ML022120249
| ML022120249 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 08/28/2002 |
| From: | Clark R NRC/NRR/DLPM/LPD1 |
| To: | Mecredy R Rochester Gas & Electric Corp |
| Clark R, NRR/DLPM, 415-2297 | |
| References | |
| TAC MB1887 | |
| Download: ML022120249 (16) | |
Text
August 28, 2002 Dr. Robert C. Mecredy Vice President, Nuclear Operations Rochester Gas and Electric Corporation 89 East Avenue Rochester, NY 14649
SUBJECT:
REQUEST FOR ADDITIONAL INFORMATION REGARDING R. E. GINNA NUCLEAR POWER PLANT (GINNA) LICENSE AMENDMENT REQUEST RELATING TO THE CONTROL ROOM EMERGENCY AIR TREATMENT SYSTEM ACTUATION CIRCUITRY (TAC NO. MB1887)
Dear Dr. Mecredy:
By letter dated May 3, 2001, as supplemented on October 29, 2001, Rochester Gas & Electric Corporation (RG&E) submitted a request to the Nuclear Regulatory Commission (NRC) to revise the Ginna Improved Technical Specification (ITS) associated with the Control Room Emergency Air Treatment System (CREATS). RG&E also submitted attachments to the above letters that provided details regarding the design and testing of the CREATS actuation circuitry.
The Nuclear Regulatory Commission (NRC) staff reviewed the information provided above and issued a request for additional information (RAI) on January 28, 2002. RG&Es response to the staffs RAI was dated May 3, 2002.
The NRC staff reviewed RG&Es response dated May 3, 2002, and have determined that additional information is required in order for the staff to complete its review. Enclosed is the NRC staffs second RAI. The RAI questions were originally e-mailed to your staff on June 11, 2002 (ADAMS accession ML022380401) and later discussed during a conference call on July 24, 2002. As a result of this conference call, draft RAI question number 15 and 21 were deleted, and one question regarding the CREATS design bases was added. The list of questions in the second RAI was re-numbered. It was agreed that your response would be provided by November 1, 2002.
Sincerely,
/RA/
Robert Clark, Project Manager, Section 1 Project Directorate 1 Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket No. 50-244
Enclosure:
RAI cc w/encl: See next page
August 28, 2002 Dr. Robert C. Mecredy Vice President, Nuclear Operations Rochester Gas and Electric Corporation 89 East Avenue Rochester, NY 14649
SUBJECT:
REQUEST FOR ADDITIONAL INFORMATION REGARDING R. E. GINNA NUCLEAR POWER PLANT (GINNA) LICENSE AMENDMENT REQUEST RELATING TO THE CONTROL ROOM EMERGENCY AIR TREATMENT SYSTEM ACTUATION CIRCUITRY (TAC NO. MB1887)
Dear Dr. Mecredy:
By letter dated May 3, 2001, as supplemented on October 29, 2001, Rochester Gas & Electric Corporation (RG&E) submitted a request to the Nuclear Regulatory Commission (NRC) to revise the Ginna Improved Technical Specification (ITS) associated with the Control Room Emergency Air Treatment System (CREATS). RG&E also submitted attachments to the above letters that provided details regarding the design and testing of the CREATS actuation circuitry.
The Nuclear Regulatory Commision (NRC) staff reviewed the information provided above and issued a request for additional information (RAI) on January 28, 2002. RG&Es response to the staffs RAI was dated May 3, 2002.
The NRC staff reviewed RG&Es response dated May 3, 2002, and have determined that additional information is required in order for the staff to complete its review. Enclosed is the NRC staffs second RAI. The RAI questions were originally e-mailed to your staff on June 11, 2002 (ADAMS accession ML022380401) and later discussed during a conference call on July 24, 2002. As a result of this conference call, draft RAI question number 15 and 21 were deleted, and one question regarding the CREATS design bases was added. The list of questions in the second RAI was re-numbered. It was agreed that your response would be provided by November 1, 2002.
