ML20274A372
| ML20274A372 | |
| Person / Time | |
|---|---|
| Issue date: | 09/08/2020 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| Antonescu, C, ACRS | |
| References | |
| NRC-1077 | |
| Download: ML20274A372 (174) | |
Text
Official Transcript of Proceedings NUCLEAR REGULATORY COMMISSION
Title:
Advisory Committee on Reactor Safeguards Digital Instrumentation and Controls Docket Number: (n/a)
Location: teleconference Date: Tuesday, September 8, 2020 Work Order No.: NRC-1077 Pages 1-135 NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers 1323 Rhode Island Avenue, N.W.
Washington, D.C. 20005 (202) 234-4433
1 1
2 3
4 DISCLAIMER 5
6 7 UNITED STATES NUCLEAR REGULATORY COMMISSIONS 8 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 9
10 11 The contents of this transcript of the 12 proceeding of the United States Nuclear Regulatory 13 Commission Advisory Committee on Reactor Safeguards, 14 as reported herein, is a record of the discussions 15 recorded at the meeting.
16 17 This transcript has not been reviewed, 18 corrected, and edited, and it may contain 19 inaccuracies.
20 21 22 23 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 www.nealrgross.com
1 1 UNITED STATES OF AMERICA 2 NUCLEAR REGULATORY COMMISSION 3 + + + + +
4 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 5 (ACRS) 6 + + + + +
7 DIGITAL INSTRUMENTATION AND CONTROLS SUBCOMMITTEE 8 + + + + +
9 TUESDAY 10 SEPTEMBER 8, 2020 11 + + + + +
12 The Subcommittee met via Video-13 Teleconference, at 9:30 a.m. EDT, Charles H. Brown, 14 Jr., Chairman, presiding.
15 16 COMMITTEE MEMBERS:
17 CHARLES H. BROWN, JR., Chairman 18 JOY L. REMPE, Vice Chairman 19 WALTER L. KIRCHNER, Member-at-large 20 DENNIS BLEY, Member 21 JOSE MARCH-LEUBA, Member 22 DAVID A. PETTI, Member 23 MATTHEW W. SUNSERI, Member 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
2 1 ACRS CONSULTANT:
2 MYRON HECHT 3
4 DESIGNATED FEDERAL OFFICIAL:
7 ALSO PRESENT:
8 ERIC BENNER, NRR 9 MARK BURZYNSKI, NewClear Day, Inc.
10 TEKIA GOVAN, NRR 11 DAWNMATHEWS KALATHIVEETIL, NRR 12 JERRY MAUCK, Public Participant 13 SCOTT MOORE, Executive Director, ACRS 14 WENDELL MORTON, NRR 15 WARREN ODESS-GILLETT, NEI 16 STEPHEN VAUGHN, NEI 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
3 1 C-O-N-T-E-N-T-S 2 Opening Remarks by Chairman 3 Charles Brown . . . . . . . . . . . . . . . . . 4 4 Introductory Remarks 5 Eric Benner . . . . . . . . . . . . . . . . . . 8 6 Updated Draft Final BTP 7-19, Revision 8 7 Wendell Morton . . . . . . . . . . . . . . . . . 10 8 NEI Comments on Draft Final BTP 7-19, Revision 8 .
9 Stephen Vaughn, NEI . . . . . . . . . . . . . 104 10 Warren Odess-Gillett, Westinghouse . . . . . . 118 11 Mark Burzynski, NewClear Day, Inc. . . . . . . 122 12 Closing Remarks by Chairman . . . . . . . . . . 135 13 14 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
4 1 P-R-O-C-E-E-D-I-N-G-S 2 9:32 a.m.
3 CHAIRMAN BROWN: This is Charles Brown, 4 the Chairman of the Digital I&C Subcommittee. It's a 5 little bit after 9:30, so we will go ahead and start, 6 and let Walt join us as he needs, as he can.
7 So anyway, this meeting will now come to 8 order. This is a meeting of the Digital 9 Instrumentation and Controls Subcommittee. I'm 10 Charles Brown, Chairman of this Subcommittee meeting.
11 ACRS members in attendance are Dennis Bley, Matt 12 Sunseri, Jose is not here, Joy Rempe, Dave Petti, Walt 13 Kirchner will join us, Myron Hecht, our consultant.
14 And I think I've covered everyone on the Committee.
15 if I've missed someone, please tell me.
16 Christina Antonescu of the ACRS staff is 17 the designated federal official for this meeting.
18 Christina, can we make sure the court 19 recorder is on, ready?
20 MS. ANTONESCU: Yes, the court reporter is 21 one.
22 CHAIRMAN BROWN: Okay. The purpose of 23 this meeting is for the staff to brief the 24 Subcommittee on the updated Draft Final Branch 25 Technical Position 7-19, Revision 8, the August 2020.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
5 1 Today we have members of the NRC staff and NEI to 2 brief the Subcommittee.
3 The ACRS was established by statute and is 4 governed by the Federal Advisory Committee Act, FACA.
5 That means the Committee can only speak through its 6 published letter reports. We hold meetings to gather 7 information to support our deliberations. Interested 8 parties who wish to provide comments can contact our 9 office requesting time.
10 That said, we've set aside 10 minutes for 11 comments from members of the public attending or 12 listening to our meetings. Written comments are also 13 welcome.
14 The meeting agenda for today's meeting was 15 published on the NRC's public meeting notice website, 16 as well as the ACRS meeting website. On the agenda 17 for this meeting and on the ACRS meeting website are 18 instructions as to how the public may participate. No 19 request for making a statement to the Subcommittee has 20 been received from the public.
21 Due to COVID-19 we are conducting today's 22 meeting virtually. A transcript of the meeting is 23 being kept and will be made available on our website.
24 Therefore, we request that participants in this 25 meeting first identify themselves and speak with NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
6 1 sufficient clarity and volume so that they can be 2 readily heard.
3 All presenters please pause from time to 4 time to allow members to ask questions. Please also 5 indicate the slide number you are on when moving to 6 the next slide.
7 We have a bridge line established for the 8 public to listen to the meeting. The public line will 9 be kept open in the listen-only mode until the time 10 for public comment. To avoid audio interference I 11 request all attendees to make sure they are muted when 12 not speaking. Based on our experience from previous 13 virtual meetings I would like to remind the speakers 14 and presenters to speak slowly.
15 We will take a short break after each 16 presentation to allow time for screen sharing as well 17 as the Chairman's discretion during longer 18 presentations.
19 We do have a short -- we will take a short 20 break -- I just lost something. Where am I? We will 21 take a short break after each presentation -- oh, I 22 already did that one. We do have a backup call-in 23 number should Skype go down and has been provided to 24 the ACRS members. If we need to go to this backup 25 number, the public line will be connected to the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
7 1 backup line.
2 Dennis, are you there?
3 MEMBER BLEY: Yes.
4 CHAIRMAN BROWN: Okay. If somehow I get 5 disconnected, would you kind of keep things on track 6 until I can get back in?
7 MEMBER BLEY: Certainly.
8 CHAIRMAN BROWN: Okay. Good. Thank you.
9 Lastly, please do not use any virtual 10 meeting feature to conduct sidebar technical 11 discussions. Rather, contact the DFO if you have any 12 technical questions so we can bring those to the 13 floor.
14 Just a schedule note: This meeting 15 extends through lunch. We will be breaking for lunch 16 at 1:00. The members have to attend another meeting 17 from 1:00 to 2:00. I will remind you at that point we 18 are going to recess. We will not log out of Skype.
19 We will leave ourselves in the meeting and just open 20 up -- for the members anyway we'll open up a second 21 session, but we will reconvene at 2:00 for the post-22 lunch break finales. I will remind everybody of this 23 when we get to that point.
24 We will now proceed with the meeting and 25 we'll ask Mr. Dawnmathews Kalathiveetil to share his NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
8 1 screen with us while Eric Benner -- did I get that 2 right, Dawnmathews?
3 MR. KALATHIVEETIL: Perfect.
4 CHAIRMAN BROWN: Okay. Thank you.
5 I will ask Eric Benner, the Director of 6 the Division of Engineering and External Hazards in 7 the Office of Nuclear Reactor Regulation for any 8 introductory remarks before we begin today's 9 presentations.
10 So, Eric, you're on.
11 MR. BENNER: Thank you, Member Brown. And 12 I most want to thank the Committee for their 13 flexibility, because as you all know we were 14 previously scheduled to have this discussion earlier 15 in the year. Because of a significant amount of 16 feedback we got from stakeholders, we -- given the 17 importance of this document for any significant 18 licensing actions that the NRC would review, we felt 19 it was important to faithfully review all that 20 feedback and make changes as appropriate. So we asked 21 for the briefing of the Subcommittee to be 22 rescheduled. We appreciate that the Subcommittee was 23 willing to entertain that rescheduling.
24 So we have a document that I think 25 visually looks a lot different than the previous NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
9 1 document, and I think part of that was to honor an 2 internal evaluation we had to reaffirm that this is 3 guidance for the staff and how the staff will conduct 4 their reviews and open the door to working with 5 industry to create maybe some companion guidance for 6 how licensees and applicants would put together their 7 application.
8 So you're going to hear from NEI today.
9 I think there are still some questions about exactly 10 how the document -- this document would be used as 11 opposed to what could potentially be contained in 12 industry guidance, whether it's generated by industry 13 or whether it be the NRC developing a regulatory guide 14 for industry.
15 So I think we've been working hard in 16 revising this document. We have not had a public 17 interaction in the interim. This is our first public 18 interaction since we've revised the document. So we 19 do intend to have a separate public interaction to 20 discuss these changes with stakeholders. We haven't 21 aligned exactly on when that will be.
22 So today we are going to focus mainly on 23 the changes we made. I think we are going to try to 24 the extent we can address some of the stakeholder 25 feedback that's going to be presented later, do that, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
10 1 but we're not at the -- ready to discuss at length how 2 we are going to have that communication with 3 stakeholders.
4 So with that I will turn it over to 5 Wendell Morton, who will be leading the presentation 6 for the staff.
7 MEMBER BLEY: Eric?
8 MR. BENNER: Yes?
9 MEMBER BLEY: This is Dennis Bley. The 10 Committee's had this for a number of weeks to look at.
11 When were the folks from the other stakeholders able 12 to get copies of it? Have they had it long?
13 MR. BENNER: No, at the same time that we 14 provided it to the Committee.
15 MEMBER BLEY: Oh, okay. So they've had a 16 fair amount of time?
17 MR. BENNER: Yes, we made it public -- I 18 mean, that's when we made it public, so that's when 19 they had access to it.
20 MEMBER BLEY: Okay.
21 MR. MORTON: Okay. Thank you, Eric.
22 Appreciate it.
23 Once again this is Wendell Morton. I am 24 the team lead for the BTP-719, Revision No. 8 project, 25 and today we'll be talking about a number of changes NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
11 1 we made inside there, but before we go any further I 2 want to thank my fellow team members, Rossnyev 3 Alvarado, David Ron, Dawnmathews, who is driving for 4 me today. Thank you for that.
5 And also want to give a special 6 appreciation for Tekia Govan, our PM, because without 7 her we wouldn't have got this far. Instead, I want to 8 thank her for her efforts involved in this project, as 9 well as the rest of the staff that contributed to this 10 effort, and all the industry stakeholders who provided 11 a lot of great input that I think have gone -- to make 12 a great difference in the improvement in this document 13 overall.
14 As I said earlier we'll be discussing the 15 latest change to the document, specifically changes 16 between the June Subcommittee meeting for ACRS and the 17 meeting we have today, and those changes obviously 18 were made as a result of our public comment resolution 19 and our own internal concurrence comments, as well as 20 the feedback that was provided by the industry.
21 I want to note that the public comment 22 file itself, which we'll be presenting in the November 23 Full Committee meeting is still in the concurrence, so 24 therefore there may be a few changes or refinements in 25 the presentation, in the document as a result of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
12 1 those. Just wanted to make a quick note of that.
2 And with that, Dawnmathews, can you go to 3 slide No. 2? So today we'll be covering obviously 4 some of the objectives we have, a summary of the key 5 changes we've made, the key top layers within the 6 document, covering some of the topics in the Draft 7 BTP, the scope of the document, the editing and 8 restructuring of the BTP, which I know a lot of folks 9 are interested in, specifically with the D3 10 assessment, with the command and controls guidance, 11 and then one -- another particular especially for the 12 justification document and the specific 13 vulnerabilities. We're going to get into a number of 14 those things in this presentation. And then lastly 15 we'll discuss the status and the next steps going 16 forward into the end of the year.
17 So if there no questions on that, 18 Dawnmathews, please go to slide No. 3.
19 So obviously our objectives is to present 20 the key changes made to the BTP and to obtain ACRS 21 Subcommittee feedback on the current draft version.
22 The Subcommittee did make a number of really good 23 comments for our consumption from the previous 24 meeting. And to the extent practicable we did 25 incorporate those comments and we will have a few NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
13 1 slides, a slide or so devoted to that point that we 2 will cover going forward into the meeting.
3 Please go to slide 4. So the summary of 4 the key changes. The biggest thing we want to say 5 here is that conceptually the BTP was revised and sort 6 of refined so that it focused more on staff guidance.
7 So a number of the sections within the BTP did see 8 some refinements or changes to sort of align along 9 those points.
10 Along those lines we did restructure 11 conceptually what the D3 assessment actually was. So 12 previously you might have seen that the graded 13 approach was actually called a graded approach. And 14 then you might have seen a D3 section. Then you might 15 have seen another separate section for the qualitative 16 assessment and then something separate for spurious 17 operation.
18 In going through -- looking at the 19 stakeholder feedback we received and going through our 20 own internal discussions we decided that in order to 21 simplify the document we really needed to warehouse 22 all those different concepts under the same umbrella 23 and just call it a D3 assessment. And we're going to 24 get into that in more detail.
25 So obviously because some of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
14 1 restructuring the numbering you're going to see inside 2 the BTP has changed a bit as well in terms of the 3 section numbers. And obviously along those lines some 4 things have been edited and restructured. Much of the 5 concepts are the same; it's just been moved around to 6 different parts or it's been refined and provided more 7 detail based on feedback we've gotten, especially from 8 ACRS in a previous meeting.
9 We believe these other improvements 10 include readability of the document obviously, the 11 technical content and overall clarity of the positions 12 contained within and its overall organization, but I 13 do want to emphasize that many of these changes were 14 the result of ensuring that the BTP itself remains 15 directed to staff and staff reviewers only. So that's 16 one of the primary drivers for a number of the changes 17 you'll see in the document, especially from the June 18 '20 meeting going forward. And we'll get into that 19 later on in the presentation for that.
20 Dawn, if you'd go to slide No. 5, please?
21 So here is just a summary of the major topic areas 22 within the BTP. Obviously we made a number -- we made 23 a few changes or refinements to the scope of the 24 document in terms of what we consider latent defects.
25 We made some changes to the overall graded approach NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
15 1 scheme. And it's now been revised, so it's no longer 2 really called a graded approach, and we'll get into 3 that later on. We've warehoused the D3 assessment a 4 bit differently to make it more holistic so that other 5 types of analyses for lower safety significant systems 6 will be generally considered another type of D3 7 assessment. We'll make that clear. We'll clarify 8 that within this presentation as well.
9 Also, the different types of means to 10 eliminate CCF consideration, diverse means, evaluation 11 of event consequence and so on and so forth. These 12 are the major topical layers we're going to cover. At 13 our end of the BTP we'll cover how those changed post 14 the June 2020 ACRS meeting.
15 So, Dawn, can you go to slide No. 6, 16 please? So now we're going to get into the scope of 17 the BTP itself. And we did receive a number of public 18 comments along the lines in terms of scope. What 19 types of failures are included within the scope of 20 consideration for this analysis? And one of the major 21 comments we had from ACRS is clarifying what the 22 definition of latent defect was, and that's exactly 23 what we did within the scope, clarifying that it 24 includes active hardware, software and software-based 25 logic when addressing the CCF. And that's really the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
16 1 whole scope and focus of the BTP. So we clarified the 2 background section of the BTP to make that very clear, 3 that that's the scope and overall goal of the analysis 4 when you're looking at CCFs due to latent defects.
5 We clarified the design and analytical 6 solutions in the BTP, essentially meaning that within 7 the concept of D3 we tried to provide maximum 8 flexibility for a staff reviewer when looking at an 9 application to see what are the potential solution 10 sets that an applicant or a licensee may provide to 11 address CCF for systems of differing safety 12 significance. And we'll get into that a little more 13 later in the presentation.
14 As part of that we resolved a number of 15 public comments regarding the scope. A number of the 16 public comments were kind of going in different 17 directions whereas one -- some commenters wanted the 18 scope to remain what it previously was, which was 19 focused strictly on software. Other commenters 20 thought that the scope should expand to where we have 21 currently decided to be. So within our discussion we 22 decided that ensuring that we cover all the bases with 23 CCF is more beneficial both towards our future state 24 determinations as well as the technical adequacy of 25 the content that's being provided within the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
17 1 applications and license amendment requests. And 2 obviously we made some conforming changes within the 3 entire document along those lines to ensure there's 4 consistency in those considerations.
5 So if there's no other questions on that, 6 Dawn, can you go to slide No. 7?
7 So editing and restructuring the BTP. As 8 we stated earlier one of the main drivers of some of 9 the changes the public and ACRS members may have seen 10 from the June version of the document were in order to 11 ensure that the staff -- this remains staff guidance 12 essentially, that its main focus was that. So some 13 content was either revised or moved due to that 14 because it presented as industry-specific guidance, 15 something that's more akin to a Reg Guide or an ISG, 16 whereas a BTP is under a different consideration.
17 It's under a different set of I would say controls and 18 rules, and we tried to ensure that the changes made 19 really focus that this guidance was directed towards 20 staff.
21 So therefore we tried to walk the fine 22 line between making sure that obviously our industry 23 stakeholders do use this document in terms of guidance 24 for addressing CCF, and we understand that, but we 25 also had to walk the fine line between that and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
18 1 ensuring that this remains staff guidance. We believe 2 we have achieved a fairly good balance between those 3 two considerations, but we're still open to hearing 4 feedback on that point. But that's the real main 5 driver for a lot of edits and restructure of the 6 document itself.
7 CHAIRMAN BROWN: Eric?
8 MR. MORTON: Part of the --
9 CHAIRMAN BROWN: Oh, I'm sorry. I thought 10 you were finished with the slide. Go ahead and finish 11 with the slide.
12 MR. MORTON: Sure. And just as you see in 13 the slide some of the refinements we made due to 14 those, to industry comments and then our own internal 15 discussions were really bringing a closer resolution 16 to the different types of (audio interference). We've 17 heard different comments about that, such as what are 18 you doing when it comes to CCF versus single failures 19 and they have propagating or cascading effects? So as 20 part of the refinement to the document we clarified 21 what failures of consideration are within the scope 22 and what failures are not within the scope? And now 23 if you can see our primary goal for the document is 24 not considering single failures, single malfunctions 25 or their effects. It is CCF due to latent defects is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
19 1 the main scope.
2 And obviously one of the bigger changes --
3 actually two of the bigger changes we've made is to 4 incorporate the previous qualitative assessment 5 section and the previous spurious operation guidance 6 into the overall D3 assessment as considerations to 7 do. And we'll get into that in more detail when we 8 get to those individual sections.
