ML20274A372
| ML20274A372 | |
| Person / Time | |
|---|---|
| Issue date: | 09/08/2020 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| Antonescu, C, ACRS | |
| References | |
| NRC-1077 | |
| Download: ML20274A372 (174) | |
Text
Official Transcript of Proceedings NUCLEAR REGULATORY COMMISSION
Title:
Advisory Committee on Reactor Safeguards Digital Instrumentation and Controls Docket Number:
(n/a)
Location:
teleconference Date:
Tuesday, September 8, 2020 Work Order No.:
NRC-1077 Pages 1-135 NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers 1323 Rhode Island Avenue, N.W.
Washington, D.C. 20005 (202) 234-4433
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 www.nealrgross.com 1
1 2
3 DISCLAIMER 4
5 6
UNITED STATES NUCLEAR REGULATORY COMMISSIONS 7
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 8
9 10 The contents of this transcript of the 11 proceeding of the United States Nuclear Regulatory 12 Commission Advisory Committee on Reactor Safeguards, 13 as reported herein, is a record of the discussions 14 recorded at the meeting.
15 16 This transcript has not been reviewed, 17 corrected, and edited, and it may contain 18 inaccuracies.
19 20 21 22 23
1 UNITED STATES OF AMERICA 1
NUCLEAR REGULATORY COMMISSION 2
+ + + + +
3 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 4
(ACRS) 5
+ + + + +
6 DIGITAL INSTRUMENTATION AND CONTROLS SUBCOMMITTEE 7
+ + + + +
8 TUESDAY 9
SEPTEMBER 8, 2020 10
+ + + + +
11 The Subcommittee met via Video-12 Teleconference, at 9:30 a.m. EDT, Charles H. Brown, 13 Jr., Chairman, presiding.
14 15 COMMITTEE MEMBERS:
16 CHARLES H. BROWN, JR., Chairman 17 JOY L. REMPE, Vice Chairman 18 WALTER L. KIRCHNER, Member-at-large 19 DENNIS BLEY, Member 20 JOSE MARCH-LEUBA, Member 21 DAVID A. PETTI, Member 22 MATTHEW W. SUNSERI, Member 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
2 ACRS CONSULTANT:
1 MYRON HECHT 2
3 DESIGNATED FEDERAL OFFICIAL:
6 ALSO PRESENT:
7 ERIC BENNER, NRR 8
MARK BURZYNSKI, NewClear Day, Inc.
9 TEKIA GOVAN, NRR 10 DAWNMATHEWS KALATHIVEETIL, NRR 11 JERRY MAUCK, Public Participant 12 SCOTT MOORE, Executive Director, ACRS 13 WENDELL MORTON, NRR 14 WARREN ODESS-GILLETT, NEI 15 STEPHEN VAUGHN, NEI 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
3 C-O-N-T-E-N-T-S 1
Opening Remarks by Chairman 2
3 Introductory Remarks 4
5 Updated Draft Final BTP 7-19, Revision 8 6
Wendell Morton................. 10 7
NEI Comments on Draft Final BTP 7-19, Revision 8 8
Stephen Vaughn, NEI 104 9
Warren Odess-Gillett, Westinghouse......
118 10 Mark Burzynski, NewClear Day, Inc.......
122 11 Closing Remarks by Chairman..........
135 12 13 14 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
4 P-R-O-C-E-E-D-I-N-G-S 1
9:32 a.m.
2 CHAIRMAN BROWN: This is Charles Brown, 3
the Chairman of the Digital I&C Subcommittee. It's a 4
little bit after 9:30, so we will go ahead and start, 5
and let Walt join us as he needs, as he can.
6 So anyway, this meeting will now come to 7
order.
This is a
meeting of the Digital 8
Instrumentation and Controls Subcommittee. I'm 9
Charles Brown, Chairman of this Subcommittee meeting.
10 ACRS members in attendance are Dennis Bley, Matt 11 Sunseri, Jose is not here, Joy Rempe, Dave Petti, Walt 12 Kirchner will join us, Myron Hecht, our consultant.
13 And I think I've covered everyone on the Committee.
14 if I've missed someone, please tell me.
15 Christina Antonescu of the ACRS staff is 16 the designated federal official for this meeting.
17 Christina, can we make sure the court 18 recorder is on, ready?
19 MS. ANTONESCU: Yes, the court reporter is 20 one.
21 CHAIRMAN BROWN: Okay. The purpose of 22 this meeting is for the staff to brief the 23 Subcommittee on the updated Draft Final Branch 24 Technical Position 7-19, Revision 8, the August 2020.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
5 Today we have members of the NRC staff and NEI to 1
brief the Subcommittee.
2 The ACRS was established by statute and is 3
governed by the Federal Advisory Committee Act, FACA.
4 That means the Committee can only speak through its 5
published letter reports. We hold meetings to gather 6
information to support our deliberations. Interested 7
parties who wish to provide comments can contact our 8
office requesting time.
9 That said, we've set aside 10 minutes for 10 comments from members of the public attending or 11 listening to our meetings. Written comments are also 12 welcome.
13 The meeting agenda for today's meeting was 14 published on the NRC's public meeting notice website, 15 as well as the ACRS meeting website. On the agenda 16 for this meeting and on the ACRS meeting website are 17 instructions as to how the public may participate. No 18 request for making a statement to the Subcommittee has 19 been received from the public.
20 Due to COVID-19 we are conducting today's 21 meeting virtually. A transcript of the meeting is 22 being kept and will be made available on our website.
23 Therefore, we request that participants in this 24 meeting first identify themselves and speak with 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
6 sufficient clarity and volume so that they can be 1
readily heard.
2 All presenters please pause from time to 3
time to allow members to ask questions. Please also 4
indicate the slide number you are on when moving to 5
the next slide.
6 We have a bridge line established for the 7
public to listen to the meeting. The public line will 8
be kept open in the listen-only mode until the time 9
for public comment. To avoid audio interference I 10 request all attendees to make sure they are muted when 11 not speaking. Based on our experience from previous 12 virtual meetings I would like to remind the speakers 13 and presenters to speak slowly.
14 We will take a short break after each 15 presentation to allow time for screen sharing as well 16 as the Chairman's discretion during longer 17 presentations.
18 We do have a short -- we will take a short 19 break -- I just lost something. Where am I? We will 20 take a short break after each presentation -- oh, I 21 already did that one. We do have a backup call-in 22 number should Skype go down and has been provided to 23 the ACRS members. If we need to go to this backup 24 number, the public line will be connected to the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
7 backup line.
1 Dennis, are you there?
2 MEMBER BLEY: Yes.
3 CHAIRMAN BROWN: Okay. If somehow I get 4
disconnected, would you kind of keep things on track 5
until I can get back in?
6 MEMBER BLEY: Certainly.
7 CHAIRMAN BROWN: Okay. Good. Thank you.
8 Lastly, please do not use any virtual 9
meeting feature to conduct sidebar technical 10 discussions. Rather, contact the DFO if you have any 11 technical questions so we can bring those to the 12 floor.
13 Just a schedule note: This meeting 14 extends through lunch. We will be breaking for lunch 15 at 1:00. The members have to attend another meeting 16 from 1:00 to 2:00. I will remind you at that point we 17 are going to recess. We will not log out of Skype.
18 We will leave ourselves in the meeting and just open 19 up -- for the members anyway we'll open up a second 20 session, but we will reconvene at 2:00 for the post-21 lunch break finales. I will remind everybody of this 22 when we get to that point.
23 We will now proceed with the meeting and 24 we'll ask Mr. Dawnmathews Kalathiveetil to share his 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
8 screen with us while Eric Benner -- did I get that 1
right, Dawnmathews?
2 MR. KALATHIVEETIL: Perfect.
3 CHAIRMAN BROWN: Okay. Thank you.
4 I will ask Eric Benner, the Director of 5
the Division of Engineering and External Hazards in 6
the Office of Nuclear Reactor Regulation for any 7
introductory remarks before we begin today's 8
presentations.
9 So, Eric, you're on.
10 MR. BENNER: Thank you, Member Brown. And 11 I most want to thank the Committee for their 12 flexibility, because as you all know we were 13 previously scheduled to have this discussion earlier 14 in the year. Because of a significant amount of 15 feedback we got from stakeholders, we -- given the 16 importance of this document for any significant 17 licensing actions that the NRC would review, we felt 18 it was important to faithfully review all that 19 feedback and make changes as appropriate. So we asked 20 for the briefing of the Subcommittee to be 21 rescheduled. We appreciate that the Subcommittee was 22 willing to entertain that rescheduling.
23 So we have a document that I think 24 visually looks a lot different than the previous 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
9 document, and I think part of that was to honor an 1
internal evaluation we had to reaffirm that this is 2
guidance for the staff and how the staff will conduct 3
their reviews and open the door to working with 4
industry to create maybe some companion guidance for 5
how licensees and applicants would put together their 6
application.
7 So you're going to hear from NEI today.
8 I think there are still some questions about exactly 9
how the document -- this document would be used as 10 opposed to what could potentially be contained in 11 industry guidance, whether it's generated by industry 12 or whether it be the NRC developing a regulatory guide 13 for industry.
14 So I think we've been working hard in 15 revising this document. We have not had a public 16 interaction in the interim. This is our first public 17 interaction since we've revised the document. So we 18 do intend to have a separate public interaction to 19 discuss these changes with stakeholders. We haven't 20 aligned exactly on when that will be.
21 So today we are going to focus mainly on 22 the changes we made. I think we are going to try to 23 the extent we can address some of the stakeholder 24 feedback that's going to be presented later, do that, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
10 but we're not at the -- ready to discuss at length how 1
we are going to have that communication with 2
stakeholders.
3 So with that I will turn it over to 4
Wendell Morton, who will be leading the presentation 5
for the staff.
6 MEMBER BLEY: Eric?
7 MR. BENNER: Yes?
8 MEMBER BLEY: This is Dennis Bley. The 9
Committee's had this for a number of weeks to look at.
10 When were the folks from the other stakeholders able 11 to get copies of it? Have they had it long?
12 MR. BENNER: No, at the same time that we 13 provided it to the Committee.
14 MEMBER BLEY: Oh, okay. So they've had a 15 fair amount of time?
16 MR. BENNER: Yes, we made it public -- I 17 mean, that's when we made it public, so that's when 18 they had access to it.
19 MEMBER BLEY: Okay.
20 MR. MORTON: Okay. Thank you, Eric.
21 Appreciate it.
22 Once again this is Wendell Morton. I am 23 the team lead for the BTP-719, Revision No. 8 project, 24 and today we'll be talking about a number of changes 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
11 we made inside there, but before we go any further I 1
want to thank my fellow team members, Rossnyev 2
Alvarado, David Ron, Dawnmathews, who is driving for 3
me today. Thank you for that.
4 And also want to give a
special 5
appreciation for Tekia Govan, our PM, because without 6
her we wouldn't have got this far. Instead, I want to 7
thank her for her efforts involved in this project, as 8
well as the rest of the staff that contributed to this 9
effort, and all the industry stakeholders who provided 10 a lot of great input that I think have gone -- to make 11 a great difference in the improvement in this document 12 overall.
13 As I said earlier we'll be discussing the 14 latest change to the document, specifically changes 15 between the June Subcommittee meeting for ACRS and the 16 meeting we have today, and those changes obviously 17 were made as a result of our public comment resolution 18 and our own internal concurrence comments, as well as 19 the feedback that was provided by the industry.
20 I want to note that the public comment 21 file itself, which we'll be presenting in the November 22 Full Committee meeting is still in the concurrence, so 23 therefore there may be a few changes or refinements in 24 the presentation, in the document as a result of 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
12 those. Just wanted to make a quick note of that.
1 And with that, Dawnmathews, can you go to 2
slide No. 2? So today we'll be covering obviously 3
some of the objectives we have, a summary of the key 4
changes we've made, the key top layers within the 5
document, covering some of the topics in the Draft 6
BTP, the scope of the document, the editing and 7
restructuring of the BTP, which I know a lot of folks 8
are interested in, specifically with the D3 9
assessment, with the command and controls guidance, 10 and then one -- another particular especially for the 11 justification document and the specific 12 vulnerabilities. We're going to get into a number of 13 those things in this presentation. And then lastly 14 we'll discuss the status and the next steps going 15 forward into the end of the year.
16 So if there no questions on that, 17 Dawnmathews, please go to slide No. 3.
18 So obviously our objectives is to present 19 the key changes made to the BTP and to obtain ACRS 20 Subcommittee feedback on the current draft version.
21 The Subcommittee did make a number of really good 22 comments for our consumption from the previous 23 meeting. And to the extent practicable we did 24 incorporate those comments and we will have a few 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
13 slides, a slide or so devoted to that point that we 1
will cover going forward into the meeting.
2 Please go to slide 4. So the summary of 3
the key changes. The biggest thing we want to say 4
here is that conceptually the BTP was revised and sort 5
of refined so that it focused more on staff guidance.
6 So a number of the sections within the BTP did see 7
some refinements or changes to sort of align along 8
those points.
9 Along those lines we did restructure 10 conceptually what the D3 assessment actually was. So 11 previously you might have seen that the graded 12 approach was actually called a graded approach. And 13 then you might have seen a D3 section. Then you might 14 have seen another separate section for the qualitative 15 assessment and then something separate for spurious 16 operation.
17 In going through -- looking at the 18 stakeholder feedback we received and going through our 19 own internal discussions we decided that in order to 20 simplify the document we really needed to warehouse 21 all those different concepts under the same umbrella 22 and just call it a D3 assessment. And we're going to 23 get into that in more detail.
24 So obviously because some of the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
14 restructuring the numbering you're going to see inside 1
the BTP has changed a bit as well in terms of the 2
section numbers. And obviously along those lines some 3
things have been edited and restructured. Much of the 4
concepts are the same; it's just been moved around to 5
different parts or it's been refined and provided more 6
detail based on feedback we've gotten, especially from 7
ACRS in a previous meeting.
8 We believe these other improvements 9
include readability of the document obviously, the 10 technical content and overall clarity of the positions 11 contained within and its overall organization, but I 12 do want to emphasize that many of these changes were 13 the result of ensuring that the BTP itself remains 14 directed to staff and staff reviewers only. So that's 15 one of the primary drivers for a number of the changes 16 you'll see in the document, especially from the June 17
'20 meeting going forward. And we'll get into that 18 later on in the presentation for that.
19 Dawn, if you'd go to slide No. 5, please?
20 So here is just a summary of the major topic areas 21 within the BTP. Obviously we made a number -- we made 22 a few changes or refinements to the scope of the 23 document in terms of what we consider latent defects.
24 We made some changes to the overall graded approach 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
15 scheme. And it's now been revised, so it's no longer 1
really called a graded approach, and we'll get into 2
that later on. We've warehoused the D3 assessment a 3
bit differently to make it more holistic so that other 4
types of analyses for lower safety significant systems 5
will be generally considered another type of D3 6
assessment. We'll make that clear. We'll clarify 7
that within this presentation as well.
8 Also, the different types of means to 9
eliminate CCF consideration, diverse means, evaluation 10 of event consequence and so on and so forth. These 11 are the major topical layers we're going to cover. At 12 our end of the BTP we'll cover how those changed post 13 the June 2020 ACRS meeting.
14 So, Dawn, can you go to slide No. 6, 15 please? So now we're going to get into the scope of 16 the BTP itself. And we did receive a number of public 17 comments along the lines in terms of scope. What 18 types of failures are included within the scope of 19 consideration for this analysis? And one of the major 20 comments we had from ACRS is clarifying what the 21 definition of latent defect was, and that's exactly 22 what we did within the scope, clarifying that it 23 includes active hardware, software and software-based 24 logic when addressing the CCF. And that's really the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
16 whole scope and focus of the BTP. So we clarified the 1
background section of the BTP to make that very clear, 2
that that's the scope and overall goal of the analysis 3
when you're looking at CCFs due to latent defects.
4 We clarified the design and analytical 5
solutions in the BTP, essentially meaning that within 6
the concept of D3 we tried to provide maximum 7
flexibility for a staff reviewer when looking at an 8
application to see what are the potential solution 9
sets that an applicant or a licensee may provide to 10 address CCF for systems of differing safety 11 significance. And we'll get into that a little more 12 later in the presentation.
13 As part of that we resolved a number of 14 public comments regarding the scope. A number of the 15 public comments were kind of going in different 16 directions whereas one -- some commenters wanted the 17 scope to remain what it previously was, which was 18 focused strictly on software. Other commenters 19 thought that the scope should expand to where we have 20 currently decided to be. So within our discussion we 21 decided that ensuring that we cover all the bases with 22 CCF is more beneficial both towards our future state 23 determinations as well as the technical adequacy of 24 the content that's being provided within the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
17 applications and license amendment requests. And 1
obviously we made some conforming changes within the 2
entire document along those lines to ensure there's 3
consistency in those considerations.
4 So if there's no other questions on that, 5
Dawn, can you go to slide No. 7?
6 So editing and restructuring the BTP. As 7
we stated earlier one of the main drivers of some of 8
the changes the public and ACRS members may have seen 9
from the June version of the document were in order to 10 ensure that the staff -- this remains staff guidance 11 essentially, that its main focus was that. So some 12 content was either revised or moved due to that 13 because it presented as industry-specific guidance, 14 something that's more akin to a Reg Guide or an ISG, 15 whereas a BTP is under a different consideration.
16 It's under a different set of I would say controls and 17 rules, and we tried to ensure that the changes made 18 really focus that this guidance was directed towards 19 staff.
20 So therefore we tried to walk the fine 21 line between making sure that obviously our industry 22 stakeholders do use this document in terms of guidance 23 for addressing CCF, and we understand that, but we 24 also had to walk the fine line between that and 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
18 ensuring that this remains staff guidance. We believe 1
we have achieved a fairly good balance between those 2
two considerations, but we're still open to hearing 3
feedback on that point. But that's the real main 4
driver for a lot of edits and restructure of the 5
document itself.
6 CHAIRMAN BROWN: Eric?
7 MR. MORTON: Part of the --
8 CHAIRMAN BROWN: Oh, I'm sorry. I thought 9
you were finished with the slide. Go ahead and finish 10 with the slide.
11 MR. MORTON: Sure. And just as you see in 12 the slide some of the refinements we made due to 13 those, to industry comments and then our own internal 14 discussions were really bringing a closer resolution 15 to the different types of (audio interference). We've 16 heard different comments about that, such as what are 17 you doing when it comes to CCF versus single failures 18 and they have propagating or cascading effects? So as 19 part of the refinement to the document we clarified 20 what failures of consideration are within the scope 21 and what failures are not within the scope? And now 22 if you can see our primary goal for the document is 23 not considering single failures, single malfunctions 24 or their effects. It is CCF due to latent defects is 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
19 the main scope.
1 And obviously one of the bigger changes --
2 actually two of the bigger changes we've made is to 3
incorporate the previous qualitative assessment 4
section and the previous spurious operation guidance 5
into the overall D3 assessment as considerations to 6
do. And we'll get into that in more detail when we 7
get to those individual sections.
