ML20175A800

Rev 2 Public Meeting on 29 June - Final

ML20175A800
Person / Time
Site:	Nuclear Energy Institute
Issue date:	06/29/2020
From:	Tekia Govan NRC/NRR/DRO/IRSB
To:
Govan T, 301-415-6197
Shared Package
ML20175A797	List: ML20175A799 ML20175A800
References
RG-1.187, Rev 2
Download: ML20175A800 (27)

Text

Regulatory Guide 1.187, Revision 2 Issuance Public Meeting June 29, 2020

Purpose

• Brief the Public on:

- The final versions of NEI 96-07, Appendix D, and Regulatory Guide (RG) 1.187, Revision 2, before issuance

• Both NEI 96-07, Appendix D and RG 1.187, Revision 2, were revised after the public comment period on the RG ended on 7/15/19

- How the exception in the Draft RG on Section 4.3.6 in NEI 96-07, Appendix D, was resolved*

• There is no longer an exception in RG 1.187, Revision 2, although there are two new clarifications

• NRCs Draft Revision 2 to Regulatory Guide 1.187, Guidance for Implementation of 10 CFR 50.59 Changes, Tests and Experiments (ML19171A323) 2

NEI 96-07, Appendix D, and RG 1.187, Rev 2 Timeline Through Issuance of RG 1.187, Rev. 2 for Public Comment:

• In July 2018, NEI provided an update to NEI 96-07, Appendix D

• In August 2018, the NRC staff provided a set of comprehensive comments (85 total) to NEI, and began a disciplined process for cataloging and tracking comments for resolution

• Public meetings were held with industry on 8/30/18, 9/11/18, 10/11/18, and 11/14/18 to resolve these comments. Over 90% of the comments were resolved using this process

• NEI submitted its final revision of NEI 96-07, Appendix D, to the NRC on 11/30/18. Letter requesting endorsement submitted 1/08/19

• ACRS Digital I&C Subcommittee meeting on 4/16/19

• Draft RG 1.187, Revision 2, was issued for public comment on 5/30/19 3

NEI 96-07, Appendix D, and RG 1.187, Rev 2 Timeline Through Issuance of RG 1.187 Rev. 2 for Public Comment (Cont):

• ACRS Full committee meeting on 6/5/19

• 06/25/19: Public meeting to conduct table-top exercises of digital I&C upgrades on applying Appendix D, Section 4.3.6 guidance (45-day RG 1.187 Public Comment period still open)

• 09/18/19: Public meeting on the comments received on RG 1.187, Revision 2. In addition, NRC offered draft wording to resolve the section 4.3.6 exception

• On 10/15/19 NEI provided revised Section 4.3.6 wording

• From November 2019 to April 2020: Staff discussion on section 4.3.6 wording

• On 4/22/20 NEI submitted final version of Section 4.3.6 wording

• On 4/27/20 there was a public meeting to discuss NRC comments and suggestions on Section 4.3.6 examples 4

NEI 96-07, Appendix D, and RG 1.187, Rev 2 Timeline Through Issuance of RG 1.187, Rev. 2 for Public Comment (Cont):

• On 5/13/20 NEI submitted by letter the final version of Appendix D and requesting endorsement

• ACRS Digital I&C Subcommittee meeting on 5/20/20

• ACRS Full Committee meeting on 6/3/20 5

50.59 Evaluation Criteria

- Result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the FSAR (50.59(c)(2)(i))

- Result in more than a minimal increase the likelihood of occurrence of malfunction of a structure, system, and component (SSC) important to safety previously evaluated in the FSAR (50.59(c)(2)(ii))

- Result in more than a minimal increase in the consequences of an accident previously evaluated in the FSAR (50.59(c)(2)(iii))

- Result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety accident previously evaluated in the FSAR (50.59(c)(2)(iv))

- Create the possibility of an accident of a different type than any previously evaluated in the FSAR (50.59(c)(2)(v))

- Create the possibility for a malfunction of an SSC with a different result than any previously evaluated in the FSAR (50.59(c)(2)(vi))

- Result in a design basis limit for a fission product barrier as described in the FSAR being exceeded or altered (50.59(c)(2)(vii))

- Result in a departure from a method of evaluation described in the FSAR used in evaluating the design basis or in the safety analysis (50.59(c)(2)(viii))

6

NEI 96-07, Appendix D (Rev. 0) Draft RG Exception 7

NEI 96-07, Appendix D (Rev. 0) Draft RG Exception

• The NRC staff takes exception to the application of the term safety analysis to the criterion in section 10 CFR 50.59(c)(2)(vi) in lieu of the term FSAR (as updated) throughout NEI 96-07, Appendix D, Section 4.3.6. In particular, the NRC staff takes exception to steps 5 and 6 in Determination of Safety Analysis Result Impact, Section 4.3.6 of NEI 96-07, Appendix D, because the determination of the safety analysis result impact is only made against the safety analysis sections of the FSAR (as updated) and not against the entire FSAR (as updated).

• Examples 4-17 through 4-23 of NEI 96-07, Appendix D, use the term safety analysis based on the explanation in the introduction of NEI 96-07, Appendix D, Section 4.3.6, rather than using the UFSAR.