Sincerely,
/RA/
Robert Clark, Project Manager, Section 1 Project Directorate 1 Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket No. 50-244
Enclosure:
RAI cc w/encl: See next page DISTRIBUTION:
PUBLIC PDI-1 R/F SLittle RClark RLaufer ACRS OGC EMarinos MReinhart BPlatchek, R1 SRichards Accession Number: ML022120249
- See previous concurrence OFFICE PDI-1/PM PDI-1/LA SPSB/SC*
EEIB/SC*
PDI-1/SC NAME RClark SLittle MReinhart EMarinos PMilano for RLaufer DATE 8/28/02 8/28/02 8/9/02 8/13/02 8/28/02 OFFICIAL RECORD COPY
R.E. Ginna Nuclear Power Plant cc:
Christopher Welch, Sr. Resident Inspector R.E. Ginna Plant U.S. Nuclear Regulatory Commission 1503 Lake Road Ontario, NY 14519 Regional Administrator, Region I U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406 Mr. William M. Flynn, President New York State Energy, Research, and Development Authority Corporate Plaza West 286 Washington Avenue Extension Albany, NY 12203-6399 Charles Donaldson, Esquire Assistant Attorney General New York Department of Law 120 Broadway New York, NY 10271 Daniel F. Stenger Ballard Spahr Andrews & Ingersoll, LLP 601 13th Street, N.W., Suite 1000 South Washington, DC 20005 Ms. Thelma Wideman, Director Wayne County Emergency Management Office Wayne County Emergency Operations Center 7336 Route 31 Lyons, NY 14489 Ms. Mary Louise Meisenzahl Administrator, Monroe County Office of Emergency Preparedness 1190 Scottsville Road, Suite 200 Rochester, NY 14624 Mr. Paul Eddy New York State Department of Public Service 3 Empire State Plaza, 10th Floor Albany, NY 12223
Enclosure REQUEST FOR ADDITIONAL INFORMATION R. E. GINNA NUCLEAR POWER PLANT CONTROL ROOM EMERGENCY AIR TREATMENT SYSTEM (CREATS)
ACTUATION CIRCUITRY The following is the Nuclear Regulatory Commission (NRC) staffs comments regarding Rochester Gas & Electric Corporations (RG&Es) response to the staffs request for additional information (RAI) dated January 28, 2002. RG&Es response to the staffs RAI was dated May 3, 2002.
1.
In RG&Es letter dated May 3, 2002, Attachment 1, Section A, Question 2, page 1, RG&E stated: The radiation monitoring equipment being installed for this modification was procured from Inovision Radiation Measurements and has been qualified to the requirements of EPRI TR-102323-R1." Please provide the test plans, test procedures, and the results of the tests. Which laboratory was used to perform these tests, or was the testing done by Inovision?
2.
In Attachment 1, Section A, Question 4, page 2, RG&E stated: A simplified failure modes and effects analysis (FMEA) was performed for the new CREATS instrumentation system. Please provide a copy of this simplified FMEA.
3.
In Attachment 1, Section B, page 4, RG&E stated: The digital ratemeter instrumentation being procured....as equipment qualified as safety related under all of the requirements of both the Inovision and the Ginna Station QA programs. Ginna procurement specification EE-171 requires that the equipment be safety related and shall be supplied in accordance with the requirements of [Title 10 of the Code of Federal Regulations (10 CFR 50), Part 50] 10 CFR 50, Appendix B. Please provide a copy of EE-171, as well as any Inovision documentation showing that the digital ratemeter instrumentation is designed and manufactured in accordance with the requirements of 10 CFR 50, Appendix B.
4.
In Attachment 1, Section B, Question 3, page 5, when asked how many of these units were in use, RG&E stated: The UDR [Universal Digital Ratemeter] has been installed in over 2,000 process and area radiation channels since then. This series of monitoring systems has been provided to fourteen nuclear sites, totaling over 100 channels, and Ginna Station has 25 units installed that have the 94X series of ratemeters installed with the same or earlier revisions of the same software. This raises several questions.
A.
While the basic algorithms may be the same, is the software used in the type 956A the same as used in the type 94X?
