ML22348A105
| ML22348A105 | |
| Person / Time | |
|---|---|
| Issue date: | 11/29/2022 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| References | |
| NRC-2189 | |
| Download: ML22348A105 (1) | |
Text
Official Transcript of Proceedings NUCLEAR REGULATORY COMMISSION
Title:
Advisory Committee on Reactor Safeguards Docket Number:
(n/a)
Location:
teleconference Date:
Tuesday, November 29, 2022 Work Order No.:
NRC-2189 Pages 1-99 NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers 1716 14th Street, N.W.
Washington, D.C. 20009 (202) 234-4433
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 www.nealrgross.com 1
1 2
3 DISCLAIMER 4
5 6
UNITED STATES NUCLEAR REGULATORY COMMISSIONS 7
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 8
9 10 The contents of this transcript of the 11 proceeding of the United States Nuclear Regulatory 12 Commission Advisory Committee on Reactor Safeguards, 13 as reported herein, is a record of the discussions 14 recorded at the meeting.
15 16 This transcript has not been reviewed, 17 corrected, and edited, and it may contain 18 inaccuracies.
19 20 21 22 23
1 UNITED STATES OF AMERICA 1
NUCLEAR REGULATORY COMMISSION 2
+ + + + +
3 701ST MEETING 4
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 5
(ACRS) 6
+ + + + +
7 TUESDAY 8
NOVEMBER 29, 2022 9
+ + + + +
10 The Advisory Committee met via 11 Videoconference, at 1:00 p.m. EST, Joy L. Rempe, 12 Chairman, presiding.
13 14 COMMITTEE MEMBERS:
15 JOY L. REMPE, Chairman 16 WALTER L. KIRCHNER, Vice Chairman 17 RONALD G. BALLINGER, Member 18 VICKI M. BIER, Member 19 DENNIS BLEY, Member 20 CHARLES H. BROWN, JR., Member 21 VESNA B. DIMITRIJEVIC, Member 22 GREGORY H. HALNON, Member 23 JOSE MARCH-LEUBA, Member 24 MATTHEW W. SUNSERI, Member 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
2 ACRS CONSULTANT:
1 STEPHEN SCHULTZ 2
DESIGNATED FEDERAL OFFICIAL:
5 ALSO PRESENT:
6 MIKE BALAZIK, NRR/DANU/UNPL 7
JEFF BARTELME, SHINE Medical Technologies 8
ERIC BENNER, NRR/DEX 9
JOSH BORROMEO, NRR/DANU/UNPL 10 MICHAEL EUDY, RES/DE/RGPMB 11 CATHERINE KOLB, SHINE Medical Technologies 12 KIM LAWSON-JENKINS, NSIR/DPCP/CSB 13 KHOI NGUYEN, NRR/DEX/ELTB 14 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
3 T-A-B-L-E O-F C-O-N-T-E-N-T-S 1
PAGE 2
- 1) Opening Remarks by the ACRS Chairman (Open) 3 (JLR/LJB) 4 1.1)
Opening Statement 4
5 1.2)
Agenda and Items of Current Interest 6
6 7
- 2) Draft Guide (DG)-1374, "Criteria for Use of 8
Computers in Safety Systems at Nuclear Power Plants" 9
(Open) (CB/CA) 10 2.1)
Subcommittee Chairman remarks 7
11 2.2)
Presentation and discussions with NRC staff 8
12 13
- 3) Committee Deliberation on DG-1374, "Criteria for 14 Use of Computers in Safety Systems at Nuclear Power 15 Plants"/Preparation of Reports (Open) (CB/CA) 16 3.1)
Committee Deliberation 69 17 3.2)
Report Preparation 69 18 19
- 4) SHINE Operating License Application -- Final Safety 20 Evaluation Report (Open/Closed) (RB/CB) 21 4.1)
Remarks from the Subcommittee Chairman 71 22 4.2)
Presentations and discussion with 23 representatives from the NRC staff 72 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
4 P-R-O-C-E-E-D-I-N-G-S 1
1:00 p.m.
2 CHAIRMAN REMPE: Okay. It's 1:00 p.m. on 3
the East Coast. This meeting will now come to order.
4 This is the first day of the 701st meeting of the 5
Advisory Committee on Reactor Safeguards.
6 I'm Joy Rempe, Chairman of the ACRS.
7 Other members in attendance are Ron Ballinger, Charles 8
Brown, Vesna Dimitrijevic, Walt Kirchner, Jose March-9 Leuba, and Matt Sunseri.
10 Member Petti has been excused today.
11 Member Halnon is not present at this time, but he will 12 be participating intermittently during this meeting.
13 And Member Bier is having some connection 14 difficulties, but we anticipate that she'll be joining 15 us shortly. Nevertheless, I note we do have a quorum.
16 Today the committee is meeting in-person 17 and virtually. The ACRS was established by the Atomic 18 Energy Act and it's governed by the Federal Advisory 19 Committee Act.
20 The ACRS section of the USNRC public 21 website provides information about the history of this 22 committee and documents such as our charter, bylaws, 23 Federal Register notices for meetings, letter reports, 24 and transcripts of all full and subcommittee meetings, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
5 including all slides presented at the open meetings.
1 The committee provides its advice on safety matters to 2
the Commission through its publicly available letter 3
reports.
4 The Federal Register notice announcing 5
this meeting was published on November 14, 2022. This 6
announcement provided a meeting agenda, as well as 7
instructions for interested parties to submit written 8
comments or request opportunities to address the 9
committee. The designated federal officer for today's 10 meeting is Ms. Christina Antonescu.
11 The communications channel has been opened 12 to allow members of the public to monitor the open 13 portions of the meeting. The ACRS is now inviting 14 members of the public to use the MSTeams link to view 15 slides and other discussion materials during these 16 open sessions. The MSTeams link information was 17 placed in the Federal Register notice and agenda on 18 the ACRS public website.
19 We received no written comments or 20 requests to make oral statements from members of the 21 public regarding today's session. Periodically the 22 meeting will be opened to accept comments from 23 participants listening to our meetings. Written 24 comments may be forwarded to Ms. Christina Antonescu, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
6 today's DFO.
1 During today's meeting the committee will 2
consider the following topics: Draft Guide 1374, 3
Criteria for Programmable Digital Devices and Safety-4 Related Systems of Nuclear Power Plants, and the SHINE 5
Operating License Application Final Safety 6
Evaluation Report. Note that portions of the SHINE 7
discussion may be closed, as stated in the agenda.
8 A transcript of the open portions of the 9
meeting is being kept. It's requested that speakers 10 identify themselves and speak with sufficient clarity 11 and volume so they can be readily heard.
12 Additionally, participants should mute themselves when 13 not speaking.
14 At this time, I'd like to ask other 15 members if they have any opening remarks. And I'd 16 also like to ask whoever has their phone not on mute 17 to please mute it.
18 COURT REPORTER:
That's the court 19 reporter.
20 CHAIRMAN REMPE: Okay. So if not, I would 21 then like to ask Charlie Brown to lead us in our first 22 topic for today's meeting.
23 Charlie?
24 MEMBER BROWN: Okay. Thank you very much, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
7 Joy. I don't have any other additional comments to 1
make. I will just call on Eric and Khoi to make 2
opening remarks and start on the presentation.
3 MR. BENNER: Okay. Thank you.
4 This is Eric Benner. I'm the Director of 5
the Division of Engineering and External Hazards, 6
which has programmatic lead for digital I&C licensing.
7 We briefed the subcommittee just a few short weeks ago 8
and found those discussions very fruitful.
9 In the interim time, we reshaped our 10 presentation today to mostly focus on the things we 11 heard in the subcommittee meeting such that the staff 12 and the committee could continue dialoguing on these 13 issues. We feel that will be most productive to help 14 the committee in developing their letter report.
15 That being said, we have the presentation 16 that we used at the subcommittee meeting queued up.
17 If there are other questions that come up, we 18 certainly are going to use the time to answer any of 19 the questions the committee has, whether it was on 20 topics we heavily discussed at the subcommittee or 21 anything else that has come up in the interim.
22 With that, I'm going to turn it over to 23 Khoi, who will be our lead presenter.
24 MR. NGUYEN: Thanks, Eric.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
8 My name is Khoi Nguyen. I'm an engineer 1
from the Engineering Branch in the Division of 2
Engineering and External Hazards in NRR. I'm here to 3
present the Draft Guide 1374, the proposed revision of 4
the Reg Guide 1.152, Criteria for Programmable Digital 5
Devices in Safety-Related Systems of Nuclear Power 6
Plants.
7 Next slide, please.
8 As you see and as shown on the slide, the 9
development of this draft guide involved the staff 10 from six divisions of the three different offices.
11 Next slide, please.
12 This slide shows the outline of today's 13 presentation.
14 Next slide, please.
15 The scope of the Draft Guide 1374 is to 16 endorse IEEE Standard 7-4.3.2-2016 as an acceptable 17 approach to meet the regulatory requirements for 18 promoting the high-functional reliability, desired 19 quality, and secure development and operational 20 environment for the use of programmable digital 21 devices in the safety-related systems of nuclear 22 power-generating stations.
23 For the purpose of this meeting, I would 24 like to use the term 7-4.3.2 for IEEE Standard 7-4.3.2 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
9 and the term SDOE for secure development and 1
operational environment.
2 Next slide, please.
3 This slide shows the major changes in the 4
standards of the 7-4.3.2-2016 version.
It 5
incorporates the SDOE guidance from Reg Guide 1.152 6
Revision 3. It provides the specific criteria on the 7
use of software tools in the digital devices and the 8
development of hardware, software, firmware, and 9
programmable logic. It also revised Annex D, 10 Identification and Control of Hazards.
11 Next slide, please.
12 The proposed change under this revision of 13 the draft guide to remove the SDOE guidance from Reg 14 Guide 1.152 Rev 3, that has been incorporated into the 15 7-4.3.2-2016 version. It endorsed Revision 2016 of 7-16 4.3.2 with exceptions and clarifications, including 17 additional guidance for fault detection and self-18 diagnostics if used in digital I&C systems.
19 It provides guidance and clarification for 20 control of access and endorsement of the Annex D, 21 Identification and Control of Hazards. Finally, it 22 includes additional guidance for providing safeguards 23 for safety-related programmable digital devices before 24 installation.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
10 Next slide, please.
1 CHAIRMAN REMPE: Before you leave that 2
slide -- again, I apologize for missing the 3
subcommittee meeting, but I did look over the slides 4
and the transcript.
5 There were a lot more changes in your 6
earlier, more in-depth presentation incorporated. And 7
one of them that I don't see here that was not only in 8
your earlier slide pack but discussed a lot by the 9
subcommittee was the fact that you've drawn in some 10 language from ISG-04 related to independence.
11 During the discussions, the subcommittee 12 members explored about when you're going to retire 13 ISG-04. There was a lot of discussion about a need 14 for a road map and things like that because of the 15 spaghetti of regulations.
16 And I guess I'd like to explore that a 17 little here because I noticed you don't even list it 18 here, and I saw the subsequent slides that you're 19 going to be going through about the changes and the 20 comments. That one was not mentioned in today's 21 package.
22 Why do you not mention that and the fact 23 that -- it was one of the major points that the 24 subcommittee emphasized about trying to decide whether 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
11 ISG-04 was -- what parts of it were still applicable 1
or not. Could you elaborate a bit about why you're 2
not mentioning it today?
3 MR. NGUYEN: There's no particular reason 4
I didn't include that clarification for ISG-04 in this 5
presentation. But if you want to know why I didn't 6
include it, as stated in the slide, this draft guide 7
endorses the standard with exception and 8
clarification.
9 It has an inclusive list of details of all 10 the changes.
We endorse the standard with 11 clarification. And some of them from the ISG-04 12 didn't incorporate into 7-4.3.2. So in this draft 13 guide we put the guidance from ISG-04 in the guidance, 14 but there's no new guidance included.
15 CHAIRMAN REMPE: So one of the points the 16 subcommittee members made was how does an applicant 17 know they still need to look at ISG, certain parts of 18 it that are not brought into this reg guide.
19 I guess I thought that was something that 20 the staff had kind of agreed, yes, maybe we need a 21 better road map and we need to identify that ISG still 22 holds until we can get where we retire it. And then 23 when I looked at the subcommittee discussion, I never 24 saw a clear time table when ISG-04 would be retired.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
12 MR. BENNER: This is Eric Benner. We took 1
it that that discussion was offline from this, that 2
the bigger picture of the road map to help the 3
committee understand how all this stuff fits together 4
was separate from this document.
5 The reality is all of the ISGs are 6
guidance to the staff. And so they won't get sunset 7
until that guidance gets incorporated into the formal 8
staff guidance of the standard review plan. In the 9
meantime, we also allow licensees to look at staff 10 guidance to understand where the staff is coming from.
11 So in reality, I believe we really should 12 have companion guidance in both the guidance to 13 industry, which is typically in the form of regulatory 14 guides, and the guidance to staff, which is namely 15 embodied in the standard review plan.
16 ISG-04 won't, strictly speaking, be 17 retired until it gets morphed into the standard review 18 plan. But this is now the guidance we're putting out 19 to the industry on these topics.
20 CHAIRMAN REMPE: This helps me. You've 21 got to go and get all of the SRP. But in your 22 perspective, this discussion about ISG-04, you need to 23 remind people it should not be put in the reg guide 24 because it's --
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
13 MR. BENNER: Correct.
1 CHAIRMAN REMPE: Okay. That helps me 2
understand your perspective. We'll see what the 3
committee's perspective is, but yes.
4 MEMBER BROWN: Before he goes on -- this 5
is Charlie -- that is brought up in the letter, Joy.
6 So we had our opportunity to address this in one way 7
or the other.
8 CHAIRMAN REMPE: I'm aware of that. I 9
just was curious because it's not here in today's 10 presentation. Yes, I did see it. Again, I know it's 11 not in the presentation and I just wanted to make sure 12 it was on the table here.
13 The discussion about the road map was also 14 not in your letter but it was discussed heavily during 15 the discussion meeting -- your draft letter. Thanks.
16 MR. NGUYEN: Next slide, please.
17 During the November 17th subcommittee 18 meeting the staff received several feedbacks from the 19 members. This slide and the next few slides will show 20 those feedbacks and the staff-proposed response.
21 For feedback number one, the concern was 22 the draft guide does not contain guidance addressing 23 external electronic data communication control and 24 access. The staff will revise the draft guide to 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
14 provide an example indicating the use of hardware-1 based uni-directional communication. It's an approach 2
that the staff considers acceptable.
3 Any questions on this slide?
4 Next slide, please.
5 The second feedback was the use of the 6
wireless capability for measure and test equipment, or 7
- MTE, will potentially compromise the safety 8
functionality, such as potential unwanted software is 9
downloaded wirelessly prior to disabling the wireless 10 function. Thus, the MTE becomes a pathway for 11 unwanted software.
