Text

Digital Modernization Project LAR Pre-submittal Meeting Presentation Slides October 20, 2021
	ML21278A545
Person / Time
Site:	Limerick
Issue date:	10/20/2021
From:	; Exelon Generation Co, Westinghouse
To:	Bhagwat Jain, V Sreenivas; NRC/NRR/DORL/LPL1
	Sreenivas V
References
	EPID L-2020-LRM-0041 GLIMM-RPS-PM-L1-000004, Rev 0
	Download: ML21278A545 (57)
	v • d • e

Limerick Generating Station Digital Modernization Project LAR Pre-submittal Meeting NRC Pre-submittal Meeting October 20, 2021

Agenda / Opening Remarks Open / Public Session

Introductions

Project update/schedule

License Amendment Request (LAR) content overview Closed Session Sensor Consolidation Defense-in-Depth and Diversity (D3) Approach

Introductions - Exelon Project Team Licensing Dave Helker, Licensing Manager Frank Mascitelli, Licensing Lead Laura Lynch, LGS Regulatory Assurance Manager George Budock, LGS Regulatory Assurance Pareez Golub, Digital Licensing SME Engineering John Connelly, Central Design Organization (CDO) Manager Mark Samselski, CDO - Lead Responsible Engineer George Bonanni, CDO - Senior Staff Engineer Mike Foote, CDO - Senior Staff Engineer Scott Schumacher, Systems Engineering Suzanne Loyd, Risk Management

Introductions - Exelon Project Team Project Management Steve Hesse, Project Director Dave Molteni, Senior Manager and Station Lead Jerry Segner, Principal Project Manager Kayla Marriner, Project Manager Operations Paul Krueger, Operations Nuclear Oversight Dave Peiffer, Performance and Assessment Lead

Introductions - Westinghouse Project Team Project Management Chris Crefeld, Project Director Dominic Mocello, Project Manager Tom Pietryka, Program Manager Samantha Heffner, Project Manager Engineering Terry Tuite, PPS Lead - Engineering Dan Zenger, DCS Lead - Engineering Warren Odess-Gillett, Lead - Licensing Steve Seaman, System Integration Lead Cal Tang, BWR Technical Advisor Steve Merkiel, PPS System Design Engineering

Project Update

Project Timeline

LAR Contents

Cover letter

Required information per ISG-06 Alternate Review Process Appendix B

Description and reason for the proposed TS changes

Site Acceptance Test (SAT) Description

System Engineer and Operations Actions Supporting TS SR Reduction

Regulatory commitments (currently none)

Conceptual FSAR Mark-ups (Info Only)

Licensing Technical Report (LTR) Proprietary and Non-proprietary versions

- LGS PPS FMEA to support TS SR eliminations (FMEDA is in WEC WCAP 18461-P)

- RRCS re-classification per 10 CFR 50.62 justification LAR Submittal Contents

D3 analysis

Technical Specification markups and clean pages

Technical Specification Bases markups (info only)

Initial Equipment Qualification Summary Report (EQSR)

PPS System Requirements Specification (SyRS)

PPS System Design Specification (SyDS)

CIM Diversity Analysis

Human Factors Evaluation

VOP Summary LAR Submittal Contents (cont'd)

PPS RTM (Requirements Phase)

Project Management Plan for the Limerick Generating Station Plant Protection System

PPS Software Development Plan

Digital Modernization Project Configuration Management Plan

Evaluation of Common Cause Failure Susceptibility of Component Interface Module

PPS Reliability Analysis

PPS Response Time Analysis

PPS Preliminary Software Hazard Analysis

Control & Information System Engineering System Quality Assurance Plan

HFE Reports (addressing NUREG-0711 elements)

Documents Complete at Time of LAR Submittal

Closed Portion

System Integration

High Level Architecture Requirements Current Design

- The protection system contains Functional Diversity that provides robust protection from Common Mode Failures

- This was evaluated in NEDO-10189 (1970), An Analysis of Functional Common-Mode Failures in GE BWR Protection and Control Instrumentation Purpose Provides an assessment of the degree of resistance of the General Electric Boiling Water Reactor protection system to unknown common-mode failures resulting in loss of the primary protection initiation signals.