B.
What hardware and software changes were made going from the type 94X to the type 956A. How were these changes verified, validated, tested, and approved?
C.
How many type 956A digital ratemeters are in use at other sites, nuclear and non-nuclear?
5.
In Attachment 1, Section B, Question 4, page 5, RG&E stated: Since 1987, of the 200+
956A units shipped, approximately twenty have been returned. All but five of the units were returned for recalibration. Of the five units not returned for calibration, four were sales demonstration units and one was incorrectly classified as a repair. This data accurately reflects the field proven reliability of the unit as there is no adverse failure history related to misoperation of the software / firmware.
RG&E has performed a search of the nuclear OE database, and found no history of failures of Inovision or Victoreen radiation monitoring equipment that would be applicable to our installation. Does the staff understand correctly that RGE is stating that there has never been a failure of a type 956A unit?
6.
In Attachment 1, Section B, Question 4, page 5, RG&E stated: The microprocessor uses standard 54LS logic for timing and system interfaces. Program storage is provided on 32Kb ultraviolet erasable, programmable, read-only memory (EPROM). 8KB random access memory (RAM) is provided for data storage, stack, and operating parameters. A 64 byte electrically erasable, programmable, read-only memory (EEPROM) is provided for long term parameter storage (i.e., set points).
A.
The staff understand that the timing and system interface chips are Mil-Spec.
low-powered Schottky TTL type devices. Are the memory chips of the same type?
B.
Are the chips soldered in place or in chip carriers. If chip carriers are used, to what degree are they environmentally qualified? (Temperature, humidity, vibration, seismic shock)
C.
How is the memory organized?
7.
In Attachment 1, Section B, Question 6, page 6, RG&E stated: The code was originally developed on a Hewlitt-Packard 64000 microprocessor development system, and is written in Motorola 6802 Assembly Language. The software development system has since been transferred to an ASCII text editor on a DOS based PC. The American Arium (formerly American Automation) Development System's assembler and linker are used to generate the absolute executable source files.
A.
Was the assembled code from the Motorola and the Arium assemblers compared? What were the differences?
B.
How were the American Arium Development Systems assembler and linker qualified? Has this previously been reviewed by NRC staff?
8.
In Attachment 1, Section B, Question 6, page 6, RG&E provided an excerpt from a correspondence with Inovision. This excerpt stated: The software (firmware) is programmed in assembly language, and does not contain an embedded operating system. Upon start up, an initialization routine is run. Once completed, the main program loop, which performing all functions, executes. The main loop calls function specific subroutines, (e.g. counts, alarms, analog output, check source, calibration, RS232 communications, display, setpoint entry, etc. ) to run each cycle. The system is timed by the Non-Maskable Interrupt (NMI), which is generated from a 4Mhz crystal clock. Four NMI events are generated each second. A hardware watchdog timer is provided. If the watchdog timer is permitted to time out (i.e. the main loop does not complete its cycle and provide a reset output), a MPU Fail condition will occur, causing the FAIL relay to change state and the front panel FAIL LED to illuminate. The Fail relay is wired into the CRHVAC Isolation circuitry so that a FAIL alarm will initiate a Control Room Isolation. The functional operation of the specific monitor functions may be easily verified in the monitor factory acceptance test (FAT).
The staff does not understand the program flow from this description. Please provide the following documents:
i) a complete software description ii) whatever was used as a software requirements specification iii) software flow diagram iv) description of how interrupts are generated and handled v) description of how the watchdog operates, how it is set and reset, and the sequence of events if the watchdog timer times out.
The same section referred to a Nuclear Utilities Procurement Issues Committee (NUPIC) Audit. Please provide a copy of that audit report.
9.
In Attachment 1, Section B, Question 8, page 7, RG&E stated: The code was developed prior to the application of a formal validation and verification program. The code was manually verified and tested by the developer. Those records are not available. What assurance is there that the code is well written, contains no unused code, and is deterministic in nature. How is the licensee able to determine that the software will function correctly in all circumstances. Has any reverse engineering been done to verify that the original developer did a good job?
