ENIQ

Framework Document
ENIQ Framework Document for Risk-Informed In-Service
Inspection

Issue 2

ENIQ Report No. 51

Technical Area 8
European Network for Inspection & Qualification

March 2019
NUGENIA Association

c/o EDF, Avenue des Arts 53, 1000 Bruxelles, BELGIUM

Email: [email protected]

Website: http://www.nugenia.org

This ENIQ Recommended Practice was prepared by the NUGENIA Association.

LEGAL NOTICE

Neither NUGENIA nor any person acting on behalf of NUGENIA is responsible for the use which might
be made of this publication.

Additional information on NUGENIA is available on the Internet. It can be accessed through the
NUGENIA website (www.nugenia.org).

Brussels: The NUGENIA Association

ISBN 978-2-919313-21-1
FOREWORD-BRIEF REVISION HISTORY OF FRAMEWORK
DOCUMENT

The first issue of European Framework Document for Risk-Informed In-Service Inspection was issued
by the ENIQ Task Group Risk (TGR) and was approved by the ENIQ Steering Committee for publication
in 2005. The second issue of the document was updated by NUGENIA Technical Area 8 (TA8) Sub-
Area for Inspection Effectiveness (SAE), taking into account more recent experience and developments
in the field. The objective is to provide guidelines to utilities both for developing their RI-ISI approaches
and for using or adapting already established approaches to the European environment taking into
account utility-specific characteristics and national regulatory requirements. This document was formally
approved for publication by the NUGENIA TA8 - ENIQ Steering Committee in February 2019.

European Framework Document for Risk-Informed In-Service Inspection I

EXECUTIVE SUMMARY
Risk-informed in-service inspection (RI-ISI) approaches are used to define inspection programmes
based on analysis of consequences and probability for leakage in pressure components important to
reactor safety. By using plant specific consequence analysis and detailed review of degradation
susceptibility and analysis of failure probability, the risk-informed approaches have the capability to
identify the items presenting the highest risks of failure, including important locations that might
otherwise be overlooked.

This document is intended to provide general guidelines to utilities for developing their RI-ISI approaches
or adapting already established approaches, taking into account utility-specific characteristics and
national regulatory requirements. This ENIQ document is Issue 2 of the European Framework Document
for RI-ISI.

European Framework Document for Risk-Informed In-Service Inspection II

TABLE OF CONTENT

1. Introduction ...................................................................................................................................... 1
2. Scope ............................................................................................................................................... 1
3. Basic definitions ............................................................................................................................... 2
3.1 Failure ...................................................................................................................................... 2
3.2 Probability of Failure ................................................................................................................ 2
3.3 Consequence of Failure........................................................................................................... 2
3.4 Risk .......................................................................................................................................... 2
4. Principles of Risk-Informed In-Service Inspection ........................................................................... 3
4.1 The Process of Risk-Informed Inspection Planning ................................................................ 3
4.2 Formation of the RI-ISI Assessment Team ............................................................................. 4
4.3 RI-ISI Scope ............................................................................................................................ 4
4.4 Qualitative, Quantitative and Semi-Quantitative Methods for RI-ISI ....................................... 5
4.5 Information Collection and Analysis for a RI-ISI Assessment ................................................. 5
4.6 Grouping of Elements and Level of Evaluation ....................................................................... 6
4.7 Probability of Failure Assessment ........................................................................................... 7
4.7.1 Structural Reliability Models ................................................................................................ 7
4.7.2 Use of Operating Experience Data and Statistics ............................................................... 8
4.7.3 Use of Expert Judgement .................................................................................................... 9
4.8 Consequence of Failure......................................................................................................... 10
4.8.1 Levels and Scope of PSA to be used in RI-ISI .................................................................. 11
4.8.2 PSA Quality, Limitations and Uncertainty .......................................................................... 12
4.8.3 Passive Component Failure Treatment in PSA ................................................................. 13
4.9 Risk Characterisation and Ranking ....................................................................................... 14
4.9.1 Graphical Representation of Risk ...................................................................................... 14
4.9.2 Sensitivity Analysis ............................................................................................................ 16
4.9.3 Identification of Safety Significant Locations ..................................................................... 16
4.9.3.1 Risk Outliers............................................................................................................... 17
4.9.3.2 Flat Risk Distribution .................................................................................................. 17
4.9.3.3 High Consequence – Low Probability of Failure Locations ....................................... 17
4.9.3.4 High Probability of Failure – Low Consequence Locations ....................................... 18
4.9.4 Leak Detection ................................................................................................................... 19
4.10 Selection of items for the RI-ISI Programme ......................................................................... 20
4.11 Risk Reduction through ISI .................................................................................................... 20
4.11.1 Inspection Interval and Inspection Method .................................................................... 21
4.11.2 Inspection Qualification.................................................................................................. 21
4.11.3 Complementing and Alternative Measures for Risk Reduction ..................................... 22
4.12 Regular Updating for a Living RI-ISI Programme .................................................................. 23

European Framework Document for Risk-Informed In-Service Inspection III

 4.13 RI-ISI for Long Term Operation ............................................................................................. 23
5. Organisation and Responsibilities ................................................................................................. 24
5.1 Introduction ............................................................................................................................ 24
5.2 Outline of Management Structure .......................................................................................... 24
5.3 Definition of Responsibilities .................................................................................................. 25
5.3.1 The RI-ISI Responsible Person ......................................................................................... 25
5.3.2 The RI-ISI Independent Advisory Panel ............................................................................ 25
5.3.3 The RI-ISI Team ................................................................................................................ 26
5.3.4 The RI-ISI Review Panel ................................................................................................... 26
5.3.5 The Inspection Qualification Team .................................................................................... 27
5.3.6 The Regulatory Body ......................................................................................................... 27
6. Documentation and Archiving ........................................................................................................ 27
6.1 RI-ISI Programme Dossier..................................................................................................... 27
6.2 Obsolescence of Storage Medium ........................................................................................ 28
References ............................................................................................................................................ 29
List of Abbreviations .............................................................................................................................. 31

European Framework Document for Risk-Informed In-Service Inspection IV

1. Introduction
In-service inspection (ISI) is an essential element in integrity and safety management. ISI consists of
non-destructive testing (NDT) and may also include pressure and leakage testing. The inspections help
to confirm that basic safety functions are preserved and that the probability of radioactive materials
breaching containment is reduced. Inspections have the purpose to detect any defects, degradation and
damages, before leakage can occur and provide a base line for future inspections (Pre-Service
Inspection (PSI)).

Risk-informed in-service inspection (RI-ISI) aims at rational plant safety management by taking into
account the results of plant-specific risk analyses. The fundamental idea is to identify high-risk locations
where the inspection efforts should be concentrated. The objective is to provide an ongoing improvement
in the overall plant safety, measured by risk, together with reduced radiation doses for the inspection
personnel.

RI-ISI reflects recent developments in Probabilistic Safety Assessment (PSA), the understanding of
degradation mechanisms (e.g. root cause evaluations, structural reliability modelling) and the
experience gained from more than 17,000 reactor operating years.

The development of a RI-ISI programme requires expertise from a number of different disciplines
including inspection, maintenance, design, materials, chemistry, stress analysis, systems, PSA,
inspection qualification, operations and safety. It requires a long-term co-ordinated management
commitment, in order to maintain a living ISI programme, updated by analysis of inspection results and
new knowledge providing feedback to the risk analysis. Before embarking on a risk-informed programme
it is essential, therefore, to obtain the backing and commitment of the utility and plant management.

This document is structured as follows. The scope is laid down in Section 2. In Section 3, the most
relevant definitions that apply herein are given. The principal elements of RI-ISI are described in Section
4. In particular, the RI-ISI scope is discussed in Sub-section 4.3 and qualitative, quantitative and semi-
quantitative methods are discussed in Sub-section 4.4. Sub-section 4.7 deals with the assessment of
degradation and probability of failure (POF). The issues concerning consequence of failure (COF)
assessment are examined in Sub-section 4.8. Risk characterisation and ranking are discussed in Sub-
section 4.9. The definition of the RI-ISI programme is considered in sub-section 4.10. In section 5
organizational responsibilities supporting the RI-ISI application are discussed including a suggested
management structure. Finally, Section 6 deals with issues related to the documentation and archiving
of the results produced in a RI-ISI application.

2. Scope
This document is intended to provide guidelines about the development of an ISI programme aimed at
providing early detection of any degradation that may impact plant safety. This document has been
developed specifically for RI-ISI planning in the nuclear industry, but the general principles can be
adapted to other industries as well.

The scope of this document is limited to establish principles that an organisation carrying out RI-ISI
should follow. The decision on whether a risk-informed approach should or should not be applied to
devising an inspection strategy is a matter for agreement between all involved stakeholders.

This document identifies the key principles that any RI-ISI approach needs to meet. This is regardless
of the level of quantification in the assessment of failure probabilities and consequences. Challenges for
purely qualitative methods, that do not use the PSA in order to define the consequences or any form of
structural integrity modelling to determine the POF, are not treated extensively in this document.

Currently, the main application area of RI-ISI is piping systems. Nevertheless, it is recognised that it is
possible to apply the principles of RI-ISI to any system, structure, or component (SSC). ENIQ has
produced a report on the role of ISI of the reactor pressure vessel (RPV) [1] as a basis for further
discussion on this topic. For RPV and internals, differences as compared to a piping system emerge for
example in the use of PSA in consequence analysis.

European Framework Document for Risk-Informed In-Service Inspection 1

An important part in developing an inspection programme is to ensure the use of appropriate NDT
methods. The link between inspection qualifications that complies with the European Qualification
Methodology and a RI-ISI programme [2] is identified as an essential step in ensuring the effectiveness
of ISI.

This document is intended to be general, and different countries can use the main principles to develop
RI-ISI programmes which are consistent throughout Europe but which also meet their different national
legal, regulatory and technical requirements.

3. Basic definitions
The definitions that apply to this document are given in the ENIQ Glossary of Terms [3] and the List of
Abbreviations. The following concepts are fundamental within this document and are therefore
discussed here in more detail.

3.1 Failure
Failure of a structural component is an event involving leakage, rupture or a condition that would disable
its ability to perform its intended safety function. For piping, failure usually involves a leak or a rupture,
resulting in a reduction or loss of the pressure-retaining capability of the element in question.
The plant response to the leakage depends on the severity of the failure, which is generally related to
the leak size and location. Hence, if the consequences of the piping failure vary significantly with leak
size, it is necessary to define and analyse different degrees of failure states of a single structural
component.

3.2 Probability of Failure

POF is the likelihood that a component or weld will fail at a given time, considering the
potential degradation mechanisms it could be susceptible to and factors such as disturbance loads,
cyclic loads and environment management. Fundamental for the risk assessment is a systematic
assessment for the identification of potential degradation mechanisms (hazards identification). The POF
over a given time period may be assessed by use of modelling, expert judgments or statistics, depending
on the degradation mechanism, service experience and available information.

In this document the term ‘POF’ is used as an abridged version of the full wording ‘POF over a given
time into the future’. POF is defined either in terms of failure frequency or POF on demand in the case
of components in a stand-by system actuated only on demand.

