SKI Report 97:26 (3rd Edition)

Reliability of Piping System Components

Framework for Estimating Failure Parameters
from Service Data

Ralph Nyman
Damir Hegedus
Bojan Tomic
Bengt Lydell

December 1997

ISSN 1104-1374
ISRN SKI-R--97/26--SE

STATENS kÄRNKRAFTINSPEKTION
Swedish Nuclear Power Inspectorate
 SKI Report 97:26 (3rd Edition)
SKI/RA-018/97

Reliability of Piping System Components

Framework for Estimating Failure

Parameters from Service Data

Ralph Nyman 1
Damir Hegedus 2
Bojan Tomic 2
Bengt Lydell 3

December 1997

1Swedish Nuclear Power Inspectorate, Department of Plant

Safety Assessment (SKI/RA), SE-106 58 Stockholm, Sweden

2 ENCONET Consulting GesmbH

Auhofstraße 58
A-1130 Vienna, Austria

3Sigma-Phase, Inc.
149 S. Mercedes Rd.
Fallbrook, CA 92028-2400, U.S.A.

Disclaimer: This report concerns a study conducted for the Swedish Nuclear Power Inspectorate (SKI). The
conclusions and viewpoints presented in the report are those of the authors and do not necessarily coincide with
those of the SKI.
 Note to 3rd Edition

This new edition includes an updated Appendix B. Since the publication of the original
report, the pipe failure database that resulted from the work documented herein has been
continuously updated and maintained. Appendix B accounts for information added to this
database since 1997. Except for minor editorial corrections, Sections 1 through 6 and
Appendices A and C remain unchanged. Since the original work performed during 1994-
97, there has been significant progress made in the pipe failure database management as
well as practical database applications:

• Active database management under a strict QA program. At the end of 2004, the
database included approximately 5,500 records on pipe degradation and failure. Since
January 1999, monthly status reports have been compiled and distributed to interested
parties.
• The OECD/Nuclear Energy Agency OPDE Project (OECD Pipe Failure Data
Exchange) was established in 2002 as a multilateral cooperative effort comprising 19
organizations from 12 countries. The OPDE project is based on what was originally
termed the “SLAP database” as it were at the end of 1998.
• Large number of database applications during the period 1999-2004. Insights from
these applications have formed an important role in supporting the database
management. Mainly, these applications have involved quantitative assessments of
piping reliability in support of risk-informed activities (e.g., risk-informed ISI, internal
flooding risk assessment, LOCA frequency assessments).
• Development of tools for parameter estimation including assessment of uncertainties.

In retrospect, all of the recommendations for further work identified in Section 6 of this
report now have been implemented and peer reviewed. Additional information is available
from the OPDE National Coordinator (Karen Gott, SKI), Ralph Nyman (SKI) or Bengt
Lydell.

B. Lydell
January 2005

SKI Report 97:26 (3rd Edition) i

 TABLE OF CONTENTS

1 INTRODUCTION........................................................................................................ 1
1.1 Project History ................................................................................................. 1
1.2 Technical Scope & Organization of the Project............................................... 2
1.3 Piping Reliability Considerations .................................................................... 4
1.4 Framework for Piping Reliability Analysis ..................................................... 5
1.5 Work Scope Limitations .................................................................................. 8
1.6 The Intended User of the ‘PFCA’ Framework & Data .................................... 9
1.7 Database Availability....................................................................................... 9
1.8 Organization of the Report............................................................................... 9
1.9 References ...................................................................................................... 10
2 UNIQUE PROBLEMS IN PIPING RELIABILITY ANALYSIS............................. 11
2.1 Passive vs. Active Component Reliability..................................................... 11
2.2 Component Boundary & Estimation of Failure Parameters .......................... 12
2.3 PSA vs. PFM.................................................................................................. 12
2.4 Discussion ...................................................................................................... 14
3 SERVICE DATA ON PIPING .................................................................................. 15
3.1 Pipe Failure Data - Sources of Uncertainty ................................................... 15
3.2 The SLAP Database Content & Coverage ..................................................... 16
3.3 The Reporting of Piping Failures................................................................... 18
3.3.1 Reporting Practices and the Quality & Completeness of Data .................. 19
3.3.2 Assessing Coverage & Completeness........................................................ 24
3.4 Conditional Factors of Pipe Failure ............................................................... 27
3.5 Time-Dependent vs. Demand-Dependent Failures ........................................ 31
3.6 Random and Systematic Piping Failures ....................................................... 32
3.7 ‘Old’ vs. ‘New’ Service Data......................................................................... 33
3.8 Discussion ...................................................................................................... 34
3.9 References ...................................................................................................... 34
4 DATA REDUCTION................................................................................................. 36
4.1 Models for Estimating Piping Failure Rates .................................................. 36
4.2 Reliability Attributes and Influence Factors .................................................. 37
4.3 Determining Attributes from Service Data .................................................... 39
4.3.1 Conditional Probability of Failure ............................................................. 39
4.3.2 Comparison and Validation of Attributes .................................................. 41
4.4 Reliability Influence Factors.......................................................................... 45
4.4.1 Determining Influence Factors from Operational Data ............................. 46
4.4.2 Evaluating Plant-Specific Service Data ..................................................... 51
4.4.3 ‘Bounding’ of Influence Factors ................................................................ 52
4.5 An Interim ‘SLAP Reliability Correlation’ ................................................... 53
4.6 Discussion ...................................................................................................... 54
4.7 References ...................................................................................................... 55
5 THE ‘PFCA’ ANALYSIS FRAMEWORK............................................................... 57
5.1 An Overview of the ‘PFCA’ Framework....................................................... 57
5.2 The ‘PFCA’ Steps .......................................................................................... 60

SKI Report 97:26 (3rd Edition) ii

 5.2.1 Step 1: Definition of Application Requirements........................................ 62
5.2.3 Step 3: Reliability Influence Factors.......................................................... 68
5.2.4 Step 4: Definition of Piping System Component Boundary ...................... 70
5.2.5 Step 5: Statistical Analysis & Uncertainty Analysis.................................. 73
5.3 Guiding Principles.......................................................................................... 74
5.4 Discussion ...................................................................................................... 77
5.5 References ...................................................................................................... 78
6 SUMMARY & RECOMMENDATIONS ................................................................. 79
6.1 Overview of the Technical Approach ............................................................ 79
6.2 Recommendations for Further Work ............................................................. 80
APPENDIX A: SOURCES OF DATA ON PIPING FAILURES ................................. 82

APPENDIX B: RAW DATA SUMMARIES: PIPING SYSTEM OPERATING

EXPERIENCE IN NPPs WORLDWIDE ...................................................................... 90

APPENDIX C: ABBREVIATIONS, ACRONYMS & GLOSSARY ......................... 100

SKI Report 97:26 (3rd Edition) iii

 LIST OF FIGURES

Figure 1. Approaches to Estimating Piping Reliability ................................................... 4

Figure 2. The Five-Step PFCA Framework for Piping Reliability Analysis ................... 6
Figure 3. The SLAP Database and the ‘PFCA? Framework ........................................... 7
Figure 4. Overview of Database Content by System Category ..................................... 17
Figure 5. Pipe Failure Mode Definitions Used in Developing the SLAP Database ...... 20
Figure 6. Development of the SLAP Database - The Event Review Process................ 20
Figure 7. The SLAP Database Content (Number of Failures per Plant and Year) ........ 27
Figure 8. Overview of Systematic Failures in the SLAP Database ............................... 32
Figure 9. Simplified Root Cause Perspective on Attributes & Influences .................... 38
Figure 10. Conditional Rupture Probability as a Function of Diameter & Material ..... 42
Figure 11. Conditional Rupture Probability of IGSCC-Susceptible Stainless Steel Pipe
................................................................................................................................ 42
Figure 12. Conceptual Relationships between Attributes and Influence Factors .......... 46
Figure 13. Example of Hazard Plot of Time to Small Leaks in Stainless Steel Piping . 53
Figure 14. The Five-Step ‘PFCA Framework’ for Piping Reliability Analysis ............ 58
Figure 15. Illustration of the Data Needs - The Frequency of Pipe Failure................... 60
Figure 16. Step 1 of the ‘PFCA’ Framework - Application Requirements ................... 63
Figure 17. Blank Sample Spreadsheet for Collecting Piping System Information........ 65
Figure 18. Step 2 of the ‘PFCA’ Framework - Estimation of the Conditional Pipe
Rupture Probability ................................................................................................ 67
Figure 19. Step 3 of the ‘PFCA’ Guidelines - Evaluation of Influence Factors ............ 68
Figure 20. ‘Step 4 of the PFCA’ Framework - Estimation of Pipe Rupture Frequency 70
Figure 21. Conditional Rupture Probabilities for Different Attributes.......................... 76

SKI Report 97:26 (3rd Edition) iv

 LIST OF TABLES

Table 1. Examples of Stressors, Degradation Mechanisms / Failure Mechanisms &

Failure Modes of Piping Systems ............................................................................ 8
Table 2. Basic Differences Between Passive & Active Component Reliability............ 11
Table 3. The Difference between PSA and PFM........................................................... 13
Table 4. The SLAP Database Content (Version 7, Revision 7) ..................................... 16
Table 5. The SLAP Database Content Organized by Pipe Size, Plant Operational State
& Apparent Cause of Failure (SLAP Version 7, Revision 7)................................ 18
Table 6. Comparison of the Database Contents in SLAP & SKI Report 96:20 ............ 18
Table 7. Examples of NDE-Based Reporting Criteria ................................................... 22
Table 8. Examples of Primary & Secondary Information Sources of SLAP Database . 26
Table 9. Conditional Probability of ‘Rupture’ by Attribute (SLAP Version 7.7) ......... 41
Table 10. Examples of Different Piping Reliability Attributes ..................................... 44
Table 11. Some Remedies for Mitigation of IGSCC (Adapted from Danko (1983) ..... 47
Table 12. Examples of Influence Factors and Piping Damage/ Failure Locations........ 49
Table 13. An Example of Influence Matrix ................................................................... 49
Table 14. Overall Range of Effect of Influence on Pipe Reliability - Example #1 ....... 50
Table 15. Overall Range of Effect of Influence on Pipe Reliability - Example #2 ....... 51
Table 16. Evaluation of Plant-Specific Influence Factors - An Interim Proposal ......... 52
Table 17. Factor of Improvement for Piping Failure Remedies (IGSCC in DN100
Piping) .................................................................................................................... 53
Table 18. Probability of DEGB and Leak in RCS Piping[5-6] - An Example ................. 66
Table 19. Examples of Literature Data on Piping System Component Populations ..... 72
Table 20. Examples of Pipe Failure and Rupture Frequency Estimates........................ 75
Table 21. Some Pipe Failure Frequency Bases.............................................................. 77

SKI Report 97:26 (3rd Edition) v

 SUMMARY

This report summarizes results and insights from the final phase of an R&D project on
piping reliability sponsored by the Swedish Nuclear Power Inspectorate (SKI). The
technical scope includes the development of an analysis framework for estimating piping
reliability parameters from service data.

The R&D has produced a large database on the operating experience with piping
systems in commercial nuclear power plants worldwide. It covers the period 1970 to the
present. The scope of the work emphasized pipe failures (i.e., flaws/cracks, leaks and
ruptures) in light water reactors (LWRs).

Pipe failures are rare events. A data reduction format was developed to ensure that
homogenous data sets are prepared from scarce service data. This data reduction format
distinguishes between reliability attributes and reliability influence factors. The
quantitative results of the analysis of service data are in the form of conditional
probabilities of pipe rupture given failures (flaws/cracks, leaks or ruptures) and
frequencies of pipe failures.

Finally, the R&D by SKI produced an analysis framework in support of practical

applications of service data in PSA. This, multi-purpose framework, termed ‘PFCA’ -
Pipe Failure Cause and Attribute - defines minimum requirements on piping reliability
analysis. The application of service data should reflect the requirements of an application.
Together with raw data summaries, this analysis framewok enables the development of
apriori and aposteriori pipe rupture probability distributions. The framework supports
LOCA frequency estimation, steam line break frequency estimation, as well as the
development of strategies for optimized in-service inspection strategies.

SKI Report 97:26 (3rd Edition) vi

 SAMMANFATTNING

Statens Kärnkraftinspektion (SKI) har under perioden 1994-97 bedrivit ett forsknings- och
utvecklingsproject med avsikt att bestämma rörbrottssannolikheter utgående från
drifterfarenheter. Föreliggande rapport utgör slutgiltlig dokumentering av resultat från
projektarnbetet. Resultaten från arbetet utgörs av:

(1) Händelsebaserad databas över intäffade skador i kärnkraftverk under perioden

1970-1997. Tyngdpunkten ligger på amerikanska ock nordiska drift- erfarenheter.
Storleksordningen 2400 skaderapporter har insamlats och bearbetats.

(2) Datahaneterings- och dataanalys baserad på tillämpning a begreppen ‘tillförlit-

lighetsattribut’ och ‘influensfaktorer.’ Resultaten datanalysen redovisas I form av
rörskadefrekvenser och betingade brottsannolikheter.

(3) Generella riktlinjer för tillförlitlighetsanalys av rörsystem i kärnkraftverk. Dessa

riktlinjer innhåller minimikrav beträffande uppläggning och dokumentering av
analyser inom ramen för PSA-tillämpningar.

SKI Report 97:26 (3rd Edition) vii

 ACKNOWLEDGEMENTS

The authors of SKI report 97:26 greatfully acknowledge the extensive support and
encouragement from numerous industry organizations and nuclear safety professionals
throughout Europe and the USA. A special thank you is extended to Messrs. Rudolf
Häussermann and Henk van Ojik of Kernkraftwerk Leibstadt AG (KKL, Switzerland),
Messrs Ralph-Michael Zander and Adelbert Gessler of Kernkraftwerke Gundremmingen
Betriebsgesellschaft mbH (KGB, Germany), Kalle Jänkälä (IVO International, Ltd.), Dr.
Yovan Lukic (Arizona Public Service), and Dr. Ching Guey (Florida Power & Light).

This final project report benefitted from the constructive critique by Dr. Roger
Cooke (Delft University of Technology, The Netherlands), Ms. Jette Paulsen (Risø
National Laboratory, Denmark), and Mr. Sture Andersson (S-A Ingenjörsbyrå AB,
Sweden).

SPECIAL NOTE ON TERMINOLOGY

The term ‘sterss corrosion cracking’ (SCC) is normally used to characterize a group of
degradation mechanisms involving environment- and stress-induced crack propagation in
austenitic stainless steel piping. Included among SCC-mechanisms are: intergranular SCC,
transgranular SCC, irradiation induced SCC, etc. Throughout this report we have used
SCC to mean stress corrosion in PWR environments, and IGSCC to mean stress corrosion
in BWR environments.

Throughout SKI Report 97:26 the term ‘failure’ implies a degradation of the
structural reliability resulting in repair or replacement of a section of piping or an
individual pipe fitting. The mode of failure is either a flaw/crack/thinning, leak or rupture
corresponding to incipient, degraded and complete failure, respectively.

SKI Report 97:26 (3rd Edition) viii

 1

INTRODUCTION

This report summarizes results and insights from the final phase of an R&D project on
piping reliability sponsored by the Swedish Nuclear Power Inspectorate (SKI)1. The
technical scope includes the development of an analysis framework for estimating piping
reliability parameters from service data.

The project has benefited from previous efforts to derive failure parameters from
service data. It differs from these earlier efforts by having had access to a broader and
more extensive database on piping failures, however. The present work has focused on
practical, engineering-oriented interpretations of the service data. The purpose of this final
report is to present the requirements on input and output activities of a five-step analysis
framework for piping reliability analysis. Explorations of industry-wide and plant-specific
operational data via conditional factors of piping reliability are central to this analysis
framework.

1.1 Project History

Among the motivations behind this SKI-funded project were: 1) Define the requirements
for appropriate and sufficient service data and analysis techniques for parameter estimation
in support of PSA applications and PSA-based evaluations of licensee submittals involving
piping system modifications; 2) Address the need for improved treatment of piping
reliability in today’s PSA studies; and 3) Address the need for improved analysis of
service data on piping systems2.

Traditionally, PSA studies have not included detailed analyses of passive

component failures. Usually the passive components have been excluded from system
models. The argument for doing so was that the failure rates were considered negligibly
small. Furthermore, most PSAs modeled initiating events3 caused by passive component
failures as single basic events or ‘black boxes.’ As the nuclear power plants are getting
older, a critical evaluation of these analysis practices is needed, however. Central to the
project was the development of an event-based, relational database on the service
experience with piping systems in nuclear power plants worldwide. The work also
included the development of a framework for analyzing these data in the context of PSA
application requirements. Initiated in the fall of 1994, the project has been performed in
three phases:

1
Copies of earlier project reports and conference papers (from PSAM-III and PSA’96) are available from the
Swedish Nuclear Power Inspectorate as hard copies or in PDF format.
2
Includes PSA-based event analysis and precursor evaluations of piping system failures such as the one
performed by VTT (1994)[1-1].
3
As examples, loss of coolant accidents (LOCAs), intersystem LOCA (ISLOCA), internal flooding due to
service water system piping break/rupture.

SKI Report 97:26 (3rd Edition) 1

(1) Design of an event-based, relational database in MS-Access®, and preliminary
gathering of data sources with emphasis on piping failures in Swedish and U.S.
nuclear power plants and Russian-designed plants (i.e., RBMKs and WWERs).4 A
first database version was available in the spring of 1995. At that time it included
about 1,500 failure reports. Insights from reviews of an additional ca. 300 piping
failures in non-nuclear facilities enabled a limited comparison between nuclear
industry and chemical process industry data5.

(2) Detailed review of previous efforts to develop failure parameters based on

operational data. In addition, an extensive survey was performed on the estimation
of loss-of-coolant-accident (LOCA) frequencies in over 60 PSA studies. The
results of the Phase 2 of the project included a definition of requirements for a
piping reliability analysis framework using operational data. The work in Phase 2
was documented in four SKI Reports published during 1996[1-2,3,4,5]. These reports
included some preliminary insights from database explorations.

(3) The final phase has concentrated on the development of an analysis framework.
This framework has been greatly influenced by insights from analyzing the
operational data. The database development has continued throughout Phase 3, and
it has benefited from access to proprietary service data from five European utilities.
The analysis framework builds on the concept of ‘conditional factors’ of piping
failure, which includes evaluations of the unique reliability attributes and influence
factors affecting or controlling the piping integrity.

Throughout the R&D, the project team has sought input from the international
nuclear industry and the research community. Volume 1 of the four technical reports
generated by Phase 2 of the project were peer reviewed by a team of experts on plant
operations, PSA and structural reliability. Peer review comments were received from
Arizona Public Service, EQE International, Florida Power & Light Company, IVO
Consulting Oy., Kernkraftwerk Leibstadt AG, and Scientech Inc. This final project report
has been peer reviewed by Dr. Roger Cooke (Delft University of Technology, The
Netherlands), Ms. Jette Paulsen (Risø National Laboratory, Denmark) and Mr. Sture
Andersson (S-A Ingenjörsbyrå AB, Sweden).

1.2 Technical Scope & Organization of the Project

Based on the analysis of service data, this SKI-sponsored project attempts to improve the
PSA-treatment of piping reliability. This R&D was prompted by a need to develop an
integrated analysis approach to support PSA applications, including the evaluation of the
impact on plant risk by modified in-service inspection programs. Also, the project
addressed new requirements to be placed on the incorporation of piping reliability into
PSA studies on older nuclear power plants. The technical scope was limited to evaluations

4 Footnote added to 2nd Edition: Since end of 1997, this database has been subject to an ongoing, active
database management effort. The database management is now part of an international program managed by
the OECD Nuclear Energy Agency.
5
Among the conclusions from this comparison were: a) the data from non-nuclear facilities have little or no
relevance to the piping systems in nuclear power plants; and b) the coverage and completeness of the non-
nuclear operating experience data repositories is limited.

SKI Report 97:26 (3rd Edition) 2

of event data extracted from licensee event reports. The intended applications of the event
database and the analysis framework include the following:

− LOCA frequency estimation. Under an assumption that the piping systems that are
part of the reactor coolant pressure boundary (RCPB) have been evaluated in terms
of number of components (e.g., welds, straight sections, elbows, tees), material,
and operating experience, the data and the analysis framework support plant-
specific LOCA frequency estimation.

− Initiating event (IE) estimation. For IEs such as main steam line break, internal
flooding due to service water system pipe rupture, the data and analysis framework
support plant-specific IE frequency estimation.

− PSA applications. The data together with the analysis framework support plant-
specific, optimization of in-service inspection (ISI) programs. The pipe rupture
frequency is calculated for individual pipe sections. Based on plant risk, a
modified inspection approach would eliminate low-risk pipe sections.

Piping reliability is a very complex topic and this final project report should be
viewed as a first step to develop detailed analysis guidelines, which are acceptable to PSA
practitioners and safety engineers. Additionally, the final project report develops a basis
for guidelines on how to report and evaluate piping failures. Specifically, this report covers
the following aspects of piping reliability: 1) The determination of the frequency of piping
degradation or failures including cracks, leaks and ruptures; 2) Estimation of the
probability of pipe rupture given a degradation of a piping system; and 3) Estimation of
piping reliability parameters for input to PSA models. The report also identifies areas in
need of additional work. Future efforts, especially in the area of data collection and data
analysis, should be pursued within the international cooperative nuclear safety R&D
programs.

Coordinated by the SKI Project Manager, Mr. Ralph Nyman (Department of Plant
Safety Assessment), the technical work was performed jointly by ENCONET Consulting
Ges.m.b.H. and RSA Technologies. Phase 1 of the project, initiated in October of 1994,
produced the database design, while Phase 2, initiated in April of 1995, included surveys
of the PSA state-of-analysis-practice with respect to LOCA frequency assessment. In
Phase 3, Mr. Bengt Lydell (RSA Technologies) was the principal investigator and the
author of the final project report.

During the fall of 1996, preliminary data analysis insights from Phase 3 were
presented to OKG AB and IVO Consulting Oy, respectively. Comments and
recommendations from these two Nordic industry organizations were incorporated in the
data reduction and analysis efforts performed during the 2nd half of 1996 and the 1st half of
1997.

Furthermore, an information exchange was also established with the parallel

Nordic Nuclear Safety Research Program ‘NKS/RAK-1.2: Strategies for Reactor Safety -
Preventing Loss of Coolant Accidents’ in which a probabilistic fracture mechanics model
was developed to calculate pipe break probabilities due to IGSCC in Swedish BWRs. The

SKI Report 97:26 (3rd Edition) 3

‘International Seminar on Piping Reliability’6, held on September 30 and October 1, 1997,
represented the formal conclusion of the SKI R&D project.

1.3 Piping Reliability Considerations

The reliability of piping system components is of great importance to the nuclear industry.
Piping systems are used extensively, and the degradation or failure of piping has
significant safety and financial implications. The modern PSA studies should account for
potential piping failures by acknowledging the available operating experience. Also,
systematic evaluations of the experience with non-destructive examination (NDE) and in-
service inspection (ISI) would benefit from the access to a comprehensive database on the
operating experience with piping systems to determine the effectiveness of NDE/ISI. In
part, this project was motivated by the ongoing Swedish plant renovation and
modernization projects and the requirements for improved treatment of LOCA frequency
estimation in the Swedish PSA studies.

As expressed by the American Society of Mechanical Engineers (ASME) Research

Task Force on Risk-Based Inspections[1-6]: “... the task of estimating piping reliability is
complex, uncertain and costly ...” There is no one best method to estimate failure
probabilities. Therefore, the estimation process has to rely on insights from the relatively
large number of incipient and degraded failures, which have occurred in NPPs worldwide.
Since major structural failures are rare events, safety engineers and PSA practitioners
should always consider the broadest possible database on operational events. Because of
the complex nature of piping reliability, it is equally important that there exists synergy
between PSA and structural mechanics including probabilistic fracture mechanics (PFM).
The methods for assessing piping reliability use a combination of techniques as indicated
in Figure 1-1.

Direct Estimation Using Service Data Results from Analysis Using

(This Project) Probabilistic Fracture Mechanics

Expert Judgment
Elicitation and Discussion

Estimated Failure Rates &

Rupture Probabilities

Figure 1. Approaches to Estimating Piping Reliability

6
Seminar on Piping Reliability: Presentation of Piping Reliability Research in Support of the Nordic PSA
Program & Other SKI Sponsored Projects, September 30 - October 1, 1997, Sigtuna (Sweden). Copies of the
Proceedings of the seminar (SKI Report 97:32) are available from the Swedish Nuclear Power Inspectorate.

SKI Report 97:26 (3rd Edition) 4

 With emphasis on applications of historical data (i.e., service data), the analysis
framework addresses the different options available in parameter estimation. This
framework encompasses requirements on probabilistic fracture mechanics studies; e.g.,
degradation mechanisms to consider, qualification of input and output data.

In PSA, a lack of quantitative models (i.e., decomposition and holistic models of

reliability) and failure data has directed practitioners to WASH-1400 (the Reactor Safety
Study of 1975). The validity of LOCA frequencies and piping failure rates often has been
cited solely on the basis of referencing the WASH-1400, and without questioning the old
data or the approach to deriving or inferring failure parameters in that study. In the opinion
of the authors of this SKI Report, the available operational data should always be
systematically explored when deriving LOCA frequencies. It is especially important that
the available, current experience data be explored by comparing industry-wide and plant-
specific service data. Analysts should take into account the current state-of-knowledge
about structural mechanics and degradation mechanisms.

1.4 Framework for Piping Reliability Analysis

The analysis framework, developed by the project, was fashioned after the results and
insights from analyzing a large volume of service data. Therefore, this framework is data-
driven. Parameter estimation based exclusively on experience data is not advisable, nor
feasible for all intended applications, however. Throughout an estimation process, it is
highly recommended that expert judgment by structural expertise be considered. The
analysis framework, which is called the ‘Pipe Failure Cause and Attribute Framework’
(PFCA), is a top-down approach favoring decomposition of a given piping reliability
problem according to reliability attributes and influences; c.f. Figure 1-2. It is a top-down
approach since an analysis would begin by specifying the requirements of an application.
That is, the framework builds on the analysts' understanding of the design and operational
factors, operating history, inspection history, and environmental influences that affect
piping reliability. The framework consists of five steps with inputs, analytical activities or
deliberations, rules and outputs:

(1) Application Requirements. The input consists of descriptions (e.g., isometric

drawings, material specifications) of a piping system, and service history. The
output is a concise description of the planned application; e.g., estimation of
LOCA or main steam line break (MSLB) frequency. The intended application
determines how to select generic piping reliability parameters. It also determines
how reliability attributes and influences are evaluated and used. Finally, the
application requirements determine which piping system component boundaries to
use; e.g., piping section/segment definitions. Examples are given of typical
requirements with discussion of the implications for the subsequent analysis steps.

(2) Raw Data, Piping Population Data & Generic Reliability Parameters. The
framework includes the necessary analysis techniques and raw data for calculating
plant-specific parameters. The framework comes with tabulations of raw data and
piping component population data for a selection of different plant types and
systems. Pipe failures are rare events, and the framework includes consideration of
Bayesian statistics. First, application-specific priors are developed, and second, the

SKI Report 97:26 (3rd Edition) 5

 user performs a detailed evaluation of plant-specific operating experience
(including inspection records and other relevant information) to estimate the plant-
specific parameters. Hence, the framework makes a distinction between
application-specific and plant-specific parameters. The former enables the
selection of the most appropriate and relevant operating experience to be used.

Output:
Step 1: Define Application Reliability attributes with
Requirements justifications.
The purpose is to determine the
key reliability attribute(s).

Step 2: Conditional Rupture Probability Output:

Based on Step 1 and the data summaries Condition probability of
in Appendix B (SKI Report 97:26) estimate pipe rupture for an attribute.
the conditional probability of pipe rupture.

Output:
Step 3: Reliability Influence Factors Definition of plant-specific
Generic matrices used as templates for influence factors and their
effect on piping reliability.
reviewing plant-specific operational data
to enable the modification of a generic
failure distribution.

Step 4: Piping Component Boundary

Depending on application requirements and
outputs from Step 3, this step determines Output:
the pipe failure frequency and its correct Plant-specific pipe rupture
dimension; e.g., 1/reactor-year and weld. frequency compatible
with PSA model specs.

Step 5: Sensitivity & Uncertainty Analysis

Using the output from previous steps, the
plant-specific parameters are evaluated Output:
'Qualification' of parameter
relative to sensitivites / uncertainties. estimates.

Figure 2. The Five-Step PFCA Framework for Piping Reliability Analysis

(3) Reliability Influences & Review of Plant-Specific Experience. The step from
application- to plant-specific parameter estimation is taken via application of
reliability influence matrices (or checklists). Extracted from SKI’s pipe failure
event database (SLAP; c.f. Figure 1-3), the framework provides detailed influence
matrices (by major degradation or failure mechanism) that list potential plant-
specific influences and their relative contribution to reliability. These matrices are
the templates to be used by PSA practitioners, who are familiar with model
requirements, and structural experts intimately familiar with the piping system
designs, the operating experience, and the NDE/ISI practices.

SKI Report 97:26 (3rd Edition) 6

 Failure Data Sources

LERs, PNOs, ROs, IAEA/NEA

Incident Reporting System, etc.

SLAP DATABASE
Data Reduction Data Manipulation & Analysis
('Archive' of Failure Reports)

The PFCA Framework

(see Figure 1-2)

Figure 3. The SLAP Database and the ‘PFCA? Framework

(4) Piping Component Boundary Definition. The review in Step 3 should be done on
the basis of isometric drawings, and the output could be in the form of pipe
section/segment definitions, and a quantitative basis for modifying generic
reliability parameters, with proper justifications. The purpose of Step 4 is to define
the dimension of the parameter estimates and the PSA model representation of
piping failures. The dimension (e.g., failure/system-year, failure/‘length-of-
piping’-and-year, failure/weld-and-year) is a function of the predominant
degradation or failure mechanism, material, system layout, etc. With respect to the
model representation, the question addressed by Step 4 is whether piping reliability
should be considered at the cutset level or at a different level in the PSA model
structure? In the opinion of the project team, whenever PSA-based applications or
risk monitoring requirements have been defined, a high level of model
discrimination is preferred over 'black box' models. Most importantly, the
boundary definition should be a function of the type of degradation or failure
mechanism affecting a piping system.

(5) Statistical Analysis & Uncertainty Analysis. The framework recognizes the
importance of analyzing uncertainties. The sources of uncertainties are identified
and evaluated in Step 5. It is recognized that in the final derivation of plant-
specific parameters, expert judgment elicitation and engineering evaluations will
be combined with estimates that are based on operational data. Ultimately the goal
of performing uncertainty analysis is to qualify those conclusions that are made
about piping reliability based on point estimate evaluations. It should also be used
to identify where improving the state of knowledge can lead to maximum benefit
with respect to an accurate assessment of piping reliability.

Depending on the scope of an analysis, an application of the framework may

involve only Steps 1 and 2, or all five steps. Rigorous applications would be relatively
time-consuming, and could require extensive inputs from structural expertise. The users of
this framework are encouraged to explore the raw data on piping failures beyond the scope
of the present report. It is invariably expected that the user is team of experts, which
determines what the unique failure modes and degradation and mechanisms are, and where
faults (e.g. flaws/cracks, leaks) in a given piping system are most likely to occur.

SKI Report 97:26 (3rd Edition) 7

1.5 Work Scope Limitations

The R&D-project considered service data involving degradation mechanisms (or aging
mechanisms, due to corrosion, erosion/corrosion, stress corrosion cracking) and failure
mechanisms (such as severe overloading due to water hammer, inadvertent over-
pressurization); c.f. Table 1. The emphasis was on degradation mechanisms acting on
piping systems within the RCPB, however. Additional study scope limitations included:

- The survey of service data emphasized leaks and ruptures as documented in public
information sources (e.g., Swedish and U.S. licensee reporting systems). Service
data on flaws/cracks were selectively considered; e.g., significant events with
potential generic implications. Information on flaws/cracks typically is included in
ISIS summary reports. Such reports were not available to the project, however.

- The study did not include a systematic and detailed determination of the frequency
of water hammer events in piping systems. Only water hammer events, which
resulted in significant pipe damage (e.g., major leak, rupture or severance) were
considered;

- The study did not collect piping component population data. This report
emphasizes the estimation of relative pipe failure parameter estimates rather than
absolute estimation. Detailed collections of piping component population data will
evolve with the number of plant-specific applications of a piping reliability
analysis framework such as the PFCA. Appendix B includes a selection of
component population data for different piping systems and types of nuclear power
plants. These population data were extracted from public domain documents.

Table 1. Examples of Stressors, Degradation Mechanisms / Failure Mechanisms & Failure

Modes of Piping Systems7
Stressors Degradation / Aging Failure Mechanisms Failure Modes
Mechanisms
Single-phase flow Erosion / corrosion Crack / leak / rupture
Two-phase flow Erosion / corrosion d:o
Temperature gradients Fatigue d:o
and transients
Environmental stress / Stress corrosion Crack / leak / rupture
sensitization cracking ( PWSCC / d:o
IGSCC / TGSCC)
Vibration Fatigue / overload Crack / leak / rupture
Water hammer / seismic Fatigue / overload / d:o + severance /
events / testing / drop of overpressurization deformation / distortion
heavy load

7
Adapted from Conley, D.A., J.L. Edson and C.F. Fineman, 1995. Aging Study of Boiling Water Reactor High Pressure Injection
Systems, INEL-94/0090 (NUREG/CR-5462), Idaho National Engineering Laboratory, Idaho Falls (ID).

