ML20325A241

Summary of November 18, 2020, REDACTED- Category 1 Meeting with Entergy Operations, Inc. Regarding LAR to Install Digital Upgrade in Accordance with Digital I&C Interim Staff Guidance No. 06, Rev. 2, Licensing Processes

ML20325A241
Person / Time
Site:	Waterford
Issue date:	12/17/2020
From:	Audrey Klett NRC/NRR/DORL/LPL4
To:	Entergy Operations
Klett A
Shared Package
ML20325A233	List: ML20325A241
References
EPID L-2020-LLA-0164
Download: ML20325A241 (27)

Text

OFFICIAL USE ONLY PROPRIETARY INFORMATION December 17, 2020 LICENSEE: Entergy Operations, Inc.

FACILITY: Waterford Steam Electric Station, Unit 3

SUMMARY

OF NOVEMBER 18, 2020, CATEGORY 1 PUBLIC MEETING WITH ENTERGY OPERATIONS, INC. REGARDING LICENSE AMENDMENT REQUEST TO INSTALL DIGITAL UPGRADE IN ACCORDANCE WITH DIGITAL INSTRUMENTATION AND CONTROL INTERIM STAFF GUIDANCE NO. 06, REVISION 2, LICENSING PROCESSES (EPID L-2020-LLA-0164)

On November 18, 2020, the U.S. Nuclear Regulatory Commission (NRC) staff held a virtual Category 1 public meeting with representatives from Entergy Operations, Inc. (the licensee) and Westinghouse Electric Company, LLC. The purpose of the meeting was to discuss the licensees amendment request dated July 23, 2020 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML20205L588), for the Waterford Steam Electric Station, Unit 3, regarding a replacement to an existing digital core protection calculator system.

The upgrade, if approved, would replace the existing core protection calculator system with a Common Q-based system. The meeting notice and agenda, dated October 23, 2020, are available in ADAMS under Accession No. ML20302A350. A list of attendees is provided in .

During the meeting, the NRC staff discussed its open items list, which is a list of NRC staff questions and informal licensee responses regarding the license amendment request for the staff to track and eventually disposition as requests for additional information, requests for confirmation of information, audits, or as needing no additional action. The proprietary version of the open items list, which is being withheld from public disclosure, is in Enclosure 2. A redacted copy of the open items list is in Enclosure 3. The NRC and licensee asked clarifying questions about the open items and the licensees responses to them. During the closed portion of the meeting, the NRC staff and licensee discussed proprietary information associated with Open Item No. 29.

Enclosure 2 to this letter contains proprietary information. When separated from Enclosure 2, this document is DECONTROLLED.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION Based on the meeting discussions, the NRC staff intends to update Open Item Nos. 17 and 18 and create a new open item to track which documents the licensee may need to provide in an amendment request supplement after the NRC sends any requests for additional information.

The NRC staff has determined that the open items list contains proprietary information pursuant to Title 10 of the Code of Federal Regulations (10 CFR) Section 2.390, Public inspections, exemptions, requests for withholding. The proprietary information is indicated by bold text enclosed within ((double brackets)). The proprietary version of the open items list is provided as Enclosure 2. Accordingly, the NRC staff has also prepared a non-proprietary version of the open items list which is provided as Enclosure 3.

The NRC staff did not make any regulatory decisions or commitments at the meeting. No members of the public identified themselves on the teleconference.

Please direct any inquiries to me at 301-415-0489 or by e-mail to Audrey.Klett@nrc.gov.

/RA/

Audrey L. Klett, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-382

Enclosures:

1. List of Attendees

2. Open Items List (Proprietary)

3. Open Items List (Non-proprietary) cc w/o Enclosure 2: Listserv OFFICIAL USE ONLY PROPRIETARY INFORMATION

Enclosure 1 List of Attendees

LIST OF ATTENDEES NOVEMBER 18, 2020, VIRTUAL PUBLIC MEETING WITH ENTERGY OPERATIONS, INC., ET AL.

WATERFORD STEAM ELECTRIC STATION, UNIT 3, LICENSE AMENDMENT REQUEST TO INSTALL DIGITAL UPGRADE U.S. Nuclear Regulatory Commission Entergy Operations, Inc.

Samir Darbali, NRR1/DEX2/ELTB3 Jacob Champagne Jennifer Dixon-Herrity, NRR/DORL4/LPL45 Remy DeVoe Greg Galletti, NRR/DRO6/IQVB7 Ron Gaston DaBin Ki, NRR/DRO/IOLB8 Loren Miller Audrey Klett, NRR/DORL/LPL4 John Schrage Mike Marshall, NRR/DORL/LPL19 Christopher Talazac Carol Moyer, RES10 William Truss Charity Pantalo, NSIR11 Michele Sampson, NSIR Jensen Hughes, Inc.

Richard Stattel, NRR/DEX/EICB12 Alan Harris Summer Sun, NRR/DSS13/SNSB14 Nick Taylor, Region IV Sargent and Lundy Mike Waters, NRR/DEX/EICB Pareez Golub Deanna Zhang, NRR/DRO/IQVB Jack Zhao, NRR/DEX/EICB Westinghouse Electric Company, LLC Matt Shakun Members of the Public John Wiesemann None introduced 1

Office of Nuclear Reactor Regulation 2

Division of Engineering and External Hazards 3

Long Term Operations and Modernization Branch 4

Division of Operating Reactor Licensing 5

Plant Licensing Branch IV 6

Division of Reactor Oversight 7

Quality Assurance and Vendor Inspection Branch 8

Operator Licensing and Human Factors Branch 9

Plant Licensing Branch I 10 Office of Nuclear Regulatory Research 11 Office of Nuclear Security and Incident Response 12 Instrumentation and Controls Branch 13 Division of Safety Systems 14 Nuclear Systems Performance Branch

Enclosure 3 (Non-proprietary)

Open Items List Proprietary information pursuant to Section 2.390 of title 10 of the Code of Federal Regulations has been redacted from this document.

Redacted information is identified by blank space enclosed within ((double brackets)).

OFFICIAL USE ONLY - PROPRIETARY INFORMATION LAR/

Audit, Topic & LTR LAR/ LTR No. IMS ID NRC Comment / Open Item Description Licensee Response Status RAI or (Reviewer) Secti Page RCI No.

on Certrec IMS Request ID Format (second column of this table) Updated by Entergy on 10/19/20 A- Audit (Generic/Multiple Documents) Proprietary Documents will be uploaded to the Westinghouse CCF-Common Cause Failure/D3 Sharepoint site at the below address EQ- Equipment Qualification HFE - Human Factors Engineering ((

PSAI- Plant Specific Action Items

- - - - - RC- Regulatory Commitments - -

RT- Response Time SA- System Architecture SDOE- Secure Development and Operational Environment ST- Surveillance Testing/Self-Diagnostics/SR Elimination SDP- System Development Processes, including SPM PSAIs ))

TS- Technical Specifications VOP- Vendor Oversight Plan 1 ST-01 Self-Tests B.2.5 B-5 The BTP 7-17 Evaluation conclusion states that It is not possible to test self-diagnostics (Entergy 11/3/20 Update) Open as part of surveillance testing because it would require creating destructive faults within the I&C (Jack Zhao, system, such as Random-Access Memory (RAM) errors. The LAR Enclosure Section 2.3, Reason for the Proposed Richard Stattel, Changes, will be revised as follows:

Samir Darbali) Though this is a quote out of the Vogtle LAR safety evaluation, it is a statement made by the licensee and not the NRC to address this criterion in BTP 7-17, self-test functions should be verified during Crediting Self-Diagnostics for TS Surveillance Requirement periodic functional tests. The interpretation being made that the BTP criterion calls for complete Elimination functional testing of the self-diagnostic functions is incorrect. Instead, the BTP states that the The Common Q design also provides additional reliability and licensee should confirm the execution of self-diagnostic tests during plant operation and the NRC operational margin via the self-diagnostics. These self-diagnostics staff believes that it is possible to do so by implementing the following necessary plant monitoring are continually monitoring the health of the hardware and software.

activities as already included in the Enclosure for this LAR. Appendix B to the Licensing Technical Report (LTR) (Attachment

4) and the Waterford System Engineer and Operations Actions The licensee (Waterford) has addressed this in the LAR as follows: Supporting TS SR Reduction (LAR Enclosure Section 3.4) provides the justification to remove selected SRs.