In PSA models the failure frequency is commonly assumed to be a constant failure rate. However, when
dealing with passive components subject to a time dependent degradation mechanism, the POF is not
constant with time. For situations where the POF is low throughout the life of the plant, this time
dependency may be of small significance. However, when the degradation mechanism is more
aggressive, improved treatment is recommended.

3.3 Consequence of Failure

Consequence is measured as the adverse outcome that is conditional on failure. For RI-ISI the
consequence is measured as the Conditional Core Damage Probability (CCDP) or Conditional Core
Damage Frequency (CCDF). The consequence that arises given failure of a component or system is
commonly determined by use of PSA. Most plants have a Level-1 PSA defining CCDP or CCDF. Many
PSAs also include containment failure metrics (e.g. Large Early Release Frequency (LERF)) and the
consequence assessment for the RI-ISI programme may include these metrics, for example conditional
large early release probability (CLERP) or conditional large early release frequency (CLERF).

3.4 Risk
The risk is defined herein in the engineering sense as the product of the probability of a failure and the
consequences of that failure occurring, as follows:

European Framework Document for Risk-Informed In-Service Inspection 2

 Risk = {Probability of Failure} × {Consequence of that Failure}

As probability is dimensionless, it follows that the metric of risk is the same as the metric of COF.

4. Principles of Risk-Informed In-Service Inspection

RI-ISI aims at a rational plant safety management strategy by taking into account the results of plant-
specific risk analyses.

Fundamental principles for development of an effective inspection programme are:

1. Ability to define the consequence and probability associated with component and weld failures,
so that the ISI programme can focus on safety-significant items for an integrated inspection
strategy;

2. Identification of an inspection programme that will improve the safety as far as it is practical,
with due consideration of resources and accumulated radiation dose to plant workers.

The advantage of such an approach is the optimisation of the inspection efforts. The term ‘optimisation’
in this context is seen as a process that:

a) Improves or at least maintains the overall plant safety;

b) Minimises the radiation dose to personnel involved in the inspection activities;

c) Provides improved plant reliability.

4.1 The Process of Risk-Informed Inspection Planning

The key steps in the process of risk-informed inspection planning are summarized in Figure 1.

4.3
Definition of
Scope
4.6 & 4.7
Failure Potential

4.2 4.9 4.10 & 4.11

Program 4.4
Formation of the Risk Program
Definition Choice of Method
RI-ISI Team Characterization Implementation

4.6 & 4.8

Consequence
Assessment

4.5 Data
Collection

4.12
Feedback &
Process
Adjustment

Figure 1: RI-ISI Process Overview.

The steps or phases may be iterative and may impact previous steps (e.g. the results of a sensitivity
study may impact the initial risk ranking):

1. Assurance of long-term commitment of senior management to the risk-informed

programme;

2. Formation of the RI-ISI assessment team (Sub-section 4.2);

3. Definition of the scope of the SSC to be considered in the analysis (Sub-section 4.3);

European Framework Document for Risk-Informed In-Service Inspection 3

 4. Collection and analysis of the information required to carry out the risk assessment (Sub-
section 4.5);

5. Grouping of items and definition of the level of the evaluation (Sub-section 4.6);

6. Assessment of the POF for all the components included in the scope of the application
(Sub-section 4.7). This step includes the hazard (degradation) identification;

7. Assessment of the consequences of failure for all the components included in the scope of
the application (Sub-section 4.8);

8. Ranking of the risks associated with all the components (Sub-section 4.9);

9. Performing sensitivity studies to determine the effect of changes in key assumptions or

data (Sub-section 4.9.2);

10. Identification and selection of components to be inspected and criteria (Sub-section 4.10);

11. Inspection intervals, qualification and other measures for risk reduction (Sub-section 4.11);

12. Feedback of the obtained information after completing the inspection, or from input
changes in PSA, damage assessments, or other (Sub-section 4.12).

Each step is further discussed in the following sub-sections.

4.2 Formation of the RI-ISI Assessment Team

The formation of an appropriate workforce structure is an essential factor in devising and implementing
a RI-ISI programme. Such a workforce will need to contain or have access to a range of different
disciplines including inspection, maintenance, design, materials, chemistry, stress analysis, systems,
PSA, operations and safety. An example of a possible RI-ISI management structure, together with the
roles, responsibilities and interfaces of the different parties involved, is described in Section 5.

4.3 RI-ISI Scope

The first practical step in developing a RI-ISI programme is to define its scope. The scope definition
should clearly define the boundary of the programme, e.g. which SSCs and which structural elements
(circumferential welds, longitudinal welds, socket welds, attachments, lugs, etc.) are to be included in
the programme.

The scope of a RI-ISI programme can be either a full scope programme or, when an alternative
programme is already in place (e.g. ASME Section XI, SKIFS 1994:1, CSAN285.4), a partial scope
programme. The scope should be clearly defined and documented.

A full scope programme can be defined as including all passive SSCs, including:

1. Those relied upon to perform a safety function during all design-basis plant conditions;

2. Those whose failure could compromise the function of safety-related SSCs or could cause
a plant trip or actuation of a safety-related system.

A partial scope programme is restricted to any subset of the systems or functions defining the full scope.
The partial scope application can be justified, for instance, if an alternative (such as deterministic,
augmented) programme is in place for the other passive components or degradation mechanisms.

A full scope RI-ISI programme is recommended, because it treats all SSCs in a consistent and objective
manner for relative comparisons. In addition a greater portion of the plant risk from pressure boundary
failures is addressed. Nonetheless, it is recognised that in the application of RI-ISI, a partial scope
programme can and has been justified.

A RI-ISI methodology usually allows flexibility in the scope of application. Therefore, conducting the
application on a large scale (e.g. a whole plant application), a system specific application (e.g. a single

European Framework Document for Risk-Informed In-Service Inspection 4

system) or a class of components (e.g. the reactor coolant pressure boundary) should still produce
consistent and reliable results.

4.4 Qualitative, Quantitative and Semi-Quantitative Methods for RI-ISI

In principle, three different approaches to the assessment can be used in developing ISI programmes:
quantitative, semi-quantitative and qualitative approach.

In the nuclear industry, one tool that is frequently used in assessments of risks associated with plant
operation (normal and abnormal) is the PSA. The COF can be quantified using the PSA model, and
results are applied for many risk-informed applications including RI-ISI.

Quantitative approaches should be chosen when feasible. However, it is recognised that the current
state of knowledge and understanding of some of the degradation mechanisms and the availability of
the required plant data can be insufficient to accurately quantify the POF (see Sub-section 4.7). Likewise,
many current PSA analyses may not be detailed enough for the level required in RI-ISI application, and
thus the consequence analysis must be complemented by some degree of qualitative assessment (see
Sub-section 4.8). A frequently applied approach to development of a RI-ISI programme is a semi-
quantitative one, based on a plant-specific PSA and with consideration of the current understanding of
potential degradation mechanisms.

A benchmark study RISMET [4] has been conducted with the purpose to compare various RI-ISI
methodologies applied to the same case. It was concluded that the use of consequence assessment
based on a plant specific PSA model improves identification of risk-important locations. Further,
successful failure probability assessment is strongly dependent on in-depth knowledge of degradation
assessment and structural integrity analysis for piping systems, independent of the level of quantification
in the methodology.

4.5 Information Collection and Analysis for a RI-ISI Assessment

The process of risk-informed inspection planning brings together a large amount of information from
many different sources, which needs to be collected and analysed. This information can be divided into
the following categories:

1. Equipment data;

2. Historical plant operating data;

3. General nuclear industry information;

4. Safety analysis report and technical specifications;

5. PSA specific data.

The information required will depend on the approach adopted, but may include:

Equipment data

a) Design and manufacturing records;

b) As-built information;

c) Design basis conditions;

d) Deterministic design stress and fatigue analysis;

e) Defined boundaries of plant items to be considered for inspection planning.

Historical plant data

a) Operational transient data and condition monitoring data;

b) Plant failures and service experience data;

European Framework Document for Risk-Informed In-Service Inspection 5

 c) Pre-service and ISI records;

d) Environmental conditions including temperatures, water chemistry and flow rates;

e) In-service degradation assessments (fatigue, stress corrosion cracking (SCC), erosion-

corrosion, external effects).

General nuclear industry information

a) National and international databases;

b) National and international publications.

Safety analysis report and technical specifications

a) Test procedures and frequencies;

b) Emergency operating procedures;

c) System failure procedures.

PSA specific data

a) System design and modifications;

b) Frequencies of initiating events (internal and external);

c) Failure modes and effects analysis (FMEA);

d) Failure frequencies (in the consequence assessment);

e) Common cause failures (CCF);

f) Data on human reliability;

g) Success criteria.

The availability and accessibility of this information will vary depending on the particular circumstances.

Data collection is an essential part of the process, as it constitutes the basis for the whole analysis and
decision process. Due care and diligence should therefore be practised during this phase. Data
collection can be a resource-demanding phase in the RI-ISI process, but the data gathered is of
considerable value. The data should be made available for other safety and reliability related activities,
as for example periodic safety review.

4.6 Grouping of Elements and Level of Evaluation

The risk assessment in a RI-ISI programme can be carried out either at the element level (e.g. each
weld and discontinuity) or for groups of contiguous elements where all relevant conditions are similar.
Grouping of elements may be performed with consideration of consequence or degradation.

The advantage of evaluation at element level is that the output can be unique for every element and
there is a clear distinction between elements. However, to reach this distinction between the elements,
a rather large amount of detailed input data is needed which might be prohibitive from a cost point of
view.

The main advantage of grouping elements with the same consequence conditions (often called
segmentation) is that it provides time savings. The initial segmentation is normally based on the
postulated direct consequences of a failure, but it is important that indirect consequences are also
considered for further segmentation. Piping segments are normally defined at major components such
as pumps, heat exchangers, check-valves, remote controlled valves or at pipe size changes. The
possibility for operator action to mitigate the consequence can also be a reason for a segment boundary.

European Framework Document for Risk-Informed In-Service Inspection 6

For the degradation assessment, grouping may also be performed with respect to elements of same
material and subjected to same environmental conditions.

4.7 Probability of Failure Assessment

A fundamental and initial step in any risk analysis process is to identify potential hazards, with the
objective to make a complete identification of threats. In the case of RI-ISI, we consider hazards due to
degradation mechanisms, such as fatigue cracking, SCC, local corrosion, embrittlement and unusual
loads. During the identification step it is important to be open to all possible threats and underlying
causes. For this reason, one may defer the assessment of the probability of the threat to a subsequent
step, after the identification of possible threats. It is recommended that the identification is executed as
a systematic review of all degradation mechanisms, performed as an in-depth analysis by experts, to
identify active and potential damage mechanisms. Examples of different types of degradation
mechanisms are found in ASME II, App A [5], IGALL [6] and similar documents. Some damages can
occur due to certain loads such as vibrations, thermal mixing, stratification or steam collapse.

The evaluation requires consideration of a range of influential parameters, such as, design and
fabrication information, loadings, environmental conditions, and inspection results. This analysis should
be supported with a review of operating experience at the plant, the same or similar plants as well as
insights from general world-wide generic data.

