approach, this is assessed through use of a probabilistic model that evaluates changes in risk of alternative inspection strategies (4)

The goal of the technical approach is to estimate the pipe rupture frequency and the core damage frequency impacts of proposed changes to the inspection program. These quantities are estimated according to failure calculations evaluated on a system-by-system basis. The model, called the Markov model, was developed based on insights from service experience about the failure mechanisms that are responsible for pipe failures. Most of these are amenable to ISI because pipe failures from these mechanisms have precursors of pipe flaws that can be identified in the in-service inspection program such that the pipe may be repaired prior to failure. The exception is vibration fatigue because of the very short time prior to failure that would be available for inspection.

Several classes of accident sequences are to be considered. These include:

• Small LOCA initiating events
• Medium LOCA initiating events
• Large LOCA initiating events
• Other initiating events occurring while the RCS is degraded by pipe ruptures

These insights are used to develop an expanded model for evaluating the conditional probability of core damage given a pipe rupture according to the following equation:

		CDPj = FSCDPSj + FMCDPMj + FLCDPLj + FOCDPOj
Where:		FSj,Mj,Lj,Oj	=	Fraction of pipe failures in segment j that result in small, medium, large LOCAs, or degraded RCS conditions in response to other non-LOCA initiating events.
		CDPSj,Mj.Lj,Oj	=	Conditional core damage probability given pipe rupture in system that results in small, medium, or large LOCA, or results in a degraded RCS in response to other non-LOCA initiating events.

	Legend PIPE STATES: S = NO DETECTABLE FLAWS F = DETECTABLE FLAWS L = DETECTABLE LEAKAGE R = RUPTURE STATE TRANSITIONS = OCCURENCE OF FLAW = OCCURENCE OF A LEAK (F) = OCCURENCE OF A RUPTURE GIVEN A FLAW (L) = OCCURENCE OF A RUPTURE GIVEN A LEAK = INSPECTION AND REPAIR OF A FLAW µ = DETECTION AND REPEAIR OF A LEAK
Fig 3: Markov Model For Degradation Type Failure Mechanisms

Figure 3 shows the model of the interactions between degradation mechanisms that create pipe failures and the inspection and leak detection processes that can mitigate the potential for pipe ruptures. These models use the Markovian reliability modeling technique to set up differential equations whose solutions are the time dependent probabilities of different pipe states. The states are the states of no flaws, flaws with no leaks, a leaking pipe segment, and a ruptured pipe segment. This model can be used to estimate the long-term frequencies of pipe ruptures.

Solutions to the Markov model can be used to assess the frequency of pipe ruptures directly, or to assess the inspection effectiveness. The latter approach is selected here as it conveniently expresses the impact of inspections on reactor safety.

An inspection effectiveness factor is applied for each element of pipe in a segment. The inspection effectiveness factor is not applied to severe loading type degradation mechanisms as these are not influenced by inspections. The results of the evaluation of the risk changes relative to ASME Section XI are shown in Figure 4. The figure shows the total risk of the RCS associated with pipe weld failures. Additional risk associated with failures of active components in the piping system is not included, although these are many times larger risk than the risk associated with passive components of the piping system. The shaded portions of the bars in the figure represent the portion of risk that cannot be addressed by ISI such as human error, water hammer, and vibration fatigue. The unshaded area represents the risk portion addressable by ISI due to thermal fatigue and construction errors. Only about 20% of the risk associated with passive component failure can be affected by ISI in this case which is typical of most piping systems. Note that risk reductions exceeding those achieved by Section XI examinations can be realized with substantially fewer inspections in this particular piping system.

Fig 4: Risk Reductions In ANO-2 RCS System Achieved By ASME Section XI And RISI Approaches Evaluated With The Markov Model

Role of Inspection Effectiveness
Markov model results provide useful insight into the role of inspection effectiveness in reactor safety. Figure 4 shows already that inspection can address only a relatively small portion of the risk associated with typical piping systems. The importance of inspection parameters such as the probability of detection (POD) varies considerably according to the particular system under consideration. High risk systems susceptible to damage mechanisms that can lead to large breaks, such as caused by FAC, obviously must be inspected reliably. Systems with moderate risk significance and subject to slowly evolving cracking mechanisms show lower sensitivity of risk to inspection effectiveness. The pilot studies, for example, have shown that the dependence of risk on POD is typically not strong. The largest gain in risk reduction is achieved by selecting the most risk significant locations rather than by increasing the inspection sensitivity (4).