Post installation, CPCS operability will be verified using 1) the automated diagnostics credited in this LAR (i.e., as described in LTR Appendix B), 2) Technical Requirements Manual (TRM) 3/4.3.1, Note: "and the Waterford System Engineer and Operations Actions "Reactor Protective Instrumentation" and associated surveillance procedures; and 3) Waterford TS Supporting TS SR Reduction (LAR Section 3.4) provides the 6.5.1.8, "Surveillance Frequency Control Program (SFCP). A failure of credited automated ustification to remove selected SRs is new inserted text.

diagnostics to detect a fault will be either detected by other diagnostics in the system or by checker(s) of diagnostics. This condition will be alarmed and displayed on the main control room (MCR) operator The LAR Enclosure Section 2.4, Description of the Proposed TS modules (OM) and/or the main control room annunciators. Upon receipt of an alarm or abnormal Changes, for TS 3.3.1/Table 4.3-1, will be revised as follows:

conditions, the station operating procedures will require the operators to perform system checks and verify operability of the CPCS deviation / function. The procedure will direct the operator to dispatch a For row TS 3.3.1/Table 4.3-1, the sentence "LTR Appendix B maintenance technician to determine the source of the alarm as needed. provides the detailed justification that demonstrates that the self-diagnostics meet the requirements of 10 CFR 50.36 for the (W3F1-2020-0038 Page 18 of 27) CPCS..."

The NRC staff agrees with the licensees proposed actions in the LAR. So, for this LAR the licensee with should cite both the credited self-diagnostic functions in Appendix B and proposed monitoring activities to justify the SR elimination in Section 2.2 of the LAR, not just the Appendix B. However, "LTR Appendix B along with the Waterford System Engineer and since Section 2.2 of the LAR cites Appendix B to WCAP-18464 as the sole justification for SR Operations Actions Supporting TS SR Reduction (LAR Enclosure elimination (see Enclosure W3F1-2020-0038, Page 5 of 27) and Appendix B does not include any Section 3.4), provides the detailed justification that demonstrates plant monitoring activity, it could lead to the misunderstanding that if the NRC accepts this LAR, it OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION would also be accepting Appendix B as the only basis for the SR elimination. In addition, the LAR that the self-diagnostics meet the requirements of 10 CFR 50.36 for says on Page 18 of 27, in part, that while LTR Appendix B states that monitoring is not required in the CPCS..."

order to credit self-diagnostic features. The NRC staff does not agree with this statement to address the above criterion in BTP 7-17. Furthermore, Appendix B says to leverage the Vogtle LAR for the SR elimination. But, the Vogtle LAR included plant monitoring activities as one of bases for the SR elimination. Therefore, the SR Elimination basis in both Section 2.2 of this LAR and Appendix B will need to include the licensees commitment to perform self-diagnostic monitoring activities and the appendix B interpretations should be revised to establish consistency with the LAR.

2 ST-02 Self-Tests B.2.5 B-6 The bullet item on this page states the following: (Entergy 11/3/20 Update)- PROPRIETARY RESPONSE Open A.

(Jack Zhao, ((

Richard Stattel, ((

Samir Darbali)

))

B. Entergy 11/16/20 Update

((

))

))

3 ST-03 Self-Tests TS 52/377 Insert C includes the following statement: (Entergy 11/3/20 Update) PROPRIETARY RESPONSE Open BASE 81/377 (Jack Zhao, S The performance of channel checks validates that the self-diagnostics are continuing to perform their Richard Stattel, mark- self-checking functions. ((

Samir Darbali) up It is not clear how a channel check can validate performance of self-diagnostics. Please provide clarification to allow the NRC staff to understand how channel checks can validate performance of self-diagnostics.

))

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

((

))

A Channel Check to review that these screens contain no alarms verifies that the system is functioning correctly.

4 ST-04 Self-Tests B.7.1 B-39 Appendix B of WCAP 18464 contains the following statement: (Entergy 11/3/20 Update) PROPRIETARY RESPONSE Open (Jack Zhao, ((

Richard Stattel, This is correct. The sentence in the LTR will be revised as Samir Darbali) follows:

((

))

))

5 ST-05 Self-Tests B.3.2. B-10 The WCAP 18464 states: IEC 60880 is comparable to IEEE 7-4.3.2, and the staff has found IEC 880 Entergy Update 11/16/20 Open 1 to be an acceptable equivalent.

(Jack Zhao, Consistent with Westinghouse WCAP-18461, the following text Richard Stattel, This was a statement in the NRC original safety evaluation of Common Q which has been will be deleted from the LTR (WCAP-18464):

Samir Darbali) superseded. The statement has been removed from the current Common Q platform TR safety evaluation report. "B.3.2.1 Common Q Topical Report - NRC Safety Evaluation The NRC does not consider IEC 880 to be an equivalent to IEEE 7-4.3.2. As such, the NRC The Common Q Platform diagnostics were developed under a evaluates all digital systems to the criteria of IEEE 7-4.3.2. robust process that was reviewed by the NRC. In 2000, the NRC ssued a safety evaluation report (ML003740165, Bibliography 8) on the Common Q Topical Report (CENP-396-P, Rev. 01 which is the predecessor to WCAP-16097-P-A, Reference 4). In that report the NRC acknowledged receipt of Westinghouse document GKWF700777, "Design and Life Cycle Evaluation Report on Previously-Developed Software in ABB AC160, I/O Modules and Tool Software" (Bibliography 9) in support of the commercial dedication of the AC160.

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION The safety evaluation report states that the, AC160 PDS

[Previously Developed Software] is composed of the AC160 software, S600 I/O Module(s) software, and ABB Tool software.

The evaluation is based on the requirements specified in nternational Electrotechnical Commission (IEC) standard IEC-60880, "Software for Computers in the Safety Systems of Nuclear Power Stations." IEC 60880 is referenced in IEEE 7-4.3.2-2003, "IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations". IEC 60880 is comparable to IEEE 7-4.3.2-2003, and the staff has found standard IEC 880 to be an acceptable equivalent.

The Design and Lifecycle Evaluation (DLCE) applies to all aspects of the PDS including the system software that executes the nuclear application program and the diagnostics integrated with the system software. In other words, the same software quality approach applied to both aspects of the system software. The results of this report were discussed with the NRC staff during the icensing of the Common Q platform. The NRC also reviewed this document as part of their review of LAR 19-001 for Vogtle 3&4 (Reference 42)."

6 SA-01 Sys. Req. LAR The licensee provided two CPCS System Requirements Specification (SyRS) documents: the (a) As previously described to the NRC during the Acceptance Open Spec. 3.1 reference CPCS design (Palo Verde) SyRS (00000-ICE-30158 (LAR Attachment 7 and LTR Review discussions:

Reference 2)) and the WF3-specific delta SyRS (WNA-DS-04517-CWTR3 (LAR Attachment 8 and

• The intent of the statements in the Enclosure and LTR, as well (Samir Darbali, LTR 3 LTR Reference 21)). as the entire paragraph in the Enclosure, was to communicate Deanna Zhang) 5-1 that the NRC has reviewed the overall design of the replacement LTR 5 The staff noticed that the SyRS for the reference CPCS design (00000-ICE-30158) revision is CPC system in a previous license amendment (i.e., PVNGS 1, 2, Revision 14. The SyRS that was reviewed as part of the Palo Verde CPCS upgrade is Revision 7. and 3, Amendment No. 150; ML033030363).

• It was not Entergy's intent to state, or even suggest, that the The LAR and LTR make several inaccurate statements regarding which revision of 00000-ICE-30158 specific revision of the reference design document that was used was previously reviewed by the NRC. For example: for the Waterford CPC replacement (i.e., Revision 14) has been reviewed by the NRC, or that the NRC's review of the previous LAR Section 3.1 states: The SyRS project document has a reference design document revision (i.e., Revision 7, submitted in ML032830027) could be (Attachment 7), which has been previously reviewed by the NRC, and a delta document used for the NRC's review of the Waterford project. However, (Attachment 8) which describes differences for the Waterford project. Entergy understands how the wording of the statement is ambiguous in this respect.

LTR Section 5, item b. states: The base system requirements for the WF3 CPCS is the CPCS System Requirements Specification (Reference 2), which have already been reviewed Entergy Update 11/16/20 by the NRC as part of the Palo Verde CPCS replacement.