12 However, significant guidance in the 13 document exists to provide for both control and the 14 use of wireless technology at the nuclear power 15 plants. These include the design and operational 16 controls, as noted in the slide.
17 IEEE Standard 7-4.3.2 requires that 18 portable MTE be maintained, controlled, and accessed 19 in a secure location with access limited to authorized 20 persons only. Further, in addition to the all the 21 restrictions for use of the wireless technology, Reg 22 Guide 5.71 contains specific operational controls that 23 require the MTE is checked prior to use in a critical 24 reach of access.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
15 Therefore, the staff believes these 1
controls are adequate and sufficient. And the staff 2
does not intend to incorporate additional guidance 3
into Reg Guide 1.152.
4 MEMBER BROWN: I have a comment on that.
5 I looked at C-4.2 and I had a hard time finding this 6
that states the checking and documenting. I've been 7
through all the 4.1, 2.1, 2.2, et cetera, et cetera.
8 And 5.71 is the general document that says this is how 9
you configure your entire program.
10 The comments I
was making in the 11 subcommittee meeting were referring to how you do this 12 operationally. We've got M&TE. We've got wireless 13 stuff hooked up to those things to bring you whatever 14 they're doing, updates or other stuff that you're 15 going to use as part of your test and evaluations, 16 stuff like that.
17 I'm not quite sure how we'll address this 18 thought process in the letter now. I do have a 19 discussion of it, but this is a very generalized 20 overall what you should do, not how do you execute 21 when you're doing the design.
22 Guide 1.152 is the design. You say that 23 in your thing. It's one of the primary design 24 documents and guidance that you have. The idea that 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
16 in this other programmatic thing sitting over here 1
somewhere it says you ought to be doing something, the 2
actual execution, I'm still somewhat wary of that. We 3
can discuss this more after you finish.
4 MR. NGUYEN: Yes.
5 MEMBER BROWN: We'll probably do that when 6
I do the letter because I do have a section on this 7
issue in the letter.
8 MR. NGUYEN: Thank you for the comment.
9 Mike, can you bring up the document, IEEE 10 Standard 7-4.3.2, on page 29?
11 MR. EUDY: Sure. Hold on a second.
12 MR. NGUYEN: Yes, on the slide.
13 MEMBER BROWN: You said Reg Guide 5.71 14 contains the following and that's C-4. It's not in 15 the --
16 MR. NGUYEN: Yes.
17 MEMBER BROWN: Okay. I just wanted to 18 make sure we were on the same page.
19 MR. NGUYEN: Because you said these are 20 the programmatic documents. I would like to bring up 21 7-4.3.2 as endorsed by Reg Guide 1.152 for the exact 22 guidance. If you look at page 29 and the subclause 23 5.9.1, the last three paragraphs on that subclause 24 provide the guidance on how to safely control the MTE.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
17 MEMBER BROWN: All it says is access to 1
permanent or portable engineering work stations and to 2
M&TEs shall be limited to a defined set of authorized 3
employees. You're talking about 5.9.1?
4 MR. NGUYEN: Yes.
5 MEMBER BROWN: That's the last -- I've got 6
the document open right in front of me.
7 MR. NGUYEN: If you look at the last three 8
paragraphs, the three short paragraphs --
9 MEMBER BROWN: Yes.
10 MR. NGUYEN: -- these provide the specific 11 guidance for how to control the MTE equipment.
12 MEMBER BROWN: It's if you think wireless 13 is okay, it tells you what you should do. If you 14 don't think wireless should be used, it doesn't. The 15 issue is should you or should you not be using 16 wireless communications to update and utilize M&TE and 17 that type of stuff. This thing says you've got to be 18 careful if you use wireless.
19 MR. NGUYEN: No. This particular 20 subclause doesn't provide guidance for wireless. It's 21 for MTE. If you want to use MTE in the safe zone 22 inside the fence, you have to follow this guidance 23 first, regardless of if you have the wireless capable 24 or not. All the MTE has to follow these provisions.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
18 MEMBER BROWN: Scroll a little higher to 1
access controls. Lower, I mean, so that access 2
controls comes up. It closes out the first paragraph.
3 Now down a little bit. Put those three paragraphs --
4 now bring in more of 5.9.1. Scroll down -- no, up a 5
little bit so you get those last -- that's it.
6 It's the last paragraph down there that 7
talks about disabling and once you go to do the 8
hookup. There's two aspects here. Nobody's going to 9
disagree with that.
10 You're obviously not -- well, maybe it's 11 not obvious, but the point was this effectively says 12 we allow the use of wireless to update, do whatever it 13 wants to do to all the M&TE equipment and anything 14 else we decide we're going to use, portable work 15 stations or other work stations.
16 And then up above that it says if you're 17 going to do it then you're going to only have good 18 people, cleared people. Permanently connected work 19 stations shall be installed in a plant area that's not 20 accessible, that provides physical security. That's 21 not wireless security.
22 And in the first paragraph it says 23 engineering stations that interface with safety 24 equipment shall be maintained, controlled, and 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
19 accessed in a physically secure location. It has 1
nothing to do with is wireless okay or not. It just 2
says if you protect it physically, you're happy.
3 And the issue that I have -- this is me.
4 The rest of the committee may not agree with me when 5
we go through the letter. The issue I have is 6
physical protection isn't worth a hangnail in this 7
circumstance. It's the fact that it's sitting out 8
there downloading stuff at other times, updates, 9
whatever they are.
10 You disconnect everything and it's in a 11 nice, physically secure location. That still doesn't 12 protect you with wireless unless you put a copper 13 shield around the entire building so you don't get any 14 wireless, which you might as well just disconnect the 15 wireless in the first place.
16 That's the point. Now, whether anybody 17 agrees with me or not is another issue. I'm just 18 saying that's something that we will have to settle 19 amongst ourselves.
20 I understand your point about the physical 21 security, the access via the IEEE standard. I don't 22 have any problem with those in terms of what they say.
23 They are valid. But they don't address the basic 24 where I'm sitting here all alone in a secure facility.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
20 I can be attacked, downloaded, and have some stuff 1
residing.
2 And to think you're going to go in --
3 every time you go to get a maintenance test or every 4
time you sit down with a portable work station, you're 5
going to disable that and then run through a complete 6
virus scan for everything that's on it, that is 7
operationally probably not real doable.
8 MR. BENNER: This is Eric Benner. Member 9
Brown, we don't dispute that vulnerability. But for 10 us, like Khoi started with the main purpose of this 11 document, our endorsement of this document is a 12 methodology to meet the requirements in 10 CFR 13 50.55(h), which incorporates by reference IEEE 603.
14 So that's why not only do we say this 15 exists from that standpoint, but the concerns you've 16 talked about we see more as -- I think you alluded to 17 them -- operational concerns. And the operational 18 management of M&TE falls more under the program that 19 licensees do in response. And our staff's guidance is 20 5.71. Those things are complementary.
21 So it's a matter of those requirements, 22 the cyber security requirements aren't contained in 23 50.55(h) or IEEE 603. So that's why --
24 MEMBER BROWN: It was 1991.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
21 MR. BENNER: That's right.
1 MEMBER BROWN: But that's --
2 MR. BENNER: I understand. But from our 3
standpoint, cyber security is regulated as an 4
operational program in a different part of the 5
requirements. And this guidance isn't in any way for 6
demonstrating compliance to those requirements.
7 There's different guidance for demonstrating 8
compliance to those requirements.
9 Certainly the committee will deliberate 10 and come to the conclusion it comes to. But for us, 11 we're trying on one level to keep some of this 12 cleaner.
13 We try to reference appropriately where 14 these -- we do believe that licensing and cyber 15 security clearly have complementary aspects to them.
16 So we work heavily with NSIR to try to make sure the 17 right linkages are there, both from a design and 18 licensing standpoint and an operational oversight 19 standpoint. We'll certainly respect where the 20 committee comes out.
21 MEMBER KIRCHNER: I share Charlie's 22 concern. Does a piece of test equipment if it's 23 connected to a safety-related digital system or 24 digitally based system, does that by default become a 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
22 critical digital asset, and therefore before you would 1
connect such test equipment to a safety-related system 2
you would have to check it for malware?
3 MR. BENNER: I see that Kim Lawson-Jenkins 4
has her hand up, and she could speak much more 5
authoritatively than me on this.
6 MS. LAWSON-JENKINS: Hi. Thank you.
7 My name is Kim Lawson-Jenkins. I work in 8
the Cyber Security Branch of NSIR. And yes, it is a 9
requirement.
10 First of all, the M&TE is not a CDA.
11 However, when it is connected to a CDA or a safety-12 related device, it has to be protected at the same 13 level as the device it's connecting to. So if a 14 vendor comes in and connects to that device, they have 15 to assure the licensee that it is protected at that 16 level when they're connecting it.
17 That is one of the main reasons we don't 18 have the requirement on what the vendor does when he's 19 using the M&TE within a
secure development 20 environment. Once you're connected to the device is 21 when it's really important to know that there is no 22 malware on that device.
23 There are best practices. They are not in 24 this document. For instance, you have things like 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
23 least functionality, which I think is exactly what 1
you're alluding to when you're saying no wireless 2
capability should be on the device.
3 But that in itself does not inherently 4
make the device more secure. I know it may seem like 5
it that you think there are less attack pathways, but 6
what's really making it secure is that you have, as 7
we've said in this document that we're looking at 8
right now, tightly controlled access to that device.
9 If malware ever gets on the M&TE, it is 10 there. The salient point then isn't how it got on 11 there. It's to be able to recognize that you have 12 malware on a device and then to remove it before 13 connecting it to a critical digital asset.
14 So I'm not disputing or saying that 15 wireless is not important at all, but the important 16 thing that you have to do when you're connecting MT&E 17 to a device is, first of all, not to do it wirelessly; 18 to have a wired connection so that when you're doing 19 the data transfer there's no question that you have a 20 secure connection.
21 And the next step is to make sure that 22 before you connect that device, that MT&E, that it is 23 clean; it does not have malware on it. And if a 24 vendor has done all the other best practices of having 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
24 the least amount of software on there, to have 1
functions only needed to support the critical digital 2
asset, that should make it secure.
3 So I just question -- and I understand the 4
issue about wireless, but removing that access before 5
you even do a connection doesn't really inherently 6
make it more secure. That's the point I'm trying to 7
make. I'm not saying it doesn't, that it absolutely 8
doesn't make a difference. I'm not saying that.
9 But the amount of benefit that you're 10 getting, more benefit would be coming from verifying 11 that you have the least amount of functionality that 12 you need on there to support that digital critical 13 asset. And then to be able to do comprehensive scans 14 of that device to make sure that there's no 15 unauthorized software on it and there's no known 16 viruses on that device.
17 I know that was a long answer to the 18 original question. We're trying to ensure that when 19 you connect that device, it's protected at the same 20 level as the CDA that you're connecting to. And the 21 history of how things got on it may not be relevant.
22 You just want to make sure at that moment when you're 23 connecting it that it is secure.
24 MEMBER BROWN: I don't disagree with that, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
25 that it's secure when you connect it, but it's not 1
always just a vendor that comes in and brings his own 2
stuff in. The plants have their own operational 3
equipment where they have to do periodic this or 4
periodic that, and that's M&TE at the same site of the 5
same kind.
6 MS. LAWSON-JENKINS: Yes.
7 MEMBER BROWN: If it's sitting in a room 8
physically secure but wireless connected, that means 9
it's open. Depending on the configuration of it at 10 the time, a lot of stuff -- when I've got my laptop 11 just sitting around and it's off, information gets 12 into it. I find that out when I turn it back on.
13 Once you've got a connection of any kind, 14 whether it's a hardwired connection or a wireless 15 connection, it's downloading. So that means every 16 time you go to use that piece of test equipment, a 17 plant technician, before he does anything he's got to 18 go do a complete whatever, virus protection. They've 19 got to go through the whole rigmarole --
20 MS. LAWSON-JENKINS: Yes, they do.
21 MEMBER BROWN: -- before they actually go 22 in and do any calibrations, testing, or anything else.
23 That's what that would mean.
24 MS. LAWSON-JENKINS: Yes.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
26 MEMBER BROWN: So I understand that the 1
plant would have to --
2 MEMBER KIRCHNER: That's what I was 3
asking, Charlie --
4 MEMBER BROWN: Yes.
5 MEMBER KIRCHNER: -- if that is explicitly 6
stated somewhere. If not in this reg, does it exist 7
in --
8 MEMBER BROWN: That's the licensee --
9 MEMBER KIRCHNER: -- in your world -- I'm 10 trying to think of which of the applicable reg guides 11 for cyber security, but is that explicitly stated?
12 MS. LAWSON-JENKINS: That is explicitly 13 stated in the section that was referenced on the 14 slides that were presented. It's also in the same reg 15 guide for portable media and mobile devices.
16 That includes M&TE where it says that you 17 must connect it -- when you connect it, it has to be 18 protected at the same level. I know I gave Khoi some 19 information about scanning the devices also.
20 Admittedly, all of these things happen in 21 the operational state. I absolutely agree with Member 22 Brown on that. That is where it's occurring. And 23 even before the device comes to the plant it has to be 24 checked, and there has to be assurance that it has 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
27 been maintained in a secure fashion. So part of the 1
oversight that is occurring when you're speaking to 2
the vendor is how do they keep these devices secure.
3 And at the --
4 MEMBER BROWN: Excuse me. It's not just 5
vendors. I mean, you don't call vendors in just to do 6
stuff you have to do routinely, I don't think. We 7
used to do it ourselves. Our operators did all the 8
testing and everything else.
9 I'm not a commercial plant operator, but 10 I'd presume commercial plants have electronic 11 technicians on their staff that do all their 12 calibrations and updates. You don't call in 13 Westinghouse or whoever did it at the time, whoever 14 designed the stuff to do that for you every time.
15 So bringing stuff into the plant, that's 16 covered. If you're going to bring something in and 17 it's going to be from outside the plant, people are 18 going to say, hold it. You can't use that until --
19 and they'll go check it. If the wireless is disabled 20 when they do that, you're probably golden.
21 I'm talking about stuff that's available 22 to the plant operators and the technicians, and it's 23 sitting in a secure facility where it's controlled.
24 It's logged and it knows the calibration period. It's 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
28 all set up. So that's all parked in, but it's got a 1
wireless connection.
2 Most of the new test equipment is all 3
software controlled. You can't get away from it 4
except the old analog volt meter. Well, not even 5
those anymore. They've got microprocessors in them.
6 So it's just a source that now says if you 7
allow that stuff to be updated -- again, if your 8
wireless is connected, even if it's off, it's 9
downloading. That means every time you go test that 10 stuff, even though it's been validated and checked 11 before the last time you used it, you've got to go 12 through the whole drill of reverifying whether it has 13 been contaminated or some cyber attack has gotten 14 through to it.