The POF over a given time period may be assessed by use of physical modelling, expert judgments or
statistics, depending on the degradation mechanism, failure mechanism and available information for
influencing factors.

The POF of a component may be analysed in a quantitative way by use of structural reliability models
(SRMs). However, two important facts are recognised concerning SRMs. Firstly, such models only exist
for some of the degradation mechanisms that affect nuclear power plants (NPPs). Secondly, for
degradation mechanisms that do have a viable prediction model, quantitative values may serve to
quantify relative differences in the POF between different locations with differences in influencing
variables. Because of the above, failure probabilities for RI-ISI applications are generally estimated on
the basis of a combination of quantitative and qualitative assessments. This is referred to as ‘semi-
quantitative’ analysis. The analysis aims at using all available knowledge to derive an auditable ranking
of the POF. An assessment of the POF can be obtained by:

1. Use of SRMs, where they exist, to provide estimates of the relative differences in the failure
probabilities (see Sub-section 4.7.1);

2. Statistical estimates based on plant-specific data and global databases in order to provide
anchoring points for SRM analysis or expert judgments (see Sub-section 4.7.2);

3. Use of expert judgements for identification and ranking of susceptibility, using a

combination of knowledge on degradation, operational experience, design and supporting
deterministic model results (see Sub-section 4.7.3).

It should be recognised that there is not a single, optimal method for assessing POF. As such, each
above mentioned approach, or combination of them, needs to address the issues identified herein.

Different leak sizes can result in large differences in consequences. Depending on the leak detection
capabilities, this implies that it can be useful to estimate the POF for different defined leak sizes, e.g.
the probability for detectable leak after wall penetration and the probability for pipe rupture. Leak
detection assessment within the RI-ISI framework is discussed in Sub-section 4.9.4.

4.7.1 Structural Reliability Models

SRMs are essential tools in the evaluation of probabilities of failure for components of NPPs. A SRM is
based on analytical modelling of a degradation mechanism and failure mode, together with evaluation
using stochastic variables that are described by distributions. Probabilistic Fracture Mechanics (PFM),
with probabilistically distributed parameters, is used for degradation mechanisms that cause cracking.
The objective of structural reliability analysis is to determine the probability of an event occurring during

European Framework Document for Risk-Informed In-Service Inspection 7

a specified reference period. There are several degradation mechanisms that are not covered with the
available analytical models, but when models exist they provide valuable insights.

It is essential to verify and validate the SRMs used in the evaluation of probabilities of failure. To this
end, a number of steps can be defined [7]:

1. The analytical assumptions should be well grounded and based on theory that is accepted
as representative of the situations considered by the given SRM.

2. The scope, the analytical assumptions and the limitations of the modelling capability should
be well defined.

3. The basic programming and modelling should be shown to have suitable quality assurance
(QA) documentation.

4. The model should be capable of reproducing the data on which its analytical assumptions
are based. Examples should be provided that can demonstrate its general agreement with
available experimental data.

5. The model should be benchmarked against other SRM models within the same field or
scope and any differences should be adequately explained.

6. Attempts should be made to show how the model compares with the world or field data,
accepting the inherent limitation of this data.

The verification and validation of SRMs is described in more detail in ENIQ Recommended Practise 9
(RP9) [8].

The results from SRMs can provide a relative risk ranking valuable for the purpose of developing a RI-
ISI programme. It is important to recognize that the absolute values developed by SRMs need to be
used with caution if used for other applications.

An important advantage of most SRMs is the possibility to quantify the influence of inspections, both in
terms of differences in inspection capability and inspection interval. This is a key factor in RI-ISI since it
is desirable to select the most appropriate inspection interval and inspection capability for every risk
significant location. The probability of detection (POD) function for different NDT systems may be used
to describe the reliability and efficiency of the inspections. These issues are discussed in more detail in
sections 4.11.1 and 4.11.2. Note that when probability assessments are based on statistical experience
data or expert judgment, it is not possible to quantify the effect from using different inspection intervals
or detection capability.

Further recommendations and discussion on requirements for SRMs and associated software in
applications for RI-ISI are found in reports produced within the NURBIM project [7].

4.7.2 Use of Operating Experience Data and Statistics

Operating experience data provides useful qualitative and quantitative information on the degradation
of structural components. For example, different types of SCC have been discovered from field failures,
and general event information has been transferred to other plants for their hazard identification work.
Operating experience data covers not only leak and rupture data, but also other information on the
presence of non-critical levels of degradation, such as small defects and wall thinning. The degradation
information can be of considerable value in the development of SRMs and in the assessment of
structural failure probabilities.

Operating experience data should be considered in the evaluation of degradation hazards. Data can be
divided according to, for example, degradation mechanisms, materials and major environmental
characteristics. The data should be broken down as finely as possible without becoming too sparse,
which can be a challenge for safety-significant systems where the number of leakage events is low.

When parameters are assessed by use of structural component failure data and degradation databases,
the following shortcomings have to be taken into consideration:

European Framework Document for Risk-Informed In-Service Inspection 8

 1. Passive components usually have an increasing failure rate (due to ageing effect), and thus
the exponential distribution does not correctly model future failure occurrence.

2. The data quality may be insufficient for obtaining reliable estimates due to:

a) Missing information related to the component population and conditions;

b) Uncertainties related to failure mechanisms and root causes;

3. Data is often very scarce, and at application it has to be considered that data is grouped
for many different conditions and ISI programmes.

Due to the shortcomings related to the quality and quantity of data, statistical estimates of failure
probabilities for passive components are often subject to large uncertainties. For RI-ISI applications,
POF estimates obtainable from world-wide or generic data may not be sufficient. However, the generic
data is extremely valuable in establishing initial preliminary probabilities. These values can then act as
an anchor for either SRM estimates or expert judgement, where plant-specific information is applied to
identify the differences in POF throughout the plant.

4.7.3 Use of Expert Judgement

As discussed, quantitative assessments are not feasible and possible for all degradation mechanisms
and in all situations. Analytical models do not exist for all degradation mechanisms, and statistical data
is often scarce. An alternative and complement is to use expert judgement for qualitative assessments.
Expert judgments may be used to rank and classify POF. Sometimes qualitative assessment can also
be applied as a first step to prioritize components for further detailed analysis.

Useful risk insights can be gained also with qualitative assessments. A qualitative evaluation should be
performed by experts and using a structured approach. Qualitative approach uses qualitative terms,
such as very low, low, medium, high and very high, which represents classes that commonly differ in a
non-linear logarithmic scale. The classes should provide sufficient differentiation to assess and compare
different components and positions. Another consideration for quantitative assessment is that
conservative assessment limits need to be applied for a robust method, since the assessments are less
detailed.

It is very important to assess all influencing parameters, and any sequences of events, to facilitate
adequate assessment and classification of the failure probability. Sometimes deterministic results exist
that can give partial support for the classification.

Well-structured expert judgement can be a powerful tool for expanding the range of application of a RI-
ISI. Elicitations can be used to support and integrate individual expert judgements to provide POF
estimates. Details on expert elicitation are described in ENIQ RP11 [9]. It is recommended to ensure
that the use of expert judgement is conducted within a structured expert elicitation process, with the
principal phases:

1. Selection and training of experts;

2. Elicitation of judgements;

3. Modelling and combination of judgements;

4. Sensitivity analyses;

5. Discussion and feedback from experts;

6. Documentation.

It is recognised that experts, who are experienced within other areas, are often not very familiar with
estimating probabilities and using non-linear scales. Training in giving probabilistic estimates is
important. Aggregation of opinion from multiple experts (three or more) tends to improve accuracy
compared to the opinion of a single expert. Further, the quality of judgments can be substantially
improved by decomposing the problem into more elementary problems.

European Framework Document for Risk-Informed In-Service Inspection 9

The person leading a structured expert elicitation process should have proper knowledge in decision
analysis, probabilistic modelling and statistics. This person is called the normative expert. His or her
responsibility is to facilitate the process by giving training, conducting the elicitation and aggregating the
expert opinions. A detailed discussion on the expert assessment approach within the nuclear industry
can be found for example in [10] and [11]. An adaptation of expert judgement to the estimation of pipe
rupture frequencies is provided in [12].

Using an expert judgement for all locations, including those for which an SRM and possible statistical
data exists, can be a format to combine qualitative information and quantitative POF estimates. The
SRM and statistical data then act as, both an anchor for the rankings and as a form of cross correlation
with the expert ranking. An example of such an approach is described in [7].

4.8 Consequence of Failure

The consequence, given a leakage or rupture of a component, is usually assessed using the measure
CCDP. The consequence assessment part of a RI-ISI analysis is commonly performed using PSA model
results.

The failure of a passive component in a NPP can basically lead to one of the following classes of events
of interest:

1. Initiating event: A pressure boundary failure occurs in an operating system resulting in an

initiating event.

2. Loss of mitigating ability (stand-by): A pressure boundary failure occurs in a standby system
and does not result in an initiating event, but degrades the mitigating capabilities of a system or
train. After the failure is discovered (if discovered), the plant enters the Allowed Outage Time
defined in the Technical Specification.

3. Loss of mitigating ability (demand): A pressure boundary failure occurs in a standby system
when the system/train operation is required by an independent demand.

4. Combination: A pressure boundary failure causes an initiating event with an additional loss of
mitigating ability (in addition to the expected mitigating degradation due to the initiator).

Furthermore, a pressure boundary failure that also affects the containment performance can be
identified as a separate class.

The consequence analysis part of the RI-ISI process aims at evaluating the impacts of any of the above-
mentioned events on plant risk. The consequence evaluation consists of the following primary steps:

a) A qualitative FMEA that determines the plant impacts of postulated failures of postulated sizes
(e.g. small leakage, medium leakage, complete rupture). This step can consume a large share
of resources;

b) Qualification of the PSA for RI-ISI application;

c) Quantitative analysis with PSA.

PSA techniques have been developed since the 1970s [13] and PSA studies exist today for most types
of NPPs and individual power stations. Although the level of details and quality of these studies vary,
the PSA methodology has become a well-known and frequently used tool in the analysis of nuclear
safety.

The following items are considered critical for a robust interface between PSA and RI-ISI is to be
developed:

 Levels and scope of PSA to be used in RI-ISI (Sub-section 4.8.1);

 PSA quality, limitations and uncertainty (Sub-section 4.8.2);

 Passive component failure treatment (Sub-section 4.8.3).

European Framework Document for Risk-Informed In-Service Inspection 10

 4.8.1 Levels and Scope of PSA to be used in RI-ISI
PSAs are performed at different levels, dealing with different types of consequences:

Level 1: Assessment of plant failures with respect to core damage and the estimation of core damage
frequency (CDF);

Level 2: Estimation of off-site fission product release: Consequences are usually expressed in terms
of the combination of small or large and early or late containment failures, related to estimation
of release frequency (e.g. LERF);

Level 3: Assessment of off-site consequences leading to estimates of the effects of fission product
release on human health. Consequences are usually expressed in terms of fatalities, public
radiation doses and environmental pollution.

All modern NPPs have plant-specific PSA studies, usually at Level 1 or Levels 1 and 2. The Western
European Nuclear Regulators’ Association (WENRA) state in their document on safety reference levels
for operating NPPs [14] that PSAs shall be developed for both Levels 1 and 2. It is natural to utilize these
as the basis for the consequence evaluation. Current RI-ISI applications mainly rely on CDF and LERF
as the consequence metrics of interest.