SKI Report 97:26 (3rd Edition) 8

− The study did not consider degradation or failures of internal reactor components
such as jet pump risers in some BWRs8. In other words, only piping system
components external to the reactor pressure vessel were considered.

1.6 The Intended User of the ‘PFCA’ Framework & Data

This report does not include processed failure parameters for direct input to PSA models. It
is a ‘basis document’, which identifies the unique aspects of piping reliability that require
detailed, explicit consideration in the parameter estimation. Therefore, the report is
intended for the advanced PSA practitioner with prior experience of data analysis. By
using the raw data summaries (in Appendix B) and an analysis framework (Section 5), the
practitioner is given the necessary tools and techniques to pursue plant-specific
applications of a data-driven model of piping reliability.

The proposed analysis framework is not a prescriptive, step-by-step analysis

procedure. Instead, the framework defines a minimum set of requirements on piping
reliability analysis based on interpretations of service data. The user of the framework is
encouraged to explore the service data beyond the presentations and representations of this
report.

1.7 Database Availability

The project has produced a large, relational database in MS-Access® on pipe failures in
nuclear power plants worldwide. The computer file size (in compacted form) of the current
version is approximately 2.5 Mb. Each data record (i.e., failure event) consists of 54 data
fields, which provide design information (material specifications, size), event narratives,
results from event analyses (e.g., root cause analyses), and information on the effect on
plant operation[1-7]. The database content is proprietary to the SKI. Nuclear safety
professionals and PSA practitioners interested in reviewing and applying the full database
must contact the SKI in writing to establish the terms-and-conditions for database access9.

1.8 Organization of the Report

The report consists of six sections and three appendices. Section 2 includes a statement on
the unique passive component reliability issues. Also included in Section 2 is an overview
of the potential interfaces between data-driven models and probabilistic fracture
mechanics, followed by a brief discussion on the role of material sciences in PSA. The
technical basis for the PFCA Framework is developed in Sections 3 and 4. With the
objective of summarizing sources of statistical uncertainties, Section 3 describes the
operational data on piping failures, and the coverage and completeness of the SLAP
database. This presentation sets the stage for Section 4, which describes the conditional
factors of piping failures. Specifically, Section 4 presents the definitions of piping
reliability attributes and influence factors and how they are used to reduce, manipulate and
8
As an example, see U.S. NRC Information Notice 97-02 (February 6, 1997): Cracks Found in Jet Pump Assembly Elbows at Boiling
Water Reactors.
9
Limited to the database version SKI-PIPE dated 12/31/1998. Letters should be forwarded to the following address: Swedish Nuclear
Power Inspectorate, Plant Safety Assessment - Dept. RA, Att.: Mr. Ralph Nyman, SE-106 58 Stockholm, Sweden.

SKI Report 97:26 (3rd Edition) 9

analyze the service data in the SLAP database.

Section 5 describes each of the five steps of the PFCA Framework, discusses the
activities pertinent to each step, and presents the rules or recommended implementations
for each step. The section illustrates the use of the framework, and includes a discussion on
statistical uncertainties as they apply to piping reliability analysis. Finally, Section 6
presents recommendations for pilot applications and future short- and long-term R&D,
together with the conclusions.

There are three appendices to the report. Appendix A presents the pipe failure
event data sources used in developing the SLAP database. Appendix B is a compilation of
a selection of raw data to be used as input to the PFCA Framework. Appendix C, finally,
contains a list of abbreviations and acronyms together with a glossary of technical terms.

1.9 References

(1-1) Holmberg, J. And P. Pyy, 1994. Example of a PSA-Based Analysis of an Occurred

Pipe Break at TVO I, NKS/SIK-1(93)17, VTT Industrial Automation, Espoo (Finland).

(1-2). Swedish Nuclear Power Inspectorate, 1996. Reliability of Piping System

Components. Volume 1: Piping Reliability - A Resource Document for PSA Applications,
SKI Report 95:58, Stockholm (Sweden).

(1-3). ibid, Volume 2: PSA LOCA Database; Review of Methods for LOCA Evaluation
Since WASH-1400, SKI Report 95:59, Stockholm (Sweden).

(1-4). ibid, Volume 3: Piping Reliability - A Bibliography, SKI Report 95:60, Stockholm
(Sweden).

(1-5). ibid, Volume 4: The Pipe Failure Event Database, SKI Report 95:61, Stockholm
(Sweden).

(1-6). Balkey, K.R. et al, 1992. Risk-Based Inspection - Development of Guidelines.

Volume 2 - Part 1: Light Water Reactor (LWR) Nuclear Power Plant Components, CRTD-
Vol. 20-2, The American Society of Mechanical Engineers, New York (NY), ISBN 0-
7918-0658-8, pp 24-27.

(1-7) Lydell, B.O.Y., 1997. SKI’s Worldwide Pipe Failure Event Database – SLAP,
Version 7.7, RSA-R-97-22, RSA Technologies, Vista (CA).

SKI Report 97:26 (3rd Edition) 10

 2

UNIQUE PROBLEMS IN PIPING

RELIABILITY ANALYSIS

The development of comprehensive databases and analysis frameworks for passive

component (e.g., piping) reliability has lagged behind the corresponding efforts for active
component reliability. In part, this discrepancy is a function of the complex nature of
piping reliability. While a consensus exists regarding the analytical treatment of active
component reliability, no such consensus has evolved for passive components. This section
investigates the unique differences between active and passive component reliability. The
motives of the SKI-funded R&D are delineated in this section.

2.1 Passive vs. Active Component Reliability

Piping systems are designed to high quality standards. These systems represent an
important safety barrier, which forms one of several elements in the defense-in-depth
concept of nuclear safety. Catastrophic piping failures are rare events, thus proving the
effectiveness of the design codes and standards. Piping systems are susceptible to aging
effects, however. Since piping systems cannot be subjected to the same maintenance and
replacement strategies as the active components, a fundamental question arises relative to
the importance of aging effects: How should the limited service data be used to address
these aging effects in today’s PSA applications? An overview of the basic differences
between passive and active component reliability is found in Table 2.

Table 2. Basic Differences Between Passive & Active Component Reliability

Feature Passive Component Active Component
Component Boundary Continuous (or ‘extended’; the piping Discrete well (uniquely) defined
Definition system boundary is defined by the plant component boundaries. Data
system boundary. That is, the boundary of collections such as the Nordic
a feedwater piping system is defined by ‘T-Book’ or IEEE Std. 500
the feedwater system boundary. contain details on component
boundaries.
Failure Rate Dimension 1/(Time · Extension) -- the ‘extension’ Uniquely defined by: dimension
cannot be universally defined. Could be ‘time’ or ‘demand’.
length of piping, number of pipe sections,
number of piping system components.
Frequency of Failure Rare events Frequent events
Component Type Many different types distinguished by Standard types
material, diameter, environment, process
medium, operating environment, etc.
Failure Modes and A spectrum of failure modes; from small Limited number of failure modes
Failure Causes to large leaks to ruptures. The (e.g., failure to start, failure to
susceptibility to failure strongly run).
dependent on design and degradation and
failure mechanisms. Difference with
respect to cause and severity.

SKI Report 97:26 (3rd Edition) 11

2.2 Component Boundary & Estimation of Failure Parameters

By definition, a component boundary clearly relates all interfaces of a specific component

to other components in the system with which it interfaces via hardware and software.
Therefore, a failure of a component relates to a clearly defined component boundary. In
other words, the physical location of a failure corresponds with a boundary definition.
Unlike active components (e.g., MOVs, pumps, electrical breakers/switches), for piping
systems one cannot define a universal piping component boundary, however. The problem
of estimating pipe failure rates and failure probabilities from scarce service data is
compounded by the fact that the large volume of piping in a nuclear power plant (NPP)
consists of many different types of piping systems.

The piping systems range from small-diameter to large-diameter piping, primary

system piping to support system piping, etc. Furthermore, the piping systems differ
according to material, process medium and operating conditions. The failure
susceptibilities are functions of the design and operational characteristics. Obviously, the
analysis of service data on piping failures must differentiate between type of piping
system, operating environment, cause and severity. Subsequently, the estimation of failure
parameters and the definition of appropriate component boundaries should reflect these
unique features of a piping system (i.e., type, environment, and cause/severity). We
calculate the failure rate of piping from:

λPIPING = (Number of Failures)/(Time × Extension) (2-1)

where ‘Extension’ = Length of piping, or number of piping system components in the

system for which the failure parameter is estimated. Could be number of pipe
sections; a section could be a segment of piping between major discontinuities
such as valves, pumps, reducers, tees.

The estimation of failure parameters builds on access to homogenous data on

events within a clearly defined component boundary. This means that the service data must
be pooled according to type of system, environment, cause and severity, and component
boundary. The extension follows on having a full understanding of ‘why-where-how’
piping systems fail.

2.3 PSA vs. PFM

The unique differences between passive and active component reliability, and the
difficulties associated with failure parameter estimation using scarce service data have
been recognized and debated for a long time. As an alternative to the ‘data-driven models’
of piping reliability, the material sciences have proposed the application of fracture
mechanics models. These models enable the calculation of failure probabilities assuming
that a piping system is susceptible to anticipated degradation mechanisms; especially
aging effects (such as stress corrosion cracking), which develop over a long time period.

There is a long-standing debate (at least since the early 1970’s) between PSA and
material sciences disciplines regarding the areas of applicability of data-driven models and
PFM. To the PSA practitioners the analytical problems associated with rare events are well
understood. According to the material sciences, it is impossible to make realistic estimates
SKI Report 97:26 (3rd Edition) 12
of the probability of pipe rupture when the service experience is zero failures in, say, 8,500
reactor years10. For this reason alone, direct estimation using service data should not be
pursued. In fact, the pursuit of service data collections has been questioned. What are the
areas of applicability of data-driven models and PFM models? In its most basic form, the
frequency, fR, of a pipe rupture is calculated from the following symbolic expression:

fR = fFAILURE ×·pRUPTURE | FAILURE

(2-2)

where fR = frequency of a pipe rupture;

fFAILURE = frequency of a pipe failure (e.g., flaw/crack, leakage);
pRUPTURE | FAILURE = conditional probability of rupture given a flaw/crack or
leakage.

The difference between PSA and PFM lies in the way the conditional probability of
pipe rupture is calculated; c.f. Table 3. In PSA the estimation is performed through detailed
evaluations of service data combined with application of Bayesian statistics (in the case of
zero failures) and expert judgment. The material sciences use fracture mechanics models
and expert judgment.

Table 3. The Difference between PSA and PFM

Method Estimation of Estimation of Comment
fFAILURE PRUPTURE | FAILURE
PFM Direct estimation Application of Assumes anticipated degra-dation (i.e., long
from service data fracture mechanics time between crack initiation → leak →
theory to the rupture) in austenitic steels. No treatment of
analysis of crack uncertainties. Requires population data.
growth Explicit treatment of the reliability of in-
service inspection methods. Parametric
models which enable sensitivity analysis.
PSA Direct estimation Direct estimation Requires population data. Implicit treatment
from service data from service data of the reliability of in-service inspection
methods. Parametric studies feasible.
Controversial in the context of LOCA
frequency estimation.

As summarized in Table 3, the approach to the estimation of pipe rupture frequency

in PFM and PSA builds on interpretations of service data. An outstanding issue is the
estimation of the conditional pipe rupture probability. Ultimately, the requirements that are
placed upon an analysis determine the selection of methodology. The R&D by SKI to
develop a comprehensive database on the service experience with piping systems and the
analysis framework, PFCA, supports both technical approaches.

A basic difference between the two approaches is found in the estimation of the
conditional rupture probability. Under a similar set of boundary conditions, the two
methods tend to produce similar (i.e., the same order-of-magnitude) results, however. The
statistical uncertainties are considerable, no matter the technical approach. The proper
merging of PSA and PFM depends on the full recognition of the methodological
differences. Possibly more important than these methodological differences, PSA and
material sciences use different terminology and definitions. Much could be gained from
10
According to IAEA data, at the end of 1996 the worldwide NPP operating experience was about 8,500 reactor-years. During that time
there have been no ruptures in medium- to large-diameter piping inside the RCPB.

SKI Report 97:26 (3rd Edition) 13

using common terminology:

- On Pipe Failure Mode Definitions: The material sciences tend to define ‘failure’ as
a ‘double-ended-guillotine-break’ (DEGB) where the pipe ends are axially
displaced or completely separated. PSA distinguishes between ‘flaw/crack’, ‘leak’
and ‘rupture’. In PSA a small leak from a large-diameter pipe could have the same
consequence as a large leak from a small-diameter pipe.

- On LOCA definitions: Material sciences only consider the DEGB that results in a
loss of process medium beyond the make-up capability of safety injection systems.
That is, the material sciences are concerned with the LOCA concept as defined by
the design basis accident (DBA) in deterministic safety analysis. PSA considers a
spectrum of pipe ruptures that could cause a small-small to large LOCAs with or
without make-up capability.

A major advantage of PFM lies in its application of parametric models, which

enable sensitivity studies, and the evaluation of leak detection and ISI reliability. An
advantage of data-driven models is the relative ease by which the applications can be
performed. The quality and completeness of the pipe failure databases limit the
applications of service data, however.

2.4 Discussion

The R&D by SKI was initiated to address the unique problems in piping reliability
analysis. Detailed evaluations of service data enabled development of recommendations
for how to define piping component boundaries. This R&D also addressed the
requirements to be place upon data-driven models of piping reliability. Sections 3 through
6 develop the basic techniques of piping reliability analysis from the perspective of service
data.

SKI Report 97:26 (3rd Edition) 14

 3

SERVICE DATA ON PIPING

In Section 1 we presented basic elements of a framework for analyzing piping reliability,

which is based on evaluations of operational data. In this section, we consider the basic
principles of how to collect and analyze service data. Also considered is the relationship
between past and current reporting practices and the coverage and completeness of service
data. The purpose is to address practical considerations in pipe failure data collection. We
explore the question whether robust and believable failure parameters can be derived from
service data: Does the SLAP database have sufficient depth and detail to support
meaningful reliability estimation?

SKI’s R&D project has produced a large database on piping failures. The unique
problems associated with operational data and piping reliability estimation were addressed
over thirty years ago. Since that time (i.e., 1964-68), several organizations have pursued
database development and data analysis. Despite these efforts, no widely recognized PSA-
oriented database has emerged. When viewed against the past projects, the uniqueness of
SKI’s R&D lies in the depth of the data collection. Reports on incipient, degraded and
complete failures have been collected from operating nuclear power plants worldwide. The
analysis of these data builds on the concept of ‘conditional factors of failure,’ which
emphasizes the relative differences in reliability. These conditional factors relate to design
parameters and environmental influences.

3.1 Pipe Failure Data - Sources of Uncertainty

Probabilistic safety assessment (PSA) is a safety assessment tool for nuclear power plants
(NPPs). An intrinsic element of PSA consists of the estimation of equipment reliability
parameters from plant operating records. The validity of a PSA is a function of how this
estimation is performed, and how well the system and plant models reflect an as-built and
as-operated NPP. Translating plant records into reliability parameters requires detailed
engineering knowledge as well as knowledge of the strengths and limitations of statistical
analysis techniques and methods.

Data estimation is done in two steps: 1) Collection of data on occurrences of the

events of interest; and 2) Parameter estimation with the aid of statistical analysis
techniques and methods. The foundation for believable estimates is laid in step 1. A first
consideration of this step involves a determination that sufficiently detailed information
has been collected on 'all' relevant failure events.

The completeness of a data collection reflects the scope of an analysis effort as well
as the extent of the exploration of different sources of operational data for the nominated
failure events. Incomplete data sets could lead to an under-estimation of the data
parameters. Step 2 of the data estimation is concerned with the selection of appropriate
techniques and methods so that the important factors, which affect reliability, are
addressed in sufficient detail.

SKI Report 97:26 (3rd Edition) 15

 Extensive use of judgment is made in both these steps. The most extensive use of
judgment usually is made in step 1 of the estimation process. Sometimes the available
information in the plant records is unclear and incomplete. A reasonable interpretation of
such information is impossible without having a detailed knowledge about the specific
equipment-related failure modes and failure mechanisms. It is equally important to
understand the reporting practices and the bases for maintenance work orders, licensee
event reports, etc. In the next sections we address key considerations in collecting data on
pipe failure events, and the data coverage and completeness issues.

3.2 The SLAP Database Content & Coverage

Databases on equipment failures must be tailored according to specific objectives. The

SLAP database builds on the principle of collecting data on an event and exposure basis.
Incorrect or incomplete data interpretations would result from a data collection, which is
limited to a fault-count basis. The analysis of conditional factors of piping failures requires
access to data collections, which include information on the ‘why-where-how’ failures
occurred.

The SLAP database contains information on known (i.e., reported) pipe failures in
nuclear power plants worldwide. It covers the period 1970 to the present. In developing the
database the scope of the work has emphasized pipe failures in light water reactors
(LWRs). Currently (October 1997), the database includes about 2,360 qualified failure
reports; c.f. Table 4.

Table 4. The SLAP Database Content (Version 7, Revision 7)11

Number of Plants Coverage(b) Failure Mode
(a)
Plant Type Surveyed [Reactor-Years] Crack(c) Leak Rupture
BWR 71 (94) 1,398 (2,282) 114 (1183) 648 (969) 63 (72)
LWGR 13 (13) 208 (302) 3 (100) 41 (49) 14 (14)
PHWR 20 (40) 354 (753) 11 (11) 75 (77) 14 (14)
PWR 164 (318) 2,670 (5,748) 55 (431) 1206 (1697) 112 (148)
”Other” (5) (94) (5) (5) (3)
Totals: 274 (421) 4,741 (9,179) 183 (1730) 1970 (2913) 203 (251)
Notes: (a) The material used in primary system piping differs among the plant types; e.g., industrial grade
vs. 'nuclear grade' stainless steel. Also, as an example, in WWER-1000, the primary system piping
material is ferritic steel with austenitic cladding as an anti-corrosion measure.
(b) As of 9/30/97; no adjustment made for time in maintenance/refueling outage.
(c) Significant events only: crack depth > 20% of wall thickness. The total number of flaws among
the worldwide NPP population is estimated to be at least a factor of 10 larger.
(d) Catastrophic loss of structural integrity and/or leak rate > 5 kg/s (80 gpm), without advance
warning; e.g., no drop leakage or leakage large enough to actuate a leak detection system to enable
prevention.

In Table 4, the category ‘rupture’ includes two types of events: 1) Catastrophic rupture
which resulted in complete separation of pipe ends, or major ‘fish-mouth’ opening; and 2)
Major crack opening which resulted in leakage in excess of 5 kg/s (80 gpm). In both cases
the failure occurs without advance warning to the control room operators. The failure
reports included in SLAP were all classified according to leak rates. For the majority of the
reports, the leak rates were estimated based on event narratives.

11 Information in parentheses corresponds to database status as of 12-31-2004.

SKI Report 97:26 (3rd Edition) 16

 Except for the Swedish, U.S. and selected European plants, for which licensee
event reports and special failure reports were available, the primary reference used was the
IAEA/NEA Incident Reporting System (IRS)[3-1]. By design, the IRS database includes
nominated or significant events as submitted by participating organizations. That is, an
event report is submitted to IRS when the event is considered by a national coordinator to
be of international interest. Approximately 10% of all pipe failure event records were
extracted from the IRS database.

Summaries of the SLAP database content by pipe diameter, mode of plant

operation when a failure was detected, and type of degradation or failure mechanisms are
given in Figure 4 and Table 5. To date, all large-diameter, complete failures (i.e., ruptures)
have occurred in balance-of-plant (BOP) systems, support systems or fire protection
system; i.e., LOCA-insensitive piping. Complete failures affecting LOCA-sensitive piping
(i.e., piping within the RCPB) have been restricted to small-diameter piping of DN ≤ 25.
That is, instrument lines, vent/drain lines, bypass lines and test/sample lines. Finally, the
SLAP database content is compared with a recent, independent data collection effort in
Table 6.

SUPPORT
> DN250 (CS) BOP
RCPB

100 < DN <= 250 (CS)

50 < DN <= 100 (CS)

25 < DN <= 50 (CS)

15 < DN <= 25 (CS)

<= DN15 (CS)

0.00% 2.00% 4.00% 6.00% 8.00% 10.00% 12.00% 14.00% 16.00%

Percentage of Failure Records in Database

Figure 4. Overview of Database Content by System Category12

12
SUPPORT = Support System (e.g., component cooling water, service water, instrument air); BOP = Balance of Plant System (e.g.,
moisture separator reheater lines, condensate piping); RCPB = Reactor Coolant Pressure Boundary (systems within containment, see
Appendix C for definition).

SKI Report 97:26 (3rd Edition) 17

Table 5. The SLAP Database Content Organized by Pipe Size, Plant Operational State
& Apparent Cause of Failure (SLAP Version 7, Revision 7)
Number of Failure Records
Attribute / Influence Crack Leak Rupture
Nominal Pipe Diameter
≤ DN15 6 138 19
15 < DN ≤ 25 13 732 55
25 < DN ≤ 50 15 261 25
50 < DN ≤ 100 25 178 16
100 < DN ≤ 250 49 312 43
> DN250 61 129 33
Unknown 14 220 12
TOTAL: 183 1970 203
(a)
Operational Mode
Startup 3 190 24
Normal operation 34 1600 157
Shutdown 146 180 22
TOTAL: 183 1970 203

Apparent Degradation / Failure Mechanism

Corrosion+Erosion 14 490 50
Fatigue 40 656 64
IGSCC / SCC / TGSCC 102(b) 295 --
Severe Overloading (e.g., water hammer) 18 74 52
Human error 5 248 13
Other(c) 4 207 24
Totals: 183 1970 203
Notes: (a). Operational mode at the time when a piping failure was detected.
(b). Rejectable cracks (crack depth > 20% of pipe wall thickness).
(c). No explicit statement about cause of failure in LER, or results from ongoing investigation
not yet available.

Table 6. Comparison of the Database Contents in SLAP & SKI Report 96:20
Pipe Size SLAP Version 7.7 SKI Report 96:20
[Number of Records] [Number of Records]

DN ≤ 25 963 (41%) 574 (38%)

25 < DN ≤ 100 521 (22%) 252 (17%)
100 < DN ≤ 300 446 (19%) 155 (10%)
> DN300 180 (8%) 74 (5%)
Unknown / Assumed Size(a) 246 (10%) 456 (30%)
Totals: 2356 1511
Note: (a). Failure report contains no explicit information on diameter.

3.3 The Reporting of Piping Failures

The piping systems in nuclear power plants are designed to high standards, and major
failures are rare events. The rare failures have a low frequency of occurrence (e.g., less
than, or much less than one failure per plant and year). Not only are the major, catastrophic
failures rare events when viewed against a frequency-scale, they are also rare when viewed
against a passive component ‘population-scale.’ Nuclear power plants contain a large
volume of piping components (e.g., many thousands of welds, and several km of length of
piping). Therefore, for any given plant, the ratio of major failures by the total piping
component population is small (<< 0.1). Most piping failure incidents are incipient or
SKI Report 97:26 (3rd Edition) 18
degraded failures with minor or no immediate impact on plant operation and safety. The
incipient or degraded failures have a relatively high frequency of occurrence; e.g., equal to
or greater than one event per plant and year.

While the volume of technical information on operating experience with piping

systems is considerable, the quality of this information varies immensely. Some reports
present detailed root cause analysis insights and results (c.f. U.S. NRC, 1997[3-3]), while the
majority of the reports contains cursory (and sometimes conflicting) information on the
causes and consequences. The determination of root cause involves interpretation of
results from visual examinations and, sometimes, detailed metallurgical evaluations of
damaged or fractured piping components. In general, failure analyses and reliability
analyses of incidents involving piping systems are complex and uncertain.

For the work documented in this report, the main source of information on piping
failures was licensee event reports (LERs). The LERs are mainly prepared upon failure
conditions, which place the plant operations outside the technical specifications. Rather
than evaluations of the root causes, these reports concentrate on the apparent causes of
failure. Uniform regulatory reporting requirements do not yet exist, and no industry
standards have been developed for the reporting and dissemination of information on
piping failures. This lack of detailed reporting protocols reflects the complex nature of
piping reliability.

It is the opinion of the authors of this report that the lack of consistent reporting
follows on not having a recognized model for analyzing piping reliability. Substantial
interpretation of the available failure information is needed to determine the where-why-
how a particular piping system failed. The interpretation should reflect the purpose of an
analysis and the database design. It is not uncommon that the failure reports include
detailed narratives of the circumstances of a given event (e.g., plant status and plant
response). Reporting of the specifics of a piping failure (e.g., exact description of fault
location, mode of failure, type and diameter of the failed piping component, trends and
failure patterns) is beyond the scope of most LER systems, however. Therefore, and
accurate and consistent failure classification often requires an ‘interrogation’ of several,
independent information sources.

3.3.1 Reporting Practices and the Quality & Completeness of Data

Typically, piping failures are reported as ‘cracks/crack indications’, ‘leaks’ or ‘ruptures’,

corresponding to incipient, degraded and complete failure, respectively; c.f. Figure 5. In
this project, a ‘rupture’ is interpreted as a catastrophic loss of mechanical integrity, which
occurs without advance warning. Ruptures potentially result in very large leak rates >> 5
kg/s (80 gpm).

SKI Report 97:26 (3rd Edition) 19

 Note, the service experience shows that leaks due to through
Piping System Incident wall thermal fatigue and stress corrosion cracks have provided
Crack or series of cracks in ample warning to enable mitigative action. Piping damaged by
one heat affected zone or in flow-assisted corrosion has on occasion lost its strength and
one location of the base-metal. failed catastrophically.

Incipient Failure Degraded Failure

Complete Failure
Wall thinning or crack < through- Detectable leak; within or in
Large leak / break resulting in
wall (TW) or TW-crack resulting excess of Technical Specification
leak rate >> TS limits.
in pinhole leak / seepage. (TS) limitations.

Complete Failure
Leak-Before-Break
Rupture, leak rate > 5 kg/s,
Break-Before-Leak
no advance warning.

Figure 5. Pipe Failure Mode Definitions Used in Developing the SLAP Database

The classification of events and the analysis of data build on a consistent

application of clear definitions of failure. In the context of PSA, inadvertent or improper
classification of a piping failure event as rupture could result in significant over-estimation
of the true rupture frequency or probability. From the point of parameter estimation, there
are several inherent limitations of LERs. By design, LERs document the effects of failure
on system and safety functions. They do not go into the details about the specific
degradation or failure mechanisms, contributing causes, and required repair actions,
however. Therefore, events identified as candidates for inclusion in the SLAP database
were processed according to the flowchart in Figure 6 and by augmenting the LER
information with other relevant information sources.

LER Selected for Review

LER review 'filter' no. 1

Positive identification of
Positive identification of
leaking pipe through leak No
crack / wall-thinning through
detection system and/or
NDE/ISI?
visual testing / walk-through?
Yes
Yes
Record included in SLAP &
LER review 'filter' no. 2
classified as 'crack' or wall
thinning if determined as a
rejectable degradation.
Leak rate > 5 kg/s (80 gpm),
Positive identification of
and event narrative confirms
size of crack/fracture and
No 'break-before-leak' (BBL), and
leak rate < 5 kg/s. Mitigation
results from root cause analysis
through isolation and plant
confirms a 'major structural
shutdown?
breakdown' of piping/fitting?
Yes
Yes
Event included in SLAP
and classified as 'pinhole Event included in SLAP
(P/H) leak' or 'leak' and classified as 'rupture'
depending on leak rate.

Figure 6. Development of the SLAP Database - The Event Review Process

SKI Report 97:26 (3rd Edition) 20

 Functional and structural interpretations of the potential or actual consequences of
a given failure determine whether a formal, written report is prepared by a licensee for
internal use or dispositioning with a regulatory agency. As an example, the probable
consequences of small cracks due to stress corrosion cracking in piping within the Reactor
Coolant Pressure Boundary (RCPB) are crack propagation in the through-wall direction
and minor leakage of primary coolant. When small but detectable leaks occur, leak
monitoring systems detect the change of leak rate, and a plant shutdown is required if
allowable leak rate limits are exceeded. Such events are reportable according to technical
specification reporting requirements. These reporting requirements do not cover
degradation or failures in steam or feedwater piping that are outside of the RCPB
boundary, however. Furthermore, the reporting of piping failures is a function of the
approach to replacement of degraded piping. The replacement of degraded piping prior to
developing a gross leakage would normally not be a reportable event. With the exception
for significant degradation and complete failures occurring within the RCPB, ad hoc
reporting of piping failures is the norm rather than the exception.

These observations would not be of any concern to PSA practitioners, were it not
for the fact that piping failures are rare events. The believable reliability estimation based
on the operational data requires full consideration of the entire body of operating
experience, and a consistent interpretation of the diverse failure information. There needs
to be assurance about the completeness and relevance of the operational data to be
considered in piping reliability analysis.

A range of different reporting criteria is in current use. These criteria mostly follow
structural reliability considerations and RCPB leak rate criteria as defined by the technical
specifications for plant operation, and applicable piping codes and standards.

The piping codes define minimum requirements for design, materials, fabrication,
installation, test and inspection. The standards contain design and construction rules and
requirements for individual piping components such as elbows, tees, flanges and other in-
line items. Compliance to Code is mandated by regulations imposed by regulatory
agencies. The codes and standards encompass consideration of metallurgical degradation
mechanisms. There are mandatory and non-mandatory requirements for nondestructive
examination (NDE), including, as an example, inservice inspection (ISI) of Class 1, 2 and
3 component and structures per the American Society of Mechanical Engineers (ASME)
Boiler and Pressure Vessel Code (ASME BPVC) Section XI[3-4].

The purpose of NDE is to determine the suitability for continued use of a given
piping system after a predetermined in-service time. Depending on the extent of
degradation, the findings of NDE could result in formal or informal reporting to regulatory
agencies. Some examples of typical NDE-based reporting criteria are summarized in Table
7. While there are regional differences among the criteria, most of them are adaptations of
the ASME BPVC Section XI and the applicable American National Standards Institute
(ANSI) standards. In Sweden, SKIFS 1994:1[3-5] documents regulatory requirements for
the mechanical integrity of piping system components.

SKI Report 97:26 (3rd Edition) 21

Table 7. Examples of NDE-Based Reporting Criteria
ISI Acceptance Standards & Reporting Criteria - Some Examples

ƒ Formal dispositioning with regulatory agency for pipe wall thickness < 50% of nominal
wall thickness (NWT).
ƒ Increased inspection frequency for wall thickness < 75% NWT; discretionary reporting
may be acceptable.
ƒ Using radiography, any elongated indication with a length greater than 1/3 T for T (=
thickness of weld being examined) from 6 mm to 57 mm inclusive is unacceptable.

In addition to the structural reliability considerations, functional requirements (e.g.,

acceptable leak rates) also determine the reporting of piping failures. The definition of
failure criteria based on leak rates is difficult and must, as a minimum, acknowledge the
design criteria as defined in Final Safety Analysis Reports; e.g., leak detection capability
and reliability, and make-up capacity of engineered safety systems. The majority of
documents surveyed during the database development and data collection did not include
explicit leak rate or leak duration information.

A large portion of reported incipient and degraded failures within the RCPB are
detected by in-service inspection (ISI) during annual refueling and maintenance outages.
Relaxations in the plant technical specifications (TS) and reporting requirements during
outages result in discretionary reporting of the ISI-findings, however. This means that
while formal licensee event reports (LERs) would not be filed based on the NDE/IS
findings, other means of reporting could be prepared as part of summaries of the
performance of outage activities (i.e., outage inspection reports). If a ‘significant’ ISI-
finding by one licensee is believed to have potential generic, industry-wide implications,
then that finding would be reported and result in formal dispositioning. Not only would the
‘discovering’ licensee provide a report, but also the other licensees which are affected by
the original ISI results. The NDE-based reporting criteria are interpreted and implemented
on a case-by-case basis, and a lack of functional considerations could impose restrictions
on the dissemination of reports within and outside an organization. Examples of reporting
practices include:

- Significant incipient or degraded failures discovered during refueling or extended

maintenance outages normally are reported to regulatory agencies.

- Some degraded failures during routine power operation are reported; especially
those with assumed generic implications.

- Most degraded failures within the RCPB are reported, especially where there is an
external leakage which is detected by the leak detection system(s). The reporting
is almost guaranteed whenever the plant-specific TS defines leak rate criteria with
limiting conditions for operation (LCO).

- There are many exceptions to the above practices, however. As an example, to

effect repairs, a RCPB leak could result in a planned shutdown of the unit. While
progressing with the manual shutdown, an equipment failure occurs which is
unrelated to the leak but possibly triggered by the change of plant status and causes
an automatic reactor trip, say, from 50% power. In this case a LER may be filed for
the equipment failure which caused the trip directly, but none filed for the piping
SKI Report 97:26 (3rd Edition) 22
 failure. Therefore, a search for failure data on piping often must include more than
one information source (c.f. Appendix A).

