A Pilot Application Study on Risk-Informed In-Service Inspection Methods for Pipelines in HPR1000 Nuclear Power Plants: A Case Study of the RCV System

Abstract

Traditional in-service inspection (ISI) methods for pipelines have certain limitations in identifying pipeline leakages. When these methods are directly applied to the ISI of Hua-long pressurized reactor (HPR1000) nuclear power plants, where the system complexity has significantly increased, they may lead to insufficient inspection efficiency and an extremely heavy workload. In this study, based on the framework of typical risk-informed analysis methods for nuclear power plants in the industry and integrating domestic engineering practical experience, an optimized ISI model for pipelines in HPR1000 nuclear power plants was constructed, and a pilot application was carried out on the chemical and volume control system (RCV) of the primary circuit. The inspection strategy was optimized through a series of steps, including determining the analysis scope, conducting pipe segment failure analysis, constructing a risk matrix, selecting inspection elements, and assessing risk impacts. Case studies showed that the risk-informed in-service inspection (RI-ISI) method successfully classified over 3000 welds in the RCV system based on risk levels (high, medium, low). After optimization, 16 low-risk welds (risk level 7) and one of the two medium-risk welds (risk level 4) that originally required volumetric inspection were exempted from inspection. Quantitative risk analysis confirmed that the increments in core damage frequency (CDF) and large early-release frequency (LERF) caused by this optimization were far below the regulatory limits. This method significantly reduces the inspection burden of medium- and low-risk pipelines while ensuring that high-risk areas receive priority attention, providing important technical support for the safe and efficient operation and maintenance of HPR1000 and subsequent third-generation nuclear power units.

1. Introduction

The safe and stable operation of nuclear power plants is of strategic significance for national energy security and socioeconomic development. During their long-term service life, systems and equipment inside the nuclear island are continuously subjected to the combined effects of multiple harsh factors, such as stress, high temperature, and irradiation. These factors inevitably induce material aging, embrittlement, and fatigue damage, ultimately leading to crack initiation and propagation, posing potential threats to the safe operation of the plants. Such damage exhibits significant time-varying characteristics, and its development is complex and difficult to predict accurately. In view of this, nuclear safety regulatory authorities worldwide mandate that nuclear power plant operators develop and implement strict in-service inspection (ISI) programs to ensure the structural and functional integrity of equipment through regular inspections and evaluations.

Traditional in-service inspection (ISI) methods mainly follow deterministic specifications [1,2]. The core logic of these methods is to define the inspection scope and select specific inspection locations based on the nuclear safety classification (e.g., Class 1, Class 2, Class 3) of the inspected components and the results of theoretical stress analysis (usually assuming high-stress/high-fatigue areas). However, the effectiveness of this approach faces severe challenges. For instance, ISI requirements and practices rooted in the ASME Code fail to explicitly account for unique aspects of piping functionality, piping degradation mechanisms, weld integrity, fabrication details, and the extent of their contribution to the overall plant risk [3].

To overcome the limitations of traditional methods, the U.S. Nuclear Regulatory Commission (NRC) first proposed the concept of risk-informed in-service inspection (RI-ISI). The core innovation of this approach lies in the deep integration of PSA technology with deterministic requirements. The PSA model is used to quantitatively evaluate the impact of different pipeline failures on the core safety goals of nuclear power plants, namely core damage frequency (CDF) and large early-release frequency (LERF), thereby identifying high-risk areas and preferentially allocating inspection resources. The NRC has successively issued guidance documents such as RG 1.174 [4] and RG 1.178 [5] to provide regulatory basis for the engineering application of RI-ISI. In the industry, the Electric Power Research Institute (EPRI), Westinghouse Electric Corporation, and other organizations have led the development of recognized RI-ISI systems (such as EPRI TR-112657 [6] and its streamlined versions [7], WCAP-14572 [8]). Currently, RI-ISI is widely applied in many operating nuclear power plants globally [9,10], and this risk-informed application has also been listed as a successful example of risk-informed technology by the International Atomic Energy Agency (IAEA) [11].

Since 2010, China has gradually promoted the introduction and localized application of RI-ISI technology. The National Nuclear Safety Administration (NNSA) has issued relevant technical policies [12] and carried out pilot projects in improved second-generation nuclear power plants such as Daya Bay and Tianwan, accumulating valuable experience. However, existing research and practices mainly focus on second-generation and improved second-generation units. For China’s self-developed third-generation advanced pressurized water reactor nuclear power technology, the HPR1000, its system design is more complex (with a large number of additional SSCs related to safety mitigation and redundancy) and the safety requirements are more stringent. If the traditional comprehensive ISI method is directly applied, the number of welds to be inspected will surge and the inspection workload will increase exponentially, not only significantly reducing inspection efficiency but also causing serious waste of human, material, and time resources. Therefore, there is an urgent need to develop and validate an optimized RI-ISI scheme that is suitable for the technical characteristics and safety requirements of the HPR1000.