9 Member Brown, you had a question?
10 CHAIRMAN BROWN: Yes, going back and 11 reviewing four different versions of this from Rev. 7 12 to the November Subcommittee meeting version to the 13 June Subcommittee meeting version to the first 14 version --
15 MR. MORTON: Yes, sir.
16 CHAIRMAN BROWN: -- of the one for this 17 meeting, which was then revised to become the fifth 18 version.
19 MR. MORTON: Yes.
20 CHAIRMAN BROWN: Or some -- I might be off 21 by a version or two.
22 MR. MORTON: That's fine.
23 CHAIRMAN BROWN: Going from earlier 24 versions, if you go back even to Rev. 5 vice Rev. 6 --
25 MR. MORTON: Yes.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
20 1 CHAIRMAN BROWN: -- there were numerous --
2 numerous -- by numerous, that's my definition --
3 MR. MORTON: Yes.
4 CHAIRMAN BROWN: -- examples for the 5 reviewer of some of the concepts --
6 MR. MORTON: Yes.
7 CHAIRMAN BROWN: -- relative to things 8 such as manual actuation should be downstream of the 9 last set of components that could actually be impacted 10 by CCF.
11 MR. MORTON: Yes.
12 CHAIRMAN BROWN: The other one would be 13 the 30-minute type stuff on manual operations relative 14 to time of time available and time required. All of 15 that was fundamentally -- virtually all examples for 16 the reviewer have been deleted. You reference -- I'll 17 finish.
18 MR. MORTON: Yes.
19 CHAIRMAN BROWN: You do reference 20 documents such as Reg Guide 1.62 --
21 MR. MORTON: Yes.
22 CHAIRMAN BROWN: -- which is the Manual 23 Operation Reg Guide. You do reference NUREG-6303, 24 which goes through the diversity and 25 defense-in-depth --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
21 1 MR. MORTON: Yes.
2 CHAIRMAN BROWN: -- I think the six types 3 that you refer to, and they cover -- and then you talk 4 also from -- the time manual action is SRP Chapter 18, 5 Appendix A.
6 MR. MORTON: Yes.
7 CHAIRMAN BROWN: Just one of my basic 8 concerns -- I understand -- this is my opinion or 9 my --
10 MR. MORTON: Yes.
11 CHAIRMAN BROWN: -- thought of why you did 12 it. You eliminate duplication when you refer back to 13 the other documents.
14 MR. MORTON: That's correct. Yes.
15 CHAIRMAN BROWN: That's both a good side 16 and a bad side.
17 MR. MORTON: Yes.
18 CHAIRMAN BROWN: There's a downside to 19 that. Based on all the interactions we've had, a lot 20 of the interactions we've had in the past, you --
21 staff -- the document doesn't much stand on its own.
22 It really has got a lot of different tendrils back 23 into a whole lot of other documents, which are fairly 24 voluminous in some cases, for people to be familiar 25 with. And in this day and age it would seem to me the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
22 1 experience level of the reviewers in many cases 2 they've not done any of this before. They're not 3 familiar with all the stuff that people have tossed 4 around in terms of how we do things and the 5 fundamental bases for things.
6 Did you all think at all about that in 7 terms of how much you deleted?
8 MR. MORTON: Yes, so we actually had a lot 9 of conversations about that, Member Brown, in terms of 10 -- and actually I think you made the case for the last 11 few sentences. You said in terms of why we did remove 12 certain content.
13 No. 1, as you did say, there's tendrils, 14 there's pointers to various different portions of 15 other staff guidance, whether it's Reg Guide 1.162 or 16 SRP Section 18 for a human factors aspect of it.
17 One of the things that you did say is that 18 there's a voluminous amount of material in those two 19 examples of guidance. And the amount of information 20 that would actually make useful to put in the BTP 21 would sort of defeat the purpose of even having those 22 guidance, so it's better to have a reference to them 23 rather than putting a small tidbit of information from 24 them so that the user can understand that if you're 25 looking at point 3 and point 4 of the SRM SECY 93087 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
23 1 ensuring how you meet that guidance.
2 Pointing to the Reg Guide 1.162 -- excuse 3 me, 1.62 rather than having a small subset did reduce 4 some of the duplication of information that can be 5 readily found within the Reg Guide itself. Rather 6 than having a specific subsection it only has a 7 partial amount of the content. It really wouldn't do 8 it justice for a staff reviewer looking at that. So 9 you kind of actually made the case for why we've done 10 that.
11 Also in consideration of readability and 12 usability of the document for both staff and industry 13 we're trying to keep the document to a -- let's just 14 say reasonable length, but if we did incorporate a lot 15 of those other pointers to information, it would make 16 the document much more voluminous than it needs to be, 17 as you stated earlier.
18 MR. BENNER: And, Member Brown, if I may 19 add; this is Eric Benner, we -- there's a general 20 attempt by staff to streamline some of this guidance 21 and then use maybe other -- one is to make sure the 22 guidance interfaces appropriately, and that's the use 23 of pointers.
24 Regarding things like examples, we're 25 considering things like using other tools like NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
24 1 Nucleapedia and figuring out the best way to keep 2 capturing a lot of the knowledge management aspect.
3 So we -- we're -- the door is still open on how we're 4 going to do that. I will say that the people who are 5 going to first use the BTP for the first reviews are 6 going to be very familiar with all those supporting 7 documents. So it's not like we're going to throw a 8 new reviewer the BTP and say here, license on major 9 modifications.
10 So there's acknowledgement that for the 11 first ones we definitely need the experience people, 12 the people who have been involved in the revision to 13 the BTP. And then there's definite knowledge 14 management work to do within the staff as we get 15 through those first reviews to make sure that all the 16 reviewers understand all the ins and outs of the BTP 17 and the linkages to other guidance documents.
18 MEMBER BLEY: Eric, this is Dennis Bley.
19 Just to follow up on Charlie's question, I'm kind of 20 in the middle on this, and I think back to 10 or 12 21 years ago when we ran into a case, a special one on 22 manual human actions human actions where some of the 23 people involved at this point weren't aware of some of 24 the other work that had provided better guidance, if 25 you will, or more thorough guidance in this area.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
25 1 One thing that might help; have you guys 2 thought about doing it, if instead of just the long 3 list of references you put some kind of graphic map to 4 put in here to help the newer reviewers see what these 5 linkages are and real briefly what's in each place, 6 where you get examples of one kind of problem or 7 another?
8 CHAIRMAN BROWN: I'm going to -- I want to 9 echo Dennis' comment a little bit. You do reference 10 -- you don't depend on the list of references to get 11 this. You do reference Reg Guide 1.62, 63.03 --
12 MR. BENNER: Yes.
13 CHAIRMAN BROWN: -- SRP Chapter 18, 14 Appendix A in the text where you're discussing these 15 particular forms. There's a few inconsistencies that 16 you've now built in with this, because if you look at 17 1.62, there's a specific sentence in 1.62 that says 18 guidance provided in BTP 7-19 asserts that manual 19 controls should be connected downstream of the plant's 20 digital safety systems. In other words, it uses the 21 basis for 1.62 as being in 7-19. So that's missing.
22 I'm not falling over myself dying about that. It's 23 just we built -- it's almost like 7-19 was the 24 originator and then somehow it flowed into 1.62.
25 But Dennis is right from the standpoint NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
26 1 that if there is a way to clarify within the BTP the 2 relevant other documents so that they don't have to 3 worry about looking at that list in front, 4 particularly if there's more than one that applied to 5 a particular area.
6 I think -- Dennis, did I capture your 7 thought?
8 (No audible response.)
9 CHAIRMAN BROWN: Are you there?
10 MEMBER BLEY: You had a different take on 11 it, but yes, we're talking about the same thing.
12 CHAIRMAN BROWN: All right. Okay. So I 13 didn't want to undercut because I -- you -- if you're 14 familiar, if you're experienced and you've done a lot 15 -- a number of these, then your brain is already 16 thinking like that. I just -- it's the aspect of I 17 know that there -- we all -- all organizations go 18 through a case where you have to rebuild and you don't 19 want to rebuild in entirety. You want to have a 20 gradual turnover of knowledge, if you want to call it 21 that. And that's difficult to do. I faced that for 22 22 years in NR, in naval reactors.
23 So anyway, that's why I -- I just wanted 24 to make sure I understood your thought process, if it 25 was somewhat in line with mine. I do not have any NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
27 1 comments on that. I will have a couple of real basic 2 comments to roast you all on at the end of the 3 meeting, but I did not want to interfere with the 4 process of getting through this, because I think 5 there's a couple of points that are ripe for 6 discussion at the end of the meeting, but I --
7 literally I want to flow through what you all did.
8 I do want to give one positive comment; 9 you think we never do that, but after the four -- I 10 don't know how many rounds of versions on Rev. 8 have 11 been now. I put aside all the rest of them in the 12 beginning. Rev. 7, I put the first three versions of 13 Rev. 8 -- and I took the August version. I just sat 14 down and read it. Then I think Tekia and her staff 15 did a very good job of reorganizing and bringing --
16 instead of having various types of these issues 17 scattered, they were consolidated into discrete 18 sections. It read much smoother, much smoother than 19 the Rev. 7. I went back and read that again, as 20 painful as it was.
21 So that's a bit of a compliment. I 22 shouldn't maybe do that because you won't like the end 23 of the meeting comments.
24 MR. MORTON: We'll take what we can get, 25 Member Brown.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
28 1 CHAIRMAN BROWN: Pardon?
2 MR. MORTON: We'll take what we can get, 3 Member Brown.
4 CHAIRMAN BROWN: Yes, I know, but I just 5 -- at some point -- because this is a very, very 6 difficult task, and I thought the reorganization and 7 the reruns -- in spite of the pain and agony that 8 you've had to go through, I think the end -- it did 9 read much smoother. The various ways to deal with 10 defense-in-depth and diversity were not scattered in 11 terms of their context.
12 MR. MORTON: Yes.
13 CHAIRMAN BROWN: They were more compact in 14 one or two particular sections. So that was a 15 positive side. I'll let you get on with the rest of 16 the slide here and then --
17 MR. MORTON: Yes.
18 CHAIRMAN BROWN: to the next -- reset of 19 the slides. So thank you for your response.
20 MR. MORTON: Yes, no problem. And that 21 was definitely one of our goals is to make sure the --
22 all relevant information to a specific topic was 23 contained where it should be to improve overall 24 readability so you didn't have things scattered.
25 Because we noticed that about Rev. 7 and previous NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
29 1 revs, that things are kind of all over the place. So 2 making sure things were in their right silo for 3 readability for both the staff review and for the 4 folks in industry who may be using it was one of our 5 goals.
6 I would also note that one nuance in terms 7 of content, that we kind of noticed this with the 8 manual operator action guidance, is that sometimes 9 things change within the referred-upon guidance 10 document. So sometimes when you have too much 11 information quoted from a particular document, 12 document changes, it also affects the BTP. And I 13 think you just gave an example of that, Reg. Guide 14 1.62. So that's another reason why we have had to 15 reduce the amount of footprint of other documents from 16 the guidance structure into the BTP because of that 17 point.
18 CHAIRMAN BROWN: Well, I was just trying 19 to make the point that the 1.62 kind of made 7-19 the 20 basis for why the downstream. Now you all have 21 reversed that. I don't have any problem with that.
22 It's just now 1.62 makes an assertion that is no 23 longer true because you don't even -- downstream is 24 not even mentioned in the BTP.
25 MR. MORTON: Yes.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
30 1 CHAIRMAN BROWN: It's strictly a reference 2 to 1.62.
3 MR. MORTON: Yes.
4 CHAIRMAN BROWN: So I mean, it's going to 5 be what it is.
6 The other -- I guess the other thing that 7 I felt when I read through it, the reorganization and 8 the deletion of certain types of information really 9 put it more on a -- it's more ethereal and abstract in 10 many cases. There's no direct connection to equipment 11 in some ways, which when you remove examples of what 12 is acceptable --
13 MR. MORTON: Yes.
14 CHAIRMAN BROWN: -- you lose context with 15 the high-level thought process. That's all. It's 16 just something we're going to have to deal with.
17 MR. MORTON: Okay.
18 CHAIRMAN BROWN: All right. Go ahead.
19 I'm sorry. I just had to get my two cents worth in.
20 MR. MORTON: Not a problem, Member Brown.
21 If there's no other questions on this 22 slide -- we'll get into the D3 assessment piece later 23 on.
24 But if there's no questions, Dawnmathews, 25 please go to slide No. 8.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
31 1 And as discussed earlier, these are some 2 of the major changes we've made based upon previous 3 ACRS feedback. This is going back to the November 4 Subcommittee meeting and the June Subcommittee 5 meeting. I know Member Brown had a couple concerns in 6 terms of removal of content. And as you stated 7 earlier, a lot of that was driven by making sure that 8 the document itself remain focused and directed 9 towards staff with refinements and improvements in the 10 content flow and structure of the document and in 11 terms of the lead-in discussions we did with each 12 major section of the BTP so that we actually provided 13 a better lead-in for the content itself so that it was 14 understandable to the reader, whomever that may be, 15 what we're actually trying to accomplish with that 16 particular section of guidance.
17 Another major point that we discussed in 18 the previous meetings is just the basic understanding 19 of the overall concept of defense-in-depth and the 20 echelons of defense that comprise that. So we did 21 have a larger section of that previously, but due to 22 the changes we made it did get reduced down to more of 23 a clarified and refined portion where we basically 24 said the overall goal is to maintain defense-in-depth 25 for the plant.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
32 1 And there's the basic four echelons of 2 defense-in-depth which we define within the BTP still, 3 just maybe not in the level of detail that was 4 previously. We really refined it towards what was 5 necessary for our basic understanding of that, and we 6 provided references to the NUREG-6303, which provides 7 more granularity in those particular concepts.
8 So this kind of illustrates what we were 9 talking about with the previous slide in terms of 10 redefining the content without having extraneous 11 detail that necessarily didn't actually add to it, but 12 may have gotten in the way of getting -- making a 13 crisp understanding of the reading when you get to 14 that particular section.
15 And also when we say -- for the last 16 bullet, refine the connectivity between the major 17 sections, you have Sections 2, 3, 4, 5 and 6 now. And 18 as Member Brown had referred to earlier, Rev. 7 was 19 kind of all over the place when it came to sections.
20 There were multiple different sections about spurious 21 operation and things like that. So we made sure that 22 if there are jump-off points or lead-in points or 23 connections between some areas -- we tried to make 24 them as clear as possible so that the reader 25 understands where you should be going, whether the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
33 1 document to accomplish -- trying to accomplish, 2 whether you're looking at a different aspect of a D3 3 assessment, a particular methodology or if you're 4 looking at how to -- what information you need to 5 provide in the application. We tried to make sure 6 that all those particular connections were clear and 7 crisp so there was no ambiguity for -- which you need 8 to do when you're reading through the documents.
9 CHAIRMAN BROWN: I will -- this is me 10 again. I will be addressing your echelons issue as 11 part of my discussion at the end of the meeting, just 12 to give you a heads up.
13 The lead-in discussions were -- it was 14 obvious you took into account the comments we made in 15 the last couple of meetings, and I think that improved 16 it. I hope you all thought it improved it. I thought 17 it did.
18 MR. MORTON: We did. Actually we did.
19 CHAIRMAN BROWN: Your comment about 20 spurious actuations and stuff, that was kind of 21 sprinkled in a couple of the different areas. There's 22 not a -- there is one area on spurious, but then it's 23 -- the use of the word spurious is tossed in a few 24 other places. I feel it's appropriate, so I didn't 25 say anything about -- I wasn't going to say anything NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
34 1 about that other than making the observation that some 2 of the comments we made back in 2011 when we reviewed 3 Rev. 6 --
4 MR. MORTON: Yes.
5 CHAIRMAN BROWN: -- which were 6 incorporated in responses from the EDO. Those are 7 gone and you now are just referencing the base 8 documents, 6303 and et cetera, or the other type 9 documents for those issues. So that was a pretty big 10 change. So you did lose the comments and stuff we --
11 that you all added in response to our recommendations 12 from 2011, if you can believe I actually found it. I 13 was surprised as well.
14 All right. Go ahead. I'm sorry.
15 MR. MORTON: Yes, Member Brown, just to 16 sort of touch on that point, we did take a hard look 17 at those previous comments from the 2011 letter and we 18 did look at -- we did take really hard into account 19 all the feedback that we provided from the November 20 Subcommittee meeting from last year in this meeting.
21 There were some things we were able to maintain 22 because they did align with the refinement of the 23 document to make sure it's directed towards staff.
24 There were other things a bit more 25 challenging to maintain, so what we tried to do is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
35 1 maintain the basic abstract content that was in there 2 such as the definition of the defense-in-depth and 3 some of the basic concepts of it without getting into 4 a lot of the extra detail that really exists within 5 for example NUREG-6303. And that's kind of the basic 6 way we went about it is for documents that we do 7 reference, we get into more of the basic aspects of it 8 as it pertains to addressing CCF due to latent 9 defects. And any other further discussions we simply 10 provide the pointer that you can get that in a better 11 source, in extra source material itself.
12 CHAIRMAN BROWN: Okay. Well, I'm going to 13 give you a heads up for the end then because in both 14 the November meeting --
15 MR. MORTON: Yes.
16 CHAIRMAN BROWN: -- and the June meeting 17 I brought up the issue of architecture as being kind 18 of the overall framework for defense-in-depth.
19 MR. MORTON: Yes.
20 CHAIRMAN BROWN: And the word architecture 21 is not even mentioned in the new BTP other than maybe 22 it's for a control system architecture. That was 23 about the only one, one listing of it.
24 And I think the biggest point that I think 25 we missed in this version of the BTP is -- and you do NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
36 1 list what you call from 6303 the normal echelons of 2 defense: reactor control, reactor trip, SFAS and the 3 monitoring and indication systems as individual 4 echelons of defense. That's in the background.
5 MR. MORTON: Yes.
6 CHAIRMAN BROWN: But the basic overall 7 thought process of how you develop a defense-in-depth, 8 this reminds me of my first introductions to how the 9 staff was reviewing the I&C systems, trip systems and 10 SFAS systems for new -- some of the new applications 11 where it was piecemealed. They were fundamentally 12 taking IEEE standards and Reg Guides, reviewing the 13 positions and saying if you meet the position, then 14 everything is fine, but you didn't know what the CAR 15 (phonetic) looked like.
16 MR. MORTON: Okay.
17 CHAIRMAN BROWN: And you will find me 18 addressing this in exquisite excruciating painful 19 detail at the end of the meeting, because I think we 20 lost a -- we didn't lose. We haven't really stressed 21 how architecture and echelons of defense go together 22 as a starting point. And so I'll bring that up at the 23 end, but I'm a firm believer in the echelons of 24 defense approach, the separation of church and state, 25 the independence of the major safety systems, and both NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
37 1 of those issues are just like a stake in my heart if 2 they're not addressed properly. So -- or in my own 3 mind properly.
4 MR. MORTON: So, Member Brown, if I 5 understand your comment, then you don't believe that 6 there is enough emphasis on the defense-in-depth 7 concept with --
8 (Simultaneous speaking.)
9 CHAIRMAN BROWN: The basic concept -- it 10 ought to be up in the background. And I'll give you 11 all kinds of words on it at the end, and then you'll 12 obviously be able to do with it what you want.
13 MR. MORTON: Okay.
14 CHAIRMAN BROWN: But I think that really 15 helps put in perspective what are we trying to 16 accomplish? What is the reviewer trying to maintain 17 and make sure he has? And I think that's lost right 18 now. Some of it got lost when we eliminated some of 19 the -- what I would call the little fine points, but 20 they weren't in part of the big picture. They were 21 little tidbits. And those of us who have been 22 involved in it for decades understand what the tidbits 23 meant, but now we -- I think you've done a good job 24 with the rest of the document, but that background on 25 what we're trying to accomplish is -- can stand some NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
38 1 real basic improvement which I'll provide some detail 2 on at the end.