This can result in an incorrect 10 CFR 50.59 evaluation.

8

NEI 96-07, Appendix D Path to Resolution Public Meeting Conducted on 6/25/19:

Purpose was to conduct a table-top exercises of digital I&C upgrades in which applying NEI 96-07, Appendix D, Criterion 6 guidance was met.

Public Meeting Conducted on 9/18/19:

Purpose was to discuss the public comments received on the draft RG.

9

NEI 96-07, Appendix D, Section 4.3.6 (Revision 1)

• Six Step Process in Section 4.3.6 Revised Wording

1. Identify the functions directly or indirectly related to the proposed modification

2. Identify which of the functions from Step 1 are Design Functions and/or Design Basis Functions

3. Determine if a new Failure Modes and Analysis (FMEA) needs to be generated

4. Determine if each design bases function continues to be performed/satisfied

5. Identify all safety analyses involved malfunctions of an SSC important to safety previously evaluated in the UFSAR

6. For each safety analyses involved malfunction of an SSC important to safety, compare the projected/postulated results with the previously evaluated results 10

NEI 96-07, Appendix D, Section 4.3.6 (Rev 1)

Acceptance Criteria Language in Step 6 Changed:

• For those design functions placed into any other category or combination of categories, if any of the previous evaluations of involved malfunctions of an SSC important to safety have become invalid due to their basic assumptions no longer being valid (e.g., single failure assumption is not maintained), or if any existing safety analysis is no longer bounding (e.g., the revised safety analysis no longer satisfies the acceptance criteria identified in the associated safety analysis), then the proposed activity creates the possibility for a malfunction of an SSC important to safety with a different result. If the acceptance criteria are still satisfied and the basic assumptions remain valid, there is no different result even if the malfunction of an SSC important to safety would otherwise cause changes to input parameters described in the USFAR.

11

Clarifications RG 1.187, Revision 2, endorses NEI 96-07, Appendix D, with clarifications Relationship to NEI 01-01: the NRC continues to find NEI 01-01 acceptable for use by NRC licensees. Licensees have the option to use the 10 CFR 50.59 guidance provided in either NEI 01-01 or in NEI 96-07, Appendix D, Revision 1. However, NEI 96-07, Appendix D, Revision 1 does not describe, and this revision to RG 1.187 (Revision 2) does not endorse, applying select portions from both NEI 96-07, Appendix D, Revision 1 and 10 CFR 50.59 guidance of NEI 01-01. In addition, NEI 96-07, Appendix D, Revision 1 is applicable to digital modifications only and is not generically applicable to the 10 CFR 50.59 process. (Reworded slightly from the draft RG) 12

Clarifications Human-System Interface (HSI):

• In NEI 96-07, Revision 1 changes to HSI automatically screened in.

• NRC has endorsed contradicting guidance in NEI 01-01, which states, not all changes to the human-system interface fundamentally alter the means of performing or controlling design functions, and therefore NEI 01-01 advises that not all changes to HSI should automatically screen in.

• NEI included similar guidance on screening for HSI in Appendix D.

• The NRC staff acknowledges that Appendix D is thus not a change from existing guidance on digital interfaces, but notes that it is a change from the guidance in NEI 96-07, Revision 1. The NRC staff agrees that changes to HSI may be screened as described in NEI 96-07, Appendix D, Revision 1. (Reworded from the draft RG) 13

Clarifications Sufficiently Low Likelihood of Software Common Cause Failure

• RIS 2002-22, Supplement 1, is currently the only guidance the NRC has reviewed or endorsed as providing an acceptable technical basis to determine that the likelihood of software CCF is sufficiently low for the purpose of 10 CFR 50.59 evaluations and may be used in conjunction with NEI 96-07, Appendix D, Revision 1. (Reworded slightly from the draft RG) 14

Clarifications Use of Acceptance Criteria as Evaluation Results:

• NEI 96-07, Revision 1, Section 4.3.6, in contrast to Appendix D, does not refer to acceptance criteria.

• NEI 96-07, Revision 1, provided that licensees should consider changes to SSCs at the same level at which malfunctions of the affected SSCs were previously evaluated in the FSAR (i.e., component- or system-level).

• The NRC has now determined that, in addition to the existing guidance in NEI 96-07, Revision 1, licensees may consider whether all applicable acceptance criteria are satisfied after a proposed change to demonstrate that no possibility for a malfunction with a different result has been created.

(New Clarification) 15

Clarifications Step 6: Basic Assumptions and Acceptance Criteria For those design functions placed into [categories 1.b, 2.b, or 3 in Step 2], if any of the previous evaluations of involved malfunctions of an SSC important to safety have become invalid due to their basic assumptions no longer being valid (e.g., single failure assumption is not maintained), or if any existing safety analysis is no longer bounding (e.g., the revised safety analysis no longer satisfies the acceptance criteria identified in the associated safety analysis), then the proposed activity creates the possibility for a malfunction of an SSC important to safety with a different result.

[Emphasis added.]