15 MS. LAWSON-JENKINS: And that is true.
16 MEMBER BROWN: Okay. So we're on the same 17 page from that stance.
18 MS. LAWSON-JENKINS: Yes. Okay.
19 MEMBER BROWN: The one way to get around 20 that is to not have test equipment ever hooked up to 21 wireless. If you need to update it, hook it up to a 22 cable where you know when you do it explicitly. And 23 then you can download and check that you didn't get 24 any malware downloaded.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
29 Although remember, all your cyber security 1
equipment, you're checking for what you already know, 2
not for what you don't know. It's very reactive.
3 That's why everybody keeps getting hacked. Somebody 4
figures out how to do it again. So I'm just 5
skeptical.
6 Again, this is my view. This is not the 7
committee's view. This is my view. And I've included 8
a section in the letter that we'll be able to discuss 9
it and come to an agreement. This has been, I think, 10 a helpful discussion to let everybody hear a little 11 bit more than me talk.
12 MEMBER BLEY: Charlie?
13 MEMBER SUNSERI: I think you're right --
14 MEMBER BROWN: Matt, what did you say?
15 MEMBER SUNSERI: Let Dennis go.
16 MEMBER BROWN: Okay. I don't want to 17 forget you.
18 Dennis?
19 MEMBER BLEY: Yes. I'm following that 20 discussion or trying to. I want to make sure I get 21 your point on this. It's almost like you're telling 22 the folks in the plants they don't want to do this and 23 they've got to make sure it doesn't have that 24 capability.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
30 I'm curious from the staff's point of 1
view, even if you don't have wireless access, you have 2
a physically secure place but people can go in and out 3
of there who are authorized. The thing I've been 4
hearing is this is a lot of burden to have to do a 5
full scan on the test equipment you bring out of that 6
secure facility.
7 Even if they don't have wireless access, 8
do you still have to do the same kind of scans and 9
things?
10 MEMBER BROWN: I would think -- sorry, 11 Dennis.
12 MEMBER BLEY: I wanted to hear from the 13 staff on that, Charlie.
14 MEMBER BROWN: Okay. I didn't know who 15 you were asking.
16 MS. LAWSON-JENKINS: Yes. They will have 17 to do the same procedure because it isn't a matter of 18
-- they have to maintain the integrity of the device.
19 As you just mentioned, you have physical access.
20 Even when you have wired access, if you 21 have an affected vendor, the website where you're 22 going to do the download, and if you have a wired 23 connection that you're connecting to the internet, it 24 is still possible to download malware that way.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
31 MEMBER BLEY: Okay. So I'm trying to get 1
this straight. From the point of view Charlie's been 2
arguing, if you get rid of one of those vectors to 3
come in, that means you've cut out one possible route 4
but there are still others.
5 From the practical side of I go in and get 6
a piece of equipment, I've got to do the same checks 7
on it whether or not there's wireless capability. So 8
there isn't any real savings in a practical sense 9
other than we know we've cut out one possible vector 10 out of many.
11 MS. LAWSON-JENKINS: And if you're 12 allowing wireless in the plant, they're doing scans to 13 see the type of connections that are occurring. So I 14 believe one of the concerns that Member Brown has 15 should be captured in the scans, especially in areas 16 where you have maintenance equipment that you're going 17 to be connecting to other devices.
18 MEMBER BLEY: Okay. Thanks.
19 Charlie, I kind of cut you off. Did I 20 misstate your concerns?
21 MEMBER BROWN: You didn't misstate. You 22 just didn't -- what's the right -- you said if you 23 don't have wireless. And somebody said you've got to 24 connect by cable. Well, it goes two ways.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
32 The M&TE is not connected to anything.
1 It's not connected by cable. It's not connected by 2
wireless. Physically you can control the cable. You 3
can't control the wireless as easy if it's on, whereas 4
with a cable you disconnect it and away you go.
5 You can do the same thing with the 6
wireless. That's the best way to do it, to not have 7
it at all. And then when somebody comes in to get the 8
equipment, it has been certified the last time. If 9
it's physically secure and nobody's come in, that 10 doesn't prevent the same thing we always worry about.
11 Even a vendor can come in to upgrade 12 software on a piece of safety equipment, which 13 everybody says is okay but somehow down there it's 14 buried. They introduce it and away you go. That's a 15 physical check that you have to do every time. It's 16 just one more way for equipment to be compromised.
17 Matt, you were going to say something.
18 MEMBER SUNSERI: I was just --
19 CHAIRMAN REMPE: Jose's had his hand up 20 too, just to keep track.
21 MEMBER BROWN: Okay. I didn't see that.
22 MEMBER SUNSERI: This is Matt. I was just 23 going to confirm -- at least my time in the plants is 24 getting pretty dated now -- the plants are very 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
33 attuned to that and calibrating what they're going to 1
connect into the plant. So they do the scans all the 2
time.
3 MEMBER BROWN: Okay.
4 MEMBER SUNSERI: They check it out. As I 5
recall, there was even two people involved so that you 6
weren't relying on a single person that could be 7
coding something in there without somebody watching 8
them.
9 MEMBER BROWN: Jose?
10 MEMBER MARCH-LEUBA: Yes. Thank you.
11 MEMBER BROWN: Are you done, Matt?
12 MEMBER SUNSERI: (No audible response.)
13 MEMBER BROWN: Jose, go ahead.
14 MEMBER MARCH-LEUBA: Yes. I just wanted 15 to warn against the false sense of security that I 16 keep hearing from the staff. We have a requirement 17 that the thing be clean and you will clean it. Yes.
18 Everybody in the world will scan their Windows 19 computer and Google Chrome for vulnerabilities, and it 20 was coming out green and clean.
21 Just this week Google issued an emergency 22 patch for a vulnerability that was being exploited.
23 So just because we were running Windows Defender or 24 sophisticated McAfee on the system and we were not 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
34 finding a vulnerability, it doesn't mean it wasn't 1
there. Everybody that has a Windows computer or 2
anybody that uses Google Chrome had a vulnerability 3
that was scanned negative last week and it was a false 4
negative. So just the fact that you scan doesn't mean 5
it's not there.
6 Let me give an example from other areas of 7
our field. We our design our pipes to be seismically 8
qualified. We scan them regularly for cracks. But 9
nevertheless, we assume the pipes will break and you 10 will have LOCAs. Even though you design it to be 11 perfect and you scan it to be perfect, you still say, 12 what happens if it breaks.
13 In the area of cyber security, we have to 14 keep everything very controlled. We have to scan for 15 vulnerabilities. But you have to do the extra step of 16 assuming that LOCA is going to happen. What will you 17 do then? How will you prevent it?
18 I keep hearing this extremely false sense 19 of security from the staff. We had it 12 years ago.
20 They told us they were going to keep it clean. They 21 don't. They cannot do it. Okay, just getting it on 22 the record.
23 MEMBER BROWN: Any other comments?
24 MS. LAWSON-JENKINS: This is Kim Lawson-25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
35 Jenkins. I would like to briefly reply to that. I 1
honestly don't believe anyone in the cyber security 2
community has a false sense of assurance about 3
attacks.
4 The hackers are very sophisticated. They 5
are always changing their methods. They are always 6
trying to exploit vulnerabilities. They are always 7
trying to misuse protocols or functions that will 8
become vulnerabilities that they can exploit.
9 So I'm sorry if I gave the impression that 10 scanning is the end-all to be all. It is only one 11 tool in the tool box, which must be used correctly to 12 be able to
- identify, as you
- said, known 13 vulnerabilities. I mentioned having a reduced amount 14 of software and only necessary things on the device 15 will help with those unknown vulnerabilities, things 16 that people can exploit in the future.
17 MEMBER MARCH-LEUBA: Yes. I want to make 18 a point to apologize to you because I know you are 19 very good and you take it seriously.
20 Just think of what other people do, 21 especially the ones that come from the management 22 side. We had a member just mention how seriously they 23 take the scans. When you don't know as much as you 24 and I know, you think that the scan saves you. A scan 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
36 is just one thing you should and must do, but it 1
doesn't protect you 100 percent.
2 When we leave the money man in charge of 3
the implementation, there is a big tendency to save 4
money. You have to because otherwise your plant won't 5
run and you have to close it.
6 MS. LAWSON-JENKINS: I'm afraid I've 7
hijacked Khoi's meeting. I didn't want this to become 8
a cyber security discussion. I honestly look forward 9
to continuing these discussions, but I want Khoi to be 10 able to finish his presentation.
11 MEMBER BROWN: You're doing just fine, 12 Kim. Don't worry about it.
13 MEMBER MARCH-LEUBA: Yes. I see my job in 14 life to scare everybody, put a little bit of the scare 15 I have in my blood into yours. Thank you.
16 MR. BENNER: This has been a good time.
17 This is Eric Benner again. I turned it over to Kim.
18 I'm glad Kim led the discussion because she has a lot 19 more of the detail as to how cyber security works.
20 I'm going to bring it back to a different 21 level in that the words that are in the standard are 22 the words in the standard. We influence standards.
23 The NRC has membership on the standards. We influence 24 the standards but we don't dictate what's in the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
37 standards.
1 And for our purposes, when we look at a 2
standard we're looking at: is there anything here 3
objectionable? We certainly don't find anything 4
objectionable in that last statement. We understand 5
about wireless capability shall be disabled prior to 6
connecting. We certainly don't find anything 7
objectionable to that part of the standard.
8 We don't use -- as I alluded to, this is 9
for the staff's review. This guidance was reviewed as 10 a way for licensees to meet IEEE 603, which is in the 11 safety-related portions of the standard, 10 CFR Part 12
- 50. None of that is about cyber security.
13 So where we're at is there is other 14 guidance for how you address cyber security, including 15 control of wireless, access, and connections. What 16 I'm going to keep repeating is no matter what we put 17 in this guidance document, it has no bearing on what 18 a licensee does operational to demonstrate compliance 19 with the security requirements in 10 CFR Part 73.
20 That's why we're drawing a distinction here.
21 MEMBER BROWN: Before you go on, I will 22 continue this for just a moment since I'm kind of 23 leading this from my standpoint. I'll either have the 24 final word or somebody else will want to say something 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
38 else.
1 The perspective I come to, I'm dividing it 2
between work stations and M&TE. We've been talking 3
about M&TE. To me, M&TE equipment sits in a room 4
where it's logged. It has a set of paperwork that 5
goes along with it or software work on some other 6
computer that says it was last calibrated at a certain 7
time and therefore it's okay to be used through this 8
period.
9 And if that equipment is sitting on a 10 shelf and it's not connected either wirelessly or by 11 cable, the likelihood of something interfering or 12 coming into that piece of equipment is pretty darn 13 low. There's no doors.
14 You put away the wireless, but now let's 15 say you've got it connected to an internet connection.
16 Well, that's a problem. I would disagree with that 17 also.
18 If you need to upgrade the software 19 because the vendor who makes that test equipment says 20 we're not measuring that stuff right and we have an 21 error in our software, he'll come in. You don't want 22 him to send any of it down to you.
23 You want his little body to go trucking 24 through the plant with all the other security to make 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
39 sure it's the right guy, with the right credentials, 1
with the right whatever to change and update all the 2
same pieces of equipment to the new software where 3
they can then do the scans and it's done. It doesn't 4
mean he didn't bring something in, but you 5
theoretically would check to make sure he didn't bring 6
something in with some capability that the site had 7
put together.
8 So my viewpoint that I come from, at least 9
in the programs I operated and developed for 22 years 10 once we had computer stuff, is just because 11 something's nice and easier to do, you ought not do it 12 if it has the potential to cause problems. With M&TE 13 it's easy to not do it.
14 Work stations are a character. You're 15 doing stuff. They're communicating with things.
16 They're bi-directional. They're getting information 17 in.
18 By hooking them up wirelessly and you say 19 all wireless should be disabled, to me, I don't know 20 if that means when somebody's following this guidance 21 that the work stations that you've got in various 22 locations would have no wireless connection. They may 23 have an internet connection because of their bi-24 directional operation in and of itself, but they don't 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
40 have another pathway where something can come in.
1 Do I read that first sentence correctly?
2 It says shall be disabled on work stations. Kim, 3
would you expect a licensee to follow that rigorously?
4 Are you still there?
5 MS. LAWSON-JENKINS: I'm still here. All 6
capabilities disabled, all wireless work stations --
7 MEMBER BROWN: Yes. All wireless 8
capabilities shall be disabled on work stations.
9 There are two sentences in that last paragraph.
10 MS. LAWSON-JENKINS: Yes, I see both of 11 them.
12 MEMBER BROWN: I'm not talking about M&TE 13 now. Put that one aside.
14 MS. LAWSON-JENKINS: Okay. If that's the 15 requirement. That's why they say disabled too. My 16 preference would be not even to have the capability.
17 MEMBER BROWN: Absolutely. I love you.
18 MS. LAWSON-JENKINS: Yes. It could even 19 be that if you're going to do something, I would 20 prefer not to have the capability rather than 21 disabled. But they may not be able to --
22 MEMBER BROWN: No work station should have 23 wireless enabled, attached, or involved.
24 MS. LAWSON-JENKINS: That's a very 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
41 customized work station where you don't even have that 1
capability, which is why this standard is probably 2
written this way.
3 MEMBER BROWN: All right.
4 MEMBER BLEY: Charlie?
5 MEMBER BROWN: Yes, Dennis.
6 MEMBER BLEY: We've gotten into an area 7
where the words matter and how the words are 8
interpreted matter, and that's not in what we're 9
reading.
10 Even quite a few years ago there were 11 places to go with your computer where you weren't 12 allowed to have a camera on board the computer. And 13 it hit a point I forget how many years ago where you 14 can't even buy one. You'd have to design it yourself.
15 But when you ran into language like that, 16 it didn't mean to turn a switch and turn it off. It 17 meant you had to have somebody go in and remove the 18 actual camera from the device.
19 I guess it's not clear to me what this 20 precise word means by disabled. Does that mean it's 21 removed, it's destroyed, so it's not just turning a 22 switch and turning it off?
23 MEMBER BROWN: It's not clear. You're 24 right. I interrupted you. I'm sorry. I thought you 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
42 were done.
1 MEMBER BLEY: It's the staff's words so 2
I'm wondering what it means to them.
3 MEMBER BROWN: This is the IEEE standard 4
now, the 7-4.3.2.
5 MEMBER BLEY: Well, yes but through the 6
reg guide they're endorsing it.
7 MEMBER BROWN: Absolutely.
8 It's muted. I hear nothing.
9 MR. NGUYEN: So this is a long discussion.
10 The staff appreciates all the comments and questions, 11 but I would like to summarize the staff decision on 12 this subject.
13 MEMBER BLEY: I guess there's no answer to 14 that question.
15 MEMBER BROWN: We'll have to discuss it 16 more on our letter when we get there, how we want to 17 deal with this discussion.
18 MR. NGUYEN: So the staff believes that --
19 MEMBER BROWN: Were you going to say 20 something else, Matt? You looked like you --
21 MEMBER SUNSERI: No. I mean, I'm going 22 back on my memory again but when we were working with 23 the interfaces, if it said disabled, it was disabled.
