ML031671460

Proposed Technical Specifications Change Deletion of Monthly Analog Rod Position Test Request for Additional Information

ML031671460
Person / Time
Site:	Surry
Issue date:	06/09/2003
From:	Hartz L Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
03-099A
Download: ML031671460 (35)

Text

VIRGINLA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 June 9, 2003 U.S. Nuclear Regulatory Commission Serial No.

03-099A Attention: Document Control Desk NLOS/GDM R2 Washington, D.C. 20555 Docket Nos.

50-280 50-281 License Nos. DPR-32 DPR-37 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS 1 AND 2 PROPOSED TECHNICAL SPECIFICATIONS CHANGE DELETION OF MONTHLY ANALOG ROD POSITION TEST REQUEST FOR ADDITIONAL INFORMATION In a letter dated November 5, 2002 (Serial No.02-688), Virginia Electric and Power Company (Dominion) requested license amendments, in the form of changes to the Technical Specifications (TS) to Facility Operating Licenses Numbers DPR-32 and DPR-37 for Surry Power Station Units 1 and 2, respectively. The requested TS change would delete the monthly analog rod position test for the control rod boftom bistables.

Subsequently, in a letter dated February 14, 2003 (Serial No.03-099), Dominion provided a response to an NRC request for additional information (RAI) regarding the proposed TS change. Dunng staff review of the RAI response, the NRC deternined that additional information was necessary to complete their review. A conference call was held on May 6, 2003, to discuss the additional questions. At the conclusion of the conference call, Dominion agreed to provide a written response to the NRC's additional RAI, and this response is provided in the attachment. We have evaluated the proposed TS change previously submitted with respect to the supplemental information provided herein and have determined that the supplemental information does not require revision of the No Significant Hazards Consideration or Environmental Assessment provided in our original November 5, 2002 submittal.

Attached are:

1. Four (4) copies of, Response to NRC Request for Additional Information, Technical Specifications Change Request, Deletion of Monthly Analog Rod Position Testr (Proprietary), and

2. Two (2) copies of, Response to NRC Request for Additional Information, Technical Specifications Change Request, Deletion of Monthly Analog Rod Position Test" (Non-proprietary).

/Ad

{

Also enclosed as Attachment 3 are a Westinghouse authorization letter, CAW-03-1645, accompanying affidavit and Proprietary Information Notice.

As Item 1 above contains information proprietary to Westinghouse Electric Company, it is supported by an affidavit signed by Westinghouse, the owner of the information. The affidavit sets forth the basis on which the information may be withheld from public disclosure by the Commission and addresses with specificity the considerations listed in paragraph (b)(4) of Section 2.790 of the Commission's regulations.

Accordingly, it is respectfully requested that the information which is proprietary to Westinghouse be withheld from public disclosure in accordance with 10 CFR Section 2.790 of the Commission's regulations.

Correspondence with respect to the proprietary aspects of the items listed above or the supporting Westinghouse Affidavit should reference CAW-03-1645 and should be addressed to H. A. Sepp, Manager of Regulatory Compliance and Plant Licensing, Westinghouse Electric Company, P. O. Box 355, Pittsburgh, Pennsylvania 15230-0355.

If you have any further questions or require additional information, please contact Mr. Gary D. Miller at (804) 273-2771.

Very truly yours, Leslie N. Hartz Vice President - Nuclear Engineering Attachments Commitments made in this letter: None

cc:

U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center Suite 23T85 61 Forsyth Street, SW Atlanta, Georgia 30303 Mr. C. Gratton NRC Senior Project Manager U. S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 8G9 Rockville, MD 20852 Mr. R. A. Musser NRC Senior Resident Inspector Surry Power Station Commissioner Bureau of Radiological Health 1500 East Main Street Suite 240 Richmond, VA 23218 (Att. 2 & 3)

(Att. 1, 2 & 3)

(Att. 2 & 3)

(Att. 2 & 3)

SN: 03-099A Docket Nos.: 50-280/281

Subject:

RAI - Proposed TS Change Deletion of Mthly Analog Rod Position Test COMMONWEALTH OF VIRGINIA

)

)

COUNTY OF HENRICO

)

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Leslie N. Hartz, who is Vice President - Nuclear Engineering, of Virginia Electric and Power Company. She has affirmed before me that she is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of her knowledge and belief.

Acknowledged before me this 9th day of June, 2003.

My Commission Expires: March 31, 2004.

(SE )Notary Public

A1TACHMENT 3 Westincihouse Authorization Letter, CAW3-1645 Accompanvina Affidavit and Proprietarv Information Notice Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

Westinghouse Westinghouse Electric Company Nuclear Services P.O. Box 355 Pittsburgh, Pennsylvania 15230-0355 USA U.S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555-0001 Direct tel:

Direct fax:

e-mail:

(412) 374-5282 (412) 374-4011 Sepplha@westinghouse.com Our ref. CAW-03-1645 May 28, 2003 APPLICATION FOR WITHHOLDING PROPRIETARY INFORMATION FROM PUBLIC DISCLOSURE

Subject:

Enclosure to Dominion Energy (Surry) Letter (Serial No. 03-099A), "Response to NRC Request for Additional Information, Technical Specifications Change Request, Deletion of Monthly Analog Rod Position Test" (Proprietary)

The proprietary information for which withholding is being requested in the above-referenced document is further identified in Affidavit CAW-03-1645 signed by the owner of the proprietary information, Westinghouse Electric Company LLC. The affidavit, which accompanies this letter, sets forth the basis on which the information may be withheld from public disclosure by the Commission and addresses with specificity the considerations listed in paragraph (b)(4) of 10 CFR Section 2.790 of the Commission's regulations.

Accordingly, this letter authorizes the utilization of the accompanying affidavit by Virginia Electric and Power Company (Dominion).