8 Member Brown, you had a question?
9 CHAIRMAN BROWN: Yes, going back and 10 reviewing four different versions of this from Rev. 7 11 to the November Subcommittee meeting version to the 12 June Subcommittee meeting version to the first 13 version --
14 MR. MORTON: Yes, sir.
15 CHAIRMAN BROWN: -- of the one for this 16 meeting, which was then revised to become the fifth 17 version.
18 MR. MORTON: Yes.
19 CHAIRMAN BROWN: Or some -- I might be off 20 by a version or two.
21 MR. MORTON: That's fine.
22 CHAIRMAN BROWN: Going from earlier 23 versions, if you go back even to Rev. 5 vice Rev. 6 --
24 MR. MORTON: Yes.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
20 CHAIRMAN BROWN: -- there were numerous --
1 numerous -- by numerous, that's my definition --
2 MR. MORTON: Yes.
3 CHAIRMAN BROWN: -- examples for the 4
reviewer of some of the concepts --
5 MR. MORTON: Yes.
6 CHAIRMAN BROWN: -- relative to things 7
such as manual actuation should be downstream of the 8
last set of components that could actually be impacted 9
by CCF.
10 MR. MORTON: Yes.
11 CHAIRMAN BROWN: The other one would be 12 the 30-minute type stuff on manual operations relative 13 to time of time available and time required. All of 14 that was fundamentally -- virtually all examples for 15 the reviewer have been deleted. You reference -- I'll 16 finish.
17 MR. MORTON: Yes.
18 CHAIRMAN BROWN:
You do reference 19 documents such as Reg Guide 1.62 --
20 MR. MORTON: Yes.
21 CHAIRMAN BROWN: -- which is the Manual 22 Operation Reg Guide. You do reference NUREG-6303, 23 which goes through the diversity and 24 defense-in-depth --
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
21 MR. MORTON: Yes.
1 CHAIRMAN BROWN: -- I think the six types 2
that you refer to, and they cover -- and then you talk 3
also from -- the time manual action is SRP Chapter 18, 4
Appendix A.
5 MR. MORTON: Yes.
6 CHAIRMAN BROWN: Just one of my basic 7
concerns -- I understand -- this is my opinion or 8
my --
9 MR. MORTON: Yes.
10 CHAIRMAN BROWN: -- thought of why you did 11 it. You eliminate duplication when you refer back to 12 the other documents.
13 MR. MORTON: That's correct. Yes.
14 CHAIRMAN BROWN: That's both a good side 15 and a bad side.
16 MR. MORTON: Yes.
17 CHAIRMAN BROWN: There's a downside to 18 that. Based on all the interactions we've had, a lot 19 of the interactions we've had in the past, you --
20 staff -- the document doesn't much stand on its own.
21 It really has got a lot of different tendrils back 22 into a whole lot of other documents, which are fairly 23 voluminous in some cases, for people to be familiar 24 with. And in this day and age it would seem to me the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
22 experience level of the reviewers in many cases 1
they've not done any of this before. They're not 2
familiar with all the stuff that people have tossed 3
around in terms of how we do things and the 4
fundamental bases for things.
5 Did you all think at all about that in 6
terms of how much you deleted?
7 MR. MORTON: Yes, so we actually had a lot 8
of conversations about that, Member Brown, in terms of 9
-- and actually I think you made the case for the last 10 few sentences. You said in terms of why we did remove 11 certain content.
12 No. 1, as you did say, there's tendrils, 13 there's pointers to various different portions of 14 other staff guidance, whether it's Reg Guide 1.162 or 15 SRP Section 18 for a human factors aspect of it.
16 One of the things that you did say is that 17 there's a voluminous amount of material in those two 18 examples of guidance. And the amount of information 19 that would actually make useful to put in the BTP 20 would sort of defeat the purpose of even having those 21 guidance, so it's better to have a reference to them 22 rather than putting a small tidbit of information from 23 them so that the user can understand that if you're 24 looking at point 3 and point 4 of the SRM SECY 93087 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
23 ensuring how you meet that guidance.
1 Pointing to the Reg Guide 1.162 -- excuse 2
me, 1.62 rather than having a small subset did reduce 3
some of the duplication of information that can be 4
readily found within the Reg Guide itself. Rather 5
than having a specific subsection it only has a 6
partial amount of the content. It really wouldn't do 7
it justice for a staff reviewer looking at that. So 8
you kind of actually made the case for why we've done 9
that.
10 Also in consideration of readability and 11 usability of the document for both staff and industry 12 we're trying to keep the document to a -- let's just 13 say reasonable length, but if we did incorporate a lot 14 of those other pointers to information, it would make 15 the document much more voluminous than it needs to be, 16 as you stated earlier.
17 MR. BENNER: And, Member Brown, if I may 18 add; this is Eric Benner, we -- there's a general 19 attempt by staff to streamline some of this guidance 20 and then use maybe other -- one is to make sure the 21 guidance interfaces appropriately, and that's the use 22 of pointers.
23 Regarding things like examples, we're 24 considering things like using other tools like 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
24 Nucleapedia and figuring out the best way to keep 1
capturing a lot of the knowledge management aspect.
2 So we -- we're -- the door is still open on how we're 3
going to do that. I will say that the people who are 4
going to first use the BTP for the first reviews are 5
going to be very familiar with all those supporting 6
documents. So it's not like we're going to throw a 7
new reviewer the BTP and say here, license on major 8
modifications.
9 So there's acknowledgement that for the 10 first ones we definitely need the experience people, 11 the people who have been involved in the revision to 12 the BTP. And then there's definite knowledge 13 management work to do within the staff as we get 14 through those first reviews to make sure that all the 15 reviewers understand all the ins and outs of the BTP 16 and the linkages to other guidance documents.
17 MEMBER BLEY: Eric, this is Dennis Bley.
18 Just to follow up on Charlie's question, I'm kind of 19 in the middle on this, and I think back to 10 or 12 20 years ago when we ran into a case, a special one on 21 manual human actions human actions where some of the 22 people involved at this point weren't aware of some of 23 the other work that had provided better guidance, if 24 you will, or more thorough guidance in this area.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
25 One thing that might help; have you guys 1
thought about doing it, if instead of just the long 2
list of references you put some kind of graphic map to 3
put in here to help the newer reviewers see what these 4
linkages are and real briefly what's in each place, 5
where you get examples of one kind of problem or 6
another?
7 CHAIRMAN BROWN: I'm going to -- I want to 8
echo Dennis' comment a little bit. You do reference 9
-- you don't depend on the list of references to get 10 this. You do reference Reg Guide 1.62, 63.03 --
11 MR. BENNER: Yes.
12 CHAIRMAN BROWN: -- SRP Chapter 18, 13 Appendix A in the text where you're discussing these 14 particular forms. There's a few inconsistencies that 15 you've now built in with this, because if you look at 16 1.62, there's a specific sentence in 1.62 that says 17 guidance provided in BTP 7-19 asserts that manual 18 controls should be connected downstream of the plant's 19 digital safety systems. In other words, it uses the 20 basis for 1.62 as being in 7-19. So that's missing.
21 I'm not falling over myself dying about that. It's 22 just we built -- it's almost like 7-19 was the 23 originator and then somehow it flowed into 1.62.
24 But Dennis is right from the standpoint 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
26 that if there is a way to clarify within the BTP the 1
relevant other documents so that they don't have to 2
worry about looking at that list in
- front, 3
particularly if there's more than one that applied to 4
a particular area.
5 I think -- Dennis, did I capture your 6
thought?
7 (No audible response.)
8 CHAIRMAN BROWN: Are you there?
9 MEMBER BLEY: You had a different take on 10 it, but yes, we're talking about the same thing.
11 CHAIRMAN BROWN: All right. Okay. So I 12 didn't want to undercut because I -- you -- if you're 13 familiar, if you're experienced and you've done a lot 14
-- a number of these, then your brain is already 15 thinking like that. I just -- it's the aspect of I 16 know that there -- we all -- all organizations go 17 through a case where you have to rebuild and you don't 18 want to rebuild in entirety. You want to have a 19 gradual turnover of knowledge, if you want to call it 20 that. And that's difficult to do. I faced that for 21 22 years in NR, in naval reactors.
22 So anyway, that's why I -- I just wanted 23 to make sure I understood your thought process, if it 24 was somewhat in line with mine. I do not have any 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
27 comments on that. I will have a couple of real basic 1
comments to roast you all on at the end of the 2
meeting, but I did not want to interfere with the 3
process of getting through this, because I think 4
there's a couple of points that are ripe for 5
discussion at the end of the meeting, but I --
6 literally I want to flow through what you all did.
7 I do want to give one positive comment; 8
you think we never do that, but after the four -- I 9
don't know how many rounds of versions on Rev. 8 have 10 been now. I put aside all the rest of them in the 11 beginning. Rev. 7, I put the first three versions of 12 Rev. 8 -- and I took the August version. I just sat 13 down and read it. Then I think Tekia and her staff 14 did a very good job of reorganizing and bringing --
15 instead of having various types of these issues 16 scattered, they were consolidated into discrete 17 sections. It read much smoother, much smoother than 18 the Rev. 7. I went back and read that again, as 19 painful as it was.
20 So that's a bit of a compliment. I 21 shouldn't maybe do that because you won't like the end 22 of the meeting comments.
23 MR. MORTON: We'll take what we can get, 24 Member Brown.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
28 CHAIRMAN BROWN: Pardon?
1 MR. MORTON: We'll take what we can get, 2
Member Brown.
3 CHAIRMAN BROWN: Yes, I know, but I just 4
-- at some point -- because this is a very, very 5
difficult task, and I thought the reorganization and 6
the reruns -- in spite of the pain and agony that 7
you've had to go through, I think the end -- it did 8
read much smoother. The various ways to deal with 9
defense-in-depth and diversity were not scattered in 10 terms of their context.
11 MR. MORTON: Yes.
12 CHAIRMAN BROWN: They were more compact in 13 one or two particular sections. So that was a 14 positive side. I'll let you get on with the rest of 15 the slide here and then --
16 MR. MORTON: Yes.
17 CHAIRMAN BROWN: to the next -- reset of 18 the slides. So thank you for your response.
19 MR. MORTON: Yes, no problem. And that 20 was definitely one of our goals is to make sure the --
21 all relevant information to a specific topic was 22 contained where it should be to improve overall 23 readability so you didn't have things scattered.
24 Because we noticed that about Rev. 7 and previous 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
29 revs, that things are kind of all over the place. So 1
making sure things were in their right silo for 2
readability for both the staff review and for the 3
folks in industry who may be using it was one of our 4
goals.
5 I would also note that one nuance in terms 6
of content, that we kind of noticed this with the 7
manual operator action guidance, is that sometimes 8
things change within the referred-upon guidance 9
document. So sometimes when you have too much 10 information quoted from a particular document, 11 document changes, it also affects the BTP. And I 12 think you just gave an example of that, Reg. Guide 13 1.62. So that's another reason why we have had to 14 reduce the amount of footprint of other documents from 15 the guidance structure into the BTP because of that 16 point.
17 CHAIRMAN BROWN: Well, I was just trying 18 to make the point that the 1.62 kind of made 7-19 the 19 basis for why the downstream. Now you all have 20 reversed that. I don't have any problem with that.
21 It's just now 1.62 makes an assertion that is no 22 longer true because you don't even -- downstream is 23 not even mentioned in the BTP.
24 MR. MORTON: Yes.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
30 CHAIRMAN BROWN: It's strictly a reference 1
to 1.62.
2 MR. MORTON: Yes.
3 CHAIRMAN BROWN: So I mean, it's going to 4
be what it is.
5 The other -- I guess the other thing that 6
I felt when I read through it, the reorganization and 7
the deletion of certain types of information really 8
put it more on a -- it's more ethereal and abstract in 9
many cases. There's no direct connection to equipment 10 in some ways, which when you remove examples of what 11 is acceptable --
12 MR. MORTON: Yes.
13 CHAIRMAN BROWN: -- you lose context with 14 the high-level thought process. That's all. It's 15 just something we're going to have to deal with.
16 MR. MORTON: Okay.
17 CHAIRMAN BROWN: All right. Go ahead.
18 I'm sorry. I just had to get my two cents worth in.
19 MR. MORTON: Not a problem, Member Brown.
20 If there's no other questions on this 21 slide -- we'll get into the D3 assessment piece later 22 on.
23 But if there's no questions, Dawnmathews, 24 please go to slide No. 8.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
31 And as discussed earlier, these are some 1
of the major changes we've made based upon previous 2
ACRS feedback. This is going back to the November 3
Subcommittee meeting and the June Subcommittee 4
meeting. I know Member Brown had a couple concerns in 5
terms of removal of content. And as you stated 6
earlier, a lot of that was driven by making sure that 7
the document itself remain focused and directed 8
towards staff with refinements and improvements in the 9
content flow and structure of the document and in 10 terms of the lead-in discussions we did with each 11 major section of the BTP so that we actually provided 12 a better lead-in for the content itself so that it was 13 understandable to the reader, whomever that may be, 14 what we're actually trying to accomplish with that 15 particular section of guidance.
16 Another major point that we discussed in 17 the previous meetings is just the basic understanding 18 of the overall concept of defense-in-depth and the 19 echelons of defense that comprise that. So we did 20 have a larger section of that previously, but due to 21 the changes we made it did get reduced down to more of 22 a clarified and refined portion where we basically 23 said the overall goal is to maintain defense-in-depth 24 for the plant.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
32 And there's the basic four echelons of 1
defense-in-depth which we define within the BTP still, 2
just maybe not in the level of detail that was 3
previously. We really refined it towards what was 4
necessary for our basic understanding of that, and we 5
provided references to the NUREG-6303, which provides 6
more granularity in those particular concepts.
7 So this kind of illustrates what we were 8
talking about with the previous slide in terms of 9
redefining the content without having extraneous 10 detail that necessarily didn't actually add to it, but 11 may have gotten in the way of getting -- making a 12 crisp understanding of the reading when you get to 13 that particular section.
14 And also when we say -- for the last 15 bullet, refine the connectivity between the major 16 sections, you have Sections 2, 3, 4, 5 and 6 now. And 17 as Member Brown had referred to earlier, Rev. 7 was 18 kind of all over the place when it came to sections.
19 There were multiple different sections about spurious 20 operation and things like that. So we made sure that 21 if there are jump-off points or lead-in points or 22 connections between some areas -- we tried to make 23 them as clear as possible so that the reader 24 understands where you should be going, whether the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
33 document to accomplish -- trying to accomplish, 1
whether you're looking at a different aspect of a D3 2
assessment, a particular methodology or if you're 3
looking at how to -- what information you need to 4
provide in the application. We tried to make sure 5
that all those particular connections were clear and 6
crisp so there was no ambiguity for -- which you need 7
to do when you're reading through the documents.
8 CHAIRMAN BROWN: I will -- this is me 9
again. I will be addressing your echelons issue as 10 part of my discussion at the end of the meeting, just 11 to give you a heads up.
12 The lead-in discussions were -- it was 13 obvious you took into account the comments we made in 14 the last couple of meetings, and I think that improved 15 it. I hope you all thought it improved it. I thought 16 it did.
17 MR. MORTON: We did. Actually we did.
18 CHAIRMAN BROWN: Your comment about 19 spurious actuations and stuff, that was kind of 20 sprinkled in a couple of the different areas. There's 21 not a -- there is one area on spurious, but then it's 22
-- the use of the word spurious is tossed in a few 23 other places. I feel it's appropriate, so I didn't 24 say anything about -- I wasn't going to say anything 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
34 about that other than making the observation that some 1
of the comments we made back in 2011 when we reviewed 2
Rev. 6 --
3 MR. MORTON: Yes.
4 CHAIRMAN BROWN:
which were 5
incorporated in responses from the EDO. Those are 6
gone and you now are just referencing the base 7
documents, 6303 and et cetera, or the other type 8
documents for those issues. So that was a pretty big 9
change. So you did lose the comments and stuff we --
10 that you all added in response to our recommendations 11 from 2011, if you can believe I actually found it. I 12 was surprised as well.
13 All right. Go ahead. I'm sorry.
14 MR. MORTON: Yes, Member Brown, just to 15 sort of touch on that point, we did take a hard look 16 at those previous comments from the 2011 letter and we 17 did look at -- we did take really hard into account 18 all the feedback that we provided from the November 19 Subcommittee meeting from last year in this meeting.
20 There were some things we were able to maintain 21 because they did align with the refinement of the 22 document to make sure it's directed towards staff.
23 There were other things a bit more 24 challenging to maintain, so what we tried to do is 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
35 maintain the basic abstract content that was in there 1
such as the definition of the defense-in-depth and 2
some of the basic concepts of it without getting into 3
a lot of the extra detail that really exists within 4
for example NUREG-6303. And that's kind of the basic 5
way we went about it is for documents that we do 6
reference, we get into more of the basic aspects of it 7
as it pertains to addressing CCF due to latent 8
defects. And any other further discussions we simply 9
provide the pointer that you can get that in a better 10 source, in extra source material itself.
11 CHAIRMAN BROWN: Okay. Well, I'm going to 12 give you a heads up for the end then because in both 13 the November meeting --
14 MR. MORTON: Yes.
15 CHAIRMAN BROWN: -- and the June meeting 16 I brought up the issue of architecture as being kind 17 of the overall framework for defense-in-depth.
18 MR. MORTON: Yes.
19 CHAIRMAN BROWN: And the word architecture 20 is not even mentioned in the new BTP other than maybe 21 it's for a control system architecture. That was 22 about the only one, one listing of it.
23 And I think the biggest point that I think 24 we missed in this version of the BTP is -- and you do 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
36 list what you call from 6303 the normal echelons of 1
defense: reactor control, reactor trip, SFAS and the 2
monitoring and indication systems as individual 3
echelons of defense. That's in the background.
4 MR. MORTON: Yes.
5 CHAIRMAN BROWN: But the basic overall 6
thought process of how you develop a defense-in-depth, 7
this reminds me of my first introductions to how the 8
staff was reviewing the I&C systems, trip systems and 9
SFAS systems for new -- some of the new applications 10 where it was piecemealed. They were fundamentally 11 taking IEEE standards and Reg Guides, reviewing the 12 positions and saying if you meet the position, then 13 everything is fine, but you didn't know what the CAR 14 (phonetic) looked like.
15 MR. MORTON: Okay.
16 CHAIRMAN BROWN: And you will find me 17 addressing this in exquisite excruciating painful 18 detail at the end of the meeting, because I think we 19 lost a -- we didn't lose. We haven't really stressed 20 how architecture and echelons of defense go together 21 as a starting point. And so I'll bring that up at the 22 end, but I'm a firm believer in the echelons of 23 defense approach, the separation of church and state, 24 the independence of the major safety systems, and both 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
37 of those issues are just like a stake in my heart if 1
they're not addressed properly. So -- or in my own 2
mind properly.
3 MR. MORTON: So, Member Brown, if I 4
understand your comment, then you don't believe that 5
there is enough emphasis on the defense-in-depth 6
concept with --
7 (Simultaneous speaking.)
8 CHAIRMAN BROWN: The basic concept -- it 9
ought to be up in the background. And I'll give you 10 all kinds of words on it at the end, and then you'll 11 obviously be able to do with it what you want.
12 MR. MORTON: Okay.
13 CHAIRMAN BROWN: But I think that really 14 helps put in perspective what are we trying to 15 accomplish? What is the reviewer trying to maintain 16 and make sure he has? And I think that's lost right 17 now. Some of it got lost when we eliminated some of 18 the -- what I would call the little fine points, but 19 they weren't in part of the big picture. They were 20 little tidbits. And those of us who have been 21 involved in it for decades understand what the tidbits 22 meant, but now we -- I think you've done a good job 23 with the rest of the document, but that background on 24 what we're trying to accomplish is -- can stand some 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
38 real basic improvement which I'll provide some detail 1
on at the end.
2 MR. MORTON: Okay. We appreciate the 3
comment then. Thank you.
4 CHAIRMAN BROWN: Okay. Thank you.
5 MEMBER KIRCHNER: Charlie, this is Walt 6
Kirchner.