10.
In Attachment 1, Section B, Question 9, page 7, RG&E stated: Final hardware testing is the Loop Test LT956A/897A-21X included in the System Manual issued with the equipment. This procedure tests the entire channel using operating firmware and a multi-rate portable radiation source to trip alarms, drive analog outputs, verify over/under and loss of count modes. Additional tests for UDR hardware and memory using diagnostic firmware, and factory multi-point range calibration of the GM detector for linearity have been provided to Ginna. Additional contract-specific testing is documented in Qualification Report 950.366. These tests include energy dependency, detector stability over contract temperature range requirements, tube plateau and repeatability. Consistent with IEEE 7-4.3.2, this testing was performed with the computer functioning with software and diagnostics that are representative of those used in actual operation, and all portions of the computer necessary to accomplish the safety function were exercised during testing. This does not describe how the hardware was tested during design and implementation, or first article testing. Please provide copies of the test documentation used at the time of design. In addition, please provide:
i)
The test plan and procedures for Loop Test LT956A/897A-21X ii)
The System Manual iii)
Qualification Report 950.366 iv)
Operators Instruction Manual, RG&E Purchase Order 4500008671 In the same section, RG&E stated: This testing of the hardware was performed by Inovision as part of the procurement process, and has been submitted to Ginna as part of the qualification documentation in the Operators Instruction Manual, RG&E Purchase Order 4500008671. These documents have been transmitted to RG&E, and have been reviewed for acceptance by engineering. A written test plan was used and reviewed by RG&E for acceptability. Please provide the written test plan and the RG&E review of that test plan.
11.
In Attachment 1, Section B, Question 10, page 8, RG&E stated: The device contains jumpers that can be moved to select different operating modes for output functions.
These jumpers and their functions are described in the vendor manual. All of these functions were reviewed and selected appropriately for the output functions desired for this design and incorporated into the design change package, which receives engineering independent review and verification. Changes to these jumpers cannot be made without following the appropriate design change process, per Ginna procedure IP-DES-2, Plant Change Process." Please provide the vendor manual and Ginna procedures IP-DES-2 and IP-DES-4.
12.
In Attachment 1, Section B, Question 11, page 8, RG&E was asked about vendor configuration control. The answer provided only discussed firmware code listings.
Please state what configuration control the vendor has for both hardware and software, and if Ginna decides to buy a replacement device in 5 years, what assurance do they have that the new device will be the same as the old device? If it is different, how will Ginna know what the differences are?
In the same section, RG&E discussed EPROM part numbers. Do these part numbers have a revision level, and if so, what changes trigger a new revision level. Is it possible to make minor changes or corrections in the firmware without triggering a part number or revision level change? RG&E stated: The specific EPROM part number and, if necessary, the revision originally supplied may be reproduced from our controlled source files. Does RG&E have the ability to burn or program these EPROMs?
13.
In Attachment 2, paragraph 4.9, page 12 of 30, RG&E stated: The appropriate reliability level requirements for this safety function have been determined by reviewing the operating requirements and comparing them to the criticality of operation of the safety function with respect to time and consequences. What was the appropriate reliability level determined to be. Please provide any documentation generated during this determination.
14.
In Attachment 2, paragraph 4.9.1, page 12 of 30, RG&E stated: A Probabilistic Safety Assessment (PSA) review of the modification design has been conducted to quantify the potential for a failure to impact the risk of release of fission product. Please provide a copy to this Probabilistic Safety Assessment.
In the same section, RG&E stated: The resultant probability of failure to perform the intended safety function is 1.93E-4. This probability is acceptable when consideration is given to the low frequency of expected need combined with the ability of the operators to mitigate the consequential conditions with a manual initiation if the failure were to occur. This value of 1.93E-4 is also discussed in Section 5.15.1. Please provide a copy of the calculations which were used to determine this value. The staff is particularly interested in how the software failure and software common mode failure values were determined. The staff is also interested in the logic used to determine that this value is acceptable.
15.