Proposed Design

- Compliant with current IEEE standards, GDCs, BTP 7-19

- Functional diversity of RPS/ECCS/NSSSS is maintained

- Functional segregation of RPS/ECCS/NSSSS is maintained

- Required system (hardware and software) diversity is in accordance with current (Digital I&C) Standards

Enabling Features of the Digital System Communication Among Divisions

- Maintains Electrical Isolation

- Robust failure detection

- Meets Digital I&C requirements (e.g., IEEE 603, IEEE 7-4.3.2, ISG-04)

- Enable each Division to use data from all Channels Improved Reliability

- Subsystems and communication paths are redundant

- Robust self-test continuously monitors the health of the system &

alarms are presented to the operator

- Full system functionality maintained with a single failure Software Common Cause Failure Addressed (Beyond Design Basis)

- D3 analysis is performed in accordance with NUREG/CR-6303

- Diverse protection features are included in proposed design a,c

Enabling Common Q Features of the Digital System a,c

Sensor Allocation a,c

Independent Setpoints Maintained Current Design Two sensors used Three Trip Units used because different setpoints are required and one sensor is shared Trip Units implemented in different hardware GDC 22, "Protection System Independence" & IEEE-603-1991 GDC 23, "Protection System Failure Modes" Sensor 1 Sensor 2 Function 1 Function 2 Current Design Function 3 Trip Unit 1 Trip Unit 3 Trip Unit 2 a,c a,c

General Architecture Comparison

- Actuation from One Division Current Design Four sensors used Pairs of sensors are powered from divisional sources Current Design

- HPCI 4 Sensors in two separate divisions 1/2 1/2 2/2 a,c

General Architecture Comparison

- Actuation from Two Divisions Current Design Four sensors used (2 in each division)

Pairs of sensors powered from the same division as the actuation Current Design

- ADS 2 Sensors in Each Division 2/2 2/2 a,c

Independence of Division Logic Representative Example of Water Level Instrumentation Separate sensor for each function; however, in some cases sensors are shared between functions. All in one division.

In some cases, bistables are shared between functions.

No cross-channel voting Separate Process Logic Separate Actuation Devices RG 1.153, IEEE-603-1991, RG 1.1.52, IEEE-7-4.3.2-2003, RG 1.53, IEEE-379, RG 1.75, IEEE-384 RPS Process Logic ECCS Process Logic Current Design NSSSS Process Logic

Reference M-0042 Sht. 2 Table I & Table II a,c a,c

Reliability Block Diagram Methodology A full system reliability analysis utilizing the Reliability Block Diagram (RBD) method of the new proposed Plant Protection System (PPS) shall be performed from sensors through to the PPS outputs to ensure system reliability goals are achieved.

A Reliability Block Diagram is a pictorial representation of a systems reliability performance.

It shows the logical connection of (functioning) components needed for system success.

A RBD is drawn as a series of blocks connected in parallel or series

- Parallel blocks are redundant subsystem

- Each block has a failure rate The reliabilities are combined using standard formulas For non-redundant components, the system failure rate is the sum of the component failure rates:

=

=1

For redundant components, the system failure rate is given by the equation:

=

n! ()+1 n q 1 ! ()

Reliability Evaluation Example a,c

Key I&C Design Criteria Summary GDC 22Protection system independence, RG 1.153, IEEE-603-1991, RG 1.152, IEEE-7-4.3.2-2003, RG 1.53, IEEE-379, RG1.75, IEEE-384 Four independent measurement channels with sensors, sensor power supplies, signal conditioning units, and bistable trip functions are provided for each protective parameter monitored by the protection system.

Four redundant protection channels remain independent from one another and no accident condition resulting in changes to the mechanical or thermal environment will interfere with their independence. Power to the protection system is provided by four independent safety related power supply buses.

GDC 23Protection system failure modes The PPS RPS trip divisions are designed to fail into a safe state in the event of loss of power supply. A failure is assumed to occur in only one division (i.e., a single failure).

The PPS-Emergency Core Cooling System (ESFAS) divisions are designed to fail into a safe state in the event of loss of power supply. A failure is assumed to occur in only one division (i.e., a single failure).