24 You couldn't use it anymore. It was physically 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
43 plugged or disconnected or something. It wasn't 1
turned off.
2 MEMBER BLEY: That's what I would have 3
expected. That's what I had to do with the camera in 4
my old computer.
5 MEMBER SUNSERI: I remember the early days 6
of laptops. Disabled meant in terms of portable media 7
that epoxy was put into the plug-in ports on the 8
computer to prevent people from doing bad things.
9 MEMBER BROWN: Disabled is a stronger word 10 than turned off. I read that strongly, but you bring 11 a good point. I didn't think of your thought process, 12 Dennis.
13 MEMBER BLEY: That's what it meant to me, 14 but I thought it would be very clear to the staff. It 15 wasn't supposed to be a hard question.
16 MEMBER BROWN: Any other comments on this 17 subject?
18 We'll let Khoi continue. Thank you very 19 much for allowing us to diverge.
20 MR. NGUYEN: Before I continue to the next 21 subject, I would like to summarize this. I mean, it's 22 a lengthy discussion but the staff's decision on this 23 subject is it's very important that a requirement is 24 in place to make sure there's no malware in the M&TE 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
44 devices before connecting to the safety equipment.
1 And we feel both the IEEE standard and the 2
Reg Guide 5.71 -- we found there's significant 3
guidance and measures in place that ensure there's no 4
malware existing in the M&TE before connecting to the 5
CDA.
6 So regardless of whatever method that the 7
malware gets into the M&TE, I think there's a measure 8
in place that's protecting, scanning, or whatever to 9
identify any malware and remove it before connecting 10 to the CDA. I think that is a sufficient safety 11 measure, for the M&TE to be connected through the CDA.
12 MEMBER KIRCHNER: Khoi, could you go back 13 to your view graphs? I just wanted to look at the 14 view graph again.
15 MEMBER BROWN: Back to the presentation?
16 MEMBER KIRCHNER: The presentation, sorry.
17 MR. NGUYEN: Mike, could you bring back 18 the slide?
19 MR. EUDY: Will do. Give me a second.
20 MEMBER BROWN: I think it was slide 8.
21 MR. EUDY: It's up. Does everyone see it?
22 MR. BENNER: Yes. Thank you, Mike.
23 MR. NGUYEN: Do you have a question on 24 this slide?
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
45 MEMBER KIRCHNER: Okay. Thank you.
1 MEMBER BROWN: That's where we were. So 2
you can proceed now.
3 MR. NGUYEN: Slide 9, please, Mike.
4 For the third feedback, the concern was 5
Clause 5.17 of the 7-4.2.3, the self-reference to 6
Annex C, Dedication of Existing Commercial Computers.
7 This reference in a way contradicts the exception of 8
endorsement of the Annex C. In other words, we are 9
not endorsing Annex C. We are endorsing Clause 5.17, 10 but the clause is a reference to Annex C. So there's 11 a contradiction.
12 The staff will revise the draft guide to 13 clarify that Clause 5.17 provides criteria that the 14 NRC staff finds acceptable for the use of commercial 15 equipment in safety-related systems in nuclear power 16 plants.
17 Clause 5.17 references Annex C for 18 additional information on commercial-grade items 19 except for the dedication. However, while there is a 20 useful history record and referenced information in 21 Annex C, the NRC staff does not see the need to 22 endorse such information. So the staff will make a 23 clarification --
24 MEMBER BROWN: I totally lost the bubble.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
46 MR. NGUYEN: Okay. This draft guide 1
endorses Clause 5.17 of IEEE Standard 7-4.3.2. But 2
the staff has not endorsed Annex C of the standard.
3 MEMBER BROWN: Got it.
4 MR.
NGUYEN:
- However, Clause 5.17 5
references Annex C.
6 MEMBER BROWN: So by default you endorse 7
it?
8 MR. NGUYEN: We make the statement in the 9
standard that --
10 MEMBER BROWN: I know you said that, but 11 I said by default. That was our discussion that we 12 had in the last subcommittee meeting.
13 MR. NGUYEN: Right. So the staff will 14 make the clarification in the draft guide to make it 15 clear that we endorse Clause 5.17 --
16 MEMBER BROWN: But you are endorsing the 17 alternate methodology as opposed to 1.164 and 1.250, 18 which had a rigorous review. This has not.
19 I'm paraphrasing our discussion from the 20 subcommittee meeting. This just popped in. We spent 21 a large amount of time. NEI documents, topical 22 reports, two different -- TR is this, TR is that; 23 1.164 and 1.250 are examples of what they meant.
24 And here there's kind of a broad brush.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
47 A page and half says it's okay, just do -- I'm 1
paraphrasing. I'm not saying do whatever you want.
2 But the method here, which is not as 3
rigorous at all compared to what we just went through 4
and wrote a letter on in great detail and yet by 5
definition you're endorsing that -- I guess in my 6
personal opinion, I wouldn't endorse 5.17. That's my 7
personal opinion.
8 MR. NGUYEN: May I have --
9 MEMBER BROWN: Of course you can.
10 MR. NGUYEN: We admit that we didn't have 11 the clear answer at the subcommittee meeting. But 12 after the meeting we went back and we looked at 1.250.
13 We note that the draft guide provides guidance for the 14 dedication process when affecting the dependability.
15 MEMBER BROWN: That's still dependability.
16 MR. NGUYEN: If the applicant or licensee 17 chooses to use a third party, then they can use that 18 draft guide as a supplemental guidance for commercial-19 grade dedication.
20 Clause 5.17 provides the traditional 21 commercial-grade dedication process. We have been 22 using and reviewing the commercial-grade dedication.
23 So there's no conflict with the two.
24 We didn't answer clearly at the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
48 subcommittee meeting that there's different methods.
1 One draft guide is for the specific guidance and this 2
reg guide for the traditional method.
3 MEMBER BROWN: The 1.250 was admittedly 4
still level with dependability, but it also was highly 5
dependent upon the previous 1.164, the NEI documents 6
and topical report, a couple of those as a matter of 7
fact.
8 And this did not seem to be as thorough as 9
the other approach. It was tough to dig out why this 10 is now okay as well as the other method, which 11 involved NEI documentations and examples of how they 12 would go about executing it.
13 MR. BENNER: It doesn't replace those. I 14 mean, our thoughts in the first bullet here gets to 15 that point. Clause 5.17 isn't in conflict with the 16 guidance.
17 Khoi was focused on 1.250, which is on 18 using self-certification for dependability. Reg Guide 19 1.164 is the overall staff guidance for commercial-20 grade dedication programs. And this doesn't change 21 that.
22 MEMBER BROWN: But if it is, why has 23 something else --
24 MR. BENNER: Because it's not in conflict.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
49 Our judgement here is do we find it objectionable, and 1
we don't. We don't find Clause 5.17 objectionable 2
because it's consistent with the regulations and the 3
guidance we have out there. It's not as detailed.
4 But I think if your concern is someone is 5
going to say, for my commercial-grade dedication 6
program I just followed 5.17 and I didn't follow Reg 7
Guide 1.164, the staff wouldn't find that. When they 8
went out to inspect the licensee's commercial-grade 9
- program, they wouldn't find that 10 acceptable.
11 And even when we talk about Clause 5.17 in 12 the reg guide, it references Reg Guide 1.164 as the 13 staff's overall guidance for commercial-grade 14 dedication.
15 MEMBER BROWN: Yes. So you accept this as 16 a standard but that doesn't --
17 MR. BENNER: Right.
18 MEMBER BROWN: -- that doesn't say you 19 can't use 5.17 and 1.164. You can do it aside from 20 1.164. You can -- I don't want to say discard it.
21 You can set that aside. You can use this procedure.
22 And you're saying you're satisfied with that, the 23 staff is?
24 MR. BENNER: I'm saying they can't satisfy 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
50 1.164 just because -- it goes back to the purpose of 1
this guidance document is for a licensee to 2
demonstrate compliance with the regulations in 10 CFR 3
50.55a. Commercial-grade dedication is under 10 CFR 4
Part 21.
5 If you look at the purpose of this reg 6
guide, it says nothing about 10 CFR Part 21. If you 7
want to comply with 10 CFR Part 21, you still have to 8
follow all the staff guidance available or provide an 9
alternative to where we've articulated what licensees 10 need to do to meet 10 CFR Part 21.
11 MEMBER BROWN: Okay. I'm going to go back 12 and read this one also just for fun.
13 MR. BENNER: It's good, light reading.
14 MEMBER BROWN: So design analysis is part 15 of the overall thing. You can do it for 1.164.
16 MR. BENNER: Um-hum.
17 MEMBER BROWN: And 5.17.4 literally says 18 performing one method for documenting this as opposed 19 to what we say is in Topical Report 106439, which is 20 the NEI topical report that was referenced via 1.164.
21 MR. BENNER: Um-hum.
22 MEMBER BROWN: That means you can set that 23 aside and use what was before for performing the 24 analysis. And I did not go back to the 1.164 and the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
51 topical report, unless somebody wants to pay me for 1
another two weeks' worth of time over and above my 2
allotment.
3 So right now it seems to me that, in a 4
way, we've got some dueling approaches. They are not 5
both the same. You're saying it looks okay, but it's 6
not the same as the other one per se.
7 MR. BENNER: It's not in conflict and it's 8
not guidance for complying with 10 CFR Part 21, which 9
is where you would address commercial-grade 10 dedication. We would only take issue with this if 11 there were something there that was in conflict with 12 our regulatory requirements. And we just don't see 13 that.
14 MEMBER BROWN: You don't see that in 5.17?
15 MR. BENNER: No.
16 MEMBER BROWN: Okay. Any other comments?
17 MR. BENNER: One, it's not in conflict.
18 And two, it is not a guidance for demonstrating 19 compliance with the regulation in question.
20 MEMBER BROWN: Okay. Using Dennis' 21 approach of words have meaning, you're saying if they 22 went through 5.17, that would not be enough to 23 demonstrate compliance unless they did something for 24 some other documents as well; 10 CFR, whatever it was.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
52 MR. BENNER: Um-hum.
1 MEMBER BROWN: Because this is not in 2
whatever part it is, fundamentally they can't use 5.17 3
exclusively. They have to use it in conjunction 4
with --
5 MR. BENNER: Well, they can't use this reg 6
guide. This reg guide isn't for purposes of 7
demonstrating compliance with that regulation period.
8 MEMBER BROWN: It said it's okay for 9
approving commercial dedication of EDD. That's what 10 this is all about, right?
11 MEMBER SUNSERI: Charlie, I think it goes 12 like this. The commercial-grade dedication has a 13 part, right. For digital there's some greyness in one 14 of the areas. And this satisfies that part, but 15 you've still got to do the other three.
16 MEMBER BROWN: Well, the way the words 17 read in that one section for the analysis is the other 18 part is one method, but not necessarily, because 19 there's a bunch of things they say before getting into 20 that which define what design analysis is plus some 21 other stuff. It's okay. I got your point.
22 Any other comments from anybody on this 23 slide?
24 Okay. Khoi?
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
53 MR. NGUYEN: Next slide, please, slide 10.
1 The last feedback would be --
2 MEMBER BLEY: Can I sneak in something?
3 MR. NGUYEN: Yes.
4 MEMBER BLEY: I've been stewing over that 5
conversation a little bit.
6 MEMBER BROWN: The previous slide?
7 MEMBER BLEY: Well, I don't need the 8
slide.
9 MEMBER BROWN: Okay.
10 MEMBER BLEY: It's the concept of the NRC 11 staff approach to looking at a standard. I had always 12 assumed, I guess, that you go to a standard when there 13 exists a standard to cover something you want to 14 include in your guidance. You don't just go out and 15 endorse standards by themselves if they don't have a 16 real need for the areas you want to provide guidance.
17 This idea that it doesn't conflict with 18 our other guidance seems -- it just feels odd to me.
19 It feels like if you don't need it for what you're 20 doing now, why would it be endorsed? You'd leave out 21 some parts of standards or their attachments because 22 they aren't necessary.
23 And this is kind of taking the other view.
24 Well, we keep it all in unless it conflicts with 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
54 something on our side. I'm just stating an unease 1
about the way that process goes. And maybe that's the 2
way it always goes but it doesn't feel that way to me.
3 I don't know what to do with it, Charlie.
4 I just wanted to get it out there.
5 MEMBER BROWN: Your point being why 6
endorse it if it doesn't satisfy -- if you've got a 7
process in place and it doesn't satisfy anything new?
8 MEMBER BLEY: If it doesn't satisfy any of 9
the purposes of this particular reg guide.
10 MEMBER BROWN: Okay. Thank you, Dennis.
11 Any other comments before we move on 12 again?
13 All right. Are we on the next slide, 14 Khoi?
15 MR. NGUYEN: All right. We are on slide 16 number 10.
17 So for feedback number four, the concern 18 was the draft guide does not contain any discussion of 19 the I&C safety system architecture, including the 20 fundamental design principles.
21 It should be noted that the scope of Reg 22 Guide 1.152 is to endorse IEEE Standard 7-4.3.2 as an 23 acceptable approach to meet the regulation 24 requirements, which is IEEE Standard 603.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
55 The I&C safety system architecture is 1
evaluated by the staff in the context of meeting the 2
four fundamental design principles. It doesn't say 3
independent and deterministic diversity and defense-4 in-depth, or D3. The staff performs its evaluation 5
using the licensing process guidance in Interim Staff 6
Guidance or ISG-06 and the Design Review Guide or DRG.
7 Staff believes that while the fundamental 8
design principles are considered by the staff when 9
evaluating the I&C safety system architecture, 10 deterministic D3 are not part of the IEEE 603 11 requirements. And therefore, they are out of the 12 scope of this reg guide.
13 Therefore the staff does not intend to 14 include these design principles in this draft guide 15 because the staff thinks that this discussion of these 16 principles in ISG-06 and the DRG is the most 17 appropriate location for that discussion, not in this 18 draft guide.
19 MEMBER BROWN: I would counter that with 20 the point that you made in here. I understand ISG-06, 21 as I've wrote reports on it and also on all the DRGs.
22 I don't disagree with your point relative 23 to big, big, big picture thought processes. You state 24 yourself that Reg Guide 1.152 is one of the primary 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
56 documents for the use of computers and I&C systems.
1 And the purpose of including this up in 2
the introduction would be to -- not down in the text 3
but in the introduction -- put the application of 4
software-based, computer-based systems, or PDDs in the 5
new, more expansive view of the world, is to convey 6
the application of those approaches within an overall 7
system design, which the architecture is the key 8
feature of those.
9 So it doesn't dictate anything. It just 10 says the fundamental without any words. It gives you 11 new stuff, but it brings a lot of baggage along with 12 it that you've got to consider when you're doing the 13 application.
14 It doesn't dictate anything, but it does 15 state that you've got to be careful because the 16 primary protection against CCS is a robust, redundant 17 architecture which has these characteristics. So I 18 would disagree that that's, from a
principle 19 standpoint, not an unreasonable thing to put in as a 20 lead into the reg guide.