(b) 00000-ICE-30158, Rev 14, System Requirements LTR Section 5.2.4 states As stated earlier, the reference design for the WF3 CPCS Specification for the Common Q Core Protection Calculator replacement is documented in Reference 2. These requirements and their traceability have System, is the basis document for WNA-DS-04517-CWTR3, already been reviewed and approved by the NRC as part of the Palo Verde CPCS System Requirements Specification for the Core Protection replacement. Calculator System. WNA-DS-04517-CWTR3 is the WF3 delta document for WF3. Requirements traceability is to WNA-DS-Again, these statements are inaccurate because the SyRS that was reviewed for the Palo Verde 04517-CWTR3. When WNA-DS-04517-CWTR3, Rev 0, was CPCS upgrade review is Revision 7 of 00000-ICE-30158. The staff has not reviewed nor performed reviewed and approved for owners acceptance per procedure traceability of requirements for 00000-ICE-30158 after Revision 7. Additionally, the licensee has not EN-DC-149, the applicable sections of 00000-ICE-30158, Rev demonstrated in the LAR or LTR that they have performed these activities. 14, were reviewed. Based on the regression analysis for n-th of kind systems described in WCAP-16096-P, Software Program Clarification questions: Manual for Common Q Systems," the only requirements traceability will be for the modified sections provided in WNA-DS-OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

• (a) Are the statements that the NRC staff had previously reviewed the SyRS (00000-ICE- 04517-CWTR3. There is a VOP audit action to compare the 30158) meant as background information, of for crediting the previous evaluation? non-modified sections of 00000-ICE-30158, Rev 14, to the Requirements Traceability as part of the Requirements

• (b) Is the licensee performing independent design quality, traceability and other oversight Traceability Matrix (RTM) VOP Audit.

activities for:

o 00000-ICE-30158 Revision 7? A regression analysis of the software is at a lower level of review o 00000-ICE-30158 Revisions 8 thru 14? than doing a regression analysis of the System Requirements o or only for the WF3-specific delta SyRS (WNA-DS-04517-CWTR3)? Specification, and WF3 considered this review to be of greater value that a document review since this include the complete

• (c) Slide 37 of the March 19, 2020 pre-application meeting identified the SyRS as a living implementation of any changes. WF3 performed a regression document, as defined in ISG-06 (i.e., a document that will be revised as system development analysis VOP audit of the current Palo Verde code (release 6.7),

activities progress). Please clarify if this statement refers to 00000-ICE-30158, WNA-DS- which was the base line for the WF3 project, to the Palo Verde 04517-CWTR3, or both documents. initial code (release 5.0) to confirm the SPM was followed for design quality, requirements traceability, and IV&V including 10/28/2020 Update: testing.

(a.1) The last sentence of the response states that However, Entergy understands how the wording 00000-ICE-30158, Rev 7 to Rev 13 were not specifically of the statement is ambiguous in this respect. Please explain if the LAR and LTR will be revised to reviewed or audited, since these were not credited for any address the ambiguous wording. vendor oversight activity or project activity. The VOP audit of the regression analysis of the software was considered by WF3 to be the best method to access the difference from the Palo Verde software to be used as the baseline for the WF3 software.

(c) Slide 37 of the March 19, 2020 pre-application meeting identified the SyRS as a living document, as defined in ISG-06 (i.e., a document that will be revised as system development activities progress). This statement refers to only WNA-DS-04517-CWTR3 (a.1) Yes, the LAR Enclosure will be revised per the response to SA-01a.

Yes, the LTR Section 3.3.4, System Requirements Documentation (D.2.3.3 and D.2.3.3.1), will be revised as follows:

From: "Reference 2 is the CPCS System Requirements Document. It is the system requirements specification for the reference design for the Common Q CPCS. The reference design system requirements is based on two requirements documents that define the legacy CPCS functionality:

- Functional Design Requirements for a Core Protection Calculator (Reference 36) and

- Functional Design Requirements for a Control Element Assembly Calculator (Reference 37)

The Common Q CPCS reference design system requirements specification (Reference 2) was developed to migrate the functional requirements of References 36 and 37) to a Common Q CPCS architecture. The result was the Palo Verde CPCS implementation.

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION The existing Waterford CPCS is based on the same two functional design requirements documents (References 36 and 37). Therefore, the CPCS reference design is also applicable to the Waterford CPCS replacement plus additional changes to accommodate plant interface differences, requested licensee improvements, and changes in technology in the Common Q platform."

To: "Reference 2 is the CPCS System Requirements Document for the reference design for the Common Q CPCS. The reference design system requirements is based on two requirements documents that define the legacy CPCS functionality:

- Functional Design Requirements for a Core Protection Calculator (Reference 36) and

- Functional Design Requirements for a Control Element Assembly Calculator (Reference 37)

The Common Q CPCS reference design system requirements specification (Reference 2) was developed to migrate the functional requirements of References 36 and 37 to a Common Q CPCS architecture. The result was the Palo Verde CPCS implementation. Note that Revision 7 of Reference 2 (ML032830027) was reviewed by the NRC.

The existing Waterford CPCS is based on the same two functional design requirements documents (References 36 and 37). Therefore, the CPCS reference design is also applicable to the Waterford CPCS replacement plus additional changes to accommodate plant interface differences, requested licensee improvements, and changes in technology in the Common Q platform. Reference 2 is the current revision of the CPCS System Requirements Document for the reference design.

7 SDP-01 SW Dev Plan LTR Section This section of the LTR states, Any exceptions to the SPM would be documented in the WF3 CPCS Entergy Update 11/3/20 Open RAI, 5.1.1 Software Development Plan (Reference 25). The Software Development Plan also includes (Deanna Zhang clarifications to particular items to make clear how certain aspects of the SPM are being fulfilled. The LTR will be revised to include the following: Audit Samir Darbali) The WF3 CPCS Software Development Plan (WNA-PD-00594- the For the ARP, ISG-06, Rev 2 provides guidance on what should be submitted. This includes a CWTR3) documents the following alternatives to the Common Q SW summary of the application software planning and processes. The LTR does not provide sufficient SPM (WCAP-16096-P-A): Dev.

information to summarize the differences between the SPM and the WF3 CPCS Software Section 5.6.1 of the SPM states: Plan Development Plan in accordance with the guidance of ISG-06, Rev. 2.

1. IV&V phase summary reports: These reports are issued after Please summarize the differences between the SPM and the WF3 CPCS Software Development each life cycle phase of the IV&V task to summarize the IV&V Plan. review. Phase summary reports may be consolidated into a single report if desired. These reports shall contain the following:

a. Description of IV&V tasks performed

b. Summary of task results

c. Summary of discrepancies and their resolution

d. Assessment of software quality

e. Recommendations Alternative:

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION The IV&V activities will be performed at their respective phases per the Software V&V Plan (SVVP); however, the IV&V team will not issue phase summary reports after each life cycle phase. The results of individual tasks are documented, and anomalies are reported in the RITS system for their resolution. A final IV&V report will be issued encompassing all software development phases.

Justification:

Due to the limited scope of the project, which is based on a previously completed reference design, the Concept, Requirements, Design, and Implementation phases are impacted concurrently and iterated frequently. Therefore, having ntermediate summary reports does not produce additional value to the stakeholders than what is already being provided through underlying task reports and RITS. The Phase Summary Report (PSR) is not the only method of gatekeeper for design progression to the next phase. The design can proceed based on the result of the individual tasks. Therefore, the PSR will be produced only once for this project, which will report on all activities, and will serve as the Final IV&V Report. This is an acceptable alternative to SPM Section 5.6.1, since the feedback to design team is provided timely based on formally issued anomalies and other underlying reports.

Section 6.3.2 of the SPM states:

Project-specific software goes to the Lead SW engineer for approval/rejection.

the Lead SW engineer determines the feasibility and appropriateness of project-specific software changes. They sign the form for approval / rejection.

Alternative:

All software modifications shall be documented with a Software Change Request (SCR) via Global Instrumentation and Control ssue Tracking System [RITS]. All functional deviations shall be documented with RITS. Modifications can be initiated because of a change in functional requirements or because of a functional deviation from the intended functional requirements.

The RITS system does not include a method for the Lead SW engineer to approve a software change request; therefore, an alternative approach for approval by the Lead SW engineer or subsystem lead will be taken.

Justification:

RITS that are identified as functional RITS require approval by a software lead and/or subsystem lead for inclusion in a baseline.

The initiator of the functional RITS shall:

• Require a detailed evaluation of the RITS.

• Route the RITS to the software lead or designated subsystem ead for formal approval of the RITS in a baseline through the detailed evaluation.

8 SDP-02 Common Q LTR Section LTR Section 5.1.6 states in part, Appendix 5 of the Common Q Topical Report (Reference 13) is the The LTR Section 5.1.6 will be revised as follows: Open Changes 5.1.6 output document for the change process described in Reference 12. The document provides a OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION summary of changes and then detailed recording of analysis and/or qualification documents, and a There have been no changes to the SPM since its approval by (Deanna Zhang conclusion statement on the status of the change relative to the NRC safety conclusions. Reference the NRC. As a result, the Common Q Record of Changes Samir Darbali) 13 can be audited by the NRC staff... document will not include any assessments of changes to the SPM.

The response to SPM PSAI 6 refers to the Common Q PSAI regarding the record of changes, but it does not address the validity of the previously derived safety conclusions if changes have been made to the Common Q SPM. The response to SPM PSAI 1 refers to the WF3 CPCS Software Development Plan and does not identify if there are any exceptions to the SPM (see the previous open item).

LTR Section 6.2.2.16 provides a list of the current product revisions used for the WF3 CPCS project.

However it does not describe whether the new revisions invalidate any of the safety conclusions in the safety evaluation of the Common Q platform. This section also states that WF3 will review the topical report record of changes document in Reference 13 for adequate qualification documentation that the changes do not invalidate safety conclusions in the safety evaluation of the Common Q platform.

It is not clear whether the WF3 review will verify that safety conclusions for the differences will only be on qualification or whether it would include other topics (e.g., software quality, etc.).