3 MR. MORTON: Okay. We appreciate the 4 comment then. Thank you.
5 CHAIRMAN BROWN: Okay. Thank you.
6 MEMBER KIRCHNER: Charlie, this is Walt 7 Kirchner.
8 CHAIRMAN BROWN: Yes.
9 MEMBER KIRCHNER: Could I just -- I just 10 observed something, and that is with regard to this 11 defense-in-depth concept the late Ms. Drouin had done, 12 from the staff, quite a bit of work in this area in 13 documenting it in a -- I think it was a Knowledge 14 Management Report where she laid out seven principles 15 of defense-in-depth. And I'm just curious as whether 16 the staff working on this referred to that work that 17 was done by their colleagues.
18 MR. MORTON: I'm sorry. I didn't catch 19 who you were referring to. I guess I might got a 20 little bit of static. I didn't catch who you were 21 referring to on the staff.
22 MEMBER KIRCHNER: She passed away last 23 year. Dennis probably can help me. Drouin I think is 24 -- was her name.
25 MEMBER REMPE: It was Mary Drouin.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
39 1 MEMBER KIRCHNER: Yes. And she put 2 together a defense-in-depth package as part of the 3 knowledge management effort and laid out --
4 (Simultaneous speaking.)
5 MEMBER BLEY: -- Knowledge Management 6 NUREG.
7 CHAIRMAN BROWN: What was that, Dennis?
8 MEMBER BLEY: It was a Knowledge 9 Management NUREG. It was one of the first ones of 10 those to get published.
11 MEMBER KIRCHNER: Yes, that's it. Thank 12 you, Dennis. Yes.
13 MR. MORTON: Yes.
14 MEMBER KIRCHNER: And it had a nice 15 structure for what was meant by defense-in-depth and 16 laid out -- and I'm just curious to the extent that 17 that's used across the staff as a -- kind of an 18 accepted way of approaching defense-in-depth, or does 19 each branch of the staff come up with its own 20 definition of what defense-in-depth means?
21 MR. MORTON: I wouldn't say that we come 22 up with different definitions of defense-in-depth. We 23 generally focus on -- within NUREG-6303 and NUREG-24 7007.
25 What I can tell you is we can take an NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
40 1 action to follow up on that point to see what she had 2 -- what she put together for that and --
3 (Simultaneous speaking.)
4 MEMBER KIRCHNER: Well, Charlie's 5 observations just made me think of that and that might 6 be a useful introductory passage, something that 7 Charlie was -- Member Brown was pointing out. Thank 8 you.
9 CHAIRMAN BROWN: Walt, that was my 10 intention with what I have put together for discussion 11 at the end after you all have completed it.
12 Unfortunately I didn't get it -- I'll have to read it 13 to you and then let you throw darts at it. I just 14 finished drafting it at 1:00 this morning, so --
15 MR. MORTON: Oh, well, we appreciate the 16 defense-in-depth data. Thank you.
17 CHAIRMAN BROWN: So I mean but that is the 18 point. The real point to this whole BTP is defense-19 in-depth, period.
20 MR. MORTON: Yes.
21 CHAIRMAN BROWN: I mean put aside all the 22 discussion of latent and this -- non-latent and this, 23 that and everything else.
24 MR. MORTON: Yes.
25 CHAIRMAN BROWN: It's really defense-in-NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
41 1 depth against -- on an overall basis and how do we 2 structure that? And that's the point I'm trying to 3 get. And how that gets integrated with the Knowledge 4 Management NUREG, it's another story, but it just --
5 I think that point doesn't get carried out as well in 6 the background as it should, particularly with digital 7 I&C systems, which are so focused and their backbone 8 is literally the architecture within which they 9 reside. So -- and the principles within -- with how 10 they reside within that.
11 MR. MORTON: Yes.
12 CHAIRMAN BROWN: As well as communications 13 and control of access, which you've heard me say 14 before.
15 MR. MORTON: Yes.
16 CHAIRMAN BROWN: So anyway, we digress.
17 Walt, did you have anything else?
18 MEMBER KIRCHNER: No, thank you, Charlie.
19 CHAIRMAN BROWN: Okay. Thank you.
20 MEMBER BLEY: The reference for the 21 document Walt was talking about is NUREG-KM-0009.
22 MR. MORTON: NUREG-KM-0009. Okay.
23 Okay. Thank you for that reference and 24 for that comment, but just a couple points just as a 25 follow up: This is a Branch Technical Position, not NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
42 1 necessarily a Design Guide, so there's a level of 2 detail that we're not necessarily able to get into in 3 terms of covering all the bases in terms of the 4 architectural aspects, but I understand. Charlie's 5 point taken in that regard.
6 MEMBER BLEY; I'll just make -- I don't --
7 the architecture thought process that I'm talking 8 about is not detail detail.
9 MR. MORTON: Yes.
10 MEMBER BLEY: It's an overarching 11 architecture concept, not design detail.
12 MR. MORTON: Okay. Understood.
13 MEMBER BLEY: So I agree with you this is 14 -- we're not doing design details in this document.
15 MR. MORTON: Yes.
16 MEMBER BLEY: But the defense-in-depth, 17 when you look at -- if you don't know what the 18 architecture looks like, you might -- you're dealing 19 with it piecemeal. How do I deal with this component 20 or this --
21 MR. MORTON: Yes.
22 MEMBER BLEY: -- or the software or what 23 have you? That is a piece part. And maybe it doesn't 24 even matter if your architecture is constructed right.
25 MR. MORTON: Okay.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
43 1 MEMBER BLEY: That's all. It's a high-2 level architecture, not down in the nitty-gritty as 3 you will see when I read it to you.
4 MR. MORTON: All right. Sounds good. So 5 we'll -- I guess we can get to those comments after we 6 get through the presentation then.
7 MEMBER BLEY: Okay. And I will provide my 8 comments to you subsequent to the meeting. Christiana 9 will send them to you.
10 MR. MORTON: All right. We appreciate 11 that. Thank you, Member Bley.
12 MEMBER BLEY: Okay?
13 MR. MORTON: With that said if there's no 14 other questions on slide 8, Dawnmathews, please go to 15 slide No. 9.
16 So as we've been kind of alluding to 17 earlier, here is the basic description of the D3 18 assessment. And sort of tapping off the last slide's 19 conversation, we do give a general overview of the 20 defense-in-depth concept in the background section, 21 and overall the goal would be to maintain defense-in-22 depth with whatever modified system you're installing 23 into the plant or modifying itself. But we do cover 24 the entire concept of D3, which is defense-in-depth 25 and diversity, as a concept to ensure that looking at NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
44 1 CCF is potentially concurrent with other events in 2 your safety analysis, ensuring you have the proper 3 design aspects in place or analytical solutions in 4 place. And obviously this is consistent with what's 5 in the SRM, the SECY 93087. So this is just a basic 6 description of what's inside this.
7 Although we do focus on defense-in-depth 8 as the overall concept, we do have to make a note that 9 the document really focuses overall on defense-in-10 depth and diversity where it is required or whether it 11 could be used as a tool to ensure you have adequate 12 defense-in-depth. Obviously will get into that later 13 in the rest of the slide presentation.
14 So, Dawn, please go to slide No. 10. So 15 the D3 assessment, the process itself. This is where 16 we're going to kind of get into how the document has 17 conceptually changed in order to make it a bit more 18 readable and more coherent.
19 So previously we had a section called 20 Section -- we still have Section 2. It was previously 21 called the graded approach. After our own internal 22 discussions and after some of the public feedback we 23 got from the comments we decided that rather than 24 having it sort of be like a separate concept outside 25 the D3 assessment it really simply becomes a process NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
45 1 within a D3 assessment itself.
2 Rather than calling it a graded approach 3 we're simply saying it's a safety significance 4 determination essentially within the D3 assessment, 5 which basically in effect will get you to the same 6 place. We're just sort of warehousing it a bit 7 differently to make it a more organized and coherent 8 approach, essentially where you have a D3 assessment, 9 you have different analytical solutions that you may 10 take for systems of differing safety significance.
11 And you determine that by the safety significance 12 determination within Section 2 to the current draft 13 version right now.
14 So that effectively means that rather than 15 having specific categories like we had previously, 16 which is A1, B1, et cetera, et cetera, those are 17 generally being removed in favor of focusing on the 18 actual characteristics of the system itself and then 19 determining what level of analysis is appropriate for 20 that particular system's characteristics and safety 21 significance to the plant itself.
22 So what you'll see inside the document now 23 is table 2-1, which had those determination sort of 24 characteristics have been removed and the 25 categorizations have been moved, but the basic NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
46 1 functions and characteristics for those systems to 2 make a significance determination is still there and 3 they incorporate the public comments and feedback we 4 received from the various stakeholders and also 5 incorporate what we had from our own internal 6 discussions as well. And we wanted to make that very 7 clear.
8 The general approach is very similar.
9 We've just -- we're warehousing it a bit differently 10 to make it overall part of the D3 assessment. So it's 11 not like a separate process, sort of the way it was 12 depicted in the previous version that you saw at the 13 June ACRS meeting.
14 One of the things we did was we also 15 refined some of the guidance when it comes to applying 16 potential risk insights to inform your significance 17 determination within the D3 assessment so that if you 18 had a particular SSC that you thought might be highly 19 safety significant or lower safety significant, then 20 the risk insights could be used as a means to sort of 21 tip the scale one way or another depending upon how a 22 particular application decides to warehouse that 23 system.
24 And we want to be clear: The approach 25 we're talking about here is how -- for the staff NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
47 1 reviewer to look at how a licensee or applicant is 2 presenting a particular SSC for addressing CCF due to 3 latent defects in the analysis or design solutions 4 they choose to address CCF for that particular SSC in 5 the application. Risk insights can be used to inform 6 that decision or to put sort of the -- or to make the 7 decision or bring more clarification to the decision 8 itself.
9 And lastly, what we want to really 10 emphasize here is that the applicants do not need to 11 base their D3 assessment on the safety significant 12 systems. They can simply include everything in an 13 overall D3 assessment for like a high safety 14 significant system. You don't have to do that if you 15 don't want to. This is something that we're providing 16 the flexibility for applicants or licensees to use if 17 they so choose to, but you don't necessarily have to.
18 We want to make that point clear, and I think we made 19 that point in the June meeting as well.
20 And also just want to be clear that the 21 risk insights piece, user risk insights is not a 22 requirement. It's not mandatory. They're only there 23 if available and if the licensee or applicant chooses 24 to use them for a determination, for the safety 25 significance determination.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
48 1 MR. HECHT: This is Myron Hecht. Can I 2 ask a question?
3 MR. MORTON: Yes, sir. Please.
4 MR. HECHT: Thank you. Given that you 5 have removed the categories does this open the door 6 for less uniformity and interpretation among different 7 reviewers? In other words, if they -- a reviewer used 8 to look at a system as A1 or A2, does this now open 9 the door to say, well, what I used to think was A2 I'm 10 now going to think of as A1, or a reviewer -- a then 11 reviewer said it's O2 and that it -- that needs to be 12 A2 and another reviewer says it's now A1?
13 MR. MORTON: That's a great question, and 14 thank you for asking that.
15 So one of the things that we talked about 16 earlier is where we're actually making sure that the 17 staff -- that guidance is aligned to be staff 18 guidance. That's sort of one of the things that was 19 sort of hit by that consideration. So then rather 20 than focusing on categories, designate A1, for 21 example, the A1 concept is still there, just not 22 called A1. It's referred to as highly safety 23 significant systems, safety-related systems that 24 perform safety significant functions.
25 So rather than focusing on the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
49 1 categorization, we simply focused on well, what is the 2 particular SSC doing? What is the safety significance 3 and how is its potential failure or spurious operation 4 going to affect plant safety? So it's part of our 5 refinement to go to make sure that everything remained 6 within the auspices of staff guidance. That was one 7 of the things that was sort of affected by that.
8 MEMBER BLEY: Can you hear me? I've had 9 trouble getting attention. This is Dennis Bley.
10 MR. MORTON: Yes.
11 MEMBER BLEY: Okay. I still have a 12 problem with your logic.
13 MR. MORTON: Yes.
14 MEMBER BLEY: You're now in the Safety 15 Significant Section 2.1.
16 MR. MORTON: Yes.
17 MEMBER BLEY: A Category B, bravo, low 18 safety significance, non-safety-related SSCs that 19 perform safety significant functions. And your first 20 bullet under there says these perform design functions 21 that are significant contributors to plant safety.
22 MR. MORTON: Yes.
23 MEMBER BLEY: It's your logic to then call 24 them low safety significance. I don't understand this 25 category.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
50 1 MR. MORTON: Well, just to be clear -- so 2 for that category we're -- because they were talking 3 about non-safety-related SSCs, we necessarily can't 4 call them safety significant per se, but in some non-5 safety-related systems they can for example directly 6 affect reactivity or power level.
7 So, insofar as they are not safety 8 significant, they're not safety-related, but their 9 potential failure can affect plant safety because 10 systems such as feedwater, reactor recirc, or your 11 non-safety-related rod control systems, these systems' 12 failure or malfunction can directly affect reactivity 13 and therefore affect safety. So they're safety 14 significant functions or contributors even though 15 they're not safety-related. Therefore the designator 16 low safety significant.
17 MEMBER BLEY: I don't get it. I think 18 we've tied ourselves in logical knots to try to imply 19 there's something more meaningful that's safety-20 related than there is. If these things really affect 21 safety, then they either should be safety-related or 22 we ought to get rid of that arbitrary designation.
23 And they are important to safety, but you're treating 24 them as if they're not. And so I -- it just a logical 25 hole.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
51 1 MR. MORTON: We understand the comment.
2 We'll take that into consideration.
3 MEMBER BLEY: And the only reason we treat 4 them differently is because they don't have that 5 label, and that makes no sense at all to me in terms 6 of engineering and safety thinking.
7 MR. MORTON: Well, I would say that we 8 treat them differently because they are under 9 different regulatory requirements. For example, if 10 you're looking at that particular system which would 11 have been called a B1 category previously, those are 12 non-safety-related systems that perform safety 13 significant functions. Obviously those sorts of 14 systems would not be Class 1E. Those systems would 15 not necessarily have independence or single failure 16 requirements on them. Some of them may have a 17 diversity requirement upon them depending upon which 18 GDC is applied to it.
19 So therefore, the first thing that really 20 calls out the differences between the systems is if 21 regulatory structure that applies to them or not.
22 Some systems such as your highly safety significant 23 system, like your protection system would be affected 24 by a different set of GDCs than those that are non-25 safety-related and so on and so forth. So that's the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
52 1 first driver for --
2 (Simultaneous speaking.)
3 MEMBER BLEY: -- to respond to this, but 4 the logical hole you fall into just doesn't work for 5 me.
6 MR. MORTON: Understood. We can take that 7 comment into consideration as we move forward looking 8 -- continuing in our efforts to refine the document.
9 But there is a licensing aspect to -- there is a 10 difference in the treatment. It's not arbitrary. It 11 is really principally driven by the difference in 12 requirements on the different systems that we're going 13 to -- that a licensee reviewer will be looking at when 14 they do a safety significance determination. Not the 15 staff. It would be the licensee performing that 16 action. And then based upon their licensing basis 17 they would make the safety significance determination.
18 MEMBER BLEY: Putting it --
19 MR. MORTON: We're simply using the -- I'm 20 sorry. Go ahead.
21 MEMBER BLEY: Putting it in those terms 22 that this is a legal -- this is a legalistic 23 classification rather than an engineering and safety 24 classification would really help and it would point 25 out some interesting problems with the way we build NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
53 1 these structures.
2 MR. MORTON: We can take -- certainly take 3 a look at improving maybe the lead-in for that if 4 that's not clear because there's aspects of both.
5 They're not quite -- the legalistic and the 6 engineering aspects are not quite the same, but we can 7 take a look to see if that needs to be clarified 8 within that section for that point. So thank you for 9 that comment.
10 And if we have no other comments, we can 11 move onto slide No. 11, Dawnmathews.
12 And also I want to make a note that with 13 regard to slide 10 -- if you can go back to that real 14 quick, Dawnmathews? Slide No. 10.
15 For those individual categories we still 16 have the opportunity to potentially adjust the names 17 of those categories as well. That's not something 18 necessarily set in stone at this time, as Eric sort of 19 alluded to earlier. We're still -- there's still 20 flexibility there. Those categories are not 21 necessarily clear. Just wanted to make that point.
22 And now you can -- I'll speak about slide 23 No. 11. And so now going back into the D3 assessment 24 process, continue to clarify the flexibility for SSCs 25 in cases where D3 assessment is not necessary. So NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
54 1 this is sort of referring to that fourth category or 2 another type of category where it's the lowest safety 3 significant systems only.
4 So if a system has -- its failure has no 5 effect on the plant safety functions at all and a 6 failure wouldn't place the plant in a condition that 7 cannot be reasonably mitigated would place a plant in 8 -- will be placed in an un-analyzed condition. There 9 is a potential there for systems such as that where 10 you may not need to provide a D3 assessment insofar as 11 NUREG-6303 thermal-hydraulic analysis or even a 12 qualitative assessment.
13 A simple failure analysis like an FMEA or 14 a FTA or something may be acceptable depending upon 15 whether the application contains a system -- it makes 16 the case that the system has such little safety 17 significance that a basic evaluation of the failure 18 effects and consequences of the failure of an SSC may 19 be sufficient without going into any other details for 20 that.
21 So we did place guidance and flexibility 22 within the safety significance determination for when 23 an applicant provides that to the staff for review.
24 There may be systems of such low consequences in terms 25 of the effects on the plant that a D3 assessment may NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
55 1 not be necessary. So we clarified that point also 2 within the BTP for this latest draft as well.
3 So if there's no questions, Dawnmathews, 4 please go to slide 12.
5 So other aspects of improvements we made 6 for the D3 assessment. So as I alluded to earlier, 7 the previous draft that you saw in June sort of had 8 different silos for different types of analysis that 9 weren't necessarily considered D3. And as we went 10 through the document and had our own internal 11 discussions and we looked at our public comments 12 received, it was decided that maybe there are certain 13 things we need to bring into the overall D3 umbrella.
14 So the first thing we just talked about 15 was the safety significant determination which we made 16 a part of the D3 assessment process itself.
17 The next piece that we made a part of the 18 D3 assessment process overall is the qualitative 19 assessment methodology. And for those of you 20 unfamiliar, the qualitative assessment is defined in 21 RIS 2002-22, Supplement 1, and it is a methodology to 22 address CCF in systems of lower safety significance.
23 We decided that rather than having that be 24 as a separate process we simply said, no, this is kind 25 of a less-rigorous form of a D3, because ultimately NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
56 1 you're addressing CCF in a slightly rigorous way for 2 lower safety significant systems. And that seemed to 3 be appropriate. So we brought that into the D3 4 umbrella. So now the qualitative assessment for 5 purposes of this BTP is considered a form of less-6 rigorous D3 assessment. So I just want to really make 7 that clear.
8 Secondly, for spurious operation, for 9 those of you have seen the previous drafts, we had 10 that -- the staff had spurious operation as a separate 11 section within the PTP. I think the previous section 12 was Section 5. It was for spurious operation. We had 13 a separate set of background and discussion and then 14 acceptance criteria.
15 And so similarly to the other improvements 16 and refinements we've made, we reconsidered how we had 17 to structure the document based on the public 18 feedback, and ACRS feedback as well, as well as our 19 own internal discussions, and we decided that spurious 20 operation is something the staff finds is necessary to 21 address when you're looking at CCF due to latent 22 defects. So we're only concerned spurious operations 23 as they are originating from latent defect CCFs. If 24 the general design solutions end up being sort of the 25 same thing, then it makes sense to have the spurious NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
57 1 operation guides incorporated within the D3 assessment 2 itself as another consideration. And that's what 3 we've done.