7 CHAIRMAN BROWN: Yes.
8 MEMBER KIRCHNER: Could I just -- I just 9
observed something, and that is with regard to this 10 defense-in-depth concept the late Ms. Drouin had done, 11 from the staff, quite a bit of work in this area in 12 documenting it in a -- I think it was a Knowledge 13 Management Report where she laid out seven principles 14 of defense-in-depth. And I'm just curious as whether 15 the staff working on this referred to that work that 16 was done by their colleagues.
17 MR. MORTON: I'm sorry. I didn't catch 18 who you were referring to. I guess I might got a 19 little bit of static. I didn't catch who you were 20 referring to on the staff.
21 MEMBER KIRCHNER: She passed away last 22 year. Dennis probably can help me. Drouin I think is 23
-- was her name.
24 MEMBER REMPE: It was Mary Drouin.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
39 MEMBER KIRCHNER: Yes. And she put 1
together a defense-in-depth package as part of the 2
knowledge management effort and laid out --
3 (Simultaneous speaking.)
4 MEMBER BLEY: -- Knowledge Management 5
6 CHAIRMAN BROWN: What was that, Dennis?
7 MEMBER BLEY:
It was a
Knowledge 8
Management NUREG. It was one of the first ones of 9
those to get published.
10 MEMBER KIRCHNER: Yes, that's it. Thank 11 you, Dennis. Yes.
12 MR. MORTON: Yes.
13 MEMBER KIRCHNER: And it had a nice 14 structure for what was meant by defense-in-depth and 15 laid out -- and I'm just curious to the extent that 16 that's used across the staff as a -- kind of an 17 accepted way of approaching defense-in-depth, or does 18 each branch of the staff come up with its own 19 definition of what defense-in-depth means?
20 MR. MORTON: I wouldn't say that we come 21 up with different definitions of defense-in-depth. We 22 generally focus on -- within NUREG-6303 and NUREG-23 7007.
24 What I can tell you is we can take an 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
40 action to follow up on that point to see what she had 1
-- what she put together for that and --
2 (Simultaneous speaking.)
3 MEMBER KIRCHNER:
- Well, Charlie's 4
observations just made me think of that and that might 5
be a useful introductory passage, something that 6
Charlie was -- Member Brown was pointing out. Thank 7
you.
8 CHAIRMAN BROWN: Walt, that was my 9
intention with what I have put together for discussion 10 at the end after you all have completed it.
11 Unfortunately I didn't get it -- I'll have to read it 12 to you and then let you throw darts at it. I just 13 finished drafting it at 1:00 this morning, so --
14 MR. MORTON: Oh, well, we appreciate the 15 defense-in-depth data. Thank you.
16 CHAIRMAN BROWN: So I mean but that is the 17 point. The real point to this whole BTP is defense-18 in-depth, period.
19 MR. MORTON: Yes.
20 CHAIRMAN BROWN: I mean put aside all the 21 discussion of latent and this -- non-latent and this, 22 that and everything else.
23 MR. MORTON: Yes.
24 CHAIRMAN BROWN: It's really defense-in-25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
41 depth against -- on an overall basis and how do we 1
structure that? And that's the point I'm trying to 2
get. And how that gets integrated with the Knowledge 3
Management NUREG, it's another story, but it just --
4 I think that point doesn't get carried out as well in 5
the background as it should, particularly with digital 6
I&C systems, which are so focused and their backbone 7
is literally the architecture within which they 8
reside. So -- and the principles within -- with how 9
they reside within that.
10 MR. MORTON: Yes.
11 CHAIRMAN BROWN: As well as communications 12 and control of access, which you've heard me say 13 before.
14 MR. MORTON: Yes.
15 CHAIRMAN BROWN: So anyway, we digress.
16 Walt, did you have anything else?
17 MEMBER KIRCHNER: No, thank you, Charlie.
18 CHAIRMAN BROWN: Okay. Thank you.
19 MEMBER BLEY: The reference for the 20 document Walt was talking about is NUREG-KM-0009.
21 MR. MORTON: NUREG-KM-0009. Okay.
22 Okay. Thank you for that reference and 23 for that comment, but just a couple points just as a 24 follow up: This is a Branch Technical Position, not 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
42 necessarily a Design Guide, so there's a level of 1
detail that we're not necessarily able to get into in 2
terms of covering all the bases in terms of the 3
architectural aspects, but I understand. Charlie's 4
point taken in that regard.
5 MEMBER BLEY; I'll just make -- I don't --
6 the architecture thought process that I'm talking 7
about is not detail detail.
8 MR. MORTON: Yes.
9 MEMBER BLEY:
It's an overarching 10 architecture concept, not design detail.
11 MR. MORTON: Okay. Understood.
12 MEMBER BLEY: So I agree with you this is 13
-- we're not doing design details in this document.
14 MR. MORTON: Yes.
15 MEMBER BLEY: But the defense-in-depth, 16 when you look at -- if you don't know what the 17 architecture looks like, you might -- you're dealing 18 with it piecemeal. How do I deal with this component 19 or this --
20 MR. MORTON: Yes.
21 MEMBER BLEY: -- or the software or what 22 have you? That is a piece part. And maybe it doesn't 23 even matter if your architecture is constructed right.
24 MR. MORTON: Okay.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
43 MEMBER BLEY: That's all. It's a high-1 level architecture, not down in the nitty-gritty as 2
you will see when I read it to you.
3 MR. MORTON: All right. Sounds good. So 4
we'll -- I guess we can get to those comments after we 5
get through the presentation then.
6 MEMBER BLEY: Okay. And I will provide my 7
comments to you subsequent to the meeting. Christiana 8
will send them to you.
9 MR. MORTON: All right. We appreciate 10 that. Thank you, Member Bley.
11 MEMBER BLEY: Okay?
12 MR. MORTON: With that said if there's no 13 other questions on slide 8, Dawnmathews, please go to 14 slide No. 9.
15 So as we've been kind of alluding to 16 earlier, here is the basic description of the D3 17 assessment. And sort of tapping off the last slide's 18 conversation, we do give a general overview of the 19 defense-in-depth concept in the background section, 20 and overall the goal would be to maintain defense-in-21 depth with whatever modified system you're installing 22 into the plant or modifying itself. But we do cover 23 the entire concept of D3, which is defense-in-depth 24 and diversity, as a concept to ensure that looking at 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
44 CCF is potentially concurrent with other events in 1
your safety analysis, ensuring you have the proper 2
design aspects in place or analytical solutions in 3
place. And obviously this is consistent with what's 4
in the SRM, the SECY 93087. So this is just a basic 5
description of what's inside this.
6 Although we do focus on defense-in-depth 7
as the overall concept, we do have to make a note that 8
the document really focuses overall on defense-in-9 depth and diversity where it is required or whether it 10 could be used as a tool to ensure you have adequate 11 defense-in-depth. Obviously will get into that later 12 in the rest of the slide presentation.
13 So, Dawn, please go to slide No. 10. So 14 the D3 assessment, the process itself. This is where 15 we're going to kind of get into how the document has 16 conceptually changed in order to make it a bit more 17 readable and more coherent.
18 So previously we had a section called 19 Section -- we still have Section 2. It was previously 20 called the graded approach. After our own internal 21 discussions and after some of the public feedback we 22 got from the comments we decided that rather than 23 having it sort of be like a separate concept outside 24 the D3 assessment it really simply becomes a process 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
45 within a D3 assessment itself.
1 Rather than calling it a graded approach 2
we're simply saying it's a safety significance 3
determination essentially within the D3 assessment, 4
which basically in effect will get you to the same 5
place. We're just sort of warehousing it a bit 6
differently to make it a more organized and coherent 7
approach, essentially where you have a D3 assessment, 8
you have different analytical solutions that you may 9
take for systems of differing safety significance.
10 And you determine that by the safety significance 11 determination within Section 2 to the current draft 12 version right now.
13 So that effectively means that rather than 14 having specific categories like we had previously, 15 which is A1, B1, et cetera, et cetera, those are 16 generally being removed in favor of focusing on the 17 actual characteristics of the system itself and then 18 determining what level of analysis is appropriate for 19 that particular system's characteristics and safety 20 significance to the plant itself.
21 So what you'll see inside the document now 22 is table 2-1, which had those determination sort of 23 characteristics have been removed and the 24 categorizations have been moved, but the basic 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
46 functions and characteristics for those systems to 1
make a significance determination is still there and 2
they incorporate the public comments and feedback we 3
received from the various stakeholders and also 4
incorporate what we had from our own internal 5
discussions as well. And we wanted to make that very 6
clear.
7 The general approach is very similar.
8 We've just -- we're warehousing it a bit differently 9
to make it overall part of the D3 assessment. So it's 10 not like a separate process, sort of the way it was 11 depicted in the previous version that you saw at the 12 June ACRS meeting.
13 One of the things we did was we also 14 refined some of the guidance when it comes to applying 15 potential risk insights to inform your significance 16 determination within the D3 assessment so that if you 17 had a particular SSC that you thought might be highly 18 safety significant or lower safety significant, then 19 the risk insights could be used as a means to sort of 20 tip the scale one way or another depending upon how a 21 particular application decides to warehouse that 22 system.
23 And we want to be clear: The approach 24 we're talking about here is how -- for the staff 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
47 reviewer to look at how a licensee or applicant is 1
presenting a particular SSC for addressing CCF due to 2
latent defects in the analysis or design solutions 3
they choose to address CCF for that particular SSC in 4
the application. Risk insights can be used to inform 5
that decision or to put sort of the -- or to make the 6
decision or bring more clarification to the decision 7
itself.
8 And lastly, what we want to really 9
emphasize here is that the applicants do not need to 10 base their D3 assessment on the safety significant 11 systems. They can simply include everything in an 12 overall D3 assessment for like a high safety 13 significant system. You don't have to do that if you 14 don't want to. This is something that we're providing 15 the flexibility for applicants or licensees to use if 16 they so choose to, but you don't necessarily have to.
17 We want to make that point clear, and I think we made 18 that point in the June meeting as well.
19 And also just want to be clear that the 20 risk insights piece, user risk insights is not a 21 requirement. It's not mandatory. They're only there 22 if available and if the licensee or applicant chooses 23 to use them for a determination, for the safety 24 significance determination.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
48 MR. HECHT: This is Myron Hecht. Can I 1
ask a question?
2 MR. MORTON: Yes, sir. Please.
3 MR. HECHT: Thank you. Given that you 4
have removed the categories does this open the door 5
for less uniformity and interpretation among different 6
reviewers? In other words, if they -- a reviewer used 7
to look at a system as A1 or A2, does this now open 8
the door to say, well, what I used to think was A2 I'm 9
now going to think of as A1, or a reviewer -- a then 10 reviewer said it's O2 and that it -- that needs to be 11 A2 and another reviewer says it's now A1?
12 MR. MORTON: That's a great question, and 13 thank you for asking that.
14 So one of the things that we talked about 15 earlier is where we're actually making sure that the 16 staff -- that guidance is aligned to be staff 17 guidance. That's sort of one of the things that was 18 sort of hit by that consideration. So then rather 19 than focusing on categories, designate A1, for 20 example, the A1 concept is still there, just not 21 called A1. It's referred to as highly safety 22 significant systems, safety-related systems that 23 perform safety significant functions.
24 So rather than focusing on the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
49 categorization, we simply focused on well, what is the 1
particular SSC doing? What is the safety significance 2
and how is its potential failure or spurious operation 3
going to affect plant safety? So it's part of our 4
refinement to go to make sure that everything remained 5
within the auspices of staff guidance. That was one 6
of the things that was sort of affected by that.
7 MEMBER BLEY: Can you hear me? I've had 8
trouble getting attention. This is Dennis Bley.
9 MR. MORTON: Yes.
10 MEMBER BLEY: Okay. I still have a 11 problem with your logic.
12 MR. MORTON: Yes.
13 MEMBER BLEY: You're now in the Safety 14 Significant Section 2.1.
15 MR. MORTON: Yes.
16 MEMBER BLEY: A Category B, bravo, low 17 safety significance, non-safety-related SSCs that 18 perform safety significant functions. And your first 19 bullet under there says these perform design functions 20 that are significant contributors to plant safety.
21 MR. MORTON: Yes.
22 MEMBER BLEY: It's your logic to then call 23 them low safety significance. I don't understand this 24 category.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
50 MR. MORTON: Well, just to be clear -- so 1
for that category we're -- because they were talking 2
about non-safety-related SSCs, we necessarily can't 3
call them safety significant per se, but in some non-4 safety-related systems they can for example directly 5
affect reactivity or power level.
6 So, insofar as they are not safety 7
significant, they're not safety-related, but their 8
potential failure can affect plant safety because 9
systems such as feedwater, reactor recirc, or your 10 non-safety-related rod control systems, these systems' 11 failure or malfunction can directly affect reactivity 12 and therefore affect safety. So they're safety 13 significant functions or contributors even though 14 they're not safety-related. Therefore the designator 15 low safety significant.
16 MEMBER BLEY: I don't get it. I think 17 we've tied ourselves in logical knots to try to imply 18 there's something more meaningful that's safety-19 related than there is. If these things really affect 20 safety, then they either should be safety-related or 21 we ought to get rid of that arbitrary designation.
22 And they are important to safety, but you're treating 23 them as if they're not. And so I -- it just a logical 24 hole.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
51 MR. MORTON: We understand the comment.
1 We'll take that into consideration.
2 MEMBER BLEY: And the only reason we treat 3
them differently is because they don't have that 4
label, and that makes no sense at all to me in terms 5
of engineering and safety thinking.
6 MR. MORTON: Well, I would say that we 7
treat them differently because they are under 8
different regulatory requirements. For example, if 9
you're looking at that particular system which would 10 have been called a B1 category previously, those are 11 non-safety-related systems that perform safety 12 significant functions. Obviously those sorts of 13 systems would not be Class 1E. Those systems would 14 not necessarily have independence or single failure 15 requirements on them. Some of them may have a 16 diversity requirement upon them depending upon which 17 GDC is applied to it.
18 So therefore, the first thing that really 19 calls out the differences between the systems is if 20 regulatory structure that applies to them or not.
21 Some systems such as your highly safety significant 22 system, like your protection system would be affected 23 by a different set of GDCs than those that are non-24 safety-related and so on and so forth. So that's the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
52 first driver for --
1 (Simultaneous speaking.)
2 MEMBER BLEY: -- to respond to this, but 3
the logical hole you fall into just doesn't work for 4
me.
5 MR. MORTON: Understood. We can take that 6
comment into consideration as we move forward looking 7
-- continuing in our efforts to refine the document.
8 But there is a licensing aspect to -- there is a 9
difference in the treatment. It's not arbitrary. It 10 is really principally driven by the difference in 11 requirements on the different systems that we're going 12 to -- that a licensee reviewer will be looking at when 13 they do a safety significance determination. Not the 14 staff. It would be the licensee performing that 15 action. And then based upon their licensing basis 16 they would make the safety significance determination.
17 MEMBER BLEY: Putting it --
18 MR. MORTON: We're simply using the -- I'm 19 sorry. Go ahead.
20 MEMBER BLEY: Putting it in those terms 21 that this is a legal -- this is a legalistic 22 classification rather than an engineering and safety 23 classification would really help and it would point 24 out some interesting problems with the way we build 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
53 these structures.
1 MR. MORTON: We can take -- certainly take 2
a look at improving maybe the lead-in for that if 3
that's not clear because there's aspects of both.
4 They're not quite -- the legalistic and the 5
engineering aspects are not quite the same, but we can 6
take a look to see if that needs to be clarified 7
within that section for that point. So thank you for 8
that comment.
9 And if we have no other comments, we can 10 move onto slide No. 11, Dawnmathews.
11 And also I want to make a note that with 12 regard to slide 10 -- if you can go back to that real 13 quick, Dawnmathews? Slide No. 10.
14 For those individual categories we still 15 have the opportunity to potentially adjust the names 16 of those categories as well. That's not something 17 necessarily set in stone at this time, as Eric sort of 18 alluded to earlier. We're still -- there's still 19 flexibility there.
Those categories are not 20 necessarily clear. Just wanted to make that point.
21 And now you can -- I'll speak about slide 22 No. 11. And so now going back into the D3 assessment 23 process, continue to clarify the flexibility for SSCs 24 in cases where D3 assessment is not necessary. So 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
54 this is sort of referring to that fourth category or 1
another type of category where it's the lowest safety 2
significant systems only.
3 So if a system has -- its failure has no 4
effect on the plant safety functions at all and a 5
failure wouldn't place the plant in a condition that 6
cannot be reasonably mitigated would place a plant in 7
-- will be placed in an un-analyzed condition. There 8
is a potential there for systems such as that where 9
you may not need to provide a D3 assessment insofar as 10 NUREG-6303 thermal-hydraulic analysis or even a 11 qualitative assessment.
12 A simple failure analysis like an FMEA or 13 a FTA or something may be acceptable depending upon 14 whether the application contains a system -- it makes 15 the case that the system has such little safety 16 significance that a basic evaluation of the failure 17 effects and consequences of the failure of an SSC may 18 be sufficient without going into any other details for 19 that.
20 So we did place guidance and flexibility 21 within the safety significance determination for when 22 an applicant provides that to the staff for review.
23 There may be systems of such low consequences in terms 24 of the effects on the plant that a D3 assessment may 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
55 not be necessary. So we clarified that point also 1
within the BTP for this latest draft as well.
2 So if there's no questions, Dawnmathews, 3
please go to slide 12.
4 So other aspects of improvements we made 5
for the D3 assessment. So as I alluded to earlier, 6
the previous draft that you saw in June sort of had 7
different silos for different types of analysis that 8
weren't necessarily considered D3. And as we went 9
through the document and had our own internal 10 discussions and we looked at our public comments 11 received, it was decided that maybe there are certain 12 things we need to bring into the overall D3 umbrella.
13 So the first thing we just talked about 14 was the safety significant determination which we made 15 a part of the D3 assessment process itself.
16 The next piece that we made a part of the 17 D3 assessment process overall is the qualitative 18 assessment methodology. And for those of you 19 unfamiliar, the qualitative assessment is defined in 20 RIS 2002-22, Supplement 1, and it is a methodology to 21 address CCF in systems of lower safety significance.
22 We decided that rather than having that be 23 as a separate process we simply said, no, this is kind 24 of a less-rigorous form of a D3, because ultimately 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
56 you're addressing CCF in a slightly rigorous way for 1
lower safety significant systems. And that seemed to 2
be appropriate. So we brought that into the D3 3
umbrella. So now the qualitative assessment for 4
purposes of this BTP is considered a form of less-5 rigorous D3 assessment. So I just want to really make 6
that clear.
7 Secondly, for spurious operation, for 8
those of you have seen the previous drafts, we had 9
that -- the staff had spurious operation as a separate 10 section within the PTP. I think the previous section 11 was Section 5. It was for spurious operation. We had 12 a separate set of background and discussion and then 13 acceptance criteria.
14 And so similarly to the other improvements 15 and refinements we've made, we reconsidered how we had 16 to structure the document based on the public 17 feedback, and ACRS feedback as well, as well as our 18 own internal discussions, and we decided that spurious 19 operation is something the staff finds is necessary to 20 address when you're looking at CCF due to latent 21 defects. So we're only concerned spurious operations 22 as they are originating from latent defect CCFs. If 23 the general design solutions end up being sort of the 24 same thing, then it makes sense to have the spurious 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
57 operation guides incorporated within the D3 assessment 1
itself as another consideration. And that's what 2
we've done.