It is recognised that the use of Level 2 consequence metrics (e.g. large early release) could be important
for RI-ISI application for reactors whose complete primary pressure boundary is not fully covered by the
containment structure (for instance, RBMK and CANDU reactors). In any case it should be borne in mind
that Level 2 studies are based on assumptions that can be very difficult to verify in practice, and thus
are in general subject to higher uncertainties than estimates of core damage.

In view of the above, it is concluded that the Level 1 PSA forms the recommended (as well as the
minimum) basis for analyses for most plant designs. Insights from Level 2 metrics can be considered in
handling priorities for elements with lower POF but higher consequences.

The scope of the most comprehensive PSA Level 1 studies includes evaluation of the risk at power
operation, start-up, shut down and cold shutdown. Among the initiating events that are usually
considered are typical transients, loss-of-coolant accidents (LOCAs), support system failures, internal
fire, flooding, seismic and other external events.

The basic requirement on the scope of a PSA is that all relevant operating plant modes and initiating
events must be addressed in the evaluation. It is however, not necessary that all modes and events are
included in the calculations. A qualitative treatment of omitted modes and events is sufficient when they
have little influence on the result. This will differ from plant to plant.

With respect to external hazards, it is important to understand the purpose of the PSA application. The
purpose of a RI-ISI application is to develop a periodic inspection programme that maintains or improves
plant safety. Therefore, consideration of other hazards outside the baseline PSA (e.g. external hazards)
are not needed for the consequence assessments, if they would not significantly impact the relevant
decision-making process (e.g. selection of inspection location) [15].

The following provides a summary on why some hazards in general not need to be included in a PSA
used to develop COFs for a RI-ISI programme for piping. However, one or more of these hazards may
be included at the option of the RI-ISI programme developer.

Internal Fire Hazard: The potential contribution of piping failure to internal fire risk is insignificant
because the failure probability of piping is insignificant compared to the failure probability of other SSCs
such as pumps, valves, and power supplies. Fire events are also not likely to present significantly
different challenges to the piping in the scope of RI-ISI. The design basis events remain unchanged and
safety margins are maintained. Meeting defence-in-depth (DiD) and safety margin principles provides
additional assurance that this conclusion will remain valid. ISI is a part of DiD, and the RI-ISI process
will maintain the basic intent of ISI (that is identifying and repairing flaws) and provide reasonable
assurance of an ongoing substantive assessment of piping condition.

European Framework Document for Risk-Informed In-Service Inspection 11

Seismic Event: Well-engineered systems and structures (for example, piping systems) are seismically
rugged. Individual plant examination of external events (IPEEE) and other industry and NRC studies
(see e.g. [16], [17]), have shown that piping systems in general have seismic fragility capacities greater
than the screening values typically used in seismic assessments, and they are generally not considered
likely to fail during a seismic event. ISI is not considered in establishing fragilities of such components.

High Wind, External Flood, and Other External Hazards: As described previously, the purpose of
developing an RI-ISI programme for piping is to define an alternative ISI strategy for piping systems.
External hazards (for example, high wind or external flood) need not be considered in the development
of an ISI programme for piping. The reasons include the structural ruggedness of the piping systems to
loads during this type of events, location (because relevant systems are typically inside well-engineered
structure), and the consequence assessment for internal events already includes the consideration of
spatial impacts. The industry experience with plants implementing RI-ISI programmes has not identified
changes based on insight from the evaluation of these external hazards. The approaches to maintain
DiD and safety margins summarized previously provide additional confidence in this conclusion.

In summary, reasons for not including some hazard groups in the PSA results used for risk-informed
decisions according to [18] are:

 The magnitude of the potential consequence is not significant.

 Including the hazard group would not affect the decision; that is, would not alter the results of
the comparison with acceptance guidelines.

 Traditional engineering arguments including preserved balance in defence and preserved

margin to design basis events are applied.

However, to be adequate for developing COFs for a RI-ISI programme, the scope and quality of the PSA
should reach established requirements for plant specific PSA, which is discussed in the next section.

4.8.2 PSA Quality, Limitations and Uncertainty

It is important to develop results in the RI-ISI programme that are robust. Therefore, the PSA should be
qualified for this purpose.

An overriding requirement is that the PSA should realistically reflect the actual design, construction,
modifications, operational practices and operational experiences of the plant. The plant’s different
functions should be modelled with the same accuracy and level of detail. The evaluation of system
demands should be done with the same level of realism and conservatism for all functions, and the input
data used for PSA analyses should be verified to ensure that it reflects the state of the art.

It is recommended that the PSA study is qualified for use in RI-ISI application by fulfilling demands
specified by ASME [19] or EPRI [15]. The qualification could also be performed by peer review of the
PSA for RI-ISI application. The qualification of the PSA should be documented ([15], [19]-[23]).

Passive components generally have low failure probabilities in comparison with active components, and
the former only contribute to a small proportion of the total plant risk evaluated in the PSA. Moreover,
because of low probabilities of failure, data available regarding failure of passive components is usually
limited. This has led to very limited treatment of such failures within the PSA. Due consideration must
be given to this fact and how the passive components should be treated in the consequence analysis.
ISI is a very important preventive action to ensure the situation of very low POF for the passive
components. The next Sub-section (4.8.3) discusses this issue in more detail.

If the PSA does not fully meet the quality requirements for RI-ISI application, specific attention should
be paid before its use in the consequence evaluation. The PSA may still provide useful information for
the analysis, but in this situation, it should be supported by complementary analyses that may be of
qualitative or quantitative nature.

Each PSA is also subject to unavoidable uncertainties, such as parameter uncertainties, model
uncertainties and completeness uncertainties. Parameter uncertainties related to statistical data are

European Framework Document for Risk-Informed In-Service Inspection 12

usually quantified and a PSA may provide uncertainty boundaries as a part of its output. Model and
completeness uncertainties are normally not included in the PSA, but they have to be evaluated in the
process of PSA qualification.

Quantified PSA uncertainties, such as parameter uncertainties, could be transferred to the RI-ISI
procedure, but it is recognised that there are no straightforward algorithms for this. The RI-ISI evaluation
should specify the effects of the parameter uncertainties in connection to sensitivity analyses (Sub-
section 4.9.2).

4.8.3 Passive Component Failure Treatment in PSA

The PSA model can be used to estimate the COF at different locations for use in RI-ISI analysis. The
consequence is estimated as the CCDP, that is, the CDP given failure assumed at a location. Pipe
breaks are modelled directly as initiating events such as LOCAs, main steam or feed-water line breaks
or flooding. PSA may spatially subdivide the pipework into zones and then consider various types of
LOCAs occurring within the zone as initiating events, but the studies do not normally model initiating
events at segment or element level. Furthermore, the components are normally modelled in the PSA
with two states: full function or total failure. In the case of piping, these states are ‘no leakage’ and
‘complete pipe break’. Thus, a ‘partly failed’ component (such as a crack or a small leak) that is handled
by a manual action, is not modelled in a basic PSA. All events leading to an automatic initiation of safety
systems are included in the PSA.

As the modelling of structural components in the base PSA may be coarse and incomplete (with respect
to RI-ISI needs) for many systems, additional analysis may be required to determine the consequences
at the degree of detail needed in RI-ISI. A complementary FMEA should be conducted in order to define
both the direct and indirect impact of failure on plant operation. Indirect effects include failure
consequences affecting other SSCs or piping segments, such as:

1. Pipe whip;

2. Jet impingement;

3. Decompression waves;

4. Flooding;

5. High environmental temperatures, etc.;

6. Loss of inventory.

It is recognised that indirect effects of passive component boundary failures may have a significant
influence on the consequence and it is therefore required that such effects are explicitly taken into
account. Spatial consequences (or area events) are determined based on the location of the failure and
relative position of important equipment and it is recommended that the analyses are confirmed by a
walk-down.

The FMEA should include the evaluation of consequences for several leak sizes (normally 2 or 3 sizes
are sufficient), and the analysis should address the possibility to isolate the leak or break. Both automatic
and manual isolation should be considered. Considerations of leak detection are discussed in Sub-
section 4.9.4.

The extent to which the findings of the FMEA can be incorporated in the PSA model for the quantitative
consequence evaluation depends on the PSA and plant-specific issues. Issues not explicitly included in
the PSA model should be judged qualitatively and be taken into account in the final review and
adjustment of the consequence ranking.

The base PSA does not usually include models of passive component failures that could result in the
loss of mitigating ability (e.g. safety system pipe break). A way to address these situations is to identify
basic events or groups of events already modelled in the PSA, whose failure captures the effects of a
piping segment failure. This method is sometimes called the ‘surrogate component approach’.

European Framework Document for Risk-Informed In-Service Inspection 13

The use of the plant-specific PSA for consequence assessment in RI-ISI analysis can be summarised
as follows:

a) The PSA model and success criteria are used to define safety functions and backup trains.

b) PSA results for all initiators are applied directly for relevant consequence impacts.

c) PSA system and/or train unavailability are used to determine the reliability of mitigative
equipment given a pressure boundary failure.

d) Internal flood analysis results are used in the analysis of spatial effects.

e) Shutdown PSA, if available, is used in the evaluation of other modes of operation.

f) Level 2 PSA results can be used to identify event sequences that provide the dominant
contribution to containment performance (e.g. LERF) with respect to pipework failures, as
applicable.

4.9 Risk Characterisation and Ranking

This sub-section provides guidance on how the risk characterisation and ranking may be developed to
support the establishment of an ISI programme. As already stated, risk is defined in engineering terms
as the product of the measure of the consequence resulting from a failure and the probability of that
failure occurring within a given period of time. Combining the information from the POF assessments
and the consequence analyses forms the basis for the risk ranking. The risk ranking may be carried out
at both element/component level and segment/group level.

4.9.1 Graphical Representation of Risk

Each segment or element can be ranked from highest to lowest according to its risk level. For evaluation
of the risk it is useful to represent it in a graphical way by developing risk plots, risk matrices or Pareto
risk diagrams.

In risk plots, each component is represented as a point on a log-log plot. The COF can be represented
on the x-axis (the abscissa of the point). The POF can be represented on the y-axis (the ordinate of the
point). Figure 2 shows an example of a risk plot, with illustrative scales for the POF per year, and for the
consequence measured as the conditional CDP.

A risk plot provides a picture of how the risk is distributed over the range of consequences. When using
log-log axes, locations of constant risk are identified by straight lines. Parallel lines of constant risk can
be drawn at fixed distances apart, identifying risk bands (for example decades), see Figure 2. This
visualises the risk situation and helps with ranking, among all considered components and hazards, and
for the assessed time instant.

In a qualitative approach, POF and COF are not numerically evaluated in absolute terms, but are
classified using either a qualitative scale such as high, medium, low, or broad categories such as from
10-3 to 10-4 etc. In this case, a risk matrix can be used to represent different risk situations as shown in
Table 1 (the values are purely illustrative and should in no way be taken as a requirement). Each
component may be entered in its classified position in the matrix.