Correspondence with respect to the proprietary aspects of the application for withholding or the Westinghouse affidavit should reference this letter, CAW-03-1645 and should be addressed to the undersigned.

Very truly yours, H.A.Sep anger Regulatory Compliance and Plant Licensing Enclosures cc: S. J. Collins B. J. BenneylNRR D. Holland/NRR A BNFL Group company

CAW-03-1645 bcc: H. A. Sepp (ECE 4-7A) L, IA R. Bastien, IL, IA (Nivelles, Belgium)

C. Brinkman, IL, IA (Westinghouse Electric Co., 12300 Twinbrook Parkway, Suite 330, Rockville, MD 20852)

RLE Administrative Aide (ECE 4-7A) IL, IA (letters w/affidavits only)

R. M. Manazir (286 Site) IL, IA M. J. Stofko (286 Site) IL, IA A BNFL Group company

CAW-03-1645 AFFIDAVIT COMMONWEALTH OF PENNSYLVANIA:

Ss COUNTY OF ALLEGHENY:

Before me, the undersigned authority, personally appeared H. A. Sepp, who, being by me duly sworn according to law, deposes and says that he is authorized to execute this Affidavit on behalf of Westinghouse Electric Company LLC ("Westinghouse"), and that the averments of fact set forth in this Affidavit are true and correct to the best of his knowledge, information, and belief:

H. A. Sepp, Manager Regulatory Compliance and Plant Licensing Sworn to and subscribed before me this 0g day of X),

2003 Notary Public Notarll N Seal W^.

4SharLFad, Notry Pti Mye JD*ss onEo anuary29,2O07 W1W.

XPenns)an*

Assodatian Or Notaries

CAW-03-1645 (1)

I am Manager, Regulatory Compliance and Plant Licensing, in Nuclear Services, Westinghouse Electric Company LLC ("Westinghouse"), and as such, I have been specifically delegated the function of reviewing the proprietary information sought to be withheld from public disclosure in connection with nuclear power plant licensing and rule making proceedings, and am authorized to apply for its withholding on behalf of the Westinghouse Electric Company LLC.

(2)

I am making this Affidavit in conformance with the provisions of 10 CFR Section 2.790 of the Commission's regulations and in conjunction with the Westinghouse application for withholding accompanying this Affidavit.

(3)

I have personal knowledge of the criteria and procedures utilized by the Westinghouse Electric Company LLC in designating information as a trade secret, privileged or as confidential commercial or financial information.

(4)

Pursuant to the provisions of paragraph (b)(4) of Section 2.790 of the Commission's regulations, the following is furnished for consideration by the Commission in determining whether the information sought to be withheld from public disclosure should be withheld.

(i)

The information sought to be withheld from public disclosure is owned and has been held in confidence by Westinghouse.

(ii)

The information is of a type customarily held in confidence by Westinghouse and not customarily disclosed to the public. Westinghouse has a rational basis for determining the types of information customarily held in confidence by it and, in that connection, utilizes a system to determine when and whether to hold certain types of information in confidence. The application of that system and the substance of that system constitutes Westinghouse policy and provides the rational basis required.

Under that system, information is held in confidence if it falls in one or more of several types, the release of which might result in the loss of an existing or potential competitive advantage, as follows:

(a)

The information reveals the distinguishing aspects of a process (or component, structure, tool, method, etc.) where prevention of its use by any of 2

CAW-03-1645 Westinghouse's competitors without license from Westinghouse constitutes a competitive economic advantage over other companies.

(b)

It consists of supporting data, including test data, relative to a process (or component, structure, tool, method, etc.), the application of which data secures a competitive economic advantage, e.g., by optimization or improved marketability.

(c)

Its use by a competitor would reduce his expenditure of resources or improve his competitive position in the design, manufacture, shipment, installation, assurance of quality, or licensing a similar product.

(d)

It reveals cost or price information, production capacities, budget levels, or commercial strategies of Westinghouse, its customers or suppliers.

(e)

It reveals aspects of past, present, or future Westinghouse or customer funded development plans and programs of potential commercial value to Westinghouse.

(f)

It contains patentable ideas, for which patent protection may be desirable.

There are sound policy reasons behind the Westinghouse system which include the following:

(a)

The use of such information by Westinghouse gives Westinghouse a competitive advantage over its competitors. It is, therefore, withheld from disclosure to protect the Westinghouse competitive position.

(b)

It is infornation that is marketable in many ways. The extent to which such information is available to competitors diminishes the Westinghouse ability to sell products and services involving the use of the information.

(c)

Use by our competitor would put Westinghouse at a competitive disadvantage by reducing his expenditure of resources at our expense.

3

CAW-03-1645 (d)

Each component of proprietary information pertinent to a particular competitive advantage is potentially as valuable as the total competitive advantage. If competitors acquire components of proprietary information, any one component may be the key to the entire puzzle, thereby depriving Westinghouse of a competitive advantage.

(e)

Unrestricted disclosure would jeopardize the position of prominence of Westinghouse in the world market, and thereby give a market advantage to the competition of those countries.

(f)

The Westinghouse capacity to invest corporate assets in research and development depends upon the success in obtaining and maintaining a competitive advantage.

(iii)

The information is being transmitted to the Commission in confidence and, under the provisions of 10 CFR Section 2.790, it is to be received in confidence by the Commission.

(iv)

The information sought to be protected is not available in public sources or available information has not been previously employed in the same original manner or method to the best of our knowledge and belief.

(v)

The proprietary information sought to be withheld in this submittal is that which is appropriately marked in the Attachment to VPA-E-0-WEC-03-0603-NR, "Response to NRC Request for Additional Information, Technical Specifications Change Request, Deletion of Monthly Analog Rod Position Test" (Proprietary), dated May 28, 2003 for Surry Power Station Units 1 and 2, being transmitted by Virginia Electric and Power Company (Dominion) letter and Application for Withholding from Public Disclosure and Affidavit, to the Document Control Desk.