3 So the basic discussion for spurious 4
operation is within Section 3 of the document now and 5
the acceptance criteria for the relevant sections 6
within different methodologies incorporate pointers 7
about spurious operation consideration as well. So 8
that section, Section 5 no longer exists. It's been 9
integrated within the D3 assessment section, Section 10 3 of the document.
11 So those are some of the bigger changes we 12 made within the document since the June 2020 ACRS 13 Subcommittee meeting.
14 These changes brought more flexibility for 15 the D3 assessment because it makes the assessment 16 clear that there are different levels of technical 17 rigor and different types of analysis that you can use 18 as a licensee or applicant to address CCF and it makes 19 it clear as well as to the staff that there are 20 different means by which a licensee can provide a 21 less-technically rigorous methodology to address a 22 less-safety -- lower safety significant system. So it 23 brings more alignment and flexibility for the method, 24 for the D3 assessment itself and it provides better 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
58 synergy with the safety significant determination that 1
we now incorporated within the D3 assessment itself.
2 As we talked about in the previous slide 3
you have your basic four categories that we're calling 4
-- we have the higher safety significant and the lower 5
safety significant. And these changes align with that 6
concept with the safety significance determinations.
7 MEMBER BLEY: If I may interrupt again --
8 MR. MORTON: Yes, sir.
9 MEMBER BLEY: -- since I made my last 10 comment I'd like to say this reorganization really is 11 a nice logical one and I think it makes a lot of 12 sense. Thank you.
13 MR. MORTON: Thanks for the comment.
14 Appreciate that. That was sort of the goal is that 15 treating them separately in retrospect was not the 16 optimal approach to go about the D3 assessment. And 17 so bringing everything under the one umbrella makes it 18 much more clear and makes a much more crisp document 19 for whomever is reading the document for their 20 particular purposes.
21 So are there any other questions on this 22 slide?
23 CHAIRMAN BROWN: Yes, I have one question 24 on this --
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
59 MR. MORTON: Yes, sir.
1 CHAIRMAN BROWN: -- on the qualitative 2
assessment.
3 MR. MORTON: Yes.
4 CHAIRMAN BROWN: And I may have this 5
backwards, so I'm open to correction on this. This is 6
not an opinion.
7 You've got high safety significant safety-8 related SSCs.
9 MR. MORTON: Yes.
10 CHAIRMAN BROWN: Low safety significance 11 non-safety-related SSCs that perform safety 12 significant functions.
13 MR. MORTON: Yes.
14 CHAIRMAN BROWN:
C is low safety 15 significant safety-related SSCs --
16 MR. MORTON: Yes.
17 CHAIRMAN BROWN: -- that do not perform 18 safety-related functions.
19 MR. MORTON: Yes.
20 CHAIRMAN BROWN: And then the lowest of 21 the low is the low safety significance non-safety-22 related SSCs --
23 MR. MORTON: Yes.
24 CHAIRMAN BROWN: -- that do not perform 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
60 safety significant functions. For the qualitative 1
assessment --
2 MR. MORTON: Yes.
3 CHAIRMAN BROWN: -- somehow it got wrapped 4
into my brain --
5 MR. MORTON: Yes.
6 CHAIRMAN BROWN: -- that it only applied 7
to the lowest of the low. That would have been --
8 MR. MORTON: Yes.
9 CHAIRMAN BROWN: -- the low safety 10 significance non-safety-related SSCs that do not 11 perform safety significant functions.
12 MR. MORTON: Yes.
13 CHAIRMAN BROWN: Is that -- that's the way 14 I read the document, yet in the discussion part of 15 this; and I'm trying to find it again, that may be 16 based on the discussion you just had --
17 MR. MORTON: Yes.
18 CHAIRMAN BROWN: -- was that the RIS 2002 19 Supplement -- or 22 Supplement 1, Qualitative 20 assessment, would -- there's three categories of low 21 safety significance.
22 MR. MORTON: Yes.
23 CHAIRMAN BROWN: B, C and D.
24 MR. MORTON: Yes.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
61 CHAIRMAN BROWN: I interpreted that -- all 1
your write-up in here, it would only apply to D. Is 2
that correct or wrong?
3 MR. MORTON: That would be incorrect.
4 CHAIRMAN BROWN: Okay. So it's all three 5
of the low safety significance categories, just not A?
6 MR. MORTON: That's correct. So if you --
7 CHAIRMAN BROWN: All right.
8 MR. MORTON: Okay.
9 CHAIRMAN BROWN: Go ahead. Go ahead.
10 Finish off and maybe you'll refresh my brain for a 11 second.
12 MR. MORTON: Oh, so the quick refresher on 13 the RIS. So the RIS -- Supplement 1 to RIS 2002-22 is 14 guidance for lower safety significant systems, 15 essentially everything outside the logic portions of 16
-- basically it's everything except outside RPS and 17 DSF, direct safety functions.
18 CHAIRMAN BROWN: Okay.
19 MR. MORTON: So that means your safety-20 related safety chillers, your feedwater systems, 21 reactor recirc, non-safety-related rod control. It 22 could even be either RPS inverters depending upon how 23 you categorize your system, but it is for lower safety 24 significant functions, not just for the lowest of the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
62 low. So it's for -- as you correctly point, it's for 1
those three categories outside of the high safety 2
significant category that we have. So it's for those 3
lower three categories --
4 CHAIRMAN BROWN: Okay.
5 MR. MORTON: -- not just for the lowest 6
safety significant category.
7 CHAIRMAN BROWN: Okay. That's one of the 8
problems with being more generic in all these 9
discussions.
10 MR. MORTON: Yes.
11 CHAIRMAN BROWN: Without talking about RTS 12 and SFAS explicitly we start muddying the waters a 13 little bit. But I got it now. Okay?
14 MR. MORTON: Okay.
15 CHAIRMAN BROWN: Is there a point -- is 16 there a place where that's very, very clear in the 17 document?
18 MR. MORTON: The qualitative assessment 19 section, which I think is 3.1.4; staff, please correct 20 me if I'm wrong --
21 CHAIRMAN BROWN: Which you refer to.
22 MR. MORTON: Yes, it should -- we do have 23 the lead-in paragraphs -- at least we thought we were 24 being clear that it applies to lower safety 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
63 significant systems.
1 CHAIRMAN BROWN: You're right.
2 MR. MORTON: Yes.
3 CHAIRMAN BROWN: You're right. I just 4
found the page. It talks only for low safety 5
significant systems. It doesn't say the other non-6 safety -- et cetera, et cetera.
7 MR. MORTON: Yes, I see that.
8 CHAIRMAN BROWN: So, all right. I got it.
9 It's very clear in 3.1.4. Thank you.
10 MR. MORTON: Okay. No problem. So 11 there's no other questions?
12 Dawnmathews, please go to slide No. 13, 13 please.
14 And in this slide we basically summarize 15 the D3 assessment, the framework itself. So we gave 16 you the description of the D3 assessment. We've kind 17 of talked about how other things have been 18 consolidated into the D3 assessment overall umbrella.
19 And you kind of see it kind to fruition here in this 20 slide with the basic framework. And I know there's 21 kind of a lot on the slide, so I won't necessarily go 22 through each and every bullet. But suffice it to say 23 you have a number of different means to attack CCF due 24 to latent defects within the BTP. And the staff 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
64 wanted to make it very clear for our reviewers and for 1
stakeholder. The intention was to provide a lot of 2
flexibility to attack CCF due to latent defects.
3 There's obviously the individual design 4
solutions. We have specific diversity testing, 5
defensive measures that are approved. And we got --
6 qualitative assessment is one means to eliminate 7
further consideration of CCF. Then you look at the 8
ability to prevent or mitigate the effects of the 9
postulated CCF. And then you get into the diverse 10 means that can be used from a safety-related functions 11 so it's not disabled.
12 Then you get into the potential to cope 13 with the CCF by simply demonstrating through analysis 14 that A, we're simply postulating the CCF. We didn't 15 necessarily do a specific design solution for it, but 16 we verified through our analysis that, hey, we can 17 accept the consequences of the CCF, the plant can 18 still operate safely in its presence.
19 And you can use, for the fourth bullet, 20 any combination of the above, or a different solution 21 set that could be proposed by a licensee or applicant.
22 You are not bound to do the D3 assessment framework as 23 defined in the BTP. Just want to be very clear, it is 24 not a requirement. This is guidance for the staff.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
65 It can be used by stakeholders. Stakeholder, 1
licensees, applicants can use a completely different 2
solution to address CCF due to latent defects if you 3
so choose. It is your purview to do that. Just want 4
to make that clear. You can have the ability to do an 5
alternative approach for that. But this is just the 6
basic D3 assessment framework within the document 7
right now.
8 It hasn't necessarily changed. We just 9
refined it to include a few more things to make the D3 10 umbrella more complete.
11 I
don't hear any questions, so, 12 Dawnmathews please go to slide No. 14.
13 As I alluded to earlier, means to 14 eliminate CCF from further consideration. Has not 15 necessarily changed a lot since the last meeting we've 16 had in terms of the basic content. The biggest change 17 we'll get into that later on is really the inclusion 18 of the quench survivability, but this is sort of a 19 refresher for folks of what this particular section --
20 sub-section provides under the D3 assessment.
21 Here is where we would get more into 22 conversations that Member Brown is referring to in 23 terms of specific architectural solutions that may be 24 involved, whether you're providing specific sort of 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
66 extensive testing to eliminate latent defects or 1
you're providing diversity within the architecture 2
within divisions of our protections, for example, or 3
you have different design solutions entirely, or 4
you're potentially using a qualitative assessment for 5
you lower safety significant systems. This is where 6
you get into the potential flexibilities for that.
7 So this particular section received some 8
refinements due to public comments, especially for the 9
testing portion. We did align the aspect to go with 10 the actual 7432 2016 framework. We don't necessarily 11 quote it per se. We did make some minor changes to 12 align with the greater efforts going on within the BTP 13 itself.
14 So if there's no questions, Dawnmathews, 15 please go to slide No. 15.
16 And here is another concept that we had 17 that we had from the June meeting. It largely remains 18 unchanged. It's providing licensees and applicants 19 the flexibility to propose their specific design 20 measures. It was defined as the particular design 21 attributes. We wanted to provide flexibility and keep 22 the door open for the circumstance where a licensee or 23 applicant provides a specific innovative design 24 solution that we haven't necessarily endorsed, but we 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
67 are not opposed to actually reviewing it within the 1
application itself.
2 So this is the general point here. There 3
are different types of examples of design measures, 4
but we just simply classify them as another type of 5
design attribute for proposed system architecture or 6
system -- or SSC. So this is mainly to provide 7
flexibility for different design solutions to actually 8
address CCF due to latent defects.
9 So, Dawnmathews, please go to slide No.
10
- 16. And now you get into the other part of the D3 11 assessment framework which is providing flexibility to 12 mitigate the consequences or the effects of the CCF.
13 And we clarify the guidance in a number of places due 14 to the public comments we received. And we got some 15 great insights from the public comments as well as 16 from ACRS.
17 Clarify the different types of -- meet 18 diversities that can be credited whether it's existing 19 systems or manual controls, or some combination 20 thereof.
21 And we also clarified within the document 22 the concept of -- because there's obviously been a bit 23 of I would say concern between point 3 and point 4 of 24 the SRP and how you are crediting different controls 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
68 to meet either of those particular provisions, because 1
they do incorporate the ability to credit manual 2
controls to meet either one of those. So we clarified 3
the appropriateness of how to do that properly within 4
your applications as well.
5 MEMBER KIRCHNER: So when you -- Wendell, 6
this is Walt Kirchner. When you use manual operations 7
as a means to mitigate, do you also then open the door 8
to look at human error? If you credit a manual 9
operation, there's the chance that there could be an 10 error in the operation.
11 MR. MORTON: And you're saying error in 12 terms of the plant procedure that may do it or just 13 the aspect of the operator making a mistake when 14 they're trying to mitigate a particular circumstance 15 diversely?
16 MEMBER KIRCHNER: Both.
17 MR. MORTON: Both? We don't necessarily 18 get into that.
19 MEMBER KIRCHNER: Either/or. I mean if 20 you have -- if you're relying on a manual operation to 21 mitigate CCF, then it opens the door also to the 22 possibility of that manual operation including an 23 error.
24 CHAIRMAN BROWN: Turning the wrong switch.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
69 MEMBER KIRCHNER: Yes, or --
1 CHAIRMAN BROWN: If your adjacent -- it's 2
happened before.
3 MR. MORTON: Well, I would say to that --
4 there's a couple things: No. 1, we don't necessarily 5
get into that level of detail here in the BTP. That's 6
one of the things that would be covered within the 7
evaluation analysis in Chapter 18 of the SRP, that the 8
manual actions have to be both feasible and reliable.
9 And much of that's going to be controlled by the plant 10 procedures when this information is developed.
11 It's not necessarily something that we 12 would get into in terms of an error in the 13 implementation of the manual actions. That would be 14 something handled mostly by plant procedure. The 15 guidance for that for the staff reviewer and for 16 licensees and applicants would be in Chapter 18. We 17 simply ensure that you follow the appropriate guidance 18 when you're actually trying to address those three 19 positions. So we understand the point, but that's 20 something that would need to be evaluated within your 21 HFE evaluation under Chapter 18 of the SRP.
22 MEMBER KIRCHNER: Well, I'll just refer 23 you back to that knowledge management document. One 24 of the points that Mary made in that -- she had seven 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
70 points on looking at licensing basis changes and 1
preserving defense-in-depth. And I think it was the 2
sixth one, provide sufficient defense against human 3
errors.
4 MR. MORTON: Yes.
5 MEMBER KIRCHNER: And so if you're 6
crediting this to mitigate CCF, you --
7 MR. MORTON: Yes.
8 MEMBER KIRCHNER: That's why I raised the 9
point that you also have to consider human error.
10 MR. MORTON: Right. And that is correct, 11 but we wouldn't necessarily -- we are presuming that 12 when you're crediting your manual actions, you're 13 crediting the operator manual actions that it needs to 14 be performed in a feasible and reliable manner, which 15 we put -- which we have within the acceptance criteria 16 for that particular sub-section within the SRP, the 17 reliability piece being what you're referring to, but 18 that really needs to really be evaluated through the 19 much more detailed guidance which would be in Chapter 20 18 of the SRP.
21 That's obviously a concern that the person 22 who is implementing the diverse manual controls 23 implements them correctly, but the nuts and bolts of 24 getting them implemented correctly would be in Chapter 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
71 18 of the SRP.
1 CHAIRMAN BROWN: Just as an amplification 2
for Walt's comment, Chapter 18, Appendix A of the SRP 3
does require you to analyze action sequences for the 4
potential -- of a potential operator error in 5
performing that manual action. So it's -- you got to 6
search around for it, but it is in there.
7 I'm just providing that to you for 8
information, Walt.
9 MEMBER KIRCHNER: No. Thanks, Charlie.
10 I was just thinking that if you -- if the staff did an 11 evaluation and they did credit a manual operation to 12 mitigate CCF, some notation of something I think would 13 be part of the review I guess that would flag this as 14 something that would have to be looked at in Chapter 15 18.
16 CHAIRMAN BROWN: And it does. It talks 17 about one of the things leading to the possibility of 18 the operator error is the time required versus the 19 time available --
20 MEMBER KIRCHNER: Right.
21 CHAIRMAN BROWN:
and what's a
22 reasonable time to do that. And they do talk about 23 the old 30-minute concept that if you depend on 24 somebody to do something within a minute-and-a-half, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
72 there's a higher likelihood that you might make the 1
wrong decision as opposed to if you have a little bit 2
longer to think about it. So they do cover it.
3 That's all I'm -- I'm just pointing out it is done.
4 It's just it's not in the BTP itself. That's all.
5 MR. MORTON: Yes, one of the nuts and 6
bolts ways this would take place if you have an 7
application from a licensee and they decide to credit 8
certain manual controls, operator actions as their 9
diverse means, then they would necessarily have to 10 have an evaluation or an analysis aligned with the 11 guidance in Chapter 18 of the SRP.
12 At that point not only would you be 13 involving the I&C staff, obviously because this is a 14 D3 assessment, wouldn't you be bringing in our friends 15 in HFE, our staff members in HFE to review that part 16 of the application as well? So it would be both. But 17 they couldn't fully credit any manual operator actions 18 until they've actually been approved to so, and that 19 would bring in both the Chapter 18 analysis and our 20 friends in HFE to review it to ensure that this is an 21 approved means to do it and therefore they could 22 credit it as part of their -- of a diverse action 23 under the BTP.
24 MEMBER MARCH-LEUBA: This is Jose March-25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
73 Leuba. I'm back online. What I think Walt was trying 1
to get at is that those operator actions feed in 2
Chapter 19 on the PRA so that they create new 3
sequences or whatever (audio interference) holds that 4
can change the PRA outputs. So is there a link that 5
says whenever you rely on operators doing something --
6 recognizing the problem and doing something about it, 7
that should feed into the PRA and create -- the PRA 8
expert should tell you how likely is that to happen.
9 MR. MORTON: I apologize. Was that a --
10 so is it a question or a statement? I just want to be 11 clear.
12 MEMBER MARCH-LEUBA: It was more of a 13 statement. Do you agree? But now comes the question:
14 Do you agree with my statement?
15 MR. MORTON: I would say that as part of 16 the application, depending upon what they're doing, 17 the PRA analysis will be included. We don't get into 18 that level of detail because it's a bit of a different 19 animal that we're dealing with.
20 If that's something that the licensee or 21 applicant would necessarily feed into as they're going 22 through meeting the SRP section, then that would kind 23 of naturally take place, but not necessarily --
24 wouldn't necessarily be the scope of work we're having 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
74 here. We're only concerned with is it -- if they do 1
credit certain diverse means to accomplish the safety 2
function, specifically if it's an operator action, 3
that they have applied the proper evaluation and 4
content within the application for that purpose. That 5
would necessarily bring in obviously Chapter 18, but 6
if there's a nexus between Chapter 19 in that regard, 7
that would be part of the overall application as well.
8 MEMBER MARCH-LEUBA: Yes, see my point is 9
we are doing risk-informed everything.
10 MR. MORTON: Yes.
11 MEMBER MARCH-LEUBA: If you -- the risk is 12 not properly calculated because we forget to introduce 13 these steps, then we're not doing it right.
14 MR. MORTON: Yes.
15 MEMBER MARCH-LEUBA: Clearly if you rely 16 on the operator recognizing the problem during a 17 stressful time in the control room and doing the right 18 thing, which I give them credit to -- I mean, they'll 19 do the right thing -- you should evaluate if it's a 10 20 to the minus-4 (audio interference) because the life 21 for the Chapter 19 guys is very difficult, because 22 they have not know everything. Okay? And it would be 23 easy if we had times that gives them homework. Hey, 24 I found a sequence for you. Make sure you evaluate 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
75 it. That's my opinion. And there's no question 1
(audio interference).
2 MR. MORTON: Understood. Thank you for 3
that feedback.
4 So if there's no other questions on this 5
slide, Dawnmathews, you can go to slide 17.
6 So here we have another aspect of the D3 7
assessment umbrella which is coding with the 8
consequence to the CCF. And this is pretty 9
straightforward. This is a licensee or applicant 10 providing analysis or an evaluation that demonstrates 11 that regardless of whatever design features and/or 12 defensive measures and/or assessments you perform, we 13 can simply demonstrate that the plant's basic 14 architecture and systems can withstand a
CCF 15 concurrent with an event in Chapter 15. So we're 16 basically saying its consequences remain acceptable.