The discussion up to now has addressed nuclear safety. The results confirm that nuclear plant piping is well designed and backup safety systems have performed well to ensure nuclear safety, even if active damage mechanisms may be operative. Inservice inspection, accordingly, contributes to safety by providing defense in depth to guard against degradation going undetected in safety significant locations.

Inspection provides another critical role in addition to its safety contribution. Leaks or other kinds of degradation, although not necessarily significant safety issues, can cause unplanned shutdowns and repairs. Utilities require accurate information on degradation so they can plan for economic replacements or repairs and operate more reliably and efficiently. Inspection, in these situations is, therefore, more an economic consideration rather than a safety issue. The demands on inspection effectiveness can be quite high for these strategic and economic issues because defects must be found typically when they are small, well before any potential for leak can be reached prior to the next outage or inspection opportunity. The inspection designer must consider all of these complex considerations to ensure that inspection goals are clearly defined and met.

Role of Damage Mechanisms
RISI focuses attention on damage mechanisms. The pilot studies have provided useful insights on the relative contributions of damage mechanisms to plant risk. The set of damage mechanisms that may be operative depends, of course, on the particular plant, piping system, materials, and operating conditions. However, important trends are evident in the pilot study results. Not surprisingly, those damage mechanisms capable of leading to large breaks or leaks, particularly FAC, are the highest contributors to risk. Cracking mechanisms, such as IGSCC, typically are less significant contributors to risk due to their much lower potential for causing large breaks. Figure 5 illustrates some results from a pilot application of RISI at the J. A. Fitzpatrick plant, a BWR unit constructed in the early 1970s (6). These figures show the contributions of the various damage mechanisms to the HIGH, MEDIUM, and LOW risk categories, respectively.

Fig 5: Contributions Of Various Damage Mechanisms To HIGH, MEDIUM, And LOW Risk Categories For The J. A. Fitzpatrick BWR Pilot Study.

Insights for NDE Qualification
Recent results of pilot applications of RISI methodology provide some conclusions important for NDE personnel. RISI studies have confirmed that many of the current inspection programs can be significantly improved by focusing inspection on those locations most important to safety and most likely to contain active damage mechanisms.

Once the location and relevant damage mechanism have been identified, the job of the NDE engineer is to apply appropriate and qualified examination methods. The various damage mechanisms contribute to risk in vastly different ways. A logical step would be to evaluate carefully the value of inspection and inspection qualification for each application. Slow cracking mechanisms, for example, are quite often moderate or even minor risk contributors, and highly sensitive or extensive inspection methods are not always warranted. These insights provide useful tools for designing approaches for designing efficient qualification approaches that addresses the reliability needs of each kind of inspection and the specific locations to be examined to make effective and economical use of inspection and qualification resources.

Role of NDE in RPV Integrity Assessment

The reactor pressure vessel is unique in the plant design basis in that its failure could not be compensated by engineered backup systems. Thus, the greatest assurance must be given that failure is not credible under any conceivable situation. A typical safety goal for the vessel is that the mean failure frequency shall not exceed 10^-6 per year. This small quantity surely cannot be fully justified based on service experience alone as this would require an inordinate number of reactor-years of operation to establish sufficient confidence. Therefore, RPV integrity assessments are typically performed with probabilistic fracture mechanics methods using assumptions of the key input parameters describing the severity and frequency of loads, material properties, the presence of defects, and the effectiveness of inspection.

Examples of evaluations for BWR and PWR pressure vessels will be reviewed to illustrate the contribution of NDE to reactor safety and, further, to show the importance of fully understanding this contribution in order to develop realistic and effective requirements for NDE and NDE qualification.