European Framework Document for Risk-Informed In-Service Inspection 14

 -2
10

-3
10

-4
Probability of Failure

10

-5
10

-6
10

-7
10

-8
10
-8 -7 -6 -5 -4 -3 -2
10 10 10 10 10 10 10
Consequence of Failure

Figure 2: Illustration of a risk plot

Table 1: Risk Matrix (the values in this table are purely illustrative).

Conditional Consequence

Very Very
Low Medium High
Low High

<10-6 10-6-10-5 10-5-10-4 10-4-10-3 >10-3

Very
>10-4
High
Probability of Failure

High 10-5-10-4

Medium 10-6-10-5

Low 10-7-10-6

Very
<10-7
Low

An additional way to graphically represent the risk distribution in a system is by means of Pareto diagram.
A Pareto risk diagram shows the risk from individual components ranked in a descending order in the
form of histograms. See examples of Pareto diagrams (linear and logarithmic) in Figure 3. The Pareto
plot is for example illustrative when evaluating the Risk Reduction Worth (RRW), commonly used in PSA
technology, as discussed in [7].

The Pareto diagram gives a ready impression of the risk distribution and the risk level of the components
being inspected. However, the risk plot and risk matrix are probably better graphical representations
with regards to inspection planning. These are more informative since they also show if the risk is
governed by the POF or by its consequence. It may be noted that ISI is a preventive action for early
detection of any degradation. Inspections can reduce the POF, but to reduce the consequence other
actions are needed. Further, ‘High consequence–low probability’ locations require different
considerations than ‘high probability–low consequence’ locations even if they have an equal risk. In

European Framework Document for Risk-Informed In-Service Inspection 15

general, larger uncertainties are associated with more rare situations. This issue is further discussed in
Sub-sections 4.9.3.3 and 4.9.3.4.

Linear Pareto Diagram

1

0.9

0.8

0.7

0.6
Relative Risk

0.5

0.4

0.3

0.2

0.1

0
10 20 30 40 50 60 70
Inspection Sites

Logarithmic Pareto Diagram

1

0.9

0.8

0.7

0.6
Relative Risk

0.5

0.4

0.3

0.2

0.1

0
10 20 30 40 50 60 70
Inspection Sites

Figure 3: Illustration of Pareto diagram for all inspection locations, using linear and logarithmic scales.

4.9.2 Sensitivity Analysis

Sensitivity studies should be performed to determine if changes in key data or assumptions could have
any significant impact on the rankings. These sensitivity studies should address the potential changes
in component ranking by varying the estimates of pressure boundary failures and estimates of the COF.
Also, crediting the effect of leak detection on the results should be investigated. These results should
then be integrated in the decision-making process.

The sensitivity studies can identify potential high risk components that exhibit significant shift in risk level
for changes in operational modes, PSA assumptions, data and other model uncertainties.

4.9.3 Identification of Safety Significant Locations

The development of a risk plot or ranking does not in itself identify all locations that could be said to be
safety-significant and additional considerations are needed. What follows is only advisory but provides
a possible structure regarding this process.

The first step in the process of determining risk-significant locations is the identification of risk outliers.
Risk outliers are locations that have a much higher risk than the overall mean risk level for all locations.
Outliers should be treated as recommended in Sub-section 4.9.3.1.

The next step consists of identifying components and locations that should be included in the inspection
programme based on the applied risk criteria. The decision criteria may be based on relative risk or on
absolute risk levels. Generally, more inspections are performed for high risk components than for those
associated with lower risk. For identification based on relative risk, a risk level can be defined relative to
the highest risk (excluding any outliers) in order to capture significant locations. Locations falling above
this risk level are considered as potentially safety-significant. No specific relative risk level is given here
since different factors may need to be considered for different utilities and different regulatory bodies.

European Framework Document for Risk-Informed In-Service Inspection 16

Among such factors are for example the risk distribution of the plant, the definition of risk outliers, the
nature of risk associated with each location, the ambition the utility has with its RI-ISI programme and
national regulatory requirements. Further, the total change in risk on a system level is often evaluated
and risk neutrality may be required, and this may result in correction of the risk level separating
potentially safety-significant locations.

When identifying locations to include in the inspection programme, it must be borne in mind that ISI
leads to radiation exposure to the inspection personnel. Each combination of ISI programme is
associated with a certain radiation exposure. In principle, it is possible to develop ISI programmes with
the same risk reduction but with different total radiation exposure. When faced with such choice, the RI-
ISI programme that gives as little radiation exposure as possible should be chosen, according to the As-
Low-As-Reasonably-Practical (ALARP) principle.

If the RI-ISI analysis is done at segment level, the evaluation of safety significance is done first at
segment level. In this case, the POF and probability of consequence are evaluated for a representative
worst element within the segment. The risk associated with such elements also approximates the risk of
the other elements within the segment.

Locations characterized by High Consequence and Low Probability generally need special consideration
due to uncertainties, as discussed further in 4.9.3.3.

Having identified the potentially safety-significant locations for a RI-ISI programme, it is recommended
that an expert panel is used to review the proposed selection of locations. This panel should review the
information, analysis and insights that have been used to identify the safety-significant locations.

It is also important to investigate alternative, or complementing, possibilities for mitigation against the
risk, based on the nature of the damage mechanism and risk associated with each location. It may be
possible to identify ways other than inspection to address the risk level. This may be especially true for
High Consequence – Low POF locations.

4.9.3.1 Risk Outliers

A risk outlier is a location with an associated risk level much higher than the overall risk level for most of
the locations. Risk outliers, the few locations dominating the overall risk, should be treated carefully to
avoid giving a skewed view of the risk distribution.

The occurrence of risk outliers should be seen as locations requiring special treatment and the locations
have to be separated from the rest of the locations when using relative risk criteria. Inspection alone
may not be considered sufficient to address the risk from these high risk locations, and consideration
should be given to other complementary methods such as redesign, continuous monitoring, new or
improved operator actions (e.g. detection/isolation of the break), improved leak rate detection, load
reduction or component replacement or re-location. Reducing risk outliers can result in a more uniform
risk distribution and help assure redundancy and DiD.

4.9.3.2 Flat Risk Distribution

There are situations where the method of identifying a specific risk band to determine which locations
are safety-significant is not applicable. One such situation would occur when using a criterion based on
relative risk and the risk distribution across the plant is very flat. In this case the Pareto diagram, see
Sub-section 4.9.1, would show a flat distribution across all the locations. The risk plot would show that
most of the locations having the highest risk fall in the same narrow risk band. Relative risk may then no
longer result in a clear differentiation between locations for inspection. One possible option could be to
weight the selected locations for inspection with focus towards higher consequence, with possibly some
random inspections.

4.9.3.3 High Consequence – Low Probability of Failure Locations

It is recognised that locations characterised by high consequence and low POF can be of concern for
reasons of uncertainties, even if the risk at the location is moderate in absolute or relative terms. Such
locations would fall in the lower right hand corner of a risk plot, see Figure 4. The plot is purely illustrative

European Framework Document for Risk-Informed In-Service Inspection 17

and the way the regions are represented should in no way be taken as a requirement. Note that these
locations are not identified by the Pareto plot or the RRW measure.

Hazards in this area of the risk matrix naturally involve large uncertainties in both the estimated
consequence and the estimated POF. For these reasons, it is suggested to apply a suitable lower risk
level for identification of safety-significant locations, see Figure 4. It is recognised that confidence can
be a challenge when the component’s POF is well below the level for which there is practical experience.
Inspection of locations in this area of the risk plot provides additional confidence in the estimated POF.
Inspection is also valuable to address unexpected (or unknown) degradation mechanisms that could
challenge the integrity of the component. This provides an element of conceptual DiD. For items in this
area of the risk matrix it is recommended to complement ISI with other preventive measures with the
purpose to reduce the risk, for example monitoring of temperatures, corrosive environment and strains,
local leak detection and also research and laboratory work to quantify potential degradation mechanisms.

Very low POF implies that there is no experience of damages and failure over the lifetime of the
component. The setting of inspection qualification goals is therefore not a straightforward matter. The
approach may vary, depending upon circumstances and regulatory requirements, but generally it is
sensible to postulate the least unlikely mechanism.

4.9.3.4 High Probability of Failure – Low Consequence Locations

Despite their low consequence (low CCDP), components falling in the upper left corner of the risk plot
in Figure 4 are risk-significant due to their high POF. However, in these cases inspections may also be
justified in order to maintain plant availability or to improve workers’ safety. Since the POF is high,
inspection may be even more important for these reasons than for nuclear safety. In order to evaluate
this, additional consequence assessments are needed for these locations, with respect to other
consequence measures such as workers’ safety and availability (production losses), in addition to CCDP.
Inspection related costs can be compared to the financial benefit obtained from improved plant reliability
due to risk reduction from ISI. This may result in more items included from this region of the risk plot,
see illustration in Figure 4.

For these locations, specification of a defect type and size for ISI and qualification can be made to a
clearly identifiable damage mechanism.

-2
10

-3
10

-4
Probability of Failure

10

-5
10

-6
10

-7
10

-8
10
-8 -7 -6 -5 -4 -3 -2
10 10 10 10 10 10 10
Consequence of Failure
Figure 4: Risk plot illustrating two regions that can require separate considerations; the region of high
consequence - low probability objects, and the region of high probability - low consequence objects.

European Framework Document for Risk-Informed In-Service Inspection 18

 4.9.4 Leak Detection
Degradation mechanisms can result in leakages of different sizes, and in many cases leakages gradually
increase with time. Smaller leakages are easier to manage, and consequence analysis by PSA models
shows that different leak sizes correspond to large differences in CCDP. Thus, early detection of leakage
is valuable. The consequence level may be estimated for two or three leak sizes scenarios. In the risk
assessment, the probabilities of failure resulting in small leakage or large leakage are then combined
with the different consequence levels.

Extensive experience accumulated over years of operation has shown that failure in very few cases
occur catastrophically (guillotine break), but rather in the form of a smaller leak for most degradation
mechanisms. This is because if a crack grows to a through-wall configuration, then it is likely that the
leakage is detected by the plant leak monitoring systems, operator walk-downs or ISI, before the crack
grows to a size that would result in total rupture and large leakage. On the other hand, for the degradation
mechanism flow-accelerated corrosion (FAC), no small leakages are expected.

In some plants leak detection functions are part of the reactor protection system, as they automatically
initiate the plant safety function if the leak rate exceeds a specified value. Furthermore, operating
procedures give the operators guidance on how to act when leakage increases above certain rates.

For cases when leak-before-break is likely for the specific degradation mechanism and loads, the
probability of large leak (or rupture) is affected by the capability to detect small leakage, before
developing to a large leak. The leak detection capability will influence the scenario at leakage and
consequently will influence the estimated POF and the resulting consequences.

RI-ISI analyses can include the effects of leak-detection, both for scenarios resulting in actuation of
automatic safety functions and of manual actions. The reliability of leak detection and related actions
could be quantified in the consequence evaluation and the leak size in the POF evaluation, and then
combined in a proper way. Alternatively the leak detection may be included as a model within the SRM
applied for evaluation of the failure probability. The RI-ISI documentation should describe how the effect
of leak detection is modelled.

