ML22348A105
| ML22348A105 | |
| Person / Time | |
|---|---|
| Issue date: | 11/29/2022 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| References | |
| NRC-2189 | |
| Download: ML22348A105 (1) | |
Text
Official Transcript of Proceedings NUCLEAR REGULATORY COMMISSION
Title:
Advisory Committee on Reactor Safeguards Docket Number: (n/a)
Location: teleconference Date: Tuesday, November 29, 2022 Work Order No.: NRC-2189 Pages 1-99 NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers 1716 14th Street, N.W.
Washington, D.C. 20009 (202) 234-4433
1 1
2 3
4 DISCLAIMER 5
6 7 UNITED STATES NUCLEAR REGULATORY COMMISSIONS 8 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 9
10 11 The contents of this transcript of the 12 proceeding of the United States Nuclear Regulatory 13 Commission Advisory Committee on Reactor Safeguards, 14 as reported herein, is a record of the discussions 15 recorded at the meeting.
16 17 This transcript has not been reviewed, 18 corrected, and edited, and it may contain 19 inaccuracies.
20 21 22 23 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 www.nealrgross.com
1 1 UNITED STATES OF AMERICA 2 NUCLEAR REGULATORY COMMISSION 3 + + + + +
4 701ST MEETING 5 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 6 (ACRS) 7 + + + + +
8 TUESDAY 9 NOVEMBER 29, 2022 10 + + + + +
11 The Advisory Committee met via 12 Videoconference, at 1:00 p.m. EST, Joy L. Rempe, 13 Chairman, presiding.
14 15 COMMITTEE MEMBERS:
16 JOY L. REMPE, Chairman 17 WALTER L. KIRCHNER, Vice Chairman 18 RONALD G. BALLINGER, Member 19 VICKI M. BIER, Member 20 DENNIS BLEY, Member 21 CHARLES H. BROWN, JR., Member 22 VESNA B. DIMITRIJEVIC, Member 23 GREGORY H. HALNON, Member 24 JOSE MARCH-LEUBA, Member 25 MATTHEW W. SUNSERI, Member NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
2 1 ACRS CONSULTANT:
2 STEPHEN SCHULTZ 3 DESIGNATED FEDERAL OFFICIAL:
6 ALSO PRESENT:
7 MIKE BALAZIK, NRR/DANU/UNPL 8 JEFF BARTELME, SHINE Medical Technologies 9 ERIC BENNER, NRR/DEX 10 JOSH BORROMEO, NRR/DANU/UNPL 11 MICHAEL EUDY, RES/DE/RGPMB 12 CATHERINE KOLB, SHINE Medical Technologies 13 KIM LAWSON-JENKINS, NSIR/DPCP/CSB 14 KHOI NGUYEN, NRR/DEX/ELTB 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
3 1 T-A-B-L-E O-F C-O-N-T-E-N-T-S 2 PAGE 3 1) Opening Remarks by the ACRS Chairman (Open) 4 (JLR/LJB) 5 1.1) Opening Statement 4 6 1.2) Agenda and Items of Current Interest 6 7
8 2) Draft Guide (DG)-1374, "Criteria for Use of 9 Computers in Safety Systems at Nuclear Power Plants" 10 (Open) (CB/CA) 11 2.1) Subcommittee Chairman remarks 7 12 2.2) Presentation and discussions with NRC staff 8 13 14 3) Committee Deliberation on DG-1374, "Criteria for 15 Use of Computers in Safety Systems at Nuclear Power 16 Plants"/Preparation of Reports (Open) (CB/CA) 17 3.1) Committee Deliberation 69 18 3.2) Report Preparation 69 19 20 4) SHINE Operating License Application -- Final Safety 21 Evaluation Report (Open/Closed) (RB/CB) 22 4.1) Remarks from the Subcommittee Chairman 71 23 4.2) Presentations and discussion with 24 representatives from the NRC staff 72 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
4 1 P-R-O-C-E-E-D-I-N-G-S 2 1:00 p.m.