This study focuses on the chemical and volume control system (RCV), one of the core safety systems of HPR1000 nuclear power plants, aiming to address the above challenges. By closely combining the international advanced EPRI RI-ISI framework with China’s nuclear power engineering practice experience, a scientific, systematic, and highly operable optimized model for risk-informed pipeline ISI is constructed. Through systematic case studies and quantitative risk assessments, the feasibility of this method in significantly reducing the inspection burden while effectively ensuring and even enhancing the overall safety level of nuclear power plants is verified. This study provides core technical support and practical paradigms for the safe, economic, and efficient operation and maintenance of HPR1000 and future third-generation nuclear power units.

2. RI-ISI Methodology

2.1. Methodology Framework

This study adopted the EPRI TR-112657 [6] RI-ISI framework (Figure 1), integrating deterministic specifications with PSA. It optimized pipeline ISI strategies through steps including defining the analysis scope, conducting failure mode and effect analysis (FMEA) of pipe segments, characterizing risk segments, selecting elements and inspections, performing risk impact assessment, making adjustments to element selection and performance monitoring, and ensuring resources focused on areas with relatively high risks.

2.2. Determine RI-ISI Program Scope

Defining the scope of RI-ISI is the initial step in conducting RI-ISI studies. The objective of this step is to determine which specific pipelines will be included in the RI-ISI analysis. Typically, pipelines classified as nuclear safety Class 1, Class 2, and Class 3, along with other safety-significant pipeline systems, are selected. Alternatively, a single pipeline system or only Class 1 nuclear safety pipelines can be chosen. The specific determination should be made according to the requirements of a particular nuclear power plant and integrated with the scope of its specific PSA model. It should be noted that for pipeline systems not selected for the RI-ISI program, the original conventional in-service inspection requirements still apply.

2.3. FMEA of Pipe Segments

For the selected pipelines, an FMEA is performed, which includes the evaluation of pipeline degradation mechanisms and the assessment of pipeline failure consequences. Based on analysis of the results, the pipelines are divided into several segments. Specifically, a continuous pipeline section with common failure probabilities and common failure consequences is regarded as a single pipe segment.

2.3.1. Consequence Analysis of Pipe Failure

Consequence analysis aims to quantitatively assess the impact of pressure boundary failure (PBF) of specific pipe segments on the quantitative safety indicators of the power plant, namely CDF and the LERF. The analysis focuses on the loss of pressure boundary integrity caused by PBF and the direct and indirect impacts resulting from it.

• Direct Effects

Direct effects result in the loss of a single sequence or system function (such as the loss of coolant makeup capability) or directly trigger an initiating event, such as a loss-of-coolant accident (LOCA), main steam line break (MSLB), feedwater line break (FWLB), or a transient event (such as a reactor scram).

• Indirect Effects

Indirect effects consider the physical damage caused by the jet flow, flooding, or pipe whip resulting from pipe segment pressure boundary failure (PBF) to adjacent SSCs, leading to their loss of function (such as cable trays being flooded or safety-class equipment being impacted by the jet flow).

To facilitate the quantification of the impact of the abovementioned PBF of pipe segments on the safety of the power plant, it is common to combine it with the power plant’s PSA model. The consequences of PBF can be classified into three basic groups for quantitative assessment, as follows.

• Initiating Event Group

PBF directly triggers an IE that has been modeled in the PSA model (such as LOCA). The conditional core damage probability (CCDP) and conditional large early-release probability (CLERP) of this PBF are directly equal to the ΔCDF and ΔLERF caused by this IE. If the IE triggered by PBF is not explicitly modeled in the existing PSA, the PSA model needs to be modified for quantification. If a single PBF is likely to cause multiple IEs simultaneously, the most severe scenario among them shall be selected for analysis.

• Mitigation Capability Group

PBF (usually a small break) does not directly trigger an IE, but causes the unavailability or degradation of the systems/sequences required for accident mitigation (such as damaging the safety injection pump or blocking the safety path). CCDP/CLERP is calculated according to the following formulas:

$${\mathrm{C}\mathrm{C}\mathrm{D}\mathrm{P}}_{\mathrm{f}}=({\mathrm{C}\mathrm{D}\mathrm{F}}_{\mathrm{f}}-{\mathrm{C}\mathrm{D}\mathrm{F}}_{\mathrm{b}})\times \mathrm{T}$$

(1)

$${\mathrm{C}\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{P}}_{\mathrm{f}}=({\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{F}}_{\mathrm{f}}-{\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{F}}_{\mathrm{b}})\times \mathrm{T}$$

(2)

where ${\mathrm{C}\mathrm{C}\mathrm{D}\mathrm{P}}_{\mathrm{f}}$ is the CCDP induced by the unavailability or degradation of system function $\mathrm{f}$ triggered by pipe segment PBF, ${\mathrm{C}\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{F}}_{\mathrm{f}}$ is the CLERP induced by the unavailability or degradation of system function $\mathrm{f}$ triggered by pipe segment PBF, ${\mathrm{C}\mathrm{D}\mathrm{F}}_{\mathrm{f}}$ is the CDF induced by the unavailability or degradation of system function $\mathrm{f}$, ${\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{F}}_{\mathrm{f}}$ is the LERF induced by the unavailability or degradation of system function $\mathrm{f}$, ${\mathrm{C}\mathrm{D}\mathrm{F}}_{\mathrm{b}}$ is the CDF in the baseline state, ${\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{F}}_{\mathrm{b}}$ is the LERF in the baseline state, and $\mathrm{T}$ is the exposure time. Exposure time means the time window from the occurrence of PBF until it is isolated or repaired.