Within the RI-ISI framework, some studies [7] [24] have shown that neglecting leak rate detection in the
assessment of POF may cause a distorted view of the risk situation and result in unjustified focus on
low-risk components for inspection selection. Since the rupture and large leak probabilities will approach
the small leak probabilities, it will be more difficult to identify the highest risk locations.

When crediting leak detection, care should be taken to ensure that realistic data is used, and not
conservative or non-conservative assumptions. Leak rate detection credited when evaluating the POF
has to be commensurate with the leak detection capabilities and operating procedures for the plant.
Adequate models of crack opening areas, leak flow rates and leak flow rate detection should be used.
The reliability of the leak detection capability should be assessed and documented, and its impact on
the results should be documented as well.

Experience has shown that crediting leak detection may result in RI-ISI programmes with much less
inspection required for piping located inside containment. This increases the requirement on qualifying
and maintaining a high leak detection capability. Leak detection with the purpose to early reveal
degradation can contribute to large risk reductions, especially when also accounting the large difference
in COF for small versus large leakage. Sensitive leak detection systems may be installed locally at
certain components, for example based on moisture and temperature measurements.

In areas without leak detection systems, leaks may be detected by walk-around or by means of other
alarms. In the analysis of failure probabilities, the probability of leak detection may be estimated also for
elements or segments at such locations. It is however recognised that a reliable and consistent
assessment of leak detection from walk-arounds is a difficult task that carries large uncertainties.

When estimating the POF, it is recommended to perform sensitivity analysis to investigate the effect of
both crediting and not crediting leak detection, and for different detection capabilities.

European Framework Document for Risk-Informed In-Service Inspection 19

 4.10 Selection of items for the RI-ISI Programme
The first step to define a RI-ISI programme consists of identifying the possible existence of risk outliers,
as described in section 4.9.3.1. The next step is to identify the items and positions that are significant to
the risk level. The risk criteria may be based on absolute risk levels or on relative risk. It was recognised
in section 4.4 that it is challenging to demonstrate that the assessed levels of risk are true in absolute
terms. For this reason, it can be beneficial to use an approach based on relative risk ranking, as
described in section 4.9.3.

After having identified items and positions with significant risk contribution, additional considerations
may be necessary, especially for positions that have moderate risk levels. Other considerations beyond
safety-risk include radiation dose, alternative locations with better accessibility, and the inspection costs.
The scope of the RI-ISI programme may also need to be complemented with locations requiring
inspection in order to meet other legal requirements, for instance in relation to the safety protection of
workers.

For the planning of ISI and complementing actions, the equipment may be evaluated according to
characteristics of the risk. Locations that have a low POF but high consequence should be considered
as discussed in Sub-section 4.9.3.3. This area of the risk plot involves higher uncertainties and a lower
risk criterion may be applied for identification, since inspections are important for the continuous
assurance that the assumptions of the analysis remain valid. Locations with low consequence but high
POF may need additional assessment of other than nuclear safety-related consequences, as discussed
in Sub-section 4.9.3.4.

When moving to a RI-ISI programme it is sometimes required that at least risk neutrality should be
achieved. After having established an initial selection of locations, the risk associated with the selected
elements should be compared with the risk associated with the current ISI programme. The total risk
level should be equal or lower than the level by the current ISI programme. This may imply iterative
adjustment of the risk criteria applied for separating risk-significant locations.

The risk reduction achieved by ISI and other measures is not only dependent on the initial risk level, but
also on the rate of degradation, the tolerance to defects, and the capability and frequency of inspections.
The issue of risk reduction is discussed in more detail in the next section.

4.11 Risk Reduction through ISI

Risk reduction through implementation of RI-ISI is achieved through several means. Examples include
increasing the number of inspections at identified high risk locations, tailoring the inspection techniques
to the degradation mechanism predicted (i.e. inspection for cause), altering the inspection interval in
relation to potential rate of degradation and tolerance to damage, identifying the appropriate examination
volume and improvements to the reliability of the NDT method.

To gain confidence that the proposed new ISI programme is at least as effective as the current ISI
programme in reducing risk, it is recommended that the two programmes are compared, considering the
inputs to the POF estimates, the inspection intervals, and inspection capability. References [24]-[27]
provide additional information on the assessment of the change in risk. This process is also called a
delta risk assessment.

In addition to risk neutrality, sometimes acceptable risk reduction is also evaluated using the ALARP
principle. This involves weighing the risk cost against the cost needed to prevent and control it, in order
to judge whether it would be disproportionately expensive to implement measures for further risk
reduction, compared to the benefits of risk reduction that would be achieved.

The sensitivity of the risk change to the inputs should also be investigated. This could include sensitivity
to assumed degradation rates, loads and damage tolerance, inspection intervals, and inspection
capability. These analyses could be used the other way around, to identify the level of inspection interval
and capability required for achieving sufficient risk reduction

As discussed previously, performance of ISI will not change the COF. Consequently, the assessment of
risk reduction from ISI is linked to the estimated POF with its influencing parameters for degradation,

European Framework Document for Risk-Informed In-Service Inspection 20

defect tolerance and inspection efficiency. For an active degradation mechanism ISI can confirm the
rate of degradation, which may have been assessed based on a general corrosion rate. A potential
degradation mechanism may initiate after long operational time due to susceptibility to variations in the
operating environment, or may evolve very nonlinearly by time. ISI will decrease the uncertainty about
the status of the equipment and therefore the assessed POF could decrease after an inspection.

The effect from ISI is dependent on the detection capability of the applied inspection system, the
coverage, and the selected time interval between inspections. The degree of risk reduction achieved by
the ISI will furthermore depend on the dynamics of the potential degradation and the tolerance to defects
under possible upset loads for the actual item.

4.11.1 Inspection Interval and Inspection Method

Inspection intervals are determined with the purpose to ensure that degradation is detected at an early
stage before it results in leakage or failure. After locations for inspection have been identified and
selected based on risk, the inspection interval and the NDT system to apply should be determined for
each location or group of items.

Inspection techniques need to be selected carefully to ensure effective detection of the predicted types
of (active or potential) degradation. The inspection technique has to be suitable for the targeted
degradation mechanism with respect to type of defect, characteristics of the defect, and coverage of
local regions that have been identified to potentially be degraded.

ISI intervals may be based on general prescriptive rules, which are based on historical operating
experience and judgments for different equipment and operating conditions. These types of rules have
to be conservative since they need to cover the full range of situations. Improved adaptation of intervals
may be established by further analysis.

An established approach to determine inspection intervals is based on deterministic damage tolerance

analysis, see e.g. ASME XI [28], R6 [29], BS7910 [30] and SSM 2018:18 [31]. The advantage of this
approach is that the method will consider information available for degradation growth, the actual
damage tolerance of the component, and will consider the detection capability (qualification defect size)
of the inspection system used. In this case established deterministic safety margins will influence the
interval. The damage tolerance analysis will consider the plant specific conditions for geometry, loads,
residual stresses, environment and materials, for the actual item or group, together with the capability
for applied NDT systems.

Inspection intervals can also be evaluated by use of probabilistic principles and validated SRM
approaches including data and models for POD. In this case the established risk criteria will influence
the interval. Development is ongoing in this area and attention to uncertainties in models and criteria is
important. For the decision on ISI intervals, results from probabilistic analyses may be combined with
results from deterministic analyses. For example, the probabilistic results may support adjustment
factors for the deterministic intervals.

It is recommended to assess and quantify the change in risk by the proposed new ISI programme,
considering the influence from different inspection intervals and NDT capability.

4.11.2 Inspection Qualification

ENIQ has established a methodology for inspection qualification [2] and it is recommended that this
approach is adopted.

An essential input to the ENIQ qualification process is the identification of appropriate inspection
qualification requirements defining the defects of concern for which the capability of detection and sizing
is to be demonstrated. The ENIQ qualification process, if followed to a successful outcome, provides
high confidence that the inspection system can achieve the inspection qualification requirements for
defect detection and sizing. An important point to note is that the process does not provide a quantitative
measure of inspection efficiency, but the output statement from the process is expressed in linguistic

European Framework Document for Risk-Informed In-Service Inspection 21

terms such as ‘highly reliable’ or ‘highly efficient’. However, subsequently developed documents [32],
[33] have described methodology to extract POD data from qualification efforts.

If a validated SRM can be used, the target qualification defect size may be determined so that the
proposed inspection programme aims at reducing the POF of the inspected items by a certain degree
(see [34]). Simplified but realistic quantitative estimates of POD curves could facilitate this.
Consideration could also be given to assess the efficiency in striving for smaller qualification size with
the aim to reduce risk even further but without incurring high costs. The effect on risk reduction can be
evaluated for a considered group of components (typical geometries and operating conditions) to
determine if a smaller detection target will have a significant effect.

4.11.3 Complementing and Alternative Measures for Risk Reduction

In order to efficiently reduce the risk from degradation in a system, it is important to apply measures that
complement ISI. Some measures are needed to monitor changes in the operating parameters and
ensure that important assumptions behind the decisions for the ISI programme are valid. Other
measures may be needed to cover cases when ISI by NDT is ineffective or impossible. The risk reduction
achieved by complementing and alternative measures to ISI is dependent on the nature of the
degradation and damage mechanism, the uncertainties in rate of degradation, loads and other main
influencing parameters.

Examples of measures that complement ISI or may be possible alternatives include:

 Regular sampling and/or monitoring of operational environment. This is an essential basis for
the degradation assessments when developing the RI-ISI;

 Water chemistry monitoring, action levels on water chemistry data with respect to different
degradation mechanisms, filtering to remove impurities, water treatment;

 Local leak monitoring (by moisture, temperature, etc.);

 Local load and temperature monitoring, for estimation of fatigue damage (e.g. vibration, or leak
at standby valve), or effect from occasional loads (e.g. steam collapse);

 Experimental work to quantify and confirm degradation rates;

 Experimental and numerical work to confirm and quantify residual stress fields, which can have
profound effect on SCC;

 Review and functional testing of safeguards that limit loads and temperature, as safety relief
valves and snubbers. Limited pressure is an essential assumption when developing the RI-ISI;

 Material sampling or replica tests to confirm or follow damage or micro structural changes;

 R&D to identify degradation mechanisms;

 Operator instructions and training to prevent or reduce the severity of upset events;

 Surface coatings and linings, improved paint systems and isolation systems, surface treatment
for residual stress improvement;

 Review of design and material selection at repairs, modifications, and new-build;

 PSI to establish a fingerprint for future NDT;

 New or revised operating procedures to increase the likelihood of isolating a postulated break;

 Plant modifications to reduce the consequence of a pipe break (e.g. flow restricting orifice or
pipe whip restraints).

European Framework Document for Risk-Informed In-Service Inspection 22

 4.12 Regular Updating for a Living RI-ISI Programme
The risk assessment provides the risk distribution at a given point in time. It is recommended that the
risk assessment is updated regularly so that it reflects as accurately as possible, the distribution of risk
for the evaluated systems at the time of the ISI. To ensure that this is the case, consideration of all
currently available plant knowledge has to be carried out on a regular basis. An effective risk-informed
inspection strategy also requires the development of a feedback procedure for updating the risk ranking
based on inspection results, new knowledge or after any plant changes affecting the probabilities of
failure or consequences of failure.