4 So the basic discussion for spurious 5 operation is within Section 3 of the document now and 6 the acceptance criteria for the relevant sections 7 within different methodologies incorporate pointers 8 about spurious operation consideration as well. So 9 that section, Section 5 no longer exists. It's been 10 integrated within the D3 assessment section, Section 11 3 of the document.
12 So those are some of the bigger changes we 13 made within the document since the June 2020 ACRS 14 Subcommittee meeting.
15 These changes brought more flexibility for 16 the D3 assessment because it makes the assessment 17 clear that there are different levels of technical 18 rigor and different types of analysis that you can use 19 as a licensee or applicant to address CCF and it makes 20 it clear as well as to the staff that there are 21 different means by which a licensee can provide a 22 less-technically rigorous methodology to address a 23 less-safety -- lower safety significant system. So it 24 brings more alignment and flexibility for the method, 25 for the D3 assessment itself and it provides better NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
58 1 synergy with the safety significant determination that 2 we now incorporated within the D3 assessment itself.
3 As we talked about in the previous slide 4 you have your basic four categories that we're calling 5 -- we have the higher safety significant and the lower 6 safety significant. And these changes align with that 7 concept with the safety significance determinations.
8 MEMBER BLEY: If I may interrupt again --
9 MR. MORTON: Yes, sir.
10 MEMBER BLEY: -- since I made my last 11 comment I'd like to say this reorganization really is 12 a nice logical one and I think it makes a lot of 13 sense. Thank you.
14 MR. MORTON: Thanks for the comment.
15 Appreciate that. That was sort of the goal is that 16 treating them separately in retrospect was not the 17 optimal approach to go about the D3 assessment. And 18 so bringing everything under the one umbrella makes it 19 much more clear and makes a much more crisp document 20 for whomever is reading the document for their 21 particular purposes.
22 So are there any other questions on this 23 slide?
24 CHAIRMAN BROWN: Yes, I have one question 25 on this --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
59 1 MR. MORTON: Yes, sir.
2 CHAIRMAN BROWN: -- on the qualitative 3 assessment.
4 MR. MORTON: Yes.
5 CHAIRMAN BROWN: And I may have this 6 backwards, so I'm open to correction on this. This is 7 not an opinion.
8 You've got high safety significant safety-9 related SSCs.
10 MR. MORTON: Yes.
11 CHAIRMAN BROWN: Low safety significance 12 non-safety-related SSCs that perform safety 13 significant functions.
14 MR. MORTON: Yes.
15 CHAIRMAN BROWN: C is low safety 16 significant safety-related SSCs --
17 MR. MORTON: Yes.
18 CHAIRMAN BROWN: -- that do not perform 19 safety-related functions.
20 MR. MORTON: Yes.
21 CHAIRMAN BROWN: And then the lowest of 22 the low is the low safety significance non-safety-23 related SSCs --
24 MR. MORTON: Yes.
25 CHAIRMAN BROWN: -- that do not perform NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
60 1 safety significant functions. For the qualitative 2 assessment --
3 MR. MORTON: Yes.
4 CHAIRMAN BROWN: -- somehow it got wrapped 5 into my brain --
6 MR. MORTON: Yes.
7 CHAIRMAN BROWN: -- that it only applied 8 to the lowest of the low. That would have been --
9 MR. MORTON: Yes.
10 CHAIRMAN BROWN: -- the low safety 11 significance non-safety-related SSCs that do not 12 perform safety significant functions.
13 MR. MORTON: Yes.
14 CHAIRMAN BROWN: Is that -- that's the way 15 I read the document, yet in the discussion part of 16 this; and I'm trying to find it again, that may be 17 based on the discussion you just had --
18 MR. MORTON: Yes.
19 CHAIRMAN BROWN: -- was that the RIS 2002 20 Supplement -- or 22 Supplement 1, Qualitative 21 assessment, would -- there's three categories of low 22 safety significance.
23 MR. MORTON: Yes.
24 CHAIRMAN BROWN: B, C and D.
25 MR. MORTON: Yes.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
61 1 CHAIRMAN BROWN: I interpreted that -- all 2 your write-up in here, it would only apply to D. Is 3 that correct or wrong?
4 MR. MORTON: That would be incorrect.
5 CHAIRMAN BROWN: Okay. So it's all three 6 of the low safety significance categories, just not A?
7 MR. MORTON: That's correct. So if you --
8 CHAIRMAN BROWN: All right.
9 MR. MORTON: Okay.
10 CHAIRMAN BROWN: Go ahead. Go ahead.
11 Finish off and maybe you'll refresh my brain for a 12 second.
13 MR. MORTON: Oh, so the quick refresher on 14 the RIS. So the RIS -- Supplement 1 to RIS 2002-22 is 15 guidance for lower safety significant systems, 16 essentially everything outside the logic portions of 17 -- basically it's everything except outside RPS and 18 DSF, direct safety functions.
19 CHAIRMAN BROWN: Okay.
20 MR. MORTON: So that means your safety-21 related safety chillers, your feedwater systems, 22 reactor recirc, non-safety-related rod control. It 23 could even be either RPS inverters depending upon how 24 you categorize your system, but it is for lower safety 25 significant functions, not just for the lowest of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
62 1 low. So it's for -- as you correctly point, it's for 2 those three categories outside of the high safety 3 significant category that we have. So it's for those 4 lower three categories --
5 CHAIRMAN BROWN: Okay.
6 MR. MORTON: -- not just for the lowest 7 safety significant category.
8 CHAIRMAN BROWN: Okay. That's one of the 9 problems with being more generic in all these 10 discussions.
11 MR. MORTON: Yes.
12 CHAIRMAN BROWN: Without talking about RTS 13 and SFAS explicitly we start muddying the waters a 14 little bit. But I got it now. Okay?
15 MR. MORTON: Okay.
16 CHAIRMAN BROWN: Is there a point -- is 17 there a place where that's very, very clear in the 18 document?
19 MR. MORTON: The qualitative assessment 20 section, which I think is 3.1.4; staff, please correct 21 me if I'm wrong --
22 CHAIRMAN BROWN: Which you refer to.
23 MR. MORTON: Yes, it should -- we do have 24 the lead-in paragraphs -- at least we thought we were 25 being clear that it applies to lower safety NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
63 1 significant systems.
2 CHAIRMAN BROWN: You're right.
3 MR. MORTON: Yes.
4 CHAIRMAN BROWN: You're right. I just 5 found the page. It talks only for low safety 6 significant systems. It doesn't say the other non-7 safety -- et cetera, et cetera.
8 MR. MORTON: Yes, I see that.
9 CHAIRMAN BROWN: So, all right. I got it.
10 It's very clear in 3.1.4. Thank you.
11 MR. MORTON: Okay. No problem. So 12 there's no other questions?
13 Dawnmathews, please go to slide No. 13, 14 please.
15 And in this slide we basically summarize 16 the D3 assessment, the framework itself. So we gave 17 you the description of the D3 assessment. We've kind 18 of talked about how other things have been 19 consolidated into the D3 assessment overall umbrella.
20 And you kind of see it kind to fruition here in this 21 slide with the basic framework. And I know there's 22 kind of a lot on the slide, so I won't necessarily go 23 through each and every bullet. But suffice it to say 24 you have a number of different means to attack CCF due 25 to latent defects within the BTP. And the staff NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
64 1 wanted to make it very clear for our reviewers and for 2 stakeholder. The intention was to provide a lot of 3 flexibility to attack CCF due to latent defects.
4 There's obviously the individual design 5 solutions. We have specific diversity testing, 6 defensive measures that are approved. And we got --
7 qualitative assessment is one means to eliminate 8 further consideration of CCF. Then you look at the 9 ability to prevent or mitigate the effects of the 10 postulated CCF. And then you get into the diverse 11 means that can be used from a safety-related functions 12 so it's not disabled.
13 Then you get into the potential to cope 14 with the CCF by simply demonstrating through analysis 15 that A, we're simply postulating the CCF. We didn't 16 necessarily do a specific design solution for it, but 17 we verified through our analysis that, hey, we can 18 accept the consequences of the CCF, the plant can 19 still operate safely in its presence.
20 And you can use, for the fourth bullet, 21 any combination of the above, or a different solution 22 set that could be proposed by a licensee or applicant.
23 You are not bound to do the D3 assessment framework as 24 defined in the BTP. Just want to be very clear, it is 25 not a requirement. This is guidance for the staff.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
65 1 It can be used by stakeholders. Stakeholder, 2 licensees, applicants can use a completely different 3 solution to address CCF due to latent defects if you 4 so choose. It is your purview to do that. Just want 5 to make that clear. You can have the ability to do an 6 alternative approach for that. But this is just the 7 basic D3 assessment framework within the document 8 right now.
9 It hasn't necessarily changed. We just 10 refined it to include a few more things to make the D3 11 umbrella more complete.
12 I don't hear any questions, so, 13 Dawnmathews please go to slide No. 14.
14 As I alluded to earlier, means to 15 eliminate CCF from further consideration. Has not 16 necessarily changed a lot since the last meeting we've 17 had in terms of the basic content. The biggest change 18 we'll get into that later on is really the inclusion 19 of the quench survivability, but this is sort of a 20 refresher for folks of what this particular section --
21 sub-section provides under the D3 assessment.
22 Here is where we would get more into 23 conversations that Member Brown is referring to in 24 terms of specific architectural solutions that may be 25 involved, whether you're providing specific sort of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
66 1 extensive testing to eliminate latent defects or 2 you're providing diversity within the architecture 3 within divisions of our protections, for example, or 4 you have different design solutions entirely, or 5 you're potentially using a qualitative assessment for 6 you lower safety significant systems. This is where 7 you get into the potential flexibilities for that.
8 So this particular section received some 9 refinements due to public comments, especially for the 10 testing portion. We did align the aspect to go with 11 the actual 7432 2016 framework. We don't necessarily 12 quote it per se. We did make some minor changes to 13 align with the greater efforts going on within the BTP 14 itself.
15 So if there's no questions, Dawnmathews, 16 please go to slide No. 15.
17 And here is another concept that we had 18 that we had from the June meeting. It largely remains 19 unchanged. It's providing licensees and applicants 20 the flexibility to propose their specific design 21 measures. It was defined as the particular design 22 attributes. We wanted to provide flexibility and keep 23 the door open for the circumstance where a licensee or 24 applicant provides a specific innovative design 25 solution that we haven't necessarily endorsed, but we NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
67 1 are not opposed to actually reviewing it within the 2 application itself.
3 So this is the general point here. There 4 are different types of examples of design measures, 5 but we just simply classify them as another type of 6 design attribute for proposed system architecture or 7 system -- or SSC. So this is mainly to provide 8 flexibility for different design solutions to actually 9 address CCF due to latent defects.
10 So, Dawnmathews, please go to slide No.
11 16. And now you get into the other part of the D3 12 assessment framework which is providing flexibility to 13 mitigate the consequences or the effects of the CCF.
14 And we clarify the guidance in a number of places due 15 to the public comments we received. And we got some 16 great insights from the public comments as well as 17 from ACRS.
18 Clarify the different types of -- meet 19 diversities that can be credited whether it's existing 20 systems or manual controls, or some combination 21 thereof.
22 And we also clarified within the document 23 the concept of -- because there's obviously been a bit 24 of I would say concern between point 3 and point 4 of 25 the SRP and how you are crediting different controls NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
68 1 to meet either of those particular provisions, because 2 they do incorporate the ability to credit manual 3 controls to meet either one of those. So we clarified 4 the appropriateness of how to do that properly within 5 your applications as well.
6 MEMBER KIRCHNER: So when you -- Wendell, 7 this is Walt Kirchner. When you use manual operations 8 as a means to mitigate, do you also then open the door 9 to look at human error? If you credit a manual 10 operation, there's the chance that there could be an 11 error in the operation.
12 MR. MORTON: And you're saying error in 13 terms of the plant procedure that may do it or just 14 the aspect of the operator making a mistake when 15 they're trying to mitigate a particular circumstance 16 diversely?
17 MEMBER KIRCHNER: Both.
18 MR. MORTON: Both? We don't necessarily 19 get into that.
20 MEMBER KIRCHNER: Either/or. I mean if 21 you have -- if you're relying on a manual operation to 22 mitigate CCF, then it opens the door also to the 23 possibility of that manual operation including an 24 error.
25 CHAIRMAN BROWN: Turning the wrong switch.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
69 1 MEMBER KIRCHNER: Yes, or --
2 CHAIRMAN BROWN: If your adjacent -- it's 3 happened before.
4 MR. MORTON: Well, I would say to that --
5 there's a couple things: No. 1, we don't necessarily 6 get into that level of detail here in the BTP. That's 7 one of the things that would be covered within the 8 evaluation analysis in Chapter 18 of the SRP, that the 9 manual actions have to be both feasible and reliable.
10 And much of that's going to be controlled by the plant 11 procedures when this information is developed.
12 It's not necessarily something that we 13 would get into in terms of an error in the 14 implementation of the manual actions. That would be 15 something handled mostly by plant procedure. The 16 guidance for that for the staff reviewer and for 17 licensees and applicants would be in Chapter 18. We 18 simply ensure that you follow the appropriate guidance 19 when you're actually trying to address those three 20 positions. So we understand the point, but that's 21 something that would need to be evaluated within your 22 HFE evaluation under Chapter 18 of the SRP.
23 MEMBER KIRCHNER: Well, I'll just refer 24 you back to that knowledge management document. One 25 of the points that Mary made in that -- she had seven NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
70 1 points on looking at licensing basis changes and 2 preserving defense-in-depth. And I think it was the 3 sixth one, provide sufficient defense against human 4 errors.
5 MR. MORTON: Yes.
6 MEMBER KIRCHNER: And so if you're 7 crediting this to mitigate CCF, you --
8 MR. MORTON: Yes.
9 MEMBER KIRCHNER: That's why I raised the 10 point that you also have to consider human error.
11 MR. MORTON: Right. And that is correct, 12 but we wouldn't necessarily -- we are presuming that 13 when you're crediting your manual actions, you're 14 crediting the operator manual actions that it needs to 15 be performed in a feasible and reliable manner, which 16 we put -- which we have within the acceptance criteria 17 for that particular sub-section within the SRP, the 18 reliability piece being what you're referring to, but 19 that really needs to really be evaluated through the 20 much more detailed guidance which would be in Chapter 21 18 of the SRP.
22 That's obviously a concern that the person 23 who is implementing the diverse manual controls 24 implements them correctly, but the nuts and bolts of 25 getting them implemented correctly would be in Chapter NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
71 1 18 of the SRP.
2 CHAIRMAN BROWN: Just as an amplification 3 for Walt's comment, Chapter 18, Appendix A of the SRP 4 does require you to analyze action sequences for the 5 potential -- of a potential operator error in 6 performing that manual action. So it's -- you got to 7 search around for it, but it is in there.
8 I'm just providing that to you for 9 information, Walt.
10 MEMBER KIRCHNER: No. Thanks, Charlie.
11 I was just thinking that if you -- if the staff did an 12 evaluation and they did credit a manual operation to 13 mitigate CCF, some notation of something I think would 14 be part of the review I guess that would flag this as 15 something that would have to be looked at in Chapter 16 18.
17 CHAIRMAN BROWN: And it does. It talks 18 about one of the things leading to the possibility of 19 the operator error is the time required versus the 20 time available --
21 MEMBER KIRCHNER: Right.
22 CHAIRMAN BROWN: -- and what's a 23 reasonable time to do that. And they do talk about 24 the old 30-minute concept that if you depend on 25 somebody to do something within a minute-and-a-half, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
72 1 there's a higher likelihood that you might make the 2 wrong decision as opposed to if you have a little bit 3 longer to think about it. So they do cover it.
4 That's all I'm -- I'm just pointing out it is done.
5 It's just it's not in the BTP itself. That's all.
6 MR. MORTON: Yes, one of the nuts and 7 bolts ways this would take place if you have an 8 application from a licensee and they decide to credit 9 certain manual controls, operator actions as their 10 diverse means, then they would necessarily have to 11 have an evaluation or an analysis aligned with the 12 guidance in Chapter 18 of the SRP.
13 At that point not only would you be 14 involving the I&C staff, obviously because this is a 15 D3 assessment, wouldn't you be bringing in our friends 16 in HFE, our staff members in HFE to review that part 17 of the application as well? So it would be both. But 18 they couldn't fully credit any manual operator actions 19 until they've actually been approved to so, and that 20 would bring in both the Chapter 18 analysis and our 21 friends in HFE to review it to ensure that this is an 22 approved means to do it and therefore they could 23 credit it as part of their -- of a diverse action 24 under the BTP.
25 MEMBER MARCH-LEUBA: This is Jose March-NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
73 1 Leuba. I'm back online. What I think Walt was trying 2 to get at is that those operator actions feed in 3 Chapter 19 on the PRA so that they create new 4 sequences or whatever (audio interference) holds that 5 can change the PRA outputs. So is there a link that 6 says whenever you rely on operators doing something --
7 recognizing the problem and doing something about it, 8 that should feed into the PRA and create -- the PRA 9 expert should tell you how likely is that to happen.
10 MR. MORTON: I apologize. Was that a --
11 so is it a question or a statement? I just want to be 12 clear.
13 MEMBER MARCH-LEUBA: It was more of a 14 statement. Do you agree? But now comes the question:
15 Do you agree with my statement?
16 MR. MORTON: I would say that as part of 17 the application, depending upon what they're doing, 18 the PRA analysis will be included. We don't get into 19 that level of detail because it's a bit of a different 20 animal that we're dealing with.
21 If that's something that the licensee or 22 applicant would necessarily feed into as they're going 23 through meeting the SRP section, then that would kind 24 of naturally take place, but not necessarily --
25 wouldn't necessarily be the scope of work we're having NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
74 1 here. We're only concerned with is it -- if they do 2 credit certain diverse means to accomplish the safety 3 function, specifically if it's an operator action, 4 that they have applied the proper evaluation and 5 content within the application for that purpose. That 6 would necessarily bring in obviously Chapter 18, but 7 if there's a nexus between Chapter 19 in that regard, 8 that would be part of the overall application as well.
9 MEMBER MARCH-LEUBA: Yes, see my point is 10 we are doing risk-informed everything.
11 MR. MORTON: Yes.
12 MEMBER MARCH-LEUBA: If you -- the risk is 13 not properly calculated because we forget to introduce 14 these steps, then we're not doing it right.
15 MR. MORTON: Yes.
16 MEMBER MARCH-LEUBA: Clearly if you rely 17 on the operator recognizing the problem during a 18 stressful time in the control room and doing the right 19 thing, which I give them credit to -- I mean, they'll 20 do the right thing -- you should evaluate if it's a 10 21 to the minus-4 (audio interference) because the life 22 for the Chapter 19 guys is very difficult, because 23 they have not know everything. Okay? And it would be 24 easy if we had times that gives them homework. Hey, 25 I found a sequence for you. Make sure you evaluate NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
75 1 it. That's my opinion. And there's no question 2 (audio interference).
3 MR. MORTON: Understood. Thank you for 4 that feedback.
5 So if there's no other questions on this 6 slide, Dawnmathews, you can go to slide 17.
7 So here we have another aspect of the D3 8 assessment umbrella which is coding with the 9 consequence to the CCF. And this is pretty 10 straightforward. This is a licensee or applicant 11 providing analysis or an evaluation that demonstrates 12 that regardless of whatever design features and/or 13 defensive measures and/or assessments you perform, we 14 can simply demonstrate that the plant's basic 15 architecture and systems can withstand a CCF 16 concurrent with an event in Chapter 15. So we're 17 basically saying its consequences remain acceptable.