• Combined Effect Group

PBF simultaneously directly triggers an IE and affects the mitigation capability for that IE (such as triggering an LOCA while damaging the safety injection system). During quantification, the frequency of the analyzed IE is set to 1, and the affected mitigation systems/sequences are set to the failure state to calculate the CCDP/CLERP under this combination. For PBF affecting multiple groups, the most severe consequence level is adopted.

2.3.2. Determine Consequence Segments

Based on the values of CCDP and CLERP obtained from the quantitative PSA model, the failure consequences of pipe segments are classified into four risk levels (

Table 1. Consequence levels of pipe segment PBF.

Consequence Level	CCDP Range	CLERP Range
High	>1.00 × 10−4	>1.00 × 10−5
Medium	1.00 × 10−6 < CCDP ≤ 1.00 × 10−4	1.00 × 10−7 < CLERP ≤ 1.00 × 10−5
Low	0 < CCDP ≤ 1.00 × 10−6	0 < CLERP ≤ 1.00 × 10−7
Negligible	0	0

).

2.3.3. Assess Failure Potential

Pipeline failure mechanisms are primarily used to identify degradation mechanisms in pipelines within the selected systems. In the analysis of degradation mechanisms, an assessment is conducted by comparing the actual pipeline design, system functions, operating conditions, materials, and the environment.

There are mainly four categories of pipeline degradation mechanisms:

• Thermal fatigue (TF), which includes mechanisms such as thermal transients (TTs), thermal stratification cycles, and thermal aging stress corrosion cracking sequences (TASCSs).
• Stress corrosion cracking (SCC), encompassing mechanisms like intergranular stress corrosion cracking (IGSCC), transgranular stress corrosion cracking (TGSCC), external chloride—environment stress corrosion cracking (ECSCC), and pressurized water stress corrosion cracking (PWSCC).
• Localized corrosion (LC), including mechanisms such as microbiologically influenced corrosion (MIC), pitting corrosion (PIT), and crevice corrosion (CC).
• Flow sensitivity (FS), involving flow accelerated corrosion (FAC) and erosion corrosion (EC).

2.3.4. Determine Potential Failure Segments

For the parameters of pipeline failure rates, the envelope values of pipeline failure rates provided in EPRI TR-111880 [13] can be referred to. These data were obtained by analyzing the operational experience of pipeline systems in 2100 reactor-years of operating commercial light-water reactors in the United States:

• For pipe segments with flow-accelerated corrosion (FAC), the failure rate is set to 1.00 × 10⁻⁴ per weld per year.
• For pipe segments with any known failure mechanism other than FAC, the failure rate is set to 1.00 × 10⁻⁵ per weld per year.
• For pipe segments without any known failure mechanisms, the failure rate is set to 1.00 × 10⁻⁶ per weld per year.

It should be noted that if a pipe segment is classified as “medium” according to its degradation mechanism in Table 1 and it is simultaneously affected by water hammer loads, the probability of rupture of this pipe segment will be upgraded from “medium” to “high.”

2.4. Determine Characterize Risk Segments

A risk matrix (

Table 2. Pipe segment risk matrix.

Failure Likelihood	Failure Consequence
	Negligible	Low	Medium	High
High	Low Risk (7)	Medium Risk (5)	High Risk (3)	High Risk (1)
Medium	Low Risk (7)	Low Risk (6)	Medium Risk (5)	High Risk (2)
Low	Low Risk (7)	Low Risk (7)	Low Risk (6)	Medium Risk (4)

) was constructed by integrating two dimensions—failure probability (high, medium, low) and failure consequence (high, medium, low, negligible)—to classify the risks of each pipe segment. The matrix defines seven risk categories (categories 1–7), which are grouped into three risk regions: high, medium, and low. This approach better maintains the principle of defense in depth compared to simply ranking based on risk importance.

• High-risk zone: categories 1, 2, 3.
• Medium-risk zone: categories 4, 5.
• Low-risk zone: categories 6, 7.

2.5. Select Elements and Inspections

After determining the risk categories of pipe segments, it is possible to select which pipeline units (usually welds, but occasionally base metal parts, depending on the nature of the degradation mechanism) will undergo in-service inspection.

The principles for inspection selection are as follows:

• For pipe segments in the high-risk category, at least 25% of the welds should be selected for inspection.
• For pipe segments in the medium-risk category, at least 10% of the welds should be selected for inspection.
• For pipe segments in the low-risk category, no selection is made, unless there are historical events in the power plant to support it.
• If necessary, current supplementary inspections should also be carried out.
• The selected welds should cover each identified degradation mechanism.