17 We can basically stand -- we can withstand it. We 18 don't need to do any further analysis. Just saying 19 you can cope with the consequences of that.
20 We did make a few minor tweaks and 21 corrections inside this particular section based upon 22 our own internal discussions and public comments, but 23 this is pretty straightforward. This is a coping 24 analysis essentially that demonstrates that you can 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
76 cope with the consequences of a CCF.
1 Dawnmathews, please go to slide No. 18.
2 And now for this slide we have the newest member of 3
the D3 umbrella, which is the assessment -- is the 4
qualitative assessment guidance itself. And we've 5
talked about this sort of at length already so I won't 6
necessarily go into a lot of detail, but basically the 7
qualitative assessment concept is for those lower 8
safety significant systems. Reaching a sufficiently 9
low determination is tantamount to saying that the 10 potential for a CCF due to latent defects is at the 11 level of other CCFs not analyzed your licensing basis.
12 It effectively constitutes saying you can remove it 13 from further consideration for lower safety 14 significant systems only, not for high safety 15 significant systems like RPS and ESF. It's just for 16 the lower safety significant stuff.
17 Based on the public comments we received 18 and some of the feedback we had from ACRS we did 19 refine the lead-in information for the qualitative 20 assessment. We did refine the approach inside to make 21 it clear that for purposes of this BTP not only doing 22 the qualitative assessment, but you need some sort of 23 supporting failure or consequence analysis that 24 demonstrates that if you did have a failure to the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
77 proposed system, that its consequences at least are 1
addressed to some degree. It's not the same thing as 2
a coping analysis per se, but your basic rudimentary 3
FME or FTE or something to that extent that shows 4
that, hey, you've also did the potential failure 5
effects on the plant and the particular SSC as well.
6 And as we said
- earlier, this was 7
integrated into Section 3 of the BTP, which is the D3 8
section. It was previously I believe Section 4 in the 9
June draft, but because of our internal discussions 10 and public comment feedback we received it was decided 11 to integrate this into the D3 assessment as a less-12 rigorous form of a D3 analysis. And this is something 13 that we got flexibility from by reading SECY 1890, 14 which said for lower safety significant systems you 15 don't necessarily have to do a super rigorous D3 16 assessment of that. So that gave us sort of the basis 17 for saying, oh, hey, why don't we just integrate this 18 into the D3 assessment and make it a less-rigorous 19 form of it?
20 And so if there's no other questions, 21 Dawnmathews, please go to slide 19.
22 Okay. So with the D3 assessment, Spurious 23 Operation guidance, we kind of got into this a lot 24 already, so I won't necessarily belabor a lot of the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
78 details of this. But spurious operation is one 1
potential consequence of a CCF due to latent defects 2
as well as a loss of function. Because it's a 3
parallel consideration for the potential consequences 4
of a CCF it was decided that rather than having a 5
separate section for spurious operation within the 6
BTP, why not just integrate it within the D3 7
assessment itself as simply another technical 8
consideration that should be looked at by the staff 9
reviewer and by default something that should be 10 considered by the applicant or licensee when they 11 provide something to the staff for review 12 So no longer separate define -- it's going 13 to be integrated within the D3 assessment itself. So 14 we clarified what the expectations were for the 15 spurious operation when you're performing a D3 16 assessment regardless of the level of technical rigor 17 for it.
18 Obviously there's been a lot of interest 19 in this particular aspect of the BTP based upon 20 previously public meetings we've had, previous staff 21 comments we've gotten internally on the subject 22 matter, as well as previous industry formal comments, 23 and as well previous meetings we've had with the ACRS.
24 There's been a lot of interest on that. And we've to 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
79 the best of our ability within the confines of making 1
sure this is staff guidance we incorporated all of 2
that feedback. But obviously there's always room for 3
improvement for things of that nature because it has 4
been sort of a highly energized discussion we've had 5
with that. But it was decided overall to integrate it 6
within the D3 assessment to make its own 7
consideration.
8 The designs and analytical solutions end 9
up being parallel if not the same for the 10 consideration of loss of function, so why not take 11 advantage of that integrated within the D3 assessment 12 itself? And that's what the staff has done.
13 So I'm hearing no questions on that, so, 14 Dawnmathews, please go to slide No. 20.
15 So right here we have the manual action 16 means to address position 4. So just as a quick 17 aside --
18 CHAIRMAN BROWN: Wendell?
19 MR. MORTON: Yes, sir?
20 CHAIRMAN BROWN: Something has just been 21 grinding away since we -- can we backtrack to slide 17 22 for a second?
23 MR. MORTON: Dawnmathews, please go to 24 slide 17. Okay.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
80 MEMBER BROWN: The document talks about 1
coping when vulnerabilities to CCF are not addressed.
2 In other words, something is found. I didn't see a 3
lot that gives a lot of -- maybe I just didn't 4
understand how somebody could demonstrate -- is it 5
strictly an analysis thing to say, hey, look, the CCF 6
occurred, but we don't violate SAFDLs or temperatures, 7
or et cetera? Is that the thrust?
8 MR. MORTON: If I understand your 9
question, Member Brown, so when we're looking at this 10 particular subsection, we have this sort of "or" 11 statement. We're only saying this from the 12 circumstance that you've got a potential vulnerability 13 that was not addressed for some reason. You didn't 14 specifically put a particular design attribute; you 15 don't have station diversity, whatever that may happen 16 to be. Or you tell them to do testing. You simply 17 have a residual CCF vulnerability that has not been 18 addressed in one form or fashion.
19 All this section is really saying is that, 20 within the concept of D3 assessment and best estimate 21 methodology, you simply can demonstrate that, within 22 the acceptance criteria that you have for your 23 particular design, the consequence would remain 24 acceptable if you're postulating a CCF for that 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
81 system. You demonstrate through analysis only.
1 MEMBER BROWN: In other words, if the 2
system fails, it doesn't do what it's supposed to do, 3
the plant is okay?
4 MR. MORTON: Yes, that's correct.
5 MEMBER BROWN: Or the core is okay?
6 MR. MORTON: Yes. Or, as we say, the 7
consequences remain acceptable, whatever that happens 8
to be for the particular plant.
9 MEMBER BROWN: Okay. Yes, I understand, 10 you know, talking about SAFDLs.
11 MR. MORTON: Yes.
12 MEMBER BROWN: I can't even remember what 13 the acronym means, except people throw it around like 14 candy at a child's party all the time.
15 (Laughter.)
16 MEMBER BROWN: Peak central temperatures, 17 overpowers, if you can accept the peaks that come, 18 then it would be said, "That's okay." That's what you 19 mean?
20 MR. MORTON: That's correct, yes.
21 MEMBER BROWN: Okay. I just wanted to 22 make sure. That's what I got out of it. I just 23 wanted to make sure I understand that, and I just 24 couldn't frame it as we went through that slide.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
82 Okay. Thank you.
1 MR. MORTON: Okay. Thank you.
2 And we tried to make that clear within the 3
lead-in subsection for that, which I think is 3.1.3, 4
off the top of my head. Staff, please correct me, if 5
I'm wrong on that.
6 Oh, 3.3? Thank you. I appreciate it.
7 So, it's 3.3 of the BTP, is that 8
subsection for the coping analysis for CCF.
9 MEMBER BROWN: Yes, I remember your 10 talking about it. I'm just trying to frame it in the 11 most simplistic terms I can.
12 MR. MORTON: Understood. Thank you, 13 Member Brown. I appreciate it.
14 MEMBER BROWN: Yes. Go on. Thank you.
15 MR. MORTON: All right. So, I think we 16 were on slide No. 20, Dawnmathews. Thank you. You're 17 already ahead of me. I appreciate that.
18
- Really, I
would say the biggest 19 consideration that we have here is there were public 20 comments requesting clarification on the potential for 21 crediting controls either for point 4 to point 3, or 22 vice versa, of crediting manual operator actions 23 credited for point 3 to point 4. Those particular 24 positions do have different legal requirements on 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
83 them.
1 And to clarify within the guidance what 2
you could do in terms of crediting manual controls for 3
either position and juxtaposing those two, if an 4
application shows up at the staff's doorstep where a 5
licensee is choosing to credit, for example, the 6
manual system controls for position 3 to meet point 4, 7
position 4, we clarified those aspects within the BTP.
8 Also, that's the biggest improvement that was made or 9
clarification that we attempted to make within that 10 section, because position 4 is a unique animal 11 compared to the other three positions in the 12 SECY-93-087.
13 MEMBER BROWN: Yes, I have another 14 question on this.
15 MR. MORTON: Yes?
16 MEMBER BROWN: Make sure I get this 17 phrased properly. I have a different thought. I 18 mean, my thought process on manual controls that 19 control critical safety functions. A large number of 20 the systems put into place are being utilized today.
21 They use touch screens. Touch screens are not as 22 positive as switches.
23 Is there any basis for not addressing the 24 functionality of touch screens in terms of the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
84 operation actually happened? I say that based on a 1
comment that I received from a friend who almost -- he 2
had a brand-new car. He was trying to change the 3
station on his radio. As opposed to his old car which 4
you punched the little button and it changed, this was 5
a touch screen that he had to scroll and touch. He 6
took his eyes off the road and almost killed himself.
7 MR. MORTON: Aw, okay.
8 MEMBER BROWN: I'm always paranoid about 9
touch screens where you've got to create, you've got 10 to control something. You have to touch it, go to a 11 menu, select the next thing, and then, punch something 12 else that says, "Go." As opposed to, if you've got a 13 critical safety function, you want to turn one switch 14 and it actuates. So, that concept is not, the 15 timeliness or the ability for positive control is not 16 identified anywhere in here.
17 I understand position 4. I read that and 18 I don't disagree with it. Okay? It's just here is an 19 application of technology where you don't want to 20 address detailed technology, but you want positive 21 controls for critical safety functions.
22 MR. MORTON: Right.
23 MEMBER BROWN: That got lost when I was 24 reading this.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
85 MR. MORTON: So, I would caution ACRS 1
members that, because it's not -- and I think you just 2
alluded to it, Member Brown -- it's not a design 3
document per se, so there's kind of a limited level of 4
detail and sort of assurance that we can put inside 5
the BTP, because we're basically limited to what the 6
positions themselves actually are calling for. And 7
then --
8 MEMBER BROWN: Okay. Hold on. Hold on.
9 I understand that. I apologize for the interruption, 10 but I did it anyway.
11 You don't have to give it -- all we're 12 talking about is positive actuation. We're not 13 talking about -- it's just the positive actuation for 14 critical functions. The other ones -- I don't know 15 how you phrase it. I'm not trying to dictate, but 16 maybe sometimes you should dictate. So, I question 17 this idea of the world is open and the sky is the 18 limit all the time. There are some things you want 19 done positively and you don't want to sell out and it 20 shouldn't be reevaluated and you shouldn't be given an 21 option.
22 I have a fundamental disagreement --
23 you've probably heard me say this in multiple 24 meetings.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
86 MR. MORTON: Mm-hmm.
1 MEMBER BROWN: There are a few areas that 2
you do not want out -- I'll give you one which I'll 3
address later. The way this reads, bidirectional 4
software communications anywhere in the plant and 5
external to the plant are perfectly satisfactory 6
software-controlled as long as you do a D3 analysis 7
which everybody decides is okay. That's insane. But 8
I just thought I'd give you a nice positive -- I'll 9
look at actuating critical safety functions 10 positively.
11 And that's one of the things we did at NR.
12 All of our control panels, all critical safety or 13 actuation functions were done with switches. We 14 allowed data to be gotten, recording pressures, 15 temperatures, going to search what alarms came up, you 16 know, as a result of an event, via touch screen and 17 scrolling, but we did not allow critical control 18 functions to be done with touch screens and menus.
19 Now that was when I left. Based on the review of the 20 Ford, it looked like they were still doing that.
21 So, I hadn't figured out how I was going 22 to address that later.
23 MEMBER BLEY: Lest this appear to be a 24 Committee position -- and I would agree with Charlie, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
87 it ought to be a Committee position on --
1 MEMBER BROWN: Oh, yes, this is (audio 2
interference) --
3 MEMBER BLEY: -- the bidirectional aspects 4
of software and having a hard interface. But there's 5
been a lot of work on these new control panels and a 6
lot of experimentation. And I think for scram they 7
still have a switch on the 07. But, for some of the 8
others, I don't think the radio example in the car is 9
really quite applicable. And operators have found 10 these things very intuitive once they've had the bugs 11 worked out for a long time. So, there aren't many out 12 in the plants, but I'm not sure I would go as far as 13 Charlie said on anything on night call or critical 14 safety function -- I'm not sure what your list is, 15 Charlie -- needs to be a switch.
16 MEMBER BROWN: Well, a scram switch, 17 actuated safeguard systems when you've got to start 18 pumps. If I've got to scroll down and select a pump, 19 that's a bad idea.
20 MEMBER BLEY: Think of the controls on 21 these new panels with touch screens for starting 22 pumps, operating valves, that sort of thing, much more 23 intuitive and the results are showing them more 24 reliable, too, in terms of human dependence. So, I 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
88 think there's a gray area in here that I'd be hard-1 pressed to try to urge a fixed rule.
2 MEMBER BROWN: Well, you can see we have 3
unanimity, Morton -- or Wendell. Excuse me.
4 (Laughter.)
5 MR. MORTON: No problem. No problem at 6
all.
7 I would say that, with regard to your 8
initial concern, in some of the conversations we had 9
earlier in the presentation today, there's a level of 10 detail that we're not going to necessarily get into in 11 the BTP for 7-19 because it's much better explained in 12 other portions of the SRP.
13 And the efficacy of the manual controls 14 and displays is not something we necessarily are going 15 to be getting into in BTP 7-19. That's why we 16 provided the pointer to SRP Section 18, because that 17 has the relevant detail that you need to really get 18 into those kinds of considerations as well.
19 MEMBER BROWN: But this is your D3 20 assessment?
21 MR. MORTON: This is correct, and --
22 MEMBER BROWN: Because there's nothing 23 that provides any nuances of various types of control 24 to the reviewers.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
89 MR. MORTON: This is correct, and a nuance 1
should be left to the evaluators in this space when 2
they are also reviewing that aspect of the 3
application. We define the critical safety functions 4
in Section B1.2 of the BTP. Those are the functions 5
by which point 4 is referring to in terms of you need 6
to have controls that are independent and diverse from 7
the computer system that makes it susceptible to the 8
particular CCF of concern or a computer system.
9 That's a main design requirement we put on the manual 10 controls and displays as pertains to point 4.
11 MEMBER BROWN: You say where? Where was 12 that? Diverse and independent?
13 MR. MORTON: Yes, B1.2 is where we define 14 the critical safety functions is where we define the 15 critical safety functions.
16 MEMBER BROWN: B1? Where? B1.1?
17 MR. MORTON: Yes, Bravo 1.2 18 MEMBER BLEY: It's the fourth page of 19 Section B, Charlie, and it comes right after the four 20 technical positions.
21 MR. MORTON: Right, right. Right, right.
22 MEMBER BROWN: You said it was B1.2, 23 right, "Critical Safety Functions"?
24 MR. MORTON: Mm-hmm. So, we define those 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
90 functions that are referred to in position 4 of the 1
SRP, are defined in that subsection in the BTP. And 2
for those particular controls, there's a requirement 3
that they be independent and diverse from the computer 4
system in question under positions 1 and 3. That's in 5
the SRM itself. That's the main design requirement we 6
put on there. The individual details about --
7 MEMBER BROWN: But that's not in 1.2. The 8
independent and diverse is not in here.
9 MR. MORTON: That's correct. We just 10 simply defined the critical safety functions, what 11 they are. For purposes of the BTP, we just simply 12 define what they are.
13 MEMBER BROWN: Well, somebody has to go 14 off and look at 93-087?
15 MEMBER BLEY: No, Charlie, the independent 16 and diverse is stated right in position 4.
17 MR. MORTON: Right.
18 MEMBER BLEY: Two pages earlier.
19 MR. MORTON: So, in the BTP, we define, we 20 actually define what position 4 is in --
21 MEMBER BROWN: Okay. I found it. Never 22 mind.
23 MR. MORTON: Yes.
24 MEMBER BROWN: As long as it's in here, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
91 that's okay.
1 MR. MORTON: Yes. It's also in this 2
particular subsection of guidance 4, position 4, in 3
the BTP, so for your reference. So, we tell you that, 4
for those particular functions --
5 MEMBER BROWN: That's in 1.1, though.
6 MR. MORTON: Yes, yes.
7 MEMBER BROWN: Only where point 4 is I 8
didn't see the diverse. That's where I got lost in 9
terms of --
10 MR. MORTON: Yes, we changed some terms 11 for consistency with the SRM, but the requirement for 12 position 4 is that those displays and controls to 13 operate the critical safety functions have to be 14 independent and diverse. That's a requirement from 15 the position 4 of the SRM itself. The individual 16 efficacy of the controls and displays is that the 17 applicant may credit if something would be handled 18 under the more detailed HV evaluation. It's not 19 something we would get into in a significant for the 20 BTP. So, I just wanted to make that -- there's a 21 distinction there I just want to be clear on.
22 MEMBER BROWN: Okay. Go on.
23 MR. MORTON: Okay.
24 MEMBER BROWN: I'm good. I've been 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
92 suitably chastised.
1 (Laughter.)
2 MR. MORTON: So, if there's no other 3
questions, Dawnmathews, if we can go to slide 21?
4 So, for this particular subsection, I 5
believe it was Section 8.5 or 8.6 previously. Now 6
it's Section B.6.5, due to the changes we made in 7
integrating different sections.
8 We did get a number of public comments on 9
this particular subsection asking for additional 10 flexibilities under the BTP for addressing the 11 potential effects of a CCF that haven't necessarily 12 been addressed through the other methodologies stated 13 earlier in the BTP. And that's essentially what the 14 staff provided, and the ability to use alternative 15 methods when certain CCF vulnerabilities were not 16 specifically addressed through specific design 17 measures or things of that nature. So, we did 18 improve, make some refinements and improvements in 19 this subsection based upon our internal discussions as 20 well as industry and stakeholder comments.
21 So, I'm hearing no questions on this 22 particular topic. So, Dawnmathews, please go to slide 23 No. 22.
24 Okay. So, status and next steps.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
93 Technically, both the Draft Rev. 8 and the public 1
comment file are attached to, are in the final 2
concurrence review. We're still continuing to make 3
refinements and tweaks based on the feedback that we 4
received, including the feedback we received today at 5
today's ACRS meeting, as well as the previous ACRS 6
member feedback we received back in November of last 7
year and in June of this year. We do have another 8
ACRS full Committee meeting potentially scheduled for, 9
I believe, early November, later this year. And 10 really, the final milestone we're looking at prior to 11 issuance, targeting January-February of 2021, is OMB 12 review and publication, potentially targeted for 13 January-February of 2021.
14 So, those are just kind of the major 15 milestones that we have left going forward with the 16 BTP into fall. So, with that said, that essentially 17 completes our presentation. Are there any questions 18 from the members?
19 MEMBER BROWN: Yes, I have one, as kind of 20 a closure item. We do have the full Committee meeting 21 coming up in November --
22 MR. MORTON: Yes.
23 MEMBER BROWN: -- which I'll, obviously, 24 be tasked with preparing a report for the Committee, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
94 full Committee's agreement.
1 There has been a lot of variability in 2
this document over the last year. Are you comfortable 3
with where your concurrence process is, that you're 4
not going to have any more hiccups, the way we did a 5
few months ago in terms of people saying, "Gee, you've 6
got to redo all this."? I don't know how much legal 7
was involved. It's obvious you all took our comments 8
from the November and the June meeting into 9
consideration in terms of your reorganization, 10 consolidations, and stuff, which I think was positive.