This information is part of that which will enable Westinghouse to:

(a) Describe and apply qualified digital computer based hardware and software for utilization in protective and control processes at nuclear power plants.

4

CAW-03-1645 (b) Develop, verify and qualify hardware, software, and analytical models.

(c) Use computer codes to provide protective and control functions.

Further this information has substantial commercial value as follows:

(a)

Westinghouse plans to sell the use of similar information to its customers for purposes of meeting NRC requirements for licensing documentation.

(b)

Westinghouse can sell support and defense of the Common Qualified Platform.

(c)

The information requested to be withheld reveals the distinguishing aspects of a methodology that was developed by Westinghouse.

Public disclosure of this proprietary information is likely to cause substantial harm to the competitive position of Westinghouse because it would enhance the ability of competitors to provide similar system features, interfaces, analyzed plant parameters, displays and alarms, and licensing defense services for commercial power reactors without commensurate expenses. Also, public disclosure of the information would enable others to use the information to meet NRC requirements for licensing documentation without purchasing the right to use the information.

The development of the technology described in part by the information is the result of applying the results of many years of experience in an intensive Westinghouse effort and the expenditure of a considerable sum of money.

In order for competitors of Westinghouse to duplicate this information, similar technical programs would have to be performed and a significant manpower effort, having the requisite talent and experience, would have to be expended.

Further the deponent sayeth not.

5

CAW-03-1645 PROPRIETARY INFORMATION NOTICE Transmitted herewith are proprietary and/or non-proprietary versions of documents furnished to the NRC in connection with requests for generic and/or plant-specific review and approval.

In order to conform to the requirements of 10 CFR 2.790 of the Commission's regulations concerning the protection of proprietary information so submitted to the NRC, the information which is proprietary in the proprietary versions is contained within brackets, and where the proprietary information has been deleted in the non-proprietary versions, only the brackets remain (the information that was contained within the brackets in the proprietary versions having been deleted). The justification for claiming the information so designated as proprietary is indicated in both versions by means of lower case letters (a) through (f) located as a superscript immediately following the brackets enclosing each item of information being identified as proprietary or in the margin opposite such information. These lower case letters refer to the types of information Westinghouse customarily holds in confidence identified in Sections (4)(ii)(a) through (4)(ii)(f) of the affidavit accompanying this transmittal pursuant to 10 CFR 2.790(b)(1).

6

Westinghouse Non-Proprietary Class 3 ATTACHMENT 2 Response to NRC Request for Additional Information Technical Specificatlons Change Request Deletion of Monthly Analoa Rod Position Test Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

Response to NRC Request for Additional Information Deletion of Monthly Analog Rod Position Test Surrv Power Station Units 1 and 2 NRC Comment In the original submittal, Suny stated that "A digital upgrade modification to the Rod Position Indication (RPI) System is being implemented dunng the next refueling outage in each unit, thus making the monthly analog rod position test no longer necessary."

The staff needs to understand why implementation of the digital system makes the monthly test unnecessary. In order to understand this, the staff needs to understand what condition was verified by the monthly rod position test, and how the self-test of the digital RPI verifies the same condition. In the first request for additional information (RAI) the staff asked:

"If Suny is trying to justify the elimination of surveillances based on digital system self testing, it is critical to know just what that self-testing actually tests, and how these tests verify the same items which the surveillances verify. It is also critical to determine that the self test actually tests those things it is supposed to test."

The licensee's February 14, 2003 RAI response did not answer the questions.

In particular, the staff does not understand the reply to question 1 of the first RAI.

Subsection (a) of that question asked for A list of all diagnostic tests, and what functions are tested." The staff still fails to understand how the digital diagnostic tests will test the non-digital portions of the systems, such as the rod position detectors and the temperature compensation signal for those detectors.

NRC Question.e Please provide documentation on how these functional tests were perfonned by the original individual rod position indication (IRPI) system (if applicable) and how these functional tests will be perforrned by the replacement Computer Enhanced Rod Position Indication (CERPI) system.

Response

A. The original IRPI system consists of the following major elements:

1. IRPI Sensors Each rod has its own sensor, which is a linear variable differential transformer (LVDT). The sensor consists of a coil stack that has a primary winding and a secondary winding. The coil stack is located around the rod's pressure boundary for the length of the rod's travel. The primary winding of the sensor is excited by a fixed frequency altemating current (AC) signal with a constant magnitude. As Page 2 of 22

the rod moves, the amount of magnetic coupling between the primary winding and the secondary winding changes. The change in the magnetic coupling changes the AC signal that is present on the sensors secondary winding. The voltage developed on the secondary winding is proportional to the position of the rod. The sensors are connected to the IRPI cabinets with individual cables.

Each cable carries two signals. One signal provides excitation for the primary coil.

This signal is developed in the IRPI cabinets and transmitted to the detector. The second signal is the rod position signal, which is generated by the secondary winding of the sensor and is sent from the sensor to the IRPI rack.

2. IRPI Cabinets Equipment in the IRPI cabinets perform the following functions:

Generates the excitation signal for the primary winding of the sensors.

Conditions the AC signal that is received from each sensors secondary winding to a DC voltage that is proportional to the position of the rod as measured in steps of withdrawal. The signal conditioning provides the means for calibration of each IRPI signal by adjusting the signal for zero and span.

There is no temperature compensation performed by the existing IRPI signal conditioning. The engineering unit of a astep' is utilized to correlate with the manner in which the rod control system operates to move rods. The rod control system utilizes a magnetic jack system, which moves the rod in discrete increments, called steps.