In Attachment 2, paragraph 4.9.2, page 12 of 30, RG&E stated: Factory testing of the units is extensive and documented in the Inovision Radiation Measurements Control Room Intake Radiation Monitors Operator's Instruction Manual provided via Inovision Shop Order number S157033. This testing was performed over a wide range of input conditions, specifically testing the digital components extensively. Test data for the units for this modification are included in the vendor manual. Please provide copies of:
i) Inovision Radiation Measurements Control Room Intake Radiation Monitors Operators Instruction Manual ii) Inovision Shop Order number S157033 iii) The vendor manual 16.
In Attachment 2, paragraph 4.9.2, page 12 of 30, RG&E stated: The Inovision Appendix B program has been audited by NUPIC (see Audit ID no: 17889) to verify....
Please provide a copy of the NUPIC audit report.
In the same section, RG&E stated: It was noted in this report that Inovision did not process any non-conformance pertaining to Firmware or EPROMs since the last NUPIC audit. Does this mean that no non-conformance reports were received, or that they were received but not processed? Is there a requirement for users to provide non-conformance reports?
17.
In Attachment 2, paragraph 5.1, page 14 of 30, RG&E stated: The proposed safety system will perform all required safety functions for a design basis event in the presence of (1) any single detectable failure within the safety systems concurrent with all identifiable but non-detectable failures; (2) all failures caused by the single failure; and (3) all failures and spurious system actions which cause or are caused by the design basis event requiring the safety functions. Was common mode software failure considered when RG&E made this determination?
18.
In Attachment 2, paragraph 5.1.1.5, page 15 of 30, RG&E stated: Mounting of all redundant components in the same structures (such as both detectors in the duct, both trains of logic in Auxiliary Benchboard, both trains of conduit sharing conduit supports) has been performed in a manner to preclude a single component failure (mounting bolt, etc.) from causing both trains to fail, including design basis seismic events. Did this determination take missile hazard into account?
19.
In Attachment 2, paragraph 5.1.2.1, page 15 of 30, RG&E makes reference to independent qualified IE optical isolators. Please provide detail on the type and qualification of the isolators.
20.
In Attachment 2, paragraph 5.1.2.2, page 15 of 30, RG&E stated: These signals and power to the toxic gas power supplies are all isolated from the safety related portion of the design by qualified fuses. Please explain how fuses provide signal isolation.
21.
In Attachment 2, paragraph 5.1.4, page 16 of 30, RG&E stated: The vendor has provided a document citing the extensive use of these digital products throughout the industry and the high reliability of the equipment. Inovision has provided a summary of the product's operating history, stating that the digital firmware has been an extremely reliable product, with a large installed base and extensive control over any changes that have been incorporated. Please provide a copy of the vendor supplied document.
22.
In Attachment 2, paragraph 5.3.1, page 17 of 30, RG&E stated: This modification installs a limited number of new components. All components required to maintain the safety functions and maintain independence for the installation were procured safety related from qualified vendors, or were commercial grade dedicated by the controls of the Ginna Quality Assurance Program. Please provide a list of which electrical/instrumentation components were purchased as safety-related, and which were dedicated by Ginna. Include the source of the components, and for the dedicated components, how they were dedicated.
23.
In Attachment 2, paragraph 5.3.2, page 17 of 30, RG&E stated: The isolation relays have been procured as safety related from a qualified supplier. Fuses and fuse blocks for isolation, independence, and protective functions have been procured commercial grade but have been dedicated via a controlled, approved process as described in Ref.
2.18 electrical specification EE-100." Please provide a copy of electrical specification EE-100.
24.
In Attachment 2, paragraph 5.3.3, page 18 of 30, RG&E stated: RG&E implements a vendor oversight program to monitor vendor's quality control for safety-related products.
This program falls under 10CFR50 appendix B Criterion VII which requires us to establish specific measures to assure that purchased material, equipment and services conform to procurement documents. Nuclear Assessment Procedure QA-PES-I describes the methods used by Quality Assurance in evaluating a supplier's capability to be considered as a qualified Safety-Related, I0CFR50 Appendix B supplier, or as a qualified Commercial Grade Supplier, and the methods to be used for their periodic requalification. Please provide a copy of Nuclear Assessment Procedure QA-PES-I.