11 My
- concern, is there some other 12 outstanding issues that you all have in the background 13 that we're not aware of that are going to drastically 14 change the picture of what this looks like before the 15 full Committee meeting?
16 MR. MORTON: Member Brown, right now, 17 we're very confident within the content of the 18 document as it stands. In terms of any major 19 significant issues, the ones that we had received 20 previously, the document that you received publicly is 21 the document that we believe resolved any remaining 22 residual significant issues that had come up since the 23 June meeting.
24 This is a version that has had internal 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
95 staff review, including the legal review as well. So, 1
it generally represents our legal positions on these 2
matters.
3 MEMBER BROWN: Okay. So that you have got 4
the NLO on this then?
5 MR. MORTON: That's correct, yes.
6 MEMBER BROWN: Whatever it's called?
7 MR. MORTON: That's correct, yes.
8 MEMBER BROWN: So, basically, we should be 9
expecting to review this document and any responses to 10 questions during this meeting during the full 11 Committee meeting? Whatever questions, you know, 12 whatever issues or whatever questions we raise in this 13 meeting, you would address those at the full Committee 14 meeting?
15 MR. MORTON: That's true. And I also want 16 to just tweak what I just said a little bit. So, we 17 did have a legal review, but it's the working -- I 18 would say this is still a working file in progress.
19 We did receive NLO on it, to your question. But we 20 will be saying the document's still technically in 21 concurrence. So, there may be changes and tweaks into 22 the document going forward.
23 MEMBER BROWN: The basic format, layout, 24 rearrangement of sections, deletion or inclusion of 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
96 additional stuff, other than if you do it based on 1
some of our comments, you don't see that as being a 2
major issue then?
3 MR. MORTON: That is correct. We don't 4
foresee any significant reorganizations like you've 5
seen from the June to August version of the document, 6
that's correct.
7 MEMBER BROWN: So, when we get a document 8
for the full Committee meeting a couple of weeks 9
before, or whatever the requirement is, you should be 10 able to highlight the stuff you've got? I don't mean 11 redline/strikeouts, but at least highlight where 12 changes were made and what those changes were?
13 MR. MORTON: That's correct, yes.
14 MEMBER BROWN: Before the meeting, a 15 couple of weeks before the meeting?
16 MR. MORTON: Yes, that's correct.
17 MEMBER BROWN: Okay.
18 MEMBER BLEY: Hey, Charlie, can I sneak 19 something in? It's Dennis.
20 MEMBER BROWN: Yes, go ahead, Dennis.
21 MEMBER BLEY: In the introduction, you 22 guys mentioned that, you know, you've really focused 23 this on being a document for the staff, as a Standard 24 Review Plan is supposed to be. The hit I got was 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
97 you're not planning on doing a Reg Guide, but you 1
think industry might be putting together some form of 2
guidance? Is that what you're expecting? And they'll 3
be on, so we can hear from them later.
4 MR. MORTON: Member Bley, can you say that 5
one more time? I didn't quite hear your question.
6 MEMBER BLEY: Okay. My understanding from 7
your initial comments was that you will not be, or you 8
don't plan to do a Reg Guide for applicants, but you 9
think industry might be putting together some kind of 10 guidance for applicants. Is that correct?
11 MR. MORTON: Yes, we can let industry 12 speak to that point. I believe they'll be on later on 13 after the staff is done.
14 In terms of the Reg --
15 MR. BENNER: This is Eric Benner. I don't 16 think the door is closed to either option. We just, 17 like I alluded to, we've been so busy focused on this 18
- document, that we haven't had the 19 interaction/communication with stakeholders to discuss 20 what form should the guidance, companion guidance for 21 industry, take. So, I mean, I think we need to have 22
-- I mean, some of it, we're going to hear some 23 thoughts from the industry today, but we need to have 24 that communication with stakeholders, particularly the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
98 industry, to see what's the best way to fill in that 1
hole.
2 MEMBER BLEY: Okay. Thanks.
3 MEMBER BROWN: Okay.
4 MS. ANTONESCU: Good morning.
5 MEMBER BROWN: Yes?
6 MS. ANTONESCU: This is Christina.
7 My understanding was that the staff 8
received a full NLO for the BTP, but working level NLO 9
for the resolution of the public comments.
10 MEMBER BROWN: Okay. Is that correct, 11 Eric?
12 MR. MOORE: Excuse me. This is Scott 13 Moore.
14 OGC has asked that we not discuss the 15 legal review as part of the presentations.
16 MEMBER BROWN: Okay.
17 MR. MOORE: I think it's a fair question.
18 Certainly, it's absolutely a fair question to ask is 19 it going to change between now and when the Committee 20 reviews documents at the full Committee stage. But 21 OGC's preference is that the staff not discuss OGC's 22 comments back to the Committee as part of the 23 presentation.
24 Thank you.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
99 MEMBER BROWN: Okay. Thank you, Scott.
1 I don't have any problem with that. It was just I 2
know there's been a lot of gyrations. I just want to 3
make sure we get a consistent document this time.
4 MR. MOORE: Yes, sir.
5 MEMBER BROWN: Okay. Wendell and Eric, I 6
told you I would provide some feedback, and we'll do 7
this before we take a break. This will only take 8
about five minutes, and then, we'll do the NEI stuff 9
after we take a break. And these are just my thoughts 10 relative to the background, and it's kind of the 11 fundamental issue of how do you craft defense in 12 depth, the most important, one of the most important 13 protections we have in these systems.
14 So, my comment, which I will send copies 15 to you via Christina, which you then can do with what 16 you decide to do with prior to the full Committee 17 meeting. But just to get it on the record, the way I 18 read this was, No. 1, in the background, fundamentals:
19 (a) The approach -- and don't take this 20 first part negatively; this is just my view of how we 21 do things a lot of the times. The approach taken by 22 the BTP is piecemeal in that it addresses the review 23 of defense in depth and diversity for digital I&C, 24 safety and non-safety systems, by evaluating the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
100 pieces that make up the systems without knowing the 1
overall I&C reactor trip and engineered safeguards 2
architectures for the specific application.
3 If you look at applications we reviewed in 4
the past few years, the architectures that meet five 5
fundamental principles for the structure of these 6
systems, the I&C system designs, provide the basic 7
framework for identifying the need for, and type of, 8
D3 required. In fact, an architecture for each of 9
these two primary high-significance safety systems, 10 RTS and SFAS, that meets the fundamental principles, 11 starts off with at least five or six layers of defense 12 in depth and two or three layers of diversity, 13 depending on how you want to aggregate them.
14 The first level is the use of redundant 15 divisions. Once you go from one division to four or 16 three or two, you have created a level of defense in 17 depth.
18 The second is the use of separate 19 detectors and A-to-D converters for each detector's 20 signals. That's a second level of defense.
21 The third is the use of asynchronous 22 clocks. In other words, the divisions are not 23 synchronized for cycle planning and processing. And 24 detectors never put out the same signal. Trying to 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
101 get them to measure the same pressure for one pressure 1
input just doesn't, typically, does not happen. And 2
this works whether you have deterministic or 3
interrupt-driven processing systems.
4 The fourth level is the use of hardware-5 based monitors, watchdog timers, independent of the 6
processors on at least the software-based coincidence 7
voting units. In other words, you have a monitor, 8
regardless of -- but it's independent, to ensure that 9
corrupt data from one division does not lock up all 10 voting units.
11 The application of timers or monitors on 12 even the data processing and computational processors 13 provides a fifth level of defense in depth.
14 The use of manual reactor trip and 15 safeguards actuation switches downstream of the CCF-16 vulnerable units provides a sixth level.
17 And the use of non-software-configured 18 one-way data communications provides a seventh level 19 in terms of access to the plant from external sources.
20 There are also three levels of diversity 21 through the use of hardware manual
- switches, 22 processor-independent hardware watchdog timers, and 23 the use of non-software unidirectional data.
24 I'm not going to read the rest. I've 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
102 provided the rest that you ought to incorporate into 1
the background the concept of what defense in depth 2
means relative to architectures and using the words 3
that I've provided.
4 The other comment (b) is that the 5
background addresses combining reactor trip systems 6
and SFAS systems into combined a single DI&C 7
protection system. It is, then -- and this is a 8
little bit pejorative -- but, then, states in the most 9
ho-hum manner that this makes identification and 10 evaluation of potential consequences of a postulated 11 CCF more challenging. I had a difficult vision of how 12 in any manner we can condone or accept combining these 13 systems into a combined system using the same 14 processors.
15 NUREG-6303 actually identifies, as you 16 said before, echelons of defense, the normal reactor 17 controls, reactor trip, SFAS, and the reactor 18 monitoring identification systems as individual 19 echelons of defense.
20 These two paragraphs, the background or 21 the other background paragraph I talked about and this 22 other one, are obviously contradictory.
23 The section or the appropriate sections 24 should be revised to verify independence between the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
103 high-significance safety systems is maintained.
1 And then, there are some similar comments 2
down relative to those two things under the Branch 3
Technical Position, which I'll just pass on to you 4
without reading.
5 Anyway, I'll pass those on to you. Those 6
were my thoughts. They're obviously not Committee 7
thoughts, not Committee agreements. But I will be 8
advocating that we provide some recommendations on 9
that via the full Committee meeting. And if my 10 colleagues disagree, I guess we will accept that. But 11 I will pass them on to you for your consideration 12 prior to the full Committee meeting in November.
13 So, is that okay?
14 MR. MORTON: Yes, sir, that's fine. Thank 15 you, Member Brown.
16 MEMBER BROWN: Okay. And at this point, 17 I think it's 11:30. We were scheduled for a break a 18 few minutes ago. We're going to take it now. We 19 will, then, come back and wrap up with the NEI 20 comments.
21 So, as of -- what time is it? -- it's 22 11:35. We'll come back at --
23 MS. ANTONESCU: Charlie, according to the 24 schedule, the NEI comments on the Draft BTP is at two 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
104 o'clock. So, we will have to find out if they're 1
ready.
2 MEMBER BROWN: Oh, could we avail them --
3 are they here, NEI?
4 MR. VAUGHN: Chairman Brown, this is Steve 5
Vaughn with NEI. I'm online. So are Warren Odess-6 Gillett and Mark Burzynski. So, we'll be ready in 7
five minutes, if that's how you want to proceed.
8 MEMBER BROWN: Okay. We'll do this at, 9
make it 11 -- 15 plus 36 is what, 51. Let's make it 10 11:55. Is that acceptable? We'll reconvene at 11:55.
11 So, we're recessed right now.
12 Thank you.
13 (Whereupon, the above-entitled matter went 14 off the record at 11:36 a.m. and resumed at 11:55 15 a.m.)
16 MEMBER BROWN: This is Charlie Brown. I'm 17 back.
18 Let me do a roll call of the members 19 again, if I can find them all.
20 Dennis?
21 MEMBER BLEY: I'm here.
22 MEMBER BROWN: Walt?
23 MEMBER KIRCHNER: Here.
24 MEMBER BROWN: Dave?
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
105 MEMBER PETTI: Here.
1 MEMBER BROWN: Joy?
2 VICE CHAIR REMPE: Here.
3 MEMBER BROWN: Matt?
4 MEMBER SUNSERI: Here.
5 MEMBER MARCH-LEUBA: And Jose March-Leuba 6
is here.
7 MEMBER BROWN: Oh, Jose is here. Okay, 8
Jose.
9 MEMBER MARCH-LEUBA: Sorry I wasn't at the 10 start.
11 MEMBER BROWN: Okay. It's all right. It 12 was exciting.
13 And I think I've got everybody.
14 MR. HECHT: Myron is also here.
15 MEMBER BROWN: Oh, Myron. I'm sorry. I 16 apologize for that.
17 With that in mind, I think I will turn 18 this over to Steve Vaughn from NEI.
19 Are you ready?
20 MR. VAUGHN: Yes. Yes, we are ready.
21 MEMBER BROWN: I lost the slides. Oh, 22 there they are again.
23 MR. VAUGHN: Yes. And I had to shut down 24 to unmute myself.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
106 MEMBER BROWN: Okay. All right. I'll 1
mute myself.
2 And this is Steve Vaughn from NEI. He 3
will doing responses from his other two compatriots.
4 I think it's Warren Odess-Gillett, right, and Mark 5
Burzynski?
6 MR. VAUGHN: Correct.
7 MEMBER BROWN: Okay. I will turn it over 8
to you, Steve.
9 MR. VAUGHN: All right. Thank you, 10 Chairman Brown and ACRS Members. We appreciate the 11 opportunity to present NEI perspectives.
12 Just again, my name is Steve Vaughn. I'm 13 a Senior Project Manager at the Nuclear Energy 14 Institute. I help coordinate a lot of the digital I&C 15 efforts ongoing.
16 And with me here in the virtual setting I 17 have Warren Odess-Gillett. He works at Westinghouse, 18 but he's also a part-time NEI loanee, and he will be 19 presenting some of the slide material.
20 And also, Mark Burzynski, representing 21 NewClear Day, Incorporated, will address some of the 22 slides as well.
23 Next, moving on, the first slide here is 24 on Section 2. We should have renamed this "Digital 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
107 I&C Characteristics," not "Categorization."
1 Just for everyone's edification, based on 2
what Wendell went through this morning, I probably 3
would have adjusted some of these slides after hearing 4
it, but we developed these last week. So, there will 5
be some tweaks here.
6 But, at a high level -- I just don't want 7
to lose the forest to the trees here -- NEI does like, 8
is all for having a graded approach to the digital I&C 9
system and components, maybe not categorization, but, 10 you know, creating the approach that you put it into, 11 based on the safety. So, we completely agree with 12 that, and we have been since the first proposal, I 13 think back in the November full Committee meeting.
14 So, we're all for it. We just have some comments here 15 to help clarify some of the guidance.
16 So, the first one here, use of risk 17 insights from site-specific PRAs, that language did 18 change a little bit from the last revision, the May 19 version. And the one thing we saw that was slightly 20 different is it noted that, if you do use risk 21 insights, you're basically demonstrating that a 22 structure, system, or component is less safety 23 significant than the criteria.
24 And our comment here is that these risks, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
108 many different risk insights, it's really independent 1
of these deterministic criteria. They could have 2
offered something that's less safety significant, but 3
the flip side is also the potential where, when you do 4
get risk insights, you could increase the level of 5
safety significance when comparing to these criteria.
6 And when Member Bley noted the logic under 7
B, where it was low safety significance, but it was 8
non-safety-related, but safety significant, it kind of 9
created a logic on an issue that kind of illustrates 10 this point where you could have something that is non-11 safety-related, but when you go through the switching 12 exercise using the site-specific PRA, you might come 13 to a determination that it has higher safety 14 significance than one might think when you see the 15 label "non-safety-related." So, that was just one 16 thing we wanted to point out.
17 The second piece, you know, based on how 18 the NRC provides the guidance to ensure that this is 19 directed to the audiences, for the staff, we do know, 20 it makes sense now why you revised the language there 21 about the risk insights should be an input into the 22 decisionmaking process. And that's what a utility 23 would use when they're making this determination, not 24 necessarily what the staff would do. So, it makes 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
109 sense why you took it out.
1 But I just wanted to note that, when an 2
applicant is going to apply for a digital modification 3
under this BTP 7-19, they're going to take risk 4
insights from the PRA and they're going to look at 5
these deterministic criteria and make an integrated 6
decision.
7 All right. So, moving on to the actual 8
criteria themselves, we did focus in on just the alpha 9
category, which is previously A1. It wasn't clear, 10 though, and we suspect that you don't need all the 11 criterion. So, it's not an "and" between each of 12 them. But we went kind of back and forth; we weren't 13 really sure. It's just an offer to maybe clarify the 14 criterion as one of the four or a subset of those, but 15 basically you don't need all the criterion to be met 16 in order for it to fall within that definition, 17 whether it's Alpha above or Charlie below.
18 MR. ODESS-GILLETT: Steve, this is Warren.
19 Do you mind if I clarify a little bit?
20 MR. VAUGHN: Sure.
21 MR. ODESS-GILLETT: Okay. So, what we're 22 really concerned about is that, if you use like the 23 first one, A, as a standalone criteria for Category A, 24 it's a significant contributor to plant safety. You 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
110 couldn't really use that as a standalone. So, the 1
industry assumes that you have to meet all four to be 2
into this Category A, and that's what we would prefer, 3
but it's not clearly stated that you need all four.
4 MR. VAUGHN: Yes. Thanks, Warren.
5 That is a good segue into the second 6
bullet, because the first criterion uses the phrase 7
"significant contributors to plant safety," and we're 8
trying to think about how one would -- how a digital 9
I&C system or a component would meet that, you know, 10 whether it's a significant contributor to plant safety 11 or not. You know, most of the focus is on insights 12 from the site-specific PRAs, and we've, obviously, 13 taken some engineering deterministic insights. Like 14 Warren said, that, in and of itself, it's just really 15 hard to make that determination. That's just a 16 challenging criterion to figure out whether you meet 17 it or not. And maybe it's meant to be ambiguous, and 18 that's okay. It's just, you know, to consistent 19 outcomes, it might be challenging.
20 And similar with the GDC 22, that's the 21 fourth criterion that was added, I think in the May 22 version. It wasn't in back in January. Again, GDCs, 23 by design, are very high-level. So, we would just 24 challenge you to see whether that criterion is met and 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
111 whether it's you just need that in that category 1
because the assessment moved away from that term. But 2
it just makes it challenging to figure out what box 3
you're in.
4 And so, the second and third criterion we 5
thought were pretty straightforward, and we think the 6
second and third should be able to address all the 7
different examples, potential examples, out there.
8 So, our recommendation would be just to focus on the 9
second and the third criterion.
10 All right. We're going to move on to the 11 next slide, unless there are any questions.
12 MEMBER BROWN: Just stay there for a 13 minute.
14 MR. VAUGHN: Okay.
15 MEMBER BROWN: I mean, I just opened the 16 document and read all four of them. I guess I didn't 17 think of it when I read -- this is Charlie Brown. I 18 guess I didn't -- and somebody else can help me, if 19 they so desire, Dennis, et cetera -- but I just read 20 those as things to consider. And whether three or 21 four or one or two applied, you had to make an 22 independent judgment whether they fell into the high 23 safety significance, but those were things to think 24 about. So, I'm not so sure -- I didn't read it the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
112 same way you did, that two of them should be deleted.
1 That's my only thought. I don't know whether anybody 2
else has the same thought process or not, but that was 3
mine.
4 I'm just feeding that back to you for my 5
thought process on the thing. I'm not suggesting a 6
resolution one way or the other. Just an observation 7
as to how I viewed it when I read them. Okay?
8 MR. VAUGHN: Thank you, Member Brown.
9 MEMBER BLEY: This is Dennis Bley.
10 I'm with Charlie on how he read them. But 11 if somebody who has to use them has trouble sorting 12 them out, maybe that's an indication the staff needs 13 to make them a little more clear. But they weren't 14 unclear to me.
15 MEMBER BROWN: I agree with you, Dennis.
16 A discussion sounds like it would be required.
17 MR. VAUGHN: Okay. And just to reiterate, 18 the first and fourth criterion, that was NEI's 19 recommendation, just to remove those and just keep the 20 second and third criterion, which strings a little bit 21 over there, once getting back to the January version.
22 At least those two, if you met one of those two, it 23 would make sense to frame it under high safety 24 significance, notwithstanding any insights you get 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
113 from your site-specific PRA. But it's the first and 1
the fourth we're challenging to see whether they were 2
met or not because there's a lot of ambiguity there.