Provides the rod position signals to individual meters in the Main Control Room for display to the reactor operators.

Provides the rod position signals to the plant computer.

Provides a bistable comparator for each individual rod position signal that will actuate relay contact outputs when the rod position signal falls below the rod bottom setpoint. For IRPI, the setpoint value is an analog voltage that is proportional to the setpoint value in steps. This comparator provides the rod bottom signals to the plant computer and the Emergency Response Facility (ERF) computer.

Provides the capability to inject an AC test signal to test the calibration of the signal conditioning module and the rod bottom alarm setpoint. Placing the system in test generates an alarm in the Main Control Room.

Provides an alarm if AC power is lost.

B. Existing IRPI Surveillance and Testing The Surry Technical Specifications describe the frequency and type of surveillance, calibration and test activities required for the IRPI. These activities are:

1. Shift Check A check of the analog rod position displayed on the Main Control Room meters against the rod position step counters is performed once per shift. The rod position step counters are an independent method of determining rod position by Page 3 of 22

counting the number of steps of rod motion that the rod control system has demanded. When a step of rod withdrawal is demanded by the control system, the step counter value increases by one step. Conversely, when the rod control system demands that the rod be inserted one step, the step counter value is decreased by one step.

2. 18-Month Calibration The IRPI system is calibrated on an 18-month frequency during each refueling outage. The fully withdrawn positions of the rods are established when the plant is at power. Measurement of the voltage values of the IRPI sensors are recorded at the IRPI racks when the rods are in the fully withdrawn position. The fully inserted positions are determined when the plant is in hot shutdown.

Measurements of the voltage values of the IRPI sensors are recorded when the rods are fully inserted.

Based on these measurements, each IRPI sensor is calibrated for zero and span.

3. Monthly Test The monthly test of the IRPI system is noted in the Surry Technical Specifications as Rod bottom bistable action". The monthly test is performed for each of the 48 rod bottom bistable comparators one at a time. The monthly test meets the Technical Specifications requirement by the following steps:

a. A selected rod position sensor is disconnected from the IRPI signal conditioning by a test switch at the IRPI cabinets. This switch also connects an AC test signal generator to the signal conditioning for the rod position circuit under test.

b. The technician performing the test connects measurement equipment to the test points that indicate the DC voltage of the input to the rod bottom bistable comparator.

c. The technician adjusts the test signal generator until the rod bottom bistable actuates.

d. The technician records the 'as found" value of the setpoint, in volts.

e. The technician adjusts the test signal generator until the rod bottom bistable retums to its normal state.

f. The technician records the "as found" value of the hysteresis.

g. The technician compares the "as found" data to the setpoint value and hysteresis value that are cited in the test procedure.

h. If the as found" data indicate that the bistable comparator has drifted out of its allowed tolerance, the technician will adjust the bistable comparator to bring it within tolerance.

i. The technician will record the "as left" data for the rod bottom bistable comparator.

j. The technician restores the rod position indication circuit to operation.

k. The technician repeats the steps above for each rod.

Page 4 of 22

C. CERPI System The CERPI system will replace the existing IRPI system. The only equipment that is being retained from the IRPI system is:

Existing LVDT rod position sensors located on the reactor head I

Existing cabling from the sensors to the IRPI cabinets and some cabling from the IRPI cabinets to other systems such as the annunciator and rod control system The IRPI cabinet shells In the CERPI installation, the existing IRPI equipment will be removed from the IRPI racks. The IRPI racks will be refurbished, and the new CERPI equipment will be installed in them.

The 48 analog meters located on the Main Control Room benchboard will be removed and two new CERPI color flat panel displays will be added to the benchboard.

The new CERPI displays provide for an improved operator interface when compared to the IRPI meters. Fiber optic cabling has been added to connect the CERPI system to the color flat panel displays in the Main Control Room and to connect the CERPI system to the plant computer.

The CERPI system provides for improvement in the accuracy of the rod position signal.

It accomplishes this accuracy improvement by adding the capability to compensate the sensor signal for the effects of temperature changes. CERPI also improves the signal accuracy by adding the capability of conditioning the signal to improve its linearity.

CERPI has the following elements:

1. Analoq Signal Conditioning F

7 ac Page 5 of 22

a,c

2. PLC Processinq to Determine Rod Position Values I

I a,c Page 6 of 22

a,c D. CERPI Surveillance and Testing The new CERPI system will retain the shift check and the 18-month interval calibration. These are described below:

1. Shift Check A check of the analog rod position displayed on the CERPI color flat panel displays against the rod position step counters is performed once a shift. The rod position step counters are an independent method of determining rod position by counting the number of steps of rod motion that the rod control system has demanded.

2. 18-Month Calibration The CERPI system will be calibrated on an 18-month frequency during each refueling outage. The technician uses the Maintenance and Test Panel (MTP) to determine the signal values at the required operating points. The technician then uses the MTP to adjust the calibration values, if required. Additional detail on how the technician uses the MTP to adjust tunable values is provided in the response to Question 3. The technician would verify the CERPI rod bottom Page 7 of 22

alarm setpoint by displaying its value on the MTP as a part of the calibration process.

E. Elimination of the Monthly Test The proposed Technical Specifications amendment would eliminate the monthly test that validates the rod bottom setpoint. In the CERPI system, an algorithm performs the comparison of the rod position values.

This algorithm is described in the response to Question 3d. The algorithm utilizes the rod position signal, which has been compensated for temperature and linearity, as described above.

This additional signal processing improves the accuracy of the determination of rod position. The more accurate signal value is compared to a digital value of the setpoint which has been entered through the use of the MTP. The setpoint value is stored in Flash Programmable Read Only Memory (FPROM). The digital setpoint is not subject to drift as the original IRPI analog bistable comparator and rod bottom setpoint were. There is no physical bistable in the CERPI system.