21 It doesn't dictate doing A, B, or C. It 22 just says, hey, in the context of applying these 23 things, they're applied in the overall thing. So it's 24 a primary document, like you say, the ISG-06, the DRG, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
57 but also BTP 7-19 and Reg Guide 5.71 eventually.
1 So 1.152 is one of the linchpin documents.
2 The concept of how it's applied in an overall 3
architecture and what is the intent of applying it, 4
that to me is a philosophical thing that should be 5
part of it, just as we've included this thought 6
process into ISG-06 and BTP 7-19.
7 Even though BTP 7-19 is fundamentally 8
defense-in-depth and diversity, it covers the overall 9
point of we've got this giant stuff we're providing.
10 Here's the overarching principles and architecture.
11 If the architecture is the key to safe 12 operation of all these critical safety systems, 13 protection systems and the safeguards in particular, 14 all those that require redundant systems. And that 15 concept ought to be that this document is part of 16 that, but here's the overarching thought process. And 17 that's the purpose of the discussion point that we 18 talked about in the subcommittee meeting.
19 So I'll just leave it right there. We can 20 go ahead to the next slide.
21 MEMBER KIRCHNER: We can leave it there.
22 I would emphasize that we are redundant, Charlie.
23 MEMBER BROWN: That's good, isn't it?
24 MEMBER KIRCHNER: Yes, that's good in this 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
58 case.
1 MEMBER BROWN: You should not be using BTP 2
7-19 absent this thought process. You shouldn't be 3
doing 5.71 without knowing what the system 4
architecture should be -- what should be embodied.
5 You shouldn't be doing 1.152 without 6
knowing what that is, and you shouldn't be doing ISG-7 06 or the review guides without that centralized 8
overall architecture thought process in terms of the 9
safety-related protection systems. That was the 10 point.
11 Yes, it is redundant. We've put it in 12 every place. For new people coming in, they start 13 working on something. Oh, I didn't know that. I'm 14 over here working, beavering away on diversity.
15 You're doing that in the context of --
16 MEMBER KIRCHNER: Charlie, I thought you 17 were going to bring up control of access.
18 MEMBER BROWN: It's in my letter. The 19 reason control of access is not in this list is I 20 didn't figure that out eight years and ten years ago 21 when we did the first Design Review Guide and we did 22 one of the earlier design certifications. I learned 23 later.
24 CHAIRMAN REMPE: So I just wanted to do a 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
59 time check. I would have thought more slides would 1
easily be accomplished in the last 20 minutes, but we 2
do have public comment periods so I just wanted to 3
make sure that everybody is aware of the time here.
4 MEMBER BROWN: Yes. I'm done with that.
5 I just wanted to put the context of what this one was.
6 It doesn't need any more elaboration.
7 MR. BENNER: This is Eric Benner. I'll 8
take the first step in responding and we'll see if I 9
get any lifelines.
10 MEMBER BROWN: Is this the same slide or 11 are you going on?
12 MR. BENNER: No, the same. I'm responding 13 to --
14 MEMBER BROWN: You want to argue with me?
15 MR. BENNER: No, no, no. I don't want to 16 argue at all. I think from the standpoint of the 17 philosophy, the staff is on board with the philosophy.
18 And the staff has incorporated that philosophy into 19 the staff review guidance.
20 The challenge we have is the purpose for 21 regulatory guides is, in this case, endorsing guidance 22 that can be used to meet the regulatory requirements.
23 And the philosophy is not embedded in the regulatory 24 requirements.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
60 We do get some pushback when we try to put 1
philosophy in guidance to licensees. The caution we 2
get is, you should have a really good line of sight 3
between anything you're putting in the guidance and 4
the regulatory requirements. That's why we continue 5
to point to the staff guidance.
6 We can get into more of those discussions 7
because it tells how the staff is going to do its 8
business. And in all honesty, it can get into 9
philosophy. That's really all I wanted to say in 10 addition to what we have on the slide.
11 MEMBER BROWN: Well, I will amplify that 12 because 603-1991 actually embodies at least three, 13 maybe even four of these. It's independence, 14 redundancy, and deterministic. It doesn't say 15 deterministic. I think it's called repeatable or time 16 response.
17 So three of them are embodied in IEEE 603-18 1991, which existed before computer stuff ever really 19 became involved in these equipments. And the internet 20 was a bare fledgling of its present capability.
21 If you ever had to operate with -- what 22 was the first thing? It wasn't email. It was so old 23 that even I can't remember it now. The first email 24 stuff, the way you got stuff was sending AOL. Back in 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
61 the old, old, old --
1 MR. BENNER: Over your phone?
2 MEMBER BROWN: Yes, over the phone 3
connection.
4 MR. BENNER: We forgot what that was like.
5 MEMBER BROWN: For a minute.
6 MR. BENNER: And those attributes that are 7
explicitly in 603, that carries through.
8 MEMBER BROWN: That's what these emphasize 9
in the reg guide.
10 MR. BENNER: And this goes beyond what's 11 in 603. That's sort of our challenge.
12 MEMBER BROWN: We'll have to disagree on 13 that -- with me on that.
14 MR. BENNER: Um-hum.
15 MEMBER BROWN: Next slide. Joy wants to 16 get that slide 11.
17 CHAIRMAN REMPE: Just want to keep us on 18 schedule.
19 MR. NGUYEN: Okay, slide 11. Reg Guide 20 1.152 is one of the primary reg guides used by the 21 applicants and licensees in development of the I&C 22 applications, the reactor applications. And these are 23 the I&C topical reports.
24 MEMBER BROWN: A whole panoply. It's a 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
62 linchpin, primary reg guide. I love that. You just 1
argued -- no, you just articulated -- excuse me --
2 what I've said before.
3 MR. NGUYEN: Yes.
4 MEMBER BROWN: Go ahead. I couldn't 5
resist.
6 MR. NGUYEN: Okay.
7 MEMBER BROWN: We've got fifteen minutes 8
left.
9 MR. NGUYEN: So the update to Reg Guide 10 1.152 is a high priority based on the recent licensing 11 experience and direction with the stakeholders that 12 contributed to the update to 7-4.3.2 in 2016.
13 Next slide, please.
14 The staff reports the revision of Reg 15 Guide 1.152 to update information and guidance in the 16 areas of functional reliability, design quality, and 17 the SDOE for programmable digital devices in the 18 safety-related systems of nuclear power plants to 19 support NRC guidance and practices to ensure that the 20 guidance in these areas is current and consistent with 21 the staff position. Therefore, revision will enhance 22 the efficiency and the effectiveness of the licensing 23 review.
24 That will conclude my presentation.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
63 MEMBER BROWN: I'm not going to be 1
contrary here. I wouldn't disagree with that. I 2
actually thought the revision was pretty well put 3
together.
4 So I didn't have any real problem with the 5
approach. I thought you did a good job of 6
incorporating stuff that was in other places. I 7
understand the separation of church and state that you 8
want to accomplish in some circumstances.
9 And I did check between the old 7-4.3.2 10 and the new one, paragraph by paragraph, to see what 11 was there. That was painful. And a comparison of the 12 old Rev 3 of the reg guide to this one.
13 It seemed to connect the dots with the 14 exception of these obvious discussion points that 15 we've been through. So I don't disagree that it's 16 good to update it the way you did.
17 Are there any other member comments right 18 now? Anybody on the outside, members?
19 MEMBER KIRCHNER: Charlie, I had one.
20 MEMBER BROWN: Go ahead. I didn't hear 21 you.
22 MEMBER KIRCHNER: I think Dennis raised it 23 during the subcommittee meeting and I think I did as 24 well. I really would like to see some kind of flow 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
64 chart that pulls all of your digital I&C guidance 1
together. I think it would be very valuable for you, 2
the staff, to have it in your interactions with the 3
commissioners as well so you can show the progress 4
that you've made in this area.
5 And I think it would be very useful for 6
applicants to sort through how you've connected the 7
dots, and leave that behind for your successors as 8
well to show how you can demonstrate that by using 9
these reg guides and other staff guidance, meeting the 10 regulations that we were bantering back and forth 11 today.
12 MR. NGUYEN: Thank you. Thank you for the 13 comment. You made a good comment.
14 MR. BENNER: Yes. And maybe we 15 disconnected -- we thought that was outside of the 16 discussion of this. I recalled it was --
17 MEMBER BROWN: I figured it was in the reg 18 guide.
19 MR. BENNER: -- we were talking about an 20 informational brief that we could give to the 21 committee as to how it all fits together.
22 MEMBER BROWN: That's in the transcript.
23 That point was made. I went back to that and looked 24 at that to make sure.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
65 I did include yours and Dennis' -- there's 1
an additional discussion that I put in. We can see if 2
we want to do it, whatever we want to do, however we 3
want to rephrase it. I just wanted to make sure I 4
captured a little bit of the thought process.
5 We need to go to --
6 CHAIRMAN REMPE: Well, before you do that, 7
when I was looking at the transcript everyone agreed 8
it should be done. But when does the staff envision 9
this will be prepared, available, and what document?
10 Could you give us some details about how you intend to 11 get it done? I'm just curious.
12 MR. BENNER: Right now, I mean, we have 13 two things that we could probably provide to the 14 committee immediately. We had a public meeting with 15 stakeholders on a body of reg guides and how we are 16 looking to transition those from what they are now to 17 what they are in the future.
18 Separately, a staff has been looking at 19 the entire SRP, Standard Review Plan, and doing what 20 we call SRP modernization. And in the area of digital 21 I&C we've looked at the entire chapter and how we 22 would reformat that chapter. We have a presentation 23 on that that we've made internally for how we're doing 24 SRP modernization.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
66 So we could provide those two things right 1
away. Now, when we would have an information 2
briefing, we could certainly negotiate with you as to 3
when you would like such a briefing.
4 CHAIRMAN REMPE: It's good to inform us, 5
but I think it's more important to inform the 6
applicants.
7 MEMBER KIRCHNER: For new applicants is 8
what I was thinking, advanced reactors. The first 9
blush, we've run into this. There's this idea that 10 LWR stuff doesn't apply to us, is not applicable, or 11 it's too specific. But in looking at your body of 12 work, I have seen very little. It's very technology 13 neutral --
14 MR. BENNER: Right.
15 MEMBER KIRCHNER: -- or inclusive, I 16 guess, is the right buzz word these days. And so I 17 think such an information road map would be invaluable 18 for newcomers for advanced reactor designs. We 19 present it literally but I think you hear, oh, that's 20 all -- 10 CFR Part 50 and 52, that's really not 21 applicable to me because I've got a new design.
22 But most of your work, I would think, from 23 what we've seen is very technology inclusive. So it 24 would be a valuable document for new designs as well 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
67 as the existing players.
1 MR. BENNER: Yes. In several forms we've 2
had workshops with industry led by my staff that was 3
mainly the operating fleet to talk about these 4
changes. We've participated in a number of the 5
advanced reactor activities, whether they were more 6
general workshops or pre-application meetings with 7
individual licensees.
8 We've tailored those discussions to what 9
I would call the sophistication of the applicant. So 10 we certainly don't have a
one-size-fits-all 11 presentation for those audiences, but we do as we have 12 different avenues.
13 That's a little different than what we 14 were thinking of as to one thing that explains all of 15 this that we would share with any stakeholder. We 16 found a lot more customization has been useful in the 17 discussions we've had.
18 MEMBER KIRCHNER: I'm just thinking 19 though, it would be a while before 53 -- if it becomes 20 a rule, in the interim people are going to come to you 21 under the banner of 50 and 52. So giving them a road 22 map through the system will be very useful.
23 CHAIRMAN REMPE: Maybe a good place to 24 start is to have a briefing with us, but you might end 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
68 up at the end of the briefing with something that 1
heavily encourages the staff to make this available to 2
a broader audience.
3 Anyway, I think we're done with that 4
additional comment. Did you want to talk to the folks 5
out in the --
6 MEMBER BROWN: I was going to ask if there 7
was anybody on the phone lines that would like to make 8
a comment.
9 Hearing none, I turn it back over to you, 10 Joy.
11 CHAIRMAN REMPE: Great. Thank you. Do 12 you want to have a 15-minute break? We'll come back, 13 if I did my math correctly, at ten 'til 3:00 on the 14 East Coast time. We'll have someone bring your letter 15 up and you can do a read-through. Does that sound 16 good?
17 MEMBER BROWN: Um-hum.
18 CHAIRMAN REMPE: Okay. We're going to 19 recess. We'll be back at ten 'til.
20 (Whereupon, the above-entitled matter went 21 off the record at 2:34 p.m. and resumed at 2:54 p.m.)
22 CHAIRMAN REMPE: Okay. We are back in 23 session.
24 Member Brown, would you read us your 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
69 letter?
1 MEMBER BROWN: Yes. Before I start I will 2
give you an outline. Are you going to talk with Walt 3
or do you want me to read?
4 CHAIRMAN REMPE: We'd like you to read.
5 MEMBER BROWN: Okay. Let me at least 6
talk. This is an introduction of all the subjects 7
that we covered, both in the subcommittee meeting and 8
in this meeting. It's broken down into five items.
9 Can you all hear me?
10 PARTICIPANT: You've got to have it in 11 front of you.
12 MEMBER BROWN: Yes, I know. I just yell 13 at everybody.
14 I'll leave the whole thing. But before we 15 go detailed, we ought to decide what we want to cover 16 and what we don't want to cover. So let me read the 17 whole thing and then I'll tell you when we're 18 switching. And then we can figure out when I finish 19 what to do or not do, okay? All right.
20 Subject, Proposed Draft Reg Guide 1.152 21 Revision 4, Criteria for Programmable Digital Devices 22 in Safety-Related Systems for Nuclear Power Plants.
23
Dear Mr. Dorman,
During the 701st meeting 24 of the Advisory Committee on Reactor Safeguards, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
70 November 29 through December 2, 2022, we reviewed 1
Proposed Draft Regulatory Guide 1.152 Revision 4, 2
Criteria for Programmable Digital Devices in Safety-3 Related Systems in Nuclear Power Plants.
4 Our Digital Instrumentation Controls 5
Committee also reviewed this matter on November 17, 6
2022. During this review we had the benefit of 7
discussions with the representatives of the United 8
States Nuclear Regulatory Commission. We also had the 9
benefit of the documents referenced.
10 Conclusion and Recommendation.
In 11 general, we agree with the proposed revision, 1.152 12 Revision 4, but it should not be issued for public 13 comment until resolution of the five issues in the 14 discussion have been incorporated into the reg guide.
15 Introduction. CFR 50.55a(h)(2) and (h)(3) 16 mandate compliance with the requirements stated in 17 IEEE Standard 279, various dates, and IEEE Standard 18 603-1991, IEEE Criteria for Safety Systems for Nuclear 19 Power Generating Stations for Post-1991 Safety System 20 Applications and Development. These standards were 21 written and applied for analog systems.