3 And what Warren's comment was is -- I 4
think when you do read it, it makes sense. Any one of 5
the four could put you into this category, for lack of 6
a better word. But because the first and the fourth 7
criterion were so open, it was just challenging to 8
make a determination. And that might be by design, 9
but, just to comment, we noted that it could --
10 there's a lot of subjectivity.
11 MEMBER BROWN: Okay. Do you want to move 12 on, unless somebody's got another comment?
13 MR. VAUGHN: Okay. Why don't we move on 14 to the next slide? It's "Defensive Measures," Section 15 3.1.3.
16 And again, this is a key section of 17 BTP 7-19. And so, we're very happy that it has been 18 added. It's been there for, I want to say, since the 19 November revision.
20 So, we're probably going to send the staff 21 some wording changes because previous versions, you 22 know, that was NRC-endorsed methodology. And 23 currently, this says industry-endorsed defensive 24 measures. And we just want to make sure that it isn't 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
114 limiting.
1 If we can step back for a second, the 2
whole purpose of this section is to allow NEI and 3
industry to develop their own guidance on how to 4
address software common cause failure. And given that 5
there's two other ways to eliminate the CCF from 6
further consideration -- it was either diversity or 7
testing -- so, there are only two options.
8 So, this section really does allow for the 9
opportunity for NEI and the industry to develop their 10 own set of guidance that will be endorsed by the NRC 11 and try the third option. So, again, we're happy that 12 it's there. We just might suggest some wording 13 changes to ensure that it really does align with the 14 first this bullet here. We have already a draft 15 version of NEI 20-07. And we did send that to the 16 NRC, I think, August 31st. So, they've only had it 17 for a week or so.
18 But, in the coming weeks when the staff 19 does have a chance to read through it, gather some 20 feedback, we look forward to an public opportunity to 21 get that feedback and get probably a handful of public 22 meetings in '20-21, as we change that guidance based 23 on staff feedback and from other stakeholders.
24 So,
- again, this section is really 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
115 important to us. And so, anything that we do provide 1
is just to ensure that the link is clear between 2
Section 3.1.3 and what we developed as NEI 20-07.
3 MEMBER BROWN: Doesn't the last paragraph 4
of 3.1.3 -- this is Charlie Brown again -- doesn't the 5
last paragraph pretty much say you guys, industry, can 6
pretty much propose what they want on a case-by-case 7
basis? And then, NRC will address it.
8 MR. VAUGHN: Yes, it does, and it may be 9
in a sense the nomenclature. But what NEI 20-07, what 10 it doesn't do, it's not just a list of defensive 11 measures that are approved for use because they're 12 occasion-specific. Again, 20-07 starts very high 13 level, the first principles, and then, it gets in safe 14 design directives, and then defensive measures, and 15 uses the term "design attributes" that you can use in 16 designs to help meet the safe design objectives; and 17 therefore, meet these first principles, which are, 18 then, again, tied to regulations. That's what 20-07 19 is. It's not just a list of defensive measures. It's 20 to make sure the wording in this section lines up well 21 with 20-07's.
22 And in the previous
- version, they 23 mentioned NRC methodology. Methodology is general 24 enough where it would apply to 20-07, because that's 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
116 really what it is. It's not just a list of defensive 1
measures. So, I could be reading too much into it, 2
but I'm heavily involved with the document and this 3
section. So, I just want to make sure everything's 4
clear to all stakeholders.
5 MEMBER BROWN: Okay. Thank you.
6 MR. VAUGHN: You're welcome.
7 MEMBER BLEY: I'm sorry, I got dumped off 8
the line for a few minutes and missed part of your 9
discussion on this one. Are you guys, have you made 10 any plans for developing guidance at this point, the 11 industry?
12 MR. VAUGHN: Yes. Yes, Member Bley, I 13 want to say it's been a little over a year we've laid 14 out a proof of concept, and just eight days ago, we 15 sent a draft version of NEI 20-07 to the NRC, and it's 16 publicly available in ADAMS right now.
17 And we look, probably in the next month or 18 two, when the staff has a chance to review it and 19 they've got us some feedback, we look forward to a 20 meeting to discuss technical and regulatory content of 21 that. So, the short answer is yes, and we probably 22 will have a public meeting before the end of 2020.
23 MEMBER BROWN: We lost the slide, by the 24 way.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
117 MEMBER BLEY: Yes, it did go away.
1 Thank you for that response.
2 Charlie?
3 MEMBER BROWN: Yes?
4 MEMBER BLEY: When is our full Committee 5
meeting scheduled?
6 MEMBER BROWN: November. That's correct, 7
isn't it, Christina?
8 (No response.)
9 MEMBER BLEY: So, we will not have the 10 industry proposed guidance -- well, we might see a 11 draft of it before then.
12 MEMBER BROWN: Yes, he just said they --
13 I think it's 20-07. And it's the 20-07 document 14 you're talking about?
15 MEMBER BLEY: Yes, I think that's what he 16 said, but they're going to revise it again in the next 17 few weeks. So, we probably won't get to see that 18 revision.
19 MS. ANTONESCU: Yes, we will have a copy, 20 a draft copy, for you.
21 MR. VAUGHN: It's available in ADAMS right 22 now. I don't have the number handy, but I can send it 23 to you. Maybe you can share it with the ACRS, and 24 anyone from the NRC will be able to share it with you 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
118 as well. It's publicly available.
1 MEMBER BROWN: Yes, Christina, if it's in 2
ADAMS, she'll get a copy for us.
3 MR. VAUGHN: Okay. Great.
4 MEMBER BROWN: Thank you.
5 MR. VAUGHN: All right. If there are no 6
other questions on this slide, I'm going to turn it 7
over to Warren Odess-Gillett, and he's going to get 8
into slide 4.
9 MR. ODESS-GILLETT: Steve, do you have 10 another document open that's preventing you from 11 sharing the presentation?
12 MR. VAUGHN: Thank you. No. So, you 13 didn't see that before?
14 MR. ODESS-GILLETT: No, it just appeared 15 now.
16 MR. VAUGHN: How about now?
17 MR. ODESS-GILLETT: Yes, that's fine.
18 That's good.
19 MR. VAUGHN: Okay. Yes, it just stopped 20 and I didn't realize that.
21 MR. ODESS-GILLETT: No worries. All 22 right. So, this has to do with the title and scope of 23 the document. The title of this draft is "CCF Due to 24 Latent Defects in Digital Safety Systems," just 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
119 extenuating the word "safety" here.
1 And the scope of this draft states that 2
the guidance of this BTP is intended for staff reviews 3
of I&C safety systems. However, even though the scope 4
seems to, and the title seems to, limit the review to 5
safety systems, the task still contains review 6
guidance for non-safety-related systems.
7 And NEI and its members would like to see 8
the non-safety-related guidance moved elsewhere from 9
the BTP, to be consistent with the title and the scope 10 of the document, if we had our druthers.
11 We agree that non-safety-related 12 discussion should be limited to any interconnectivity 13 or dependency of the safety system with a non-safety 14 system. But we know in the past addressing CCF for 15 non-safety-related systems has not always been 16 consistent in Part 52 reviews, where we've seen the 17 reviews range from a probabilistic approach, as in the 18 ESBWR, to actual transient analysis computations, as 19 was demonstrated for the APR1400.
20 We know that RIS 2002-22, Supplement 1, 21 has good regulatory guidance to industry on how to 22 address this issue for non-safety-related systems for 23 the operating fleet. And if the staff wants to 24 migrate the RIS into staff guidance, it's desired by 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
120 industry that this would be in another document, not 1
part of the SRP, and limit this SRP to its significant 2
title and scope, which is review of safety-related 3
systems.
4 MEMBER BLEY: Since this is staff 5
guidance, I'm curious as to why you're concerned about 6
the last comments you made.
7 MR. ODESS-GILLETT: It makes the BTP 7-19 8
a more complicated document by now -- we already have 9
a graded approach. Industry is really happy with the 10 graded approach to addressing CCF via the RIS for the 11 operating fleet.
12 And so, we just fine that, if the title 13 and scope -- either the title and scope need to 14 change, or the content needs to change. And if the 15 industry had its druthers, we'd like to keep this 16 content consistent with the title and scope and have 17 the non-safety-related stuff in another section of the 18 SRP than this, just to simplify the document.
19 MEMBER BLEY: Okay. Go ahead.
20 MR. ODESS-GILLETT: Okay. Now I guess we 21 go to slide 5.
22 All right. So here, as Wendell had 23 mentioned, they had defined in the background section 24 that this was to focus on latent defects. And we 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
121 understand that, really, these latent defects are 1
related to the design. Because latent defects are 2
associated with manufacturing, which this BTP is not 3
addressing those potentialities. So, the BTP scope, 4
since it is focusing on the design aspects of the 5
safety systems when addressing CCF, we'd like to see 6
the word "design" be used as a qualifier when 7
referring to "latent defects."
8 And then, also, the draft uses the term 9
"active components" without defining the term. So, 10 industry is struggling to understand what the 11 differentiation between an active hardware component 12 is and a component that has software-based logic 13 because they're used both in the same sentence, and 14 they are somehow differentiated between the two.
15 And similar to our comment to the last 16 ACRS Subcommittee meeting, how the industry addresses 17 particularly a hardware CCF, again, is still not clear 18 to us, even with this added term of "active 19 component," because we're not really sure what it 20 means. I mean, the industry is clear that it needs to 21 address CCF for what we would call programmable 22 hardware components, but we would like to know what 23 the definition of an "active component" is and why 24 that is different from a component that is software-25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
122 logic-based.
1 MEMBER BROWN: And an inactive component 2
is a resistor.
3 MR. ODESS-GILLETT: Okay.
4 MEMBER BROWN: An active component is a 5
solid-state device that can do something.
6 MEMBER BLEY: I think we ought to let the 7
staff speak to this one.
8 (Laughter.)
9 MEMBER BROWN: Well, I just thought I'd 10 throw this out. It's kind of an interesting thought.
11 Capacitors, resistors, et cetera, inductors, those are 12 passive components. Anything else is -- a vacuum tube 13 is an active component. But that's all right. You 14 all can work that out on your own. I just thought I'd 15 throw that, like that little puppy in the rice bowl; 16 that's all.
17 (Laughter.)
18 MEMBER BROWN: You can go on.
19 I agree with you, Dennis.
20 MR. ODESS-GILLETT: Okay. Steve, I think 21 we can go to slide 6 and hand it off to Mark.
22 MR. BURZYNSKI: Okay. Can you hear me?
23 MR. ODESS-GILLETT: Yes.
24 Mark, did we lose you?
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
123 MR. BURZYNSKI: No, I'm here.
1 MEMBER BROWN: Yes, go ahead. We can hear 2
you.
3 MR. BURZYNSKI: Okay. So, the point with 4
the slide 6 is that the example that's provided in the 5
document that addresses partial actuation of an 6
emergency core cooling system, mentioned as a single 7
division coincident with false indications stemming 8
from a postulated CCF, is a confusing example. We 9
find that it's inconsistent with the evaluation 10 guidance in NUREG/CR-6303. Specifically, Section 3.6 11 would require you to postulate concurrent failures in 12 all the same blocks in all redundant divisions, which 13 would preclude the partial actuation example of a 14 single ECCS division.
15 The second evaluation guidance in Section 16 3.8 specifies that downstream blocks are assumed to 17 function correctly in response to the incorrect or 18 correct inputs they receive, which would preclude the 19 false indications. A spurious actuation would 20 indicate that it actuated. A failure to actuate would 21 indicate no actuation. But you wouldn't mix the two.
22 So, we just want to point that out, that this 23 introduces confusion with respect to what is expected 24 for spurious actuation or that it's inconsistent with 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
124 the other guidance that's mentioned regarding CCS 1
evaluation.
2 Next slide.
3 Okay. On slide 7 --
4 MEMBER BROWN: Your slides disappeared 5
again.
6 MR. BURZYNSKI: -- is where we find 7
inconsistencies within the document. We note in 8
several cases that the use of best estimate 9
methodology is allowed for evaluation of consequences, 10 but we do note that in several places it specifically 11 says, "bounded by acceptance criteria defined in the 12 FSAR," without mention of best estimate or realistic 13 assumptions. So, that creates some confusion was to 14 whether a different set of rules applies to these 15 cases here.
16 We also note that the discussion of 17 independent and diverse with respect to manual 18 controls is confusing. This is similar to some of the 19 discussion that occurred earlier regarding the use of 20 Reg Guide 1.62 and how we've reconciled these 21 documents. We think it would be useful to add a 22 clarification that the independent statement does not 23 require additional isolation on a hard-wired manual 24 control that is connected downstream of the digital 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
125 part of the system in the same safety division.
1 And the last item on this slide, it's an 2
inconsistency between ability to credit ATWS 3
mitigation equipment and the specification here 4
requiring independent sensors and actuators. We make 5
note of the fact that the ATWS rule does not require 6
independent sensors or actuators for the equipment it 7
required to be installed.
So, there's an 8
inconsistency.
9 We also note that 10 CFR 50.62 was removed 10 as a reference in the regulatory basis section, and we 11 think it should be added back.
12 Thank you.
13 MR. ODESS-GILLETT: All right. So, I'm 14 going to address this one. This is Warren Odess-15 Gillett.
16 I think this is just an editorial thing, 17 but it has some technical significance. So, that's 18 just why we're bringing it up.
19 The first paragraph of page 29 allows for 20 diverse controls that are credited to mitigate a CCF 21 vulnerability with a safety system; in other words, 22 position 3 controls. They can also be credited as 23 position 4 controls as long as they're in the control 24 room.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
126 Steve, I think we lost the slides again.
1 Thank you.
2 However, the wording in the next paragraph 3
seems to contradict that statement by stating that 4
position 4 controls, and displays for that matter, 5
must be diverse from those credited for position 3.
6 And as we know, position 3 need to be diverse and 7
independent from the system that's vulnerable to a 8
CCF. So, we believe this was not the intent. And so, 9
we're bringing this syntactical situation to the 10 attention of the staff.
11 MR. VAUGHN: All right. Thank you, 12 Warren. This is Steve Vaughn, NEI.
13 That is the last slide with any salient 14 content. Before any closing remarks, any questions on 15 the material we presented thus far?
16 Okay. Hearing none, again, we appreciate 17 the opportunity to share our thoughts. This is the 18 third Subcommittee meeting on this topic. So, that's 19 a reflection of how much engagement has been involved 20 over the past year-plus. And again, we're happy that 21 we're a stakeholder and to be able to participate in 22 the discussion. And we're getting close to resolving 23 most of the content issues, and I think BTP 7-19 is on 24 schedule to be issued, hopefully, by the end of this 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
127 calendar year. So, again, we appreciate the 1
opportunity to try our perspectives. We appreciate 2
it.
3 And I will turn it back over to you, 4
Chairman Brown.
5 MEMBER BROWN: Okay. Thank you.
6 Hopefully, I don't get this out of 7
sequence, but before we go to public content, I was 8
going to see if any of the members and our consultant 9
have any additional comments. Do you want me to walk 10 through?
11 Dennis, do you have anything else?
12 MEMBER BLEY: Thanks, Charlie.
13 I like some of the rearrangement they did 14 in this one. I remain concerned about the full 15 material that was in the A1, A2, all that, in the way 16 it's presented.
17 So, just to close for me on this, given 18 the way those four categories are described in Section 19 2.1, under "Acceptance Criteria for Safety-20 Significance Determination," high safety significance, 21 one, makes sense to me. The second one is really 22 functionally important to safety. The third one is 23 really definitionally important to safety. And the 24 fourth one is really not important to safety. So, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
128 that's the only thing. Everything else I think looks 1
pretty clean.
2 I would like to have a chance to look over 3
these NEI slides. They raised a lot of particular 4
issues, but I couldn't quite decide on as they went 5
through them, and I just need to see them again. So, 6
we'll get a copy of them when this is over.
7 MEMBER BROWN: Okay. Thank you, Dennis.
8 Jose?
9 MEMBER MARCH-LEUBA: Yes, I'm here. No, 10 I have no further comment. Thank you.
11 MEMBER BROWN: Okay. Dave?
12 MEMBER PETTI: No comments.
13 MEMBER BROWN: Okay. Matt? Or Joy?
14 Excuse me. I don't want to go out of alphabetical 15 order here. Joy, do you have any additional comments?
16 VICE CHAIR REMPE: Hi, Charlie. No. I 17 appreciate the opportunity to get an update from the 18 staff and NEI's continued participation, but I don't 19 have any additional comments.
20 MEMBER BROWN: Okay. Thank you.
21 Matt?
22 MEMBER SUNSERI:
I thought the 23 presentations were good, informative. I don't have 24 any additional comments. Thank you.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
129 MEMBER BROWN: Okay. Myron? Or Walt?
1 Excuse me. Walt Kirchner?
2 MEMBER KIRCHNER: Yes. Thanks, Charlie.
3 I echo Dennis' comments on the boxology.
4 Just an observation, it's not just this I&C matter, 5
but across the Agency it seems to me that there's not 6
a lot of consistency on how one approaches these 7
safety-significant determinations. I would point out, 8
for example, that even within the BTP, it is somewhat 9
inconsistent with the definition of safety-related 10 that's used in 10 CFR 50 and 52. And so, it's just a 11 general issue.
12 And I already made my comments about the 13 defense in depth topic as well. It's a similar thing.
14 It seems to be a lot of variability across the Agency 15 in how we do this boxology.
16 And second, a minor point, I always like 17 your kind of holistic approach, Charlie, starting with 18 the architecture. So, on the NEI slides, there was 19 one bullet pointing out that design and latent defects 20 would not include fabrication issues. It would seem 21 to me, if you start with architecture, this BTP would 22 work for both design CCF issues, as well fabricated 23 CCF issues.
24 That's it.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
130 MEMBER BROWN: Okay. Thank you very much, 1
Walt.
2 Myron?
3 MR. HECHT: I guess the observation I 4
wanted to make was not specific to BTP 7-19, but to 5
the philosophy of trying to remove replicated material 6
from reference documents. And Charlie already pointed 7
out that there was a circular reference problem 8
between 9-62 and 7-19. At least in the past, I guess 9
the overall problem is that (audio interference) --
10 how shall I say it? -- non-replicated approach, and 11 you start relying more on dependencies, particularly 12 the source document, the reference document, as it 13 changes, it has to be aware of the documents that are 14 dependent on it. And that introduces additional 15 complexity that might be caught and problems that 16 might not be caught for several years, unless a 17 dramatic effort is made to ensuring that particularly 18 the referenced documents on which other documents are 19 dependent are always checked for all of the 20 dependencies that they have.
21 MEMBER BROWN: Okay. Thank you.
22 That kind of restated the point that we 23 made earlier, and I agree with that. It's a balance.
24 I've already made my comments once. I 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
131 will provide them to Christina, as opposed to mouse-1 milking them anymore.
2 Let's see, I think I've covered everyone.
3 Did I miss anybody from the Committee or consultants?
4 No, I don't think so.
5 Christina, is the public line open?
6 MS. ANTONESCU: Thomas, can you please 7
open the public line?
8 MR. DASHIELL: The public line is open for 9
public comments.
10 MEMBER BROWN: Thank you, Thomas.
11 Is there anyone on the public line that 12 would like to make a comment?
13 (No response.)
14 MEMBER BROWN: Is there anybody on the 15 public line at all who could just say "Hi" to let us 16 know that it's, in fact, open?