9 SDP-04 SW LTR Section This section states in part, The allocation of CPCS reference design system requirements (a) The RTM only includes requirements on the differences Open Requirements 5.2.5 (Reference 2) to software have already been accomplished as part of the NRC-approved Palo Verde between the WF3 CPCS replacement system/corresponding CPCS replacement. The WF3 delta requirement from the reference design are documented in software requirements and the system (Deanna Zhang Reference 21. These are allocated to software as described in Section 5, item c and documented in requirements/corresponding software requirements in the Samir Darbali) the SRS....Similar to the WF3 system requirements specification, the SRS is independently reviewed, Westinghouse Rev 14 baseline of the CPCS requirements approved and baselined as input to the ongoing life cycle activities. In addition the RTM is updated specification.

showing the tracing of software requirements to the WF3 system requirements specification (Reference 21). (b) (Entergy 11/3/20 Update)

(a) Based on this description, it is not clear whether the RTM only include requirements on the The following summarizes the revisions to 00000-ICE-30158 differences between the WF3 CPCS replacement system/corresponding software requirements and since Revision 7.

the system requirements/corresponding software requirements in Westinghouse Rev 14 baseline of the CPC system requirements specification or whether it includes all CPCS system requirements. Revision 08 This revision was to change the state of the Operating Bypass (b) Given that (1) the WF3 system requirements specification only includes deltas between the WF3 Contact annunciator outputs as a result of field installation. Some CPCS project and the referenced System Requirements Specification of the Common Q Core additional typographical errors and inconsistencies were also Protection Calculator System (0000-ICE-30158), Revision 14, and (2) the System Requirements corrected.

Specification of the Common Q Core Protection Calculator System (0000-ICE-30158) version that Change Summary:

was reviewed and approved during the referenced Palo Verde CPCS Digital Upgrade LAR is Text Main Body Changes Revision 7, it is unclear what types of regression analysis have been performed between the 1. Corrected Figure 2.1-1.

Revision 7 and Revision 14 of the System Requirements Specification of the Common Q Core 2. Section 2.2.1.5.2.2.1: Deleted "or CPP" from the third bullet.

Protection Calculator System to use Revision 14 as the new baseline for the WF3 CPCS project? 3. Section 2.3.9.6.3: Revised discussion of Operating Bypass relays so that form A contacts are used on all outputs.

(c) It is also not clear whether Entergy performed appropriate oversight on the activities related to 4. Table 3.1.1.1.7-1: Deleted CPC Trouble for CEAC processor addressing the differences between Revision 7 and Revision 14 of the System Requirements global memory failure.

Specification of the Common Q Core Protection Calculator System. 5. Section 3.5.3: Revised to define that an availability analysis shall be performed not a reliability analysis.

6. Added requirement for ANSIN45.2.2 Level B storage in new section 3.6.

Appendix Changes:

None OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION Revision 09 This revision only changed page A121 in the Appendix. The change was to clarify the calculation of the row index.

Revision 10 This revision incorporates changes to various display pages based on customer comments.

Change Summary:

Text Main Body Changes

1. Moved table of Contents prior to the Revision Abstract and increase number of entries.

2. Revision 09 was issued with various bookmarks printed as "Error! Reference source not found". Corrected these or removed the reference (pgs 23, 30, 103, 210).

3. Section 1.4.2: Removed revision level on CEAPD SysRS (Ref.

1.4.2.9) and added footnote.

4. Section 2.1: Reworded last bullet and removed Reference to CEAPD SysRS.

5. Section 2.1.1.4.3.4: Clarified and added reference to CEAPD data link section

6. Section 2.1.2.2.4.1: added CEA positions to items transmitted to CEAPD.

7. Section 2.1.2.2.4.3: Removed reference to CEAPD SysRS.

8. Section 2.2.1.4.4: Added requirement for CEA trip snapshot page with live CEA position data.

9. Section 2.2.1.4.6: added CRC value to Addressable Constants page.

10. Section 2.2.1.4.7: added CRC value to Change Addressable constants page.

11. Section 2.2.1.4.12: added missing colon for "Page 3".

12. Section 2.2.1.4.19: defined CEA inputs to be displayed as SUBGRPx on this page.

13. Section 2.2.1.4.20: Corrected spelling of capability.

14. Section 2.2.1.5.2.1.2: clarified trouble alarm occurs for loss of other display.

15. Section 2.2.1.5.2.2: Added alarm icon label to sentence.

16. Section 2.2.1.5.2.2.1 and 2, added OM and MTP CRCs do not agree to trouble list.

17. Section 2.2.2.4: changed heading text and changed requirements for AI calibration testing for CPC, CPP1, and CPP2 functional tests.

18. Section 2.2.2.4: Removed requirement to enable the Exit Functional test icons only if the associated AI calibration is complete. This section was modified to reflect the as implemented software.

19. Section 2.2.2.4.6: added section to describe functional test interlock requirements.

20. Section 2.3: corrected CEAPD description and removed reference.

21. Section 2.3.4.1.3: added missing period to end of sentence.

22. Section 2.3.4.4.3.2: corrected description since CEAPD does not use trip buffer data.

23. Section 3.1.1.1.6.3.1: added "minimum" to description.

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

24. Section 3.1.1.1.9.13: removed reference to CEAPD and added reference to applicable sections.

25. Section 3.1.1.1.9.13.1: Clarified data being sent to CEAPD.

26. Section 3.1.1.1.10.3: defined the CEA position data being sent to CEAPD and usage.

27. Section 3.1.1.1.10.8: added CEA positions to CEAPD cross channel comparison information.

Appendix Changes:

1. Corrected Table of contents to remove "symbol" link after Sec.

3.2.5.6.

2. Pg 116: Added IRPC decision statement to reflect text description.

3. Pg 217: Added definition of CEAIW.

4. Pg 217, 219: Moved all variable definitions to end of section 3.2.6.1.1

5. Pg 220: Clarified that CPOS(i,1) is the CEA position of the current execution cycle.

Revision 11 Change Summary:

Text Main Body Changes

1. Pg 59 clarified the conditions for taking the CEAC snapshot.

2. This revision incorporated changes to the Reactor Power Cutback detection algorithm in Appendix A.

Revision 12 Change Summary:

Appendix Changes

1. Pg A224, added footnote for starting the RPC timer.

Revision 13 Change Summary:

Text Main Body Changes

1. Page 150, incorporated CAPs Commitment 07-285-W006.02 for both CEACs inoperable.

Revision 14 Change Summary:

Text Main Body Changes

1. Re-numbered Sections to match Table of Contents per CAPAL 100074239.

Appendix Changes:

1. Correct QHOT definition in Sections 3.2.4.5 & 3.2.4.16 of Appendix A per CAPS #08-315-W001.

Entergy Update 11/16/20 b) Entergy did not perform a regression analysis between the 00000-ICE 30158 Revision 7 and 00000-ICE 30158 Revision 14 documents. Entergy performed a lower level regression analysis audit of the Palo Verde CPCS software changes between the initial release of the software that was approved by the NRC and the current baseline of the Palo Verde CPCS software. This OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION VOP audit included all software change requests for the Palo Verde CPCS software. These software changes in some cases required a revision to the 00000-ICE 30158. This regression analysis audit is documented in an Entergy regression analysis audit report (AUD-WF3-2019-236-CA058).

There were no hardware design changes to the CPCS since NRC approval.

(c) 10 SDP-03 SW Design LTR Section This section states in part, System Validation Test - this is formal integration testing of the software The intention is to re-run the complete set of PVNGS system tests Open 5.2.8 and hardware performed by the independent test team. The System Validation Test traces the test with the design changes made for the WF3 implementation.

(Deanna Zhang cases to the WF3 CPCS replacement system requirements specification (Reference 21). Therefore, no credit is being taken for past system tests.

Samir Darbali)

Please explain whether the system validation test only includes test cases for the WF3 CPCS replacement system requirements specification or if it also includes the CPCS reference system requirements specification (Rev. 14).

11 VOP-01 Critical VOP Table of It appears that the VOP does not have complete identification of activities for providing oversight of (a) Per VOP Section 7, "The scope of vendor oversight is Open Characteristic Sum Contents the project and will only be a plan to develop or determine them while the expectation is to have the expected to evolve during the project. Project-specific s mary activities and associated acceptance criteria completed. Examples include: performance measures that warrant vendor oversight are

a. Section 6: Development and Assessment of Potential Project and Technical Risk Factors updated as this list changes."

(Deanna Zhang b. Section 7: Determine Performance Measures and Acceptance Criteria (Critical Samir Darbali) Characteristics/Design Artifacts) The performance measures are divided into three categories:

• Critical Characteristics, (a) It is also not clear what oversight activities are associated with Section 7 of the VOP to verify the

• Design Artifacts, and vendor has satisfied the critical characteristics.

• Programmatic Elements.