22 For applications for computer-based 23 systems, Reg Guide 1.152 series endorsing IEEE 24 Standard 7-4.3.2, IEEE Standard Criteria for 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
71 Programmable Digital Devices in Safety Systems of 1
Nuclear Power Generating Stations, various dates, were 2
developed and first issued in 1985. These standards 3
use the term safety system, consistent with the NRC's 4
definition --
5 (Whereupon, the above-entitled matter went 6
off the record at 2:58 p.m. and resumed at 3:45 p.m.)
7 CHAIRMAN REMPE: Okay. We're back in 8
session. At this point I'm going to ask Member 9
Ballinger to lead us through the SHINE discussion.
10 MEMBER BALLINGER: Okay. I have one 11 sentence. Who brought the champagne? I'll connect 12 the dots. This is the last, we hope, meeting on the 13 SHINE application. It's been a long, long process, 14 but to my mind a rewarding one.
15 We'll have a presentation from the SHINE 16 folks first and then from the staff. I think Josh is 17 going to give a few words.
18 MR. BORROMEO: Yes. I have some quick 19 opening remarks.
20 My name is Josh Borromeo. I'm Chief of 21 the Non-Power Production and Utilization Facility 22 Licensing Branch in the Office of Nuclear Reactor 23 Regulation.
24 Today you'll be hearing an overview from 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
72 SHINE and the staff regarding the review of the SHINE 1
Medical Technologies Operating Licensing Application.
2 This is a first-of-a-kind review that required 3
extensive coordination across the agency and required 4
unique licensing approaches, which the staff will 5
discuss today.
6 While the finalization of the staff's SER 7
is a major milestone for the operating license for the 8
SHINE facility, this is only part of the NRC's 9
decision to issue the operating license. There are 10 several inspection activities planned related to the 11 construction and operational readiness of the facility 12 that are required to be completed prior to the 13 issuance of the license, and the staff will highlight 14 those areas in the presentation today.
15 I want to thank ACRS for all the engaging 16 interactions that we've had thus far. And I'm 17 especially thankful for the flexibility that ACRS has 18 extended to us as we had to make changes throughout 19 the review.
20 And finally, I want to especially thank 21 the NRC staff for all their diligent work on this 22 challenging review and pushing it here to the finish 23 line. So thanks.
24 MEMBER BALLINGER: Think we're ready to 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
73 go? Is it Catherine or Jeff?
1 MS. KOLB: Yes. My name is Catherine 2
Kolb. I'll be giving the presentation for SHINE.
3 Tracy was unfortunately unable to meet with us in 4
person today.
5 MEMBER BALLINGER: You're going to have to 6
be a little closer.
7 MS. KOLB: All right. Okay, got it.
8 So my name is Catherine Kolb. I'm the 9
Senior Director of Plant Operations for SHINE. I'll 10 be giving our presentation today. Tracy was unable to 11 make it here in person.
12 We have an overview of the SHINE process.
13 We'll start with the site overview, some status of the 14 construction of our facility, an overview of the 15 process which you've all seen before, and summaries of 16 our technological approach and safety philosophy.
17 The SHINE facility, which was envisioned 18 to produce medical isotopes, is located in Janesville, 19 Wisconsin, about four miles south of the city center 20 in the southern edge of the city. It is about two 21 miles from Interstate 3990 and directly to the east of 22 the Southern Wisconsin Regional Airport.
23 In the next slide here you'll see our site 24 plan. The large building in blue in the middle is the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
74 main production facility. That is where the 1
irradiation process and the chemical separation 2
processes take place.
3 To the south is the storage building.
4 That is primarily a warehouse, but it also contains 5
maintenance areas and office areas.
6 To the east of the site is the material 7
staging building. That is where we temporarily store 8
waste prior to shipment off-site for disposal.
9 The green building to the north of that is 10 the resource building. That houses support equipment 11 for the main production facility, including boilers 12 and a standby natural gas generator.
13 And then the very small building in yellow 14 is the nitrogen purge system building or the N2PS 15 building. That is a safety system that is used on a 16 loss of off-site power.
17 Here is a rendering of what the completed 18 campus will look like. You can see the main 19 production facility in the center, to the left the 20 storage building, the warehouse over on the right, and 21 in the back the resource and material staging 22 buildings.
23 In our next slide you'll see what they 24 actually look like as of a couple of days ago. The 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
75 main production facility you can see we're still 1
working on some of the architectural details, but the 2
facility structure is essentially complete. Inside we 3
are working on process equipment and mechanical, 4
electrical, and plumbing auxiliary equipment, which we 5
have pictures of in another couple of slides.
6 The resource building, the small building 7
that has support equipment, is also constructed. And 8
we are installing equipment inside of that. The 9
storage building is upright, but we haven't started 10 outfitting the inside of that to any great extent.
11 Here are some photos of inside the main 12 production facility. On the left is a picture of 13 workers installing process piping in the subgrade 14 trenches. You can see some of the piping. It's the 15 scaffolding there. We have approximately 50 percent 16 of all the process piping installed and about 60 17 percent of it welded out.
18 In the center picture, that yellow 19 structure is actually a temporary crane that will be 20 used to construct direct to the supercell. We have 21 about half of the shipping containers containing the 22 supercell pieces on-site, and we are beginning that 23 installation there. We needed a temporary crane so 24 that we can both construct the supercell and the areas 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
76 to the right in the photo, which have the subgrade 1
tanks and the other process equipment.
2 And finally, on the right is a photo of 3
the radiological ventilation zone 2 air handling 4
units. Those are part of the mechanical, electrical, 5
and plumbing scope of which 50 percent is completed.
6 These are the support equipment and the 7
auxiliary equipments mostly in the non-safety-related 8
portions of the building. You can see some of the 9
conduit, hangers, and lighting also installed in the 10 overhead there, so that is also well underway.
11 The next couple of slides are just a brief 12 overview of the SHINE process. The SHINE facility, if 13 you start at number one there, is the target solution 14 preparation area where we take depleted uranium metal, 15 oxidize it, and dissolve it in sulfuric acid in order 16 to form uranyl sulfate target solution. This is done 17 only periodically in the life of the facility, mostly 18 up front. And then that room is used for making make-19 up solution ongoing.
20 The target solution is directed into a 21 hold tank, shown as number two there in the center of 22 the rendering. From the hold tank the target solution 23 is lifted by our vacuum and transfer system into the 24 target solution vessel, which is the upright portion 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
77 of the T-shaped vessel shown underwater in that pool.
1 We fill to 95 percent by volume of criticality.
2 Then we irradiate for about five and a 3
half days using the accelerator, which is the blue 4
pressure vessel in the white box, where a beam of 5
deuterium ions are directed into a tritium gas target 6
which create a fusion reaction, which produces helium 7
and neutrons which are used to fission the uranyl 8
sulfate target solution. Of the fission products 9
moly-99 is one of those, which is our main target 10 isotope.
11 After about five and a half days, we drain 12 the solution from the target solution vessel into the 13 dump tank. We let the very short-lived fission 14 products decay. Then we send the solution via the 15 underground pipe trenches, which you saw in the 16 previous picture, over to the supercell.
17 The solution is passed through an 18 extraction column where the molybdenum adheres to the 19 media. The bulk of the solution returns to the hold 20 tank by the same underground pipe trenches. The 21 extraction column is then washed.
22 The washes are directed into a waste tank, 23 shown as number five in the photo. And the moly is 24 then eluted off of the column, purified, tested for 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
78 product quality, and packaged in the supercell.
1 So the technological approach of the SHINE 2
facility is based on a couple of principles. Our 3
systems are small. A maximum license power of 125 4
kilowatts per unit, which is hundreds of times less 5
power than reactors that are being used currently to 6
produce medical isotopes.
7 The low source term helps ensure safety of 8
the public and of our workers. The decay heat of the 9
system produces less than one kilowatt within five 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after the end of the irradiation, so it requires 11 no forced cooling. It is all passively cooled by the 12 pool that you saw in the previous rendering.
13 The low size also minimizes the production 14 of waste nuclides compared to reactors, which both 15 need to irradiate to their target for making medical 16 isotopes and their reactor fuel.
17 Our targets are usable, as we talked about 18 in the last slide. The solution is irradiated, 19 processed, and irradiated again. This reduces waste 20 in this process. It's using uranium and making moly 21 via fission. It produces high specific activity moly-22 99, which is completely compatible with the current 23 supply chain for our customers. Using the LEU target 24 solution also eliminates the need to use highly 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
79 enriched uranium.
1 Our process is driven by a low-energy 2
electrostatic accelerator, so it does not produce a 3
self-sustaining critical reaction. It is driven by 4
the accelerator. So if power is shut down, if the 5
accelerator's shut
- down, the fission process 6
eventually terminates, leading to an inherently safe 7
design.
8 And finally, you saw in the previous slide 9
there were many units. There are eight irradiation 10 units in the facility and three processing trains 11 within the supercell. Each unit can be directed to at 12 least two different supercell processing trains, which 13 provide operational skill ability and flexibility for 14 our facility and allow us to more reliably manufacture 15 products to deliver to our customers.
16 The safety philosophy of the SHINE 17 facility -- this is my last slide to go over this --
18 the system is designed to operate at low pressure/low 19 temperatures as compared to some reactor designs. And 20 it produces low decay heat, as I mentioned previously.
21 This results in minimal stored energy when compared to 22 alternatives, leading to essentially a safer facility.
23 The eight independent irradiation units 24 are independent. They each have their separate and 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
80 dedicated target solution reactivity protection 1
system, a safety-related I&C system. So this design 2
limits common cause failures between the eight 3
irradiation units.
4 MEMBER BALLINGER: This is Ron Ballinger.
5 I'm just curious as to -- how does that limit common 6
cause failures? I mean, it seems to me that you could 7
have common cause failures.
8 MEMBER KIRCHNER: You could have common 9
cause in all eight.
10 MEMBER BALLINGER: Yes.
11 MS. KOLB: You could have the same cause 12 in all of them because they all have the same design.
13 I guess what we meant by this slide is no single 14 failure. One failure would affect all eight units at 15 the same time.
16 MEMBER BALLINGER: Right, okay. Thanks.
17 MS. KOLB: I apologize.
18 The third bullet there, operating --
19 MEMBER KIRCHNER: You could throw in the 20 word redundant.
21 MEMBER BALLINGER: As opposed to -- yes.
22 MEMBER KIRCHNER: Yes.
23 MS. KOLB: When we present this again we 24 will take that into consideration. I understand.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
81 Operator actions in our design are not 1
required to mitigate the consequences of an accident.
2 So operators are not required to do anything after a 3
design-basis accident. The systems are designed to 4
either automatically or passively handle the 5
situations that they were designed for.
6 In the event of an upset condition, the 7
safety-related I&C system initiates a shutdown of the 8
system. There are two independent safety-related dump 9
valves, which both open, each controlled by a separate 10 division of the TRPS system. The solution is gravity-11 drained into a TSV dump tank, which is designed to be 12 favorable geometry for all uranium concentrations.
13 And the hydrogen that's generated by the 14 fission process is maintained below the lower 15 flammability limits by our off-gas system blowers, 16 which are powered from an uninterruptable power 17 supply, a safety-related electrical system. So 18 following the short amount of time that the blowers 19 need to be powered from the safety-related UPS system, 20 the plant is passively safe.
21 We've done calculations that 90 days 22 without cooling of the solution results in a pool 23 temperature rise that is not more than 13 degrees 24 Fahrenheit.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
82 And the nitrogen purge system is in place 1
to sweep any hydrogen that is produced by a radiolysis 2
from the various tanks in the facility and the dump 3
tank after potential loss of off-site power and the 4
loss of the blowers or other active systems.
5 And that is the end of our presentation.
6 MEMBER KIRCHNER: Is the UPS run time a 7
proprietary number? I don't remember.
8 MR. BORROMEO: I believe the run time in 9
the Chapter 8 tables are not proprietary.
10 MEMBER KIRCHNER: Just for the public 11 record, how long can you run your off-gas system 12 blowers before you switch over to nitrogen purge?
13 MS. KOLB: The blowers are required to run 14 for five minutes, at which point they automatically --
15 MEMBER KIRCHNER: Five minutes?
16 MS. KOLB: Five minutes, yes, at which 17 point they would come off the battery. And the 18 nitrogen purge system would take over and provide the 19 hydrogen mitigation function.
20 MEMBER KIRCHNER: Thank you.
21 MEMBER SUNSERI: Catherine, this is Matt.
22 Just one question. You're in this stage because of 23 the supply chain and delivery of the irradiation 24 units. Do you have a sense for how that schedule is 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
83 coming? Is the supply chain supporting your 1
construction schedule or are they getting farther out, 2
the delivery of the units?
3 MS. KOLB: I know that we have had some 4
challenges with supply
- chain, particularly on 5
commodity items. Most of our process equipment is on 6
order or sitting in a warehouse. But some things like 7
hangers and other normal commodities, the lead times 8
have been getting longer.
9 MEMBER SUNSERI: Yes. The only reason I 10 even mentioned that, just so you know what my 11 relevance was, is just the longer that you have some 12 operating units under construction -- just trying to 13 minimize that in your objective as well.
14 MEMBER BALLINGER: We all set? Other 15 members online?
16 CHAIRMAN REMPE: I have one just final 17 comment because this may be the last time you're here.
18 I think that all of us were very pleased to see the 19 responsiveness of SHINE. The visit helped make things 20 more concrete for us.
21 Again, I think that efficient regulation 22 and review by ACRS really depends a lot on the 23 applicant. And you guys did a great job. So thank 24 you.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
84 MEMBER BALLINGER: And I was mentally 1
processing those photos in the first few slides and 2
comparing it to the last time we were there, and 3
there's quite a different. There's quite a 4
difference. So thank you.
5 I guess we're ready for the staff. I 6
don't know. Who's the presenter?
7 MR. BORROMEO: It'll be Mike Balazik.
8 MR. BALAZIK: Hi. This is Mike Balazik.
9 Can everybody me okay?
10 MEMBER BALLINGER: Yes.
11 MR. BALAZIK: Okay. We'll start here in 12 a second. All right.
13 Good afternoon, everyone. My name is Mike 14
-- can you guys hear me okay?
15 MEMBER BALLINGER: I can.
16 MR. BALAZIK: Okay. I'll go ahead.
17 Good afternoon, everyone. My name is Mike 18 Balazik. I'm the Project Manager and Inspector in the 19 Non-Power Production and Utilization Facility 20 Licensing Plant in the Office of Nuclear Reactor 21 Regulation. Today I'll be providing an overview of 22 the staff's review of the application, some background 23 information, and some upcoming next steps of the 24 process.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
85 Next slide, please.
1 NRC staff is committed to conducting 2
efficient and effective reviews of applications and 3
inspections in accordance with applicable regulatory 4
requirements using appropriate regulatory guidance and 5
acceptance criteria while ensuring the protection of 6
the health and safety of the public.