- Complete failures (e.g., ruptures) which result in manual or automatic reactor trip
are reported most of the time, especially if they occur within the RCPB.
Discretionary reporting applies to failures outside the RCPB.

There is no all-encompassing definition of pipe failure modes. Different

interpretations based on functional and/or structural interpretations lead to inconsistent
reporting of failures, and complicates data analysis. Insights from the data collection effort
in this project seem to imply that ruptures and major leaks are reported at all time, while
the incipient and degraded failures (e.g., leaks near or well below the TS limitations) at
best are reported on an ad hoc basis. In simple terms, a rupture is a major loss of
mechanical integrity without advance warning. Such an event is not foregone by
precursors such as drop leakage, or leakage large enough to activate a leak detection
system that would enable mitigation by plant personnel. Using a functional definition, a
rupture is a piping failure which causes a loss of coolant (or process medium) inventory in
excess of the make-up capability of an engineered safety system (or non-safety-related
make-up system). The different interpretations of failure potentially influence the formal
reporting of events involving piping degradation.

The reliability of reactor pressure vessels and primary system piping is an

important topic for nuclear safety R&D as well as plant operations. The earliest nuclear
safety debates kept addressing this complex reliability issue; sometimes in a highly
unbalanced way. With this debate followed a ‘sensitized’ awareness about the potential
implications of including too detailed accounts of the evaluations of results from NDE/ISI
in the licensee event reports. Non-stringent use of technical terms could be misinterpreted.
The historical developments within the nuclear safety have influenced the way piping
failures are documented and reported today.

Since piping reliability and reporting of failures are so difficult, is there a way of
determining the coverage and completeness of failure reports? A philosophy adopted by
this project is the notion that piping failures of varying severity have occurred at each
operating plant worldwide. Failure reports qualified for entry into the database came from
the plants subjected to a detailed survey of its operating history. Plants not yet covered by
the database were those plants for which operational data were unavailable to the project.
In developing the SLAP database the emphasis of the detailed surveys of operational data
was on Swedish and U.S. plants. According to the SLAP database, the annual frequency of
a piping degradation is on the order of 0.5 event per year and plant (c.f. Table 3-1, page
16), which should be compared with the following published estimates:

- According to Rodabaugh (1985)[3-6], a “…reasonable pipe failure rate…” is about 1

event per year and plant;

- Recent information on flaws/cracks, leaks and ruptures in German reactor and

feedwater-condensate piping systems indicates a failure rate of about 0.2 event per
year and plant; c.f. Reck and Bieniussa (1995)[3-7].

SKI Report 97:26 (3rd Edition) 23

 We will return to the estimation of piping failure ‘initiating’ event frequencies in
Sections 4 and 5. For reasons discussed below, the uncertainties in the pipe failure
frequency estimation are considerable.

3.3.2 Assessing Coverage & Completeness

Databases on equipment failures must be tailored according to specific objectives. These

objectives should be reflected in the database coverage and the efforts to achieve
completeness. The coverage and completeness are concerned with fault-counts and the
conditional factors of failure. Both these factors have an important impact on the data
quality.

Determination of uncertainties in input data parameters and results is an important

analytical activity in PSA. Therefore, each stage of PSA model development includes
stating the assumptions and the reason(s) for selecting certain data parameters. The effects
of assumptions and data selections on results and insights are determined through
sensitivity analyses and engineering evaluations. An underlying premise of PSA is that
analysts fully understand the range of operating experience covered by the data, and how
the input data parameters were derived. In reliability data analysis the estimators for failure
rates and demand failure probabilities must relate to a statistical model as well as data
collection approach. As an example, for maximum likelihood estimators the necessary data
to be collected are:

X = number of failures of the particular failure mode;

T = total exposure time of the items during the period of event data surveillance;
N = total number of item demands during the period of event data surveillance.

Quality PSA is a function of the technical knowledge embedded in judgments, data

selections, parameter estimation and model development. Verification and validation of
data parameters are important considerations in quality PSA. The performance of
verification and validation includes the assessment of the coverage and completeness of
data. The numerators and denominators of the maximum likelihood estimators must be
consistently developed. Coverage is defined as a ratio of the number of occurrences
reported in a database versus all occurrences reported in that database and elsewhere. For
SLAP the coverage is expressed by:

QN = FSLAP / (FSLAP + FMISS ) (3-1)

where QN = Coverage of the SLAP database. QN varies from a value greater than 0 to a
maximum of 1, where 1 indicates full coverage.
FSLAP = Number of occurrences reported in the SLAP database.
FMISS = Number of occurrences reported elsewhere (e.g., proprietary data not
available to this project), but not in SLAP. Possible omissions are included by this
category; i.e., piping failure reports that should have been captured in SLAP but
were not due to omissions by the database developers.

How many reports are missing from SLAP? An accurate assessment is difficult or
impossible to achieve. The coverage varies according to the type of piping system and type
of plant, and the reporting practices. Beyond the proprietary data submitted to the project

SKI Report 97:26 (3rd Edition) 24

by five European utilities, one could say that the Swedish and U.S. data on significant
piping failures within the RCPB has ‘reasonable coverage.’ Between 80 to 90% of all
major leaks and ruptures are believed to be included in SLAP; c.f. Appendix A for further
discussions on the database coverage.

Completeness is defined by the reliability attributes and reliability influences (c.f.

Section 4), which that are addressed by the reports in a given database. In other words, do
the failure records include sufficient information to support a definite classification of a
failure event? The accurate interpretation and classification of failure build on the
technical information contained by the reports. Where information is missing, inferences
will have to be made from event narratives or similarities with other events for which more
details are available. Obviously, errors in the interpretation of incomplete failure reports
represent one source of uncertainty in the statistical estimation of failure parameters.

During the development of the SLAP database, the coverage and completeness
issues were addressed by using calibration data, and diverse and complementary
information sources. Comparisons against data summaries in the public domain were made
to test the coverage of SLAP. As an example, for stress corrosion cracking (SCC)
problems, several literature sources were utilized, including the following:

- Summary by the Pipe Crack Study Group which addressed intergranular SCC
(IGSCC) in U.S. and foreign BWRs for the period 1965 through January 1979; c.f.
U.S.NRC (1979)[3-8] and Shao and Burns (1980)[3-9]. For the stated period, the total
incidents numbered 133 for pipe diameters in the range DN75 to DN300. No
statements presented about crack depths or crack geometry.

- Summary by the Electric Power Research Institute which addresses IGSCC in

nuclear power plants worldwide for the period 1974 through June 1, 1982; c.f.
Danko (1983)[3-10]. For the stated period, the worldwide incidents numbered 287
for pipe diameters of DN50 through DN710. No statements presented about crack
depth.

- Summary by the U.S. Nuclear Regulatory Commission addressing IGSCC

observations as of March 1984; c.f. U.S. NRC (1984)[3-11]. According to this
summary there were a total of 312 cracking incidents in piping of DN300 - DN700.
For the stated period, a total of 1924 welds in BWR primary system piping had
been inspected in response to the Inspection and Enforcement (IE) Bulletin 82-03;
c.f. U.S. NRC (1982)[3-12].

- Swedish study on IGSCC problems in the domestic BWR plants covering the
period 1972 - 1988; c.f. Skånberg (1988)[3-13]. This study summarizes information
from 43 occurrences of IGSCC. No information presented on the crack depth and
crack geometry.

These information sources enabled determination of piping incident frequencies.

An absolute assessment of database coverage is not feasible without a combination of
functional and structural interpretations of raw data, however. Only reports addressing
crack indications with explicit statements on crack depth > 20% of the pipe wall were
nominated for entry into SLAP. These were events with a potential for further crack
propagation in the through-wall direction. Additional tests were performed by comparing

SKI Report 97:26 (3rd Edition) 25

the content in SLAP against other, independent database development efforts; e.g., Bush et
al (1996)[3-2]. For many database entries, the completeness was systematically addressed by
using diverse information sources. As examples, many reports nominated for entry into
the database were based on information from at least two references. In some cases, as
many as five different sources were used to corroborate the information contained by a
primary source such as a licensee event report or significant event report. A summary of
primary and secondary information sources is given in Table 8 and in Appendix A.

Table 8. Examples of Primary & Secondary Information Sources of SLAP Database

Primary Sources Secondary Sources
Preliminary Notifications of Unusual Special reports; e.g., U.S. NRC Special Study
Occurrence or Event (PNO) - U.S. NRC Reports prepared by AEOD(b) and the U.S. NRC
Pipe Crack Study Group
Licensee Event Reports (Germany, U.S,
Sweden) NRC Weekly Reports (NRR) for 1986-1996.

Power Reactor Events - bimonthly newsletter U.S. NRC Generic Letters, Information Bulletins
issued by the U.S. NRC. and Information Notices

NEA/IAEA Incident Reporting System - NUREG-0020: Licensed Operating Reactors Status

Worldwide Coverage (1970 - to date) Summary Report

Proprietary piping failure event reports made Summary of Operating Experience at Swedish
available to project by five European utilities Nuclear Power Plants, Annual Reports by RKS /
KSU
INPO/SER Reports (Nuclear Network) up to
1989 made available to project via KSU in Übersicht über besondere Vorkommnisse in
Sweden(a) Kernkraftwerken der Bundesrepublik Deutschland

Nuclear Power Experience by Stoller Auszug aus dem Bericht des ABE-Ausschusses
Corporation (BWR & PWR event reports) (atomwirtschaft)

Nuclear Safety, Volumes 12 - 33

Swedish scram reports
IAEA: Operating Experience With Nuclear Power
SKI / STAGBAS - Event database maintained Stations in Members States, 1982-1993.
by SKI/RA (Dept. of Plant Safety Assessment)
Note: (a). Reports less than five years old are proprietary to the member utilities of the Institute of
Nuclear Power Operations (INPO).
(b). AEOD = Office for Analysis and Evaluation of Operational Data, U.S. NRC.

The actual reporting of failures depend not only on regulatory reporting

requirements. Based on root cause analyses of significant events with potential generic
implications, an operator may decide to submit a report to a regulator or industry
organization. Additionally, a regulator may decide to request focused NDE/ISI efforts by
licensees to determine existence of degradation that could substantiate or refute an earlier
evaluation of the potential for a generic trend. Such requests could lead to increased
coverage of the reporting for as long as a safety concern exists. The average number of
piping failures per plant in the database and calendar year is shown in Figure 7. From that
plot it is possible to distinguish relationships between data coverage and regulatory
initiatives addressing degradation or failure mechanisms such as SCC, erosion/corrosion,
and thermal fatigue:
- As the knowledge about stress corrosion cracking problems improved during the
early 1970s, changes to the piping designs, welding techniques, NDE/ISI, etc. were

SKI Report 97:26 (3rd Edition) 26

 implemented. Also, several utilities performed piping replacement programs
involving the use of different materials. Results of these improvements were
realized during the 1980s. Mostly, the peaks displayed by the plot are caused by
incipient and degraded failures that were reported in response to the many NRC
Inspection and Enforcement Bulletins.

- During the mid-1980s numerous, significant failures induced by erosion/ corrosion

occurred. Again, initiatives by industry and regulators improved the knowledge
about this particular degradation mechanism and design changes together with
improved NDE/ISI have resulted in reliability growth.

NRC IE B ulletin 74-10: IGSCC 1970 - 1974: 'learning perio d'

NRC IE B ulletin 75-01: IGSCC 1974-1985: 'reliability gro wth' relative to
6 NRC IE B ulletin 82-03: IGSCC IGSCC/SCC - significant primary
NRC IE B ulletin 83-02: IGSCC system piping replacements. In the U.S.,
Number of Piping Failures /

NRC IE B ulletin 88-08: Thermal special repo rting requirements per IE

5
Stresses B ulletins.
1985-1990: ero sio n/co rro sio n pro blems
4
Plant.Year

highlighted in the U.S.

No te: Up tp 2 years lag-time fo r
3 issuance o f LERs.

1 SLAP Version 7.7

October 1997
0
1970

1972

1974

1976

1978

1980

1982

1984

1986

1988

1990

1992

1994

1996

1998
Year

Figure 7. The SLAP Database Content (Number of Failures per Plant and Year)

3.4 Conditional Factors of Pipe Failure

In Section 2 of this report we identified some unique differences between passive and
active components. As a consequence of these reliability features, which characterize
piping, the development of a database must distinguish between ‘events’ and ‘exposures.’
The event cells of a database on piping failures identify the failure mode, and degradation
or failure mechanism that led to failure. The exposure cells of a database identify the pipe
size and material, process medium and pressure/temperature of the process medium. The
event cells include information on reliability influence factors, whereas the exposure cells
include information on reliability attributes. We distinguish between influence and
attribute as follows: 1) an influence indicates a cause of failure that relates to
environmental or operational conditions of or in the piping system; 2) an attribute indicates
a cause of failure that relates to the inherent piping system design. Together, attributes and
influences represent the ‘conditional factors’ which must be considered in data reduction
and analysis. Reliability attributes are assigned piping systems on a global basis, while
influence factors are assigned on a plant-specific basis.

SKI Report 97:26 (3rd Edition) 27

 Pipe failure modes and failure mechanisms differ according to metallurgy, process
medium, operating time, plant and system transient history, operating environment (e.g.,
temperature, pressure, chemistry/composition of process medium, design, ISI-strategy,
etc.). Relative to pipe diameter, the failure records could be grouped according to the
following diameter classes:

- Instrument piping/tubing/thimble; ≤ DN25

- Test/sample/vent/drain/bypass/temporary lines; 25 < DN ≤ 50;
- Small-diameter process piping; 50 < DN ≤ 100;
- Intermediate-diameter process piping; 100 < DN ≤ 250
- Large-diameter process piping; > DN250.

This grouping is chosen for two reasons: 1) to enable comparisons with recent data
published by GRS; and 2) the failure modes and mechanisms in piping of DN < 50 tend to
be quite different from the other piping sizes. In general, the grouping of failure records
should reflect intended application. Other groupings could be developed according to the
make-up capability (i.e., thermal-hydraulic considerations) of safety injection system. A
typical, PSA-oriented grouping is to use three classes; i.e., equal-to-or-below DN50, above
DN50 and below DN250, and above DN250, respectively. In summary, any grouping by
size should reflect an intended application.

The failure records are sorted according to failure mode; i.e., crack, leak and
rupture, corresponding to incipient, degraded and complete failure, respectively. For now,
the terms pinhole leakage, leakage and rupture are based on structural interpretations of
piping failures. From a PSA-perspective and based on their impact on plant operations,
some leaks should be re-classified as ruptures; i.e., the leaks are large enough (e.g., >> 0.3
kg/s) to incapacitate system functions and/or result in forced plant shutdown. The majority
of failure records in the SLAP database do not have explicit information on leak rates,
however. Based on event narratives, TS requirements and capabilities of leak detection
systems, leak rates can be inferred from available information to assist with further event
classification.

The conditional factors of pipe degradation and failure are numerous and of
varying importance. Data analysis always should reflect an intended PSA application,
which means that for LOCA frequency assessment one unique set of conditional factors
should be considered and for internal flooding another set of factors. Regarding the
dependence of pipe failure on plant operational status, it is difficult to establish such
correlations. The issue of latency of pipe failures needs to be considered in the
interpretation of operational data. Its relevance for data analysis is less clear, however.
Some latent pipe failures develop during cold shutdown. Once a system is commissioned
and pressurized, the latent failure could evolve into a degraded or complete failure. Taken
from the SLAP database, three examples on ‘latency’ are given below:

(1) The use of induction heat stress improvement (IHSI) is commonly used on piping
susceptible to IGSCC to avoid through-wall cracking of welds. If there already is a
crack in the through-wall direction, the IHSI would enhance crack growth and
eventually lead to a leak. The database includes several events where leaks have
been revealed after IHSI, and power operation has resumed.

SKI Report 97:26 (3rd Edition) 28

(2) Numerous small-diameter piping systems are used to enable functional testing of
components, such as fast-closing isolation valves. Such test lines could include
temporary connections. The database includes events where the leak tightness of a
test connection (e.g., flange on a fixed spool piece) deteriorates over time. Because
of transients involving, say, MSIV closure, it is no longer possible to line up
flanges. This would be a combination of piping system design problem, and,
possibly, procedural problem that does not sufficiently address the importance of
exact flange lineup.

(3) During maintenance activities, wrong type of spare parts could be utilized and later
affect piping reliability. A recent event points to the complex nature of piping
system failures. In the particular case, simulating a pipe break to test the Reactor
Protection System, caused two high-head safety injection (HHSI) system pumps to
run against not fully closed medium-operated check valves. This created pressure
waves and a DN15 drain line close to one of the HHSI pumps broke off, and
another drain line ruptured causing a significant loss of primary system water (i.e.,
a small-LOCA precursor event). The check valves were unable to close fully
because the wrong packing material was used during the most recent annual
maintenance outage.

The three examples represent piping failures for which the root causes relate to
plant shutdown operations and maintenance activities. The failures were revealed upon
returning to routine power operation. Maintenance or testing during shutdown could affect
component or system performance such that given a demand on active components
(pumps, valves), pipe failure occurs due to an unusual or severe pressure transient. A
general observation is that low system pressure during shutdown operations reduces the
frequency of pipe failure, however. This brings up the topic of the correlation between
failure mechanism and mode of plant operation. Some failure mechanisms are independent
of operating mode. Others are clearly correlated with the plant transient history (i.e.,
number of shutdown-startup cycles) and reveal themselves during normal, steady state
power operation.

Pipe failures generally are the result of coincident or dependent failure

mechanisms. An example of a failure event which results from combined effects of
degradation and damage mechanisms would be erosion/corrosion damaged piping and
water hammer; e.g., a piping system subjected to wall thinning splits open at its weakest
point when subjected to severe water hammer. An example of a failure event which results
from dependent (or synergistic) degradation mechanisms would be where pipe cracking
originates in a transgranular mode and progresses in the intergranular mode. Without the
transgranular effect it could be feasible that the intergranular would effect would have
been delayed or prevented. In this example the TGSCC effect could be viewed as the crack
initiator 'catalyst.' The fact that the piping consisted of cold bent segments of IGSCC
susceptible material contributed to the failure.

The SLAP database distinguishes between ‘apparent cause of failure’ and ‘root
cause.’ While beyond the scope of the current work, a detailed data reduction should
acknowledge the potential correlation of different degradation and failure mechanisms.
Where supported by data, such distinction was selectively considered during the project
while analyzing influence factors; c.f. Section 4.

SKI Report 97:26 (3rd Edition) 29

 Detectability of leaks is a function of the capability and reliability of leak detection
systems, and mode of plant operation and the plant operating procedures. Also, the
operating practices impact the response to leaks; e.g., some plants operate with persisting
primary system leaks for long periods of time, while others are shutdown for repairs.
Obviously such differences affect the reporting of pipe failures. During low power and
shutdown operations the Technical Specification (TS) requirements are relaxed. Therefore,
it is feasible that a leak developing during cold shutdown would not be detected until the
plant is back at full power. Some leaks are so small (i.e., << TS-limits) that they would not
be easily detected during normal plant operation. There are many examples in the database
where operations personnel are sensitized to ever-present leaks via pump seals, valves, etc.
without taking any remedial action. Some plants may have been operated for extended
periods (perhaps, years) with small primary system leaks, and corrective action is taken
while the plant is in unrelated maintenance outage. This raises a question about
interpretation of operational data; i.e., during what mode of operation did a pipe failure
actually occur? Should data reduction be performed on the basis of plant system in which
the piping failure occurred, type of process medium, or mode of piping system operation
(e.g., standby with stagnant medium, or operating with pressurized, flowing medium)? For
the following (incomplete set of) reasons, there is no single, simple answer:

(1) Where do pipe failures occur? The plant system where the failure occurred could
be a reasonable discriminator. Many systems perform dual functions; e.g., a normal
process function and a safety function. As an example, in BWRs the residual heat
removal system performs a containment heat removal function during normal plant
operation by cooling the containment pressure suppression pool water. During
cold shutdown, the system performs a residual heat removal function, and during
LOCA the system would perform a low-pressure safety injection function. The
extent, by which the system is used during normal, routine power operation is a
function of safety relief valve actuations or leaks. Hence, there is extensive plant-
to-plant variability in how the RHRS is being operated. In PWRs, the chemical and
volume control system (CVCS) performs a triple function. During, normal routine
power operation the system maintains primary system purity, injects boric acid for
long-term reactivity control, and provides a storage location for excess primary
water. The system also performs a high-head safety injection function on demand.

Obviously, the pipe failure discriminators are dynamic in the sense that the pooling
of data cannot be structured by rigid rules. Depending on the intended application, there
could be several influences to consider. The reliability influence factors are highly plant-
specific. Moreover, at any given plant the effect an influence has on the reliability changes
over time due to plant modifications or variability in maintenance practices. Data reduction
must be based on knowledge of plant system design and operation. An advantage of using
plant system as discriminator is that it encompasses implicit information about process
medium, mode of operation, and design (e.g., pipe diameter and metallurgy). The
disadvantage is the stated one, namely a ‘fixed’ system discriminator is not feasible.

(2) The data could be evaluated on the basis of mode of piping system operation. For
the reasons stated under (1), this is not a trivial issue because of the ways some of
the plant systems are operated, however. While it is known that the mode of
operation is a conditional factor, an unambiguous discrimination of the database
content is difficult to perform. An added complication is that within a given piping
system, and for a specified mode of operation, there could be medium phase

SKI Report 97:26 (3rd Edition) 30

 transitions; i.e., portions of the piping system could have single-phase flow, and
other portions could have a two-phase flow condition. Is the particular piping
system designed to withstand two-phase flow conditions? Some failure
mechanisms are manifestations of process media as a conditional factor. As
examples, erosion/corrosion is a problem where there is turbulent steam flow, or
wet steam flow. Furthermore, thermal fatigue could be a problem where there is
thermal stratification in stagnant medium or cyclic injection of media at different
temperatures. Yet another example, boric-acid corrosion in PWR environments is a
problem where there is stagnant boric acid diluted water such as in safety injection
system and residual heat removal system piping.

(3) In addition, data could be evaluated based on type of process medium. It is known
that type of medium is a conditional factor. The triplet 〈 process medium - plant
system - mode of operation〉 is a far stronger conditional factor than ‘medium’
alone, however. Rather than an attribute of piping reliability, it should be
interpreted as an influence factor. Within any given category of process medium,
the chemical composition could have significant impact on reliability; e.g.,
hydrogen injection in BWR feedwater to condition the reactor water.

3.5 Time-Dependent vs. Demand-Dependent Failures

On what basis should pipe data be analyzed? Intuitively, piping failures develop over time
due to aging effects. In the earlier phases of the project the raw data were analyzed by
means of hazard plots[3-14]. The primary outcome of these evaluations was recognition of
the difficulties in developing reasonable groupings of the data. In general, no clear
correlation could be found between operating time and the extent of piping degradation
and failures. This observation pointed to the difficulty in defining exposure times of the
piping failures during the period of event data surveillance.

A detailed discussion on the definition of exposure times is included in Section 4 of

this report. In principle, the exposure time is a function of the type of piping system and
the environmental conditions that exist in piping systems. As an example, small-diameter
piping tend to be vulnerable to vibration-fatigue, and failures tend to develop over short
periods of time. Here, the run time of a vibration-source (e.g., positive displacement pump)
could determine the exposure time on which to base a statistical evaluation.

As an example of additional complications, the database includes events attributed

to thermal fatigue and stress corrosion cracking which have occurred in systems that are
operated for a few minutes per fuel cycle. In such cases the determination of the exposure
time or number of demands on which failure rate estimation is to be based need to include
evaluation of connecting systems and how they are operated. Although it is quite feasible
that some pipe failures are demand-dependent, current service data included in the SLAP
database do not support such evaluations. Therefore, the data evaluations in this study are
based on time-exposures only. Some work on the relationship between crack propagation
due to IGSCC and a plant’s transient history points to a correlation between the two,
however; c.f., Aaltonen, Saarinen and Simola (1993)[3-15].

SKI Report 97:26 (3rd Edition) 31

 Estimation of piping reliability using available operating experience is complex,
and for the following reasons: 1) Several reliability attributes impact the reliability; 2)
several reliability influences impact the reliability; and 3) the available operating
experience data are in-homogenous. There is no one way of approaching the problem.
From the mathematical statistics perspective, the problem is that of multivariate statistics;
i.e., several variables control the reliability of a piping system. In the proposed approach
the leading idea builds on understanding the major causes of variation using reliability
attributes. In this work, the reliability attributes are characterized by the conditional
probability of rupture given degradation. The chosen approach reflects the completeness
and coverage of the database, and the project scope limitations. Once we understand what
the attributes are and how they impact the reliability, the analysis framework suggests that
we choose a dominant or key attribute as a basis for developing informed generic failure
distributions that reflect intended applications.

3.6 Random and Systematic Piping Failures

An underlying assumption in the statistical analysis of reliability data is that of the

randomness of failure occurrences. The raw data in the SLAP database are a mixture of
systematic and random failures, however. Often the systematic failures reveal themselves
as recurring failures. These are the failures, which are repeated within one piping system
at or near one location, and which show evidence of similarities in the degradation or
failure mechanisms and therefore could be classified as recurring failures. Based on the
information in the database, in some cases (e.g., for a specific plant system, during a
limited time period) the systematic failures have dominated over the random failures.
Overall, about 10% of the records in the database were classified as systematic failures; c.f.
Figure 8.

28 Repeat Events
> DN250 195
Total No. of Events
100 < DN <= 250 51
352

50 < DN <= 100 30

190

25 < DN <= 50 39
262

15 < DN <= 25 70
730

<= DN15 12
151

0 100 200 300 400 500 600 700 800

Num ber of Failure Records

Figure 8. Overview of Systematic Failures in the SLAP Database

The systematic failures could be symptoms of ineffective or lack of root cause

analysis efforts to prevent recurrence. For evolving technologies, they could also reflect a
lack of knowledge of highly complicated degradation mechanisms due to ineffective
feedback of operating experience. Examples of systematic failures include (e.g., Moieni
and Apostolakis, 1981[3-16]):

SKI Report 97:26 (3rd Edition) 32

- Design errors (wrong material selection, design specification errors, unforeseen
dependencies, etc.).

- Manufacturing and fabrication errors. An example would be cold bending of

austenitic stainless steel piping where crack initiation has been known to result
from inside surface scratches caused by the bending tool, and surface
contamination by pipe collars or via bending tool lubricants containing sulphides
or chlorides.

- Construction and installation errors such as improper welding techniques, in-

sufficient piping support, poor routing / ‘low points’ resulting in stagnant process
medium, etc.;

- Unknown phenomena or conditions at the time of the design work (e.g., errors that
could have been avoided assuming consideration of service data).

Within the database, random and systematic failures are intertwined in the
conditional factors of failure. There is always the question whether the obvious systematic
failures should be culled from the database. Furthermore, there may be questions about the
division between random and systematic failures. In the current version of the database the
event classification is based on the following criteria:

- Explicit statement by a failure report on recurring failures and with references to

the previous failures at that or another plant.

- Evaluation of failure reports for one plant pointed to similitude with failure(s) at
other plants.

Recurring failures could be indicative of a generic problem potentially affecting an

entire NPP design generation. The term ‘generic failure’ is not synonymous with ‘repeat
failure’, however. It could be argued that obvious systematic failures (applicable to a
single plant) should be culled from a raw database from which generic failure parameters
are estimated. Such culling should be performed on the basis of influence factors in
combination with evaluations of plant-specific operational data. In developing the raw data
files, which are summarized in Appendix B, no distinction was made between the two
basic forms of piping failures. Additional discussions are found in Sections 4 and 5.

3.7 ‘Old’ vs. ‘New’ Service Data

The service data on which this study is based cover the period 1970-1997. Many
significant improvements to design, operating environments, and inspection practices have
been implemented during the study period. Therefore, the value and applicability of the
early service data to present conditions could be questioned.

Within the scope of this R&D-project it has not been possible to discard any
service data solely on the basis of date-of-occurrence. In general, the degradation
mechanisms that were revealed in the early 1970’s remain relevant. It is questionable
whether the full insights from reviews of the available service data yet have been exploited
by the efforts to improve piping reliability, however. Service data should not be screened

SKI Report 97:26 (3rd Edition) 33

out from a parameter estimation effort unless sufficient justification is provided regarding
an assumed ineligibility of certain operating experience.

3.8 Discussion

Section 3 summarized technical and plant safety management considerations affecting the
development of a database on pipe failure events. The format for the reporting of pipe
failures varies immensely from detailed root cause analysis reports, which address the
conditional factors of failure to brief summary reports, which require further interpretation
and analysis. For SLAP, numerous primary and secondary information sources are utilized
to ensure reasonable database coverage and completeness. It is the opinion of the authors
of this report that the estimation of piping reliability parameters is feasible as long as the
estimation process is supported by a comprehensive and validated pipe failure database.

Aside from applications related to PSA, a database such as SLAP supports different
types of qualitative assessments including trends and patterns. The database content points
to the recurring nature of many failure types. The recurrences could be symptoms of
insufficiently implemented experience feedback loops, but they also are symptoms of the
complex nature of the degradation and failure mechanisms; i.e., mitigation programs
continue to evolve. In the opinion of the authors of this report, a cost-effective approach to
piping reliability management is achieved through improved reporting of degradation and
failures.

3.9 References

(3-1) International Atomic Energy Agency, 1997. The IAEA/NEA Incident Reporting
System: Using Operational Experience to Improve Safety, Vienna (Austria).

(3-2) Bush, S.H. et al, 1996. Piping Failures in United States Nuclear Power Plants:
1961-1995, SKI Report 96:20, Swedish Nuclear Power Inspectorate, Stockholm.

(3-3) U.S. Nuclear Regulatory Commission, 1996. Oconee-2 Heater Drain Line Rupture,
September 24, 1996, NRC Augmented Inspection Team Report 50-269/96-15, 50-270/96-
15, Washington (DC).

(3-4) American Society of Mechanical Engineers, 1989. Section XI - Rules for Inservice
Inspection of Nuclear Power Plant Components, ASME Boiler and Pressure Vessel Code,
New York (NY).

(3-5) Swedish Nuclear Power Inspectorate, 1994. A Presentation of SKI’s Requirements

for Mechanical Structures in Nuclear Power Plants (Presentation av SKIs föreskrifter om
mekaniska anordningar i kärntekniska anläggningar), SKIFS 1994:1, Stockholm
(Sweden).

SKI Report 97:26 (3rd Edition) 34

(3-6) Rodabaugh, E.C., 1985. Comments on the Leak-Before-Break Concept for Nuclear
Power Plant Piping Systems, ORNL/Sub/82-22252/3 (NUREG/CR-4305), Oak Ridge
National Laboratory, Oak Ridge (TN), pp 10-12.

(3-7) Reck, H. and K.W. Bienussa, 1995. “Auswertung von Betriebserfahrungen Teil 1:
Schäden an DWR- und SWR- Rohrleitungen der J- und K-System,“ GRS Fachseminar
Ermittlung der Häufigkeiten von Lecks und Brühchen in druckführenden Systemen für
probabilistische Sicherheitsanalysen, Köln, 18-20 September, 1995.

(3-8) U.S. Nuclear Regulatory Commission, 1979. Investigation and Evaluation of

Stress-Corrosion Cracking in Piping of Light Water Reactor Plants, NUREG-0531,
Washington (DC), pp 2.1-2.2.

(3-9) Shao, L.C. and J.J. Burns, 1980. “Stress-Corrosion Cracking Experience in Piping
of Light Water Reactor Plants,“ Nuclear Engineering and Design, 57:133-140.

(3-10) Danko, J.C., 1983. “Boiling Water Reactor Pipe Cracking: The Problem and
Solution,“ Materials in Nuclear Energy, American Society for Metals, Metals Park (OH),
pp 181-188.

(3-11) U.S. Nuclear Regulatory Commission, 1984. “Large Diameter Pipe Cracking in
Boiling Water Reactors,“ Power Reactor Events, NUREG/BR-0051, 5/6:7-11.

(3-12) U.S. Nuclear Regulatory Commission, 1982. Stress Corrosion Cracking in Thick-
Wall, Large-Diameter Stainless Steel, Recirculation System Piping at BWR Plants,
Inspection and Enforcement Bulletin 82-03, Washington (DC).

(3-13) Skånberg, L., 1988. Survey of IGSCC Incidents in Swedish BWRs, SKI-UH Report
No. 1/88, Swedish Nuclear Power Inspectorate, Stockholm (Sweden).

(3-14) Swedish Nuclear Power Inspectorate, 1995. Reliability of Piping System

Components. Volume 4: The Pipe Failure Event Database, SKI Report 95:61, Stockholm
(Sweden).

(3-15) Aaltonen, P., K. Saarinen and K. Simola, 1993. “The Correlation of IGSCC
Propagation With the Power Plant Transient History,” International Journal of Pressure
Vessel and Piping, 55:149-162.

(3-16) Moieni, P., G. Apostolakis and G.E. Cummings, 1981. "On Random and
Systematic Failures," Reliability Engineering, 2:199-219.