18 We can basically stand -- we can withstand it. We 19 don't need to do any further analysis. Just saying 20 you can cope with the consequences of that.
21 We did make a few minor tweaks and 22 corrections inside this particular section based upon 23 our own internal discussions and public comments, but 24 this is pretty straightforward. This is a coping 25 analysis essentially that demonstrates that you can NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
76 1 cope with the consequences of a CCF.
2 Dawnmathews, please go to slide No. 18.
3 And now for this slide we have the newest member of 4 the D3 umbrella, which is the assessment -- is the 5 qualitative assessment guidance itself. And we've 6 talked about this sort of at length already so I won't 7 necessarily go into a lot of detail, but basically the 8 qualitative assessment concept is for those lower 9 safety significant systems. Reaching a sufficiently 10 low determination is tantamount to saying that the 11 potential for a CCF due to latent defects is at the 12 level of other CCFs not analyzed your licensing basis.
13 It effectively constitutes saying you can remove it 14 from further consideration for lower safety 15 significant systems only, not for high safety 16 significant systems like RPS and ESF. It's just for 17 the lower safety significant stuff.
18 Based on the public comments we received 19 and some of the feedback we had from ACRS we did 20 refine the lead-in information for the qualitative 21 assessment. We did refine the approach inside to make 22 it clear that for purposes of this BTP not only doing 23 the qualitative assessment, but you need some sort of 24 supporting failure or consequence analysis that 25 demonstrates that if you did have a failure to the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
77 1 proposed system, that its consequences at least are 2 addressed to some degree. It's not the same thing as 3 a coping analysis per se, but your basic rudimentary 4 FME or FTE or something to that extent that shows 5 that, hey, you've also did the potential failure 6 effects on the plant and the particular SSC as well.
7 And as we said earlier, this was 8 integrated into Section 3 of the BTP, which is the D3 9 section. It was previously I believe Section 4 in the 10 June draft, but because of our internal discussions 11 and public comment feedback we received it was decided 12 to integrate this into the D3 assessment as a less-13 rigorous form of a D3 analysis. And this is something 14 that we got flexibility from by reading SECY 1890, 15 which said for lower safety significant systems you 16 don't necessarily have to do a super rigorous D3 17 assessment of that. So that gave us sort of the basis 18 for saying, oh, hey, why don't we just integrate this 19 into the D3 assessment and make it a less-rigorous 20 form of it?
21 And so if there's no other questions, 22 Dawnmathews, please go to slide 19.
23 Okay. So with the D3 assessment, Spurious 24 Operation guidance, we kind of got into this a lot 25 already, so I won't necessarily belabor a lot of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
78 1 details of this. But spurious operation is one 2 potential consequence of a CCF due to latent defects 3 as well as a loss of function. Because it's a 4 parallel consideration for the potential consequences 5 of a CCF it was decided that rather than having a 6 separate section for spurious operation within the 7 BTP, why not just integrate it within the D3 8 assessment itself as simply another technical 9 consideration that should be looked at by the staff 10 reviewer and by default something that should be 11 considered by the applicant or licensee when they 12 provide something to the staff for review 13 So no longer separate define -- it's going 14 to be integrated within the D3 assessment itself. So 15 we clarified what the expectations were for the 16 spurious operation when you're performing a D3 17 assessment regardless of the level of technical rigor 18 for it.
19 Obviously there's been a lot of interest 20 in this particular aspect of the BTP based upon 21 previously public meetings we've had, previous staff 22 comments we've gotten internally on the subject 23 matter, as well as previous industry formal comments, 24 and as well previous meetings we've had with the ACRS.
25 There's been a lot of interest on that. And we've to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
79 1 the best of our ability within the confines of making 2 sure this is staff guidance we incorporated all of 3 that feedback. But obviously there's always room for 4 improvement for things of that nature because it has 5 been sort of a highly energized discussion we've had 6 with that. But it was decided overall to integrate it 7 within the D3 assessment to make its own 8 consideration.
9 The designs and analytical solutions end 10 up being parallel if not the same for the 11 consideration of loss of function, so why not take 12 advantage of that integrated within the D3 assessment 13 itself? And that's what the staff has done.
14 So I'm hearing no questions on that, so, 15 Dawnmathews, please go to slide No. 20.
16 So right here we have the manual action 17 means to address position 4. So just as a quick 18 aside --
19 CHAIRMAN BROWN: Wendell?
20 MR. MORTON: Yes, sir?
21 CHAIRMAN BROWN: Something has just been 22 grinding away since we -- can we backtrack to slide 17 23 for a second?
24 MR. MORTON: Dawnmathews, please go to 25 slide 17. Okay.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
80 1 MEMBER BROWN: The document talks about 2 coping when vulnerabilities to CCF are not addressed.
3 In other words, something is found. I didn't see a 4 lot that gives a lot of -- maybe I just didn't 5 understand how somebody could demonstrate -- is it 6 strictly an analysis thing to say, hey, look, the CCF 7 occurred, but we don't violate SAFDLs or temperatures, 8 or et cetera? Is that the thrust?
9 MR. MORTON: If I understand your 10 question, Member Brown, so when we're looking at this 11 particular subsection, we have this sort of "or" 12 statement. We're only saying this from the 13 circumstance that you've got a potential vulnerability 14 that was not addressed for some reason. You didn't 15 specifically put a particular design attribute; you 16 don't have station diversity, whatever that may happen 17 to be. Or you tell them to do testing. You simply 18 have a residual CCF vulnerability that has not been 19 addressed in one form or fashion.
20 All this section is really saying is that, 21 within the concept of D3 assessment and best estimate 22 methodology, you simply can demonstrate that, within 23 the acceptance criteria that you have for your 24 particular design, the consequence would remain 25 acceptable if you're postulating a CCF for that NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
81 1 system. You demonstrate through analysis only.
2 MEMBER BROWN: In other words, if the 3 system fails, it doesn't do what it's supposed to do, 4 the plant is okay?
5 MR. MORTON: Yes, that's correct.
6 MEMBER BROWN: Or the core is okay?
7 MR. MORTON: Yes. Or, as we say, the 8 consequences remain acceptable, whatever that happens 9 to be for the particular plant.
10 MEMBER BROWN: Okay. Yes, I understand, 11 you know, talking about SAFDLs.
12 MR. MORTON: Yes.
13 MEMBER BROWN: I can't even remember what 14 the acronym means, except people throw it around like 15 candy at a child's party all the time.
16 (Laughter.)
17 MEMBER BROWN: Peak central temperatures, 18 overpowers, if you can accept the peaks that come, 19 then it would be said, "That's okay." That's what you 20 mean?
21 MR. MORTON: That's correct, yes.
22 MEMBER BROWN: Okay. I just wanted to 23 make sure. That's what I got out of it. I just 24 wanted to make sure I understand that, and I just 25 couldn't frame it as we went through that slide.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
82 1 Okay. Thank you.
2 MR. MORTON: Okay. Thank you.
3 And we tried to make that clear within the 4 lead-in subsection for that, which I think is 3.1.3, 5 off the top of my head. Staff, please correct me, if 6 I'm wrong on that.
7 Oh, 3.3? Thank you. I appreciate it.
8 So, it's 3.3 of the BTP, is that 9 subsection for the coping analysis for CCF.
10 MEMBER BROWN: Yes, I remember your 11 talking about it. I'm just trying to frame it in the 12 most simplistic terms I can.
13 MR. MORTON: Understood. Thank you, 14 Member Brown. I appreciate it.
15 MEMBER BROWN: Yes. Go on. Thank you.
16 MR. MORTON: All right. So, I think we 17 were on slide No. 20, Dawnmathews. Thank you. You're 18 already ahead of me. I appreciate that.
19 Really, I would say the biggest 20 consideration that we have here is there were public 21 comments requesting clarification on the potential for 22 crediting controls either for point 4 to point 3, or 23 vice versa, of crediting manual operator actions 24 credited for point 3 to point 4. Those particular 25 positions do have different legal requirements on NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
83 1 them.
2 And to clarify within the guidance what 3 you could do in terms of crediting manual controls for 4 either position and juxtaposing those two, if an 5 application shows up at the staff's doorstep where a 6 licensee is choosing to credit, for example, the 7 manual system controls for position 3 to meet point 4, 8 position 4, we clarified those aspects within the BTP.
9 Also, that's the biggest improvement that was made or 10 clarification that we attempted to make within that 11 section, because position 4 is a unique animal 12 compared to the other three positions in the 13 SECY-93-087.
14 MEMBER BROWN: Yes, I have another 15 question on this.
16 MR. MORTON: Yes?
17 MEMBER BROWN: Make sure I get this 18 phrased properly. I have a different thought. I 19 mean, my thought process on manual controls that 20 control critical safety functions. A large number of 21 the systems put into place are being utilized today.
22 They use touch screens. Touch screens are not as 23 positive as switches.
24 Is there any basis for not addressing the 25 functionality of touch screens in terms of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
84 1 operation actually happened? I say that based on a 2 comment that I received from a friend who almost -- he 3 had a brand-new car. He was trying to change the 4 station on his radio. As opposed to his old car which 5 you punched the little button and it changed, this was 6 a touch screen that he had to scroll and touch. He 7 took his eyes off the road and almost killed himself.
8 MR. MORTON: Aw, okay.
9 MEMBER BROWN: I'm always paranoid about 10 touch screens where you've got to create, you've got 11 to control something. You have to touch it, go to a 12 menu, select the next thing, and then, punch something 13 else that says, "Go." As opposed to, if you've got a 14 critical safety function, you want to turn one switch 15 and it actuates. So, that concept is not, the 16 timeliness or the ability for positive control is not 17 identified anywhere in here.
18 I understand position 4. I read that and 19 I don't disagree with it. Okay? It's just here is an 20 application of technology where you don't want to 21 address detailed technology, but you want positive 22 controls for critical safety functions.
23 MR. MORTON: Right.
24 MEMBER BROWN: That got lost when I was 25 reading this.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
85 1 MR. MORTON: So, I would caution ACRS 2 members that, because it's not -- and I think you just 3 alluded to it, Member Brown -- it's not a design 4 document per se, so there's kind of a limited level of 5 detail and sort of assurance that we can put inside 6 the BTP, because we're basically limited to what the 7 positions themselves actually are calling for. And 8 then --
9 MEMBER BROWN: Okay. Hold on. Hold on.
10 I understand that. I apologize for the interruption, 11 but I did it anyway.
12 You don't have to give it -- all we're 13 talking about is positive actuation. We're not 14 talking about -- it's just the positive actuation for 15 critical functions. The other ones -- I don't know 16 how you phrase it. I'm not trying to dictate, but 17 maybe sometimes you should dictate. So, I question 18 this idea of the world is open and the sky is the 19 limit all the time. There are some things you want 20 done positively and you don't want to sell out and it 21 shouldn't be reevaluated and you shouldn't be given an 22 option.
23 I have a fundamental disagreement --
24 you've probably heard me say this in multiple 25 meetings.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
86 1 MR. MORTON: Mm-hmm.
2 MEMBER BROWN: There are a few areas that 3 you do not want out -- I'll give you one which I'll 4 address later. The way this reads, bidirectional 5 software communications anywhere in the plant and 6 external to the plant are perfectly satisfactory 7 software-controlled as long as you do a D3 analysis 8 which everybody decides is okay. That's insane. But 9 I just thought I'd give you a nice positive -- I'll 10 look at actuating critical safety functions 11 positively.
12 And that's one of the things we did at NR.
13 All of our control panels, all critical safety or 14 actuation functions were done with switches. We 15 allowed data to be gotten, recording pressures, 16 temperatures, going to search what alarms came up, you 17 know, as a result of an event, via touch screen and 18 scrolling, but we did not allow critical control 19 functions to be done with touch screens and menus.
20 Now that was when I left. Based on the review of the 21 Ford, it looked like they were still doing that.
22 So, I hadn't figured out how I was going 23 to address that later.
24 MEMBER BLEY: Lest this appear to be a 25 Committee position -- and I would agree with Charlie, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
87 1 it ought to be a Committee position on --
2 MEMBER BROWN: Oh, yes, this is (audio 3 interference) --
4 MEMBER BLEY: -- the bidirectional aspects 5 of software and having a hard interface. But there's 6 been a lot of work on these new control panels and a 7 lot of experimentation. And I think for scram they 8 still have a switch on the 07. But, for some of the 9 others, I don't think the radio example in the car is 10 really quite applicable. And operators have found 11 these things very intuitive once they've had the bugs 12 worked out for a long time. So, there aren't many out 13 in the plants, but I'm not sure I would go as far as 14 Charlie said on anything on night call or critical 15 safety function -- I'm not sure what your list is, 16 Charlie -- needs to be a switch.
17 MEMBER BROWN: Well, a scram switch, 18 actuated safeguard systems when you've got to start 19 pumps. If I've got to scroll down and select a pump, 20 that's a bad idea.
21 MEMBER BLEY: Think of the controls on 22 these new panels with touch screens for starting 23 pumps, operating valves, that sort of thing, much more 24 intuitive and the results are showing them more 25 reliable, too, in terms of human dependence. So, I NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
88 1 think there's a gray area in here that I'd be hard-2 pressed to try to urge a fixed rule.
3 MEMBER BROWN: Well, you can see we have 4 unanimity, Morton -- or Wendell. Excuse me.
5 (Laughter.)
6 MR. MORTON: No problem. No problem at 7 all.
8 I would say that, with regard to your 9 initial concern, in some of the conversations we had 10 earlier in the presentation today, there's a level of 11 detail that we're not going to necessarily get into in 12 the BTP for 7-19 because it's much better explained in 13 other portions of the SRP.
14 And the efficacy of the manual controls 15 and displays is not something we necessarily are going 16 to be getting into in BTP 7-19. That's why we 17 provided the pointer to SRP Section 18, because that 18 has the relevant detail that you need to really get 19 into those kinds of considerations as well.
20 MEMBER BROWN: But this is your D3 21 assessment?
22 MR. MORTON: This is correct, and --
23 MEMBER BROWN: Because there's nothing 24 that provides any nuances of various types of control 25 to the reviewers.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
89 1 MR. MORTON: This is correct, and a nuance 2 should be left to the evaluators in this space when 3 they are also reviewing that aspect of the 4 application. We define the critical safety functions 5 in Section B1.2 of the BTP. Those are the functions 6 by which point 4 is referring to in terms of you need 7 to have controls that are independent and diverse from 8 the computer system that makes it susceptible to the 9 particular CCF of concern or a computer system.
10 That's a main design requirement we put on the manual 11 controls and displays as pertains to point 4.
12 MEMBER BROWN: You say where? Where was 13 that? Diverse and independent?
14 MR. MORTON: Yes, B1.2 is where we define 15 the critical safety functions is where we define the 16 critical safety functions.
17 MEMBER BROWN: B1? Where? B1.1?
18 MR. MORTON: Yes, Bravo 1.2 19 MEMBER BLEY: It's the fourth page of 20 Section B, Charlie, and it comes right after the four 21 technical positions.
22 MR. MORTON: Right, right. Right, right.
23 MEMBER BROWN: You said it was B1.2, 24 right, "Critical Safety Functions"?
25 MR. MORTON: Mm-hmm. So, we define those NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
90 1 functions that are referred to in position 4 of the 2 SRP, are defined in that subsection in the BTP. And 3 for those particular controls, there's a requirement 4 that they be independent and diverse from the computer 5 system in question under positions 1 and 3. That's in 6 the SRM itself. That's the main design requirement we 7 put on there. The individual details about --
8 MEMBER BROWN: But that's not in 1.2. The 9 independent and diverse is not in here.
10 MR. MORTON: That's correct. We just 11 simply defined the critical safety functions, what 12 they are. For purposes of the BTP, we just simply 13 define what they are.
14 MEMBER BROWN: Well, somebody has to go 15 off and look at 93-087?
16 MEMBER BLEY: No, Charlie, the independent 17 and diverse is stated right in position 4.
18 MR. MORTON: Right.
19 MEMBER BLEY: Two pages earlier.
20 MR. MORTON: So, in the BTP, we define, we 21 actually define what position 4 is in --
22 MEMBER BROWN: Okay. I found it. Never 23 mind.
24 MR. MORTON: Yes.
25 MEMBER BROWN: As long as it's in here, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
91 1 that's okay.
2 MR. MORTON: Yes. It's also in this 3 particular subsection of guidance 4, position 4, in 4 the BTP, so for your reference. So, we tell you that, 5 for those particular functions --
6 MEMBER BROWN: That's in 1.1, though.
7 MR. MORTON: Yes, yes.
8 MEMBER BROWN: Only where point 4 is I 9 didn't see the diverse. That's where I got lost in 10 terms of --
11 MR. MORTON: Yes, we changed some terms 12 for consistency with the SRM, but the requirement for 13 position 4 is that those displays and controls to 14 operate the critical safety functions have to be 15 independent and diverse. That's a requirement from 16 the position 4 of the SRM itself. The individual 17 efficacy of the controls and displays is that the 18 applicant may credit if something would be handled 19 under the more detailed HV evaluation. It's not 20 something we would get into in a significant for the 21 BTP. So, I just wanted to make that -- there's a 22 distinction there I just want to be clear on.
23 MEMBER BROWN: Okay. Go on.
24 MR. MORTON: Okay.
25 MEMBER BROWN: I'm good. I've been NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
92 1 suitably chastised.
2 (Laughter.)
3 MR. MORTON: So, if there's no other 4 questions, Dawnmathews, if we can go to slide 21?
5 So, for this particular subsection, I 6 believe it was Section 8.5 or 8.6 previously. Now 7 it's Section B.6.5, due to the changes we made in 8 integrating different sections.
9 We did get a number of public comments on 10 this particular subsection asking for additional 11 flexibilities under the BTP for addressing the 12 potential effects of a CCF that haven't necessarily 13 been addressed through the other methodologies stated 14 earlier in the BTP. And that's essentially what the 15 staff provided, and the ability to use alternative 16 methods when certain CCF vulnerabilities were not 17 specifically addressed through specific design 18 measures or things of that nature. So, we did 19 improve, make some refinements and improvements in 20 this subsection based upon our internal discussions as 21 well as industry and stakeholder comments.
22 So, I'm hearing no questions on this 23 particular topic. So, Dawnmathews, please go to slide 24 No. 22.
25 Okay. So, status and next steps.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
93 1 Technically, both the Draft Rev. 8 and the public 2 comment file are attached to, are in the final 3 concurrence review. We're still continuing to make 4 refinements and tweaks based on the feedback that we 5 received, including the feedback we received today at 6 today's ACRS meeting, as well as the previous ACRS 7 member feedback we received back in November of last 8 year and in June of this year. We do have another 9 ACRS full Committee meeting potentially scheduled for, 10 I believe, early November, later this year. And 11 really, the final milestone we're looking at prior to 12 issuance, targeting January-February of 2021, is OMB 13 review and publication, potentially targeted for 14 January-February of 2021.
15 So, those are just kind of the major 16 milestones that we have left going forward with the 17 BTP into fall. So, with that said, that essentially 18 completes our presentation. Are there any questions 19 from the members?
20 MEMBER BROWN: Yes, I have one, as kind of 21 a closure item. We do have the full Committee meeting 22 coming up in November --
23 MR. MORTON: Yes.
24 MEMBER BROWN: -- which I'll, obviously, 25 be tasked with preparing a report for the Committee, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
94 1 full Committee's agreement.