The entry, storage, and diagnostics associated with the rod bottom alarm setpoint are described in the response to Question 3.

Based on the method of entry and storage of the setpoint, and the diagnostic checks associated with the setpoint, changing the manual setpoint verification interval from monthly to an 18-month interval basis by eliminating the monthly test is warranted.

NRC Question 1.b Since these functions are not part of the Common Q nornal self check features, and since the CERPI system, being a non-safety system, is not subject to the Common 0 quality control and V& V procedures, please provide documentation of Surry's verification and validation and quality control (QC) programs which were used when these plant specific functions were developed.

The staff understands that these programs will not be as rgorous as those required for a safety related system, but there must have been some means used by the Suny engineering staff to assure themselves that the functions will perform as designed.

Response

The following discussion describes the CERPI project development and acceptance processes, as well as Dominion's involvement with the CERPI system supplier throughout the processes. These activities provide assurance that the CERPI system will perform as designed, and the proposed TS change will not compromise the performance of the CERPI system.

A. CERPI Project Initiation The overall project to develop a CERPI system for the Surry Power Station was initiated and controlled by Dominion. The initial phase of the effort involved the development of a plan for integrated instrumentation and control upgrades for Surry.

A project team was formed that included the major system stakeholders, including Project Management, Operations, Maintenance, Training, and Engineering.

The Page 8 of 22

project team developed a list of problems with the existing system and reviewed the existing system design, system problems, and desired enhancements with a number of potential suppliers.

The next step in the process involved the selection of a supplier.

Durng that process, detailed proposals were obtained and reviewed. Multiple meetings were held with the potential suppliers, including a meeting where a demonstration CERPI system was brought to the Surry site for a period of several days. This meeting was designed to allow the CERPI system to be reviewed in a "hands on" manner by a relatively large population of system users, including operators, I&C maintenance technicians, engineers, system engineers and reactor engineers.

The supplier evaluation also included a detailed review of the hardware and software platform for the proposed system and a review of operating experience.

The selected supplier met the performance requirements that Dominion had identified.

The selected supplier had demonstrated successful operating experience and had a thorough understanding of the existing IRPI system design basis and function, as this supplier had provided the original IRPI system for Surry. The hardware and software platform that was proposed was demonstrated to be of high quality, high reliability and capable of meeting the system's performance requirements based on Dominion's review and the review performed by the NRC that was documented in the Common 0 safety evaluation.

The CERPI system was developed by Dominion's supplier utilizing a structured design and testing process that included the development of formal system documentation and software that was developed in accordance with a structured life cycle process that is similar to that utilized for safety-grade systems.

B. CERPI Verification and Validation (V&V) Process The CERPI supplier implemented a formal software verification and validation process for the CERPI system. The V&V process was govemed by a formal V&V plan document. The V&V plan describes the following:

Purpose of the V&V Process, including adherence to the suppliers formal quality management system requirements, which are included in the plan as specific references.

Scope of the V&V Process, which includes a description of the software lifecycle to be used for software development and requirements for V&V at each stage in the life cycle. The scope also describes the requirement that the PLC standard system software be dedicated to the project by version control.

V&V Overview, which describes the organization, schedule, resources and responsibilities. The organization requirements also include requirements for independence of the V&V reviewers.

Life Cycle V&V Activities, which describes the required V&V activities to be performed at each stage of the life cycle. For each phase of the life cycle, the plan provides a detailed description of the following:

Page 9 of 22

Goal of the V&V activities to be performed for the phase Input documentation and information required for the V&V activities for the phase Tasks to be performed during the V&V with detailed checklists for V&V review guidance for the phase Description of the V&V outputs for the phase V&V policies and procedures, including discrepancy reporting and resolution, deviation policy, and control procedures.

The lifecycle phases for the CERPI software development covered by the V&V plan are the following:

Requirements Phase Design Phase Implementation Phase Test Plan Development Phase Test Results Evaluation Phase User Documentation Phase C. CERPI System Design and Implementation Process The CERPI overall design process was a top-down structured process. The first phase of the process was the requirements phase.

1. Requirements Phase In the requirements phase, two formal documents were developed for Surry: a System Requirements Specification and an Interface Requirements Specification.

a. CERPI System Requirements Specification (SRS)

The SRS describes the requirements for the CERPI system including the following topics:

Purpose and Scope, which provide a high level description of the SRS document Overview, which describes the existing IRPI system and provides a high level description of the CERPI system General Requirements, which describe requirements associated with physical layout constraints, environmental constraints, redundancy requirements and PLC data retention requirements System Performance Requirements, which describe the requirements for system accuracy, error budget allowances for the major subsystems and system timing requirements Page 10 of 22

• Analog Signal Conditioning requirements, which describe signal interface requirements, signal processing requirements and user interface requirements including test points, local indication and adjustment PLC Functional Requirements, which describes the requirements and block diagrams for each processing algorithm including signal processing, application diagnostics, alarming and calibration PLC Hardware Interface Requirements, which describe the input and output interface requirements by reference to the Interface Requirements Specification Maintenance and Test Panel User Interface Requirements, which describe the requirements for calibration, security, plant computer interface and maintenance displays Operator Flat Panel Display Requirements, which describe general requirements and requirements for calibration, security and detailed requirements for each operator-selectable display

b. CERPI Interface Requirements Specification The interface requirements specification describes the detailed CERPI requirements for interfacing to external plant equipment and systems. The requirements for each interface point are described in detail.