(b) Section 2 of the VOP Summary states in part The level of vendor oversight follows a graded As listed in VOP Section 7, the following activities are used to approach, based on project and technical risk factors, which are described in VOP Section 6. All provide oversight of the each category:

levels of the graded approach will include specifically defined performance measures and acceptance criteria which are described in VOP Section 7. Based on this description, the project Critical Characteristics:

and technical risk factors and the performance measures and acceptance criteria for the critical characteristics and programmatic elements should already have been identified in the VOP. This " Oversight of critical characteristics utilizes the following vendor does not appear to be consistent with the titles of Sections 6 and 7. oversight activities:

• Conducting vendor audits and quality surveillances (c) It is also not clear based on the title of Section 8 in the Table of Contents for the VOP, what

• Reviewing WEC design output documents Implement Appropriate Oversight Methods will entail.

• Participating in Factory Acceptance Testing

• Conducting Site Acceptance Testing

• Conducting Post-Modification Testing

• Observing or witnessing specific vendor activities

• Capturing issues in WF3/WEC corrective action programs" Design Artifacts:

"Oversight of the design artifacts utilizes the following vendor oversight activities:

• Conducting vendor audits

• Reviewing WEC design output documents (e.g., specifications, drawings, analyses)

• Providing input to and review/confirmation of specific vendor activities and related information items OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

• Coordinating multi-disciplined interactions between various stakeholders

• Capturing issues in WF3/WEC corrective action programs" Programmatic Elements:

"Conducting vendor audits

• Reviewing WEC design output documents

• Providing input to and review/confirmation of specific vendor activities and related information items

• Observing or witnessing specific vendor activities

• Participating directly in specific vendor activities

• Coordinating multi-disciplined interactions between various stakeholders

• Capturing issues in WF3/WEC corrective action programs" (b) The acceptance criteria and oversight activities have been identified in VOP Sections 6 and 7. The VOP is a plan and can be revised pending the design/project evolution. As the design/project progresses, it may be necessary to add more acceptance criteria or design artifacts to conduct adequate vendor oversight.

(c) Section 8 is intended to show escalation of oversight methods based on the risk factors. If the risk factors which are periodically evaluated indicate that risks are increasing, then supplemental oversight methods may need to be used.

12 VOP-02 CPP VOP Section 2 This section of the VOP Summary, states in part, Monitoring, verification and acceptance phase As indicated in VOP Section 2, Vendor Oversight Plan (VOP) Open Sum activities are defined in the Critical Procurement Plan (CPP) during the Planning Phase. Verification Scope, "The CPCS Replacement Project Critical Procurement (Deanna Zhang mary can be either through the normal Receipt Inspection process or other activities outlined in the CPP. Plan (CPP) (Reference 6), prepared under Entergy procedure EN-Samir Darbali) The Critical Procurement Plan provides a summary of the requirements and necessary actions MP-100, Critical Procurements (Reference 13), is incorporated by including on-site services (when required), to ensure that a critical procurement will meet Entergys reference into the VOP."

expectations...The CPP credits the management of procurement risks based on the Westinghouse software verification and validation process, factory acceptance testing, performance of site acceptance testing, and rigorous software testing. QA surveillances will be performed to ensure the approved Westinghouse processes were followed.

Given that the VOP summary states that the CPP will be an input to the VOP, what is the relationship between the CPP and the VOP (e.g., the CPP will be referenced in the VOP or parts of the CPP will be incorporated into the VOP)?

13 VOP-03 Oversight of VOP Section 3 This section of the VOP Summary, states in part, Some of the SPM plans will have project-specific Entergy Update 11/16/20 Open SPM project- Sum instances (i.e., SVVP, SCMP, and Software Test Plan). These project-specific plans will be specific mary evaluated to ensure they are developed in accordance with the SPM. Vendor Oversight Plan Revision 2 was uploaded to Item A-01c for instances reference. VOP section 7 provides some details on how Entergy Please explain what specific activities will be performed by Entergy to review these plans and what will review plans and what acceptance criteria will be used.

(Deanna Zhang the acceptance criteria are. Specifically, subsection Software Verification and Validation Samir Darbali) describes acceptance criteria for software V&V detail.

The VOP Plan includes the use of other Entergy processes and procedures.

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION 14 VOP-04 V&V VOP Section 3 This section of the VOP Summary states that reviews will be performed of V&V for each applicable Entergy Update 11/16/20 Open Sum lifecycle phase for each plan through test. a. VOP Revision 2 was uploaded to item A-01c for reference.

(Deanna Zhang mary Section 2 discusses the overall review process, including the Samir Darbali) a. Please explain what these reviews will entail. For example, will all lifecycle phase design outputs relationship to risk ranking and how items are reviewed. Section 7 be reviewed and will the review only cover the WF3 project specific application without including the (specifically Design Artifacts and Programmatic Elements baseline (e.g., Rev. 14 of the System Requirements Specification of the Common Q Core Protection subsections) discusses the reviews throughout the life cycle Calculator System (0000-ICE-30158))? development.

b. Will Entergy audit the design change packages performed between the previous versions of the n summary, the VOP, when executed by WF3, does ensure that System Requirements Specification of the Common Q Core Protection Calculator System (up to Westinghouse executes the CPCS system and software lifecycle Revision 7) and corresponding design and implementation documentation between those versions? development consistent with the LAR. The execution of the VOP ncludes other processes, and procedure EN-DC-149 is used for owner acceptance of design artifacts.

EN-DC-149 Rev 15 "Acceptance of Vendor Documents" attached n IMS 15 VOP-05 Vendor VOP Section 3 This section lists a number of vendor oversight activities that will be applied to the programmatic Entergy Update 11/16/20 Open oversight Sum elements.

activities mary VOP Revision 2 has been attached to item A-01c for reference.

Please explain how the vendor oversight activities correspond to specific programmatic elements. Section 7 (specifically, Programmatic Elements and Quality (Deanna Zhang Assurance subsections) discuss in detail how vendor oversight Samir Darbali) activities correspond to specific programmatic elements.

16 VOP-06 Criterion VII of VOP All, Section The VOP Summary does not address Appendix B, Criterion VII, Control of Purchased Items and Entergy Update 11/16/20 Open Appendix B to Sum 8 Services and the VOP Summary language is inconsistent with Criterion VII. Please explain:

10 CFR Part mary a. VOP Audits and WF3 Quality Assurance (QA) surveillances 50 a. whether the surveillances planned are consistent with source verification. Source verification (EN-QV-108, QA Surveillance Process) are used in conjunction needs to be performed at intervals consistent with the importance and complexity of the item with the CPCS Replacement Project Critical Procurement Plan (Deanna Zhang or service, and shall include monitoring, witnessing, or observing selected activities. (CPP), CPP-WF3-2019-002, to provide adequate vendor Samir Darbali) b. how the VOP addresses Control of Suppliers Nonconformances including evaluation of oversight as defined in the Vendor Oversight Plan.

nonconforming items, review of nonconformances to procurement requirements or purchaser-approved documents (e.g., technical or material requirement violated, requirement in supplier Per EN-QV-108, a surveillance is "a process of reviewing or documents, which has been approved by the Purchaser, is violated, purchaser disposition of observing an activity, process, or end product to verify that certain supplier recommendation, verification of the implementation of the disposition). actions have been or are being accomplished to obtain desired

c. how supplier evaluation and selection, acceptance of items or services, supplier non results. This includes the terms Monitoring, Observations, conformances, including their evaluation and disposition will be documented. Section 8 of Walk-downs, Site Vendor Audit, and Source Verification. A the VOP Summary, Documentation, is not clear on this. surveillance activity is normally documented as a surveillance report." In addition, "Surveillances may not be used in lieu of a required audit."

b. The VOP incorporates the Critical Procurement Plan (CPP-WF3-2019-002) and specific existing Entergy QA procedures by reference, including EN-QV-108 (QA Surveillance Process). The CPP ensures adequate and timely Supplier QA involvement.

Additionally, Work Tracking items (within Entergy's PCRS program) track development of QA surveillances. Procedure EN-LI-102 controls the Entergy Corrective Action Program.

c. As discussed in VOP-06b, the Critical Procurement Plan (CPP) s incorporated by reference in the Vendor Oversight Plan (VOP).

The CPP provides details Entergy's Supplier QA involvement.

Additionally, within the CPP, an evaluation template is used to evaluate the different categories in the project to discrete criteria.

f that criteria is not currently available, a tracking action is created OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION to ensure the criteria is evaluated and accepted. The CPP is controlled by Entergy procedure EN-MP-100.