25.
In Attachment 2, paragraph 5.3.4, page 18 of 30, RG&E stated: The software was developed prior to existing requirements, therefore, no development tracking or formal verification and validation documentation has been developed. IEEE 7-4.3.2 Annex D provides guidance on addressing qualification of computers that were not developed per this standard. The objective of this qualification is to determine, with reasonable assurance, that the item being qualified satisfies the requirements necessary to accomplish the safety function. This involves identifying the safety functions that the computer must perform, identifying the characteristics the computer must possess in order to accomplish the safety functions, and demonstrating that the characteristics are acceptably implemented. The documentation that provides that assurance is provided on the Product Information Bulletin. In summary, the combination of actual operating experience in commercial and nuclear facilities, control of the firmware and changes, and functional testing that replicates the actual conditions and safety functions that must be performed, combine to provide adequate evidence that the unit will perform as designed. IEEE 7-4.3.2 Annex D is informative only, and is not a part of the approved standard. Nevertheless, Section D.2.3.2 on Software states that An evaluation should be performed to show that the functional and performance requirements and ACEs identified in D.2.2.2 have been complied with and resolved. This may require performance of special tests, performance of certain V&V activities, evaluation of published vendor specifications, or reliance on documented operating experience that is similar to the manner in which the computer will be used in the nuclear power generating station. Was this done? If so, please provide the analysis and other data. In addition, please:
A.
Identify the safety functions the computer must perform B.
Identify the characteristics the computer must possess in order to accomplish the safety functions C.
Demonstrate that the characteristics are acceptably implemented Please provide whatever documentation exists which considers these items, identifies the safety functions, characteristics of the computer, and shows they are acceptably implemented.
EPRI TR-106439, Guideline on Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications, also addresses dedication of commercial software. Section 4.2, when discussing dependability characteristics, states:
This is the category in which dedication of digital equipment differs the most from that of other types of components. It addresses attributes that typically cannot be verified through inspection and testing alone and are generally affected by the process used to produce the device. A key issue is that hardware failures are typically associated with fabrication defects, aging and wear-out, but software does not wear out. If there is a problem in the software that degrades the dependability of a device, it reflects a design error that was built into the device, or a mismatch between the application requirements and the device design.
In traditional dedications of mechanical and electrical equipment, dependability issues have been treated within the supplier's QA program and have been delineated in the commercial grade survey or source inspection plan. Due to the increased importance of these built-in attributes to a digital device, this document has defined these attributes as critical characteristics to ensure that they are adequately addressed and documented during the dedication process. Although this may be viewed as a departure from traditional procurement and dedication practices, the end result is considered compatible with current industry practices.
Table 4-1 shows methods of verification of critical characteristics, including dependability. Has this, or a similar method been used? If so, please provide the appropriate documentation.
26.
In Attachment 2, paragraph 5.4.2, page 19 of 30, RG&E stated: None of the equipment installed for this modification is dependent on any environmental control system in order to perform any safety function. In the past, the staff has found that electronic equipment has environmental requirements concerning temperature and humidity for the equipment to work properly. Will the installed equipment function correctly in all possible temperature and humidity conditions in the worst-case postulated accident?
What are the vendors listed temperature and humidity limitations?
27.
In Attachment 2, paragraph 5.4.3, page 19 of 30, RG&E stated: Specification EE-171 specifically requires that the instrumentation in the modification, provided by Inovision, be qualified to meet the requirements of EPRI TR-102323, "Guidelines for Electromagnetic Interference Testing in Power Plants" to demonstrate that the equipment is qualified to operate in an environment with EMI and electrostatic discharge concerns. Inovision has provided documentation demonstrating compliance with the requirements of this EPRI document with respect to EMI/RFl qualification. Please provide a copy of the Inovision provided documentation.
28.