BWR Example
Recent evaluations (7) have confirmed the inherent safety of the BWR RPV due to the low likelihood for overpressurization transients. It is well known that the currently mandated full examination coverage of the beltline welds in many BWR RPVs is not possible because of complex geometric configurations that impose many access difficulties. Many plant owners, therefore, resort to supplemental manual examination from the RPV outside surface in addition to automated examination from the inside surface to achieve as much coverage as possible, incurring considerable radiation exposure and cost. The motivation for this evaluation was to develop a recommendation for modifying the inspection requirements to reduce the cost and radiation exposure associated with BWR RPV ISI and to show that this modification would result in negligible changes in risk.

The evaluation was completed using both deterministic and probabilistic methods. The Monte Carlo analysis method was used as it is amenable to statistical problems governed by a large number of random variables for which closed form solutions are not available or are impractical. Each input parameter is described as a distribution with a mean and spread function. Many simulations are made by choosing a set of random variables sampled from the various distributions and then performing deterministic calculations of crack initiation and growth. Each simulation results in either failure or non-failure. The probability of failure is then derived as the ratio of failures to the total number of simulations. Simulations are continued until a sufficient number are completed to establish specified confidence in the failure probability.

The applied loads included system pressure, residual welding stresses, differential thermal stresses from postulated operational transients, and stresses resulting from application of the clad. Appropriate materials properties, including worst case fracture toughness due to embrittlement, were used.

The inspection efficiency was modeled with empirical representations of the probability of detection (POD). Several POD models were investigated, ranging from high to low effectiveness, to study the influence of inspection qualify and coverage. Defects detected in the simulations were assumed to be repaired or addressed with other actions taken to prevent failure.

This evaluation and many other similar results confirmed the importance of the flaw distribution assumptions. This flaw distribution is a sensitive input to RPV integrity assessments and is subject to considerable uncertainty. For this assessment, a distribution of defect numbers and sizes was assumed to exist in the carbon steel vessel welds, as well as initiating in the stainless steel cladding. A conservative modification to the Marshall Distribution was used. All flaws were conservatively assumed to be located at the inner surface of the vessel. Table 4 summarizes the results.

	Probability of Failure in 40 years
Weld	Full inspection	No inspection
Axial welds	5.7 x 10-8	2.7 x 10-7
Circumferential welds	1.9 x 10-22	2.1 x 10-22

Table 4: Failure Probabilities For BWR Beltline Welds

The failure probabilities shown in Table 4 are all well below the safety goal of 10^-6 per year, even with no inspection. This result confirms the inherent safety of the BWR RPV design and operation. The results show some benefit of examination of axial welds, but practically no benefit associated with examination of circumferential welds. This result is due primarily to the very low applied stress levels. Thus, elimination of examination of circumferential welds entirely can be justified as it does not contribute to increased risk. Regulatory acceptance of elimination of examination of the circumferential welds has been obtained. Evaluation of examination of axial welds is currently continuing. Substantial benefits are realized in terms of reduced radiation exposure to workers and lower costs.

PWR Example
A specialized example of a PWR case illustrates a situation where NDE plays a more significant role in the integrity assessment. In PWR RPV analysis, unlike for the BWR case, postulated overpressurization events and embrittlement are more significant. Accordingly, the failure probability evaluations are more sensitive to the presence of defects and, therefore, also to the effectiveness of NDE. It will be shown, in particular, how NDE reliability directly affects the confidence and quality of conclusions about the presence and size of defects that may remain in the vessel, having escaped detection.

Analysis of postulated pressurized thermal shock (PTS) includes an explicit treatment of the capability of ultrasonic inspection to detect defects that are presumed to exist in the vessel (8). The approach analyzed the effects of the flaw detection performance and flaw sizing accuracy of the inspection system when evaluating the risk associated with both detected flaws, as well as flaws that may escape detection. Assumptions about the number, size, shape, and location of defects assumed to exist in the vessel were found to have a substantial influence on the result. The reliability of NDE, therefore, plays an important role in these kinds of analyses. A postulated defect distribution derived from the Marshall report has become the standard input to PTS and other RPV integrity assessments. Unfortunately, very little data is available to substantiate these assumptions or to construct more accurate flaw distributions. Several experimental efforts are in progress to develop complementary data to improve the flaw distribution assumptions.