17 RT-01 Response LTR Effect of the CPC Response Time on Thermal Margin Degradation (1) Waterford 3 letters W3F1-2015-0040 [Reference 1] and Open Time 3.2.6 W3F1-2015-0061 [Reference 2] submitted a control element Section 3.2.6 of Attachment 4 in the LAR describes the estimated impact of the CPCS delay time on assembly drop time increase request to the NRC. This request (Summer Sun, thermal margin degradation. It indicates that the basis of the estimate is the CEA rod drop time LAR was approved under Waterford 3 license amendment 246 Samir Darbali) submitted in 2015 that increased the CEA rod drop time in the safety analysis an additional 200 ms [Reference 3]. Letter W3F1-2015-0061 provided the limiting due to a hold coil delay that needed to be accounted for. The method used for the CPCS delay time events results with a control element assembly drop time estimate on thermal margin results is to take the thermal margin degradation of the CEA rod drop increase of 200 milliseconds. The W3F1-2015-0040 and 200 ms delay and then extrapolate for the increase in CPCS response times. W3F1-2015-0061 results can be used to extrapolate the new (1) Discuss acceptability of the extrapolation method used to estimate the effect of the CPCS delay CPC time impacts on the analysis results. The letter W3F1-time on thermal margin degradation. 2015-0061 showed small changes for the 200 milliseconds (2) Identify and justify the values of the CPCS delay times used in the thermal margin estimate for and within the acceptance limits. It is reasonable to use the each of the applicable transients and accidents listed in Table 3.2.6-1 of Attachment 4. same extrapolation to judge that the analysis results will (3) Discuss what will be done to assure that the values of the CPCS delay time used in the thermal remain within the acceptance limits (i.e., the largest delay is margin estimate are the limiting values applicable to Waterford 3 when the CPCS is installed for 53.5 msec). In addition, the reload analyses will incorporate operation. the new CPC response times to ensure the accident analyses (4) Discuss and justify what will be done to assure that the thermal margin estimate for the pre- thermal margin requirements cover any analysis impacts.

installed CPCS condition is acceptable, if the values of the CPCS delay time used in thermal margin estimate are not limiting values. References

1. W3F1-2015-0040, License Amendment Request to Revise Control Element Assembly Drop Times, July 2, 2015 [ADAMS 10/15/2020 Update:

Accession Number ML15197A106].

(1.1) Follow-up question to OI 17(1): The last paragraph of the response states that In addition,

2. W3F1-2015-0061, Supplement to Revise Control Element the reload analyses will incorporate the new CPC response times Assembly Drop Times Associated with Technical Specification 3.1.3.4, August 13, 2015 [ADAMS Accession Number Please clarify the methods that will be used for performing the reload analysis.

ML15226A346].

3. NRC License Amendment 246, Control Element Assembly (3.1) Follow-up question to OI 17(3): The first sentence of the response states that The response Drop Times, November 13, 2015 [ADAMS Accession Number times calculated in WNA-CN-00572-CWTR3 for the CPCS are bounded by the current ML15289A143].

response time requirements specified in the reference design (00000-ICE-30158).

11/16/20 Entergy Update Please clarify the adequacy of the response time requirements specified in the reference design in terms of the thermal limits (i.e., DNBR and LHGR) calculation.

(1.1) The actual WF3 CPCS calculated response times will be used as input for the reload analysis.

(2) The identification and justification for the CPCS delay time values in the thermal margin estimate for each applicable transient and accident listed in Table 3.2.6-1 is documented in Westinghouse document LTR-GIC-20-003, Waterford 3 CPCS Response Time Information for FSAR and Technical Specification. A 2nd document, WNA-CN-00572-CWTR3, Core Protection Calculator System Response Time Calculation provides the response time calculation for the WF3 CPCS. Both of these can be submitted to the NRC.

WNA-CN-00572-CWTR3, Core Protection Calculator System Response Time Calculation was attached to the LAR. LTR-GIC-20-003, Waterford 3 CPCS Response Time Information for FSAR and Technical Specification is on the Westinghouse document portal.

See OI 26 (h)

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION (3) The response times calculated in WNA-CN-00572-CWTR3 for the CPCS are bounded by the current response time requirements specified in the reference design (00000-ICE-30158). The response time testing conducted during FAT and post installation testing will confirm that the system meets these response time criteria.

Entergy Update 11/16/20 (3.1) It is LTR-GIC-20-003 that correlates the response time calculated in WNA-CN-00572-CWTR3 to the various CPCS trips. LTR-GIC-20-003 describes the adequacy of the new response time requirements. After further investigation, it was determined that the revised calculated response times are not bounded by the reference design, and the WF 3 SyRS, WNA-DS-04517-CWTR3, needs to specify these new response time requirements. A Westinghouse Corrective Action Issue Report (IR-2020-11971) was issued accordingly.

(4) LTR Section 3.2.6 states, As part of the normal fuel reload process, Waterford runs the safety analysis of record with the WF3 CPCS calculated response times to validate that acceptable margin is maintained. It is the fuel reload process performed under 10 CFR 50.59 that evaluates the results of the rerun of the safety analysis prior to core reload. If the results become more limiting, the analyses results will be evaluated against the 10CFR50.59 criteria. If the 10CFR50.59 criteria requires NRC approval, then a new submittal will be generated. Based upon previous analysis impacts, it is expected that the response time changes will be covered in the reload under 50.59.

In addition, Waterford 3 letter W3F1-2015-0062 [Reference 1]

NRC request for additional information question #8 describes the Westinghouse reload process.

Reference

1. W3F1-2015-0062, Control Element Assembly Drop Times Submittal Request for Additional Information, September 23, 2015 [ADAMS Accession Number ML15268A019].

18 CCF-01 CCF LTR Common Cause Failure Analysis (updated 10/05/2020) (a) The intent of the new paragraphs in Enclosure to Entergy Open 3.2.18 letter number W3F1-2020-0038, dated July 23, 2020, Section 3, (Summer Sun, Section 3.2.18 of Attachment 4 in the LAR discusses the common cause failure (CCF) analysis and Technical Evaluation, sub-section 2, Licensing Technical Samir Darbali, indicates that the original licensing basis for WF3 assumes a potential CCF of the CPCS and that the Report (LTR) is to credit the WF3 ATWS instead of the ANO-2 Richard Stattel, replacements of the current digital CPCS with the Common Q platform does not change the WF3 and PVNGS SEs described in Attachment 4 of the Enclosure to Jack Zhao) licensing basis for defense in depth and diversity (D3) (see LTR page 3-60). In support of the D3 Entergy letter number W3F1-2020-0038 (WCAP-18484-P, CCF analysis for WF3 CPC updates, the licensee quoted the NRC safety evaluation (SE) approving Licensing Technical Report for the Waterford Steam Electric the CCF analysis for the Arkansas Nuclear One, Unit 2 ANO-2 original CPC design and Palo Verde Station Unit 3 Common Q Core Protection Calculator System").

Nuclear Generating Station (PVNGS) CPC replacements (see LTR pages 3-61 and 3-62). The W3F1-2020-0038 Enclosure Section 3, Technical Evaluation, sub-section 2, provides the justification of the LAR Section 2. Licensing Technical Report (LTR), paragraphs 3 - 8 credit the WF3 Anticipated acceptability of crediting ATWS for CPCS failure to trip due to a Transients Without Scram (ATWS) Mitigation Systems described in FSAR Chapter 7.8. These CCF.

paragraphs were added after the draft LAR review pre-application meeting discussions regarding LTR Section 3.2.18. (b)

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION (a) Please explain if the intent of the new paragraphs in LAR Section 2 is to credit the WF3 ATWS (c) Entergy Update 11/3/20 instead of the ANO-2 and PVNGS SEs (LTR pages 3-61 and 3-62). The technical and licensing basis for the existing CPCS are the following sections of the WF3 UFSAR:

In a public meeting held September 22, 2020, the licensee discussed open item 18, Common Cause Failure Analysis, and indicated that it would rely on the information related to the ATWS mitigation

• Chapter 7.2 systems in FSAR Section 7.8 to address the open item 18 for the CCF analysis. (Since the CPCS is an integral part of the Reactor Protective System, the CPCS basis is described throughout the section.

(b) Since the licensee is crediting ATWS, please describe how the ATWS analysis is sufficient to Note Section 7.2.1.1.8 establishes the licensing basis for address a CCF failure of the replacement CPCS for the events which credit the CPCS. diversity against a predictable common failure mode)

(c) Please discuss the current technical and licensing basis for the current digital CPCS and whether

• Appendix 4.3A.5.2 & 4.3A.5.3 the Common Q platform maintains this technical and licensing basis for defense in depth and diversity (D3). To summarize what is described in UFSAR Chapter 7.2.1.1.2.5, the basic architecture for the CPCS is a four channel computer (d) Please address inconsistencies in the LAR and Section 3.2.18 of the LAR Attachment 4 to reflect system (i.e., Core Protection Calculator [CPC]) that calculates the information used for supporting the D3 discussion related to CCF of the CPCS. these parameters and initiates reactor trip signals to the analog reactor protection system. This basic architecture also includes 10/28/2020 Update: two computers (CEAC 1 and CEAC 2) that calculate a CEA position penalty factor used by all four CPC computers.