2 There has been a lot of variability in 3 this document over the last year. Are you comfortable 4 with where your concurrence process is, that you're 5 not going to have any more hiccups, the way we did a 6 few months ago in terms of people saying, "Gee, you've 7 got to redo all this."? I don't know how much legal 8 was involved. It's obvious you all took our comments 9 from the November and the June meeting into 10 consideration in terms of your reorganization, 11 consolidations, and stuff, which I think was positive.
12 My concern, is there some other 13 outstanding issues that you all have in the background 14 that we're not aware of that are going to drastically 15 change the picture of what this looks like before the 16 full Committee meeting?
17 MR. MORTON: Member Brown, right now, 18 we're very confident within the content of the 19 document as it stands. In terms of any major 20 significant issues, the ones that we had received 21 previously, the document that you received publicly is 22 the document that we believe resolved any remaining 23 residual significant issues that had come up since the 24 June meeting.
25 This is a version that has had internal NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
95 1 staff review, including the legal review as well. So, 2 it generally represents our legal positions on these 3 matters.
4 MEMBER BROWN: Okay. So that you have got 5 the NLO on this then?
6 MR. MORTON: That's correct, yes.
7 MEMBER BROWN: Whatever it's called?
8 MR. MORTON: That's correct, yes.
9 MEMBER BROWN: So, basically, we should be 10 expecting to review this document and any responses to 11 questions during this meeting during the full 12 Committee meeting? Whatever questions, you know, 13 whatever issues or whatever questions we raise in this 14 meeting, you would address those at the full Committee 15 meeting?
16 MR. MORTON: That's true. And I also want 17 to just tweak what I just said a little bit. So, we 18 did have a legal review, but it's the working -- I 19 would say this is still a working file in progress.
20 We did receive NLO on it, to your question. But we 21 will be saying the document's still technically in 22 concurrence. So, there may be changes and tweaks into 23 the document going forward.
24 MEMBER BROWN: The basic format, layout, 25 rearrangement of sections, deletion or inclusion of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
96 1 additional stuff, other than if you do it based on 2 some of our comments, you don't see that as being a 3 major issue then?
4 MR. MORTON: That is correct. We don't 5 foresee any significant reorganizations like you've 6 seen from the June to August version of the document, 7 that's correct.
8 MEMBER BROWN: So, when we get a document 9 for the full Committee meeting a couple of weeks 10 before, or whatever the requirement is, you should be 11 able to highlight the stuff you've got? I don't mean 12 redline/strikeouts, but at least highlight where 13 changes were made and what those changes were?
14 MR. MORTON: That's correct, yes.
15 MEMBER BROWN: Before the meeting, a 16 couple of weeks before the meeting?
17 MR. MORTON: Yes, that's correct.
18 MEMBER BROWN: Okay.
19 MEMBER BLEY: Hey, Charlie, can I sneak 20 something in? It's Dennis.
21 MEMBER BROWN: Yes, go ahead, Dennis.
22 MEMBER BLEY: In the introduction, you 23 guys mentioned that, you know, you've really focused 24 this on being a document for the staff, as a Standard 25 Review Plan is supposed to be. The hit I got was NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
97 1 you're not planning on doing a Reg Guide, but you 2 think industry might be putting together some form of 3 guidance? Is that what you're expecting? And they'll 4 be on, so we can hear from them later.
5 MR. MORTON: Member Bley, can you say that 6 one more time? I didn't quite hear your question.
7 MEMBER BLEY: Okay. My understanding from 8 your initial comments was that you will not be, or you 9 don't plan to do a Reg Guide for applicants, but you 10 think industry might be putting together some kind of 11 guidance for applicants. Is that correct?
12 MR. MORTON: Yes, we can let industry 13 speak to that point. I believe they'll be on later on 14 after the staff is done.
15 In terms of the Reg --
16 MR. BENNER: This is Eric Benner. I don't 17 think the door is closed to either option. We just, 18 like I alluded to, we've been so busy focused on this 19 document, that we haven't had the 20 interaction/communication with stakeholders to discuss 21 what form should the guidance, companion guidance for 22 industry, take. So, I mean, I think we need to have 23 -- I mean, some of it, we're going to hear some 24 thoughts from the industry today, but we need to have 25 that communication with stakeholders, particularly the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
98 1 industry, to see what's the best way to fill in that 2 hole.
3 MEMBER BLEY: Okay. Thanks.
4 MEMBER BROWN: Okay.
5 MS. ANTONESCU: Good morning.
6 MEMBER BROWN: Yes?
7 MS. ANTONESCU: This is Christina.
8 My understanding was that the staff 9 received a full NLO for the BTP, but working level NLO 10 for the resolution of the public comments.
11 MEMBER BROWN: Okay. Is that correct, 12 Eric?
13 MR. MOORE: Excuse me. This is Scott 14 Moore.
15 OGC has asked that we not discuss the 16 legal review as part of the presentations.
17 MEMBER BROWN: Okay.
18 MR. MOORE: I think it's a fair question.
19 Certainly, it's absolutely a fair question to ask is 20 it going to change between now and when the Committee 21 reviews documents at the full Committee stage. But 22 OGC's preference is that the staff not discuss OGC's 23 comments back to the Committee as part of the 24 presentation.
25 Thank you.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
99 1 MEMBER BROWN: Okay. Thank you, Scott.
2 I don't have any problem with that. It was just I 3 know there's been a lot of gyrations. I just want to 4 make sure we get a consistent document this time.
5 MR. MOORE: Yes, sir.
6 MEMBER BROWN: Okay. Wendell and Eric, I 7 told you I would provide some feedback, and we'll do 8 this before we take a break. This will only take 9 about five minutes, and then, we'll do the NEI stuff 10 after we take a break. And these are just my thoughts 11 relative to the background, and it's kind of the 12 fundamental issue of how do you craft defense in 13 depth, the most important, one of the most important 14 protections we have in these systems.
15 So, my comment, which I will send copies 16 to you via Christina, which you then can do with what 17 you decide to do with prior to the full Committee 18 meeting. But just to get it on the record, the way I 19 read this was, No. 1, in the background, fundamentals:
20 (a) The approach -- and don't take this 21 first part negatively; this is just my view of how we 22 do things a lot of the times. The approach taken by 23 the BTP is piecemeal in that it addresses the review 24 of defense in depth and diversity for digital I&C, 25 safety and non-safety systems, by evaluating the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
100 1 pieces that make up the systems without knowing the 2 overall I&C reactor trip and engineered safeguards 3 architectures for the specific application.
4 If you look at applications we reviewed in 5 the past few years, the architectures that meet five 6 fundamental principles for the structure of these 7 systems, the I&C system designs, provide the basic 8 framework for identifying the need for, and type of, 9 D3 required. In fact, an architecture for each of 10 these two primary high-significance safety systems, 11 RTS and SFAS, that meets the fundamental principles, 12 starts off with at least five or six layers of defense 13 in depth and two or three layers of diversity, 14 depending on how you want to aggregate them.
15 The first level is the use of redundant 16 divisions. Once you go from one division to four or 17 three or two, you have created a level of defense in 18 depth.
19 The second is the use of separate 20 detectors and A-to-D converters for each detector's 21 signals. That's a second level of defense.
22 The third is the use of asynchronous 23 clocks. In other words, the divisions are not 24 synchronized for cycle planning and processing. And 25 detectors never put out the same signal. Trying to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
101 1 get them to measure the same pressure for one pressure 2 input just doesn't, typically, does not happen. And 3 this works whether you have deterministic or 4 interrupt-driven processing systems.
5 The fourth level is the use of hardware-6 based monitors, watchdog timers, independent of the 7 processors on at least the software-based coincidence 8 voting units. In other words, you have a monitor, 9 regardless of -- but it's independent, to ensure that 10 corrupt data from one division does not lock up all 11 voting units.
12 The application of timers or monitors on 13 even the data processing and computational processors 14 provides a fifth level of defense in depth.
15 The use of manual reactor trip and 16 safeguards actuation switches downstream of the CCF-17 vulnerable units provides a sixth level.
18 And the use of non-software-configured 19 one-way data communications provides a seventh level 20 in terms of access to the plant from external sources.
21 There are also three levels of diversity 22 through the use of hardware manual switches, 23 processor-independent hardware watchdog timers, and 24 the use of non-software unidirectional data.
25 I'm not going to read the rest. I've NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
102 1 provided the rest that you ought to incorporate into 2 the background the concept of what defense in depth 3 means relative to architectures and using the words 4 that I've provided.
5 The other comment (b) is that the 6 background addresses combining reactor trip systems 7 and SFAS systems into combined a single DI&C 8 protection system. It is, then -- and this is a 9 little bit pejorative -- but, then, states in the most 10 ho-hum manner that this makes identification and 11 evaluation of potential consequences of a postulated 12 CCF more challenging. I had a difficult vision of how 13 in any manner we can condone or accept combining these 14 systems into a combined system using the same 15 processors.
16 NUREG-6303 actually identifies, as you 17 said before, echelons of defense, the normal reactor 18 controls, reactor trip, SFAS, and the reactor 19 monitoring identification systems as individual 20 echelons of defense.
21 These two paragraphs, the background or 22 the other background paragraph I talked about and this 23 other one, are obviously contradictory.
24 The section or the appropriate sections 25 should be revised to verify independence between the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
103 1 high-significance safety systems is maintained.
2 And then, there are some similar comments 3 down relative to those two things under the Branch 4 Technical Position, which I'll just pass on to you 5 without reading.
6 Anyway, I'll pass those on to you. Those 7 were my thoughts. They're obviously not Committee 8 thoughts, not Committee agreements. But I will be 9 advocating that we provide some recommendations on 10 that via the full Committee meeting. And if my 11 colleagues disagree, I guess we will accept that. But 12 I will pass them on to you for your consideration 13 prior to the full Committee meeting in November.
14 So, is that okay?
15 MR. MORTON: Yes, sir, that's fine. Thank 16 you, Member Brown.
17 MEMBER BROWN: Okay. And at this point, 18 I think it's 11:30. We were scheduled for a break a 19 few minutes ago. We're going to take it now. We 20 will, then, come back and wrap up with the NEI 21 comments.
22 So, as of -- what time is it? -- it's 23 11:35. We'll come back at --
24 MS. ANTONESCU: Charlie, according to the 25 schedule, the NEI comments on the Draft BTP is at two NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
104 1 o'clock. So, we will have to find out if they're 2 ready.
3 MEMBER BROWN: Oh, could we avail them --
4 are they here, NEI?
5 MR. VAUGHN: Chairman Brown, this is Steve 6 Vaughn with NEI. I'm online. So are Warren Odess-7 Gillett and Mark Burzynski. So, we'll be ready in 8 five minutes, if that's how you want to proceed.
9 MEMBER BROWN: Okay. We'll do this at, 10 make it 11 -- 15 plus 36 is what, 51. Let's make it 11 11:55. Is that acceptable? We'll reconvene at 11:55.
12 So, we're recessed right now.
13 Thank you.
14 (Whereupon, the above-entitled matter went 15 off the record at 11:36 a.m. and resumed at 11:55 16 a.m.)
17 MEMBER BROWN: This is Charlie Brown. I'm 18 back.
19 Let me do a roll call of the members 20 again, if I can find them all.
21 Dennis?
22 MEMBER BLEY: I'm here.
23 MEMBER BROWN: Walt?
24 MEMBER KIRCHNER: Here.
25 MEMBER BROWN: Dave?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
105 1 MEMBER PETTI: Here.
2 MEMBER BROWN: Joy?
3 VICE CHAIR REMPE: Here.
4 MEMBER BROWN: Matt?
5 MEMBER SUNSERI: Here.
6 MEMBER MARCH-LEUBA: And Jose March-Leuba 7 is here.
8 MEMBER BROWN: Oh, Jose is here. Okay, 9 Jose.
10 MEMBER MARCH-LEUBA: Sorry I wasn't at the 11 start.
12 MEMBER BROWN: Okay. It's all right. It 13 was exciting.
14 And I think I've got everybody.
15 MR. HECHT: Myron is also here.
16 MEMBER BROWN: Oh, Myron. I'm sorry. I 17 apologize for that.
18 With that in mind, I think I will turn 19 this over to Steve Vaughn from NEI.
20 Are you ready?
21 MR. VAUGHN: Yes. Yes, we are ready.
22 MEMBER BROWN: I lost the slides. Oh, 23 there they are again.
24 MR. VAUGHN: Yes. And I had to shut down 25 to unmute myself.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
106 1 MEMBER BROWN: Okay. All right. I'll 2 mute myself.
3 And this is Steve Vaughn from NEI. He 4 will doing responses from his other two compatriots.
5 I think it's Warren Odess-Gillett, right, and Mark 6 Burzynski?
7 MR. VAUGHN: Correct.
8 MEMBER BROWN: Okay. I will turn it over 9 to you, Steve.
10 MR. VAUGHN: All right. Thank you, 11 Chairman Brown and ACRS Members. We appreciate the 12 opportunity to present NEI perspectives.
13 Just again, my name is Steve Vaughn. I'm 14 a Senior Project Manager at the Nuclear Energy 15 Institute. I help coordinate a lot of the digital I&C 16 efforts ongoing.
17 And with me here in the virtual setting I 18 have Warren Odess-Gillett. He works at Westinghouse, 19 but he's also a part-time NEI loanee, and he will be 20 presenting some of the slide material.
21 And also, Mark Burzynski, representing 22 NewClear Day, Incorporated, will address some of the 23 slides as well.
24 Next, moving on, the first slide here is 25 on Section 2. We should have renamed this "Digital NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
107 1 I&C Characteristics," not "Categorization."
2 Just for everyone's edification, based on 3 what Wendell went through this morning, I probably 4 would have adjusted some of these slides after hearing 5 it, but we developed these last week. So, there will 6 be some tweaks here.
7 But, at a high level -- I just don't want 8 to lose the forest to the trees here -- NEI does like, 9 is all for having a graded approach to the digital I&C 10 system and components, maybe not categorization, but, 11 you know, creating the approach that you put it into, 12 based on the safety. So, we completely agree with 13 that, and we have been since the first proposal, I 14 think back in the November full Committee meeting.
15 So, we're all for it. We just have some comments here 16 to help clarify some of the guidance.
17 So, the first one here, use of risk 18 insights from site-specific PRAs, that language did 19 change a little bit from the last revision, the May 20 version. And the one thing we saw that was slightly 21 different is it noted that, if you do use risk 22 insights, you're basically demonstrating that a 23 structure, system, or component is less safety 24 significant than the criteria.
25 And our comment here is that these risks, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
108 1 many different risk insights, it's really independent 2 of these deterministic criteria. They could have 3 offered something that's less safety significant, but 4 the flip side is also the potential where, when you do 5 get risk insights, you could increase the level of 6 safety significance when comparing to these criteria.
7 And when Member Bley noted the logic under 8 B, where it was low safety significance, but it was 9 non-safety-related, but safety significant, it kind of 10 created a logic on an issue that kind of illustrates 11 this point where you could have something that is non-12 safety-related, but when you go through the switching 13 exercise using the site-specific PRA, you might come 14 to a determination that it has higher safety 15 significance than one might think when you see the 16 label "non-safety-related." So, that was just one 17 thing we wanted to point out.
18 The second piece, you know, based on how 19 the NRC provides the guidance to ensure that this is 20 directed to the audiences, for the staff, we do know, 21 it makes sense now why you revised the language there 22 about the risk insights should be an input into the 23 decisionmaking process. And that's what a utility 24 would use when they're making this determination, not 25 necessarily what the staff would do. So, it makes NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
109 1 sense why you took it out.
2 But I just wanted to note that, when an 3 applicant is going to apply for a digital modification 4 under this BTP 7-19, they're going to take risk 5 insights from the PRA and they're going to look at 6 these deterministic criteria and make an integrated 7 decision.
8 All right. So, moving on to the actual 9 criteria themselves, we did focus in on just the alpha 10 category, which is previously A1. It wasn't clear, 11 though, and we suspect that you don't need all the 12 criterion. So, it's not an "and" between each of 13 them. But we went kind of back and forth; we weren't 14 really sure. It's just an offer to maybe clarify the 15 criterion as one of the four or a subset of those, but 16 basically you don't need all the criterion to be met 17 in order for it to fall within that definition, 18 whether it's Alpha above or Charlie below.
19 MR. ODESS-GILLETT: Steve, this is Warren.
20 Do you mind if I clarify a little bit?
21 MR. VAUGHN: Sure.
22 MR. ODESS-GILLETT: Okay. So, what we're 23 really concerned about is that, if you use like the 24 first one, A, as a standalone criteria for Category A, 25 it's a significant contributor to plant safety. You NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
110 1 couldn't really use that as a standalone. So, the 2 industry assumes that you have to meet all four to be 3 into this Category A, and that's what we would prefer, 4 but it's not clearly stated that you need all four.
5 MR. VAUGHN: Yes. Thanks, Warren.
6 That is a good segue into the second 7 bullet, because the first criterion uses the phrase 8 "significant contributors to plant safety," and we're 9 trying to think about how one would -- how a digital 10 I&C system or a component would meet that, you know, 11 whether it's a significant contributor to plant safety 12 or not. You know, most of the focus is on insights 13 from the site-specific PRAs, and we've, obviously, 14 taken some engineering deterministic insights. Like 15 Warren said, that, in and of itself, it's just really 16 hard to make that determination. That's just a 17 challenging criterion to figure out whether you meet 18 it or not. And maybe it's meant to be ambiguous, and 19 that's okay. It's just, you know, to consistent 20 outcomes, it might be challenging.
21 And similar with the GDC 22, that's the 22 fourth criterion that was added, I think in the May 23 version. It wasn't in back in January. Again, GDCs, 24 by design, are very high-level. So, we would just 25 challenge you to see whether that criterion is met and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
111 1 whether it's you just need that in that category 2 because the assessment moved away from that term. But 3 it just makes it challenging to figure out what box 4 you're in.
5 And so, the second and third criterion we 6 thought were pretty straightforward, and we think the 7 second and third should be able to address all the 8 different examples, potential examples, out there.
9 So, our recommendation would be just to focus on the 10 second and the third criterion.
11 All right. We're going to move on to the 12 next slide, unless there are any questions.
13 MEMBER BROWN: Just stay there for a 14 minute.
15 MR. VAUGHN: Okay.
16 MEMBER BROWN: I mean, I just opened the 17 document and read all four of them. I guess I didn't 18 think of it when I read -- this is Charlie Brown. I 19 guess I didn't -- and somebody else can help me, if 20 they so desire, Dennis, et cetera -- but I just read 21 those as things to consider. And whether three or 22 four or one or two applied, you had to make an 23 independent judgment whether they fell into the high 24 safety significance, but those were things to think 25 about. So, I'm not so sure -- I didn't read it the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
112 1 same way you did, that two of them should be deleted.
2 That's my only thought. I don't know whether anybody 3 else has the same thought process or not, but that was 4 mine.
5 I'm just feeding that back to you for my 6 thought process on the thing. I'm not suggesting a 7 resolution one way or the other. Just an observation 8 as to how I viewed it when I read them. Okay?
9 MR. VAUGHN: Thank you, Member Brown.
10 MEMBER BLEY: This is Dennis Bley.
11 I'm with Charlie on how he read them. But 12 if somebody who has to use them has trouble sorting 13 them out, maybe that's an indication the staff needs 14 to make them a little more clear. But they weren't 15 unclear to me.
16 MEMBER BROWN: I agree with you, Dennis.
17 A discussion sounds like it would be required.
18 MR. VAUGHN: Okay. And just to reiterate, 19 the first and fourth criterion, that was NEI's 20 recommendation, just to remove those and just keep the 21 second and third criterion, which strings a little bit 22 over there, once getting back to the January version.