Posterior Flaw Number Distribution
The approach described here begins with the assumed, or prior, flaw distribution such as the Marshall distribution or modifications of it. The results of ISI are then used to modify or update the prior distribution to produce a post inspection, or posterior, distribution. The degree of updating or modification of the prior is influenced strongly by the quality of the inspection. Inspection quality in this example is measured by the probability of detection (POD) expressed as a simplified one-parameter model based only on flaw size. Inspection performed with a low POD, for example, would have practically no effect on the flaw distribution as it would carry little weight in the updating process. Thus, the availability of this kind of model allows evaluation of the value of ISI and provides guidance for setting the quality level needed for the inspection procedure.

Combining the prior flaw number distribution with the number of detected flaws using Bayes theorem as follows generates the posterior flaw number distribution:

Where

I	=	The inspection result, i.e., the number of detected flaws
P(n|I)	=	The posterior distribution of number of flaws given that I flaws are detected
P(n)	=	The prior flaw number distribution
P(I|n)	=	The probability of detecting I flaws given that n flaws are present
P(n) P(I|n)	=	P(I), and is the normalizing factor

P(I|n) is expressed as a binomial distribution with probability of detection POD and probability of missing a flaw (1-POD) as follows:

Flaw Size Distribution
The post-inspection plant-specific flaw size distribution consists of two parts, the distribution for found flaws and a distribution for potentially missed flaws. The main reasons for using this approach are:

1. The number of detected flaws is expected to be small (1-10 actual flaws: many insignificant indications, however, are expected to be found) and determining a valid fit to a postulated flaw size model is unreliable with such a small population.
2. The found flaws and missed flaws have different size distributions and cannot be described by the same function.

The next step is to develop the distributions for found and missed flaws.

Flaw Size Distribution for Found Flaws
The distribution for found flaws is flaw-specific and is based on the measured size, ISI measuring accuracy, and generic information. If a flaw is found with measured size S with accuracy E, then the flaw size will be distributed in the interval [S-E, S+E] in a manner that depends on the measuring technique. The error function is weighted by the prior flaw size distribution to account for the small shift towards small flaw sizes. The prior distribution is assumed to be described by the Marshall flaw size distribution because this is the currently used industry standard.

Flaw Size Distribution for Potentially Missed Flaws
Any inspection procedure could potentially fail to detect a flaw, and the possibility of missing a flaw must be accounted for in the analysis. The available information on the sizes of potentially missed flaws consists of the fact that they were missed and that the size distribution is given by the Marshall distribution. Use of the Marshall flaw size distribution alone will not be valid for determining the post-inspection size distribution because there is a very small chance of missing large flaws that are included in the Marshall distribution using modern inspection techniques. Thus, the prior (Marshall) size distribution will be updated with the POD model to account for the probability of missing flaws as a function of size. For example, the Marshall distribution predicts an approximately 7% chance of having a flaw with size greater than 10 mm. The probability of detecting this size of flaw is expected to be high, thus the post-inspection size distribution will be very different from the prior, particularly for large flaws.

The posterior distribution is derived as a Bayesian update of the Marshall size distribution as follows:

P(a|M) = P(M|a) P(a) / P(M), where


P(a|M)	Is the probability of having a flaw of size a given that it was missed during inspection, this is the posterior flaw size distribution
P(M|a)	is the probability of missing a flaw of size a (=1-POD(a))
P(a)	is the probability of having a flaw of size a, that is, this is the prior flaw size distribution
P(M)	is the total probability of missing a flaw.

The probability of missing a flaw P(M) is determined by the following expression:

Fig 6: Example Calculation of the Posterior Flaw Number Distribution Following Inspection of a PWR RPV Assuming 1 Flaw Is Found and POD= 0.9[1-2.7exp (-33a)]

Figure 6 shows an example calculation for a hypothetical RPV inspection. A high quality examination, as postulated in this example, strongly improves the confidence in the post-inspection flaw distribution as shown by the shift toward a smaller mean number of flaws and narrow distribution.