(d.1) The second paragraph in LAR Section 3, sub-section 2, Licensing Technical Report (LTR),

refers to LTR Section 3.2.18 and the ANO-2 and PVNGS evaluations. Please explain if this The WF3 I&C architecture mirrors the echelons of defense paragraph will also be revised. described in NUREG 6303, Method for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection Systems, to protect the health and safety of the public. The first echelon is 11/10/2020 Update: the non-safety control systems which controls the nuclear plant (c.1) The response to item (c) suggests that conformance with BTP 7-19 is not required. However, process within its technical specification limits. The second echelon of defense is the plant protection system to LAR Section 4.1 Applicable Regulatory Requirements/Criteria lists BTP 7-19. LTR Section 3.2.18 automatically shutdown reactivity and provide heat removal in also identifies BTP 7-19. Please clarify if the LAR and LTR will be revised to remove references to case of an accident. And the third echelon of defense is the BTP 7-19? manual indications and controls to allow operators to manually control the plant. In addition to these echelons of defense, there is an ATWS system to protect the health and safety of the public should an anticipated transient occur without a scram.

This plant modification only impacts the second echelon of defense, the plant protection system, and in particular the reactor protection system. The WF3 operating license allows for a computerized digital system to calculate and initiate a reactor trip on low DNBR and High LPD in support of the WF3 accident analysis, as described in the WF3 UFSAR Chapter 7.2.1.1.2.5.

As summarized above and described in detail in WF3 UFSAR Chapter 7.2.1.1.2.5, the basic architecture for this aspect of the reactor protection system is a four channel computer system (i.e., CPC) that calculates these parameters and initiates reactor trip signals to the analog reactor protection system. This basic architecture also includes two computers (CEAC 1 and CEAC 2) that calculate a CEA position penalty factor used by all four CPC computers. This plant modification does not invalidate the diversity claims in UFSAR Section 7.2.1.1.8.

The Common Q CPCS upgrade preserves this basic architecture but improves upon it by multiplying the number of CEAC computers from two to eight (2 in each channel) to improve system reliability. There are still four independent CPC channels OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION calculating DNBR and LPD as in the existing architecture.

Therefore the D3 strategy for WF3 is not impacted by this plant modification.

There are no plans at this time to replace any of the non-safety plant control systems with the Common Q platform which could potentially impact the WF3 D3 strategy. Should the PPS be replaced with a digital system, then compliance to BTP 7-19 would be required.

(d) Attachment 4 of the Enclosure to Entergy letter number W3F1-2020-0038 (WCAP-18484-P, Licensing Technical Report for the Waterford Steam Electric Station Unit 3 Common Q Core Protection Calculator System"), Section 3.2.18 will be revised to delete reference to the ANO-2 diversity analysis and refer to the LAR for the D3 assessment for the Common Q CPCS.

11/16/20 Entergy Update (d.1) Yes, LAR Enclosure Section 3.2, Licensing Technical Report (LTR) will be revised as part of a LAR Supplement. The following paragraph will be deleted:

"LTR Section 3.2.18 describes the NRC evaluation of the first CPCS at Arkansas Nuclear One, Unit 2 (ANO-2) in NUREG-0308, "Safety Evaluation Report Related to the Operation of Arkansas Nuclear One, Unit 2," Supplement 1 (i.e., the ANO-2 NRC SER) in regards to CPCS Common Cause Failure (CCF).

This was also the evaluation the NRC staff referred to in their PVNGS safety evaluation for the Common Q CPCS upgrade license amendment (Reference 6.10, Section 3.4.6.11). The NRC cited the ANO-2 evaluation to conclude, in part, that CCF is adequately addressed for the Common Q CPCS replacement for PVNGS. The Waterford LTR included this as part of the reference design licensing precedence."

19 TS-01 Clean TS Encl, Cover Clean TS Pages The information on the coversheet of Attachment is incorrect. The Open RCI pages Att 2 page Markup page is correct. There is no intention to submit a Attachment 2 cover page lists 3/4 2-6a as a clean TS page; however, the mark-up and submitted corrected coversheet.

(Tarico Sweat, clean page is numbered 3/4 2-6, not 3/4 2-6a.

Audrey Klett, Samir Darbali) Confirm that this was a typo and that the Attachment 2 list entry should be 3/4 2-6 and not 3/4 2-6a.

20 TS-02 Marked up Encl, Cover Marked up and Clean TS Pages The change to TS 3.10.2 is partially described in the table on Open RAI and Clean TS Att 1 pages page 11 of 27 in the Enclosure to W3F1-2020-0038. The table pages Encl, The cover page of Attachment 1 lists page 3/4 10-2 as having mark-ups; however, the marked up entry for TS 3.10.2 will be enhanced to indicate that the editorial Att 2 version of this page is not provided in the LAR. The cover page of Attachment 2 lists page 3/4 10-2, change for "Functional Unit 15" to "Functional Unit 9c" occurs four (Tarico Sweat, however, a clean version of this page is not included in Attachment 2 (assuming that the licensee times on the page, as shown on the markup. (see below).

Audrey Klett, intended to provide a mark-up of page 3/4 10-2).

Samir Darbali) TS 3.10.2 is being revised in four places to replace "Functional NRC staff requests the licensee to confirm whether it intended to propose changes to this TS page Unit 15" with Functional Unit 9c". This is purely editorial as a result and, if so, to provide the proposed marked up and clean TS pages. of the changes to TS 2.2.1 and 3.3.1 described above, which redesignated the CPCs as Functional Unit 9c in Tables 2.2-1 and 3.3-1.

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION The Markup and Clean copies were inadvertently absent from the LAR submittal and will be provided along with the revised table entry with the next docketed CPC correspondence. Copies attached to this response.

21 EQ-01 Oversight of VOP In the earlier pre-submittal meetings, the licensee stated that it would include the equipment The VOP Summary (included with the LAR) Section 5.1, Critical Open Audit EQ Sum qualification (EQ) for some unqualified items as a licensee commitment. But, in the final pre- Characteristics, includes Environmental Critical Characteristics. In the mary submittal meeting, the licensee did not include the commitment and stated that EQ would be addition, VOP Section 5.2, Design Artifacts, includes review of EQ (Jack Zhao, performed as part of the VOP. The VOP Summary does not describe how the VOP will cover the Westinghouse design documents. This section provides examples part of Deanna Zhang, equipment qualification for the unqualified items. Please clarify which VOP Summary section of Westinghouse design documents including the System the Samir Darbali) includes the oversight of EQ. Requirements Specification (SyRS), Software Requirements VOP Specification (SRS), etc. Another example, not listed, includes the Equipment Qualification Summary Report (EQSR).

Note that VOP Section 7, Determine Performance Measures and Acceptance Criteria, includes oversight of EQ. The Environmental Critical Characteristics section includes acceptance criteria which will be evaluated as part of vendor oversight. In addition, the Design Artifacts section includes a review of the Westinghouse Equipment Qualification Summary Report (EQSR) per Entergy procedure EN-DC-149, Acceptance of Vendor Documents.

22 EQ-02 GDC 4 LAR Section 4 Please clarify why the applicable GDC 4 was not addressed and evaluated in Section 4 of the LAR. 11/16/20 Entergy Update Open (Jack Zhao, A LAR Supplement will contain a revision to LAR Section 4, Samir Darbali) Regulatory Evaluation. This revision will include the following:

"10 CFR 50, Appendix A, GDC 4 requires that the core protection calculator system (CPCS) be designed and qualified to operate under the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, ncluding loss-of-coolant accidents. The protection system shall also be appropriately protected against dynamic effects. The CPCS equipment qualification is contained in the Equipment Qualification Summary Report (EQSR) which is referenced in the LTR (Reference 35)."

23 EQ-03 CPCS Attach Section 2.1 In Section 2.1 it says that the CPCS primary digital components identified in Table 2.1-1 are The following components are covered by the subsequent EQSR: Open components ment addressed. Please list the components which are not addressed in Attachment 11. ((

Not Listed in 11 Table 2.1-1 (Jack Zhao, Samir Darbali)

))

24 EQ-04 EQ Attach Section 3 In Section 3 it says that an assessment was performed for seismic, environmental, and EMC 11/16/20 Entergy Update Open assessments ment qualification in Reference 10 and 11 of Attachment. But, except the conclusion statement in 11 Attachment 11, no summary of these assessments is provided. References 10 and 11 will are now in the Westinghouse ERR.

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION (Jack Zhao, Samir Darbali) Please submit on the docket either References 10 and 11 or their assessment summaries for the staffs evaluation.