In addition to the above selection principles, when specifically selecting welds, factors such as the nuclear power plant’s operating history, the severity of the degradation mechanism, physical accessibility, and radiation exposure should also be considered comprehensively.

2.6. Perform Risk Impact Assessment

The purpose of the risk impact assessment is to quantitatively evaluate the impact of the optimized RI-ISI program (compared with the current program) on the overall risk level of the nuclear power plant, ensuring that the risk increment remains within an acceptable range. The assessment is based on the detailed PSA model of the nuclear power plant, mainly focusing on the incremental changes of two key risk indicators:

• Increment in core damage frequency (ΔRCDF): difference between the CDF after the change and that before the change (in reactor-years).
• Increment in large early-release frequency (ΔRLERF): difference between the LERF after the change and that before the change (in reactor-years).

The risk increment must meet the risk acceptance criteria (

Table 3. Risk acceptance criteria.

Consequence Level	Risk Limits for Individual System	Risk Limits for Plant
ΔRCDF	≤1.00 × 10−7/reactor-year	≤1.00 × 10−6/reactor-year
ΔRLERF	≤1.00 × 10−8/reactor-year	≤1.00 × 10−7/reactor-year

).

Formulas (3) and (4) are used to calculate the risk increment caused by changes in the inspection strategy (reduction or increase in inspections) for a specific group of welds with the same consequence c, the same failure frequency f, and the same degradation mechanism:

$$\Delta {\mathrm{R}}_{\mathrm{C}\mathrm{D}\mathrm{F}}={\sum }_{\mathrm{c}}{\sum }_{\mathrm{f}}[{\mathrm{C}\mathrm{C}\mathrm{D}\mathrm{P}}_{\mathrm{c}}\times {\mathrm{P}\mathrm{F}}_{\mathrm{f}}\times ({\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{e}}{\times \mathrm{N}}_{\mathrm{e}}-{\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{r}}{\times \mathrm{N}}_{\mathrm{r}}\left)\right]$$

(3)

$$\Delta {\mathrm{R}}_{\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{F}}={\sum }_{\mathrm{c}}{\sum }_{\mathrm{f}}[\mathrm{C}{\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{P}}_{\mathrm{c}}\times {\mathrm{P}\mathrm{F}}_{\mathrm{f}}\times ({\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{e}}{\times \mathrm{N}}_{\mathrm{e}}-{\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{r}}{\times \mathrm{N}}_{\mathrm{r}}\left)\right]$$

(4)

where ${\mathrm{C}\mathrm{C}\mathrm{D}\mathrm{P}}_{\mathrm{c}}$ is the calculated conditional core damage probability for a specific group of welds with consequence grouping c, $\mathrm{C}{\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{P}}_{\mathrm{c}}$ is the calculated conditional large early-release probability for a specific group of welds with consequence grouping c, ${\mathrm{P}\mathrm{F}}_{\mathrm{f}}$ is the pipeline failure frequency determined based on the degradation mechanism and failure possibility classification f (high, medium, low) of a specific group of welds (refer to Table 2), and ${\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{e}}$ is the probability of detection of defects for a specific degradation mechanism under the current ISI program. Refer to the recommended values in EPRI TR-1013543 [14]:

• For the thermal fatigue (TF) mechanism, the mean ${\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{e}}$ is 0.3.
• For all other degradation mechanisms (including no known degradation): the mean ${\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{e}}$ is 0.5.

Where ${\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{r}}$ is the probability of detection of defects for a specific degradation mechanism under the risk-informed ISI program. Refer to the recommended values in EPRI TR-1013543 [14]:

• For the TF mechanism, the mean ${\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{e}}$ is 0.9 (assuming more effective inspection techniques/focus).
• For all other degradation mechanisms (including no known degradation), the mean ${\mathrm{P}\mathrm{O}\mathrm{D}}_{\mathrm{e}}$ is 0.5 (assuming detection capability is equivalent to the current level).

Where ${\mathrm{N}}_{\mathrm{e}}$ is the number of welds belonging to consequence grouping c and failure frequency grouping f required to be inspected under the current ISI program, and ${\mathrm{N}}_{\mathrm{r}}$ is the number of welds belonging to consequence grouping c and failure frequency grouping f required to be inspected under the RI-ISI program.

To assess the impact of uncertainties in model assumptions, sensitivity analysis is required. Conservative assumptions are usually adopted, such as taking the upper-limit values of CCDP/CLERP for each group of welds and recalculating the upper limit of the risk increment to ensure that the risk increment still meets the limits in Table 3 under the worst-case scenario. Moreover, the risk impact assessment and weld selection are an iterative process. If the preliminary assessment results exceed the risk limits, the inspection strategy needs to be adjusted (such as increasing the proportion of certain welds being inspected) and reevaluated until the risk acceptance criteria are met.