7 NRC licensing and oversight activities 8
support the US national security interest in nuclear 9
nonproliferation policy objectives to establish a 10 domestically available and reliable supply of 11 molybdenum-99 without the use of highly enriched 12 uranium.
13 The NRC licensing activities include 14 initial licensing and subsequent license amendment 15 requests for facilities proposing to manufacture, 16 irradiate, and process low-enriched uranium and 17 molybdenum targets. The NRC oversight activities 18 include construction, inspection, operational 19 readiness reviews, safety and security inspection, and 20 licensing of operators.
21 Next slide, please.
22 The Division of Advanced Reactors and Non-23 Power Production and Utilization Facilities, otherwise 24 known as DANU, has the lead responsibility for 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
86 licensing of non-power production and utilization 1
facilities licensed under Part 50.
2 The following type of facilities can be 3
licensed as a 103 facility, which is a commercial 4
facility, or a 104 facility, which is for medical 5
therapy and research and development facilities. Some 6
of these facilities include non-power reactors, 7
subcritical operating assemblies similar to what SHINE 8
is, and production facilities. SHINE also contains a 9
production facility.
10 NRR relies on lots of expertise for this 11 type of review. We reached out to a lot of the other 12 offices that have supported the review in the areas of 13 emergency planning, physical security, accident 14 analysis, crit safety, and cyber security.
15 Next slide, please.
16 Now to touch on some background 17 information. The NRC received a two-part construction 18 permit application, received an environmental report 19 and a preliminary safety analysis report, otherwise 20 known as a PSAR, back in 2013.
21 As mentioned earlier, SHINE is planning to 22 produce molybdenum-99 from the fission of low-enriched 23 uranium targets in an irradiation facility consisting 24 of eight irradiation units. The molybdenum-99 is 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
87 recovered through the irradiated target solution 1
processing in the radioisotope production facility, 2
which consists of a series of hot cells.
3 The construction permit was issued on 4
February 29th of 2016 and SHINE commenced construction 5
of the facility back in September of 2019.
6 Next slide, please.
7 Now I'll touch upon the licensing 8
overview. As mentioned earlier, the irradiation 9
facility houses eight subcritical irradiation units.
10 Catherine mentioned earlier that each one's licensed 11 for 125 kilowatts.
12 So this is comparable in power level and 13 safety considerations to existing non-power reactors 14 licensed under 10 CFR Part 50. A majority of the 15 reactors that are licensed are trigger reactors. I'd 16 say most of those have a licensed power limit of 17 approximately one megawatt.
18 What's different with SHINE is that SHINE 19 operates -- it's a subcritical operating assembly, so 20 it didn't meet the definition of a utilization 21 facility as defined in 50.2. And it couldn't be 22 licensed under 10 CFR Part 70.
23 So in order to align these processes with 24 the potential hazards, the NRC issued a direct final 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
88 rule. In chief, the 10 CFR 50.2 definition is to 1
include the SHINE irradiation units.
2 So now in 50.2, under the definition of 3
utilization facility it also includes an accelerator-4 driven subcritical operating assembly used for the 5
irradiation materials containing special nuclear 6
material, as described in the application assigned 7
Docket No. 50-608, which is SHINE. This final rule 8
was published in October of 2014. It became effective 9
in December of 2014.
10 Next slide, please. Perfect.
11 Okay. So just to touch upon the licensing 12
- overview, the radioisotope production facility 13 consists of a series of hot cells for molybdenum-99 14 separation and purification. This facility was 15 defined as a production facility based on the batch 16 size, that the batches are greater than 100 grams. So 17 it meets the definition under 10 CFR 50.24, Production 18 Facility.
19 While the NRC has licensed production 20 facilities in the past, there are no such facilities 21 that are currently operating. There are a few 22 facilities in the past that have conducted similar 23 activities to SHINE.
24 There was the Cintichem, which was a five-25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
89 megawatt reactor. They did produce and process 1
molybdenum-99. However, it was done under 10 CFR Part 2
70 because the size of the batches were less than 100 3
grams.
4 West Valley was a privately owned facility 5
that was reprocessing fuel. So that was defined as a 6
production facility. They ceased operation back in 7
the early '70s. And I think Cintichem, they ceased 8
their activities -- I think it was in 1990.
9 So this is the first production facility 10 that's been licensed in quite some time. That's my 11 point here.
12 Next slide, please. Thanks.
13 The safety reviews for operating license 14 applications are conducted with the Commission's 15 regulations. The main guidance that we use for this 16 review was NUREG-1537, guidelines for preparing and 17 reviewing applications for licensing of non-power 18 reactors.
19 We also used the ISG. It expands the 20 guidance for NUREG-1537 to include aqueous homogeneous 21 non-power reactor technology and guidance for the 22 production facilities for the separation of byproduct 23 material from special nuclear material.
24 We also used standard industry guidance, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
90 such as certain ANS standards and industry standards.
1 These were documented in the Safety Evaluation Report.
2 Next slide, please.
3 I just want to touch upon the licensing 4
process. For an operating license application, we 5
accepted and of course documented the review. We 6
performed the safety and environmental reviews. And 7
also, we obtained information through a request for 8
additional information and conducted audits to 9
understand some of the underlying information.
10 So here today we're at the Advisory 11 Committee on Reactor Safeguards review, so this has 12 been going on since early this year where we presented 13 the different chapters in the SER.
14 For hearings, there are no mandatory 15 hearings required for an operating license. There is 16 the potential for it to have a contested hearing. The 17 staff did put out an FRN for the opportunity to 18 request a hearing. That was issued back in January 19 6th of 2020.
20 There were no hearing requests that were 21 received. So the next step here is the decision to 22 grant or deny the license, and I'll talk about that in 23 a second here.
24 Next slide, please.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
91 I just want to touch upon the license 1
application itself real quick. SHINE submitted the 2
license application in July of 2019.
3 SHINE requested a single operating license 4
under Part 50. The irradiation units will be licensed 5
as utilization facilities and the hot cells will be 6
licensed as a production facility.
7 SHINE did request a 30-year license, a 8
Class 103, which is a commercial license, per the 9
requirements of 50.33, which requires general 10 information in the application. And it states to 11 request the duration of the license and what type of 12 license it is.
13 SHINE did submit a supplement to the 14 license application in January 2022. This was 15 providing information with a phased approach to 16 operation. The big picture consists of four phases of 17 construction. The operation and construction will be 18 occurring simultaneously.
19 The staff did evaluate the phased approach 20 to operation that's documented in Appendix A of the 21 Safety Evaluation Report. The staff's approach to 22 this review was to look at the deltas between the full 23 design and the phased approach design.
24 Next slide, please.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
92 Here is a list of some of the interactions 1
that the NRC staff has had with the subcommittee.
2 Back in February we presented an overview of the 3
review to the full committee. I'm just showing all 4
the different interactions and the different 5
information that was presented during the subcommittee 6
meetings.
7 Next slide, please.
8 So now let me get to the basis for issuing 9
of an operating license. The following findings must 10 be made to issue an operating license. It's based on 11 10 CFR 50.7.
12 These are that the constructions would 13 substantially complete; the facility will operate in 14 conformity with application regulations; reasonable 15 assurance that operation will not endanger public 16 health and safety; applicant technically and 17 financially qualified; the provisions of Part 140 are 18 satisfied, which is financial protection requirements; 19 and issuance of a license will not be inimical to 20 common defenses of security.
21 In the SER the staff has made a majority 22 of these findings at the end of each chapter.
23 However, for example, the construction has been 24 substantially complete. As a result of oversight 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
93 activities, those findings will be made. So I guess 1
I'll just say there's a lot more activity that needs 2
to be done in the oversight space before an operating 3
license is issued.
4 Also, the staff will have the operational 5
readiness inspection, which is a tool to provide more 6
input for NRC decisions regarding the issuance of an 7
operating license.
8 Next slide, please.
9 So we'll talk about a couple of next 10 steps. The staff plans to issue the Final Safety 11 Evaluation Report. We do understand that there's the 12 potential that as the facility moves towards 13 substantially complete, there may be a need for design 14 changes.
15 The staff will be ready to determine 16 whether these design changes impact the informational 17 findings in the SE, and potentially supplement the SE 18 as needed. And of course we'll notify ACRS of any 19 substantial changes to the SER.
20 Also, we're going to continue on with the 21 construction oversight activities under Inspection 22 Procedures 69020 and 69021. At this point we have 23 issued three inspection reports related to 24 construction oversight activities, which I've got 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
94 documented there.
1 Next slide, please.
2 The NRC staff is developing a SHINE-3 specific inspection plan using Inspection Procedure 4
69022, which is Inspections for Operational Readiness 5
During Construction in Non-Power Production and 6
Utilization Facilities. What I've got listed on the 7
screen are some of the areas that we are planning to 8
perform inspections. There may be more added later 9
on, but this is what we're at least starting off with.
10
- Also, the operational readiness 11 inspections. We'll conduct these inspections once 12 SHINE informs the NRC that they're ready for each 13 inspection activity.
14 The final slide is that SHINE is expected 15 to notify the NRC in writing when the construction of 16 the facility is substantially complete. In our 17 inspection activities we'll support the basis on the 18 10 CFR 50.57 findings are satisfied, which allow 19 issuance of the operating license.
20 That's my last slide. I don't know if 21 there's any questions that I can answer.
22 MEMBER KIRCHNER: Mike, this is Walt 23 Kirchner. Have you found any major design changes 24 that would impact materially your SER?
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
95 MR. BALAZIK: No, not at this point.
1 There have been some design changes throughout the 2
review. One of the changes was related to the carbon 3
delay beds and changing sensors, but there haven't 4
been any substantive design changes. Most of them are 5
minor.
6 However, going forward there's that 7
potential that there may be substantive design 8
changes. Right now we're just not knowing until the 9
facility is substantially complete.
10 MEMBER KIRCHNER: Can you give us an idea 11 of an estimated schedule for issuance of the operating 12 license?
13 MR. BALAZIK: I think I would let SHINE 14 answer that question based upon their construction 15 schedule.
16 MR. BARTELME: This is Jeff Bartelme, 17 Director of Licensing from SHINE. We are working 18 through some schedule updates right now. We do have 19 construction going through the majority of next year, 20 but we're still working through an update. We're 21 committed to getting the staff a letter in the near 22 term providing a schedule update.
23 MEMBER BALLINGER: This is Ron Ballinger.
24 I guess for the staff it's probably a bit subjective, 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
96 but is there a threshold for which you need to modify 1
the SER? In other words, what constitutes enough 2
change so that you would have to modify the SER and 3
then maybe come before ACRS?
4 MR. BALAZIK: I think it's just dependent 5
upon what we've got documented in there, if it would 6
impact a finding. I think under that circumstance 7
that we'd have to come back to the ACRS. I think 8
we're going to have to do this as we see these design 9
changes and make that determination.
10 And of course, we can share all design 11 changes to the ACRS. It's just for their knowledge.
12 But again, I think it just depends on how we've 13 documented the design in the safety evaluation itself.
14 MEMBER BALLINGER: So it is a bit 15 subjective? There's no manual anywhere that says if 16 this happens then you have to do this?
17 MR. BALAZIK: That's correct.
18 MEMBER SUNSERI: This is Matt. They are 19 using a 50.59-like process, right, a 50.59 or a 50.59-20 like process, aren't they?
21 MR. BALAZIK: They are --
22 PARTICIPANT: Is it for construction?
23 MR. BALAZIK: SHINE is using that for 24 modifications for the facility.
25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
97 MEMBER SUNSERI: Right. I would think at 1
least one threshold would be anything that didn't 2
screen past 50.59 and required NRC approval prior to 3
implementing would be one that you would want to bring 4
forward.
5 MR. BORROMEO: This is Josh Borromeo. I 6
think the ultimate threshold is if they make a design 7
change and we're not aware of it. And then when we go 8
to make our 50.57 finding, if it doesn't align with 9
the FSAR, they don't get an operating license.
10 That's the ultimate backstop. Anything 11 that goes to that level, they'll have to address their 12 FSAR and we'll have to address our SE so that they are 13 in alignment and we can issue the license.
14 MEMBER BALLINGER: So how does this 15 process interact with the finding of substantially 16 complete construction?
17 MR. BORROMEO: SHINE will notify the staff 18 when they believe that they are substantially complete 19 with the facility. And then we'll inspect to ensure 20 that the facility is built in conformance with the 21 FSAR and we'll be able to operate it in conformance 22 with the FSAR. If we can't come to that finding, then 23 we won't issue an operating license.
24 MR. BALAZIK: One of the modules in the 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
98 Operational Readiness Inspection Program are design 1
changes. So that's where we can get a look at all 2
those if needed.
3 MEMBER BALLINGER: Thank you.
4 Questions from the members? I'm not sure 5
who's online anymore.
6 MR. BALAZIK: Thank you, everyone, for 7
your time.
8 MEMBER BALLINGER: I hear no other 9
questions.
10 Is it appropriate for public comments?
11 CHAIRMAN REMPE: Yes.
12 MEMBER BALLINGER: Okay. So now we should 13 ask for public comments. If there are members of the 14 public that would like to make a comment, please 15 unmute yourself, state your name, and make your 16 comment.
17 This is a bit anti-climatic. Hearing 18 none, we're through with the presentations.
19 I'm sure that I speak for the rest of the 20 committee that we, if you can use the word, enjoyed 21 the review process. And we thank you very much for a 22 very thorough, both the staff and the applicant -- I 23 don't think we ever found any question that we didn't 24 get an answer to very quickly. Again, it sounds a bit 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
99 anti-climatic but thank you.
1 Madam Chairman?
2 CHAIRMAN REMPE: Thank you for your 3
leadership and getting us through that timely.
4 At this time, I'd like to ask the court 5
reporter to close the record for the transcript and 6
come back tomorrow at 8:30. Okay, Allegra?
7 COURT REPORTER: Yes.
8 CHAIRMAN REMPE: We're going off the 9
record.
10 (Whereupon, the above-entitled matter went 11 off the record at 4:24 p.m.)
12 13 14 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
Advisory Committee on Reactor Safeguards SHINE Medical Technologies, LLC Operating License Application Review Michael F. Balazik, Project Manager/Inspector Non-Power Production and Utilization Facility License Branch Division of Advanced Reactors and Non-power Production and Utilization Facilities Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission November 29, 2022
Supporting Domestic 99Mo Production
- NRC staff committed to efficient reviews of applications and inspections in accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR)
- Licensing and oversight activities support U.S. national security interests and nuclear nonproliferation policy objectives of establishing a domestically-available and reliable supply of molybdenum-99 (99Mo) without the use of highly-enriched uranium
- Applications include initial license and license amendment requests for facilities proposing to manufacture, irradiate, and process low enriched uranium and molybdenum targets
- Oversight activities focused on construction inspection of utilization and production facilities 2
Responsibilities and Coordination
- The Division of Advanced Reactors and Non-Power Production and Utilization Facilities (DANU) is responsible, in part, for initial licensing activities associated with NPUFs licensed under 10 CFR Part 50.