SKI Report 97:26 (3rd Edition) 35

 4

DATA REDUCTION

Piping reliability is a function of size, metallurgy, process medium, operating time,

NDE/ISI practice, plant transient history, and operating environment (for example,
temperature, pressure, flow rate, chemistry/composition of process medium). Section 4
presents basic considerations in data reduction and data analysis that are based on the
conditional factors of piping reliability.

Section 2 presented the basic equation for calculating the frequency of pipe rupture
(c.f., Equation 2-2, page 14). This frequency was represented by the product of two terms:
1) The frequency of a pipe failure (flaw/crack, leak or rupture); and 2) The conditional
probability of rupture given a failure, pRUPTURE | FAILURE. The objective of Section 4 is to
present the basis for deriving this conditional rupture probability from service data.

4.1 Models for Estimating Piping Failure Rates

The estimation of equipment failure rates must acknowledge the system-to-system, plant-
to-plant and environment-to-environment variability. If all factors that influence the
equipment failure rates were to be used to develop a mathematical model or correlation,
the following expression would result:

λ = f(φ1, φ2, φ3, ..., φn) (4-1)

where λ = time- or demand-related failure rate;

φi = conditional factor (i = 1 to n).

Many of these conditional factors are addressed to different degrees in design,

fabrication, installation, commissioning, operation, and maintenance so that their
influences are controlled if not eliminated. A standard practice in reliability engineering is
to apply ‘adjustment factors’ to those conditional factors that are not explicitly accounted
for by the design or operations. One way of determining the actual failure rate that will be
exhibited by a component is to first obtain a generic, or base failure rate and multiply it by
the appropriate application and operation stress factors:

λActual = λGeneric⋅ kAp⋅ kOp (4-2)

where λActual = actual (e.g., plant-specific) failure rate;

λGeneric= generic, or base failure rate which reflects the intended application as well
as a specific component type;
kAp = application stress factor (or environmental application factor), a multiplying
factor which considers the effect of environment such as water chemistry, steam
quality, or high-cycle fatigue on λGeneric;
kOp = operation stress factor, a multiplying factor which considers the effect of
operations (e.g., standby, load-following, base load) on λGeneric.

SKI Report 97:26 (3rd Edition) 36

 While simple in concept, Equation (4-2) requires numerical values on the two ‘k-
factors.’ It is less than clear how to derive such parameter estimates from service data,
however. A specialization of Equation (4-2) was suggested by Thomas (1981)[4-1] for
pressure vessels and piping system components:

λActual = λGeneric⋅ [(QP + A ⋅ QW) ⋅ E] ⋅ F ⋅ B (4-3)

where QP = D ⋅ L/T2;
D = pipe diameter;
L = length of piping section;
T = wall thickness of piping;
A = weld penalty factor;
QW = 1.75 ⋅ NC ⋅ D/T + 1.75 ⋅ NL ⋅ L/(3.14⋅T);
NC = number of circular welds;
NL = number of longitudinal welds;
E = quality factor;
F = age factor;
B = learning factor.

The ‘Thomas correlation’ estimates the actual failure rate from empirical data
scaled by a geometric proportionality measure of size, shape and welds, and other factors
such as plant age and ‘learning factors.’ In the remainder of Section 4 we shall define and
quantify the conditional factors of piping failure by exploring the SLAP database. The
objective is not to prove or disprove the ‘Thomas correlation,’ instead the objective is to
demonstrate the application of a database developed especially for piping reliability
analysis. We start by accepting the basic premise of correlations like those described by
Equations (4-1), (4-2) and (4-3), next we define the constituent elements of an PSA-
oriented correlation that builds on Eq. (4-2).

4.2 Reliability Attributes and Influence Factors

The conditional factors of piping reliability are numerous, and of varying importance. In
this report we consider conditional factors that reflect generic reliability, and those that
reflect plant-specific reliability. This R&D focused on the estimation of failure rates and
failure probabilities of ‘complete failures’ as addressed by PSA studies. Using functional
and structural definitions of piping failure, a complete failure could be the classical ‘direct
double-ended guillotine break’ (DEGB) or a major leakage, via an extensive through-wall
crack or split, in excess of the make-up capability of an engineered safety system. A
‘rupture’ is interpreted as a piping failure, which meets the PSA requirements of functional
and structural definitions of complete failure.

We distinguish between two types of conditional factors: a) attribute; and b)

influence; c.f. Figure 9. The attributes represent conditional factors of piping system
reliability prior to installation and commissioning. In other words, the attributes relate to
the design and the application of codes and standards in view of specific service
requirements and safety considerations (i.e., the predicted reliability). An attribute cannot
be modified without changing the design of the system. As an example, pipe diameter and

SKI Report 97:26 (3rd Edition) 37

the corresponding wall thickness (e.g., Schedule Number13 to use U.S. nomenclature)
reflect specific service requirements. Any piping system can be evaluated on the basis of
its material, heat treatment history, stress level, number of weldments, and geometrical
factors. For a given application, the reliability of a DN100, Schedule 40 piping system
could be quite different from a DN100, Schedule 160 piping system. Similarly, DN25
piping is expected to differ from DN250 piping, etc. Piping material is another example of
an attribute. The selection of material for piping applications requires consideration of
material characteristics appropriate for the required service. There is a difference in
reliability characteristics of stainless steel piping versus carbon steel piping. This
difference is caused by the different susceptibilities to degradation and failure
mechanisms. Depending on the metallurgy, within the group of stainless steels there are
IGSCC-resistant and IGSCC-susceptible steels.

Piping System
(Characterized by Material,
Influence Factors Acting on Piping System Size, Service, Etc.)

Damage or Crack, Leak or

Failure Mechanism Rupture

Apparent Cause
of Failure

Underlying Underlying Underlying

Cause '1' Cause '2' Cause '3'

Contributing Contributing Contributing

Factors i, j, k Factors l, m, n Factors x, y, z

Time / Cycles / Demands

Figure 9. Simplified Root Cause Perspective on Attributes & Influences

An influence relates to a cause of failure, which is due to environmental or

operational conditions of a piping system. Another term is ‘environmental application
factor.’ For a given piping system design, the reliability influence factors represent the
maintenance, inspection (e.g., NDE/ISI) and operational conditions ‘imposed’ on the
piping as-installed and operated. A practical way of defining primary influence factors is
to ask: In view of an actual failure, what is the best (e.g., most cost-effective), remedial
action to prevent recurrence? This is the root cause analysis perspective on reliability
influences. The definition implies that: a) influence factors can be inferred from
operational data by differentiating between the apparent and underlying causes of failure;
and b) short-term, and possibly long-term, reliability growth is accomplished by changing
one or more influences, and not necessarily by changing the design.

13
Pipe schedules refer to predetermined nominal wall thicknesses according to dimensional criteria specified
in ANSI Standards; e.g. B36.10 (Welded and Seamless Wrought Steel Pipe).

SKI Report 97:26 (3rd Edition) 38

4.3 Determining Attributes from Service Data

The objective of determining attributes from service data includes development of

application-specific, baseline conditional probabilities of pipe rupture. That is,
probabilities that represent unique groups of piping systems according to design
parameters (for example, material and size) and intended service. A piping reliability
attribute is characterized by the conditional probability of pipe rupture given that a certain
type of system has been exposed to degradation or failures requiring repair or replacement
actions. Together, crack indications, leaks and ruptures are the manifestations of various
degradation and failure mechanisms. The effect and magnitude of these mechanisms differ
according to reliability attributes. For example, an austenitic stainless steel is immune to
erosion-corrosion damage while a carbon steel could be highly susceptible, and small-
diameter piping could be more susceptible to vibratory fatigue than large-diameter piping,
etc.

Service data cannot be grouped according to pre-determined, rigid attributes.

Instead, the grouping should be a function of the PSA requirements. For LOCA frequency
estimation, the analysis could be a function of equivalent leak rates through holes (break
size) in the reactor coolant pressure boundary (RCPB) and the proportionality between
pipe size and break size. So far we have alluded to diameter/wall thickness and material as
being attributes of piping reliability. We will start by describing a simple approach to
calculating conditional probabilities of rupture for different attributes. Next we present
some preliminary insights from analyzing service data included in the SLAP database, and,
finally, we present some conclusions about the grouping of service data by attribute.

4.3.1 Conditional Probability of Failure

In this study, attributes are characterized on the basis of the conditional probability of pipe
rupture. A conditional probability of rupture may be calculated using classical or Bayesian
statistics.

Ultimately, the selected approach is a matter of analyst’s preference and

experience; both approaches have advantages14 and disadvantages. We use a Bayesian
approach together with the following assumption: Each exposure to a degradation or
failure mechanism which results in detectable damage to the piping is viewed as a demand
on the structural integrity. As an example, if we observe 300 flaws in one type of piping
system, then that type of system (i.e., attribute) has been exposed to 300 demands. Next we
determine how many of these demands actually led to complete failure (i.e., rupture).
Hence, the reliability problem is treated as a failure-on-demand problem. The binomial
distribution is the distribution of the number of ruptures, R, out of ‘DP’ independent
demands where DP is the number of events leading to degraded piping. The binomial
likelihood function, L (E | p), is:

14
Given sufficient service data the classical approach and the Bayesian approach produce numerically compatible results. Due to
difference of interpretation, propagation of uncertainty measures in the Bayesian approach is easier than in the classical approach.

SKI Report 97:26 (3rd Edition) 39

 L(E|p) = (DP! / [R! (DP - R)!]) × pR × (1 - p)DP-R (4-4)

Where E = Evidence in the form of specific service data;

R = Number of ruptures;
DP = Number of ‘demands’ on the piping system;.
p = Probability of rupture.

In the Bayesian approach, the parameter p is regarded as a random variable with a

specified prior distribution. There are different ways of generating a prior distribution,
including: 1) A noninformative prior; or 2) empirical prior. Arguments can be made to
support the choice of each of these priors. Ultimately the choice should be a function of the
form and extent of available service data. For now, this report will use a noninformative
prior, as discussed below.

A noninformative prior is valid if no consensus failure distribution exists. This

would seem appropriate for piping failures. As stated by Atwood (1996)[4-2]: “... When
prior knowledge is vague, it is often not worth the effort of defending an assumed prior
distribution against challengers who have various agendas ...” For a detailed discussion on
the choice of prior distribution, see Chapter 6 in the text by Martz and Waller (1982)[4-3].
A noninformative prior is calculated from:

f(p) ∝ [p (1 - p)]-1/2 (4-5)

Using the likelihood function (Eq. 4-4) and the noninformative prior (Eq. 4-5) it
can be shown (c.f. Ref. 4-3, pp 255-258) that the posterior mean and variance are as
follows:

PR⏐DP = (2R + 1) / (2DP + 2) (4-6)

Var (PR⏐DP) = [(2R +1)(2DP - 2R + 1)] / [2(DP + 1)2 (2DP + 4)] (4-7)

where PR⏐DP = mean probability of rupture given a degraded piping (‘DP’) system;
R = number of rupture events (i.e., complete failures);
DP = number of occurrences of degraded piping of a certain kind. Includes
consideration of flaws/crack indications, leaks or ruptures.

This approach yields a simple format for analyzing attributes of piping reliability,
which enables estimation of reliability parameters when the evidence is 0 ruptures. But
more importantly, the format encompasses a procedure for quantifying and expressing
uncertainties that relate to the interpretations of the operational data. Assuming that any
given attribute is applicable to all failure modes (e.g., material is equally strong attribute
for crack indication as for leak), this approach (i.e. Eq. 4-6) enables consideration of all
relevant service data. It is also sensitive to the coverage of the SLAP database and the
classification of failure events. Without differentiating between different types of systems,
Table 9 presents a summary of conditional rupture probabilities for the attributes
‘diameter’ and ‘material.’

SKI Report 97:26 (3rd Edition) 40

Table 9. Conditional Probability of ‘Rupture’ by Attribute (SLAP Version 7.7)
Reliability Attribute PR⏐DP

Material Diametera Mean Variance

Carbon Steel ≤ DN25b 5.8E-2 1.9E-4

25 < DN ≤ 50 1.5E-1 1.1E-3
50 < DN ≤ 100 1.0E-1 1.5E-3
100 < DN ≤ 250 1.8E-1 9.8E-4
DN > 250 2.3E-1 1.7E-3

Stainless Steel ≤ DN25b 5.8E-2 1.0E-4

25 < DN ≤ 50 4.1E-2 2.2E-4
50 < DN ≤ 100 2.7E-2 2.6E-4
100 < DN ≤ 250 1.5E-2 6.8E-5
DN > 250 5.1E-3 5.1E-5
Notes: (a). Excludes bellows and expansion joints. The latter are forbidden by ASME Section III on Class
1 safety systems; however, they are used in Class 2 and 3 systems and the balance of plant at low
pressures and temperatures. See Appendix C for definitions of ASME Class 1, 2 and 3 piping.
(b). Vibration-fatigue is a predominant failure mechanism affecting small-diameter piping/tubing (≤
DN25). The small-diameter piping also is susceptible to human factors deficiencies and human
errors; e.g., maintenance worker inadvertently stepping on or bumping unsupported piping.

According to Table 9, in which it is assumed that ‘diameter’ is the key reliability

attribute, there is no clear pattern in the ratios for carbon steels and stainless steels for
intermediate- and large-diameter piping. The results for carbon steel piping are strongly
biased by an under-reporting of failures in balance-of-plant (BOP) systems. Mostly the
reporting has been limited to catastrophic failures of BOP piping such as steam extraction
piping.

4.3.2 Comparison and Validation of Attributes

As defined above, given presence of a degradation mechanism, a reliability attribute is a

measure of the ‘propensity’ of piping to fail completely. Some correlations and hypotheses
describing the relationship between pipe diameter and the conditional probability of failure
given degradation have been proposed. These proposed relationships have been developed
from results and insights from structural mechanics models, experimental data and
operating experience. Beliczey and Schulz (1987)[4-4] and Beliczey (1995)[4-5] have
proposed the following semi-empirical (first-approximation) correlations, which assume
the pipe size to be a primary reliability attribute:

PR⏐DP = [(9.6⋅DN / 2.5) + (0.4⋅DN2/25)]-1 (4-8)

PR⏐DP = 2.5 / DN (4-9)

A comparison of these correlations with the results in Table 9 is shown in Figure

10. For stainless steel piping, there is agreement between the correlation by Beliczey and
Schulz and the conditional rupture probabilities derived from service data in the SLAP
database.

SKI Report 97:26 (3rd Edition) 41

 1.0E+00

SS (Table 9)
Eq. 4-8 (GRS)
Eq. 4-9 (GRS)

1.0E-01

PR|DP (Mean)

1.0E-02

1.0E-03

1.0E-04
∅ ≤ 25 25 < ∅ ≤ 50 50 < ∅ ≤ 100 100 < ∅ ≤ 250 ∅ > 250

Figure 10. Conditional Rupture Probability as a Function of Diameter & Material

According to Figure 10, diameter is a relatively strong attribute of stainless steel

piping. The uncertainties in the estimates are dictated by database coverage and the
interpretations and classifications of the experience data. The entire SLAP database is
represented in the above graph and the service data were not differentiated according to
specific types of piping system types. By contrast, Figure 11 compares the ‘first-
approximation’ correlation given by Equation (4-9) with conditional rupture probabilities
derived from service data for IGSCC-susceptible stainless steel piping.

1.0E+00

BWR IGSCC Susceptible Piping

Eq. 4-9 (GRS)

1.0E-01

PR|DP (Mean)
1.0E-02

1.0E-03

1.0E-04
∅ ≤ 25 25 < ∅ ≤ 100 ∅ > 100

Figure 11. Conditional Rupture Probability of IGSCC-Susceptible Stainless Steel Pipe

SKI Report 97:26 (3rd Edition) 42

 For the IGSCC-susceptible piping a question arises as to the bias in the estimation
by the coverage/completeness of the SLAP database. The scope of the present work was
limited to significant events as documented in public domain information sources. There
have been thousands of IGSCC crack indications and confirmed cracks in BWR plants
worldwide. While some of the more significant events are reported as LERs or reportable
occurrences (ROs), most of the events are documented in special inspection or outage
reports, however.

As examples on the IGSCC incidence rate, for the period up to March 1984, of
1924 examined welds in U.S. BWRs, 312 were found to be defective; c.f. U.S. NRC
(1984)[4-6]. At a German plant, examinations in the early 1990s found approximately 30
cracks out of 1300 welds which were inspected; c.f. IAEA (1993)[4-7]. Finally, Wachter and
Brümmer (1997)[4-8] and Bieniussa and Reck (1997)[4-9] report that as a result of an
extensive non-destructive testing program involving almost 3000 welds in stainless steel
piping greater that DN50 in German BWRs, about 90 cracks were detected. Most of these
extended less than 30% in the through-wall direction. In the current version of the SLAP
database, only cracks extending more than 20% in the through-wall direction have been
included. The potential biases in parameter estimates due to different data interpretations
are addressed further in Section 5.

As an additional proof-of-the-SLAP-principle, we turn to a set of relatively recent

probabilistic fracture mechanics evaluations. In the May 1973 the U.S. NRC published the
Regulatory Guide 1.45, “Reactor Coolant Pressure Boundary Leakage Detection Systems.”
This document provides guidance on leak detection methods and system requirements.
Furthermore, leak detection limits are specified in plant Technical Specifications and are
different for BWRs and PWRs. These leak detection limits are also used in leak-before-
break evaluations performed according to the Standard Review Plan (SRP), Section 3.6.3[4-
10]
. In this SRP, for each position of the highest stress or with the least advantageous
material properties, a through-wall crack of a length corresponding to a 3.8 kg/min (1 gpm)
leak under normal operating condition multiplied by a safety factor of 10 is postulated.
This crack length is called lleak and is used in determining the crack size considered in
subsequent fracture analyses. In a study by Battelle, the conditional rupture probability for
piping (base metal and weld metal) of DN100 to DN800 leaking at the allowable leak
detection limit is calculated; c.f. Rahman et al (1995)[4-11]. Depending on the degree of
piping degradation, the rupture probability ranged from 1.0E-4 to about 1.0E-1 in the most
unfavorable cases. This evaluation by Battelle concluded that:

- The conditional failure probability of wrought stainless steel is much lower than
for carbon steel, particularly when the crack is located in the base metal.

- Due to a significant reduction in the toughness properties of the weld metal

compared with the base metal of wrought stainless steel pipes, the conditional
failure probability for cracks in weld metal was much larger (by about two orders
of magnitude) than for cracks in base metal.

- The conditional failure probability for both BWR and PWR piping systems is
decreasing with increasing pipe diameter.

SKI Report 97:26 (3rd Edition) 43

- The conditional probability of complex-cracked15 pipes was higher than that for
through-wall-cracked pipes. Also, the conditional failure probability was found to
increase with increasing depth of the surface crack. If the depth of the surface
crack is large enough, then failure could occur even under normal operating loads,
which is the principal reason that piping susceptible to IGSCC type mechanisms is
not permitted for LBB.

-
The conditional failure probability strongly depends on the chosen attribute; i.e, the
grouping of the operational data. Since an attribute reflects specific design considerations,
the operational data should be grouped according to the PSA requirements. Different
reliability attributes are summarized in Table 10.

Table 10. Examples of Different Piping Reliability Attributes

Attribute Comment
Pipe diameter A strong attribute. The grouping of the operational data should
reflect the intended application. Note that the database coverage
differs according to pipe size.
Piping system type Insights from the review of the operational data show considerable
system-to-system variability. Note that this variability could be a
function of process medium, mode of operation and/or pressure and
temperature.
Piping material A strong attribute. The effect of degradation and failure mechanisms
differ with the material. Within a given class of material (e.g.,
industrial grade stainless steel) extensive plant-to-plant variability
could arise depending on the influence factors.
Location of piping failure A strong attribute. The location of failure depends on material,
(e.g., base metal vs. weld metal) diameter/wall thickness, type of system and the susceptibility to
specific damage/failure mechanism(s).
Pipe wall thickness See ‘pipe diameter’ above. The wall thickness implicitly is
accounted for via ‘pipe diameter’ and ‘piping system type.’
Failure location A strong attribute; depends on the susceptibility(ies) to
degradation/failure mechanism(s).
Leak rate / failure mode Highly dependent on ‘piping system type’, ‘material’ and the
prevalent degradation/failure mechanism.
Process medium Implicitly accounted for via ‘piping system type.’ Extensive plant-
to-plant variability exists. The BWR primary system environment
differs from the corresponding PWR environment.

NSSS vendor / plant type Weak attribute. The failure ‘propensity’ is determined by other
factors as explained above.

Reviews of the operational data yield insights about the many correlations between
failure occurrences and piping system designs. In addition to the ones listed in Table 10,
some general, qualitative reliability correlations are:

(1) Erosion and erosion/corrosion damage typically occurs in base metal of carbon
steel piping; stainless steels are virtually immune to these failure mechanisms.
Primary fault locations are elbows (e.g., outside radius), tees, straight-sections
15
As defined by Rahman et al (1995), a complex crack is a long circumferential surface crack that penetrates the thickness over a short
length.

SKI Report 97:26 (3rd Edition) 44

 downstream of welds or valves (flow disturbances). Erosion and erosion/ corrosion
damage is not a major problem of LOCA-sensitive piping, and stainless steels are
virtually immune to these failure mechanisms. In some plant designs, safety
system, such as safety injection systems and auxiliary feedwater system, rely on
steam-driven pumps. The steam supply piping systems use carbon steels, and,
hence, are susceptible to erosion/corrosion damage.

(2) Failure due to stress corrosion cracking invariably occurs in weld metal or weld
heat affected zones (HAZ). An exception would be TGSCC where cracking has
been experienced in the base metal. It is a stainless steel problem which occurs due
to environmental influences. Some stainless steels are more susceptible than
others. Steels with low carbon-content are more resilient than high carbon-content
steels. Recent experience with primary system piping in German BWRs indicates
stress corrosion cracking to be a problem in Ti-stabilized and Nb-stabilized
stainless steels under certain conditions; c.f. Wachter et al (1996)[4-12].

(3) Fatigue failures (e.g., vibration-induced, or acoustically induced) tend to develop at

the weakest portions of a piping system; at or near over-stressed joints, reducers,
bends. Often, failures occur in weld metals, at or near HAZ.

4.4 Reliability Influence Factors

An explicit consideration of all environmental and mechanical influence factors is

difficult. The influences are many, tend to be highly plant-specific, and they change over
time. Complications result from competing degradation mechanisms and inter-acting
degradation mechanisms. With the improved knowledge of environmental stress factors
follows changes to operational strategies. Subtle changes at one plant could significantly
impact the reliability, while the same changes at another plant could have a modest impact
only. The design and operating practices evolve with the improved knowledge and
historical data may not apply to all analytical situations. The objective of determining
influence factors includes assessing how NDE/ISI-practices and operational conditions
could improve or degrade piping reliability.

Different data interpretations may lead to different conclusions about an ‘inherent’

reliability characteristic (i.e., attribute, a characteristic which cannot be altered/ eliminated
without changing a design) versus an achieved reliability (i.e., influence, a characteristic
which can be controlled through operational strategy, ISI, chemistry, etc.). Conceptual
relationships between attributes and influence factors are shown in Figure 12. According to
this figure, an influence could have different effect on different types of piping. Influence
factors should be determined on the basis of the underlying causes of predominant
degradation and failure mechanisms; i.e., insights and results from root cause analyses.

The dependency between attributes and influence factors is complex. Subtle

changes to an attribute could drastically change the effect of an influence factor on the
reliability, and vice versa.

SKI Report 97:26 (3rd Edition) 45

 10

k-factor 1

F
E
0.1 C
DN25

B
DN50

Influence Factor
DN100

DN250 A

> DN250
Pipe Diam eter

Figure 12. Conceptual Relationships between Attributes and Influence Factors

4.4.1 Determining Influence Factors from Operational Data

Each predominant degradation or failure mechanism reflects different piping system

applications. Results from root cause analyses16 give information on the influence factors
and the ways by which a piping system component failed. An example of influence factors
for piping susceptible to IGSCC is included in Table 11; c.f. Danko (1983)[4-13]. According
to this table, the influence factors include welding techniques, fabrication and installation
practices, and water chemistry.

Piping normally or intermittently containing stagnant water has exhibited

accelerated IGSCC in the presence of high oxygen level as well as contaminants of
chlorides, fluorides, caustics, and sulphur compounds. The environment chemistries could
involve several independent or competitive processes that affect the cracking; c.f. Cullen,
Gabetta and Hänninen (1985)[4-14].

As an example of the impact of water chemistry, according to the U.S. NRC

Generic Letter 88-01[4-15] the use of hydrogen water chemistry (HWC), together with
stringent controls on conductivity, will inhibit the initiation and growth of IGSCC.
However, the response to hydrogen injection differs from plant to plant. There is no
generic HWC specification, and the reduction in piping inspection frequency based on the
use of HWC has been considered on individual case bases. The effect of water chemistry
on reliability has been known to differ depending on whether piping is fabricated from
stabilized or unstabilized austenitic stainless steels.

16
A degradation or failure mechanism is a symptom of underlying causes. The analysis of influence factors should be done on the basis
of the contributing and causal factors of degradation and failure mechanisms.

SKI Report 97:26 (3rd Edition) 46

Table 11. Some Remedies for Mitigation of IGSCC (Adapted from Danko (1983)
Influence Factor / Remedial Activity Objective
1. Sensitization Related
1.1 Solution heat treatment (1.1) Eliminate weld sensitization and residual stresses

1.2 Corrosion-resistant clad (1.2) Provide protection of weld-heat-affected zone.

Welds are considered resistant to IGSCC if the weld
HAZ on the inside of the pipe is protected by a
cladding of resistant weld metal (CRC - corrosion
resistant cladding)
(1.3) Alternate material (1.3) Prevent weld sensitization. Materials considered
resistant to sensitization and IGSCC in BWR piping
systems are low carbon wrought stainless steel
(maximum carbon content of 0.035%).

2. Stress Related
2.1 Heat sink welding 2.1 Alter the internal surface and through-wall residual
stress distribution.
2.2 Last pass heat sink welding 2.2 Same as (2.1)
2.3 Induction heating stress improvement 2.3 Same as (2.1)

3. Environmental Related
3.1 Startup deaeration 3.1 Reduce dissolved oxygen content during startup
3.2 Hydrogen water chemistry (HWC) 3.2 Reduce steady-state oxygen content

Research on erosion-corrosion mechanisms suggests a wide range of operational

and environmental influences. Most of the failures have occurred in wet-steam systems,
but there is evidence of failures in single-phase systems. Based on historical data, the pipe
rupture at Trojan Power Station in March 1985 was caused by single-phase erosion-
corrosion phenomenon. According to a study by Cragnolino, Czajkowski and Shack
(1988)[4-16], the most promising approach to mitigating erosion-corrosion in the short term
would be to modify environmental factors such as:

- Effect of temperature. Laboratory studies generally have found that erosion-

corrosion rates drop off markedly at high and low temperatures with a strong peak
at intermediate temperatures. Failures in single-phase flow systems have occurred
within a temperature range of 80 - 260 C; and for two-phase flow systems in the
range 140 - 260 C.

- Effect of pH. Erosion-corrosion rates are strongly dependent on pH over the range
of interest in secondary side water systems. The data (as quoted by Ref. 4-16)
consistently show a decrease of more than an order of magnitude in erosion-
corrosion rates over the pH-range 8.5 - 9.5.

- Effect of Oxygen. Dissolved oxygen and oxide reaction products can have severely
damaging effect on steam generator materials. Modern practice seeks to keep air
ingress and dissolved oxygen levels as low as possible in PWR secondary systems.
For BWRs, industry guidelines suggest that dissolved oxygen levels in the
feedwater be maintained at ≥ 20 ppb, even under hydrogen water chemistry
conditions (see above).

SKI Report 97:26 (3rd Edition) 47

- Effect of Material Composition. Alloying can greatly reduce susceptibility to
erosion-corrosion; chromium being the most important alloying element for
improving resistance. Austenitic stainless steels are considered virtually immune to
erosion-corrosion. Plant-to-plant variations in susceptibility (or even heat-to-heat
variations within a plant) could be strongly influenced by variations in the levels of
chromium present as a trace element in a nominally carbon steel. The
specifications for the commonly used carbon steels do not include chromium;
however, experience suggests that chromium could be present as an ‘impurity’ at
levels ranging from 0.005 - 0.07 wt%.

The system-to-system variability in reliability is a function of influence factors

such as those listed above. Typical influence patterns are determined from the historical
data, and insights from root cause analyses and failure analyses. While some influence
factors apply in the generic sense, others are highly plant-specific. Depending on the
specific implementation strategy, a factor that improves reliability at one plant may give
negative side effects at another plant.

The manifestations of influence factors include the location of a crack indication,

the shape and orientation of cracks, and ultimately the effect on plant operations. Some
results from a top-level review of event narratives, including failure analysis results in the
SLAP database, are included in Tables 12 and 13. It is recommended that an evaluation of
the significance of influence factors on average piping reliability be done in four steps:

(1) For a given attribute (e.g., 〈diameter - material〉), identify the prevalent
degradation and failure mechanisms; c.f. Tables 12 and 13. The evaluation should
go beyond the ‘apparent’ mechanism.

(2) Identify the causal and contributing factors and determine the remedial actions to
prevent recurrence of a specific degradation or failure mechanism.

(3) Identify physics-of-failure concepts/models to verify the insights from historical

data and failure analyses.

(4) Calculate the overall range of effect an influence factor has on the average piping
reliability, or global failure propensity. For the chosen attribute, calculate the
ratio:

rAp-I = max pR⏐DP-I / min pR⏐DP-I (4-10)

This ratio measures the range of effect (or relative importance) of an influence on
average piping reliability. It establishes a basis (or checklist) for plant-specific evaluations
of operating experience.

The effects of influence factors on different size stainless steel piping are
summarized in Table 14 and Table 15; additional examples are included in Appendix B.
The influence matrix (Table 13) should be used as checklist of influences for small-
diameter, stainless steel piping inside the containment.

SKI Report 97:26 (3rd Edition) 48

Table 12. Examples of Influence Factors and Piping Damage/ Failure Locations
Damage / Failure Mechanism Location of Piping System Flaw
Mechanism Influencea Inside→Outb Outside→Inc Description
Erosion or Environmental x Erosion or erosion/corrosion damage occurs
erosion- where there is turbulent flow; e.g., downstream
corrosion of valves, elbows, tees. Typically the damage
occurs in base metal. Limited to carbon steels.
Stainless steels are almost immune to this
damage mechanism. Reliability improvements
are introduced by changing geometry of piping,
and through NDE/ISI.
TGSCC Environmental / x x Typically occurs in base metal, and where the
Stress / surface of the pipe wall microstructure has been
Sensitization damaged during initial fabrication/ installation.
As an example, cold bending of piping has
been known to cause damage to the
microstructure (inside and/or outside pipe
wall). The TGSCC is induced by presence of
sulphides, chlorides or phosphates. Pipe collars,
valve packings containing these chemicals
could be the source of the environmental stress.
Vibration- Process / N/A N/A Low- or high-cycle vibrations, acoustic
fatigue Mechanical vibrations. Primarily a small-diameter piping
problem affecting the weakest part of a system.
Where there is insufficient pipe support,
welds/joints tend to fail first. Seldom causing
damage to base metal.
Thermal-fatigue Process / x Caused by temperature fluctuations causing
thermal cycling repeated contraction / expansion of piping
component. Damage to base metal and weld
metal has been observed.
Thermal-fatigue Process / x Hot water floats on top of cold water. Hot
thermal stratifi- water mixes with the cold water causing abrupt
cation cooling of the hot water, and abrupt heating of
cold water. Cyclic temperature changes lead to
fatigue of mixing zones. A base metal problem.
Notes: (a). Distinction made between environmental & influence related to process environment or design.
(b). Cracking of pipe wall from the inside in the through-wall (TW) direction.
(c). Cracking of pipe wall from the outside in the TW-direction.

Table 13. An Example of Influence Matrix

Attributes: Stainless steel, TGSCC-susceptible Piping
INFLUENCE FACTOR Industrial Grade Nuclear Grade
≤ DN25 25 < DN ≤ 50 ≤ DN25 25 < DN ≤ 50
Method of fabrication:
- Cold bending - lubricant contains fluorides. ++ (a) ++ + +
- Warm/hot bending tools and coatings contain (+) (+) (+) (+)
zinc.
- Cutting lubricant contains chlorides. + + (+) (+)
Installation:
- Pipe collar containing chlorides. + + (+) (+)
- Flange gasket material of asbestos with traces + + (+) (+)
of chlorides.
- Proximity to piping carrying waste water (+) (+) (-) (-)
(chlorides); environmental stress from external
impact
Operation / Maintenance:
- Flushing of system to keep inside pipe surface + + (+) (+)
free from chlorides / irregular or no flushing.
- Leak-tightness of isolation valves not verified / + + (+) (+)
chlorides in test/sample lines during long
periods.
Legends: ‘++’ = based on operational data, the specific influence could be strong (e.g., reducing time to
failure), ‘+’ = the SLAP database contains at least 10 reports indicating a recurring problem, ‘(+)’ =
probably a plant-specific issue - SLAP database does not indicate a recurring problem, ‘(-)’ = plant-
specific issue, only a problem if one or more failures in adjacent systems occur (e.g., leaking valve
coincident with failure of piping insulation).