2.7. Optimization Implementation and Feedback

After completing the above steps, an optimized in-service inspection program is output, clearly defining the specific locations of welds to be inspected, inspection methods (such as ultrasonic and radiographic inspection), and inspection intervals. During the implementation of the optimized program, it is crucial to establish a continuous monitoring and feedback mechanism:

• Result Monitoring: Systematically record the results of all RI-ISI inspections (including both the detection of defects and the absence of defects).
• Assess Feedback: Analyze the inspection results, operational events, and aging monitoring data to assess the effectiveness of the RI-ISI strategy.
• Program Adjustment: Regularly review and adjust the RI-ISI program based on the feedback. For example, if unexpected significant defects are found in the low-risk area, the degradation mechanism and risk level of this area need to be reevaluated, and additional inspections may be required.
• Database Update: Incorporate the power plant-specific inspection results, failure data, and information on the development of degradation mechanisms into the database. These data are used to improve the assessment of failure probabilities in future RI-ISI analyses and the PSA model.

3. Case Study: Application in the RCV System of HPR1000

3.1. Analysis Objects and Scope

This study focused on the RCV system, a critical auxiliary system of the primary circuit in the HPR1000, as the pilot for optimizing RI-IS). The RCV system performs essential safety-related functions, including regulating the volume of primary circuit coolant (to compensate for leakage and temperature-induced variations), purifying coolant (by removing fission products and corrosion products), controlling reactivity (through boron concentration adjustment), and supplying shaft seal water to the primary circuit’s main pump. Pipeline failures within this system would directly compromise the integrity of the primary circuit pressure boundary and impair accident mitigation capabilities. The RCV system comprises a letdown unit, a charging unit, a reactor pump shaft seal injection and return unit, a coolant purification unit, a volume control and hydrogen addition unit, and a chemical addition unit.

Compared with traditional second-generation or improved second-generation nuclear power plants, the HPR1000’s RCV system exhibits distinct design features:

• Adoption of a “quantitative charging and regulated letdown” control mode to achieve precise regulation of primary loop water inventory.
• Implementation of a “first cooling, then pressure reduction” configuration for letdown flow treatment, which effectively mitigates flashing risks during pressure reduction.
• Prioritized placement of high-energy pipelines within the reactor building to minimize radioactive material release consequences in the event of pipeline rupture.
• Application of jet hydrogenation technology, which significantly reduces hydrogen concentration and inventory in both the system and the building, thereby essentially eliminating the risk of hydrogen explosion.

The scope of welds included in this study encompassed all circumferential butt welds of nuclear safety classes 1, 2, 3, and NC (safety-significant non-nuclear class) pipelines within the RCV system. Conversely, socket welds and fillet welds (e.g., BOSS head welds and radiographic inspection plug welds) are excluded. These excluded welds are primarily used for small-diameter pipelines and their connections, with some involved in sealing source guide holes. They typically undergo regular liquid penetration testing (LPT), and thus fall outside the optimization scope of this volumetric inspection (e.g., ultrasonic and radiographic inspection).

3.2. Calculation Models, Data, and Tools

This case study was based on the in-service PSA model of a typical HPR1000 commercial nuclear power plant operated by China General Nuclear Power Group (CGN, located in Shenzhen, China), headquartered in Guangdong Province, China, which had been in commercial operation for over one year as of the time of this analysis. The PSA framework encompasses all operational modes, including full-power, low-power, and shutdown states. Equipment reliability datasets integrated into the model were primarily sourced from NUREG/CR-6928 [15] and a China nuclear power plant equipment reliability data report [16]. Additionally, explicit consideration was given to design optimizations implemented during plant operation that may influence PSA outcomes, as well as relevant insights derived from international peer reviews. The PSA model was rigorously developed using RiskSpectrum® 1.3.2, a globally recognized industry-standard software suite specifically designed for PSA in nuclear engineering applications.

This in-service PSA model was built upon the Level 1 and Level 2 PSA models developed during the plant’s fuel loading license application phase (both of which have passed regulatory review). It also incorporates key information, including plant improvement measures, operational experience feedback, and revisions based on peer review comments. Fully aligned with the plant’s current operational status, the model not only meets the requirements for optimizing pipeline in-service inspection analysis but is also applicable to other risk-informed evaluation activities.

Modifications to the in-service PSA model are as follows:

• Plant improvements

• In accordance with the refueling outage repowering plan, the LVD bypass power system was reconfigured from LKC to LKH, with corresponding revisions to the fault tree in the model.
• The trigger for VDA isolation was adjusted from “SG pressure low 3” to “SG pressure low 2,” and the relevant fault tree signals in the PSA model were updated synchronously.

• Operational experience feedback

A motor-driven valve experienced one opening failure over a total of 3128 demand events. In accordance with the data processing principles outlined in a China nuclear power plant equipment reliability data report [16], a Bayesian update was performed exclusively for motor-driven valves (retaining generic data for other equipment). Specifically, the failure-to-open probability of motor-driven valves was revised from 3.57 × 10⁻⁴ to 3.56 × 10⁻⁴.