- The following types of facilities may be licensed as commercial or research and development facilities under Sections 103 or 104 of the Atomic Energy Act, respectively:
Non-Power Reactors, including advanced reactor technologies
Subcritical Operating Assemblies
Production Facilities
- NRR relies on the expertise and support of other offices in the following technical areas to review medical radioisotope facility applications:
Emergency Planning
Physical Security
Environmental
Financial Qualifications
Material Control and Accounting
Accident Analysis
Chemical safety
Criticality Safety
Cybersecurity 3
SHINE Medical Technologies Background
- NRC received two-part construction permit application
Environmental Report (March 26, 2013)
Preliminary Safety Analysis Report (May 31, 2013)
- SHINE proposes to produce 99Mo from the fission of low enriched uranium target solution in an Irradiation Facility consisting of 8 irradiation units
- 99Mo is recovered through irradiated target solution processing in a Radioisotope Production Facility consisting of hot cells
- Construction permit issued on February 29, 2016
- Construction commenced in September 2019 4
Licensing Overview: SHINE Irradiation Facility
- Irradiation facility houses eight subcritical irradiation units, which are comparable in power level and safety considerations to existing non-power reactors licensed under 10 CFR Part 50
- However, due to subcriticality, irradiation units did not meet the existing definition of utilization facility in 10 CFR 50.2 and could not be licensed under 10 CFR Part 70
- To align licensing process with potential hazards, NRC issued direct final rule modifying 10 CFR 50.2 definition of utilization facility to include SHINE irradiation units
Published October 17, 2014
Effective December 31, 2014 5
Licensing Overview:
SHINE Radioisotope Production Facility
- Radioisotope Production Facility consists of a series of hot cells for 99Mo separation and purification
- Based on batch size (i.e., greater than 100 grams), facility meets the definition of a production facility as defined in 10 CFR 50.2, Definitions
- While the NRC has historically licensed production facilities, no such facilities are currently operating
- Few previously-licensed facilities have conducted similar activities as SHINE
Cintichem (licensed under 10 CFR Part 70)
West Valley (licensed as a reprocessing facility) 6
- Safety reviews for operating license applications conducted in accordance with Commissions regulations
- Staffs review tailored to unique and novel technology described in operating license application using appropriate regulatory guidance NUREG-1537, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors Interim Staff Guidance Augmenting NUREG-1537 Other guidance (e.g., regulatory guides and industry standards) and engineering judgment used, as appropriate NRC Safety Review Methodology 7
Review process for operating license applications:
Acceptance and docketing review Parallel safety and environmental reviews Request(s) for additional information, as needed Advisory Committee on Reactor Safeguards (ACRS) review Hearing(s) o No mandatory hearing required for an operating license o Potential for contested hearing(s) o Opportunity to request hearing and petition for leave issued on January 6, 2020 (60 days) o No hearing requests received Decision to grant or deny license 10 CFR Part 50 Licensing Process 8
SHINE Operating License Application
- SHINE submitted operating license application on July 17, 2019
- SHINE requested a single operating license under 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities
Irradiation units licensed as utilization facilities
Hot cells licensed as production facility
- SHINE requested a 30-year (Class 103) license (ML19211C089)
Per 10 CFR 50.22, Class 103 license is for commercial or industrial activities
Per 10 CFR 50.51(a),states that each license will be issued for a fixed period of time to be specified in the license but in no case to exceed 40 years from date of issuance
- SHINE submitted a supplement to the license application in January 2022, providing information on phased approach to operations
Consists of four phases
Operations and construction occurring simultaneously
The staffs evaluation of phased approach to operations is documented in Appendix A of the safety evaluation report (SER) 9
ACRS Subcommittee Engagement Subcommittee Topics (March 17)
Facility Description (Chapters 1, 4)
Site Characteristics (Chapter 2)
Coolant Systems (Chapter 5)
Engineered Safety Features (Chapter 6)
Subcommittee Topics (May 6)
Design of Structures, Systems, and Components (Chapter 3)
Electrical Power Systems (Chapter 8)
Auxiliary Systems (Chapter 9)
Radiation Protection and Waste Management (Chapter 11)
Subcommittee Topics (May 17/18)
Emergency Planning (within Chapter 12)
Accident Analysis (Chapter 13)
Criticality Safety (within Chapter 6b)
Material Control and Accounting (within Chapter 12)
Subcommittee Topics (July 19/20)
Design Criteria (within Chapter 3)
Instrumentation and Control (Chapter 7)
Fire Protection (within Chapter 9)
Conduct of Operations (within Chapter 12)
Operator Training (within Chapter 12)
Human Factors Engineering (within Chapter 7)
Subcommittee Topics (September 9, 2022)
Technical Specifications (Chapter 14)
Cybersecurity (within Chapter 12)
Subcommittee Topics (October 21, 2022)
Process Integrated Control System (within Chapter 7)
Phased Startup Operations (within Appendix A) 10
Basis for Issuing Operating License
- The following findings must be made to issue an operating license, based on 10 CFR 50.57, Issuance of operating license.
Construction has been substantially completed [10 CFR 50.57(a)(1)]
Facility will operate in conformity with application and regulations
[10 CFR 50.57(a)(2)]
Reasonable assurance that operation will not endanger public health and safety [10 CFR 50.57(a)(3)]
Applicant technically and financially qualified [10 CFR 50.57(a)(4)]
Provisions of 10 CFR Part 140 satisfied (Financial Protection Requirements) [10 CFR 50.57(a)(5)]
Issuance of license will not be inimical to common defense and security
[10 CFR 50.57(a)(6)]
These findings are supported by the NRC staffs evaluation of the application, as documented in the SER, and the staffs oversight activities, as documented in inspection reports Operational readiness inspection is a tool to provide input for NRC decisions regarding the issuance of an operating license 11 11
Next Steps
- The NRC staff will issue the final safety evaluation report
- If there is a need for design changes prior to the facility being substantially complete
Determine whether design change impacts the information and findings in the SER
Supplement the SER, as needed
Notify ACRS of any substantive changes to the SER
- Construction inspection oversight continues under IMC 69020, Inspections of Safety-Related Items (and Services) During Construction of Non-Power Production and Utilization Facilities and IMC 69021, Inspection of Quality Assurance Program Implementation During Construction of Non-Power Production and Utilization Facilities Inspections completed: May 2022 (ML22154A405), April 2021 (ML21224A127), December 2019 (ML20030A744) 12
Next Steps (continued)
NRC staff is developing a SHINE facility specific inspection plan using Inspection Procedure (IP) 69022, Inspections of Operational Readiness During Construction of Non-Power Production and Utilization Facilities Operational readiness inspections will be conducted once SHINE informs the NRC of readiness for each inspection activity Process and Effluent Monitoring Criticality Safety Radiation Protection Start-up Plan for Operation Operator Training Requalification Transportation Emergency Preparedness Instrumentation and Control Operations Quality Assurance Physical Security and Cybersecurity 13
Next Steps (continued)
SHINE is expected to notify the NRC in writing when construction of the facility is substantially complete Inspection activities will support the basis for the NRCs conclusion that the 10 CFR 50.57 findings are satisfied 14
© SHINE Technologies, LLC 1
© SHINE Technologies, LLC Overview of the SHINE Medical Isotope Production Facility (Open Session)
TRACY RADEL, VICE PRESIDENT OF ENGINEERING
© SHINE Technologies, LLC 2 SHINE Site Overview Construction Status Process Overview Technological Approach Safety Philosophy Outline
© SHINE Technologies, LLC 3 Located in Janesville, WI
© SHINE Technologies, LLC 4 Site Plan
© SHINE Technologies, LLC 5 Site Rendering
© SHINE Technologies, LLC 6 Construction Status Resource Building Storage Building Main Production Facility
© SHINE Technologies, LLC 7 Construction Status Air Handling Units Crane Structure for Installation of Supercell Process Piping
© SHINE Technologies, LLC 8 Periodic solution preparation from LEU Solution chemistry check and staging Irradiation for 5.5 days Extraction, purification, QC, and packaging Waste handling Process Overview
© SHINE Technologies, LLC 9 Small systems: 125 kW, hundreds of times less power than isotope production reactors being used o Low source termhelps ensure safety of public and workforce o Decay heat per system < 1 kW within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> o Minimizes waste nuclide generation compared to reactors Low enriched uranium (LEU) reusable target o Reduces waste o Product compatible with current supply chain o Eliminates need for highly enriched uranium (HEU)
Driven by low-energy electrostatic accelerator o Fission essentially terminate shortly after driver turned off Multiple units and trains provide operational scalability and flexibility Technological Approach
© SHINE Technologies, LLC 10 Low decay heat, low pressure, low temperature system o Minimal stored energy Independent units limit common cause failures Operator actions are not required to mitigate the consequences of an accident In the event of an upset condition:
o Target solution vessel (TSV) reactivity protection system (TRPS) initiates trip of system o Two completely independent safety-related TSV dump valves open o Target solution gravity drains to the TSV dump tank (safe for all uranium concentrations) o Hydrogen concentration maintained below lower flammability limit (LFL) by off-gas system blowers Following uninterruptible power supply (UPS) battery run time, entire plant is passively safe o 90 days without cooling: pool temperature rise is not more than 13°F o Nitrogen purge system for hydrogen control Safety Philosophy
Advisory Committee on Reactor Safeguards Digital Instrumentation & Controls Systems Full Committee Briefing November 29, 2022 Draft Guide 1374 - Proposed RG 1.152, Revision 4 Criteria for Programmable Digital Devices in Safety-related Systems of Nuclear Power Plants
Working Group
- NRR/DEX
- NRR/DORL
- Michael Marshall
- NRR/DRO
- NRR/DSS
- Khadijah West 2
- NSIR/DPCP
- RES/DE
Presentation Outline 3
- Scope of Draft Guide (DG) 1374 and associated Regulatory Guide (RG) 1.152, Rev. 4
- Background
- Proposed Changes
- Subcommittee Feedback and Staff Responses
- Summary
- Q&A
Scope of DG 1374 & RG 1.152, Rev. 4 Endorses IEEE Std. 7-4.3.2-2016 as an acceptable approach to meet regulatory requirements for promoting high functional reliability, design quality, and a Secure Development and Operational Environment (SDOE) for the use of programmable digital devices (PDDs) in the safety-related systems of nuclear power generating stations.
4
=
Background===
- Major Changes in IEEE Std 7-4.3.2 - 2016:
Incorporating secure development and operational environment guidance from RG 1.152, revision 3.
Providing specific criteria on the use of software tools in digital devices and the development of hardware, software, firmware, and programmable logic.
Revising Annex D, Identification and Control of Hazards.
5
Proposed Changes
- Remove SDOE guidance from RG 1.152, R3 that has been incorporated into IEEE Std 7-4.3.2-2016.
- Endorse Revision 2016 of IEEE Std 7-4.3.2 with exceptions and clarifications, including:
Additional guidance for fault detection and self-diagnostics, if used, in DI&C systems.
Guidance and clarification for control of access.
Endorsement of Annex D, Identification and Control of Hazards.
Include additional guidance for providing safeguards to safety-related programmable digital devices before installation.
6
Subcommittee Feedback and Staffs Responses Feedback #1 DG-1374 does not contain guidance addressing external electronic data communication control of access.
Response
The staff will revise DG-1374 to provide an example indicating the use of hardware-based uni-directional communication is an approach the staff considers acceptable.
7
Subcommittee Feedback and Staffs Responses (Cont.)
Feedback #2 The guidance for measurement and test equipment (M&ET) in IEEE Std 7-4.3.2 only requires disabling of wireless capability prior to connecting to safety-related equipment.
Response
Significant guidance exists for both the control of M&TE and use of wireless technologies. IEEE Std 7-4.3.2 additionally requires that portable M&TE be maintained, controlled and accessed in a secure location with access limited to authorized personnel only. Additionally, RG 5.71 contains the following guidance:
Section C.4.2 states checking and documenting all media and mobile devices, such as laptops, containing diagnostic, CDA [critical digital assets], and system and test programs or software for malicious code before the media or mobile device is used in or on a CDA.
Section B.1.17 states that the licensee/applicant is responsible for: establishing usage restrictions and implementation guidance for wireless technologies, documenting, justifying, authorizing, monitoring, and controlling wireless access to CDAs, and conducting scans for unauthorized wireless access points.
The staff believe these controls remain adequate and does not intend to incorporate additional guidance into RG 1.152.
8
Subcommittee Feedback and Staffs Responses (Cont.)
Feedback #3 The endorsement status of IEEE Std 7-4.3.2 Annex C, Dedication of Existing Commercial Computers, is not clear.
Response
The staff reviewed Clause 5.17 of IEEE 7-4.3.2 and found that it provides an acceptable approach for performing commercial grade dedication of digital equipment in safety-related systems at nuclear power plants. The staff also finds that Clause 5.17 is not in conflict with the guidance in RGs 1.164 and 1.250; therefore, the staff proposes endorsement of Clause 5.17.
The staff will revise the draft guide to clarify that Clause 5.17 of IEEE Std 7-4.3.2-2016 provides criteria that the NRC staff finds acceptable for the use of commercial digital equipment in safety-related systems at nuclear power plants. Clause 5.17 references Annex C for additional information on commercial grade item acceptance and dedication.
However, while there is useful historical and reference information in Annex C, the NRC staff does not see a need to endorse such information.
9
Subcommittee Feedback and Staffs Responses (Cont.)
Feedback #4 DG-1374 does not contain the discussion of the I&C safety system architecture, including the fundamental design principles.
Response
The scope of RG 1.152 is to endorse IEEE Std 7-4.3.2 as an acceptable approach to meet regulatory requirements (IEEE Std 603).
I&C safety system architecture is evaluated by the staff in the context of meeting four fundamental design principles: redundancy, independence, deterministic, and diversity and defense-in-depth (D3). The staff performs its evaluation using its licensing process guidance contained in Interim Staff Guidance (ISG) 06 and the Design Review Guide (DRG).
While the fundamental design principles are considered by the staff when evaluating the I&C safety system architecture, deterministic and D3 are not part of IEEE Std 603 requirements and thus are out of scope for this RG.
10
Summary RG 1.152 is one of the primary RGs used by applicants and licensees in the development of digital I&C license applications, reactor certifications, and digital I&C topical reports.
The update to RG 1.152 is a high priority based on recent licensing experience and interactions with stakeholders that contributed to the update to IEEE Std 7-4.3.2 in 2016.
11
Summary (Cont.)
The staff proposes the revision of RG 1.152 to
- Update information and guidance in the areas of functional reliability, design quality, and a SDOE for programmable digital devices in the safety-related systems of nuclear power plants.
- Support NRC guidance and review practices.
- Ensure that the guidance in these areas is current and consistent with the staffs position.
Thus, enhancing the efficiency and effectiveness of licensing review.
12
Questions?