(New Clarification) 16

NEI Comments on RG 1.187, Rev 2 (From ACRS Subcommittee Mtg)

• Appears to unnecessarily insert the purpose of Criterion 8 in the consideration of Criterion 6. Resolution: Clarification 2.d was revised to remove Criterion 8 language.

• May not fully account for revised Section 4.3.6 guidance.

Resolution: Clarifications 2.d was revised.

• May imply that RIS 2002-22, Supplement 1 must be used in a broader population of DI&C activities than intended.

Resolution: Clarification 2.c was revised.

• The two-prong test has been the way that licensees having been doing 50.59 evaluations even though it is not stated in NEI 96-07, Revision 1. Resolution: Clarification 2.c retains this language, but it is slightly modified.

17

RG 1.187 Rev 2 Next Steps

• Issue RG 1.187, Rev. 2

• There will be a post-issuance 30 day public comment period 18

Questions ?

19

Back-Up Slides 20

NEI 96-07, Appendix D

• RIS 2002-22, Supplement 1, gives guidance on the technical aspect of digital I&C modifications, not the 50.59 process

• Appendix D gives digital I&C modification screening and evaluation guidance

• The format of Appendix D is aligned with NEI 96-07, Rev. 1 text for ease of use

• Some of the guidance in Appendix D is not digital specific

• NEI 96-07, Appendix D, does incorporate some RIS 2002-22, Supplement 1, guidance on qualitative assessments 21

RIS 2002-22, Supplement 1

• NRC issues RIS 2002-22, Supplement 1, in May 2018 to clarify RIS 2002-22

• NRC continues to endorse NEI 01-01

• RIS 2002-22, Supplement 1, clarifies guidance for preparing and documenting Qualitative Assessments

• Not for Replacement of:

- Reactor Protection System (wholesale)

- Engineered Safety Features Actuation System (wholesale)

- Modification/Replacement of the Internal Logic Portions of These Systems

• Licensees can currently performed digital modifications using RIS 2002-22, Supplement 1, guidance (without an NRC endorsed NEI 96-07, Appendix D) 22

NEI 96-07, Appendix D, Screening Section

• Scope of digital modifications:

- Software-related activities

- Hardware-related activities

- Human-System Interface-related activities

• To reach screen conclusion of non-adverse:

- Physical characteristics of the digital modification

• Change has limited scope

• Relatively simple digital architecture

• Limited functionality

• Can be comprehensively tested

- Engineering Evaluation Assessments

• Quality of the design process

• Single failures encompassed by existing failures of the analog device

• Has extensive operating history 23

NEI 96-07, Appendix D, Screening Section

• Combination of Components/Systems and/or Functions

- Mere act of combining does not make the screen adverse

- If it causes an adverse act on the design function, then adverse

- Reductions in the redundancy, diversity, separation, or independence of a UFSAR design function screen adverse

• Human Factors Engineering Evaluation

- NEI worked closely with NRC human factors personnel on this section

- Two steps:

• Identify generic primary tasks involved

• For all primary tasks, assess if the mod negatively impacts the primary task 24

NEI 96-07, Appendix D, Evaluation Section

• Guidance in Sections 4.3 aligns with main body of NEI 96-07 and there is a caution that Appendix D is intended to supplement guidance in main body of NEI 96-07

• Sections 4.3.1, 4.3.2, 4.3.5, and 4.3.6 (which align with the Criterion in the evaluation paragraph of 10 CFR 50.59)

(50.59(c)(2)) discuss the use of the qualitative assessment outcome (sufficiently low or not sufficiently low) to answer the evaluation questions

• Sections 4.3.3 and 4.3.4 state that they provide no new guidance for digital modifications

- More than a minimal increase in the consequences of an accident

- More than a minimal increase in the consequences of a malfunction 25

NEI 96-07, Appendix D Evaluation Section

• Guidance in Section 4.3.6 (Does the Activity Create a Possibility for a Malfunction of an SSC Important to Safety with a Different Result):

- Discussion on design basis functions

- Connection between design basis functions and safety analysis result 26

NEI 96-07, Appendix D Path to Resolution Example of Acceptance Criteria: (Example 4-18)

• Previously, only one of four feedwater flow control valves was assumed to fail open as part of the initiation of the Excess Feedwater event. Now, as a result of this change, all four feedwater flow control valves could simultaneously fail open following a software CCF.

• Step 6: The severity of the initiating failure has increased due to four valves supplying flow as compared to one valve prior to the change.

• The minimum acceptable departure from nucleate boiling ratio (DNBR), i.e., the acceptance criteria identified in the associated safety analysis, is 1.30. The current safety analysis documents a minimum DNBR value equal to 1.42. After using the increased value for the new feedwater flow (to represent the increase in feedwater flow caused by the opening of the four feedwater flow control valves) in a revision to the Excess Feedwater accident analysis, the new safety analysis documents a minimum DNBR value equal to 1.33.

Conclusion:

Although the software CCF likelihood was determined to be not sufficiently low and the severity of the initiating failure has increased, a comparison of the minimum DNBR values shows that the safety analysis remains bounded by the associated acceptance criteria. Therefore, the proposed activity does NOT create the possibility for a malfunction of an SSC important to safety with a different result.

27