Interface requirements include the following:

• Sensor interface requirements including the function of the input and detailed requirements for input signal characteristics such as number of inputs, voltage, current, and frequency requirements

• Analog output interface requirements including the function of the output and detailed requirements for the number of signals and their voltage range, and output impedance Digital input and output requirements including relay requirements for each relay function including relay coil characteristics, contact characteristics, mounting and termination requirements Plant Computer interface requirements including the definition of signals, signal formats and communication requirements for transmission and the detailed definition of the cabling required for the fiber optic extemal interface Operator Display interface requirements, including the number of displays, communications protocol, and fiber optic cabling requirements Power and Heat Load interface requirements including requirements that define the input AC power characteristics, the intemal DC power supply characteristics, grounding requirements and the maximum expected heat load Cabinet layout and mounting requirements, where applicable Page 11 of 22

Intemal cable and wiring requirements including wire type, wire insulation, shield and outer jacket construction for both analog and digital cabling.

The cable requirements invoke the following industry standards:

IEEE Standard 383-1974 Paragraph 2.5 Flame tests UL Subject 1277, Vertical Tray Fire Tests

+ IPCEA S-19-81, Paragraph 6.19.6 Flame Resisting Test NEMA Publication No. WC3-1969 including revision no. 5, June 1976 After the suppliers internal review and approval of the requirements phase documents, they were formally issued for Dominion's review and approval.

Dominion conducted a detailed review of these documents, provided comments to the supplier, and approved the documents after incorporation of the comments.

2. Design Phase The design phase has two distinct elements: hardware design and software design.

Hardware Design The system requirements specification was the controlling document that provided the requirements that guided the hardware design. Based on these requirements, the hardware design was developed and documented primarily through formal drawings. These drawings include:

Block diagrams that outline the overall design of the system Configuration drawings that describe the equipment designed or selected to fulfill the hardware requirements Manufacturing drawings that provide the design details that control the manufacture of custom equipment, such as the analog signal conditioning equipment and custom mechanical components needed for mounting Schematic drawings that describe wiring interconnection of the hardware elements Assembly drawings that describe the assembly of the hardware elements into a system Physical drawings that describe the physical attributes of equipment needed to describe the physical interfaces of the equipment The drawings described above, with the exception of the manufacturing drawings, were formally issued for Dominion's review and approval. Dominion performed a detailed review of the drawings, providing comments where required. Dominion's approval of the configuration drawings, which described the use of the custom manufactured equipment, covered this aspect of the design.

Software Design Page 12 of 22

The software design is developed from the requirements defined in the system requirements specification. The system requirements specification was formally verified consistent with the V&V plan described above.

In the software design phase, the software definition is developed at the next level of detail, expanding the system requirements into design requirements that are suitable to control the software implementation phase. The CERPI software design is documented in a CERPI Software Design Description, which is the formal output of the software design phase.

This document describes the following:

References, which provide a formal definition of the inputs to the software design. The references include the following:

System Requirements Specification, which describes the Surry CERPI requirements Software V&V Plan, which describes the required documentation inputs, documentation outputs and documentation content requirements PLC Manufacturers Manuals, which describe the requirements for software structure, software interface to the PLC, software language characteristics, software building block functions, database elements and constraints on the software design that are imposed by the hardware Common Q Generic Flat-Panel Display Software Design Description, which describes the generic software design of this subsystem on which the Surry CERPI display applications will be designed Purpose, scope and overview, which describe the software design document at a high level General description, which provides the product perspective, product functions, user characteristics, general constraints on the design including modularity, readability, maintainability, programming language to be used, processor loading constraints, memory spare capacity requirements, and assumptions and dependencies Project dedication of standard software, which provides a detailed description of the PLC operating system software by revision level, a detailed description of the PLC applications programming tool software by version level, a detailed description of the Flat Panel Display operating system and display building tool by revision level, and the data format for the communications interface to the plant computer Database configuration including conventions, structure, module call names, and detailed descriptions of each database element Process control programming, which describes the control modules, application algorithm modules and the program hierarchy, structure and timing requirements MTP and operator flat panel display (OFPD) configuration, which describes the overall display requirements, presentation of analog values, presentation of digital values, navigation, and security Page 13 of 22

MTP and OFPD displays, which provide a detailed description of each display, including a graphical representation The software design description underwent V&V review and was formally transmitted to Dominion for review. Dominion performed a detailed review of this document and provided comments to the CERPI supplier.

3. Imnlementation Phase In the implementation phase, the hardware is procured, assembled and wired into the CERPI configuration. The CERPI supplier utilized standard industrial quality control practices during the hardware implementation, which included receipt inspection of all hardware and purchased software, and bench test of hardware assemblies. Continuity testing was performed to verify the wiring. The formal verification of the implementation of the hardware occurs in the testing phase which is the next phase of the process and is described in item 4 below.

For software, implementation involves the development of software source code from the software design documentation developed in the previous phase. The software development tool utilized for the Surry CERPI PLC system utilizes graphical function charts to implement the application software. The application software tool is self-documenting. The implementation documentation consists of process control diagrams formatted as function charts and database listings.

The tool also provides an ASCII listing of the source code. Source code for the MTP and OFPD software was also developed in the format consistent with the graphical display development tool. The CERPI supplier, as an integral part of the software implementation process, performed testing of the software. The software that resulted from the implementation process was subjected to a formal V&V review.

4. Test Plan DeveloDment In this phase, the CERPI supplier developed a comprehensive Factory Acceptance Test (FAT) procedure. The procedure was designed to validate the implementation and performance of the integrated system, both hardware and software. The FAT procedure describes the establishment and documentation of the required test equipment. For the Surry CERPI, this included the use of a simulated sensor test box that could simulate the behavior of the CERPI sensors.

For each of the tests, the procedure defines the test set up, signal values and display parameters to be monitored and expected results. The operation of the MTP and OFPD were validated during the conduct of each test by viewing and recording the values and attributes of the displays.