SKI Report 97:26 (3rd Edition) 49

 As an example, a susceptibility to TGSCC should be assumed to exist given certain
environmental influences as listed in the left column of Table 13. Many different
environmental conditions could, individually or together, cause the degradation
mechanism to act on the piping material. In the example it has been assumed that TGSCC
is the apparent cause of failure. The SLAP database includes reports where TGSCC has
been a contributing degradation mechanism. That is, it has either coexisted with other
degradation mechanisms or has triggered another ‘faster-acting’ mechanism. After crack
initiation through TGSCC, cracks have been known to propagate intergranularly.

In Table 14 the operating experience indicates that small-diameter piping mainly is

vulnerable to ‘human factors’ and vibration fatigue. This implies that that ‘internal’ factors
such as process medium, flow rate, chemistry have less influence on the reliability than the
external influences. A recurring problem could be prevented by enhancing existing
maintenance procedures or by improving the design practice. The range of effect of
influence factors depends on the pooling of the experience data. An evaluation of small-
diameter instrument lines in emergency diesel generator systems would reveal vibration-
fatigue due to improper material selection combined with lack of support as a stronger
influence than human factors.

Table 14. Overall Range of Effect of Influence on Pipe Reliability - Example #1

≤ DN25 Stainless Steel Piping
Application: Instrument Line / Sample Line - Stagnant or Intermittently Stagnant Fluid

Level of Factor Level Description Range of Effect

Influence [rAp-I]

1 Human Factors 1 Construction defect / QA deficiency 9.3 17

2 Design error - lack of verification
3 Fabrication error
4 Human error
5 Installation error
6 Maintenance error
7 Repair error
8 Welding error

2 Fatigue 1 Vibratory fatigue 4.6

2 Thermal fatigue
3 Fatigue - ‘default’

3 Corrosion 1 Flow-assisted corrosion 3.1

2 Boric acid corrosion and cracking
3 Chloride induced corrosion

4 Stress corrosion 1 IGSCC - BWR environment 2.0

cracking 2 SCC - PWR environment
3 TGSCC - LWR environment

17
Using the service data, for each of the eight (in this case) contributors to pipe failures induced by human
factors problems/deficiencies compute the conditional probability of pipe rupture, then calculate the ratio of
the largest to smallest value.

SKI Report 97:26 (3rd Edition) 50

Table 15. Overall Range of Effect of Influence on Pipe Reliability - Example #2
100 < DN ≤ 250 Stainless Steel Piping
Application: Process Line - Stagnant or Intermittently Stagnant Fluid

Level of Factor Level Description Range of Effect

Influence [rAp-I]
1 Stress Corrosion 1 IGSCC - BWR environment 20.1
Cracking 2 SCC - PWR environment
3 TGSCC - LWR environment

2 Human Factors 1 Construction defect / QA deficiency 7.0

2 Design error - lack of verification
3 Fabrication error
4 Welding error

3 Fatigue 1 Vibratory fatigue 4.8

2 Thermal fatigue
3 Fatigue - ‘default’

4 Corrosion 1 Flow-assisted corrosion 3.8

2 Boric acid corrosion and cracking
3 Chloride induced corrosion

The insights about the effect of influence factors on reliability change with
different reliability attributes. The insights also change depending on how the contributing
and causal factors of degradation and failure are defined. That is, the depth of an
evaluation of root causes determines the quality of the insights about influence factors. Yet
other insights are developed by pooling of the operational data according to type of plant
system, mode of operation.

4.4.2 Evaluating Plant-Specific Service Data

A measure of the actual or potential effects of plant-specific influences is established by

comparing them against the global data; e.g., influence matrices (c.f. Table 13) and range
of effects of influences (c.f. Tables 14 and 15). Consistent definitions of causal factors and
contributing factors must be developed to enable a comparison. A simple quantitative
measure of the effect of influence ‘i’ on attribute ‘X’ is given by:

ki⏐X = [(φSPECIFIC ⏐ ‘i’ / T) / (φGENERIC⏐ ‘i’ / TGENERIC )] (4-11)

where φ SPECIFIC⏐ ‘i’ = Number of failures according to the plant-specific experience given
an influence ‘i’;
φGENERIC⏐ ‘X’ = Number of failures according to industry-wide service data for
piping systems affected by an influence ‘i’;
T = Plant-specific exposure time;
TGENERIC = Total exposure time according to the industry-wide service data.

As an example of how (Eq. 4-11) could be applied, assume that for the influence of
‘vibration’ the industry-wide experience is 20 failures in 250 reactor-years (e.g., service
data from 5 plants with a total operating time of 50 years). Furthermore, assume that the
plant-specific experience is 1 failure in 20 reactor-years. The corresponding k-factor =
1.25. This means that the plant-specific susceptibility could be 25% higher than the

SKI Report 97:26 (3rd Edition) 51

industry average. In case the single failure was a systematic error addressed through a
minor design change (e.g., improved piping support), the analysis should also consider the
case of zero failures. Assuming that instead of 1 failure in 20 years, the plant-specific
operating experience is 0 failures in 20 years. A simple approach to this problem could be
to perform a 1-stage Bayesian updating using 20 failure in 250 reactor-years as the prior.
The mean-failure rate of the posterior distribution, assuming lognormal distributions, is
1.57E-6/reactor.hour. In this case the k-factor becomes 0.17; i.e., the plant-specific
experience indicates the reliability to be about 6 times better than the industry-wide data
indicates.

Based on the operational data alone, the evaluation of an influence such as primary
water chemistry is difficult. Some examples of possible approaches to the analysis are
summarized in Table 16. Failure records in SLAP represent the full range of water
chemistry strategies. While theoretically possible, it would not be practical to determine
the water chemistry strategy for each of the surveyed plants in the database, however. We
therefore make the assumption that the global data represent an average water chemistry
strategy. This 'average strategy' reflects the state-of-knowledge ten to twenty years ago.
How should today's state-of-knowledge about the physics of degradation mechanisms-be
accounted for in the parameter estimation? A decision to derive plant-specific failure
parameters, which takes into account specific influence factors, should be based on
detailed consideration of industrywide and plant-specific operating experience. The
conditions under which some damage or failure mechanisms evolve are complex. It
therefore is difficult to base a decision to use a small or negligible k-factor on a single
factor. Additional details are addressed in Section 5.

Table 16. Evaluation of Plant-Specific Influence Factors - An Interim Proposal

Operating Experience Analysis Strategy

(1) No evidence of degradation or failure (a) No action - generic data applies; i.e., no reason
to believe the plant-specific experience to be better
than the 'average' plant.
(b) If degradation and failure mechanisms have
been explicitly accounted for, use k = 0.1, 0.5 or
0.8. Justifications essential; the demand for
justification increases for low 'multipliers'.
(c) Assume zero failures

(2) Degradation / failure has been experienced Perform quantitative evaluation as indicated above
and substantiate with reviews of NDE/ISI results.
The evaluation must address the question: “In what
way(s) does (do) the plant-specific operating
experience differ from the industry-wide
experience?”

4.4.3 ‘Bounding’ of Influence Factors

The ‘range factor’ (c.f. Eq. 4-10) is an indirect measure of the reliability growth which can
be achieved by eliminating or minimizing the effects of a certain influence factor. As an
example, according to Table 17 an improvement by a factor of about 20 could be realized
by eliminating piping material susceptible to IGSCC. The Electric Power Research
Institute (EPRI) has studied the potential improvements by implementing remedies for

SKI Report 97:26 (3rd Edition) 52

mitigating IGSCC; c.f. Danko (1983)[4-13] and Table 17 (based on Danko’s paper).

Table 17. Factor of Improvement for Piping Failure Remedies (IGSCC in DN100 Piping)
Factor of Improvement
Piping Failure Remedy (Increase in ‘Time to Failure’)
1. Sensitization Related
(a) Solution heat treatment > 20
(b) Corrosion resistant clad > 20
(c) 316 nuclear grade (NG) stainless steel > 20
(d) 304 NG stainless steel > 20
2. Stress Related
(a) Heat sink welding 15.1
(b) Induction heating stress improvement (IHSI) > 10

Another way of determining the range factor is by developing hazard plots for
groups of failure data. In theory, the spread in values of time to failure (TTF) could help
determine the effects of different remedies. Figure 13 is a hazard plot18, which shows the
TTF for cold worked medium-diameter stainless steel piping.

1000

Cold Worked SS-Piping (DN80-DN100)

Hazard (100xln[1/(1-MR)])

100
Cumulative

10

1
1000 10000 100000 1000000
Time to Failure [Hours]

Figure 13. Example of Hazard Plot of Time to Small Leaks in Stainless Steel Piping

Only failed piping system components are included in this hazard plot. It is seen
that for small-diameter piping systems the time to failure has ranged from about 10,000
hours to about 130,000 hours (i.e., difference is a factor of 13). Different attributes and
environmental influence factors explain this difference.

4.5 An Interim ‘SLAP Reliability Correlation’

Data analysis should be based on a model of failure. That model should portray pertinent
aspects of failure as extracted from service data. The model should discriminate between
general reliability attributes and plant-specific influence factors. Translating operating
experience data into a parameter data set for PSA requires a multi-step approach.

18 For an introduction to hazard plotting techniques, see: O’Connor, P.D.T. (1991): Practical Reliability Engineering, Third
Edition, John Wiley & Sons, Chichester (UK), ISBN 0-471-92696-5, pp 82-85.

SKI Report 97:26 (3rd Edition) 53

Consistent with the discussion in Section 4.1, for the purpose of interpreting and applying
the industry-wide data in the SLAP database, the following ‘symbolic’ piping reliability
concept is chosen:

pR DP-‘X’ = Σn = α, β…η (ki-‘X’ $ pR DP - GENERIC ) (4-12)

where pR DP-‘X’ = plant-specific conditional probability of pipe rupture and ‘X’ refers to
a specific attribute such as type of system;
ki-‘X’ = influence factor ‘i’ applicable to attribute ‘X’;
α, β …. η refer to different, independent degradation or failure mechanisms
affecting the piping system under consideration.
pR DP-GENERIC = generic conditional probability of pipe rupture derived from
industry-wide service data.

Therefore, the plant-specific conditional rupture probability is the conditional

probability resulting from the reliability influence factors that act upon an attribute,
which is considered on the basis of the industry-wide data. Each of the elements in
Equation (4-12) is addressed by the data reduction and data analysis steps described in
Sections 4.3 and 4.4. So far we have only discussed the relative contributions to piping
failure. Ultimately the goal is to derive an absolute rupture frequency for which a
‘nominated’ (i.e., consensus) frequency of pipe failure is required. A ‘nomination’
implies that the raw data meet acceptable levels of completeness and coverage. Exactly
how a nominated frequency of failure is generated could be controversial. The approach
to deriving an absolute pipe rupture frequency is a function of the PSA application
requirements as described in Section 5 of this report.

An approach to estimating the k-factor was discussed in Section 4.4.2. In practical

applications, the determination of k-factors is quite complex, and a rigorous statistical
analysis of influence factors would require the design and analysis of statistical
experiments. A more straightforward approach could be to perform further pooling of
the service data according to specific ‘exposure cells.’ As an example, if we were
interested in, say, the influence of hydrogen water chemistry (HWC) on IGSCC-
susceptible piping, the service data should be organized according to the different HWC-
strategies that have been implemented. Next, by evaluating the impact on piping
reliability by HWC would enable an assessment of the conditional rupture probability
with and without HWC. Such parametric studies could be supported by probabilistic
fracture mechanics.

4.6 Discussion

The conditional factors of piping reliability were defined in terms of ‘attributes’ and
‘influence factors.’ An attribute relates to piping system design features as addressed by
codes and standards and functional requirements. An influence factor relates to the
operating environment once a system has been commissioned. An analysis format building
on these conditional factors provides the framework for deriving plant-specific piping
reliability parameters.

SKI Report 97:26 (3rd Edition) 54

 The selection of a statistical analysis approach must reflect intended application(s). In
Section 4 we used Bayesian statistics to infer some insights about reliability attributes. It
must be understood that in the context of PSA the Bayesian approach works quite well for
the purpose of deriving point estimates with consideration of uncertainties. A drawback of
this approach is that it is insensitive to changes in the operational data. That is, the approach
is not very useful for performing trend analysis or other reliability-oriented applications. At
this stage of the R&D there is no need for more advanced Bayesian statistics, however. The
techniques and tools of classical statistics should be exploited when performing detailed
evaluations of the operational data. Piping reliability is a complex topic. Section 4 outlines
some key analysis considerations that are included in the analysis framework, which is
presented in Section 5. This framework constitutes minimum analytical requirements to be
acknowledged in modern PSA.

4.7 References

(4-1) Thomas, H.M., 1981. “Pipe and Vessel Failure Probability,” Reliability
Engineering, 2:83-124.

(4-2) Atwood, C.L., 1996. “Constrained Noninformative Priors in Risk Assessment,”

Reliability Engineering and System Safety, 53:37-46.

(4-3) Martz, H.F. and R.A. Waller, 1982. Bayesian Reliability Analysis, John Wiley &
Sons, New York (NY), ISBN 0-471-86425-0.

(4-4) Beliczey, S. And H. Schulz, 1987. “The Probability of Leakage in Piping Systems
of Pressurized Water Reactors on the Basis of Fracture Mechanics and Operating
Experience,” Nuclear Engineering and Design, 102:431-438.

(4-5) Beliczey, S., 1995. “Grundlegende statistische Methoden, GRS Fachseminar:

Ermittlung der Häufigkeiten von Lechs und Brüchen in Druckführenden Systemen für
probabilistische Sicherheitsanalysen, 18-20 September, Köln (Germany).

(4-6) U.S. Nuclear Regulatory Commission, 1984. “Large Diameter Pipe Cracking in
Boiling Water Reactors,” Power Reactor Events, NUREG/BR-0051, 5/6:7-11.

(4-7) International Atomic Energy Agency, 1993. “Crack Indications in Welds of

Austenitic Pipes - NEA #1380.00,” IAEA/NEA Incident Reporting System, Vienna
(Austria).

(4-8) Wachter, O. And G. Brümmer, 1997. “Experiences With Austenitic Steels in

Boiling Water Reactors,” Nuclear Engineering and Design, 168:35-52.

(4-9) Bieniussa, K.W. and H. Reck, 1997. “Evaluation of Piping Damage in German
Nuclear Power Plants,” Nuclear Engineering and Design, 171:15-32.

(4-10) U.S. Nuclear Regulatory Commission, 1986. “Leak Before Break Procedures,”
Standard Review Plan 3.6.3, Washington (DC).

SKI Report 97:26 (3rd Edition) 55

(4-11) Rahman, S. et al, 1995. Probabilistic Pipe Fracture Evaluations for Leak-Rate-
Detection Applications, BMI-2174 (NUREG/CR-6004), Battelle Memorial Institute,
Columbus (OH).

(4-12) Wachter, O. Et al, 1996. “Interkristalline Spannungsrißkorrosion an Nb-

stabilisiertem austenitischem Stahl in Kerneinbauten eines Siedewasserreaktors,” VGB
Kraftwerkstechnik, 76:514-520.

(4-13) Danko, J.C., 1983. “Boiling Water Reactor Pipe Cracking: The Problem and
Solution,” Materials in Nuclear Energy, American Society for Metals, Metals Park (OH),
pp 181-188.

(4-14) Cullen, W., G. Gabetta and H. Hänninen, 1985. A Review of the Models and
Mechanisms for Environmentally-Assisted Crack Growth of Pressure Vessel and Piping
Steels in PWR Environments, NUREG/CR-4422, U.S. Nuclear Regulatory Commission,
Washington (DC).

(4-15) U.S. Nuclear Regulatory Commission, 1988. NRC Position on IGSCC in BWR
Austenitic Stainless Steel Piping, Generic Letter 88-01, Washington (DC).

(4-16) Cragnolino, G., C. Czajkowski and W.J. Shack, 1988. Review of Erosion-
Corrosion in Single-Phase Flows, ANL-88-25 (NUREG/CR-5156), Argonne National
Laboratory, Argonne (IL).

SKI Report 97:26 (3rd Edition) 56

 5

THE ‘PFCA’ ANALYSIS FRAMEWORK

As stated in Section 1, the ‘Pipe Failure Cause and Attribute’ (PFCA) Framework consists
of five steps. The details of this analysis framework for piping reliability are discussed
and illustrated in this section. Each step in PFCA consists of inputs, analytical activities,
special considerations (i.e., caveats), and outputs. Completing an analysis probably
requires several iterations within and between steps; especially between Steps 2, 3 and 4.

A given level of analytical ambition determines the particular implementation of

this Framework. That is, the analytical implementation might be part of a detailed, plant-
specific LOCA frequency estimation requiring an effort of several person-months. At the
other end of the range of possible applications could be a limited scope validation of an
old, judgmental piping reliability estimate requiring no more than a few hours of effort.

5.1 An Overview of the ‘PFCA’ Framework

The ‘PFCA’ Framework (c.f. Figure 14) is not a prescriptive, or ‘cook book style’ analysis
framework. It represents a menu of steps, activities, and rules or recommendations. This
‘menu’ enables an assessment of piping reliability to be tailored to meet work scope
definitions and analysis objectives in the context of PSA applications. Users of the
framework are encouraged to explore the failure data beyond what was done in Section 4.
To refine the analysis framework, further analyses of the data together with pilot
applications should be pursued. Ultimate objective of the framework is to support
development of plant-specific failure parameters for piping system components based on
the broadest possible database, while recognizing the inherent large statistical
uncertainties. A philosophy is presented for how to derive piping reliability parameters.
The framework is data-driven and builds on qualitative and quantitative insights from
reviews and evaluations of operational data from nuclear power plants worldwide.

For reasons cited in Sections 2, 3 and 4, the derived failure parameters will have
large statistical uncertainties. Parameter estimation based exclusively on service data is not
advisable, nor is it feasible for all intended applications. The completeness and coverage of
the reporting on piping failures are well below the standards established by the modern
equipment reliability databases for active components. Therefore, the framework develops
and explains the many caveats to be considered in piping reliability estimation. The user of
this framework should be aware of the statistical uncertainties associated with parameter
estimation based on operational data. Throughout an estimation process, expert judgment
by structural expertise is recommended. The analyst should always assess the
reasonableness of estimated parameters, however.

The analysis framework favors decomposition of a given piping reliability

problem. Upon identification of key design features of a piping system, the analyst
proceeds by addressing the questions about the why-where-how. An analysis should
acknowledge the full operational experience database together with the specifics of the

SKI Report 97:26 (3rd Edition) 57

requirements for application. The framework consists of five steps with required inputs,
analytical activities or deliberations, rules and outputs:

Figure 14. The Five-Step ‘PFCA Framework’ for Piping Reliability Analysis

Output:
Step 1: Define Application Reliability attributes with
Requirements justifications.
The purpose is to determine the
key reliability attribute(s).

Step 2: Conditional Rupture Probability Output:

Based on Step 1 and the data summaries Condition probability of
in Appendix B (SKI Report 97:26) estimate pipe rupture for an attribute.
the conditional probability of pipe rupture.

Output:
Step 3: Reliability Influence Factors Definition of plant-specific
Generic matrices used as templates for influence factors and their
effect on piping reliability.
reviewing plant-specific operational data
to enable the modification of a generic
failure distribution.

Step 4: Piping Component Boundary

Depending on application requirements and
outputs from Step 3, this step determines Output:
the pipe failure frequency and its correct Plant-specific pipe rupture
dimension; e.g., 1/reactor-year and weld. frequency compatible
with PSA model specs.

Step 5: Sensitivity & Uncertainty Analysis

Using the output from previous steps, the
Output:
plant-specific parameters are evaluated 'Qualification' of parameter
relative to sensitivites / uncertainties. estimates.

(1) Application Requirements. The input to this step consists of descriptions of a

piping system (e.g., isometric drawings, material specifications) and service
history. The output is a concise description of the planned application; e.g.,
estimation of LOCA or main steam line break (MSLB) frequency. The intended
application determines how to select generic piping reliability parameters. It also
determines how reliability attributes and influence factors are evaluated and used.
Finally, the application requirements determine how the piping system component
boundaries are defined; e.g., piping section/segment definitions.

(2) Raw Data, Piping Population Data & Generic Reliability Parameters. The
framework includes the necessary analysis techniques and raw data for calculating
plant-specific parameters. Examples of generic parameters are given. The
framework comes with tabulations of raw data (Appendix B) and piping

SKI Report 97:26 (3rd Edition) 58

 population data. Development of application-specific generic data parameters is
followed by detailed evaluations of plant-specific operating experience (including
inspection records and other relevant information) to estimate the plant-specific
parameters. Ask the question: Does the available raw data support the application
requirements?

(3) Reliability Influences & Review of Plant-Specific Experience. The step from
application- to plant-specific parameter estimation is taken via the implementation
of reliability influence matrices (or ‘check-lists’) and evaluations of the observed
effects on reliability by specific influences. Extracted from the SLAP database, the
framework provides information on the influence factors affecting piping
reliability. Information is also provided on the potential reliability improvements
that can be achieved by different remedies. A decision to develop plant-specific
parameters is a major step, and to be meaningful it requires substantial resources
(budget, personnel). Consideration should be given the potential additive or
cumulative effects of two or more influence factors on piping reliability.

(4) Piping Boundary Definition. The review in Step 3 should be done on the basis of
isometric drawings, and the output could be in the form of pipe section/ segment
definitions, and a quantitative basis for modifying generic reliability parameters,
with proper justifications. The purpose of Step 4 is to define the dimension of the
parameter estimates and the PSA model representation of piping failures. The
dimension (e.g., failure/system-year, failure/’length-of-piping’ and year) is a
function of the predominant degradation or failure mechanisms, material, system
layout, etc. For example, in IGSCC-susceptible piping the cracks or leaks typically
develop in weld and weld heat affected zones. For such systems the rupture
frequency should be derived on a per-weld-basis.

(5) Statistical Analysis & Uncertainty Analysis. The framework recognizes the
importance of analyzing uncertainties, and identifies the sources of uncertainty
and how they should be addressed. In the final derivation of plant-specific
parameters expert judgment elicitation and discussions will be combined with
estimates that are based purely on operational data. The ultimate goal of
uncertainty analysis is to qualify the conclusions about piping reliability based on
point estimate evaluations. Uncertainty analysis should also be used to identify
where improvements in the state of knowledge can lead to maximum benefit with
respect to an accurate assessment of piping reliability.

Typical applications are illustrated in Figure 15. The LOCA frequency assessment
is concerned with piping system failures within the RCPB. Similarly, the systems analysis
or the analysis of internal flooding events could be could be concerned with failures in
support system piping, etc. In the PFCA Framework we divide the parameter estimation
into the following activities, as indicated in Figure 15:

(1) Assessment of the piping failure frequency (i.e., initiator) by asking how often
does a plant experience piping degradation. As indicated in Sections 2, 3 and 4,
there are different estimation strategies; e.g., a) direct estimation using the service
data in the SLAP database, b) conservative assumption of 1 event per year, or c)
data specialization using a combination of ‘1’ or ‘2’ and plant-specific data.

SKI Report 97:26 (3rd Edition) 59

(2) Determination of an attribute of piping reliability which yields the conditional
probability of rupture given a degradation.

(3) Consideration of influence factors to generate application-specific parameter

estimates.

Failure of RCPB Failure of SUPPORT Failure of BOP

Piping? System Piping? Piping?

Leak? Rupture? Leak? Rupture? Leak? Rupture?

RCPB Leak (40%)

Piping Failure
RCPB Rupture (1.9%)
[1/yr]
SUPPORT Leak (23.1%)

SUPPORT Rupture (1.4%)

BOP Leak (19.7%)

BOP Rupture (4.8%)

Split fractions are characterized
as a 'conditional probability of a
leak or rupture given an occurrence
of degraded piping.

Note: Numbers in ( ) represent the percentage of

the total SLAP database content (per Version 7.7,
a total of 2,356 events).

Figure 15. Illustration of the Data Needs - The Frequency of Pipe Failure

5.2 The ‘PFCA’ Steps

The ‘PFCA’ Framework was developed for PSA practitioners, and it is strongly influenced
by interpretations of operational data. Each step of the framework consists of inputs,
activities, rules, and outputs.

The inputs are derived from prior steps, from the main PSA study tasks, or from
other information sources (e.g., incident reports, root cause analysis reports, published
PSA studies, probabilistic fracture mechanics (PFM) evaluations). The activities are what
are basically undertaken by the analysts within each step to achieve the objectives of that
step. Recommendations and rules guide the activities of the analysts. The output is the
product of the activities carried out by the analysts and is determined by the information
required in the other steps or by the PSA study itself. It is envisioned that a team of system
analysts (i.e., PSA practitioners) and structural expertise would be intimately involved in
all steps of the analysis.

SKI Report 97:26 (3rd Edition) 60

 Data analysis should be based on a model of failure. That model should portray
pertinent aspects of failure as extracted from operational data. The model should also
discriminate between reliability attributes and influence factors. Translating operating
experience data into a PSA parameter data set requires a multi-step approach. For the
purpose of interpreting and analyzing service data the following model of piping reliability
is chosen; c.f., Section 2.3 and Section 4.5:

fR = fFAILURE × pRUPTURE | FAILURE

(5-1)

where fR = frequency of a pipe rupture;

fFAILURE = frequency of a pipe failure (e.g., flaw/crack, leakage);
pRUPTURE | FAILURE = conditional probability of rupture given a flaw/crack or
leakage.

pR FAILURE = Σn = α,β ..η (ki-‘X’ $ pR DP - GENERIC ) (5-2)

where pR DP-‘X’ = plant-specific conditional probability of pipe rupture and ‘X’ refers to
a specific attribute such as type of system;
ki-‘X’ = influence factor ‘i’ applicable to attribute ‘X’;
α, β … η refer to different, independent degradation or failure mechanisms
affecting the piping system under consideration.
pR DP-GENERIC = generic conditional probability of pipe rupture derived from
industry-wide service data.

Equation (5-2) acknowledges that within a given type of piping system, different,
independent degradation or failure mechanisms (denoted by α, β ... η) could be acting
upon the piping system components. The right-hand side of Equation (5-1) consists of two
terms which are addressed by Steps 1 through 5 of the ‘PFCA’ Framework:

- Step 1 defines the attribute(s) of interest (e.g., 〈material - diameter〉, 〈material -

plant system - diameter〉) and how they relate to the PSA (e.g., static versus
dynamic PSA, full power versus low power or shutdown PSA) and the definition
of population data;

- Step 2 quantifies the attribute(s), provides a basis for nominating a base failure
rate, and produces an application-specific generic failure rate. The output is a
conditional rupture probability (pR DP);

- Step 3 identifies the key influence factors and develops a basis for converting an
application-specific generic failure rate into a plant-specific failure rate.

- Step 4 defines the PSA model requirements including the parameter database.
The output is the pipe failure frequency, fFAILURE;

- Step 5, finally, should be seen as a validation of assumptions made in previous

steps. The sensitivities and uncertainties in parameter estimates are evaluated in
this step.

SKI Report 97:26 (3rd Edition) 61

 The combination of activities in Steps 1 and 2 establishes a basis for application-
specific but generic pipe failure rates. The term ‘generic’ should not imply an ad hoc
selection of data parameters. Instead, the selection of generic data should be done with the
same care and attention to operating environments and plant design features as the data
specializations themselves. In Steps 3 and 4, the generic information is specialized to
reflect the unique features of a given piping system as defined by Steps 1 and 2. We can
say that Steps 1 and 2 are concerned with a priori analysis, while Steps 3 and 4 consider
the a posteriori analysis. The details of the steps are discussed in the next five sections.

5.2.1 Step 1: Definition of Application Requirements

The parameter estimation should be performed against clearly defined application

requirements. The ‘top-level’ requirements come from the PSA model specifications (e.g.,
computer code requirements and data input formats), assessments of consequences of
potential piping system failures, and the motivations behind the PSA project. Before
presenting the intents of Step 1, the data parameter content of the PFCA are discussed
below. PFCA includes ‘modules’ to carry out plant-specific piping reliability analysis in
the context of PSA projects, including base-line full power, low power and shutdown
PSAs and ‘living’ or ‘online’ PSAs. The latter type of application could be concerned with
the risk-impact of different ISI strategies. For any given analytical context, combinations
of modules may be developed by the analyst using the data contained in Appendix B. The
data is organized according to the conditional factors of failure. Included with the data
presentations in Appendix B are the following items, which represent the generic data:

- Reliability attributes (e.g., type of piping system, type of plant system, material).
Using the raw data in Appendix B, the user of this framework may develop new,
application-specific attributes;

- Population data (e.g., type and number of piping system components). Embedded
within this ‘block’ is the question about what kinds of operational data should be
considered (i.e., data from all plants worldwide, or a subset of all data). Some
examples of population data are included in Appendix B;

- Raw data; e.g., number and types of failure events corresponding to a given
attribute or set of attributes;

- Summaries of reliability influence factors, and checklists containing global

influences extracted from the SLAP database.

Step 1 of the PFCA Framework is represented by a flow chart; c.f. Figure 16. With
emphasis on purpose, inputs and outputs, and expected analysis activity, the application of
this flow chart is discussed below. A chosen attribute, or set of attributes, must have
relevance to the specific piping system(s). The approach to data analysis and identification
of the most appropriate piping reliability attributes are functions of study scope and
objectives.

SKI Report 97:26 (3rd Edition) 62

 As an example, should an attribute be selected on the basis of 〈material - diameter〉
or 〈plant system - material - diameter〉? The answer should reflect the desired analytical
discrimination. The purpose of defining attributes is to support development of a generic
failure rate distribution based on operational data, which correspond to the chosen
attribute(s). The selection of an attribute should reflect our knowledge about piping
reliability and its conditional factors.

The user of the Framework should develop justifications for selecting a certain set
of attributes among the extensive set of attributes included in Appendix B. As an example,
if the study objective is to develop new LOCA frequencies, the operational data of interest
could be limited to piping failures in LOCA-sensitive piping. A systems review enables
the identification of those systems of concern (e.g., primary system piping and
unisolateable connecting piping inside containment). The review would provide the
attributes to be considered for further analysis. These user- or application-defined
attributes most likely would be limited to piping systems of certain metallurgy, diameter,
mode of operation, safety significance, systems addressed by existing PSA model
structures, etc.

Element 1: Plant-specific analysis

of piping reliability in support of
PSA application.

Use published parameter data,

but perform qualification by No APPLICABLE?
comparing the basis for estimation
with raw data sets in Appendix B.
Yes

IE-LOCA / ISLOCA IE-FLOODING RBI / ISI Targets Event Analysis

BOP / Support Mainly RCPB 'Safety Significant'

RCPB-Piping
System Piping Piping Piping

Element 2: Analysis of operational data by:

- Identifying failure modes / mechanisms;
- Identifying affected systems / fault locations;
- Identifying extent of damage (plant and
system impact), potential for pipe whips.

Step 1 Output:

List of reliability attributes

with justifications.

Figure 16. Step 1 of the ‘PFCA’ Framework - Application Requirements

SKI Report 97:26 (3rd Edition) 63

 The applications are differentiated according to ‘black-box approach’ (which is
equivalent to direct use of already published data; e.g., WASH-1400), ‘opaque-with-
constraints’ and estimation by
THE ‘PFCA’ STEP 1
‘decomposition.’ The problems
associated with the direct use of The Analysis Inputs (c.f. Figure 5-3):
published data are well documented; Description of the scope and objective of the
e.g., SKI Report 95:59[5-1]. Therefore, PSA / PSA application, definition of resources.
this report does not present any
Intent of Step 1: To decide whether implicit or
tabulations of recommended or
explicit modeling of piping reliability is required.
nominated failure frequencies or Also, to determine the specific safety issues /
conditional rupture probabilities. regulatory issues to be considered by PSA. To
Instead, the analyst has to derive establish the level of analytical discrimination
parameter estimates that best fit an which is required.
application. The analysis framework Rules: Compatibility with PSA model structures
provides all the main elements for and data requirements.
developing failure parameters that
reflect interpretations of the selected Outputs: Itemized list of piping systems to be
service data, however. The focus of this considered by the analysis.
analysis framework is on the opaque-
with-constraints and decomposition approaches. It is expected that an application is
performed as a team effort, which involves PSA expertise, structural expertise, and
NDE/ISI expertise.