25 EQ-05 Licensees EQ Attach Attachmen In Attachment 11, it says a few times that the qualification of all components used in the final CPCS (a) The LTR, Section 4, states, Further equipment qualification Open Summary ment t 11 design will be addressed in the CPCS equipment qualification summary report for Waterford Unit 3 testing and/or analysis of lower level CPCS equipment such Report for 11 and will not be addressed in this report (i.e., Attachment 11). However, according to Section D.3 of as HSL modems, power supply assembly, interposing relays CPCS ISG-06, which says that The NRC staff should verify that the licensee has demonstrated that the is required after the detailed hardware design is complete.

system will perform its safety functions under the design-basis conditions at the location in which the (Jack Zhao, equipment will be installed. This information should be found in equipment qualification test plans, Attachment 11 summaries the generic qualification performed Samir Darbali) methodologies, and test reports. on the Common Q platform to demonstrate that the platform can meet site environmental requirements. The subsequent (a) Please explain the difference between Attachment 11 (Qualification Summary Report for EQSR is to summarize the EQ for the detailed design Waterford Unit 3) and the CPCS equipment qualification summary report for Waterford Unit 3 being implementation of the CPCS. (See the response to OI #23) referred to.

(b) The EQ Summary report referenced in the LTR, EQ-QR-400-(b) Please explain when the licensees CPCS equipment qualification summary report will be CWTR3, Rev 0, "Core Protection Calculator System Primary submitted for evaluation. Digital Components Qualification Summary Report for Waterford Unit 3" was attached to the LAR.

The EQ Summary report for additional items, EQ-QR-412-CWTR3, Revision 0, "Core Protection Calculator System Upgrade Project Equipment Qualification Summary Report for Waterford Unit 3" is now available and is in the Westinghouse ERR per request A-01 n.

26 A-01 Audit Audit Documents #1: Please have the following information readily available and accessible for the Comments from the licensee or staff on each portal document. Open Audit Documents NRC staffs review via an internet-based portal: a.

b. Staff: Provided in the WEC SharePoint Everyone a. Licensee documentation of Common Q platform changes assessment activities performed c. Licensee: Waterford 3's Vendor Oversight Plan (VOP-WF3-in accordance with PSAI 6.17 response. (See WCAP-18484 LTR Section 6.2.2.16) 2019-00236) Revision 2 has been uploaded to this response.

Of particular note, VOP section 7 discusses how WF3 will

b. Common Q Record of Changes document - Updated version of Reference 19 to the review the Common Q record of changes (Physical Critical Common Q platform safety evaluation, (ADAMS accession No. ML20020A003) (Reference 13 Characteristics subsection), how WF3 will verify Westinghouse of LAR). complies with requirements in the SPM (Design Artifacts and

c. The VOP and other documents that are referenced in the VOP that encompass the Secure Development Environment subsections), and licensees plan for performing oversight of the vendor for the development of the CPCS. documents that the response time will be confirmed to meet These documents should demonstrate how the licensee will perform vendor oversight in the SyRS (Performance Critical Characteristics subsection).

relation to the following system and lifecycle development activities: d. Staff: Located in WEC SharePoint

e. Staff: Located in WEC SharePoint o Review of the current Common Q Record of Changes f. Staff: See Attachment 1 of the VOP and WEC SharePoint o Verification that Westinghouse complies with the requirements in the SPM for a Entergy Uploaded Organization chart to IMS (11/3/20 Update) secure development environment g. Entergy Uploaded to IMS (11/3/20 Update)

h. Staff: Provided in response to OI 17.2, WEC Uploaded to o Equipment Qualification SharePoint (11/3/20 Update) o Verify that Westinghouse properly propagates the response time requirements . Entergy: There is not a WF3 CPC project-specific Software through the design, implementation, and test of the replacement CPCS Safety Plan, Section 3, Software Safety Plan, of the Common Q Software Program Manual is followed. WCAP-16096-P R5

d. Software Development Plan for the Core Protection Calculator System Upgrade, WNA- is the SPM used for the CPC project.

PD-00594-CWTR3 . Licensee: Entergy upload to IMS 10/19/20

k. Staff: Located in WEC SharePoint

e. Configuration Management Plan for the Core Protection Calculator System Upgrade

. Staff: Provided in the WEC SharePoint Project, WNA-PC-00069-CWTR3 m. WEC Uploaded to SharePoint (11/3/20 Update)

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION

f. Westinghouse organization chart, as referenced in LTR Section 5.2.12, Software V&V n. Staff: Provided in the WEC SharePoint Processes o. Staff: Provided in the WEC SharePoint

p. Entergy Uploaded to IMS (11/3/20 Update)

g. Control Panel 7 & 2 Cyber Security Door Lock Plan, ENT-WF3-CPC-115 q. Entergy Uploaded to IMS (11/3/20 Update)

r. Entergy Uploaded to IMS (11/3/20 Update)

New for 9/30/2020 s. Entergy Uploaded to IMS (11/3/20 Update)

h. Document that identifies and justifies the values of the CPCS delay times used in the t. Entergy Uploaded to IMS (11/3/20 Update) thermal margin estimate for each of the applicable transients and accidents listed in Table u. Entergy Uploaded to IMS (11/3/20 Update) 3.2.6-1 of Attachment 4. v. Entergy Uploaded to IMS (11/3/20 Update)

w. WEC Uploaded to SharePoint (11/3/20 Update)

i. N/A Software Safety Plan for the Core Protection Calculator System Upgrade x.

j. SPEC-10-00001-MULTI, 73.55 Fleet Strategy Implementation - Fiber Optic Cable y.

Common-Procurement Specification (Reference 40 of the LTR) z.

k. AC160 CPU Loading Restrictions, Document Number AN03007Sp (SyRS Reference aa.

1.4.2.12) bb.

cc.

New for 10/15/2020

l. Project Management Plan for the Waterford 3 Core Protection Calculator Upgrade, GPEP-PMP-2019-000020, Revision 1

m. WF3 Project Quality Plan New for 10/28/2020

n. Subsequent EQSR (see open item 23)

o. Waterford Unit 3 Common Q Implementation - Non-LOCA Evaluation of Updated CPCS Response Times, LTR-TA-20-4, Revision 0 (LTR Reference 24)

p. PO 10587546 - CPC, CEAC, CEAPDS Single Channel and Four Channel Components

q. PO 10591996 - Input / Output (I/O) Simulator Components

r. SPEC-18-00005-W, Rev 0

s. CPCS Replacement Project Critical Procurement Project (CPP), CPP-WF3-2019-002 (WTWF3-2019-00236)

t. EN-MP-100, Critical Procurements

u. EN-DC-115, Engineering Change Process

v. EN-IT-104, Software Quality Assurance Program

w. 00000-ICE-36369, Rev. 02, CPC Timing Analysis for the Common Q Core Protection Calculator System New for 11/10/2020

x. EN-DC-149, Acceptance of Vendor Documents

y. Waterford 3 Core Protection Calculator System Safety Function Table, LTR-TA-19-154, Revision 0 27 A-02 Audit 1. Requirements Traceability Demonstration - show how requirements from the reference CPCS The plan is to re-run the complete set of PVNGS system tests Activities design (Palo Verde) SyRS (00000-ICE-30158) and the WF3-specific delta SyRS (WNA-DS-04517- with the design changes made for the WF3 implementation.

CWTR3 are traced all the way through testing. Therefore, no credit is being taken for past system tests Everyone conducted for the Palo Verde CPCS. This would in effect, re-run all the system tests that support the original Palo Verde OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY - PROPRIETARY INFORMATION requirements tracing to system test including the test mentioned in NRC OI 30 (SA-03).

28 A-03 VOP Audit VOP Audit Discussion Requests: (Entergy 11/3/20 Update)

Activities 1. Discuss definitions of acronyms such as FME and DWGS. 1. The acronym FME is Foreign Material Exclusion. The Critical

2. Discuss responsibilities of Entergy CPCS Project Digital or I&C Engineer in Section 5 Procurement Plan describes project considerations in (Deanna Zhang 3. Discuss risks identified in Table 5-1; specifically the risk associated with Hazards accordance with Waterford's FME program.

Samir Darbali) 4. Walk through of Section 7 and discuss performance measures, acceptance criteria and their relationships to specific oversight activities The acronym DWGS is for drawings.

29 SA-02 CPU Load LTR 3-34, 3-35 (( Entergy Update 11/16/20 Limit 3.2.7.

2.7 Regarding to the requirement that the AF100 interface (CI631)

(Samir Darbali) must be in slot 2 of the AC160 rack, is defined in the SyRS in the architecture drawing, and therefore was not specifically explained n the LTR. All of the Westinghouse standard architectures, ncluding the AP1000 PMS and the reference design CPCS has the CI631 in slot 2 of the AC160 rack.

Regarding the requirement that the CI615/CI610 not be used, these are not used in the CPCS architecture, and so was not mentioned here.

))

30 SA-03 CPU Load (( Entergy Update 11/16/20 Limit / VOP

)) The VOP does not ensure this. The Requirements Traceability (Samir Darbali, Matrix (RTM) ensures this design restriction is met (implemented Deanna Zhang) and performed). The VOP audits verify the RTM has been completed.

OFFICIAL USE ONLY - PROPRIETARY INFORMATION