The CERPI FAT includes the following testing:

Verification of the installed software version numbers for each unique software element Power supply testing, including the validation of the fail-over capability between the redundant supplies Page 14 of 22

Calibration testing, which validates each calibration feature of the system, including zero, span, temperature compensation and linearity; the MTP calibration features are also validated during this testing Rod position alarm testing using simulated sensor signals, which validates the function of all of the rod position alarms, including the rod bottom alarm PLC transfer testing, including main PLC trouble, back up PLC trouble, common input trouble, watchdog timer timeout circuit tests for both main and backup PLCs, and system status testing, including processor load verification and 10 module diagnostic flag verification Oscillator trouble and failure testing, including oscillator trouble and switchover, main and back up oscillator failure, oscillator recovery and reset, and back up oscillator failure Loss of communications with a PLC System throughput testing Loss of AC power feed testing Plant computer interface testing V&V for the FAT procedure was conducted in accordance with the V&V plan described above.

The FAT procedure was transmitted to Dominion.

Dominion performed a detailed review of the test procedure, provided comments to the CERPI supplier, and approved the procedure after incorporation of comments.

5. Factory Acceptance Testing The CERPI supplier conducted the formal FAT and Dominion representatives witnessed the testing.

The test results were documented during testing as required by the procedure. The FAT was successfully executed.

6. Test Results Evaluation Phase The CERPI supplier is in the process of documenting the results of the FAT in a formal report. V&V will be performed on the FAT report consistent with the V&V plan. The FAT report will be submitted to Dominion for review and approval.

Dominion will conduct a detailed review of the report.

7. User Documentation Phase The CERPI supplier is in the process of developing a CERPI Technical Manual for Dominion's use in supporting operation and maintenance of the Surry CERPI system. Selected elements of the technical manual will undergo V&V.

The elements are:

Software configuration document Calibration procedure Maintenance procedure Page 15 of 22

The technical manual will be submitted for Dominion's review and approval. The supplier will also develop a final V&V report and transmit this report to Dominion for review and approval.

D. Surry Site Installation and Testing Dominion will perform installation and site acceptance testing for the CERPI system to validate that the CERPI equipment is correctly installed and operates correctly in the plant environment. This testing is designed, documented and conducted in accordance with established Dominion standards and processes.

NRC Comment The concept of elimination of surveillances based upon diagnostic online tests performed by the Common Q System is based in part on detailed review of the Common Q hardware and software. Extending this concept to a non-safety system based on similar components as the Common Q will depend to some degree on how similar the CERPI is to the Common 0.

NRC Question 2.a Are the Advant S 600 model AO 610 analog output module and the Allied Telesyn model AT-MC 102XL fiber optic modem for Fast Ethemet the only components used in the CERPI system that are not Common 0 components?

Response

The CERPI equipment is divided into the following categories:

Analog signal conditioning equipment, which is not Common Q equipment PLC equipment, which is Common Q equipment, including the model A061 0 analog output as described in the NRC SER, "Acceptance of the Changes to Topical Report CENPD-396-P, Rev 01 Common Qualified Plafform and Closeout of Category 2 Open Items," dated 2/24/03 Power supplies, which are Common Q equipment Operator flat panel displays, which are Common 0 equipment Maintenance and Test Panel, which is Common Q equipment Plant computer interface equipment including the Allied Telesyn model AT-MC 1 02XL fiber optic modem, which is not Common Q equipment Miscellaneous equipment, such as relays, wire, terminations, mounting equipment, etc., which are not Common Q equipment NRC Question 2.b Please include a list of industry standards used in the design, test and qualification of these non Common Q components.

Have these standards been endorsed by the NRC?

Page 16 of 22

Response

Analog Signal Conditioning Equipment The analog signal conditioning equipment is unique to the CERPI function. It is not Common Q equipment. This equipment was designed to the unique requirements in the CERPI System Requirements Specification and the CERPI Interface Requirements Specification. These specifications did not invoke any high-level industry standards.

Rather, the specifications provided detailed requirements for all the functions and critical characteristics for the analog signal conditioning equipment. These specifications were reviewed and approved by Dominion.

Validation testing was performed that demonstrated the compliance of this equipment to the specifications.

Plant Computer Interface Equipment This equipment is not Common Q equipment. It is standard industrial grade equipment and no high-level standards were invoked. This equipment was selected to meet the interface requirements specification, including compatibility with the plant computer system. The function of this equipment and its compatibility with the CERPI system were validated durng the Factory Acceptance Test for CERPI.

Miscellaneous Equipment This equipment is not Common Q equipment. It is standard industrial grade equipment.

It was selected for its conformance to the requirements detailed in the system requirements specification, interface requirements specification, and the CERPI drawings that describe the detailed design. Industry standards were invoked on the flammability of the cable as described in the response to Question lb. Equipment characteristics relative to CERPI performance were validated during the Factory Acceptance Test.

NRC Question 2.c For the portions of the system which are similar to the Common Q components, please compare the revision levels of the CERPI components to the Common 0 components.

For any which are dfflerent, please explain the differences.

Response

For the portions of the system that utilize Common 0 components, the hardware system is at the same revision levels as Common 0.

NRC Question 2.d Are all software components exactly as reviewed for the Common 0 system? Please compare the revision levels of the CERPI software components to the Common 0 software components. For any which are dffferent, please explain the differences.

Response

For the portions of the system that utilize Common Q components, the system software and the development tools are at the same revision levels as Common Q.

Page 17 of 22

NRC Question 2.e Please list any other software used in the CERPI system which was not reviewed and approved with the Common Q. As in question lb above, please provide documentation of Surrys verification and validation and QC programs which were used when these software components were developed.

Response

The CERPI applications software for the PLCs and the applications software that defines the displays for the MTP Panel and the OFPD are project specific software.

This software was developed as a part of a structured design process that incorporated a formal V&V process as described in the response to Question lb.