In the context of piping reliability analysis, ‘opaque-with-constraints’ means that

while an analysis is concerned with the details of piping failures (i.e., causes, attributes and
influence factors, industry-wide and
plant-specific operating experience), it THE PFCA STEP 1 / ELEMENT 2
does not include explicit modeling of an
entire piping system with its Inputs to Element 2 of Flowchart in Figure
components such as welds, nozzles, 5-3: Information on piping system design (e.g.,
isometric drawings), material specifications,
bends, elbows, etc. The opaque NDE/ISI experience/insights and service data.
approach looks at a piping system as a
whole; i.e., without explicit recognition Activity: Review of the conditional factors
of geometry or individual welds, (e.g., attributes and influence factors),
elbows, etc. In other words, the including the relevant raw data tabulations in
Appendix B of this report. Determine whether
analysis ‘blocks out’ the individual the data analysis should be done according to
features of a piping system design type of system, operating mode, material, or
deemed unimportant to plant other attribute.
safety/PSA results, analytical
Outputs: List of reliability attributes to
discrimination, etc. consider, with guidance on how to proceed
with the estimation of failure parameters.
Validation of an estimate solely
on the basis of referencing published data is not recommended. In the past, most PSA
studies have used the WASH-1400 estimates. For the reasons stated in SKI Report 95:58
(c.f. Nyman et al (1996)[5-2]), these estimates could lead to over-conservatism in the
parameter estimation. The purpose of Step 1 of the analysis framework is to ensure that the
available service data are considered in sufficient detail.
The decomposition approach is equivalent to a section-by-section or component-by
component evaluation of piping system reliability. A detailed review of a piping system

SKI Report 97:26 (3rd Edition) 64

should be done on the basis of reviews isometric drawings and system walkdowns. Such
review would reveal any discrepancies between the as-designed and as-built/operated
system. Next, spreadsheets are developed with details on piping system design issues,
operating experience, reliability attributes and influence factors for each piping system
section or component as identified by the analysis team. An example of a spreadsheet is
given in Figure 17.

Node P&ID Isometric Material Weld DN Medium Service

No. NO. No. Spec. spec. history

Notes: - Node No. refers to an individual component as identified on the isometric drawing.
- Under ‘Medium’ identify the type of medium, and whether the process medium is (could be)
stagnant during normal operation.

Figure 17. Blank Sample Spreadsheet for Collecting Piping System Information

Proceeding to ‘Element 2’ of the flowchart in Figure 16 implies a detailed

consideration of the applicable industry-wide operational data, including the plant-specific
experience. The SLAP database includes mainly significant failures as documented in
LERs and equivalent reports. The coverage and completeness of the SLAP database are
discussed in Section 3 and Appendix A.

While most major piping failure events have been included in the database, SLAP
does not contain the plant-specific service data normally available to a PSA project (e.g.,
the reports on NDE/ISI results, primary and secondary side incipient and degraded failures
not determined to require formal dispositioning with regulatory agency). Objective of
‘Element 2’ is to ensure that all the relevant plant-specific operating experience is being
accessed, and to prepare for detailed evaluation of plant-specific data against industry-
wide data. The formation of an analysis team should include consideration of involving
structural expertise NDE/ISI expertise. That expertise should be consulted when reviewing
isometric drawings and the service data.

5.2.2 Step 2: Derivation of Application-Specific Rupture Probabilities

There is no one way of developing an application-specific rupture probability. From the

SLAP database (c.f. Appendix B) we get the conditional probabilities of pipe rupture,
pR⏐DP, for various attributes. The way we elect to define the attribute(s) of concern affects
the derivation of absolute pipe rupture frequencies. Note that each attribute category may
incorporate (i.e., subsume) several specific reliability attributes.

SKI Report 97:26 (3rd Edition) 65

 A simple way of characterizing reliability attributes is via direct estimation of
conditional rupture probabilities using the Bayesian approach (c.f. Section 4). An
alternative approach would be to use probabilistic fracture mechanics (PFM). PFM
techniques have gained increased acceptance as a method of generating piping failure
probabilities. Mostly, these studies have analyzed the probability of a double-ended
guillotine break (DEGB) of the reactor coolant loop piping. An overview of the
methodology is given in Simola and Koski (1997)[5-3], and a summary of typical results is
given in Bush and Chockie (1996)[5-4]. PFM evaluations are labor intensive and may not fit
into a PSA project schedule. In the past, PFM has been used to calculate large and medium
LOCA frequencies.

An example addresses the potential problems of converting PFM results into PSA
parameters. As part of its reevaluation of the DEGB of reactor coolant loop piping as a
design basis event, the Lawrence Livermore National Laboratory, under a contract with the
U.S. Nuclear Regulatory Commission, estimated the probability of occurrence of DEGB
by using the PRAISE computer code[5-5]. Results from an evaluation of Westinghouse
PWRs are reproduced in Table 18.

Table 18. Probability of DEGB and Leak in RCS Piping[5-6] - An Example

Failure Probability of Failure / Yea
Mode 10% 50% 90%
DEGB 5.0E-17 4.4E-12 7.5E-10

Leak 5.6E-10 1.1E-7 2.4E-7

These results relate to the hot leg, cold leg and crossover leg of a four-loop PWR
plant. Additional information on material, dimensions, degradation mechanisms, and crack
size must be derived from the input data used to run the PRAISE computer code. Prior to a
PSA application, information as presented in Table 18 should be evaluated relative to the
computer code input parameters. That is, do the tabulated results represent the conditional
rupture probability of the entire system or a specific piping system component such as a
weld? Performing a parameter conversion, or specifying the PFM input parameters could
be done within the PFCA Framework.

The limitations of service data should always be considered when performing

direct estimation of conditional rupture probabilities using service data. The SLAP
database is limited to failures for which a requirement has existed to file a licensee event
report. This means that failures, which result in an entry into a Technical Specification
Action Statement are included in the database. Statistical uncertainties due to data
coverage and completeness impact applications in different ways. Events involving
support system and BOP system are typically under-reported.

The PFCA Framework stresses the importance of surveying existing plant-specific

maintenance work order records, NDE/ISI records, etc. to ensure full consideration of all
relevant operating experience. SLAP provides a general overview of the types of failures
that have been experienced to date. Based on the coverage and completeness of the SLAP
database, the users of the Framework should pursue further explorations and evaluations of
operational experience, however.

SKI Report 97:26 (3rd Edition) 66

 Depending on intended application, operational data can be interpreted and pooled
in any number of ways. The analysis must be supported by proper justifications, however.
The objective of Step 2 (Figure 18) is to ensure the derivation of relevant application-
specific generic failure rates. That is, the failure rates should be relevant to the specific
piping systems.

Input From Step 1:

List of reliability attributes
with justifications.

Direct Estimation
Probabilistic Fracture Mechanics (PFM)
Estimation of conditional
Estimation of conditional rupture
rupture probability using
probabilities using PFM.
service data.

Extract service data which best

reflect intended application.

For PFM, the service data for, say,

IGSCC susceptible piping could be
information on crack location and Step 2 Output:
geometry. Matching sets of attributes
and conditional rupture
probabilities.

Figure 18. Step 2 of the ‘PFCA’ Framework - Estimation of the Conditional Pipe Rupture
Probability

Step 2 Analysis Inputs (c.f. Figure 18):

Piping reliability attribute(s) together with application specifications; e.g., detailed
pipe-section-by-pipe-section LOCA frequency estimation, or define PFM
evaluation requirements.

Intent of Activity:
Estimation of the conditional probability of pipe rupture to support the calculation
of pipe rupture frequency per Equation (5-1).

Rules:
There must be consistency between the Step 1 output and the selection of service
data. When performing direct estimation, the pooling of service data must be
consistent with the defined attributes; e.g., service data for carbon steel and
stainless steel should not be mixed.

Outputs:
Conditional pipe rupture probability for a specific attribute or sets of attributes.

SKI Report 97:26 (3rd Edition) 67

5.2.3 Step 3: Reliability Influence Factors

Step 3 (Figure 19) could be the most time-consuming and challenging part of a plant-
specific analysis of piping reliability. It includes detailed engineering evaluations of a
given piping system to determine where vulnerable areas exist. Such an evaluation should
be done against the service data, including the NDE/ISI experience relevant to the specific
piping system. Ultimately, Step 3 is concerned with the question whether the industry-
wide service data applies or not. There should be well formulated, compelling reasons for
modifying a conditional rupture probability as derived in Step 2.

Input From Step 2:

Matching set of reliability
attributes & failure rate
distributions with justifications.

Application-specific influence factors

Select influence factors from Appendix B.

Plant-specific operational data available?

Yes
No APPLICABLE?

Determine range factors and apply expert Develop influence matrix(-ces) and determine
judgment to assess the factor-of-improvement. the k-factors of the SLAP correlation.

Step 3 Output:
Data specialization strategy; retain or
modify generic failure parameters?

Figure 19. Step 3 of the ‘PFCA’ Guidelines - Evaluation of Influence Factors

Step 3 Analysis Inputs (c.f. Figure 19):

Application specific conditional pipe rupture probability)-ies). Reliability influence
matrix(ces) that apply to the specific system(s); Appendix B.

Activity:
Performance of the 4 tasks of Step 3: Team effort, with input from PSA expertise, piping
design engineers, structural engineers, and NDE/ISI expertise.

Rules:
Derived ‘k-factors’ should be consistent with observed ranges of variability. A ‘k-factor’
is a measure of how plant-specific service data differ from the industry-wide data.

Outputs:
A determination of how plant-specific service data differs from the industry-wide data,
and (possibly) k-factor values.

SKI Report 97:26 (3rd Edition) 68

 The objective of Step 3 is to develop justifications of sufficient depth for modifying
or not modifying the conditional rupture probability as developed in Step 2 of the
framework. The output of Step 3 could include the ‘k-factors’ of the interim SLAP
Reliability Correlation (c.f. Sections 4.4 and 4.5) for modifying an application-specific
conditional rupture probability, including justifications. Equally plausible could be the
decision not to pursue further data specialization. Four tasks are included by this step:

- Task 1. Review of an influence matrix (c.f. Section 4.4 and Appendix B) relevant
to a specific attribute. The matrix represents a checklist that identifies typical
degradation and failure mechanisms with their influence factors. A multi-discipline
analysis team determines which of the given influences apply to the system under
review, and to what extent the influence applies relative to the industry-wide
service data.

- Task 2. Based on the root cause analysis approach, identify the causal and
contributing factors and determine the remedial actions to prevent recurrence of a
specific degradation or failure mechanism. The evaluation must go beyond the
apparent cause of failure. Of particular interest is to note the effectiveness of
remedial actions at other plants; e.g., effectiveness of HWC, the extent by which
IGSCC has been reduced or eliminated by changing the piping material from, say,
Type 304 stainless steel to Type 304 NG stainless steel.

- Task 3. Identify physics-of-failure concepts/models to verify the insights from

historical data and failure analysis.

- Task 4. Determine the overall range of effect an influence factor could have on
average piping reliability. Appendix B includes examples of the range of effect of
different influences on different attributes. The raw data files in Appendix B
supports the calculation of range factors that are not explicitly covered in this
appendix.

The output consists of justifications for keeping or modifying a generic failure rate.
Assuming that sufficient plant-specific experience exists, Step 3 could provide k-factors
per the interim SLAP reliability correlation (Equation 4-12). The evaluation and review of
influence factors should be augmented by piping system isometric drawings and system
walkdowns. The isometric drawings include details on:

- Layout and geometry, including welds, flanges, valves, pumps;

- Instrument and test line connections, sample points including locations of stagnant
process medium;
- Supports and hangers;
- Accessibility for NDE/ISI;
- Type and extent of piping insulation, heat tracing;
- Diameter, wall thickness, metallurgy;
- Process medium and flow direction;
- Method of fabrication, which includes identification of shop- and field fabricated
piping and welds;
- Test and inspection points;
- Physical proximity of fixed equipment (i.e., pipe whip vulnerabilities).

SKI Report 97:26 (3rd Edition) 69

 An implementation of Step 3 reflects the outputs from Steps 1 and 2. As an
example, evaluations of test and inspection points, and NDE/ISI, become more important
in the context of dynamic PSA than for the static PSA. In the former case we need to
acknowledge the testing and inspection intervals and practices, and how they could
influence piping reliability. The effectiveness of NDE/ISI would also be a consideration.

5.2.4 Step 4: Definition of Piping System Component Boundary

At this stage we have defined the application requirements with the reliability attributes
and influence factors. The objective of Step 4 (Figure 20) is to estimate the absolute pipe
rupture frequency. Before estimating the pipe rupture frequency we must define the type of
modeling to be considered; e.g., pipe rupture frequency per length of piping, per weld.

Input From Step 3:

Application requirements with matching
sets of attributes & influence factors.

Model discrimination
Develop basis for modeling by
decomposition.

No APPLICABLE?

Yes

Define & Summarize

Define & Summarize
Generic failure rate(s) & attributes and
Generic failure rate, attributes &
influences. Define the approach to
influences + justifications.
'reliability apportionment'.

Step 4 Output:
Definition of piping reliability structure,
requirements on parameter estimation.

Figure 20. ‘Step 4 of the PFCA’ Framework - Estimation of Pipe Rupture Frequency

The purpose of a model determines its basic form and data needs. An engineering
purpose could be to use the PSA as a basis for optimizing the system design and operation.
In this form most attention is given to relative differences in reliability. A plant safety
management purpose could be to use the PSA to monitor plant safety against some target
value. The safety monitor approach could imply an interest in absolute rather than relative
reliability. Typically, optimization requires a higher level of model discrimination than
‘safety monitoring.’ Step 4 essentially determines the completeness of the modeling that is
necessary to meet the PSA application requirements.

SKI Report 97:26 (3rd Edition) 70

 Model discrimination is a function of the approach to establishing reliability
models. Decomposition models are based on reliability methods such as the fault tree or
the reliability block diagram, which includes the individual piping system components;
e.g., bends, elbows, straight sections, tees and welds. Holistic models are established based
on a proposed direct functional relationship between a quantitative measure of reliability
performance and the variables affecting reliability. Holistic models of piping reliability
consider an entire system rather than modeling of individual components.

Plant-specific operating experience could influence the modeling approach. Piping

system component failures are location dependent, which means that leaks or ruptures
occur in the weakest piping system component. A piping system model should reflect
known or expected degradation and failure susceptibilities. Available operating experience
points to the location dependency of failures. Examples include elbows or tees thinned to
the point of failure due to erosion-corrosion mechanisms, or welds cracked by stress
corrosion cracking or vibrational fatigue. A piping system model which is based on
decomposition could be limited to the most vulnerable (i.e., most risk significant) piping
system components. The objective of Step 4 includes ensuring that the piping reliability
data are derived against an objective. Plant-specific experience could result in a decision to
apply a mixed modeling approach; i.e., some piping systems are analyzed by
decomposition while others are analyzed holistically.

A piping system boundary definition could be based on the global data to

demonstrate the relative importance of environmental conditions such as water-in-steam,
vibrations-by-poor-piping support, etc. There is a fine division between definitions of
attribute and influence, however. Different data interpretations may lead to different
insights or conclusions regarding what is considered an influence factor, a characteristic
controlled through operational strategy, ISI, or chemistry). The component boundary
definition determines the form of the piping failure rate estimators; e.g., failure per weld
and hour of failure per piping section and hour.

In the decomposition approach, pipe sections as defined by isometric drawings are

analyzed individually. Accurate piping component population counts is obtained via
reviews of isometric drawings. Differentiated by their failure susceptibilities, failure
frequencies are developed on a ‘per-section-basis.’ This means that different failure
frequencies are derived for welds, fittings, bends, elbows, etc. The frequency of pipe
failure is determined from:

fFAILURE = (Number of failures) / (Time × Extension) (5-3)

where ‘Extension’ = Piping system component boundary; e.g., number of pipe segments,
welds, elbows, or tees. Based on the attribute(s) defined in Step 1, population data
on the piping system components must be derived from reviews of piping system
design information.

Depending on the output from Step 1 of the PFCA Framework, different strategies
could be applied to the definition of the numerators and denominators of Equation (5-3).
Significant uncertainties are associated with the failure frequency estimates. The value of
the numerator is a function of the coverage and completeness of service data. The
denominator is a function of the completeness of design information. Some literature data

SKI Report 97:26 (3rd Edition) 71

on piping system component populations exist; c.f. Table 19 and Appendix B. There are
considerable plant-to-plant differences in piping system designs; major differences
between BWRs and PWRs, between external-pump and internal-pump BWRs, and major
differences between the different reactor vendors. The development of realistic component
counts could be very time consuming.

Table 19. Examples of Literature Data on Piping System Component Populations

Source Type of Data Comment
EPRI TR-100380 (1992) and Pipe section counts for different Proprietary report available to
EPRI TR-102266 (1993): Pipe systems or system combinations. EPRI members only. According
Failures in U.S. Commercial A ‘section’ is defined as “.. a to this EPRI report, the reason
Nuclear Power Plants segment of piping, between for using the pipe section
major discontinuities such as definition is that pipe section
valves, pumps, reducers, tees, counts “.. can be readily counted
etc. ..” A pipe section typically on the P&IDs ..” It is to be
contains between one or three noted, that for some piping
elbows and four to eight welds. systems the P&IDs would not
The information is differentiated provide the level of detail needed
by pipe diameter (three classes). for accurate pipe section counts -
significant uncertainties could
arise if a verification is not
performed against isometric
drawings.
NUREG/CR-4407 (1987): Pipe Approximate number of welds For reasons stated in Section 4,
Break Frequency Estimation for and approximate length of piping this type of information is of
Nuclear Power Plants. for BWR and PWR systems. limited practical use. Piping
The information is differentiated reliability analysis must be
by pipe diameter (two classes). performed on the basis of
‘where-why-how’ a specific
piping system fails. Pipe length
is a weak measure of reliability.
PSA applications; Oskarshamn-1 Detailed evaluations of The best sources of information.
(1995), Surry (1996) , Millstone- individual piping systems; Note that the estimation of
3 (1996, WCAP-14572), etc. accurate counts of piping absolute rupture frequencies
components with information on must include plant-specific
material, size, inspection assessments of piping component
histories. populations.

A problem with an estimator like Equation (5-3) is that it is largely controlled by

the denominator. The uncertainty could be very large depending on how the denominator
is defined. Not only is it difficult to develop realistic component counts, the definition of
the exposure time also requires knowledge about plant operations and piping system
design. In general, the exposure time is a function of the type of piping system and the
dominant degradation mechanism. A few examples are given below:

- The exposure time is equal to the time between failure of a specific piping system
component. Relative to active components, passive components such as piping are
highly reliable. Therefore, the exposure time normally is equal to the age of the
component ‘socket’ if the dominant degradation or failure mechanism can be
attributed to corrosion, erosion/ corrosion or stress corrosion cracking.

SKI Report 97:26 (3rd Edition) 72

- The mode of piping system operation determines the exposure time if the dominant
degradation or failure mechanism can be attributed to vibrational fatigue. Usually
the operating time of the vibration source (e.g., pump, compressor, fan) determines
the exposure time. Reliable estimates are available via run time meters where
available.

- The SLAP database tracks instances of piping system replacements as well as

repeat failures. The estimation of exposure time should include adjustments that
recognize replacements and time between repeat failures.

As for the estimation of the conditional pipe rupture probability in Step 2, the
estimation of the numerator and denominator of Equation (5-3) must reflect a stated
application. Detailed engineering evaluations of a piping system should always be
considered in the parameter estimation process.

5.2.5 Step 5: Statistical Analysis & Uncertainty Analysis

There are many sources of uncertainties and the objective of Step 5 is to develop a
qualitative discussion of these sources and how they could impact the results. The goal of
uncertainty analysis is to qualify the conclusions made as a result of point estimate
evaluations.

Given the sparseness of the piping failure data, the analyst is forced to merge the
data from several plants together and to pool similar (but not identical) piping system
components into generic classes. Engineering judgment is required to determine the
applicability of data and to perform the aggregation of the different sources of data into
generic groupings. Even in the case of the simplest type of data, true data in the sense of a
set of measurements of the quantity in question (e.g., failure rate) does not exist. We have
records of the number of components failing in a given span of years, and from this a
failure rate is computed as the ratio of the number of failures over the exposure. The data
are taken at different plants and on components in different systems having different
operating environments, NDE/ISI-intervals and modes of operation.

Typically, the denomination is not known precisely and engineering judgment is

used to determine reasonable average exposure times, demand histories, etc. Thus, in
addition to a piping system component type’s inherent variability in failure history due to
randomness in, say, materials, we also have variability, which is due to data source
differences:

- Plant-to-plant differences (type, age of plant, operating practices);

- In-plant differences (age of component, location in plant, mode of usage during

routine plant operation, low power operation, or shutdown operation);
-
- Generic grouping;

- Mode of failure (c.f. discussion on failure modes in Section 3).

SKI Report 97:26 (3rd Edition) 73

 This type of variability is often termed systematic and becomes a source of
uncertainty when data from several sources are applied to the analysis of a particular plant.
In practice, one must use the existing data with its systematic variability and the question
becomes:

- How to characterize the uncertainty to reflect the systematic variability;

- How to reconcile generic data from many sources with more limited plant-specific
data (if available).

Some considerations in answering these questions have been addressed by Mosleh

[5-7]
(1987) . One resolution is to define a generic group (i.e., according to attribute) of
components for which the times to failure are assumed to be fixed values. By plotting the
cumulative distribution function against time an assessment is made of the plant-to-plant
variability. When plant-specific data are available, the generic distributions can, in the
Bayesian method, be modified, using it as a prior distribution, and utilizing the plant-
specific data to specify the likelihood.

It may also be desirable to include other sources of variability in deriving a

distribution. For example, the distribution may be chosen to reflect both plant-to-plant and
system-to-system variability. This distribution should, however, be used to represent
uncertainty in the failure characteristics of a piping system component only if there is no
consistent system-to-system variability at all plants. If there is a significant consistent
system-to-system variability, the piping components from different systems should not be
grouped into the same population, but rather each system should be treated separately by
constructing a plant-to-plant distribution for components of that system.

5.3 Guiding Principles

The proposed ‘PFCA’ framework evolved from reviews of service data on piping systems.
It supports piping reliability analysis in the context of PSA applications. Although the
framework supports direct estimation, alternative techniques to the estimation of the
conditional rupture probability in Steps 1 and 2 should be considered. Probabilistic
fracture mechanics (PFM) is an example of an alternative to direct estimation. Regardless
of the chosen technical approach, PFCA is not a short-cut method to failure parameter
estimation. In fact, whether direct estimation or PFM is used, the level of effort involved in
parameter estimation could be considerable.

Based on the attribute and influence concepts, the service experience should be
organized according to exposure and event fields (or ‘bins’). Each record fits one unique
exposure field, and each failure is the realization of one and only one degradation
mechanism and one and only one failure mode. The pipe rupture frequency, fR, associated
with a particular attribute may be estimated from:

fR = fF × pR| F (5-4)

Where fF = (2F + 1)/2T (5-5)

pR|F = (2R + 1)/(2F + 2) (5-6)
SKI Report 97:26 (3rd Edition) 74
 Index ‘R’ = rupture;
Index ‘F’ = failure, which could be a flaw/crack, leak or rupture (see below);
T = exposure time in reactor-years (i.e., the in-service time).

In Equation (5-4) the parameter estimation problem is separated into two steps.
First, the occurrence rate of a ‘failure’, fF,, resulting in a plant shutdown for repair or
replacement is estimated from the service experience. Next, the conditional rupture
probability given a failure, pR F, is estimated. Equation (5-4) is useful for degradation
mechanisms that progress from leakage to rupture if the leak is not detected and repaired.
The estimates derived through Equations (5-5) and (5-6) are the mean values of aposteriori
Γ- and β-distributions, respectively, using non-informative priors; c.f. Martz and Waller[5-
8]
. Some failure frequency and rupture frequency estimated by using the above set of
equations and the service experience summarized in Section 3 and Appendix A are given
in Table 20.

Table 20. Examples of Pipe Failure and Rupture Frequency Estimates

Degradation Number Number Mean Failure Mean Mean Rupture
Mechanism of of Frequency Conditional Frequency
Failures Ruptures [1/Reactor-Year] Rupture [1/Reactor-Year]
Probability
Boric Acid 19 0 4.1E-03 2.5E-02 1.0E-04
Corrosion (BAC)
Corrosion 143 4 3.0E-02 3.2E-02 9.6E-04
(COR)
Erosion-corrosion 405 46 8.6E-02 1.1E-01 9.4E-03
(E/C)
Vibration-fatigue 618 57 1.3E-01 9.3E-02 1.2E-02
(VF)
Thermal fatigue 84 4 1.8E-02 5.3E-02 9.5E-04
(TF)
Stress corrosion 115 0 4.3E-02 4.3E-03 1.9E-04
cracking (SCC) -
PWR environment
Intergranular SCC 230 0 1.6E-01 2.2E-03 3.6E-04
(IGSCC) - BWR
environment
Transgranular 28 0 6.0E-03 1.7E-02 1.0E-04
SCC (TGSCC)
TOTALS: 1642 111 3.5E-01 6.8E-02 2.4E-02

These tabulated values represent industry wide experience with piping subjected to
respective degradation mechanism. Next the attribute of concern must be defined more
precisely, and the dimension of exposure must also be determined. For PSA applications,
an attribute could be <diameter - type-of-system - process-medium>. This leads to the
necessity of organizing the service experience according to exposure fields by defining
appropriate reliability attributes. Does it matter in what way the service data are
disaggregated? The data dis-aggregation - and the establishment of raw data summaries,
which reflect a specific attribute - should reflect a deep understanding of piping reliability,
the service experience, and the role of the influence factors. Figure 21 shows comparison
of conditional rupture probabilities for a selection of attributes. This comparison
demonstrates the importance of defining strategies for dis-aggregation of service data.
Equally important is the qualification of the service data. That is, the relevance of a

SKI Report 97:26 (3rd Edition) 75

particular service data aggregation to a specific application must be validated relative to
application requirements.

1.00E+00 RCPB Piping Stainless steel (all degradation

Systems mechanisms)
Conditional Probability of Rupture

Stainless steel (IGSCC + SCC +

TGSCC)
1.00E-01
pR|F

1.00E-02

Stress corrosion cracking is the

1.00E-03
principal degradation mechanism
of piping of > DN250.

1.00E-04
<= DN25 25 < DN <= 50 50 < DN <= 100 100 < DN <= 250 > DN250
Nominal Diameter

Figure 21. Conditional Rupture Probabilities for Different Attributes

Before inputting the parameter estimates in the PSA models, the proper failure
parameter dimension must be applied. For piping system components the dimension of
exposure is [time × extension]. Hence, the parameters given in Table 5-3 are incomplete
estimates. The ‘extension’ cannot be universally defined, however. It is a function of the
applicable reliability attributes and influence factors. For austenitic steels susceptible to
IGSCC, the flaws/cracks or leaks develop in welds or weld-heat-affected zones (HAZ).
Therefore, the ‘extension’ would be the number of welds/HAZ in the piping system(s)
under consideration. The extent of erosion/corrosion (or flow-assisted corrosion) damage
in ferritic steels is strongly influenced by flow velocity and geometry. Hence, for piping
susceptible to erosion/corrosion (or flow-assisted corrosion) the ‘extension’ would be
given by the number of elbows, tees, reducers and straight sections.

Assuming that the average number of welds in IGSCC-susceptible piping in an

external-recirculation pump BWR is about 2000 per plant, the mean rupture frequency
then becomes:

fR = (fF / 2000) × pR|F= (1.6·E-01/2000) × 2.2E-03 = 1.8E-07 / Weld. Reactor-yr

The above parameter estimate is provided for illustrative purposes. It does not
distinguish between IGSCC-susceptible piping of different diameter and different grades
of austenitic stainless steels. Accurate piping component population counts should be
extracted from design information (e.g., isometric drawings). At this stage the analysis
should address the influence factors; e.g., water chemistry (normal water chemistry versus
hydrogen water chemistry), welding method.

SKI Report 97:26 (3rd Edition) 76

 Step 4 of the PFCA framework addresses the estimation of application-specific
pipe failure frequencies. That is, failure frequencies which relate to a specific degradation
or failure mechanism. Pipe degradations and failures are location-dependent. As examples,
in IGSCC-susceptible piping the cracking or leaks develop in welds and weld-HAZ, and in
piping susceptible to erosion-corrosion the wall thinning, leak or ruptures develop in the
base metal. Table 21 summarizes the failure frequency basis for some degradation and
failure mechanisms.

Table 21. Some Pipe Failure Frequency Bases

Degradation / Failure Mechanism Failure Frequency Comment
Basis
Corrosion (COR) 1/pipe-length.yr
Boric acid corrosion cracking (B/A-CC) 1/# fittings.yr or B/A-CC could develop in base metal
1/pipe-length.yr due to stagnant process medium.
Therefore, the analysis should
consider determination of the number
of fittings, straight sections that
contain stagnant process medium.
Erosion-corrosion (E/C) 1/# fittings.yr or E/C typically develops in base metal,
1/pipe-length.yr and especially in elbows, tees
IGSCC / SCC 1/# welds.yr
TGSCC 1/# welds.yr TGSCC could develop in the base
1/# fittings.yr. metal; e.g., cold-bent pipe sections.
Pipe sections with pipe collars (in
pipe penetration areas) have been
known to be susceptible to TGSCC
Thermal fatigue (TF) 1/# welds.yr In PWRs, TF has occurred in FWS
welds
Vibrational fatigue (VF) 1/pipe-length.yr
Water hammer (WH)

5.4 Discussion

A verification of the different analysis steps in the proposed analysis framework requires
more extensive ‘numerical experimentation.’ Selection of reliability attributes and pipe
failure frequencies, respectively, is critical to plant-specific applications. Data
interpretations and data reductions should recognize the requirements of an intended
application. Typically, operational data for small-diameter sample lines, drain lines, test
lines do not apply to process piping, or vice versa.

Consistency in applications must be ensured through critical reviews of the

operational data being considered. Equally important, any generic data included with the
Framework must be qualified, and justifications or caveats clearly stated. The effects on
parameter estimation by different data pooling strategies should be explored.

The service experience highlights the complex nature of piping reliability

management. Despite the lessons from past incidents, new incidents occur with similar
‘failure signatures’ as events which occurred in the 1970s or 1980s. Anticipated
applications of the ‘PFCA’ Framework include estimation of LOCA frequency and
internal flooding initiating event frequency. Old experience data should not be dismissed

SKI Report 97:26 (3rd Edition) 77

simply because they are ‘old,’ however. The analysis framework encourages critical
evaluations and applications of the entire database as long as statistical uncertainties are
considered. The current database includes information on failures in LOCA-sensitive
piping of ‘industrial grade’ (IG) and ‘nuclear grade’ (NG) stainless steels. The evaluation
of IGSCC data is difficult. The quality of construction, installation, operations and
inservice inspection together with the unique features of a given piping system design
(e.g., number of welds, overall layout and accessibility) tend to be as important than an
attribute such as material. Against this background, a rigorous application of the ‘PFCA’
Framework should be very useful in determining the relative merits of different piping
system design solutions.

5.5 References

(5-1). Nyman, R. et al, 1996. Reliability of Piping System Components. Volume 2: PSA
LOCA Database - Review of Methods for LOCA Evaluation Since the WASH-1400, SKI
Report 95:59, Swedish Nuclear Power Inspectorate, Stockholm (Sweden).

(5-2). Nyman, R. et al, 1996. Reliability of Piping System Components. Volume 1: Piping
Reliability - A Resource Document for PSA Applications, SKI Report 95:58, Swedish
Nuclear Power Inspectorate, Stockholm (Sweden).

(5-3) Simola, K. And K. Koski, 1997. A Survey of Probabilistic Methods for Evaluation
of Structural Component Reliability, TAU-7007/97, VTT Automation, Technical Research
Centre of Finland, Espoo (Finland).

(5-4). Bush, S.H. and A.D. Chockie, 1996. Failure Frequencies and Probabilities
Applicable to BWR and PWR Piping, SKI Report 96:39, Swedish Nuclear Power
Inspectorate, Stockholm (Sweden).

(5-5) Harris, D.O., D.D. Dedhia and S.C. Lu, 1992. Theoretical and User’s Manual for
PC-PRAISE. A Probabilistic Fracture Mechanics Computer Code for Piping Reliability
Analysis, UCRL-ID-109798 (NUREG/CR-5864), Lawrence Livermore National
Laboratory, Livermore (CA).

(5-6) Holman, G.S. and C.K. Chou, 1985. Probability of Pipe Failure in the Reactor
Coolant Loop of Westinghouse PWR Plant. Volume 1: Summary Report, UCID-19988
(NUREG/CR-3660), Lawrence Livermore National Laboratory, Livermore (CA).

(5-7) Mosleh, A., 1986. “Hidden Sources of Uncertainty: Judgment in Collection and
Analysis of Failure Data,” Nuclear Engineering and Design, 93:187-198.

(5-8) Martz, H.F. and R.A. Waller, 1982. Bayesian Reliability Analysis, John Wiley &
Sons, New York (NY), ISBN 0-471-86425-0.

SKI Report 97:26 (3rd Edition) 78

 6

SUMMARY & RECOMMENDATIONS

The R&D project by the Swedish Nuclear Power Inspectorate (SKI) was initiated in 1994
to establish a systematic approach to piping reliability analysis. This R&D emphasized two
difficult areas in piping reliability analysis: 1) the coverage and completeness of the
reporting of piping failures; and 2) parameter estimation in the absence of data on the
‘sample size’ of piping systems in NPPs. Results of SKI’s R&D include a large database
on piping failures in NPPs worldwide, and an analysis framework for interpreting failure
data and estimating failure parameters. Further work is needed to fully exploit and explore
the operational data, however. Similarly, pilot applications of the analysis framework
should be pursued to develop a streamlined analysis procedure.