This example shows the dominating influence of a high POD. The shift toward lower flaw numbers and lower flaw sizes significantly influences the probability of failure assessment. Recent qualification results have supported the possibility that this level of high quality examination of the critical under clad region can be achieved. Results from the US Performance Demonstration initiative (PDI) program (9) show that good flaw detection performance can be expected for examination of undercladding defects in RPVs. In approximately 500 measurements, undercladding flaws in test pieces were detected with approximately 96% effectiveness.

Role of Performance Demonstration
These examples have shown how the connection between nuclear safety and NDE effectiveness varies considerably according to the application A thorough understanding of this connection provides clear targets for inspection system performance. The next step is then to demonstrate conclusively that this performance can be achieved. This is the primary role of performance demonstration or qualification. The challenge to performance demonstration practitioners is to organize and perform this important mission in the most effective and efficient way.

As we have seen, a thorough knowledge of the contributions of NDE to reactor safety is essential in order to properly define the most important NDE parameters to qualify and to provide realistic and accurate criteria for qualification. For example, modification of RPV flaw distribution as discussed in the previous section requires accurate information on the flaw detection and flaw sizing performance of the inspection system. Thus, the qualification must be organized to measure these relevant parameters accurately, and the qualification level should match the inspection objective. In the BWR beltline weld example, inspection is of little value. In this example, performance demonstration of any quality level would not be justified. Examination of the inner region of PWR RPVs, on the other hand, would require a more appropriate level of inspection quality and qualification approach. Piping examination is an intermediate situation because the risk associated with piping varies by several orders of magnitude according to the particular location.

Performance demonstration has taken many different forms, ranging from simple demonstrations of capability to in-depth theoretical and experimental verifications (10). Many years of performance demonstration experience have shown that several principles are the most important to successful and meaningful qualifications.

Analysis to Match Performance Level to Technical Need.

• Identification of technical needs
  • Flaw detection efficiency
  • Sizing accuracy
  • Discrimination of flaws from non-flaw conditions

Process Design

• Develop supporting technical basis that challenges the procedure and personnel
  • Computer modeling or other theoretical evidence
  • Historical data
  • Laboratory experiments
• Identify need for mockups
  • Number of samples
  • Number and type of flaws
  • Realism of mockups and flaws
• Develop demonstration protocol
  • Acceptance criteria
  • Simulation of field conditions
  • Monitoring requirements
  • Grading
  • Record keeping and documentation of results
  • Blind or non-blind demonstration
  • Personnel or procedure qualification

Implementation

• Scheduling
• Funding
• Regulatory and Code - relationships
• Industry consensus on approach
• Quality assurance
• Security of samples and data

Discussion continues worldwide on the relative merits of blind and non-blind methods for qualification. Both methods are in use in the United States and other countries for a variety of programs. In each case, the technical merits of the approach are evaluated, and appropriate methods selected that best accomplish the objectives. Blind qualification is often perceived as burdensome and limiting due to the practicality of using a limited number of samples that can address only a finite number of conditions. Experience has proved that this need not be the case. Applications in many different situations have shown that either the blind or the non-blind method can produce technically sound and reliable results, provided a thorough technical case has been made beforehand and properly documented. Blind qualification is also sometimes seen to have an advantage of being more readily accepted by regulatory authorities who typically prefer definitive results achieved under blind conditions. In fact, non-blind qualifications have provided technically equivalent results when the process is designed to ensure that all of the steps used by the inspection personnel to make decisions are logical, well defined, and adequately described in the procedure and are followed. Regardless of the method chosen, qualification must be organized to thoroughly evaluate the inspection system performance and to ensure that the inspection procedure is complete and implementable for actual examinations.

Implementation of Effective NDE Technology

Development of reliable inspection technology, assessment of the safety contribution of inspection, and qualification of the inspection system will accomplish nothing unless the inspection technology is implemented. Commercial and economic pressures are impediments to implementation of improved (and often expensive) NDE technology by inspection organizations. EPRI recognizes this dilemma and is addressing it by working directly with inspection companies and utilities to facilitate development and commercialization of efficient and effective technology (11). This is done by providing technical assistance to the inspection organization, assisting with demonstration and qualification activities, providing access to a comprehensive collection of realistic mockups, assisting the utility with field application, and providing credible evidence of inspection effectiveness that can be provided to all parties, including the regulator.