• Peer review comment revisions

Peer reviews noted that the fault tree for the loss of heat sink (LOHS) initiating event in the original model lacked consideration of common causes of filter failures. Consequently, a corresponding common-cause filter-failure model was added to the existing PSA model.

The modifications mentioned above have exerted minimal impact on the results of the PSA model. Specifically, the CDF has adjusted from 1.61 × 10⁻⁷ per reactor-year in the design-phase PSA model to 1.62 × 10⁻⁷ per reactor-year. The LERF for internal events has changed from 8.57 × 10⁻⁹ to 8.58 × 10⁻⁹ per reactor-year.

3.3. Pipeline FMEA—Process and Results

3.3.1. Direct Impact Analysis

A breach in the pipelines of the RCV system may directly trigger initiating events in the PSA model. Specifically, pipelines within the primary loop boundary—such as segments of the charging and letdown lines where the RCV system connects directly to the reactor coolant pump (RCP) system up to the first isolation valve or globe valve (all these pipelines are located in the reactor building)—could upon rupture directly lead to a loss-of-coolant accident (LOCA) in the primary loop. Given that these pipelines have a relatively large diameter of 100 mm, breaches of varying severities may result in large, medium, or small LOCA events as defined in the PSA model. Additionally, the integrity of the letdown line, charging line, and reactor pump shaft seal injection line is critical to maintaining system functionality: any rupture in these lines will directly disrupt the balance between charging and letdown functions, induce pressure fluctuations in the primary loop, and consequently trigger a reactor trip. This accident scenario has a direct mapping relationship with the preset “primary transient (PTS)” initiating event in the Level 1 PSA model for internal events.

3.3.2. Indirect Impact Analysis

RCV pipelines are distributed across the BRX, nuclear auxiliary building (BNX), and fuel building (BFX). Indirect impacts from PBF were analyzed as follows.

• Flooding Effect Analysis

In the analysis of the flooding effect, reference was made to the commonly used approach in internal flooding PSA practices, which is to conservatively assume that equipment in the flooded area will be damaged unless the equipment in the flooded area has a flooding protection design.

In the BRX, equipment is designed to be resistant to spraying, and safety-class electrical equipment all adopt 1E-class protection. In the event of a pipeline rupture, the in-containment refueling water storage tank (IRWST) can effectively contain the leaked medium, meaning the flooding effect in the BRX area has no additional impact on the safety equipment concerned in the PSA model. Within the BNX, since there are no safety-significant items of concern in the PSA model, even if a pipeline rupture causes a flooding event, it will not have an indirect impact on core safety. As for the BFX, RCV system pipelines are concentrated in BFX01 (left half of the center line) and BFX02 (right half of the center line), and flooding in a single area will result in the loss of RCV system functionality, trigger a PTS initiating event, and cause the unavailability of a single train of the reactor backup system (RBS).

• Whipping and Jet Impact Effect Analysis

These effects are mainly caused by the failure of high-energy pipelines in the RCV system. In the BRX, the whipping force and jet flow generated by the rupture of high-energy pipelines may affect adjacent equipment (such as pipe supports, sensors, cable trays, etc.). Evaluation showed that only the rupture of the charging line RCV6411TY- may simultaneously trigger a PTS event and the failure of a single train of the RBS, while damage to other equipment does not constitute a new initiating event. In the BNX, equipment is not involved in accident mitigation functions, so jet impact effects were not included in the PSA model analysis. In the BFX, rupture of the letdown heat exchanger cooling line (RCV1241TY-) and the volume control tank isolation boundary line (RCV3241TY-) may cause local equipment damage, but it does not affect the execution of key safety functions in the PSA model.

3.3.3. Quantification Results

Based on the above analysis, the consequences of critical pipeline ruptures in the RCV system can be categorized into two types, as follows.

• Pipelines within the primary loop boundary directly connected to the RCP: Failures of these pipelines (all within the primary loop boundary) will directly trigger an LOCA event. Calculations using the “initiating event group” method yield a result of 3.17 × 10⁻³, with a corresponding CLERP of 3.03 × 10⁻⁵.
• Other pipelines (including the letdown line, charging line, and reactor pump shaft seal injection line): Failures of these pipelines will cause pressure instability in the primary loop and trigger a reactor trip, thereby becoming a PTS initiating event in the internal-event PSA model. Additionally, local flooding in the fuel building and failure of the charging pipeline in the reactor building (RX) may render a single train of the reactor backup system (RBS) unavailable, increasing the risk of core damage. For quantitative calculation, a conservative assumption was adopted to simplify the process: except for the aforementioned pipelines within the primary loop boundary, all other pipeline failures in the RCV system will trigger a PTS initiating event and simultaneously cause a single train of the RBS system to be unavailable. Based on this, the conditional core damage probability (CCDP) and conditional large early-release probability (CLERP) were derived using the joint impact group calculation method. Specifically, the model was set to simulate the scenario where “a PTS initiating event occurs with a single train of the RBS system unavailable,” and the calculation results showed a CCDP of 1.70 × 10⁻⁸ and a CLERP of 1.81 × 10⁻⁹.