6.1 Overview of the Technical Approach

Central to the R&D was the development of an event-based, relational database on piping
failures. Insights and results from exploring the operational data were used to develop a
framework for estimating plant-specific failure parameters. There are major sources of
uncertainties in the reliability parameter estimation. Therefore, the ultimate objective of the
analysis framework was to establish a structured approach to data qualification.

An important aspect of data qualification consists of understanding the database

content, including its coverage and completeness. Section 3 summarized technical and
plant safety management considerations affecting the development of a database on pipe
failure events. The reporting of pipe failures varies immensely from detailed root cause
analysis reports, which address the conditional factors of failure, to brief summary reports,
which require further interpretation and analysis.

The assessment of reliability of piping system components is difficult. Reasons for

this difficulty include the inconsistent reporting of failures, and the lack of population data
(e.g., sample size). The inconsistent reporting reflects the complex nature of piping
reliability. Quality data on the sample size (measured in number of components times an
appropriate time-unit) is lacking in a considerable way. Therefore, the R&D emphasized
the value of analyzing the conditional factors of reliability. The effects of reliability
attributes and influence factors must be evaluated before representative, absolute reliability
parameter estimates can be produced.

The coverage and completeness of data are important to the development of a

database on piping failures. For the SLAP database, numerous primary and secondary
information sources were utilized to ensure reasonable coverage and completeness within
the scope of the project. Spot-checks were performed to verify and validate the data
nominated for entry into the database. Estimation of data parameters is feasible assuming
that the database collection approach is clearly stated and that the data coverage is verified.

SKI Report 97:26 (3rd Edition) 79

 In addition to meeting the needs of PSA applications, there are many potential
benefits of enhanced reporting practices. The content of the SLAP database points to the
recurrence of piping failures. The recurrences could be symptoms of insufficient feedback
of operating experience, but they also are symptoms of the complex nature of the
degradation and failure mechanisms. In the opinion of the authors of this report, a cost-
effective approach to piping reliability management is achieved through improved
reporting of degradation and failures.

Realistic parameter estimation based exclusively on fault counts and exposure

times is not feasible. Parameter estimation should be based on the thorough understanding
of the why-where-how of piping failures. In Section 4 the conditional factors of piping
reliability were defined in terms of attributes and influence factors. An attribute relates to
piping system design features as addressed by codes and standards and functional
requirements. An influence factor relates to the operating environment once a system has
been commissioned. An analysis format building on these conditional factors provides the
framework for deriving plant-specific piping reliability parameters.

The selection of a statistical analysis approach must reflect intended

application(s). In Section 4 we used Bayesian statistics to infer some insights about
reliability attributes. It must be understood that in the context of PSA the Bayesian
approach works quite well for the purpose of deriving point estimates with consideration
of uncertainties. A drawback of this approach is that it is insensitive to changes in the
service data. That is, the approach is not very useful for performing trend analysis or
other reliability-oriented applications. At this stage of the R&D there is no need for more
advanced Bayesian statistics, however. The techniques and tools of classical statistics
should be exploited when performing detailed evaluations of the service data. Piping
reliability is a complex topic.

Section 4 outlined important analysis considerations, which were included in the

analysis framework in Section 5. This framework constitutes the minimum analytical
requirements to be considered by modern PSA. The framework defined five analysis
steps. In this report the requirements for ‘base-line’ evaluations were presented. More
comprehensive evaluations would have to be done on the basis of detailed service data
collections like SLAP.

6.2 Recommendations for Further Work

Many operating nuclear power plants are undergoing renovation and modernization as
part of the plant life extension projects. In some cases, the renovation activities are
directed at improving the primary system piping reliability by incorporating detailed
considerations of the current state-of-knowledge about degradation and failure
mechanisms and structural reliability. Increasingly, PSA applications are performed (or
are being considered) to evaluate the effects the modified primary system piping designs
could have on plant risk. Also, PSA applications are performed to support the definition
of enhanced strategies for in-service inspection (ISI) objectives or targets and with these
applications follow unique parameter estimation considerations.

SKI Report 97:26 (3rd Edition) 80

 SKI’s R&D project is one step in the development of a comprehensive database on
the operating experience with piping systems. Further work is required to improve the
database coverage and completeness. The R&D also demonstrated a simple approach to
parameter estimation, and developed a framework for qualifying these parameter
estimates. The project team strongly recommends that future efforts to improve the
database and the statistical analysis should be pursued within the international cooperative
nuclear safety research programs. Examples of areas to pursue further include:

(1) Pilot applications of the PFCA Framework. Improvements to the proposed

analysis framework should be pursued through pilot applications in two phases:
1) limited-scope applications within the framework of current Swedish regulatory
research, or Nordic research; and 2) broader scope applications within
international cooperative research programs (e.g.; risk-based ISI).

(2) Detailed statistical analysis of the service data using techniques from design of
experiments (DOE). Special consideration should be directed at the influence
factors.

(3) Development of piping system component population data. While a time-

consuming task, tabulations of population data for different plant design
generations and plant systems would enable more streamlined parameter
estimation.

SKI Report 97:26 (3rd Edition) 81

 APPENDIX A

SOURCES OF DATA ON PIPING FAILURES

Developed mainly from public domain data sources, SLAP is an event-based, relational
data collection on piping failures in commercial nuclear power plants, worldwide. The
primary data sources for developing the current version of the database included Swedish
and U.S. licensee event reporting (LER) systems and the NEA/IAEA Incident Reporting
System (IRS). Proprietary data on piping failures plus several secondary data sources
enabled consideration of the completeness and coverage of the SLAP database.
Summarized in this appendix are examples of data search strategies for the database
development.

A.1 Data Search Strategies

No dedicated reporting system exists for piping failures. Therefore, failure rates based on
operational data must be derived from counts of piping failures together with information
on the conditional factors of failures as addressed by existing multi-purpose reporting and
data management systems; c.f. Figure A-1. There is no one way of extracting relevant
failure information from the public domain sources. The information that makes its way
from plant work order requests, inspection reports, significant event reports, trip reports,
etc. into central repositories for operational data is filtered according to different criteria.

NEA/IAEA Incident
Reporting System (IRS)
SLAP Database

Data 'filter'
(nominated events)

Equipment Reliability
Licensee Event Reports Special Incident Reports
Database; e.g., TUD-System

Data filters - different

reporting criteria

Maintenance Inspection and Equipment Control Room

Work Orders
Files / Reports Test Reports Histories Log Books

Figure A-1: The Sources of Piping Failure Information

The LER systems cover events deemed significant enough to require notification
based on actual or implied safety impact. Technical specification limits for primary system
leakage constitute examples of criteria for licensee event reporting. Equipment reliability

SKI Report 97:26 (3rd Edition) 82

data management systems, like the Swedish TUD-System[A-1] and the EPIX System in the
U.S, include events that have been selected on the basis of functional definitions of failure.
While there are overlaps between different national systems, there also are omissions and
errors in recorded data. In deriving information on piping failures, a fundamental question
relates to the completeness and coverage of the selected information sources. No
individual information source provides full data coverage. The information sources
identified in Figure A-1 are multipurpose reporting systems. Events that appear in LER
systems may or may not appear in equipment reliability databases, and vice versa.

LER systems include significant reactor coolant pressure boundary leaks (RCPB),
which occur during routine power operation; e.g., leak rates > 0.1 kg/s[A-2]. The reporting
of RCPB leaks is a function of the detectability of leaks, and when and how leaks are
detected. Should an RCPB leak be discovered during a plant outage and after removal of
piping insulation, that information on degradation or failure may become embedded in
outage inspection reports. Some piping failures are under-reported; e.g., piping failures in
balance-of-plant (BOP) systems. Inconsistent reporting requirements and failure
definitions for piping degradation and failures influence the reporting. While an objective
assessment of database coverage and completeness is difficult or impossible, relative
measures of coverage and completeness result from comparative, iterative, overlapping
and complementary data search strategies.

As an example of a comparative search, for events in U.S. plants the primary data
source was the LER abstracts[A-3] combined with full-text LERs requested via the U.S.
NRC Public Document Room (PDR) and Preliminary Notifications of Unusual
Occurrences or Events (PNOs). Key words for these three information resources were
‘pipe failure’, ‘leak’, ‘severance’, ‘rupture’ and ‘crack indication.’ Next, the Nuclear
Power Experience (NPE) was searched manually using ‘piping’ as keyword for finding
failures in BWR and PWR plant systems. A new, consolidated master data file resulted
from comparisons of the results from the two data searches.

In addition to the U.S. LERs, piping failure event summaries appear in Information
Bulletins and Information Notices (c.f., Table A-1) issued by NRC’s Office of Nuclear
Reactor Regulation (NRR), Special Study Reports (e.g., AEOD/E308[A-4], AEOD/E4 16[A-
5]
and AEOD/S902[A-6]) prepared by NRC’s Office for Analysis and Evaluation of
Operational Data (AEOD), Power Reactor Events[A-7] by AEOD, and other special study
reports published in the NUREG or NUREG/CR series (e.g., NUREG-0531[A-8], NUREG-
0679[A-9], NUREG-0691[A-10], NUREG/CR-2781[A-11], NUREG/CR-5156[A-12]). Iterative
surveys and searches of the four groups of NRC information sources verified the relative
coverage of the initial comparative searches.

Examples of overlapping information sources include NRC’s monthly NUREG-

0020 series[A-13] and IAEA’s annual Operating Experience With Nuclear Power Stations in
Member States. The former includes monthly summaries of operating data (e.g., load
reductions, manual and automatic reactor and turbine trips, equipment failures). Similarly,
the IAEA-source includes operating data for plants worldwide. For U.S. plants, selected
data from NUREG-0020 are entered into the IAEA data collection.

SKI Report 97:26 (3rd Edition) 83

Table A-1. Selected U.S. NRC Information Notices / Bulletins on Piping Degradation &
Failures (Sheet 1-of-3)
U.S. NRC INFORMATION DOCUMENT TITLE SLAP Event IDs /
NOTICE / BULLETIN NO. NOTE(s)
74-10 (September 18, 1974) Failures in 4-Inch Bypass Piping at Dresden-2 1736, 1758

75-01 (January 31, 1975) Through-Wall Cracks in Core Spray Piping at 623, 2794
Dresden-2

76-04 (March 30, 1976) Cracks in Cold Worked Piping at BWRs 560, 566, 1342, 2061

76-06 (November 22, 1976) Stress Corrosion Cracks in Stagnant, Low Pressure 1218, 1518
Stainless Piping Containing Boric Acid Solution at
PWRs

79-03 (March 12, 1979) Longitudinal Weld Defects in ASME SA-312, Type Generic communication
304 Stainless Steel

79-13 (June 25, 1979) Cracking in Feedwater System Piping 466, 2123, 2795

79-19 (July 17, 1979) Pipe Cracks in Stagnant Borated Water Systems at Generic communication
PWR Plants

81-04 (February 27, 1981) Cracking in Main Steam Lines Surry-1 (<20% TWC)

82-02 (June 2, 1982) Degradation of Threaded Fasteners in the Reactor Generic communication
Coolant Pressure Boundary of PWR Plants

82-03 (October 14, 1982) Stress Corrosion Cracking in Thick-Wall, Large- 437
Diameter, Stainless Steel, Recirculation System
Piping at BWR Plants

82-09 (March 31, 1982) Cracking in Piping of Makeup Coolant Lines at 551, 2739
B&W Plants

82-17 (June 11, 1982) Overpressurization of Reactor Coolant System Generic communication

82-22 (July 9, 1982) Failures in Turbine Exhaust Lines 500

82-39 (September 21, 1982) Service Degradation of Thick Wall Stainless Steel 437
Recirculation System Piping at a BWR Plant

83-02 (March 4, 1983) Stress Corrosion Cracking in Large-Diameter 437

Stainless Steel Recirculation System Piping at
BWR Plants

84-18 (March 7, 1984) Stress Corrosion Cracking in Pressurized Water 2113

Reactors

84-41 (June 1, 1984) IGSCC in BWR Plants 2401

85-34 (April 30, 1985 Heat Tracing Contributes to Corrosion Failure of 1707
Stainless Steel Piping

85-76 (September 19, 1985) Recent Water Hammer Events Generic communication

85-99 (December 31, 1985) Cracking in Boiling-Water-Reactor Mark I and 610

Mark II Containments Caused by Failure of the
Inerting System

86-106 (December 16, 1986) Feedwater Line Break 595

SKI Report 97:26 (3rd Edition) 84

Table A-1. Selected U.S. NRC Information Notices / Bulletins on Piping Degradation &
Failures (Sheet 2-of-3)
U.S. NRC INFORMATION DOCUMENT TITLE SLAP Event IDs /
NOTICE / BULLETIN NO. NOTE(s)
86-108 (December 29, 1986 Degradation of Reactor Coolant System Pressure 949
Boundary Resulting from Boric Acid Corrosion

87-36 (August 4, 1987) Significant Unexpected Erosion of Feedwater Lines Generic communication

88-01 (January 27, 1988) Safety Injection Pipe Failure 616

88-08 (June 22, 1988) Thermal Stresses in Piping Connected to Reactor 14, 616
Coolant Systems

88-09 (July 26, 1988) Thimble Tube Thinning in Westinghouse Reactors Generic communication

88-11 (December 20, 1988) Pressurizer Surge Line Thermal Stratification Generic communication
re. pipe movement

88-17 (April 22, 1988) Summary of Responses to NRC Bulletin 87-01. 595, 2410
Thinning of Pipe Walls in Nuclear Power Plants#(a)

89-07 (January 25, 1989) Failures of Small-Diameter Tubing in Control Air, 405, 426, 972, 2315,
Fuel Oil, and Lube Oil Systems Which Render 2819, 2820
Emergency Diesel Generators Inoperable

89-53 (June 13, 1989) Rupture of Extraction Steam Line on High Pressure 445
Turbine

91-05 (January 30, 1991) Intergranular Stress Corrosion Cracking in 1734, 2116
Pressurized Water Reactor Safety Injection
Accumulator Nozzles

91-38 (June 13, 1991) Thermal Stratification in Feedwater System Piping Beaver Valley-1; global
stratification(b)

91-18 (March 12, 1991) High-Energy Piping Failures Caused by Wall 498, 534
Thinning

92-15 (February 24, 1992) Failure of Primary System Compression Fitting 1373

92-35 (May 6, 1992) Higher Than Predicted Erosion/Corrosion in 614

Unisolable Reactor Coolant Pressure Boundary
Piping Inside Containment at a Boiling Water
Reactor

93-20 (March 24, 1993) Thermal Fatigue Cracking of Feedwater Piping to 470, 615
Steam Generators

94-38 (May 27, 1994) Results of a Special NRC Inspection at Dresden Freeze damage to system
Nuclear Power Station Unit 1 Following a Rupture in decommissioned unit.
of Service Water Inside Containment

Notes: (a). This Information Notice reports 34 events involving pipe wall thinning in feedwater-condensate
systems during the period June 1967 - June 1986.
(b). No failure reported. Global stratification over a long stretch of horizontal feedwater system
piping inside containment.

SKI Report 97:26 (3rd Edition) 85

Table A-1. Selected U.S. NRC Information Notices / Bulletins on Piping Degradation &
Failures (Sheet 3-of-3)
U.S. NRC INFORMATION DOCUMENT TITLE SLAP Event IDs /
NOTICE / BULLETIN NO. NOTE(s)
95-11 (February 24, 1995) Failure of Condensate Piping Because of 863
Erosion/Corrosion at a Flow-Straightening Device

97-19 (April 18, 1997) Safety Injection System Weld Flaw at Sequoyah 1226
Nuclear Power Plant, Unit 2

97-46 (July 9, 1997) Unisolable Crack in High-Pressure Injection Piping 2781

Examples of complementary information sources include the U.S. LER-system and

the Institute of Nuclear Power Operations (INPO) Nuclear Network, which includes event-
based summaries of operating experience (e.g., Significant Operating Experience Reports -
SOERs). For SLAP, a search in Nuclear Network for piping failures was facilitated by
Kärnkraftsäkerhet och Utbildning AB (KSU)[A-14,15]. This search yielded failure events for
which no LERs existed.

A.2 Coverage and Completeness Issues

Throughout the SLAP database development, diverse information sources were used to
verify the coverage, accuracy and completeness of data. In many cases at least two data
sources were utilized to substantiate the accuracy and completeness of failure information,
and in some cases up to five sources were used. The difficulty in assessing the coverage
and completeness of piping failure data is compounded by factors such as:

- Some failures of the non-catastrophic kind are not reported at all. No forced plant
shutdown; repairs are done with turbine-generator connected to grid.

- Isolateable failures in BOP-systems which do not impose safety hazards or affect

plant operations negatively are repaired without delays. Beyond work order
requests, and depending on the exact circumstances of the failures, formal written
input may or may not be submitted to a LER system or equipment reliability
database.

- Despite the regulatory reporting requirements, there exists discretionary reporting

of incipient or degraded failures. Beyond specific requirements defined in plant-
specific technical specifications, the exact circumstances and implications of a
given failure ultimately determine the reporting.

- Many piping failures are revealed during refueling or maintenance outages, and the
results of NDE/ISI may only be included in outage inspection reports.

- Licensee event report formats do not include data fields or key words specific to
degradation and failure mechanisms affecting piping systems. As a consequence,
computerized data searches may not identify flaws/cracks, leaks or ruptures
involving piping systems.

SKI Report 97:26 (3rd Edition) 86

 In designing the SLAP database structure, the coverage and completeness were
accounted for by including the following three basic types of database fields; c.f. SKI
(1995)[A-16]:

(1) Reliability Attribute Field. Using a set of key words, each failure report was
classified according to reliability attributes. In the context of piping reliability, an
attribute represents the inherent reliability as determined and realized by applying
recognized design codes and standards. This means that the inherent reliability
cannot be changed without changing the original design; e.g., increasing the
diameter and wall thickness, changing the metallurgy throughout the system from
high carbon content stainless steel to low carbon content stainless steel, etc.
Information entered into a reliability attribute field is used to facilitate data
reduction and data analysis. Examples of attributes include metallurgy,
diameter/wall thickness (piping schedule), geometry.

(2) Reliability Influence Field. An influence addresses the operating environment and
how it affects (or could affect) the as-designed and installed piping system.
Reliability management is directed at the influence factors and reliability
improvement/growth can be accomplished through changes to the operating
environment. Information entered into a reliability influence field is used to
facilitate data reduction and analysis. Examples of reliability influences include
water chemistry, steam quality, method of fabrication and installation, NDE/ISI.

(3) Background Information Field. The information in this field supports the
identification and classification of attributes and influences. Some failure reports
include explicit information on attributes and influences. In most cases, the
attributes and influences are extracted or inferred from the background
information, which mostly is in the form of event narratives and descriptions of
corrective actions. The narrative describes the conditions prior to, at the time of,
and immediately after failure, together with details on the plant response and the
affected systems.

A.3 Piping System Component Exposures

Cumulative worldwide operating experience from nuclear power plants at the end of 1997
is well over 9,000 reactor-years. Based on data reported to the International Atomic
Energy Agency (IAEA) Power Reactor Information System (PRIS), a total of 442 nuclear
power plants were operating around the world in 1997. The SLAP database currently
includes service data from 274 plants representing approximately 4,700 reactor-years of
operating experience. In the past, efforts to develop rupture frequencies from service data
mostly have used the number of reactor years as a basis for estimating an exposure time.

An estimation of piping system exposure times solely based on reactor-years of

operating experience would include a large uncertainty, however. For reasons stated above
and in Section 3, the coverage and completeness of the data collection strongly influences
the estimation of exposure times. Furthermore, the analysis steps of the PFCA Framework
should assist in determining how an exposure time is assessed; Table A-2.

SKI Report 97:26 (3rd Edition) 87

Table A-2. Examples of Piping System Exposure Times
Plant System / Degradation Mechanism Piping System Exposure Time
Small-diameter piping / tubing susceptible to Controlled by run-time of vibration source. As an
vibratory fatigue example, instrument lines on emergency diesel
generators have been known to fail during 24-
hour endurance runs
Intermediate- and large-diameter steam extraction Age of component socket, or better operating
piping time of plant.
Primary system piping susceptible to stress Age of component socket or number of plant
corrosion cracking transients. Consider an evaluation of time- and
demand-related failures

A.4 References & Notes

(A-1) Nyman, R. et al, 1995. The T-Book Seminar 1995-01-27 in Stockholm, SKI/RA-
01/95, Swedish Nuclear Power Inspectorate, Stockholm (Sweden).

(A-2) Technical specification governing a facility operation requires that certain leak
detection systems be functioning during operation and impose limits on the amount of
leakage that may be permitted. When these conditions cannot be met, timely remedial
measures are required. The exact limits vary depending on presence of IGSCC-susceptible
piping materials. As an example, for older plants not designed to meet LBB criteria, plant
shutdown should be initiated for inspection and corrective action when the leak detection
system indicated, within a period of four hours or less, an increase in the rate of
unidentified leakage in excess of 0.13 kg/s (2 gpm), or when the total unidentified leakage
attains a rate of 0.32 kg/s (5 gpm), whichever occurs first.

(A-3) U.S. Nuclear Regulatory Commission. Licensee Event Report (LER) Compilation,
NUREG/CR-2000, Washington (DC) [Monthly summaries of LER abstracts].

(A-4) Brown, E.J., 1983. Engineering Evaluation Report on Cracks and Leaks in Small
Diameter Piping, AEOD/E308, Office for Analysis and Evaluation of Operational Data,
U.S. Nuclear Regulatory Commission, Washington (DC).

(A-5) Brown, E.J., 1984. Erosion in Nuclear Power Plants, AEOD/E4 16, Office for
Analysis and Evaluation of Operational Data, U.S. Nuclear Regulatory Commission,
Washington (DC).

(A-6) Su, N.T., 1990. Review of Thermal Stratification Operating Experience,

AEOD/S902, Office for Analysis and Evaluation of Operational Data, U.S. Nuclear
Regulatory Commission, Washington (DC).

(A-7) “Power Reactor Events” used to be a bimonthly newsletter that compiles operating
experience information about commercial nuclear power plants. This includes summaries
of noteworthy events and listings and/or abstracts of U.S. NRC and other documents that
discuss safety-related or possible generic issues.

SKI Report 97:26 (3rd Edition) 88

(A-8) Pipe Crack Study Group, 1979. Investigation and Evaluation of Stress-Corrosion
Cracking in Piping of Light Water Reactor Plants, NUREG-0531, U.S. Nuclear
Regulatory Commission, Washington (DC).

(A-9) Frank, L. et al, 1980. Pipe Cracking Experience in Light-Water Reactors, NUREG-
0679, U.S. Nuclear Regulatory Commission, Washington (DC).

(A-10) PWR Pipe Crack Study Group, 1980. Investigation and Evaluation of Cracking
Incidents in Piping in Pressurized Water Reactors, NUREG-0691, U.S. Nuclear
Regulatory Commission, Washington (DC).

(A-11) Uffer, R.A. et al, 1982. Evaluation of Water Hammer Events in Light Water
Reactor Plants, NUREG/CR-2781, U.S. Nuclear Regulatory Commission, Washington
(DC).

(A-12) Cragnolino, G., C. Czajkowski and W.J. Shack, 1988. Review of Erosion Corrosion
in Single Phase Flows, NUREG/CR-5136, U.S. Nuclear Regulatory Commission,
Washington (DC).

(A-13) U.S. Nuclear Regulatory Commission. Licensed Operating Reactors Status

Summary Report, NUREG-0020, Washington (DC) (Published monthy).

(A-14) Svensson, P., 1994. Survey of NUCLEAR NETWORK for Failures in Nuclear
Power Plant Piping Systems, KSU-S 171, Kärnkraftsäkerhet och Utbildning AB, Studsvik
(Sweden).

(A-15) KSU is the utility owned Nuclear Training and Safety Center in Sweden. The
Swedish utilities are members of INPO via KSU. Regarding NUCLEAR NETWORK, the
INPO SEE-IN Program Information less than 5 years old is proprietary to the INPO
member organizations.

(A-16) Swedish Nuclear Power Inspectorate, 1996. Reliability of Piping System

Components. Volume 4: The Pipe Failure Event Database, SKI Report 95:61, Stockholm
(Sweden).

SKI Report 97:26 (3rd Edition) 89

 APPENDIX B

RAW DATA SUMMARIES: PIPING SYSTEM

OPERATING EXPERIENCE IN NPPs WORLDWIDE

This appendix includes a summary of the SLAP database content as of October 1997. The
database content is organized in five groups by nominal diameter (DN):

- ≤ DN25 (≤ NPS1)
- 25 < DN ≤ 50 (1 < NPS ≤ 2)
- 50 < DN ≤ 100 (2 < NPS ≤ 4)
- 100 < DN ≤ 250 (4 < NPS ≤ 10)
- > DN250 (> NPS10)

For each pipe size group, the experience data are summarized in three (3) tables
addressing the effect and influence of different degradation and failure mechanisms,
material and process media. The following broad groups of piping systems are addressed
in the raw data summaries:

- Balance of Plant (BOP); e.g., main steam, feedwater, condensate and moisture
separator reheat systems, steam extraction lines (mainly non-Code class systems).
The systems in this group tend to be included in augmented inspection programs
for flow accelerated corrosion (FAC; see Appendix C)

- Fire Protection System (FPS). Increasingly, this system is subject to volumetric

inspection programs (e.g., ultrasonic testing).

- LOCA Sensitive Piping (LSP); the piping systems that contain the reactor coolant
(ASME Code Class 1 piping). In the data summaries below, the ‘RCPB’ category
also includes the ASME Code Class 2 piping systems located inside containment;
i.e., piping systems connected to the reactor coolant system. The systems in this
group are subject to ASME Section XI (or equivalent) ISI programs.

- Auxiliary Cooling Water Systems (AUXC); this group includes Code Class 3 and
non-Code Class service water systems (raw water systems).

A given system can belong to more than one group, however. As noted in Sections
3 through 5 of this report, the grouping (i.e., pooling of data) should reflect a stated
application. The data summaries in this appendix represent the SLAP database content as
of October 1997 (SLAP Version 7.7).19 Each database application includes unique data
processing requirements. Note that the tabulations in this appendix excludes failures
involving closed-loop cooling piping (e.g., Component Cooling Water System, Spent Fuel
Pool Cooling Water System), and instrument air piping.

19
In this 3rd Edition of SKI 97:26, for the period 1972-1997 all tabulations have been updated with information from the current (12-31-
2004), proprietary version of the database. In each table, the updated information is included in parentheses. Figure B-1 is a summary of
the evolution of the PIPExp database.

SKI Report 97:26 (3rd Edition) 90

Table B.1-1. Summary of Failures in ≤ DN25 Piping
Failure Mode
System Category Crack Leak Rupture
Balance of Plant 3 (24) 156 (220) 29 (16)
Fire Protection System 0 (0) 6 (11) 1 (2)
LOCA Sensitive Piping 13 (41) 500 (627) 21 (28)
Auxiliary Cooling Water Systems 0 (3) 98 (134) 2 (6)
Totals: 16 (68) 760 (992) 53 (52)

Table B.1-2. Summary of Failures in Piping of 25 < DN ≤ 50

Failure Mode
System Group Crack Leak Rupture
Balance of Plant 2 (4) 64 (77) 14 (16)
Fire Protection System 0 (0) 9 (5) 4 (2)
LOCA Sensitive Piping 20 (65) 124 (163) 5 (4)
Auxiliary Cooling Water Systems 1 (1) 34 (88) 1 (0)
Totals: 23 (70) 231 (333) 24 (22)

Table B.1-3. Summary of Failures in Piping of 50 < DN ≤ 100

Failure Mode
System Group Crack Leak Rupture
Balance of Plant 4 (9) 59 (67) 15 (12)
Fire Protection System 0 (0) 4 (8) 2 (1)
LOCA Sensitive Piping 23 (182) 101 (117) 4 (4)
Auxiliary Cooling Water Systems 2 (6) 62 (92) 1 (0)
Totals: 29 (197) 226 (284) 22 (17)

Table B.1-4. Summary of Failures in [100 < DN ≤ 250] Piping

Failure Mode
System Group Crack Leak Rupture
Balance of Plant 12 (32) 101 (116) 32 (37)
Fire Protection System 0 (2) 8 (26) 3 (3)
LOCA Sensitive Piping 70 (344) 146 (130) 3 (3)
Auxiliary Cooling Water Systems 1 (19) 34 (77) 2 (1)
Totals: 83 (397) 289 (349) 40 (44)

Table B.1-5. Summary of Failures in Piping of DN > 250

Failure Mode
System Group Crack Leak Rupture
Balance of Plant 34 (61) 63 (59) 29 (25)
Fire Protection System 0 (0) 0 (6) 3 (9)
LOCA Sensitive Piping 106 (600) 44 (82) 0 (0)
Auxiliary Cooling Water Systems 0 (16) 23 (85) 2 (0)
Totals: 140 (677) 130 (232) 34 (34)

SKI Report 97:26 (3rd Edition) 91

 Table B.2-1. Event Count by Calendar Year (≤ DN25 Piping)
Failure Mode Calendar Year
(DB Version) 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 Σ
Crack (as of 12-31-1997) 0 0 0 0 0 0 0 5 1 0 1 1 1 9
(as of 12-31-2004) (0) (0) (0) (0) (0) () (2) (6) (2) (0) (4) (4) (3) (21)
Leak (as of 12-31-1997) 3 16 32 53 45 40 37 36 30 48 63 54 27 484
(12-31-2004) (2) (10) (21) (38) (46) (40) (42) (52) (50) (55) (73) (60) (32 (521)
Rupture (as of 12-31-1997) 2 0 2 3 3 3 0 2 3 1 1 2 1 23
(as of 12-31-2004) (1) (0) (3) (3) (4) (3) (2) (2) (2) (1) (1) (2) (2) (26)
Failure Mode Calendar Year
(DB Version) 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 Σ
Crack (as of 12-31-1997) 0 0 1 0 0 3 0 0 4 0 0 0 0 8
(as of 12-31-2004) (2) (2) (6) (7) (3) (5) (3) (4) (5) (2) (3) (5) (0) (47)
Leak (as of 12-31-1997)) 15 16 32 22 24 27 30 19 28 20 20 12 16 281
(as of 12-31-2004) (33) (27) (52) (42) (30) (45) (40) (32) (41) (23) (37) (31) (32) (465)
Rupture (as of 12-31-1997) 1 3 4 4 3 1 4 1 0 0 7 1 2 31
(as of 12-31-2004) (3) (8) (6) (7) (2) (2) (3) (2) (0) (0) (7) (5) (3) (49)
Table B.2-2. Event Count by Calendar Year (25 < DN ≤ 50 Piping)
Failure Mode Calendar Year
(DB Version) 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 Σ
Crack (as of 12-31-1997) 0 0 1 1 0 2 0 1 0 3 1 2 1 12
(as of 12-31-2004) (0) (0) (1) (1) (1) (2) (0) (1) (0) (6) (2) (3) (3) (20)
Leak (as of 12-31-1997) 2 4 15 6 14 10 10 9 11 14 19 23 11 148
(12-31-2004) (1) (4) (8) (5) (16) (7) (10) (20) (11) (13) (21) (20) (8) (144)
Rupture (as of 12-31-1997) 0 1 1 0 0 1 1 0 2 0 0 2 2 11
(as of 12-31-2004) (0) (0) (0) (0) (0) (1) (2) (0) (0) (0) (0) (2) (1) (6)
Failure Mode Calendar Year
(DB Version) 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 Σ
Crack (as of 12-31-1997) 0 0 0 0 0 0 0 0 4 2 4 0 1 11
(as of 12-31-2004) (7) (0) (0) (21) (2) (0) (0) (0) (4) (2) (5) (3) (6) (50)
Leak (as of 12-31-1997)) 7 4 6 10 6 9 10 10 2 5 7 3 5 84
(as of 12-31-2004) (6) (5) (5) (13) (11) (14) (18) (16) (20) (14) (42) (9) (16) (189)
Rupture (as of 12-31-1997) 3 0 1 0 0 1 1 2 3 1 1 1 0 14
(as of 12-31-2004) (2) (0) (2) (0) (0) (0) (1) (1) (4) (1) (2) (2) (0) (15)