23 At least those two, if you met one of those two, it 24 would make sense to frame it under high safety 25 significance, notwithstanding any insights you get NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
113 1 from your site-specific PRA. But it's the first and 2 the fourth we're challenging to see whether they were 3 met or not because there's a lot of ambiguity there.
4 And what Warren's comment was is -- I 5 think when you do read it, it makes sense. Any one of 6 the four could put you into this category, for lack of 7 a better word. But because the first and the fourth 8 criterion were so open, it was just challenging to 9 make a determination. And that might be by design, 10 but, just to comment, we noted that it could --
11 there's a lot of subjectivity.
12 MEMBER BROWN: Okay. Do you want to move 13 on, unless somebody's got another comment?
14 MR. VAUGHN: Okay. Why don't we move on 15 to the next slide? It's "Defensive Measures," Section 16 3.1.3.
17 And again, this is a key section of 18 BTP 7-19. And so, we're very happy that it has been 19 added. It's been there for, I want to say, since the 20 November revision.
21 So, we're probably going to send the staff 22 some wording changes because previous versions, you 23 know, that was NRC-endorsed methodology. And 24 currently, this says industry-endorsed defensive 25 measures. And we just want to make sure that it isn't NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
114 1 limiting.
2 If we can step back for a second, the 3 whole purpose of this section is to allow NEI and 4 industry to develop their own guidance on how to 5 address software common cause failure. And given that 6 there's two other ways to eliminate the CCF from 7 further consideration -- it was either diversity or 8 testing -- so, there are only two options.
9 So, this section really does allow for the 10 opportunity for NEI and the industry to develop their 11 own set of guidance that will be endorsed by the NRC 12 and try the third option. So, again, we're happy that 13 it's there. We just might suggest some wording 14 changes to ensure that it really does align with the 15 first this bullet here. We have already a draft 16 version of NEI 20-07. And we did send that to the 17 NRC, I think, August 31st. So, they've only had it 18 for a week or so.
19 But, in the coming weeks when the staff 20 does have a chance to read through it, gather some 21 feedback, we look forward to an public opportunity to 22 get that feedback and get probably a handful of public 23 meetings in '20-21, as we change that guidance based 24 on staff feedback and from other stakeholders.
25 So, again, this section is really NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
115 1 important to us. And so, anything that we do provide 2 is just to ensure that the link is clear between 3 Section 3.1.3 and what we developed as NEI 20-07.
4 MEMBER BROWN: Doesn't the last paragraph 5 of 3.1.3 -- this is Charlie Brown again -- doesn't the 6 last paragraph pretty much say you guys, industry, can 7 pretty much propose what they want on a case-by-case 8 basis? And then, NRC will address it.
9 MR. VAUGHN: Yes, it does, and it may be 10 in a sense the nomenclature. But what NEI 20-07, what 11 it doesn't do, it's not just a list of defensive 12 measures that are approved for use because they're 13 occasion-specific. Again, 20-07 starts very high 14 level, the first principles, and then, it gets in safe 15 design directives, and then defensive measures, and 16 uses the term "design attributes" that you can use in 17 designs to help meet the safe design objectives; and 18 therefore, meet these first principles, which are, 19 then, again, tied to regulations. That's what 20-07 20 is. It's not just a list of defensive measures. It's 21 to make sure the wording in this section lines up well 22 with 20-07's.
23 And in the previous version, they 24 mentioned NRC methodology. Methodology is general 25 enough where it would apply to 20-07, because that's NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
116 1 really what it is. It's not just a list of defensive 2 measures. So, I could be reading too much into it, 3 but I'm heavily involved with the document and this 4 section. So, I just want to make sure everything's 5 clear to all stakeholders.
6 MEMBER BROWN: Okay. Thank you.
7 MR. VAUGHN: You're welcome.
8 MEMBER BLEY: I'm sorry, I got dumped off 9 the line for a few minutes and missed part of your 10 discussion on this one. Are you guys, have you made 11 any plans for developing guidance at this point, the 12 industry?
13 MR. VAUGHN: Yes. Yes, Member Bley, I 14 want to say it's been a little over a year we've laid 15 out a proof of concept, and just eight days ago, we 16 sent a draft version of NEI 20-07 to the NRC, and it's 17 publicly available in ADAMS right now.
18 And we look, probably in the next month or 19 two, when the staff has a chance to review it and 20 they've got us some feedback, we look forward to a 21 meeting to discuss technical and regulatory content of 22 that. So, the short answer is yes, and we probably 23 will have a public meeting before the end of 2020.
24 MEMBER BROWN: We lost the slide, by the 25 way.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
117 1 MEMBER BLEY: Yes, it did go away.
2 Thank you for that response.
3 Charlie?
4 MEMBER BROWN: Yes?
5 MEMBER BLEY: When is our full Committee 6 meeting scheduled?
7 MEMBER BROWN: November. That's correct, 8 isn't it, Christina?
9 (No response.)
10 MEMBER BLEY: So, we will not have the 11 industry proposed guidance -- well, we might see a 12 draft of it before then.
13 MEMBER BROWN: Yes, he just said they --
14 I think it's 20-07. And it's the 20-07 document 15 you're talking about?
16 MEMBER BLEY: Yes, I think that's what he 17 said, but they're going to revise it again in the next 18 few weeks. So, we probably won't get to see that 19 revision.
20 MS. ANTONESCU: Yes, we will have a copy, 21 a draft copy, for you.
22 MR. VAUGHN: It's available in ADAMS right 23 now. I don't have the number handy, but I can send it 24 to you. Maybe you can share it with the ACRS, and 25 anyone from the NRC will be able to share it with you NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
118 1 as well. It's publicly available.
2 MEMBER BROWN: Yes, Christina, if it's in 3 ADAMS, she'll get a copy for us.
4 MR. VAUGHN: Okay. Great.
5 MEMBER BROWN: Thank you.
6 MR. VAUGHN: All right. If there are no 7 other questions on this slide, I'm going to turn it 8 over to Warren Odess-Gillett, and he's going to get 9 into slide 4.
10 MR. ODESS-GILLETT: Steve, do you have 11 another document open that's preventing you from 12 sharing the presentation?
13 MR. VAUGHN: Thank you. No. So, you 14 didn't see that before?
15 MR. ODESS-GILLETT: No, it just appeared 16 now.
17 MR. VAUGHN: How about now?
18 MR. ODESS-GILLETT: Yes, that's fine.
19 That's good.
20 MR. VAUGHN: Okay. Yes, it just stopped 21 and I didn't realize that.
22 MR. ODESS-GILLETT: No worries. All 23 right. So, this has to do with the title and scope of 24 the document. The title of this draft is "CCF Due to 25 Latent Defects in Digital Safety Systems," just NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
119 1 extenuating the word "safety" here.
2 And the scope of this draft states that 3 the guidance of this BTP is intended for staff reviews 4 of I&C safety systems. However, even though the scope 5 seems to, and the title seems to, limit the review to 6 safety systems, the task still contains review 7 guidance for non-safety-related systems.
8 And NEI and its members would like to see 9 the non-safety-related guidance moved elsewhere from 10 the BTP, to be consistent with the title and the scope 11 of the document, if we had our druthers.
12 We agree that non-safety-related 13 discussion should be limited to any interconnectivity 14 or dependency of the safety system with a non-safety 15 system. But we know in the past addressing CCF for 16 non-safety-related systems has not always been 17 consistent in Part 52 reviews, where we've seen the 18 reviews range from a probabilistic approach, as in the 19 ESBWR, to actual transient analysis computations, as 20 was demonstrated for the APR1400.
21 We know that RIS 2002-22, Supplement 1, 22 has good regulatory guidance to industry on how to 23 address this issue for non-safety-related systems for 24 the operating fleet. And if the staff wants to 25 migrate the RIS into staff guidance, it's desired by NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
120 1 industry that this would be in another document, not 2 part of the SRP, and limit this SRP to its significant 3 title and scope, which is review of safety-related 4 systems.
5 MEMBER BLEY: Since this is staff 6 guidance, I'm curious as to why you're concerned about 7 the last comments you made.
8 MR. ODESS-GILLETT: It makes the BTP 7-19 9 a more complicated document by now -- we already have 10 a graded approach. Industry is really happy with the 11 graded approach to addressing CCF via the RIS for the 12 operating fleet.
13 And so, we just fine that, if the title 14 and scope -- either the title and scope need to 15 change, or the content needs to change. And if the 16 industry had its druthers, we'd like to keep this 17 content consistent with the title and scope and have 18 the non-safety-related stuff in another section of the 19 SRP than this, just to simplify the document.
20 MEMBER BLEY: Okay. Go ahead.
21 MR. ODESS-GILLETT: Okay. Now I guess we 22 go to slide 5.
23 All right. So here, as Wendell had 24 mentioned, they had defined in the background section 25 that this was to focus on latent defects. And we NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
121 1 understand that, really, these latent defects are 2 related to the design. Because latent defects are 3 associated with manufacturing, which this BTP is not 4 addressing those potentialities. So, the BTP scope, 5 since it is focusing on the design aspects of the 6 safety systems when addressing CCF, we'd like to see 7 the word "design" be used as a qualifier when 8 referring to "latent defects."
9 And then, also, the draft uses the term 10 "active components" without defining the term. So, 11 industry is struggling to understand what the 12 differentiation between an active hardware component 13 is and a component that has software-based logic 14 because they're used both in the same sentence, and 15 they are somehow differentiated between the two.
16 And similar to our comment to the last 17 ACRS Subcommittee meeting, how the industry addresses 18 particularly a hardware CCF, again, is still not clear 19 to us, even with this added term of "active 20 component," because we're not really sure what it 21 means. I mean, the industry is clear that it needs to 22 address CCF for what we would call programmable 23 hardware components, but we would like to know what 24 the definition of an "active component" is and why 25 that is different from a component that is software-NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
122 1 logic-based.
2 MEMBER BROWN: And an inactive component 3 is a resistor.
4 MR. ODESS-GILLETT: Okay.
5 MEMBER BROWN: An active component is a 6 solid-state device that can do something.
7 MEMBER BLEY: I think we ought to let the 8 staff speak to this one.
9 (Laughter.)
10 MEMBER BROWN: Well, I just thought I'd 11 throw this out. It's kind of an interesting thought.
12 Capacitors, resistors, et cetera, inductors, those are 13 passive components. Anything else is -- a vacuum tube 14 is an active component. But that's all right. You 15 all can work that out on your own. I just thought I'd 16 throw that, like that little puppy in the rice bowl; 17 that's all.
18 (Laughter.)
19 MEMBER BROWN: You can go on.
20 I agree with you, Dennis.
21 MR. ODESS-GILLETT: Okay. Steve, I think 22 we can go to slide 6 and hand it off to Mark.
23 MR. BURZYNSKI: Okay. Can you hear me?
24 MR. ODESS-GILLETT: Yes.
25 Mark, did we lose you?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
123 1 MR. BURZYNSKI: No, I'm here.
2 MEMBER BROWN: Yes, go ahead. We can hear 3 you.
4 MR. BURZYNSKI: Okay. So, the point with 5 the slide 6 is that the example that's provided in the 6 document that addresses partial actuation of an 7 emergency core cooling system, mentioned as a single 8 division coincident with false indications stemming 9 from a postulated CCF, is a confusing example. We 10 find that it's inconsistent with the evaluation 11 guidance in NUREG/CR-6303. Specifically, Section 3.6 12 would require you to postulate concurrent failures in 13 all the same blocks in all redundant divisions, which 14 would preclude the partial actuation example of a 15 single ECCS division.
16 The second evaluation guidance in Section 17 3.8 specifies that downstream blocks are assumed to 18 function correctly in response to the incorrect or 19 correct inputs they receive, which would preclude the 20 false indications. A spurious actuation would 21 indicate that it actuated. A failure to actuate would 22 indicate no actuation. But you wouldn't mix the two.
23 So, we just want to point that out, that this 24 introduces confusion with respect to what is expected 25 for spurious actuation or that it's inconsistent with NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
124 1 the other guidance that's mentioned regarding CCS 2 evaluation.
3 Next slide.
4 Okay. On slide 7 --
5 MEMBER BROWN: Your slides disappeared 6 again.
7 MR. BURZYNSKI: -- is where we find 8 inconsistencies within the document. We note in 9 several cases that the use of best estimate 10 methodology is allowed for evaluation of consequences, 11 but we do note that in several places it specifically 12 says, "bounded by acceptance criteria defined in the 13 FSAR," without mention of best estimate or realistic 14 assumptions. So, that creates some confusion was to 15 whether a different set of rules applies to these 16 cases here.
17 We also note that the discussion of 18 independent and diverse with respect to manual 19 controls is confusing. This is similar to some of the 20 discussion that occurred earlier regarding the use of 21 Reg Guide 1.62 and how we've reconciled these 22 documents. We think it would be useful to add a 23 clarification that the independent statement does not 24 require additional isolation on a hard-wired manual 25 control that is connected downstream of the digital NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
125 1 part of the system in the same safety division.
2 And the last item on this slide, it's an 3 inconsistency between ability to credit ATWS 4 mitigation equipment and the specification here 5 requiring independent sensors and actuators. We make 6 note of the fact that the ATWS rule does not require 7 independent sensors or actuators for the equipment it 8 required to be installed. So, there's an 9 inconsistency.
10 We also note that 10 CFR 50.62 was removed 11 as a reference in the regulatory basis section, and we 12 think it should be added back.
13 Thank you.
14 MR. ODESS-GILLETT: All right. So, I'm 15 going to address this one. This is Warren Odess-16 Gillett.
17 I think this is just an editorial thing, 18 but it has some technical significance. So, that's 19 just why we're bringing it up.
20 The first paragraph of page 29 allows for 21 diverse controls that are credited to mitigate a CCF 22 vulnerability with a safety system; in other words, 23 position 3 controls. They can also be credited as 24 position 4 controls as long as they're in the control 25 room.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
126 1 Steve, I think we lost the slides again.
2 Thank you.
3 However, the wording in the next paragraph 4 seems to contradict that statement by stating that 5 position 4 controls, and displays for that matter, 6 must be diverse from those credited for position 3.
7 And as we know, position 3 need to be diverse and 8 independent from the system that's vulnerable to a 9 CCF. So, we believe this was not the intent. And so, 10 we're bringing this syntactical situation to the 11 attention of the staff.
12 MR. VAUGHN: All right. Thank you, 13 Warren. This is Steve Vaughn, NEI.
14 That is the last slide with any salient 15 content. Before any closing remarks, any questions on 16 the material we presented thus far?
17 Okay. Hearing none, again, we appreciate 18 the opportunity to share our thoughts. This is the 19 third Subcommittee meeting on this topic. So, that's 20 a reflection of how much engagement has been involved 21 over the past year-plus. And again, we're happy that 22 we're a stakeholder and to be able to participate in 23 the discussion. And we're getting close to resolving 24 most of the content issues, and I think BTP 7-19 is on 25 schedule to be issued, hopefully, by the end of this NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
127 1 calendar year. So, again, we appreciate the 2 opportunity to try our perspectives. We appreciate 3 it.
4 And I will turn it back over to you, 5 Chairman Brown.
6 MEMBER BROWN: Okay. Thank you.
7 Hopefully, I don't get this out of 8 sequence, but before we go to public content, I was 9 going to see if any of the members and our consultant 10 have any additional comments. Do you want me to walk 11 through?
12 Dennis, do you have anything else?
13 MEMBER BLEY: Thanks, Charlie.
14 I like some of the rearrangement they did 15 in this one. I remain concerned about the full 16 material that was in the A1, A2, all that, in the way 17 it's presented.
18 So, just to close for me on this, given 19 the way those four categories are described in Section 20 2.1, under "Acceptance Criteria for Safety-21 Significance Determination," high safety significance, 22 one, makes sense to me. The second one is really 23 functionally important to safety. The third one is 24 really definitionally important to safety. And the 25 fourth one is really not important to safety. So, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
128 1 that's the only thing. Everything else I think looks 2 pretty clean.
3 I would like to have a chance to look over 4 these NEI slides. They raised a lot of particular 5 issues, but I couldn't quite decide on as they went 6 through them, and I just need to see them again. So, 7 we'll get a copy of them when this is over.
8 MEMBER BROWN: Okay. Thank you, Dennis.
9 Jose?
10 MEMBER MARCH-LEUBA: Yes, I'm here. No, 11 I have no further comment. Thank you.
12 MEMBER BROWN: Okay. Dave?
13 MEMBER PETTI: No comments.
14 MEMBER BROWN: Okay. Matt? Or Joy?
15 Excuse me. I don't want to go out of alphabetical 16 order here. Joy, do you have any additional comments?
17 VICE CHAIR REMPE: Hi, Charlie. No. I 18 appreciate the opportunity to get an update from the 19 staff and NEI's continued participation, but I don't 20 have any additional comments.
21 MEMBER BROWN: Okay. Thank you.
22 Matt?
23 MEMBER SUNSERI: I thought the 24 presentations were good, informative. I don't have 25 any additional comments. Thank you.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
129 1 MEMBER BROWN: Okay. Myron? Or Walt?
2 Excuse me. Walt Kirchner?
3 MEMBER KIRCHNER: Yes. Thanks, Charlie.
4 I echo Dennis' comments on the boxology.
5 Just an observation, it's not just this I&C matter, 6 but across the Agency it seems to me that there's not 7 a lot of consistency on how one approaches these 8 safety-significant determinations. I would point out, 9 for example, that even within the BTP, it is somewhat 10 inconsistent with the definition of safety-related 11 that's used in 10 CFR 50 and 52. And so, it's just a 12 general issue.
13 And I already made my comments about the 14 defense in depth topic as well. It's a similar thing.
15 It seems to be a lot of variability across the Agency 16 in how we do this boxology.
17 And second, a minor point, I always like 18 your kind of holistic approach, Charlie, starting with 19 the architecture. So, on the NEI slides, there was 20 one bullet pointing out that design and latent defects 21 would not include fabrication issues. It would seem 22 to me, if you start with architecture, this BTP would 23 work for both design CCF issues, as well fabricated 24 CCF issues.
25 That's it.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
130 1 MEMBER BROWN: Okay. Thank you very much, 2 Walt.
3 Myron?
4 MR. HECHT: I guess the observation I 5 wanted to make was not specific to BTP 7-19, but to 6 the philosophy of trying to remove replicated material 7 from reference documents. And Charlie already pointed 8 out that there was a circular reference problem 9 between 9-62 and 7-19. At least in the past, I guess 10 the overall problem is that (audio interference) --
11 how shall I say it? -- non-replicated approach, and 12 you start relying more on dependencies, particularly 13 the source document, the reference document, as it 14 changes, it has to be aware of the documents that are 15 dependent on it. And that introduces additional 16 complexity that might be caught and problems that 17 might not be caught for several years, unless a 18 dramatic effort is made to ensuring that particularly 19 the referenced documents on which other documents are 20 dependent are always checked for all of the 21 dependencies that they have.
22 MEMBER BROWN: Okay. Thank you.
23 That kind of restated the point that we 24 made earlier, and I agree with that. It's a balance.
25 I've already made my comments once. I NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
131 1 will provide them to Christina, as opposed to mouse-2 milking them anymore.
3 Let's see, I think I've covered everyone.
4 Did I miss anybody from the Committee or consultants?
5 No, I don't think so.
6 Christina, is the public line open?
7 MS. ANTONESCU: Thomas, can you please 8 open the public line?
9 MR. DASHIELL: The public line is open for 10 public comments.
11 MEMBER BROWN: Thank you, Thomas.
12 Is there anyone on the public line that 13 would like to make a comment?
14 (No response.)
15 MEMBER BROWN: Is there anybody on the 16 public line at all who could just say "Hi" to let us 17 know that it's, in fact, open?