Utilities and inspection companies must first see that benefits will outweigh the costs before investing in expensive new technology. The benefits that utilities are most interested in achieving include safety improvements, radiation exposure reduction, facilitating regulatory compliance, and cost reduction. Ease of implementation at the plant is an important issue facing both the utility and the inspection organization.

Elimination of negligible value inspections not only lowers cost and radiation exposure, it also allows utilities to apply these resources to more risk significant locations. Implementation of appropriate ISI technology is therefore facilitated greatly when the connection to safety or reliability is well known.

Conclusions

The main conclusion to be drawn from the examples given in this paper is that assessment of the contribution of NDE to reactor safety requires careful analysis, and is not immediately obvious. This assessment should be the first step in inspection design. Analysis tools that use risk insights are available to address this question. Such analysis allows inspection to be focused on the most risk significant locations in a way that ensures that the safety goals can be met. Focusing on the most important locations results in improved safety and can often be achieved with fewer, but more effective, inspections. This kind of analysis provides essential information to NDE designers and performance demonstration designers to optimize the procedures and qualification to ensure that the important parameters are measured effectively and efficiently. Reactor safety can be then be enhanced when the appropriate inspections are performed in the most safety-significant systems and components. Insights drawn from this analysis enables the NDE community to be well informed and prepared to address the relevant damage mechanisms and locations. Performance demonstration is a flexible tool for ensuring that inspection processes effectively and efficiently address relevant safety or other strategic objectives. Understanding the connection of ISI to safety allows performance demonstration to organized efficiently and ensures that the inspection will actually address the safety or reliability objective.

References

1. Ricardella, P. et. al., Evaluation of Inservice Inspection Requirements for Class 1, Category B-J Pressure Retaining Welds in Piping. ASME Section XI Task Group on ISI Optimization, White Paper Report No. 92-02-01, July, 1995
2. Gosselin, S. Risk Informed Inservice Inspection Evaluation Procedure. Electric Power Research Institute, TR-106706, June 1996
3. USNRC. Draft Regulatory Guide DG-1063: An Approach for Plant-Specific, Risk-Informed Decision Making: Inservice Inspection of Piping. October 1997
4. Gosselin, S. Flemming, C. Evaluation of Pipe Failure Potential via Degradation Mechanism Assessment. Proceedings of ICONE-5, 5^th International Conference on Nuclear Engineering, May 26-30, 1997, Nice, France
5. Gosselin, S. Risk Informed Inservice Inspection Evaluation Procedure. Electric Power Research Institute, TR-106706, June 1996
6. EPRI. Application of the EPRI Risk-Informed Inservice Inspection Evaluation Procedure; Volume 1: A BWR Pilot Study. EPRI TR-107530-V1, December, 1997
7. EPRI. BWR Reactor Pressure Vessel Shell Weld Inspection Recommendations. BWRVIP-05. EPRI TR-105697, September, 1995
8. Ammirato, F, and Dimitrejevic, V. Use of NDE Data to Improve Analysis of Reactor Pressure Vessel Integrity. EPRI TR-102074, March 1993
9. Becker, L. Appendix VIII and Implementation by PDI. Proceedings of the Joint EC OECD IAEA Specialists Meeting on NDE Techniques Capability Demonstration and Inspection Qualification. Edited by U. von Estorff and P. Lemaitre. Petten, Netherlands, 11-13 March, 1997
10. Ammirato, F. US Position on Inspection Performance Demonstration. 14^th ASM International Conference on NDE in the Nuclear and Pressure Vessel Industries, Stockholm, September, 1996
11. Hayden, J. Phased Array Ultrasonic Examination of BWR Core Shroud Assembly Welds. Proceedings of the 3^rd EPRI Reactor Pressure Vessel Inspection Conference. Santa Fe, New Mexico, June 22-24, 1998