GDC 24Separation of Protection and Control Systems There is separation between the plant protection system and the control systems. Outputs from the control system components and channels are not used as protection system inputs. The sensors, trip channels, and trip logics of the protection system are not used for automatic control of process systems. A failure in the controls and instrumentation of process systems cannot induce failure of any portion of the protection system.

GDC 29Protection against anticipated operation occurrences Plant events have been considered in the design of the protection systems.

Consideration of redundancy, independence and testability in the design, coupled with careful component selection, overall system testing, and adherence to detailed quality assurance requirements assure that safety functions are accomplished in the event of anticipated operational occurrences (AOOs).

Drywell Pressure Instrumentation Example a,c

Diversity and Defense in Depth (D3) Approach

Defense-in-depth and Diversity (D3)

In a previous NRC pre-submittal meeting, examples of D3 CCF Coping analyses were presented:

Performed using NUREG/CR-6303 for each UFSAR Chapter 15 Accident Analysis event identifying:

Automatic control actions that would not occur due to CCF Automatic control actions outside of PPS Diverse displays and alarms for operator entry to EOPs Applicable operator actions per EOPs / Plant Operating Procedures Diverse features needed for mitigation of the event Required diverse functions to be implemented in a separate and diverse non-safety DCS platform (Ovation)

DPS Diverse Functions from CCF Coping Analysis a,c

Defense-in-depth and Diversity (D3) a,c

Position 4 Displays and Controls

Position 4 Displays and Controls Position 4 of the NRCs position on D3 in SRM/SECY-93-087 and BTP 7-19 states that the applicant shall provide a set of displays and controls in the Main Control Room (MCR) for manual system-level actuation of critical safety functions and monitoring of parameters that support the safety functions. This section defines the Position 4 diverse controls and displays for the critical safety functions.

BTP 7-19 Section 1.2, Position 4 states the following:

A set of displays and controls located in the main control room shall be provided for manual, system-level actuation of critical safety functions and monitoring of parameters that support the safety functions. The displays and controls shall be independent and diverse from the safety computer system identified in items 1 and 3 above.

SECY-93-0087 identified the following critical safety functions to be managed from the MCR in accordance with Position 4:

reactivity control

core heat removal

reactor coolant inventory

containment isolation

containment integrity Each of these critical safety functions are examined, minimum diverse controls to achieve each critical safety function, and displays to monitor the performance of these functions from the main control room are defined. It is possible that some of these controls and displays overlap those identified from the Chapter 15 coping analyses (presented previously).

Summary Results for Diverse Controls to Address Position 4 a,c

Summary of Diverse Controls to Address Position 4 (cont.)

a,c

Summary of Position 4 Displays a,c

Summary of Position 4 Displays (cont.)

a,c

Spurious Actuation Analysis

Spurious Actuation Analyses The following protection function spurious actuations were selected for analysis based on the adverse impact the spurious actuation can have on the reactor pressure vessel and containment:

Acceptance Criteria From BTP 7-19: "For those postulated spurious operations that have not been fully mitigated or eliminated from further consideration, the consequences of spurious operation of safety-related components... are bounded by the acceptance criteria defined in the FSAR or the LAR."

a,c a,c

Spurious Actuation Analyses a,c

Spurious Actuation Analysis Example

Spurious Actuation of LPCI Event: Four loops of LPCI mode of RHR spuriously actuates Initiating Event LPCI spuriously actuates at a reactor pressure below its pump shutoff head conditions and injects into the reactor. The main turbine and feedpump turbines are off-line at low pressure conditions.

Spurious Actuation of LPCI (cont.)

a,c

Spurious Actuation of LPCI (cont.)

a,c

Additional Diverse Indications and Controls from Spurious Actuation Analysis a,c

Application of PRA

Additional Analyses - Risk Management PRA impact reviews are a required part of the Exelon modification design process

- Stakeholder Identification and Engagement section of the Exelon Design Change Manual outlines PRA review process for plant modifications

- Risk Management personnel review the impacts of the changes on the PRA models (internal events, fire, etc.)