The RI-ISI programme should be re-evaluated as new information affecting the programme becomes
available, such as system or component design change, plant operating condition changes, plant PSA
changes, industry-wide failure notifications, etc.

The information gathered after inspections have been completed is also very relevant as it increases
the knowledge of the plant condition, even if no acting damage mechanism is found. This information
may influence the assessment of the POF as more data is known (i.e. less uncertainty), concerning the
presence or absence of a degradation mechanism.

This living process with recurrent updating is one of the strengths of the risk-informed approach, as it
leads to a process that is responsive to operating experiences and emerging problems.

If evidence of damage is found by inspection it is assumed that actions are taken to reduce the risk.
These actions include component replacement, repair, or fitness-for-purpose assessments.
Fitness-for-purpose assessment may justify continued operation coupled with prescriptive follow-up
inspections (or monitoring) of the affected locations. An assessment should also be carried out to
determine the root cause for the damage and whether the defect is due to particular conditions at the
detected location or if the conditions can occur more widespread in the plant. In the latter case, additional
examinations should be carried out to determine the possible extent of the condition.

Validation of the assessment methodology is important and the question must be posed as to whether
the occurrence of the degradation was in line with the prediction when the risk was assessed prior to
inspection. If the answer to this question is negative, then the models and assessments that were used
to evaluate the POF need to be reassessed.

Even if no evidence of defects is found after the performance of a certain number of inspections, it is
still very important to consider the meaning of these results. One critical issue is the capability of the
applied inspection technique (see Sub-section 4.11.2 for a discussion on inspection qualification).
Another issue could be conservative assumptions and data used in the evaluation of failure probability
(e.g. for DiD purposes). However, it is emphasised that for components with low failure probability, it is
expected and useful that the inspections essentially results in no findings, since this confirms the
condition of no active degradation mechanism.

Plant changes and updates to the PSA models may affect the estimated COF. For update of the COF,
some guidance regarding living PSA can be found in [35], [36]. For an example of guidance on living
programme concerning RI-ISI see [37].

4.13 RI-ISI for Long Term Operation

Plants entering Long Term Operation (LTO), beyond the initial plant design life, should re-evaluate their
RI-ISI programme to incorporate any new considerations that may be relevant due to the extended
operation. Examples include additional fatigue cycles, environmental effects on fatigue life, thermal
aging and embrittlement.

Re-assessments should be performed for mechanisms such as SCC and FAC to consider actual
conditions and any new knowledge, e.g. loads due to power uprates, new knowledge about loads or
residual stresses, new information on susceptibility and degradation rates, or improved NDT capabilities.
Existing work processes for the continuous management of ageing and degradation will proceed during
LTO, but increasing severities can be expected at long operational times. Thus, there is an increasing
need for efficient processes for developing well adapted ISI programmes, and RI-ISI can be very useful.

European Framework Document for Risk-Informed In-Service Inspection 23

Generally, application of risk principles may help achieving balanced efforts in a LTO work process by
ensuring allocation of resources in proportion to safety-importance. ISI and other preventive actions are
increasingly important and should be balanced in relation to equipment risk level and uncertainties, in
order to focus on items, degradation mechanisms and hazards that can have real effect on safety and
reliability.

5. Organisation and Responsibilities

5.1 Introduction
The overall responsibility for the RI-IS programme lies with the plant operator (licensee).

In this section the roles, responsibilities and interfaces of the different parties involved in the creation of
a RI-ISI programme are described.

It is recognised that utilities in different countries have different structures that vary in detail. Hence, what
follows is a suggested management structure and interfaces that can be used as a guide for a typical
organisation in order to implement a RI-ISI programme.

5.2 Outline of Management Structure

The main parties and personnel involved are as follows:

1. RI-ISI Responsible Person;

2. RI-ISI Advisory Panel;

3. RI-ISI Team;

4. RI-ISI Review Panel;

5. Inspection Qualification Team.

An example of a reporting chain of the responsible parties/personnel is shown in Figure 5.

European Framework Document for Risk-Informed In-Service Inspection 24

 RI-ISI Process

RI-ISI Responsible
Person (Safety Director
or equivalent)
Independent Advisory
Panel

Inspection Qualification Chairperson QA

Team
Review Panel
RI-ISI Team:
Systems
Operations
PSA
Inspection
Structural Integrity
Reliability
……..

Figure 5: Reporting Chain Identifying the Main Responsibilities in a RI-ISI Process.

5.3 Definition of Responsibilities

5.3.1 The RI-ISI Responsible Person
The RI-ISI Responsible Person is responsible for setting the boundary and scope of the RI-ISI
programme. The person is ultimately responsible for the acceptance of the final RI-ISI programme, and
for these reasons the Responsible Person should be a senior employee of the utility. Another way to
address the setting for boundary and scope is that a proposal developed by the RI-ISI team is presented
for an Expert Panel who will approve the final scope.

The Responsible Person will ensure that sufficient resources are made available for the full RI-ISI
process, all the way to the final Inspection Qualification and data archiving of the proposed inspections.
The Responsible Person will form the RI-ISI team and appoint its chairperson. It will then be the RI-ISI
team responsibility to recommend a RI-ISI programme to the Responsible Person. In order to assist the
Responsible Person in accepting the proposed RI-ISI programme, he or she may wish to form a RI-ISI
Advisory Panel, appointing senior advisors.

5.3.2 The RI-ISI Independent Advisory Panel

The responsibility of the Advisory Panel is to counsel the Responsible Person with regard to any areas
of the proposed RI-ISI programme that in its opinion are questionable, be it from the analytical modelling
used, possible omissions, external considerations, etc.

The Advisory Panel should not have the power to change the risk rankings or, more specifically, change
how the probabilities or consequences of failure and hence the risk are derived. It may recommend
changes, verification of the work carried out, etc.

The panel should raise any questions or concerns associated with ISI that may not be directly described
in terms of the parameters used to measure the failure or consequence aspects in the risk-informed
methodology adopted. This may include any political or public concerns that cannot be uniquely
described in terms of the consequence.

European Framework Document for Risk-Informed In-Service Inspection 25

The RI-ISI Advisory Panel should be independent from commercial or operational considerations.
Representatives from the regulator could attend meetings of the panel as observers.

5.3.3 The RI-ISI Team

The RI-ISI team will need to be a multi-disciplinary team, with expertise including inspection, design,
materials, chemistry, stress analysis, systems, PSA, operations, maintenance, quality and safety.

The RI-ISI team has the responsibility of developing the RI-ISI programme and following it through to its
implementation. It is responsible for co-ordinating the required effort within the utility, to produce the
necessary documentation, compile the RI-ISI dossier and ensure that the relevant QA procedures are
followed and records kept.

It is the responsibility of this team, via the authority of the RI-ISI Responsible Person, to demand that
the relevant departments within the utility provide the necessary support to generate a RI-ISI programme.
This support will be required to produce a ranking of the probabilities of failure and the consequences
for all the probable inspection locations within the defined ISI boundary. The team will be responsible
for setting up expert elicitation exercises when required and ensuring an adequate interchange between
the various experts required for a RI-ISI programme.

The RI-ISI Team will present for review its POF and COF rankings to the RI-ISI Review Panel. It also
has ultimate responsibility for the finalisation of the rankings of POF and COF, and for integrating such
rankings in order to construct a risk plot for all the locations within the scope of the exercise.

The RI-ISI team will establish risk acceptance criteria, and ensure acceptance from the Regulatory Body.

The RI-ISI team will outline an inspection programme based on estimated risk levels, risk acceptance
criteria and taking into due account:

1. Risk outliers;

2. High consequence-low probability locations;

3. Uncertainties associated with the models, etc.;

4. DiD considerations.

In doing so, the team will also interface with the Inspection Qualification team to assess that the
proposed inspection locations are both practical in the sense of carrying out the inspection and that there
is a realistic chance of providing an inspection qualified according to the European methodology for
qualification of NDT.

The RI-ISI team will present the RI-ISI programme for approval to the Responsible Person.

5.3.4 The RI-ISI Review Panel

The purpose of the Review Panel is to provide an essential independent element in the QA process.

The Review Panel should contain experts in the relevant areas that are independent from those
belonging to the RI-ISI team. Such experts could be from either inside or outside the utility. Their
independence must be ensured in the sense that they should not have been at any stage involved in
the generation of the basic POF and COF data to be assessed.

The critical task of the Review Panel is to review the work carried out by the utility (RI-ISI team) in
deriving the estimates of POF and COF.

As a part of the RI-ISI process, the RI-ISI team should provide the Review Panel with draft POF and
COF rankings, plus details regarding the assumptions made and the calculations carried out. The
members of the Review Panel should be in dialogue with the RI-ISI Team to agree a final risk ranking.
The RI-ISI team will ultimately be responsible for the finalisation of the estimated probabilities of failure
and consequences of failure.

European Framework Document for Risk-Informed In-Service Inspection 26

The Review Panel should use all the pertinent probabilistic and deterministic data provided by the RI-
ISI team plus any world data available, together with their own expertise and experience.

5.3.5 The Inspection Qualification Team

The Inspection Qualification team has the responsibility of advising the RI-ISI team with regard to the
feasibility of achieving the specified NDT capability for a proposed ISI programme. It should be clearly
understood that the Inspection Qualification team cannot, at this time, guarantee that any subsequent
inspection qualification against the specified requirements will be successful.

5.3.6 The Regulatory Body

The Regulatory Body is assigned the task of monitoring and evaluating safety and of ensuring that the
licensee fulfils the conditions of its location licenses.

In the context of a safety-driven RI-ISI programme, the Regulatory Body either defines or reviews the
basic safety requirements that must be met.

The Regulatory Body also undertakes audits, periodic reviews and monitors the licensee’s compliance
with the safety requirements. To these ends the Regulatory Body may wish to observe the development
of any safety-driven RI-ISI programme. For instance, the Regulatory Body may wish to participate with
the status of observer in the RI-ISI Advisory Body meetings.

While the relationship between each plant operator and its regulator may be country specific, the
experience with several European RI-ISI applications has shown that having early engagement with the
regulatory body is very beneficial.

6. Documentation and Archiving

6.1 RI-ISI Programme Dossier
The RI-ISI team will prepare the RI-ISI dossier which should contain all information related to the whole
process of risk-informed inspection planning and should comprise at least the following:

1. Nomination of the personnel involved in the process;

2. Scope of the RI-ISI programme;

3. Input data:

a) All data used in calculations (design specifications, historical plant data, etc.);

b) Assumptions made;

c) Models used;

d) PSA data;

e) Risk criteria used;

4. Output data:

a) Records of meetings of panels, etc.;

b) List of locations to be inspected;

c) Requirements for inspection qualification (including qualification level);

d) Subsequent analysis;

e) Further action required;

f) Risk change for locations inspected.

European Framework Document for Risk-Informed In-Service Inspection 27

If parts of this information cannot be included, precise references should be made in the RI-ISI dossier.

6.2 Obsolescence of Storage Medium

Problems associated with the future obsolescence of the medium used for storing the RI-ISI dossier
information should be properly addressed.