SKI Report 97:26 (3rd Edition) 92

 Table B.2-3. Event Count by Calendar Year (50 < DN ≤ 100 Piping)
Failure Mode Calendar Year
(DB Version) 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 Σ
Crack (as of 12-31-1997) 0 0 0 2 4 2 43 1 1 0 1 1 10 17
(as of 12-31-2004) (0) (0) (3) (3) (4) (2) (12) (1) (5) (0) (8) (14) (6) (58)
Leak (as of 12-31-1997) 3 1 22 17 6 6 10 15 9 13 11 12 9 134
(12-31-2004) (2) (0) (12) (15) (7) (5) (11) (16) (10) (11) (10) (13) (13) (125)
Rupture (as of 12-31-1997) 3 1 0 1 2 1 0 0 0 1 0 1 1 11
(as of 12-31-2004) (3) (1) (0) (1) (1) (1) (0) (0) (0) (1) (0) (1) (0) (9)
Failure Mode Calendar Year
(DB Version) 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 Σ
Crack (as of 12-31-1997) 0 2 1 0 0 0 1 1 1 2 0 2 2 12
(as of 12-31-2004) (0) (65) (4) (1) (1) (2) (3) (6) (33) (10) (2) (7) (5) (139)
Leak (as of 12-31-1997) 6 7 10 7 3 15 10 9 2 9 5 5 3 91
(as of 12-31-2004) (4) (11) (9) (9) (6) (14) (23) (12) (15) (12) (10) (11) (20) (156)
Rupture (as of 12-31-1997) 0 0 3 1 0 2 1 1 1 2 0 0 0 11
(as of 12-31-2004) (0) (0) (1) (0) (1) (2) (1) (1) (1) (1) (0) (0) (0) (8)
Table B.2-4. Event Count by Calendar Year (100 < DN ≤ 250 Piping)
Failure Mode Calendar Year
(DB Version) 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 Σ
Crack (as of 12-31-1997) 0 0 0 1 1 2 2 5 2 0 5 7 7 32
(as of 12-31-2004) (0) (0) (0) (5) (1) (2) (3) (5) (29) (4) (26) (34) (42) (151)
Leak (as of 12-31-1997) 1 2 18 21 18 16 16 16 10 6 19 21 6 170
(as of 12-31-2004) (0) (0) (8) (18) (18) (10) (16) (14) (14) (6) (19) (22) (10) (155)
Rupture (as of 12-31-1997) 1 1 0 0 1 5 0 0 0 0 3 2 2 15
(as of 12-31-2004) (1) (1) (0) (0) (1) (3) (0) (0) (1) (0) (4) (3) (1) (15)
Failure Mode Calendar Year
(DB Version) 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 Σ
Crack (as of 12-31-1997) 1 6 2 0 3 2 3 0 3 1 6 17 7 51
(as of 12-31-2004) (17) (9) (14) (15) (9) (9) (19) (42) (42) (2) (13) (31) (24) (246)
Leak (as of 12-31-1997) 7 27 17 7 5 5 5 8 9 9 11 9 4 123
(as of 12-31-2004) (3) (26) (19) (12) (9) (13) (18) (10) (16) (9) (20) (23) (15) (178)
Rupture (as of 12-31-1997) 4 4 1 4 1 1 4 0 3 1 2 2 0 27
(as of 12-31-2004) (4) (4) (2) (3) (1) (2) (4) (1) (3) (1) (2) (1) (0) (28)

SKI Report 97:26 (3rd Edition) 93

 Table B.2-5. Event Count by Calendar Year (> DN250 Piping)
Failure Mode Calendar Year
(DB Version) 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 Σ
Crack (as of 12-31-1997) 0 0 0 0 2 1 0 6 6 0 13 43 5 76
(as of 12-31-2004) (1) (0) (0) (0) (3) (1) (3) (6) (7) (1) (22) (195) (77) (315)
Leak (as of 12-31-1997) 0 1 4 1 9 3 2 4 1 2 7 11 15 60
(12-31-2004) (0) (1) (4) (0) (9) (4) (3) (5) (1) (3) (16) (7) (14) (67)
Rupture (as of 12-31-1997) 2 1 1 0 0 0 0 0 1 2 4 2 3 16
(as of 12-31-2002) (0) (1) (1) (0) (0) (0) (0) (0) (1) (1) (3) (2) (4) (13)
Failure Mode Calendar Year
(DB Version) 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 Σ
Crack (as of 12-31-1997) 23 0 5 2 0 11 2 9 1 2 3 2 4 64
(as of 12-31-2004) (67) (47) (25) (12) (12) (41) (28) (19) (5) (5) (19) (14) (67) (361)
Leak (as of 12-31-1997) 9 8 9 1 7 9 7 8 4 4 2 0 2 70
(as of 12-31-2004) (13) (24) (15) (11) (8) (16) (16) (13) (16) (8) (5) (3) (17) (165)
Rupture (as of 12-31-1997) 2 2 2 0 4 1 2 0 1 0 0 1 1 16
(as of 12-31-2004) (2) (2) (3) (0) (3) (1) (2) (1) (1) (0) (1) (3) (2) (21)

Table B.3-1. Degradation and Failure Mechanisms in Piping ≤ DN25

Degradation & Failure Failure Mode
Mechanism System Group Crack Leak Rupture
Corrosion / Erosion- PCS 1 (1) 51 (66) 4 (4)
Corrosion / Fire Protection 0 (0) 4 (6) 1 (0)
Erosion-Cavitation LOCA Sensitive 0 (2) 21 (20) 0 (3)
Aux. Cooling Water 0 (0) 48 (63) 0 (0)
Corrosion-Fatigue / PCS 1 (14) 64 (116) 19 (26)
Vibration-Fatigue Fire Protection 0 (0) 1 (3) 0 (0)
LOCA Sensitive 5 (21) 284 (381) 11 (17)
Aux. Cooling Water 0 (2) 31 (56) 2 (5)
IGSCC / SCC / TGSCC PCS 0 (0) 3 (0) 0 (0)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 8 (13) 68 (98) 0 (0)
Aux. Cooling Water 0 (2) 0 (0) 0 (0)
Human Error / Design & PCS 0 (0) 14 (20) 2 (8)
Construction Error Fire Protection 0 (0) 0 (2) 0 (1)
LOCA Sensitive 0 (3) 88 (106) 4 (2)

SKI Report 97:26 (3rd Edition) 94

 Degradation & Failure Failure Mode
Mechanism System Group Crack Leak Rupture
Aux. Cooling Water 0 (0) 12 (11) 0 (0)
Thermal Fatigue PCS 0 (0) 3 (5) 2 (0)
(Thermal Cycling / Fire Protection 0 (0) 0 (0) 0 (0)
Stratification) LOCA Sensitive 0 (0) 9 (9) 0 (0)
Aux. Cooling Water 0 (0) 5 (3) 1 (2)
Other (includes PCS 1 (1) 21 (10) 2 (1)
‘unreported’, overloading, Fire Protection 0 (0) 1 (0) 0 (1)
water hammer) LOCA Sensitive 1 (2) 43 (13) 7 (6)
Aux. Cooling Water 0 (0) 6 (4) 0 (1)

Table B.3-2. Degradation and Failure Mechanisms in Piping 25 < DN ≤ 50

Degradation & Failure Failure Mode
Mechanisms System Group Crack Leak Rupture
Corrosion / Erosion- PCS 1 (2) 32 (45) 6 (5)
Corrosion / Fire Protection 0 (0) 4 (3) 0 (0)
Erosion-Cavitation LOCA Sensitive 0 (3) 7 (24) 1 (1)
Aux. Cooling Water 1 (1) 26 (75) 0 (0)
Corrosion-Fatigue / PCS 1 (2) 16 (21) 5 (5)
Vibration-Fatigue Fire Protection 0 (0) 1 (1) 0 (0)
LOCA Sensitive 1 (29) 57 (66) 2 (0)
Aux. Cooling Water 0 (0) 2 (14) 0 (2)
IGSCC / SCC / TGSCC PCS 0 (0) 0 (0) 0 (0)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 9 (15) 34 (36) 0 (0)
Aux. Cooling Water 0 (5) 0 (0) 0 (0)
Human Error / Design & PCS 0 (0) 6 (8) 1 (2)
Construction Error Fire Protection 0 (0) 2 (1) 2 (2)
LOCA Sensitive 0 (6) 16 (24) 1 (1)
Aux. Cooling Water 0 (0) 2 (3) 0 (0)
Thermal Fatigue PCS 0 (0) 4 (4) 0 (1)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 6 (4) 6 (8) 1 (0)
Aux. Cooling Water 0 (0) 0 (3) 0 (2)
Other (includes PCS 0 (0) 5 (2) 2 (3)
‘unreported’, overloading, Fire Protection 0 (0) 2 (0) 2 (2)
water hammer) LOCA Sensitive 4 (6) 5 (5) 1 (2)
Aux. Cooling Water 0 (0) 4 (6) 1 (0)

SKI Report 97:26 (3rd Edition) 95

Table B.3-3. Degradation and Failure Mechanisms in Piping 50 < DN ≤ 100.
Degradation & Failure Failure Mode
Mechanisms System Group Crack Leak Rupture
Corrosion / Erosion- PCS 2 (4) 27 (35) 7 (5)
Corrosion / Fire Protection 0 (0) 3 (6) 0 (0)
Erosion-Cavitation LOCA Sensitive 2 (12) 6 (5) 1 (1)
Aux. Cooling Water 1 (4) 45 (81) 0 (0)
Corrosion-Fatigue / PCS 1 (2) 6 (13) 1 (1)
Vibration-Fatigue Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 1 (4) 18 (18) 1 (1)
Aux. Cooling Water 1 (2) 3 (6) 0 (0)
IGSCC / SCC / TGSCC PCS 0 (0) 0 (0) 0 (0)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 18 (160) 55 (63) 0 (0)
Aux. Cooling Water 0 (1) 0 (0) 0 (0)
Human Error / Design & PCS 0 (0) 7 (5) 2 (1)
Construction Error Fire Protection 0 (0) 0 (2) 2 (1)
LOCA Sensitive 0 (4) 11 (13) 1 (1)
Aux. Cooling Water 0 (0) 8 (4) 0 (0)
Thermal Fatigue PCS 0 (2) 0 (13) 0 (1)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 2 (7) 5 (11) 0 (0)
Aux. Cooling Water 0 (0) 1 (0) 0 (0)
Other (includes PCS 1 (2) 16 (10) 5 (5)
‘unreported’, overloading, Fire Protection 0 (0) 1 (0) 0 (0)
water hammer) LOCA Sensitive 0 (1) 8 (7) 1 (1)
Aux. Cooling Water 0 (0) 5 (1) 1 (0)

Table B.3-4. Degradation and Failure Mechanisms in Piping 100 < DN ≤ 250
Degradation & Failure Failure Mode
Mechanisms System Group Crack Leak Rupture
Corrosion / Erosion- PCS 3 (17) 68 (85) 22 (28)
Corrosion / Fire Protection 0 (2) 0 (19) 1 (1)
Erosion-Cavitation LOCA Sensitive 0 (0) 0 (0) 0 (0)
Aux. Cooling Water 0 (16) 26 (70) 1 (0)
Corrosion-Fatigue / PCS 0 (0) 17 (17) 1 (2)
Vibration-Fatigue Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 1 (2) 22 (18) 1 (0)
Aux. Cooling Water 0 (1) 1 (0) 0 (0)
IGSCC / SCC / TGSCC PCS 0 (1) 0 (0) 0 (0)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 60 (302) 74 (69) 0 (0)
Aux. Cooling Water 0 (10) 0 (11) 0 (0)
Human Error / Design & PCS 0 (0) 6 (7) 1 (1)
Construction Error Fire Protection 0 (0) 0 (5) 1 (1)
LOCA Sensitive 0 (10) 19 (19) 0 (0)
Aux. Cooling Water 1 (1) 1 (5) 0 (0)
Thermal Fatigue PCS 5 (8) 0 (0) 0 (0)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 8 (18) 11 (10) 0 (1)
Aux. Cooling Water 0 (0) 1 (0) 0 (0)
Other (includes PCS 3 (3) 9 (6) 8 (6)
‘unreported’, overloading, Fire Protection 0 (0) 3 (2) 2 (1)
water hammer) LOCA Sensitive 1 (1) 13 (4) 1 (2)
Aux. Cooling Water 0 (0) 4 (2) 3 (1)

SKI Report 97:26 (3rd Edition) 96

Table B.3-5. Degradation and Failure Mechanisms in Piping DN > 250.
Degradation & Failure Affected Systems Failure Mode
Mechanisms System Group Crack Leak Rupture
Corrosion / Erosion- PCS 8 (41) 26 (31) 12 (13)
Corrosion / Fire Protection 0 (0) 0 (5) 1 (2)
Erosion-Cavitation LOCA Sensitive 0 (22) 0 (1) 0 (0)
Aux. Cooling Water 0 (15) 20 (80) 0 (0)
Corrosion-Fatigue / PCS 0 (1) 5 (6) 0 (0)
Vibration-Fatigue Fire Protection 0 (0) 0 (0) 0 (1)
LOCA Sensitive 1 (2) 3 (8) 0 (0)
Aux. Cooling Water 0 (0) 0 (1) 0 (0)
IGSCC / SCC / TGSCC PCS 0 (0) 0 (0) 0 (0)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 35 (535) 38 (61) 0 (0)
Aux. Cooling Water 0 (0) 0 (0) 0 (0)
Human Error / Design & PCS 2 (3) 6 (6) 4 (4)
Construction Error Fire Protection 0 (0) 0 (1) 2 (4)
LOCA Sensitive 4 (18) 1 (6) 0 (0)
Aux. Cooling Water 0 (0) 1 (2) 2 (0)
Thermal Fatigue PCS 16 (7) 8 (4) 0 (0)
Fire Protection 0 (0) 0 (0) 0 (0)
LOCA Sensitive 3 (19) 0 (3) 0 (0)
Aux. Cooling Water 0 (0) 5 (0) 1 (0)
Other (includes PCS 5 (9) 14 (14) 13 (11)
‘unreported’, overloading, Fire Protection 0 (0) 0 (0) 2 (2)
water hammer) LOCA Sensitive 3 (4) 2 (2) 1 (0)
Aux. Cooling Water 0 (1) 6 (3) 3 (0)

SKI Report 97:26 (3rd Edition) 97

 SKI R&D Project 1994-1998
• SOAR on piping reliability analysis as it relates to PSA (SKI Report 95:58)
• Basis for deriving pipe failure parameters from service data (SKI Report 97:26;
• SKI-PIPE (1998) pipe failure database (2291 records as of 12-31-1998)

PIPExp Database Project (1999 – to date) – independent of SKI

• Active maintenance program (weekly updates);
• QA program – extensive data validation;
• Practical applications & enhancements to db-structure

PIPExp-1999 (12-31-1999)
• 3417 db records

PIPExp-2000 (12-31-2000) OPDE Project (2002-2005)

• 3679 db records (pipe) • Based on SKI-PIPE (1998);
• Validation of selected records by National
PIPExp-2001 (12-31-2001) Coordinators;
• 3957 db records (pipe) • Harmonized db-structure;
• Coding Guideline / QA Program
PIPExp-2002 (12-31-2002)
• 4215 db records (pipe) OPDE-2003 (12-31-2003)
• 2427 db records
PIPExp-2003 (12-31-2003)
• 4437 db records (pipe) OPDE-2004 (12-31-2004)
• 2778 db records
PIPExp-2004 (12-31-2004)
• 4894 db records (pipe)
• 250 db records (non-pipe,
passive Code Class 1 & 2
components, excl. S/G
tube)
• 457 water hammer records
(w/o structural failure)

Figure B-1. Evolution of the PIPExp Database

SKI Report 97:26 (3rd Edition) 98

Table B-4. Piping Component Population Data (From NUREG/CR-440720
Approximate Length Approximate Number
NPP Type System of Piping [m] of Welds
PWR RCS 750 970
HPSI (50 ≤ DN < 150) 320 559
HPSI (> DN150) 110 (a)
LPSI (50 ≤ DN < 150) 52 122
LPSI (> DN150) 510 468
RHRS (50 ≤ DN < 150) 52 122
RHRS (> DN150) 510 468
CVCS (50 ≤ DN < 150) 950 928
CVCS (> DN150) 30 19
Main Steam 1800 2177
AFWS (50 ≤ DN < 150) 160 159
AFWS (> DN150) 30 48
MFWS 1770 1900
Condensate 2160 1500
CCWS (50 ≤ DN < 150) 260 504
CCWS (>DN150) 945 1155
ESWS (50 ≤ DN < 150) 328 1719
1183 710
ESWS (> DN150)
GE-BWR RCS (50 ≤ DN < 150) 6 96
RCS (> DN150) (a) 173
HPCI (50 ≤ DN < 150) 120 101
HPCI (> DN150) 750 401
RCIC (50 ≤ DN < 150) 85 49
RCIC (> DN150) 118 160
Core Spray (50 ≤ DN < 150) 22 51
Core Spray (> DN150) 178 205
RHRS (50 ≤ DN < 150) 393 215
RHRS (> DN150) 411 360
SLCS 18 39
Main Steam 420 214
MFWS (50 ≤ DN < 150) 309 51
MFWS (> DN150) 226 276
Condensate (50 ≤ DN < 150) 182 175
Condensate (> DN150) 307 433
RBCCWS (50 ≤ DN < 150) 609 608
RBCCWS (> DN150) 255 515

(a). Where no distinction is made between (50 ≤ DN < 150) and (> DN150) piping, one number represents
the average total length of piping or the average total number of welds in a system.

Note: The piping component population differs between plants. For a give type of system the population
count could differ by as much as an order of magnitude for.

20
Wright, R.E., J.A. Steverson and W.F. Zuroff, 1987. Pipe Break Frequency Estimation for Nuclear Power Plants, Appendix B, EGG-
2421 (NUREG/CR-4407), EG&G Idaho, Inc., Idaho Falls (ID), pp B-7-11

SKI Report 97:26 (3rd Edition) 99

 APPENDIX C

ABBREVIATIONS, ACRONYMS & GLOSSARY

C.1 Abbreviations & Acronyms - Engineering Terms

AUXC Auxiliary Cooling Water System
BA/CC Corrosion Cracking in Stagnant Borated Water
BBL Break-Before Leak
BOP Balance of Plant
C/F Corrosion-Fatigue
CRC Corrosion Resistant Cladding
CVCS Chemical and Volume Control System
DEGB Double-Ended Guillotine Break
DN Nominal Diameter [mm]
E/C Erosion/Corrosion
EPIX Equipment Performance and Information Exchange System (database
operated by INPO)
ERF Event Reporting Form (IAEA)
FPS Fire Protection System
FW Field weld
FWS Feedwater System
HAZ Heat-Affected Zone
HIC Hydrogen Induced Cracking
HSCC Hydrogen Stress Corrosion Cracking
HWC Hydrogen Water Chemistry
IGSCC Intergranular stress corrosion cracking
IHSI Induction Heating Stress Improvement
ISI In-service Inspection
LBB Leak-Before-Break
LER Licensee Event Report
LOCA Loss of Coolant Accident
LWGR Light Water Cooled and Graphite Moderated Reactor
MR Median Rank
MSIP Mechanical Stress Improvement Process
MS/R Moisture Separator / Reheater
NDE Non-Destructive Examination
NPS Nominal Pipe Size [inch]
NSSS Nuclear Steam Supply System
NWC Neutral/Normal Water Chemistry
PCS Power Conversion System
PFM Probabilistic Fracture Mechanics
PNO Preliminary Notification of Event or Unusual Occurrence
POS Plant Operational State
PT Penetrant Testing
PTS Pressurized Thermal Shock
RCPB Reactor Coolant Pressure Boundary
RCS Reactor Coolant System
RT Radiographic Test
SCC Stress Corrosion Cracking
SICC Strain Rate-Induced Corrosion Cracking

SKI Report 27:26 (3rd Edition) 100

SLAP SKI's LOCA Affected Piping Database
SN Schedule Number
SS Stainless Steel
SSCC Sulfide Stress Corrosion Cracking
SW Shop weld
TC Thermal Cracking
TEM Thomas Elemental Model
TF/TS Thermal Fatigue by Thermal Stratification
TGSCC Transgranular Stress Corrosion Cracking
TWC Through-Wall Crack
TWD Through-Wall Defect
UT Ultrasonic Test
WD Weld Defect
WH Water Hammer
WOR Weld Overlay Repair

C.2 Abbreviations & Acronyms - Organizations

ANSI American National Standardization Institute
ASME American Society of Mechanical Engineers
CSNI Committee on the Safety of Nuclear Installations
EPRI Electric Power Research Institute
GRS Gesellschaft für Anlagen- und Reaktorsicherheit
IAEA International Atomic Energy Agency
INES International Nuclear Event Scale (IAEA)
INPO Institute of Nuclear Power Operations
KSU Kärnkraftsäkerhet och Utbildning AB
NEA-IRS (OECD) Nuclear Energy Agency - Incident Reporting System
OECD Organization for Economic Cooperation and Development
SKI Statens Kärnkraftinspektion
U.S.NRC United States Nuclear Regulatory Commission

SKI Report 27:26 (3rd Edition) 101

C.3 Glossary

Abrasion (or Particle Erosion): Erosion process due to flowing gases or vapors containing
solid particles.

Aging: Degradation of a component resulting in the loss of function or reduced

performance caused by some time-dependent agent or mechanism. The agent or
mechanism can be cyclic (e.g., caused by repeated demand) or continuously acting (e.g.,
caused by the operational environment). The change in the component failure probability
resulting from the degradation will be monotonically increasing with the time of exposure
to the agent or mechanism unless the component is refurbished, repaired, or replaced. In
reliability statistics, aging is represented by that part of the "bathtub curve" where the
failure rate changes from being approximately constant to increasing.

Balance of Plant: The turbine-generator portion of a nuclear power plant with the
associated piping and controls.

Break-Before-Leak: Used to describe the ratio of ruptures to total number of events

involving ruptures and leaks. Various, experience-based correlations exist for determining
this ratio.

Complete Failure: A failure that causes termination of one or more fundamental functions.
If the failure is sudden and terminal it is also referred to as ‘catastrophic.’ The complete
failure requires immediate corrective action to return the item to satisfactory condition.
The effect of the complete failure on the unit can be a reduction in the feed rate or unit
shutdown.

Database Coverage: Percentage of reportable/known failure events that reside in a data-

base.

Degraded Failure: A failure that is gradual or partial. If left unattended (no immediate
corrective action) it can lead to a complete failure.

Direct DEGB: Complete pipe break ("double-ended guillotine break", DEGB) induced by
fatigue crack growth resulting from the combined effects of thermal, pressure, seismic, and
other cyclic loads.

Disruptive Failure: A breaching of the piping by failure of the wall or weld, accompanied
by a rapid release of a large volume of the contained pressurized fluid.

Droplet Impingement Erosion (or Liquid Impact Erosion): Erosion process due to
flowing vapors and gases containing liquid inclusions.

Erosion-Cavitation (E-C):21 Occurs downstream of a directional change or in the presence

of an eddy. Evidence could be seen by round pits and is often misdiagnosed as FAC (see
below). Like erosion, E-C involves fluids accelerating over the surface of a material;
however, unlike erosion, the actual fluid is not doing the damage. Rather, cavitation results

21
Definition is courtesy of Vogt Power International, Inc. (2004).
SKI Report 27:26 (3rd Edition) 102
from small bubbles in a liquid striking a surface. Such bubbles form when the pressure of a
fluid drops below the vapor pressure, the pressure at which a liquid becomes a gas. When
these bubbles strike the surface, they collapse, or implode. Although a single bubble
imploding does not carry much force, over time, the small damage caused by each bubble
accumulates. The repeated impact of these implosions results in the formation of pits.
Also, like erosion, the presence of chemical corrosion enhances the damage and rate of
material removal. E-C has been observed in PWR decay heat removal and charging
systems.

Erosion/Corrosion (E/C): Degradation caused by both mechanical and chemical

processes. A form of materials degradation that affects carbon-steel piping systems
carrying water (single-phase) or wet steam (two-phase) in both BWRs and PWRs. E/C-
damage due to single-phase flow conditions usually manifest as uniform wall thinning
similar to that caused by general corrosion. E/C-damage due to two-phase flow is less
uniform and often has the appearance of "tiger-striping". Piping systems susceptible to
E/C-damage include feedwater, condensate, extraction steam, turbine exhaust, feedwater
heater, heater and moisture separator reheater vents and drains. There has been no
documented evidence of E/C in dry steam lines (e.g., Code Class 1 BWR main steam
lines).

Fabrication: The term applies to the cutting, bending, forming, and welding of individual
pipe components to each other and their subsequent heat treatment and nondestructive
examination (NDE) to form a unit (piping subassembly) for installation.

Flow Accelerated (or Assisted) Corrosion (FAC). EPRI defines FAC as “a process
whereby the normally protective oxide layer on carbon or low-alloy steel dissolves into a
stream of flowing water or water-steam mixture.” It can occur in single phase and in two
phase regions. According to EPRI, the cause of FAC is a specific set of water chemistry
conditions (e.g., pH, level of dissolved oxygen), and absent a mechanical contribution to
the dissolution of the normally protective iron oxide (magnetite) layer on the inside pipe
wall.

Hazard Analysis: Structured identification of physical conditions (or chemicals) that has
the potential for causing damage to people, property, or the environment. Hazard analysis
techniques include ‘hazard-and-operability study’ (HAZOP), what-if analysis, failure
mode and effects analysis (FMEA), etc.

Hazard Plotting: Data plots used for display and interpretation of data; often used to
analyze field and life test data on mechanical equipment (including heavy industrial
equipment). The probability and data scales on a hazard paper are exactly the same as
those on the corresponding probability paper. The cumulative hazard scale is an aid for
plotting the data. The ‘hazard value’ for each failure is calculated from the reverse rank.
The cumulative hazard values have no physical meaning and may exceed 100%. For
details on the hazard plotting technique, see W. Nelson (1983): How to Analyze Reliability
Data, Vol. 6, ASQC Quality Press, Milwaukee (WI), ISBN 0-87389-018-3.

High Energy Piping System: Any system, or portion of system, where the maximum
operating pressure exceeds 1.9 MPa (275 psig), or the maximum operating temperature
exceeds 93 C (200 F), during normal plant operating conditions. Those piping systems that

SKI Report 27:26 (3rd Edition) 103

operate above these limits for only a relatively short portion (less than approximately 2
percent) of the period of time to perform their intended functions, may be classified as
moderate energy. An example of such a system could be the residual heat removal systems
in some plant designs.
[Reference: ANSI/ANS-58.2-1980 ]

Incipient Failure: An imperfection in the state or condition of equipment such that a

degraded or complete failure can be expected to result if corrective action is not taken in
time.

Indirect DEGB: Complete pipe break (double-ended guillotine break) resulting from
seismically-induced failure of NSSS supports.

Induction Heating Stress Improvement: Heat treatment process which is preventing stress
corrosion cracking by reducing tensile residual stresses.

Installation: The term refers to the physical placement of piping subassemblies, valves,
and other specialty items in their required final location relative to pumps, heat
exchangers, turbines, tanks, vessels, and other equipment; assembly thereto by welding or
mechanical methods; final NDE; heat treatment; leak testing; and cleaning and flushing of
the completed installation.

Intergranular Stress Corrosion Cracking (IGSCC): A condition of brittle cracking along

grain boundaries of austenitic stainless steel caused by a combination of high stresses and
a corrosive environment. Primarily a problem in BWR environments. IGSCC has also
been discovered (mid-1970's) in the PWR environment, especially in piping containing
stagnant boric acid solutions.

Leak-Before-Break (LBB): Most nuclear high-energy piping is made of high-toughness

material, which is resistant to unstable crack growth. This type of piping would leak a
detectable amount well in advance of any crack growth that could result in a sudden
catastrophic break.

LBB Screening: LBB methodology is not applied to systems in which excessive or

unusual loads or cracking mechanisms can be present because these phenomena adversely
affect the piping behavior. The excessive/unusual loads or cracking mechanisms of
concern include IGSCC, erosion, creep, brittle fracture and fatigue.

LOCA Sensitive Piping (External LOCA, LSPE): Piping in which a break results in a loss
of reactor coolant or steam. For a BWR it mainly consists of the part of the main
feedwater system upstream of the outer isolation valves, the part of the main steam system
upstream of the MSIVs, the piping of the intermediate component cooling water system,
and some other auxiliary supporting systems. For a PWR, see topics described for BWR.

LOCA Sensitive Piping (Internal LOCA, LSPI): Piping in which a break results in a loss
of reactor coolant. For a BWR it consists of the RCS, the part of the main feedwater
system downstream of the isolation check valves, the part of the main steam system
downstream of the MSIVs, the piping of the core cooling system, the piping of the
containment spray system, and some other auxiliary supporting systems. For a PWR it

SKI Report 27:26 (3rd Edition) 104

consists of the primary coolant system excluding the steam generators.
Noncritical Piping Failure: A local degradation of the pressure boundary that is limited to
localized cracking with or without minor leakage. Such a crack would not reach critical
size and lead to disruptive piping failure.

Nondisruptive Failure: A condition of crack growth or flaw size that is corrected, and
which if it had not been corrected, could have reached a critical size and led to disruptive
failure.

Non-LOCA-Sensitive Piping (NLSP): Piping associated with systems that would be

used to help mitigate a core damage sequence.

Pipe Rupture: Loss of pressure integrity of a pipe run in the form of a circumferential
break, longitudinal break or through-wall crack.
[Reference: ANSI/ANS-58.2-1980]

Pipe Section (as defined by WASH-1400): A segment of piping between major

discontinuities such as valves, pumps, reducers, etc. WASH-1400 indicated that, on
average, a pipe section consists of 12 feet (3.6 m) of piping.

Pipe Section: A segment of piping between welds as indicated on isometric drawings. A

pipe section can be either an elbow (e.g., 90° or 180°) or a straight, or a tee.

Pipe Whip: Uncontrolled motion of a ruptured pipe. Rupture of a pressurized piping

system gives rise to a thrust as a reaction to the expulsion of the contained fluid. The thrust
can generate rapid displacements of the broken pipe, a phenomenon termed ‘pipe whip.’

Piping schedule designation: The schedule number (SN) is defined as: SN = 1000 x
P/SE, where P is operating pressure in lb/in2 and SE is allowable stress range multiplied by
joint efficiency in lb/in2. Two examples are given:

(i) ND-1", Schedule 40 - wall thickness is 0.133 in.

ND-1", Schedule 80 - wall thickness is 0.179 in.
(ii) ND-4", Schedule 40 - wall thickness is 0.237 in.
ND-4", Schedule 80 - wall thickness is 0.337 in.

Some of the failure event reports give details of the Schedule number of affected piping.
There have been instances where a pipe segment has failed simply because the initial
design specifications were inappropriate by calling for, say, Schedule 40 instead of
Schedule 80 piping - an example of design error.

Piping segment: Continuous length of piping with the same degradation mechanism and
failure consequence.
[Reference: EPRI TR-106706./\’, June 1996]

Probabilistic Fracture Mechanics: A procedure for determining pipe failure (leak or

break) probabilities, especially large-diameter piping in the RCS. The procedure
incorporates deterministic (either empirical or analytic) models into a probabilistic
"framework" that allows the results of deterministic growth calculations for literally

SKI Report 27:26 (3rd Edition) 105

thousands of individual cracks to be consolidated, along with the effects of other factors
such as NDE intervals and earthquake occurrence rates, into a single convenient result.
The PFM models only apply for anticipated degradation mechanisms; e.g., IGSCC with
long time between crack initiation and leak.

Reactor Coolant Pressure Boundary: All pressure containing components of light water
reactor nuclear power plants, such as pressure vessels, piping, pumps, and valves that are
either:

(1) Part of the reactor coolant system (RCS); or

(2) Connected to the RCS up to and including any or all of the following:
(a) the outermost primary containment isolation valve in system piping
that penetrates the primary containment;
(b) the second of two valves normally closed during normal reactor
operation in system piping that does not penetrate primary
containment; or
(c) the RCS safety and relief valves.

For a direct cycle BWR, the RCS extends to and includes the outermost primary
containment isolation valve in the main steam and feedwater piping.
[Reference: ANSI/ANS-58.14-1993]

Reliability Attribute: The inherent piping reliability established through application of

recognized (e.g., nominated) piping system design principles and engineering standards.
Factor(s) that is believed to have a significant impact on pipe reliability; e.g., combination
of metallurgy and application, type of pipe section, exposure time, load cycles; c.f.
‘reliability attribute.’ The inherent reliability cannot be changed without making design
modifications.

Reliability Influence Factor: The achieved reliability through controlled/manageable

environmental impacts (i.e., influences) or NDE, ISI, etc.

Sensitization: Precipitation of carbides during welding. When austenitic stainless steels are
heated in the range of about 425 C - 870 C, carbon in excess of about 0.02% will come out
of solution and diffuse to the grain boundaries where it will combine with adjacent
chromium to form chromium carbide (Cr23C6). These grain boundaries are then
preferentially attacked by corrosive media.

Stabilization: To minimize the formation of carbides in austenitic stainless steels, niobium

(Nb) or titanium (Ti) is added to the grain boundary area so that Nb- or Ti-carbides are
formed. Purpose of stabilization is to minimize the susceptibility to sensitization.

Transgranular Stress Corrosion Cracking (TGSCC): A form of environment-assisted

cracking (just as IGSCC); complex interaction of metallurgy, process medium and stresses.
The resistance against corrosion that stainless steel has is depending on a passive oxide
film that has low electron movement. Chlorides and sulfides travel into the film to create
oxide chlorides/sulfides that result in high electron movement. Outside and inside diameter
TGSCC have been observed.

SKI Report 27:26 (3rd Edition) 106

 STATENS kÄRNKRAFTINSPEKTION
Swedish Nuclear Power Inspectorate

Postal Address: Telephone: FAX No.: Telex:

SKI Nat. 08-698 84 00 Nat. 08-661 90 86 11961 SWEATOM S

SE-106 58 Stockholm Int. +46-8-698 84 00 Int. +46-8-661 90 86