18 MR. MAUCK: I'd like to make one or two 19 comments. This is Jerry Mauck.
20 MEMBER BROWN: From?
21 MR. MAUCK: From ER Resources, formerly 22 NRC.
23 The verbiage on the ATWS rule is totally 24 against what we wrote in the ATWS rule back in the 25 1980s. We took many man-years to ever get the ATWS NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
132 1 rule published. And the use of BTP 7-19 to rewrite 2 part of 10 CFR 50.62 is not acceptable and that should 3 be removed, or you're going to run into a major 4 conflict.
5 And the other comment is that citing these 6 non-safety systems, such as the recirculation 7 feedwater, as a problem and the defense in depth, has 8 anyone at the NRC staff gone through this using a 9 diverse digital (audio interference) once in the 10 protection system to see if this causes problems?
11 Because I don't think it will because the reactor 12 protection system protects against those systems 13 having a common cause software failure.
14 And it would be a problem if you used the 15 same digital platform in these critical non-safety 16 systems to do in the protection system. But if you do 17 that, it's already covered by BTP 7-19. You'd have to 18 include them as failing along with the protection 19 system. So, my question is, has anyone on the staff 20 gone through the concern (audio interference) to see 21 if there really is one?
22 CHAIRMAN BROWN: Okay. Could you give me 23 your name again, Jerry?
24 MR. MAUCK: Yes. Jerry Mauck, M-A-U-C-K.
25 CHAIRMAN BROWN: M-A -- say that again?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
133 1 MR. MAUCK: M-A-U-C-K.
2 CHAIRMAN BROWN: Okay. Jerry, right?
3 MR. MAUCK: Right.
4 CHAIRMAN BROWN: Okay. Thank you.
5 Is there anyone else on the public line 6 that would like to make a comment?
7 Hearing none, Thomas, Christina, you all 8 can close the public line.
9 MR. DASHIELL: The public line is closed.
10 CHAIRMAN BROWN: Okay. Are there any 11 other comments that anybody thought of in the interim 12 here before I adjourn the meeting?
13 Hearing none, we will adjourn the meeting 14 at this time. Thank you all for your participation, 15 and we look forward to wrapping this up in the full 16 Committee meeting in November.
17 Eric, do you have anything else final to 18 say?
19 MR. BENNER: Just that you have given us 20 a lot to think about, and I think -- I know it was 21 good feedback, particularly on the terminology of 22 "high safety significance." You know, there's a 23 number of things that I think we can, irrespective of 24 what comes in the letter, I think you've given us some 25 good things to digest that we can clarify. So, we NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
134 1 will, in whatever product we provide to you for the 2 full Committee meeting, we'll explain the changes, and 3 particularly those changes that we make that we hope 4 will be responsive to some of the feedback we heard 5 here today.
6 CHAIRMAN BROWN: Okay. I have one final 7 -- obviously, you didn't care for my architecture 8 stuff. So, you'll only look at the other things. I'm 9 just pulling your leg a little bit.
10 (Laughter.)
11 CHAIRMAN BROWN: We've got to have some 12 humor somewhere in here.
13 MR. BENNER: Yes.
14 CHAIRMAN BROWN: I wanted to thank Tekia 15 and her colleagues and staff. I thought they did a 16 very good job. This was a much better document, a 17 smoother-reading document than the ones I have seen in 18 the past. So, we wanted to make sure management 19 understood that they had some good response from the 20 folks you had working on it, as well as Tekia with her 21 management of getting it done. Okay? So, hopefully, 22 you will pass that on.
23 I don't know that she's on the line. I 24 know she had other meetings.
25 MS. GOVAN: Member Brown, I'm back. Thank NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
135 1 you very much.
2 CHAIRMAN BROWN: Oh, okay. Very good.
3 Thank you, Tekia. Take care.
4 With that, I will adjourn the meeting, and 5 we'll get on with business.
6 Matt, I presume we will get on with our --
7 this is your P&P Subcommittee at o'clock, correct?
8 MEMBER SUNSERI: That is correct.
9 CHAIRMAN BROWN: Okay. And we've got a 10 separate thing to go to. So, we close this meeting 11 out, and we'll then meet you at 1:00 p.m.
12 MEMBER SUNSERI: Very good, Charlie.
13 That's correct. Thank you.
14 CHAIRMAN BROWN: Okay. Thank you all, 15 everybody.
16 Logging off. The meeting's adjourned.
17 (Whereupon, the above-entitled matter went 18 off the record at 12:40 p.m.)
19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
Draft Branch Technical Position 7-19, Revision 8 Advisory Committee on Reactor Safeguards Subcommittee Meeting NRC Staff Presentation September 8, 2020
Agenda
- Objectives
- Summary of Key Changes
- Topics within the draft BTP 7-19
- Scope of the draft BTP 7-19
- Editing and Restructuring of the BTP
- D3 Assessment
- Manual Action Means to Address Position 4 in SRM-SECY-93-087
- Justification for Not Correcting Specific Vulnerabilities
- Status and Next Steps 2
Objectives
- Present key changes made in the draft BTP 7-19, Rev.
8, in response to public comments, as well as, ACRS feedback received in June 2020
Summary of Key Changes
- Each section of the BTP saw refinements in light of public comments and ACRS:
- Graded approach revised to a categorization scheme
- Qualitative assessment and spurious operation guidance moved to Section 3
- Numbering for BTP sections now slightly different
- Edited and restructured the BTP to emphasize guidance is directed to staff reviewers
- Other improvements:
- Readability
- Technical content and regulatory bases
- Overall clarity of positions contained therein
- Organization 4
Topics within the draft BTP 7-19
- Scope of the BTP
- Graded Approach Revised to a Categorization Scheme
- Defense-in-Depth and Diversity (D3) Assessment
- Means to Eliminate CCF from Further Consideration
- Diverse Means to Mitigate CCF
- Evaluation of Event Consequences for Coping with CCF
- Qualitative Assessment Applicability
- Spurious Operation Evaluation Guidance
- Manual Action Means to Address Position 4 in SRM-SECY 087
- Justification for Not Correcting Specific Vulnerabilities 5
Scope of the draft BTP 7-19
- Included consideration of active hardware, software, and software-based logic when addressing CCF (originating from latent defects)
- Clarified the definition of latent defect
- Clarified that the design and/or analytical solutions in this BTP are applicable for latent defects in active hardware or software
- Resolved several public comments regarding the scope of the BTP
- Made conforming changes to reference latent defects with regard to CCF 6
Editing and Restructuring the BTP
- Maintained focus of the BTP as staff guidance
- Refined background section discussion:
- Failure types clarification
- Single failures and single malfunctions (out of scope)
- CCFs due to latent defects (in scope)
- Consolidated technical guidance and corresponding acceptance criteria for the D3 Assessment:
- Qualitative assessment guidance
- Spurious operation guidance 7
Editing and Restructuring of the BTP -
Refinements based on ACRS feedback
- Improved lead-in discussions in each section of the BTP
- Added discussion clarifying echelons of defense and overall defense in depth concept
- Refined the connectivity between major sections to improve logic flow and readability 8
D3 Assessment - Description
- A D3 assessment is a systematic approach an applicant uses to analyze the proposed design of a DI&C system for CCFs that can occur concurrently within a redundant design, such as within two or more independent divisions
- Consistent with SRM-SECY-93-087, a D3 assessment should be performed for all systems determined to be of higher safety significance 9
D3 Assessment - Process (previously called Graded Approach)
- D3 assessment to be based on the safety significance of the system
- Design and analytical approaches applied are based on the safety significance determination
- General focus on characteristics of the SSCs rather than categories (A1, B1, etc. and Table 2-1 removed)
- Risk insights (if available) can be an input to the safety significance determination
- Applicants do not need to base their D3 assessment based on the safety significance of the systems 10
D3 Assessment - Process(Continued)
- Clarified flexibility for SSCs in applications where a D3 Assessment is not necessary
- For lowest safety significant systems only
- Identified flexibility based on the following criteria:
- Failure does not adversely affect a safety function
- Failure would not place a plant in a condition that cannot be reasonably mitigated 11
D3 Assessment - Improvement
- Modified D3 Assessment process to include:
- Qualitative Assessment methodology
- Guidance and acceptance criteria for addressing spurious operation
- Provided more flexibility under the D3 Assessment method
- Provided better synergy with the safety significance determination process 12
D3 Assessment - Framework
- Identified means to eliminate from consideration:
CCF vulnerability to latent defects can be eliminated from further consideration by use of these design attributes: diversity, testing, NRC-approved defensive measures or qualitative assessment; or
- Identified means to prevent or mitigate the effects of CCFs:
A diverse means can be used to perform the same or different function than the safety function disabled by the postulated CCF; or
- Identified strategy to cope with CCFs by evaluating if the consequences due to CCF remain within acceptable limits; or
- A combination of the above or a different proposed solution by the licensee/applicant.
13
D3 Assessment - Means to Eliminate CCF from Further Consideration
- Diversity within the DI&C system or component
- Provided staff guidance to evaluate diversity within each safety division or among redundant divisions to address CCF
- Provided staff guidance to evaluate that sufficient diversity exists in the design so different portions of the system are not subject to the same CCF
- Testing to identify and eliminate latent defects
- Revised staff guidance to align with testing criteria described in IEEE Std. 7-4.3.2-2016 14
D3 Assessment - Means to Eliminate CCF from Further Consideration
- Defensive Measures:
- Defined as a type of design attribute
- Added to conceptually allow for new and innovative design techniques to be employed to address CCF
- Clarified that it must be NRC-approved to be creditable 15
D3 Assessment - Means to Mitigate CCF
- Clarified staff guidance on the evaluation of the use of diverse means to perform the same or different function as the safety function:
- The types of diverse means that can be credited
- Guidance on the quality level for credited equipment
- Included staff guidance on the evaluation of the use of equipment outside the main control room for the performance of manual operator actions. Applies only for use of diverse means to address Position 3 in the SRM-SECY-93-087 16
D3 Assessment -
Coping with the Consequences of a CCF
- Included staff guidance to evaluate whether the facility can operate and consequences remain acceptable:
- When remaining (residual) CCF vulnerabilities exist
- Identified acceptance criteria to conclude that consequences of CCFs of a proposed system, or portions of a proposed system, are acceptable 17
D3 Assessment -
Qualitative Assessment Guidance
- Considered a less (technically rigorous) type of a D3 assessment for purpose of this BTP
- Qualitative assessment can only be used for low safety significance systems
- CCF removed from further consideration if found sufficiently low
- Defined what constitute a Qualitative Assessment
- Three factors used in the aggregate to demonstrate likelihood of failure (i.e. CCF due to latent defect) remains acceptable:
Design attributes Design quality Operating experience
- Supporting failure and consequence analysis (e.g. FMEA, FTAs, etc.)
- Provided staff guidance and acceptance criteria in Section 3 of the draft BTP 7-19 18
D3 Assessment - Spurious Operation Guidance
- Provided staff guidance in Section 3 to consider spurious operation for evaluating a D3 assessment
- Clarified regulatory basis of spurious operation
- Spurious operations as a result of CCFs originating from latent defects
- Focused the staff guidance on integrated systems
- Integrated acceptance criteria into relevant subsections within the review guidance of the D3 assessment 19
Manual Action Means to Address Position 4 in SRM-SECY-93-087
- Clarified staff guidance on the use of displays and manual controls to monitor, control and actuate critical safety functions from the main control room--
necessary to address Position 4 of the SRM on SECY-93-087, Item 18
- Clarified that reviewers should accept these displays and manual controls as diverse means to address CCF (Position 3) only if they are not susceptible to the same CCF vulnerabilities 20
Justification for Not Correcting Specific Vulnerabilities
- Modified Section B.6.5 to highlight the possible use of alternative methods to not address specific CCF vulnerabilities
- Updated review guidance to specifically refer to the potential for licensees or applicants to credit other systems and manual operator actions
- Emphasized that justifications would be reviewed on a case-by-case basis only 21
Status and Next Steps
- Draft BTP 7-19, Rev. 8, is in final concurrence review
- ACRS Full Committee Meeting slated for November 2020
Questions 23
Acronyms ACRS Advisory Committee on Reactor Safeguards BTP Branch Technical Position CCF Common Cause Failure D3 Defense-in-Depth and Diversity DI&C Digital Instrumentation and Control IEEE Institute of Electrical and Electronics Engineers FMEA Failure Mode and Effects Analysis FTA Failure Tree Analysis OMB Office of Management and Budget RG Regulatory Guidance SECY NRC Office of the Secretary to the Commission SRM Staff Requirements Memorandum SSC Structures, Systems, and Components Std. Standard 24
Background Information 25
SRM to SECY-93-087
- 1. The applicant shall assess the defense-in-depth and diversity of the proposed instrumentation and control system to demonstrate that vulnerabilities to common-mode failures have adequately been addressed.
- 2. In performing the assessment, the vendor or applicant shall analyze each postulated common-mode failure for each event that is evaluated in the accident analysis section of the safety analysis report (SAR) using best-estimate methods.
The vendor or applicant shall demonstrate adequate diversity within the design for each of these events.
- 3. If a postulated common-mode failure could disable a safety function, then a diverse means with a documented basis that the diverse means is unlikely to be subject to the same common-mode failure, shall be required to perform either the same function or a different function. The diverse or different function may be performed by a nonsafety system if the system is of sufficient quality to perform the necessary function under the associated event conditions.
- 4. A set of displays and controls located in the main control room shall be provided for manual, system-level actuation of critical safety functions and monitoring of parameters that support the safety functions. The displays and controls shall be independent and diverse from the safety computer system identified in Items 1 and 3 above.
26
SECY-18-0090 - Five Guiding Principles
- 1. Applicants and licensees for Production and Utilization Facilities under 10 CFR Part 50, Domestic Licensing of Productions and Utilization Facilities or under 10 CFR Part 52, Licensees, Certifications and Approvals for Nuclear Power Plants should continue to assess and address CCFs due to software for DI&C systems and components.
- 2. A defense-in-depth and diversity analysis for reactor trip systems and engineered safety features should continue to be performed to demonstrate that vulnerabilities to a CCF have been identified and adequately addressed. In performing this analysis, the vendor, applicant, or licensee should analyze each postulated CCF for each event evaluated in the accident analysis section of the safety analysis report. This defense-in-depth and diversity analysis can be either a best estimate analysis or a design-basis analysis.
- 3. This analyses should also be commensurate with the safety significance of the system. An analysis may not be necessary for some low-significance I&C systems whose failure would not adversely affect a safety function or place a plant in a condition that cannot be reasonably mitigated.
27
Five Guiding Principles continued
- 4. If a postulated CCF could disable a safety function, then a diverse means, with a documented basis that the diverse means is unlikely to be subject to the same CCF, should perform either the same function or a different function. The diverse or different function may be performed by either a safety or a non-safety system if the system is of sufficient quality to perform the necessary function under the associated event conditions in a reliable manner. Use of either automatic or manual actuation within an acceptable time frame is an acceptable means of diverse actuation. If the defense-in-depth and diversity analysis demonstrates that a CCF, when evaluated in the accident analysis section of the safety analysis report, can be reasonably mitigated through other means (such as with current systems), a diverse means that performs the same or a different function may not be needed.
- 5. The level of technical justification needed to demonstrate that defensive measures (i.e., prevention and mitigation measures) are adequate to address potential CCFs should be commensurate with the safety significance of the DI&C system. For the systems of higher safety significance, any defensive measures credited need technical justification that demonstrates that an effective alternative to internal diversity and testability has been implemented.
28
NEI Perspective:
Draft Revision 8 to BTP 7-19 ACRS DI&C Subcommittee Meeting September 8th, 2020
©2020 Nuclear Energy Institute
DI&C Categorization (Section 2)
Use of risk insights from site-specific PRAs Risk insights are not only used to demonstrate that an SSC is less safety-significant than the deterministic criteria Previous drafts of the BTP noted that risk insights should be an input to an integrated decision-making process - this language should be added back Deterministic Criteria It is not clear whether all (or just one) of the criteria under each of the four categories needs to be met In category (a) (i.e., high safety-significance) the phrase significant contributors to plant safety and GDC 22 are challenging to use as criteria.
The 1st and 4th criterion in (a) should be deleted
©2020 Nuclear Energy Institute 2
Defensive Measures (Section 3.1.3)
The purpose of this section is to allow the use of an NRC-approved methodology to limit the likelihood of latent design defects and thus, limit the likelihood of a CCF.
A draft version of NEI 20-07, Guidance for Addressing Software CCF in High Safety Significant Safety Related DI&C Systems was provided to the staff for review in late August.
NEI appreciated the opportunity to develop guidance as an alternative to Diversity (3.1.1) and Testing (3.1.2) and will suggest wording changes to Section 3.1.3 to ensure there is an appropriate linkage.
We look forward to a technical and regulatory discussion with the staff in a public forum later this year.
©2020 Nuclear Energy Institute 3
DI&C SSC Scope: Safety vs Non-safety The title and scope statement of the BTP focuses on safety systems Sections of the guidance still address non-safety systems and this inconsistency between the title/scope and review details creates confusion The only link to non-safety systems should be system integration and interconnectivity as described in Section 2.1
©2020 Nuclear Energy Institute 4
Latent Design Defects: Hardware and Software Recommend adding design to the term latent defects to ensure other latent defects (e.g., fabrication) are not in scope Footnote 2 refers to active hardware components but it is not clear what active means in this context.
Do FPGAs fall under this?
How is this different from software-based logic?
Recommend that the scope of latent design defects that can cause a CCF in hardware is limited to hardware that is programmed using software tools (e.g., FPGAs).
©2020 Nuclear Energy Institute 5
Spurious Operations (Section 3)
Current draft provides an example of a partial actuation of an emergency core cooling system (i.e., spurious operation of a single division) with false indications stemming from postulated CCF The example is inconsistent with the evaluation guidance in NUREG/CR-6303 NUREG/CR-6303 (Section 3.6) requires concurrent failures of the same blocks in all redundant divisions, which precludes partial actuations NUREG/CR-6303 (Section 3.8) specifies that downstream blocks are assumed to function correctly in exact response to correct or incorrect inputs they receive, which precludes false indications
©2020 Nuclear Energy Institute 6
Additional Items No mention of the phrase best estimate (various Sections)
BTP states in several places consequences of CCFs are bounded by the acceptance criteria defined in the FSAR, with no mention of best estimates or realistic assumptions Independent and Diverse (various Sections)
Add clarification on independent that isolation is not required for safety-related manual controls that are connected downstream of the digital I&C safety system outputs in the same safety division Crediting Existing Systems (Section 3.2.1) using independent sensors and actuators The phrase using independent sensors and actuators is not consistent with 10 CFR 50.62(c)(1) through 10 CFR 50.62(c)(3) 10 CFR 50.62 should be a reference in the Regulatory Basis section
©2020 Nuclear Energy Institute 7
Additional Items (continued)
BTP (page 29, 1st paragraph states), the applicant may credit some or all of these displays and manual controls to meet Position 4 as the diverse means called for under Position 3 The following paragraphs states, The applicant may credit existing displays and controls in the MCR to satisfy Position 4. However, the reviewer should confirm that the applicant did not also credit the same digital platform or analog technology for Position 1 or 3 (e.g., for mitigating DBEs) because Position 4 specifies that the MCR displays and controls shall be independent and diverse from those credited for Position 1 and 3.
System credited for Position 3 must be diverse from the digital system being replaced. Does it also have to be diverse from Position 4?
©2020 Nuclear Energy Institute 8
Closing Remarks The NEI team appreciates the opportunity to share our perspective Looking forward to resolving the remaining regulatory and technical aspects of the guidance
©2020 Nuclear Energy Institute 9