European Framework Document for Risk-Informed In-Service Inspection 28

REFERENCES
[1] ENIQ TGR Discussion Document on the Role of In-Service Inspection of the Reactor Pressure
Vessel, ENIQ Report no. 35, EUR 23419 EN, 2008.

[2] The European Methodology for Qualification of Non-Destructive Testing – Issue 4, ENIQ Report
no. 61, The NUGENIA Association, 2019.

[3] ENIQ Glossary of Terms – Issue 3, ENIQ Report no. 62, The NUGENIA Association, 2019.

[4] Benchmark Study on Risk-Informed In-Service Inspection Methodologies (RISMET),

NEA/CSNI/R(2010)13, EC-JRC/OECD-NEA, 2011.

[5] ASME Section II Materials, Part D Properties, Appendix A Issues associated with materials used
in ASME code construction, 2013.

[6] Ageing management for nuclear power plants - International Generic Ageing Lessons Learned
(IGALL), IAEA Safety Reports Series No. 82, IAEA, 2015.

[7] Nuclear Risk-Based Inspection Methodology for passive components (NURBIM), NURBIM Final
Report, EURATOM project FIKS-CT-2001-00172, 2004.

[8] ENIQ Recommended Practise 9: Verification and Validation of Structural Reliability Models and
Associated Software to Be Used in Risk-Informed In-Service Inspection Programmes - Issue 2,
ENIQ Report no. 52, The NUGENIA Association, 2017.

[9] ENIQ Recommended Practise 11: Guidance on Expert Panel in Risk-Informed In Service
Inspection - Issue 2, ENIQ Report No. 53, The NUGENIA Association, 2017.

[10] Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, Final Report, US
NRC NUREG-1150, Vol. 1-3, 1990.

[11] White Paper: Practical Insights and Lessons Learned on Implementing Expert Elicitation, US
NRC, October 13, 2016.

[12] Estimating Loss-of-Coolant Accident (LOCA) Frequencies through the Elicitation Process: Main
Report, US NRC NUREG-1829, Vol. 1, 2008.

[13] Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Power
Plants, US NRC, WASH-1400 (NUREG-75/014), 1975.

[14] WENRA Safety Reference Levels for Existing Reactors, Update in Relation to Lessons Learned
from TEPCO Fukushima Dai-Ichi Accident, Western European Nuclear Regulators Association
(WENRA), 2014.

[15] Nondestructive Evaluation: Probabilistic Risk Assessment Technical Adequacy Guidance for
Risk-Informed In-Service Inspection Programs, 1021467-A, EPRI, Palo Alto, CA, 2011.

[16] Individual Plant Examination for External Events (IPEEE) Seismic Insights: Revision to EPRI
Report TR-112932, EPRI report TR-1000895, 2000.

[17] Piping System Response During High-Level Simulated Seismic Tests at the Heissdampfreactor
Facility (SHAM Test Facility), NUREG/CR-5646, Idaho National Engineering Laboratory, 1992.

[18] An approach for using Probabilistic Risk Assessment (PRA) in risk-informed decision on plant-
specific changes to licensing basis, US NRC Regulatory Guide RG 1.174, 1998.

[19] ASME/ANS - Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications,
RA-Sb-2013, 2013.

European Framework Document for Risk-Informed In-Service Inspection 29

[20] Probabilistic Risk Assessment Peer Review Process Guidance, Revision A3, Nuclear Energy
Institute, NEI-00-02, 2002.

[21] A Framework for Quality Assurance Programme for PSA, IAEA-TECDOC-1101, 1999.

[22] Determining the quality of probabilistic safety assessment (PSA) for applications in nuclear
power plants, IAEA-TECDOC-1511, 2006.

[23] Review of Probabilistic Safety Assessments by Regulatory Bodies, IAEA Safety Reports Series
No. 25, 2002.

[24] Studies on the effect of flaw detection probability assumptions on risk reduction at inspection,
Report of NKS project PODRIS, Nordic Nuclear Safety Research, 2010.

[25] Westinghouse Owners Group Application of Risk-informed Methods to Piping Inservice

Inspection Topical Report, WCAP-14572, Revision 1-NP-A, Westinghouse Energy Systems,
Pittsburgh (PA), US, 1999.

[26] Revised Risk-Informed Inservice Inspection Procedure, TR-112657, Revision B-A, EPRI, Palo
Alto (CA), 1999.

[27] Justification of Risk Reduction through In-Service Inspection (REDUCE), WP2 & WP3; Analysis
of risk reduction by ISI for baseline cases and sensitivity analyses, FP7 project NUGENIA-
PLUS, EURATOM, 2016.

[28] ASME XI, ASME Boiler and Pressure Vessel Code, Section XI: Rules for In-service Inspection of
Nuclear Power Plant Components, 2017 Edition, The American Society of Mechanical
Engineers, USA, 2017.

[29] R6, Assessment of the Integrity of Structures Containing Defects, R6 – Revision 4, EDF Energy
Nuclear Generation Ltd, 2015.

[30] BS 7910, Guide to methods for assessing the acceptability of flaws in metallic structures, BS
7910:2013+A1:2015, The British Standards Institution, 2015.

[31] SSM 2018:18, Procedure for Safety Assessment of Components with Defects – Handbook
Edition 5, ISSN: 2000-0456, SSM Swedish Radiation Safety Authority, 2018.

[32] ENIQ TGR Technical Document: Probability of Detection Curves: Statistical Best-Practices,
ENIQ report no. 41, EUR 24429 EN, 2010.

[33] ENIQ TGR Technical Document: Influence of Sample Size and Other Factors on Hit/Miss
Probability of Detection Curves, ENIQ report no. 47, EUR 25200 EN, 2012.

[34] ENIQ Technical Report: Link Between Risk-Informed In-Service Inspection and Inspection
Qualification, ENIQ Report no. 36, EUR 23928 EN, 2009.

[35] Living Probabilistic Safety Assessment (LPSA), IAEA-TECDOC-1106, 1999.

[36] ENIQ TGR Discussion Document: Updating of Risk-informed In-Service Inspection

Programmes, ENIQ Report no. 37, EUR 23929 EN, 2009.

[37] Living Program Guidance to Maintain Risk-Informed In-service Inspection Programs for Nuclear
Plant Piping Systems, Nuclear Energy Institute, NEI 04-05, 2004.

European Framework Document for Risk-Informed In-Service Inspection 30

LIST OF ABBREVIATIONS

ALARP As-Low-As-Reasonably-Practicable
ASME American Society of Mechanical Engineers
CANDU Canadian Deuterium Uranium
CCDF Conditional Core Damage Frequency
CCDP Conditional Core Damage Probability
CCF Common Cause Failures
CDF Core Damage Frequency
CLERF Conditional Large Early Release Frequency
CLERP Conditional Large Early Release Probability
COF Consequence of Failure
DiD Defence-in-Depth
ENIQ European Network for Inspection and Qualification
EPRI Electric Power Research Institute
FAC Flow-Accelerated Corrosion
FMEA Failure Modes and Effects Analysis
IAEA International Atomic Energy Agency
ISI In-Service Inspection
LERF Large Early Release Frequency
LOCA Loss-of-Coolant Accident
LTO Long Tem Operation
NDT Non-Destructive Testing
NPP Nuclear Power Plant
PSI Pre-Service Inspection
POD Probability of Detection
POF Probability of Failure
PSA Probabilistic Safety Assessment
QA Quality Assurance
RBMK Reactor Bolshoy Moshchnosty Kanalny (Russian designed high-power channel reactor)
RI-ISI Risk-Informed In-Service Inspection
RPV Reactor Pressure Vessel
RRW Risk Reduction Worth
SCC Stress Corrosion Cracking
SSC Systems, Structures, and Components
SRM Structural Reliability Model
WENRA Western European Nuclear Regulators’ Association

European Framework Document for Risk-Informed In-Service Inspection 31

 Contributors to Drafting and Editing of Issue 2

Robertas Alzbutas Lithuanian Energy Institute (LEI) Lithuania

Otso Cronvall Technical Research Centre of Finland (VTT) Finland

Carlos Cueto-Felgueroso Tecnatom Spain

Jens Gunnars KIWA Inspecta Sweden

Anders Lejon Ringhals AB, Vattenfall Sweden

Patrick O´Regan Electric Power Research Institute (EPRI) United States of America

Tony Walker Inspection Validation Centre (IVC) / Wood Plc Great Britain

Kaisa Simola European Commission – Joint Research Centre European Commission

Oliver Martin European Commission – Joint Research Centre European Commission

Contributors to Drafting and Editing of Issue 1

R. Alzbutas (LEI, Lithuania), T. Billington (Westinghouse Energy System Europe, Belgium), B. Brickstad
(DNV and SKI, Sweden), O. J. V. Chapman (OJVC Associates, UK), J. Delgado (EPRI Europe, Spain),
C. Cueto-Felgueroso (Tecnatom S.A., Spain), A. Eriksson (EC-JRC), C. Faidy (EDF SEPTEN, France),
L. Gandossi (EC-JRC), M. Hallen (Ringhals AB, Vattenfall, Sweden), G. Hultqvist (Forsmark NPP,
Vattenfall, Sweden), L. Horáček (Nuclear Research Centre Rez, Czech Republic), W. Kohlpaintner
(E.ON Kernkraft, Germany), V. Kopustinskas (LEI, Lithuania), D. Lidbury (Serco Assurance, UK), J.
Lötman (Forsmark NPP, Vattenfall, Sweden), A. Mengolini (EC-JRC), P. O’Regan (EPRI, USA), H.
Schultz (GRS, Germany), B. Shepherd (Mitsui Babcock, UK), K. Simola (EC-JRC and VTT, Finland), J.
Slechten (Tractebel, Belgium), A. E. Walker (Rolls Royce Naval Marine, UK), A. Weyn (AIB Vinçotte,
Belgium).

Edited by O.J.V. Chapman, L., Gandossi, A. Mengolini, K. Simola, T. Eyre and A. E. Walker.

European Framework Document for Risk-Informed In-Service Inspection 32

ABOUT NUGENIA AND ENIQ

NUGENIA is an international non-profit association under Belgian law established in 2011. Dedicated to
the research and development of nuclear fission technologies, with a focus on Generation II & III nuclear
plants, it provides scientific and technical basis to the community by initiating and supporting
international R&D projects and programmes. The Association gathers member organisations from
industry, research, safety organisations and academia.

The activities of NUGENIA cover plant safety & risk assessment, severe accidents, reactor operation,
integrity assessment and ageing of systems, structures & components, development of fuel, waste &
spent fuel management & reactor decommissioning, innovative light water reactor design & technologies,
harmonisation and in-service inspection & their qualification.

The European Network for Inspection and Qualification (ENIQ) is a utility driven network working mainly
in the areas of qualification of non-destructive testing (NDT) systems and risk-informed in-service
inspection for nuclear power plants. Since its establishment in 1992 ENIQ has issued over 50 documents.
Among them are the “European Methodology for Qualification of Non-Destructive Testing” and the
“European Framework Document for Risk-Informed In-Service Inspection”. ENIQ is recognised as one
of the main contributors to today’s global qualification guidelines for in-service inspection. ENIQ became
Technical Area 8 of NUGENIA in 2012.