- If significant impacts are identified, actions are created to reduce the impact to risk After modification installation, PRA models will be updated to reflect as-built design and must meet requirements in R.G. 1.174 to support current risk-informed applications Exelon Risk Management staff are engaged with the design team and are evaluating potential impacts of the design on the current models Early review of the design is key to ensuring R.G. 1.174 requirements are met for Risk-Informed Programs

Next Presubmittal Meeting

Potential Topic Areas for next Presubmittal Meeting

MCR Human-System Interface and Human Factors Engineering

VOP update

Project status update

Technical Specifications

Diversity and Defense in Depth (continued)

Follow-up items identified from previous meetings

Closing Comments

Acronyms Acronym Definition ADS Automatic Depressurization System AER Auxiliary Equipment Room AOI Advant Ovation Interface ARI Alternate Rod Injection ARP Alternate Review Process ASAI Application Specific Action Item ATWS Anticipated Transient Without Scram BPL Bistable Protection Logic BWR Boiling Water Reactor CAP Corrective Action Program CCF Common Cause Failure CDO Central Design Organization CRDR Control Room Design Review CIM Component Interface Module CRADA Cooperative Research and Development Agreement CPU Central Processing Unit CS Core Spray D3 Defense-in-Depth and Diversity DCS Distributed Control System DDS Data Display System DEHC Digital Electro-Hydraulic Control DPS Diverse Protection System ECCS Emergency Core Cooling System EDG Emergency Diesel Generator EOP Emergency Operating Procedures EQSR Equipment Qualification Summary Report ESFAS Emergency Safety Function Actuation System

Acronyms (cont'd)

Acronym Definition FMEA Failure Modes and Effects Analysis FMEDA Failure Modes, Diagnostics, and Effects Analysis FPGA Field Programmable Gate Array FSAR Final Safety Analysis Report HFE Human Factors Engineering HPCI High Pressure Core Injection HSL High Speed Link IBR Incorporated by Reference ILP Integrated Logic Processor INL Idaho National Labs I/O Input/Output ITAAC Inspection, Test, Analysis, and Acceptance Criteria LAR License Amendment Request LCL Local Coincidence Logic LGS Limerick Generating Station LOOP Loss of Offsite Power LPCI Low Pressure Coolant Injection LRA Licensee Required Action LTR Licensing Technical Report MCR Main Control Room MPB Manual Partial Bypass MPT Manual Partial Trip MSFIS Main Steam and Feedwater Isolation System MSIV Main Steam Isolation Valve NSR Nonsafety-related NSSSS Nuclear Steam Supply Shutoff System OBE Operating basis earthquake PC Personal Computer PMS Protection and Monitoring System PPC Plant Process Computer

Acronyms (cont'd)

Acronym Definition PPS Plant Protection System PSAI Plant Specific Action Items QA Quality Assurance QMP Quality Management Plan RAI Request for Additional Information RCIC Reactor Core Isolation Cooling RHR Residual Heat Removal RPS Reactor Protection System RPV Reactor Pressure Vessel RRCS Redundant Reactivity Control System RWCU Reactor Water Cleanup SER Safety Evaluation Report SFMS Supplier Fundamental Management System SDC Shutdown Cooling SDV Scram discharge volume SLCS Standby Liquid Control System SPDS Safety Parameter Display System SPM Software Program Manual SR Safety-related SRNC Safety Remote Node Controller SRV Safety Relief Valve SSE Safe Shutdown Earthquake SyDS System Design Specification SyRS System Requirements Specification TS Technical Specifications TU Trip Unit UFSAR Updated Final Safety Analysis Report VOP Vendor Oversight Plan WEC Westinghouse

Backup MCR Pictures

Current Main Control Room Configuration

General Arrangement for Main Control Room

Reserved for RG 1.97 Potential Arrangement with Monitor Visuals

OVATION DISPLAY Potential Arrangement with View from RO Console

Reserved for RG 1.97 Potential Arrangement with View from SRO Station

v t e Letter Sequence Meeting
EPID:L-2020-LRM-0041, TSTF-564 (Open)
Initiation Request, Request Acceptance... Administration Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting Questions Answers Results Approval... Other: ML20175A240, ML21123A136, ML22089A116, ML22089A117, ML22124A286
MONTHYEAR2021-06-23 [Table View]

ML21278A545

Text

Navigation menu

Search