3.4. Failure Probability Estimation

Based on the functions, operating conditions of the RCV system, and the criteria for determining deterioration mechanisms, the analysis of the deterioration mechanisms of its pipe segments is as follows.

• During normal operation, the temperatures of the charging and letdown pipelines change synchronously and the fluid flows at a high speed, so they are not sensitive to TF. Although they may be sensitive to TT under extreme designed transient conditions, the actual occurrence probability of such transients is extremely low. Moreover, the pipeline design is based on conservative assumptions with a large margin. Therefore, it is determined that the relevant pipe segments are not sensitive to TT.
• The pipeline material is austenitic stainless steel. The system takes water from the primary loop. In the water chemistry environment, oxygen and pollutants are negligible, and the pipelines do not come into contact with humid chloride-containing environments, so they are not sensitive to SCC.
• During normal operation, the fluid is taken from the primary loop with very little oxygen and pollutants and the flow rate is high, so the pipelines are not sensitive to LC.
• There are many control valves on the charging, letdown, and shaft seal injection pipelines, which generate cavitation sources during system operation. The flow rates on these pipelines are all lower than 9.14 m/s, so the pipelines are not sensitive to EC according to the criteria for determining deterioration mechanisms.
• The pipeline materials of the RCV system include austenitic stainless steel and carbon steel. According to the criteria for determining deterioration mechanisms, the austenitic stainless steel pipelines of the RCV system are not sensitive to FAC. The equipment cooling water part of the RCV system heat exchanger uses carbon steel pipelines, and the fluid in these pipelines is RRI cooling water with an oxygen concentration exceeding 1000 ppb. It is either a single-phase fluid with a temperature lower than 93 °C, or a fluid with a temperature higher than 93 °C, but with an operating time less than 2% of the plant’s operating time. Therefore, it is judged that the carbon steel pipelines of the RCV system are not sensitive to FAC.

In conclusion, the pipelines of the RCV system do not belong to the category of common deterioration mechanisms, and their failure probability was calculated to be 1.00 × 10⁻⁶ per weld per year.

3.5. Risk Classification and Inspection Strategy Optimization

Integrating the consequence analysis and failure probability assessment of pipe segments, a risk matrix (Table 3) was applied to classify the risk levels of all welds in the analyzed RCV system.

• For pipelines of the RCV system within the primary loop boundary, the risk level is categorized as medium risk (category 4). Although the total number of such welds is relatively small, there are two welds subject to volumetric inspection requirements (e.g., ultrasonic testing). In accordance with the principles for inspection selection, at least 10% of the welds must be selected. Following the principle of rounding up, one out of these two welds requiring volumetric inspection shall be selected for inspection, considering factors such as inspection accessibility and operating history.
• For welds on other pipelines of the RCV system, including 3244 circumferential butt welds in the RCV system, 16 specific welds within this scope were originally subject to volumetric inspection. In line with the risk matrix principles (no inspection required for low-risk category 7), volumetric inspection for the aforementioned 16 welds is exempted. The released inspection resources will be reallocated to high/medium-risk welds in other pipeline systems of the plant.

3.6. Risk Impact Assessment

Based on Equations (3) and (4), combined with information including the CCDP, CLERP, pipeline failure frequency, and reduction in pipeline quantity involved in the above analysis, the risk increments of the system were calculated as follows:

• Risk increments induced by ISI optimization for pipelines within the primary loop boundary of the RCV system: 1.59 × 10⁻⁹ per reactor-year and 1.82 × 10⁻¹¹ per reactor-year.
• Risk increments induced by ISI optimization for other pipelines in the RCV system: 1.36 × 10⁻¹³ per reactor-year and 1.36 × 10⁻¹⁴ per reactor-year.

In summary, the total risk increments of the entire system due to ISI optimization are 1.59 × 10⁻⁹ per reactor-year for and 1.82 × 10⁻¹¹ per reactor-year for $\Delta {\mathrm{R}}_{\mathrm{L}\mathrm{E}\mathrm{R}\mathrm{F}}$, neither of which exceeds the risk increment limits. Furthermore, modifications to the weld inspection locations and quantities in the RI-ISI program designed for RI-ISI, as well as adjustments to plant design criteria and design bases, will not significantly alter the plant’s defense-in-depth capability or safety margin. Therefore, the aforementioned ISI optimization scheme for the RCV system is acceptable.

4. Discussion

This study successfully applied the internationally recognized RI-ISI framework to the chemical and volume control system (RCV) of HPR1000 nuclear power plants, achieving significant optimization results. Through systematic risk classification, the number of welds requiring volumetric inspection in the RCV system—originally 18 (including both medium-risk and low-risk categories)—was reduced to only 1 after optimization. The resulting increments in system-level and plant-level risks both remain within safe margins. This optimization directly reduces redundant inspections of low-risk welds, freeing up valuable human resources, equipment, and time, which can be reallocated to high/medium-risk components or systems in the plant. For the HPR1000 reactor, characterized by high system complexity and a large number of welds, such efficiency improvements not only yield substantial economic benefits but also significantly enhance operational flexibility. This approach can serve as a reference for optimizing in-service inspections of other systems in HPR1000 plants.