NRC Question 3 In the oiginal submittal, Surry states that:

"The rod position signal is then compared to a rod bottom setpoint that is a digital input to the fprogrammable logic controllers] PLCs via an interface on the maintenance and test panel (MTP) that will be located in the IRPI system cabinets."

Since this rod bottom setpoint seems to be used to generate an alarm, we would like to know how the rod bottom setpoint is generated on the CERPI?

Please include a description of the interface on the MTP (i.e., keypad, keyboard, dip switches). Identify any analog inputs to the setpoint If there are analog inputs, list the sampling rate and the reason this is sufficient.

Response

The MTP human-machine interface includes an IBM compatible PC with FPROM for storing CERPI values that can be changed by the technician, a touch screen display and a keyboard for the technician. The technician must actuate a key-lock switch before he can access the capability that will allow him to change an installed system value. To enter or change the rod bottom setpoint, the technician utilizes the MTP touch screen to select the "Tunable Parameters" display. The technician then selects the "Alarm Limit for Rod Bottom Alarm" setpoint to be changed (note that there is only one rod bottom setpoint value for the entire CERPI system). The technician then enters the new value using a keyboard and confirms that the entered value is correctly displayed as the current value. The technician would then return the key-lock switch to the position that disables any additional changes. There are no analog inputs involved with the setpoint.

Page 18 of 22

NRC Question 3.a Where in memory is the setpoint stored (i.e. EPROM, RAM)? How is this portion of memory protected?

Response

The value of the setpoint is stored in two places. The first place the value is stored is on the MTP FPROM for initialization of the communications software during an MTP boot-up. While the MTP is running, the variable is stored in a second location: a shared memory database in RAM. This is the value that is loaded onto the AF1 00 network and sent to the AC160 every 0.5 seconds. On the AC160, the setpoint values are stored only in RAM.

Question 3.b How is the value stored by the system verified? Is this an actual verification of the value, or is the check only a checksum or cyclic redundancy check (CRC)? How often is it verified?

Response

The setpoint is stored in FPROM at the MTP.

The following features protect the memory:

Requiring a key-lock switch to enable the capability to change a value Performing a reasonability check on the setpoint value entered by comparing it to a predetermined range Storing the setpoint value in non-volatile storage Performing communications diagnostics on the AF100 message transfer from the MTP to the AC160 PLC Performing RAM diagnostics in the AC1 60 Manually verifying the setpoint value as a part of the system calibration required by the plant Technical Specifications A detailed description of the AC160 diagnostics is included below:

1 a,c Page 19 of 22

The AF100 communication interface, Cl631, monitors the validity of the data sets it is supposed to receive.

If the data is not correctly transferred or the communication interface fails, the database element for the data set will be flagged as failed. The control module program constantly monitors the database element flag and performs the appropriate error processing.

NRC Question 3.c What is the value of the setpoint which will be used and how was it determined?

Response

The setpoint value utilized is the existing system's setpoint. The setpoint (20 steps) is provided in the station's controlled setpoint documents, and its adequacy was verified during the original design and licensing of the Surry plant.

Question 3.d Please provide the documentation of the plant specific code to actuate the alarm.

Response

There are three rod bottom alarm conditions calculated by CERPI.

These alarm conditions are:

Rod XX Bottom, where XX is the identity of the specific rod that is on the bottom Any Rod on Bottom All Rods on Bottom A detailed description of these alarm functions is provided below.

Rod XX Bottom Any Rod on Bottom a,c

]

,c Page 20 of 22

a,c All Rods on Bottom The output state of every rod bottom algorithm must be true to generate an "all rods on bottom" alarm.

The MTP functions include the capability of suppressing alarms. The use of the alarm suppression capability is administratively controlled by station procedures. The key-lock switch enabling of the change value capability described in the response to Question 3 above supplements these procedures.

NRC Question 4 Is the rod bottom bistable being eliminated? Please provide a line drawing or schematic of the new system, showing the parts of the old system that will be kept in service, and how they interface with the new computer enhanced system. Please show the interface with the maintenance test panel, and the rod bottom bistable.

Response

The existing IRPI rod bottom analog bistables are being eliminated. The new CERPI system utilizes software to perform the function previously performed by the analog bistables.

The system is being completely replaced with the exception of the following elements:

Existing IRPI detectors Existing cabling, connectors, and containment penetrations between the existing IRPI detectors and the existing IRPI cabinets Existing IRPI cabinets Some existing cabling from existing IRPI cabinets to other miscellaneous cabinets (i.e., annunciator cables and rod control logic cabinet cables, etc.)

Page 21 of 22

In a teleconference on May 6, 2003, the NRC representative noted that a line drawing or schematic of the new system was not required after discussing our response to this question.

NRC Question 5 In order for the staff to understand why the monthly surveillance can be eliminated, it is necessary for the staff to understand the reason why the surveillance was initially required. Is this reason documented in the TS bases or in licensee controlled documentation? If so, please provide a copy of this documentation.

Response

Technical Specification Table 4.1-1 describes the frequency and type of testing to be performed for analog rod position, and the table has a note that clarifies the purpose of the monthly test. The note states Rod bottom bistable action." This note focuses the monthly test on the verification of the action of the rod bottom bistable only. A copy of the cited page of Table 4.1-1 was provided in the original submittal letter (Serial No.02-688 dated November 5, 2002).

From this description it is inferred that the purpose of the monthly test was to determine whether the analog rod bottom bistable had drifted out of tolerance. The CERPI system utilizes a software algorithm with a digital setpoint that is not subject to drift. The CERPI diagnostics and design features described above justify including the rod bottom setpoint verification in the 18-month CERPI calibration that is controlled by plant Technical Specifications and eliminating the current monthly test.

Page 22 of 22