17 MR. MAUCK: I'd like to make one or two 18 comments. This is Jerry Mauck.
19 MEMBER BROWN: From?
20 MR. MAUCK: From ER Resources, formerly 21 NRC.
22 The verbiage on the ATWS rule is totally 23 against what we wrote in the ATWS rule back in the 24 1980s. We took many man-years to ever get the ATWS 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
132 rule published. And the use of BTP 7-19 to rewrite 1
part of 10 CFR 50.62 is not acceptable and that should 2
be removed, or you're going to run into a major 3
conflict.
4 And the other comment is that citing these 5
non-safety
- systems, such as the recirculation 6
feedwater, as a problem and the defense in depth, has 7
anyone at the NRC staff gone through this using a 8
diverse digital (audio interference) once in the 9
protection system to see if this causes problems?
10 Because I don't think it will because the reactor 11 protection system protects against those systems 12 having a common cause software failure.
13 And it would be a problem if you used the 14 same digital platform in these critical non-safety 15 systems to do in the protection system. But if you do 16 that, it's already covered by BTP 7-19. You'd have to 17 include them as failing along with the protection 18 system. So, my question is, has anyone on the staff 19 gone through the concern (audio interference) to see 20 if there really is one?
21 CHAIRMAN BROWN: Okay. Could you give me 22 your name again, Jerry?
23 MR. MAUCK: Yes. Jerry Mauck, M-A-U-C-K.
24 CHAIRMAN BROWN: M-A -- say that again?
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
133 MR. MAUCK: M-A-U-C-K.
1 CHAIRMAN BROWN: Okay. Jerry, right?
2 MR. MAUCK: Right.
3 CHAIRMAN BROWN: Okay. Thank you.
4 Is there anyone else on the public line 5
that would like to make a comment?
6 Hearing none, Thomas, Christina, you all 7
can close the public line.
8 MR. DASHIELL: The public line is closed.
9 CHAIRMAN BROWN: Okay. Are there any 10 other comments that anybody thought of in the interim 11 here before I adjourn the meeting?
12 Hearing none, we will adjourn the meeting 13 at this time. Thank you all for your participation, 14 and we look forward to wrapping this up in the full 15 Committee meeting in November.
16 Eric, do you have anything else final to 17 say?
18 MR. BENNER: Just that you have given us 19 a lot to think about, and I think -- I know it was 20 good feedback, particularly on the terminology of 21 "high safety significance." You know, there's a 22 number of things that I think we can, irrespective of 23 what comes in the letter, I think you've given us some 24 good things to digest that we can clarify. So, we 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
134 will, in whatever product we provide to you for the 1
full Committee meeting, we'll explain the changes, and 2
particularly those changes that we make that we hope 3
will be responsive to some of the feedback we heard 4
here today.
5 CHAIRMAN BROWN: Okay. I have one final 6
-- obviously, you didn't care for my architecture 7
stuff. So, you'll only look at the other things. I'm 8
just pulling your leg a little bit.
9 (Laughter.)
10 CHAIRMAN BROWN: We've got to have some 11 humor somewhere in here.
12 MR. BENNER: Yes.
13 CHAIRMAN BROWN: I wanted to thank Tekia 14 and her colleagues and staff. I thought they did a 15 very good job. This was a much better document, a 16 smoother-reading document than the ones I have seen in 17 the past. So, we wanted to make sure management 18 understood that they had some good response from the 19 folks you had working on it, as well as Tekia with her 20 management of getting it done. Okay? So, hopefully, 21 you will pass that on.
22 I don't know that she's on the line. I 23 know she had other meetings.
24 MS. GOVAN: Member Brown, I'm back. Thank 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
135 you very much.
1 CHAIRMAN BROWN: Oh, okay. Very good.
2 Thank you, Tekia. Take care.
3 With that, I will adjourn the meeting, and 4
we'll get on with business.
5 Matt, I presume we will get on with our --
6 this is your P&P Subcommittee at o'clock, correct?
7 MEMBER SUNSERI: That is correct.
8 CHAIRMAN BROWN: Okay. And we've got a 9
separate thing to go to. So, we close this meeting 10 out, and we'll then meet you at 1:00 p.m.
11 MEMBER SUNSERI: Very good, Charlie.
12 That's correct. Thank you.
13 CHAIRMAN BROWN: Okay. Thank you all, 14 everybody.
15 Logging off. The meeting's adjourned.
16 (Whereupon, the above-entitled matter went 17 off the record at 12:40 p.m.)
18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
Draft Branch Technical Position 7-19, Revision 8 Advisory Committee on Reactor Safeguards Subcommittee Meeting NRC Staff Presentation September 8, 2020
Agenda
- Objectives
- Summary of Key Changes
- Topics within the draft BTP 7-19
- Scope of the draft BTP 7-19
- Editing and Restructuring of the BTP
- D3 Assessment
- Manual Action Means to Address Position 4 in SRM-SECY-93-087
- Justification for Not Correcting Specific Vulnerabilities
- Status and Next Steps 2
Objectives
- Present key changes made in the draft BTP 7-19, Rev.
8, in response to public comments, as well as, ACRS feedback received in June 2020
Summary of Key Changes Each section of the BTP saw refinements in light of public comments and ACRS:
- Graded approach revised to a categorization scheme
- Qualitative assessment and spurious operation guidance moved to Section 3
- Numbering for BTP sections now slightly different Edited and restructured the BTP to emphasize guidance is directed to staff reviewers Other improvements:
- Readability
- Technical content and regulatory bases
- Overall clarity of positions contained therein
- Organization 4
Topics within the draft BTP 7-19 Scope of the BTP Graded Approach Revised to a Categorization Scheme Defense-in-Depth and Diversity (D3) Assessment Means to Eliminate CCF from Further Consideration Diverse Means to Mitigate CCF Evaluation of Event Consequences for Coping with CCF Qualitative Assessment Applicability Spurious Operation Evaluation Guidance Manual Action Means to Address Position 4 in SRM-SECY 087 Justification for Not Correcting Specific Vulnerabilities 5
Scope of the draft BTP 7-19
- Included consideration of active hardware, software, and software-based logic when addressing CCF (originating from latent defects)
- Clarified the definition of latent defect
- Clarified that the design and/or analytical solutions in this BTP are applicable for latent defects in active hardware or software
- Resolved several public comments regarding the scope of the BTP
- Made conforming changes to reference latent defects with regard to CCF 6
Editing and Restructuring the BTP
- Maintained focus of the BTP as staff guidance
- Refined background section discussion:
- Failure types clarification
- Single failures and single malfunctions (out of scope)
- CCFs due to latent defects (in scope)
- Consolidated technical guidance and corresponding acceptance criteria for the D3 Assessment:
- Qualitative assessment guidance
- Spurious operation guidance 7
Editing and Restructuring of the BTP -
Refinements based on ACRS feedback
- Improved lead-in discussions in each section of the BTP
- Added discussion clarifying echelons of defense and overall defense in depth concept
- Refined the connectivity between major sections to improve logic flow and readability 8
D3 Assessment - Description
- A D3 assessment is a systematic approach an applicant uses to analyze the proposed design of a DI&C system for CCFs that can occur concurrently within a redundant design, such as within two or more independent divisions
- Consistent with SRM-SECY-93-087, a D3 assessment should be performed for all systems determined to be of higher safety significance 9
D3 Assessment - Process (previously called Graded Approach)
- D3 assessment to be based on the safety significance of the system
- Design and analytical approaches applied are based on the safety significance determination
- General focus on characteristics of the SSCs rather than categories (A1, B1, etc. and Table 2-1 removed)
- Risk insights (if available) can be an input to the safety significance determination
- Applicants do not need to base their D3 assessment based on the safety significance of the systems 10
D3 Assessment - Process(Continued)
- Clarified flexibility for SSCs in applications where a D3 Assessment is not necessary
- For lowest safety significant systems only
- Identified flexibility based on the following criteria:
- Failure does not adversely affect a safety function
- Failure would not place a plant in a condition that cannot be reasonably mitigated 11
D3 Assessment - Improvement
- Modified D3 Assessment process to include:
- Qualitative Assessment methodology
- Guidance and acceptance criteria for addressing spurious operation
- Provided more flexibility under the D3 Assessment method
- Provided better synergy with the safety significance determination process 12
D3 Assessment - Framework
- Identified means to eliminate from consideration:
CCF vulnerability to latent defects can be eliminated from further consideration by use of these design attributes: diversity, testing, NRC-approved defensive measures or qualitative assessment; or
- Identified means to prevent or mitigate the effects of CCFs:
A diverse means can be used to perform the same or different function than the safety function disabled by the postulated CCF; or
- Identified strategy to cope with CCFs by evaluating if the consequences due to CCF remain within acceptable limits; or
- A combination of the above or a different proposed solution by the licensee/applicant.
13
D3 Assessment - Means to Eliminate CCF from Further Consideration 14
- Diversity within the DI&C system or component
- Provided staff guidance to evaluate diversity within each safety division or among redundant divisions to address CCF
- Provided staff guidance to evaluate that sufficient diversity exists in the design so different portions of the system are not subject to the same CCF
- Testing to identify and eliminate latent defects
- Revised staff guidance to align with testing criteria described in IEEE Std. 7-4.3.2-2016
D3 Assessment - Means to Eliminate CCF from Further Consideration 15
- Defensive Measures:
- Defined as a type of design attribute
- Added to conceptually allow for new and innovative design techniques to be employed to address CCF
- Clarified that it must be NRC-approved to be creditable
D3 Assessment - Means to Mitigate CCF 16
- Clarified staff guidance on the evaluation of the use of diverse means to perform the same or different function as the safety function:
The types of diverse means that can be credited Guidance on the quality level for credited equipment
- Included staff guidance on the evaluation of the use of equipment outside the main control room for the performance of manual operator actions. Applies only for use of diverse means to address Position 3 in the SRM-SECY-93-087
D3 Assessment -
Coping with the Consequences of a CCF 17
- Included staff guidance to evaluate whether the facility can operate and consequences remain acceptable:
When vulnerabilities to CCF are not addressed OR When remaining (residual) CCF vulnerabilities exist
- Identified acceptance criteria to conclude that consequences of CCFs of a proposed system, or portions of a proposed system, are acceptable
D3 Assessment -
Qualitative Assessment Guidance Considered a less (technically rigorous) type of a D3 assessment for purpose of this BTP
- Qualitative assessment can only be used for low safety significance systems
- CCF removed from further consideration if found sufficiently low Defined what constitute a Qualitative Assessment
- Three factors used in the aggregate to demonstrate likelihood of failure (i.e. CCF due to latent defect) remains acceptable:
Design attributes Design quality Operating experience
- Supporting failure and consequence analysis (e.g. FMEA, FTAs, etc.)
Provided staff guidance and acceptance criteria in Section 3 of the draft BTP 7-19 18
D3 Assessment - Spurious Operation Guidance
- Provided staff guidance in Section 3 to consider spurious operation for evaluating a D3 assessment
- Clarified regulatory basis of spurious operation
- Spurious operations as a result of CCFs originating from latent defects
- Focused the staff guidance on integrated systems
- Integrated acceptance criteria into relevant subsections within the review guidance of the D3 assessment 19
Manual Action Means to Address Position 4 in SRM-SECY-93-087
- Clarified staff guidance on the use of displays and manual controls to monitor, control and actuate critical safety functions from the main control room--
necessary to address Position 4 of the SRM on SECY-93-087, Item 18
- Clarified that reviewers should accept these displays and manual controls as diverse means to address CCF (Position 3) only if they are not susceptible to the same CCF vulnerabilities 20
Justification for Not Correcting Specific Vulnerabilities
- Modified Section B.6.5 to highlight the possible use of alternative methods to not address specific CCF vulnerabilities
- Updated review guidance to specifically refer to the potential for licensees or applicants to credit other systems and manual operator actions
- Emphasized that justifications would be reviewed on a case-by-case basis only 21
Status and Next Steps
- Draft BTP 7-19, Rev. 8, is in final concurrence review
- ACRS Full Committee Meeting slated for November 2020
23 Questions
24 Acronyms ACRS Advisory Committee on Reactor Safeguards BTP Branch Technical Position CCF Common Cause Failure D3 Defense-in-Depth and Diversity DI&C Digital Instrumentation and Control IEEE Institute of Electrical and Electronics Engineers FMEA Failure Mode and Effects Analysis FTA Failure Tree Analysis OMB Office of Management and Budget RG Regulatory Guidance SECY NRC Office of the Secretary to the Commission SRM Staff Requirements Memorandum SSC Structures, Systems, and Components Std.
Standard
Background Information 25
SRM to SECY-93-087 1.
The applicant shall assess the defense-in-depth and diversity of the proposed instrumentation and control system to demonstrate that vulnerabilities to common-mode failures have adequately been addressed.
2.
In performing the assessment, the vendor or applicant shall analyze each postulated common-mode failure for each event that is evaluated in the accident analysis section of the safety analysis report (SAR) using best-estimate methods.
The vendor or applicant shall demonstrate adequate diversity within the design for each of these events.
3.
If a postulated common-mode failure could disable a safety function, then a diverse means with a documented basis that the diverse means is unlikely to be subject to the same common-mode failure, shall be required to perform either the same function or a different function. The diverse or different function may be performed by a nonsafety system if the system is of sufficient quality to perform the necessary function under the associated event conditions.
4.
A set of displays and controls located in the main control room shall be provided for manual, system-level actuation of critical safety functions and monitoring of parameters that support the safety functions. The displays and controls shall be independent and diverse from the safety computer system identified in Items 1 and 3 above.
26
SECY-18-0090 - Five Guiding Principles 1.
Applicants and licensees for Production and Utilization Facilities under 10 CFR Part 50, Domestic Licensing of Productions and Utilization Facilities or under 10 CFR Part 52, Licensees, Certifications and Approvals for Nuclear Power Plants should continue to assess and address CCFs due to software for DI&C systems and components.
2.
A defense-in-depth and diversity analysis for reactor trip systems and engineered safety features should continue to be performed to demonstrate that vulnerabilities to a CCF have been identified and adequately addressed. In performing this analysis, the vendor, applicant, or licensee should analyze each postulated CCF for each event evaluated in the accident analysis section of the safety analysis report. This defense-in-depth and diversity analysis can be either a best estimate analysis or a design-basis analysis.
3.
This analyses should also be commensurate with the safety significance of the system. An analysis may not be necessary for some low-significance I&C systems whose failure would not adversely affect a safety function or place a plant in a condition that cannot be reasonably mitigated.
27
Five Guiding Principles continued 4.
If a postulated CCF could disable a safety function, then a diverse means, with a documented basis that the diverse means is unlikely to be subject to the same CCF, should perform either the same function or a different function. The diverse or different function may be performed by either a safety or a non-safety system if the system is of sufficient quality to perform the necessary function under the associated event conditions in a reliable manner. Use of either automatic or manual actuation within an acceptable time frame is an acceptable means of diverse actuation. If the defense-in-depth and diversity analysis demonstrates that a CCF, when evaluated in the accident analysis section of the safety analysis report, can be reasonably mitigated through other means (such as with current systems), a diverse means that performs the same or a different function may not be needed.
5.
The level of technical justification needed to demonstrate that defensive measures (i.e., prevention and mitigation measures) are adequate to address potential CCFs should be commensurate with the safety significance of the DI&C system. For the systems of higher safety significance, any defensive measures credited need technical justification that demonstrates that an effective alternative to internal diversity and testability has been implemented.
28
©2020 Nuclear Energy Institute ACRS DI&C Subcommittee Meeting NEI Perspective:
Draft Revision 8 to BTP 7-19 September 8th, 2020
©2020 Nuclear Energy Institute 2 Use of risk insights from site-specific PRAs
Risk insights are not only used to demonstrate that an SSC is less safety-significant than the deterministic criteria
Previous drafts of the BTP noted that risk insights should be an input to an integrated decision-making process - this language should be added back Deterministic Criteria
It is not clear whether all (or just one) of the criteria under each of the four categories needs to be met
In category (a) (i.e., high safety-significance) the phrase significant contributors to plant safety and GDC 22 are challenging to use as criteria.
The 1st and 4th criterion in (a) should be deleted DI&C Categorization (Section 2)
©2020 Nuclear Energy Institute 3 The purpose of this section is to allow the use of an NRC-approved methodology to limit the likelihood of latent design defects and thus, limit the likelihood of a CCF.
A draft version of NEI 20-07, Guidance for Addressing Software CCF in High Safety Significant Safety Related DI&C Systems was provided to the staff for review in late August.
NEI appreciated the opportunity to develop guidance as an alternative to Diversity (3.1.1) and Testing (3.1.2) and will suggest wording changes to Section 3.1.3 to ensure there is an appropriate linkage.
We look forward to a technical and regulatory discussion with the staff in a public forum later this year.
Defensive Measures (Section 3.1.3)
©2020 Nuclear Energy Institute 4 The title and scope statement of the BTP focuses on safety systems Sections of the guidance still address non-safety systems and this inconsistency between the title/scope and review details creates confusion The only link to non-safety systems should be system integration and interconnectivity as described in Section 2.1 DI&C SSC Scope: Safety vs Non-safety
©2020 Nuclear Energy Institute 5 Recommend adding design to the term latent defects to ensure other latent defects (e.g., fabrication) are not in scope Footnote 2 refers to active hardware components but it is not clear what active means in this context.
Do FPGAs fall under this?
How is this different from software-based logic?
Recommend that the scope of latent design defects that can cause a CCF in hardware is limited to hardware that is programmed using software tools (e.g., FPGAs).
Latent Design Defects: Hardware and Software
©2020 Nuclear Energy Institute 6 Current draft provides an example of a partial actuation of an emergency core cooling system (i.e., spurious operation of a single division) with false indications stemming from postulated CCF The example is inconsistent with the evaluation guidance in NUREG/CR-6303
NUREG/CR-6303 (Section 3.6) requires concurrent failures of the same blocks in all redundant divisions, which precludes partial actuations
NUREG/CR-6303 (Section 3.8) specifies that downstream blocks are assumed to function correctly in exact response to correct or incorrect inputs they receive, which precludes false indications Spurious Operations (Section 3)
©2020 Nuclear Energy Institute 7 No mention of the phrase best estimate (various Sections)
BTP states in several places consequences of CCFs are bounded by the acceptance criteria defined in the FSAR, with no mention of best estimates or realistic assumptions Independent and Diverse (various Sections)
Add clarification on independent that isolation is not required for safety-related manual controls that are connected downstream of the digital I&C safety system outputs in the same safety division Crediting Existing Systems (Section 3.2.1) using independent sensors and actuators
The phrase using independent sensors and actuators is not consistent with 10 CFR 50.62(c)(1) through 10 CFR 50.62(c)(3)
10 CFR 50.62 should be a reference in the Regulatory Basis section Additional Items
©2020 Nuclear Energy Institute 8 BTP (page 29, 1st paragraph states), the applicant may credit some or all of these displays and manual controls to meet Position 4 as the diverse means called for under Position 3 The following paragraphs states, The applicant may credit existing displays and controls in the MCR to satisfy Position 4. However, the reviewer should confirm that the applicant did not also credit the same digital platform or analog technology for Position 1 or 3 (e.g., for mitigating DBEs) because Position 4 specifies that the MCR displays and controls shall be independent and diverse from those credited for Position 1 and 3.
System credited for Position 3 must be diverse from the digital system being replaced. Does it also have to be diverse from Position 4?
Additional Items (continued)
©2020 Nuclear Energy Institute 9 The NEI team appreciates the opportunity to share our perspective Looking forward to resolving the remaining regulatory and technical aspects of the guidance Closing Remarks