Several issues warrant further exploration in practice.

• Iteration and Dynamic Updates of Optimization Schemes

This study only analyzed the RCV system as a case study. In risk increment assessment, system-level risk acceptance criteria are more relevant than plant-level ones. A comprehensive evaluation of plant-level risk impacts will require calculating the cumulative risk increments after completing RI-ISI optimizations for all systems. To ensure that the overall plant risk increment does not exceed acceptable limits, the RCV system optimization scheme proposed in this study may need appropriate adjustments when planning plant-wide RI-ISI. Additionally, during the implementation of the optimized in-service inspection program, updates to performance monitoring data and dynamic adjustments to the PSA model (e.g., incorporating new equipment modifications or operating conditions) may necessitate further iterations of the current RCV system scheme. It is therefore recommended to establish a regular review mechanism for RI-ISI schemes that calibrates inspection strategies periodically based on actual plant operation data and model updates to maintain risk controllability.

• Refinement of Pipeline Failure Probability Assessment

The probability of pipeline failure is not only a core basis for classifying pipeline failure levels but also a key parameter for calculating the risk increments in systems and power plants after ISI optimization. The data used in this study were relatively outdated and lack sufficient accuracy. Therefore, more advanced assessment methods can be considered, such as adopting pipeline failure probability assessment tools similar to those involved in the RI-ISI method proposed by the WOG [8], combined with Markov chain sampling technology for simulation [17]. In addition, pipeline fault monitoring and prognostics and health management (PHM) technology integrated with intelligent technologies have been proposed in the industry [18]. Through this technology, more accurate performance information such as equipment health indicators and remaining useful life (RUL) can be predicted using intelligent algorithms based on equipment degradation monitoring data. Relevant data can also be used as inputs to obtain more precise time-varying failure probabilities of pipelines [19], which can then be incorporated into RI-ISI analyses. In summary, the aforementioned improvements aim to integrate multidimensional information, including failure modes, material properties, and degradation mechanisms, to construct a more refined failure probability model, thereby significantly enhancing the accuracy of assessment results, reducing the risk of misjudgment caused by rough data, and providing a more reliable quantitative basis for risk classification and inspection strategy optimization.

• Integration with Deterministic Analysis

In this project, the indirect impact assessment (whipping and jet impact effect analysis) already referenced results from high-energy pipeline safety analyses. Integrating these two approaches can further improve analysis efficiency and reliability. High-energy pipeline safety analysis aims to ensure that safety-class equipment can still perform its safety functions after a pipeline rupture. It determines the location and failure mode of high-energy pipeline breaks through mechanical analysis, simulates the impact range of whipping and jet effects using PDMS 3D modeling, and identifies affected target equipment via collision checks. It is recommended that such deterministic analysis results be systematically integrated into the failure consequence assessment phase of RI-ISI, thereby leveraging the complementary strengths of PSA and deterministic safety analysis (DSA).

• Adaptability of Plant Risk Indicator Limits

The risk indicator limits referenced in this study (e.g., CCDP and CLERP) were established relatively early. As a third-generation nuclear power plant, the HPR1000 features enhanced defense-in-depth capabilities and probabilistic safety goals compared to second-generation plus plants, necessitating a reevaluation of the adaptability of these risk limits (e.g., potentially increasing stringency by an order of magnitude). While CCDP and CLERP reflect a plant’s accident mitigation capabilities, third-generation units do not achieve uniformly improved mitigation capabilities across all accident scenarios. However, given that third-generation plants typically have probabilistic safety goals an order of magnitude higher than second-generation units, it is advisable to tighten limits for key risk indicators (e.g., LERF) to ensure that risk increments from risk-informed activities do not significantly impact overall plant safety. This adjustment should be validated through multi-scenario simulations and sensitivity analyses, incorporating long-term operational experience and evolving industry standards, to ultimately develop risk acceptance criteria tailored to the HPR1000’s technical characteristics.

In summary, this study confirms the applicability of the RI-ISI method to the HPR1000, and the directions discussed above provide key pathways for future optimizations.

5. Conclusions

The RI-ISI method based on the EPRI TR-112657 framework is applicable to the HPR1000. Through standardized procedures, the number of welds requiring volumetric inspection in the RCV system—originally 18 (including medium-risk and low-risk categories)—was reduced to only 1 after optimization, verifying the method’s effectiveness in streamlining inspection workload.

• The optimized scheme achieves a balance between safety and economy. The total system risk increments are far below the limit values and do not compromise the plant’s defense-in-depth capability.
• Resource reallocation has improved inspection efficiency, providing an economical and flexible solution for the operation and maintenance of high-complexity systems.
• The methodology developed in this study can be extended to other critical systems of the HPR1000, serving as a template for plant-wide pipeline inspection optimization. It also provides practical references for the application of risk-informed technologies in China’s independently developed third-generation nuclear power models.