In Attachment 2, paragraph 5.4.5, page 20 of 30, RG&E stated: IEEE 7-4.3.2 has additional requirements for this section of IEEE 603. Equipment qualification testing shall be performed with the computer functioning with software and diagnostics that are representative of those used in actual operation. Please provide information showing the diagnostics coverage of the computer functions.
29.
In Attachment 2, paragraph 5.5.2, page 20 of 30, RG&E stated: Post-modification testing has been structured to demonstrate that system response will be adequate in the configuration installed in the plant, in both active and bypass modes. Please provide copies of the test plan and test procedures for the post-modification testing.
30.
In Attachment 2, paragraph 5.5.3, page 21 of 30, RG&E stated: Failure of digital hardware or software of the system in the ratemeters will not inhibit manual initiation of protective functions. This is evident in attachment 2 wiring diagram that shows the manual isolation pushbutton contacts in series with ratemeter outputs so that if ratemeter outputs failed to the closed contact position, a manual initiation would still drop out the isolation relays and the system would perform its function. From the data provided by RG&E, it appears that the operators will know to manually isolate the system based upon the digital displays mounted in the control room. It also appears that the digital displays receive the radiation level data from the digital ratemeters. What backup is available if the digital ratemeters fail?
31.
In Attachment 2, paragraph 5.6.1, page 21 of 30, RG&E stated: A review of the design of the electrical systems associated with the proposed design has been performed to demonstrate that compliance with the requirements of IEEE Std 384, IEEE Standard Criteria for Independence of Class I E Equipment and Circuits." Please provide a copy of that design review.
32.
In Attachment 2, paragraph 5.15.2, page 27 of 30, RG&E stated: Inovision has provided evidence that this product has adequate operating history and error tracking to demonstrate design reliability, and that Inovision QA engineering control and testing provides assurance that the specific units shipped to Ginna for this application will meet the operating requirements with the same levels of reliability. Please provide a copy of this evidence. The staff is particularly interested in the requirements for non-regulated industrial users to report operating history and failures.
33.
In Attachment 2, paragraph 6.1, page 27 of 30, RG&E stated: The digitally-based portion of the automatic actuation circuitry has also been evaluated for real-time performance with respect to the systems requirements in these design analyses and found appropriate for the system to perform its functions. Please provide the evaluation which shows the required system response time, the system response time, and the method of determining the system response time. How will this response time be tested in the future?
34.
In Attachment 2, paragraph 6.5.1, page 28 of 30, RG&E stated: Any anomalies are immediately evaluated to explicit criteria for operability. What are these criteria?
35.
In reference to Ginna procedure EP-3-S-505, "Instrument Setpoint/Loop Accuracy Calculation Methodology," not all versions of ANSI/ISA-67.04 and RG 1.105 require that setpoints meet a 95/95 confidence level. Ginna did not provide the publication dates or revision levels for ANSI/ISA-67.04.01, ANSI/ ISA-RP67.04.02 standards, and for RG 1.105 which were used to developing the Ginna setpoint calculation methodology (procedure EP-3-S-505). Please provide the publication dates or revision levels of the standards used, and confirm that the setpoint calculation methodology meets 95/95 confidence level requirement.
36.
In Attachment 2, paragraph 4.0, page 4 of 30, RG&E stated: The modified system has been designed to function for the following events and resulting operating conditions:
Large Break Loss-of-Coolant Accident, Small Break Loss-of-Coolant Accident, Rod Ejection Accident, Steam Generator Tube Rupture Accident, Steam Line Break Accident, Fuel Handling Accident, and Tornado Missile in Spent Fuel Pool.
Per RG&Es design calculations, DA-EE-2001-013 R0, Control Room Radiation Monitors Analytical Limit Calculation, the analytical limit for the CREATS radiation monitors was calculated based on the release expected from a worst-case design basis loss-of-coolant accident (LOCA). In developing the radiation monitor analytical limit A.
Were any evaluations or analyses performed to determine the limiting source term and radiological releases the radiation monitors would be exposed to?
B.
Are the radiation monitors capable of detecting the releases from the non-LOCA accidents listed above and is the CREATS response time within the time assumed in the radiological analysis?