3 CHAIRMAN REMPE: Okay. It's 1:00 p.m. on 4 the East Coast. This meeting will now come to order.
5 This is the first day of the 701st meeting of the 6 Advisory Committee on Reactor Safeguards.
7 I'm Joy Rempe, Chairman of the ACRS.
8 Other members in attendance are Ron Ballinger, Charles 9 Brown, Vesna Dimitrijevic, Walt Kirchner, Jose March-10 Leuba, and Matt Sunseri.
11 Member Petti has been excused today.
12 Member Halnon is not present at this time, but he will 13 be participating intermittently during this meeting.
14 And Member Bier is having some connection 15 difficulties, but we anticipate that she'll be joining 16 us shortly. Nevertheless, I note we do have a quorum.
17 Today the committee is meeting in-person 18 and virtually. The ACRS was established by the Atomic 19 Energy Act and it's governed by the Federal Advisory 20 Committee Act.
21 The ACRS section of the USNRC public 22 website provides information about the history of this 23 committee and documents such as our charter, bylaws, 24 Federal Register notices for meetings, letter reports, 25 and transcripts of all full and subcommittee meetings, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
5 1 including all slides presented at the open meetings.
2 The committee provides its advice on safety matters to 3 the Commission through its publicly available letter 4 reports.
5 The Federal Register notice announcing 6 this meeting was published on November 14, 2022. This 7 announcement provided a meeting agenda, as well as 8 instructions for interested parties to submit written 9 comments or request opportunities to address the 10 committee. The designated federal officer for today's 11 meeting is Ms. Christina Antonescu.
12 The communications channel has been opened 13 to allow members of the public to monitor the open 14 portions of the meeting. The ACRS is now inviting 15 members of the public to use the MSTeams link to view 16 slides and other discussion materials during these 17 open sessions. The MSTeams link information was 18 placed in the Federal Register notice and agenda on 19 the ACRS public website.
20 We received no written comments or 21 requests to make oral statements from members of the 22 public regarding today's session. Periodically the 23 meeting will be opened to accept comments from 24 participants listening to our meetings. Written 25 comments may be forwarded to Ms. Christina Antonescu, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
6 1 today's DFO.
2 During today's meeting the committee will 3 consider the following topics: Draft Guide 1374, 4 Criteria for Programmable Digital Devices and Safety-5 Related Systems of Nuclear Power Plants, and the SHINE 6 Operating License Application -- Final Safety 7 Evaluation Report. Note that portions of the SHINE 8 discussion may be closed, as stated in the agenda.
9 A transcript of the open portions of the 10 meeting is being kept. It's requested that speakers 11 identify themselves and speak with sufficient clarity 12 and volume so they can be readily heard.
13 Additionally, participants should mute themselves when 14 not speaking.
15 At this time, I'd like to ask other 16 members if they have any opening remarks. And I'd 17 also like to ask whoever has their phone not on mute 18 to please mute it.
19 COURT REPORTER: That's the court 20 reporter.
21 CHAIRMAN REMPE: Okay. So if not, I would 22 then like to ask Charlie Brown to lead us in our first 23 topic for today's meeting.
24 Charlie?
25 MEMBER BROWN: Okay. Thank you very much, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
7 1 Joy. I don't have any other additional comments to 2 make. I will just call on Eric and Khoi to make 3 opening remarks and start on the presentation.
4 MR. BENNER: Okay. Thank you.
5 This is Eric Benner. I'm the Director of 6 the Division of Engineering and External Hazards, 7 which has programmatic lead for digital I&C licensing.
8 We briefed the subcommittee just a few short weeks ago 9 and found those discussions very fruitful.
10 In the interim time, we reshaped our 11 presentation today to mostly focus on the things we 12 heard in the subcommittee meeting such that the staff 13 and the committee could continue dialoguing on these 14 issues. We feel that will be most productive to help 15 the committee in developing their letter report.
16 That being said, we have the presentation 17 that we used at the subcommittee meeting queued up.
18 If there are other questions that come up, we 19 certainly are going to use the time to answer any of 20 the questions the committee has, whether it was on 21 topics we heavily discussed at the subcommittee or 22 anything else that has come up in the interim.
23 With that, I'm going to turn it over to 24 Khoi, who will be our lead presenter.
25 MR. NGUYEN: Thanks, Eric.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
8 1 My name is Khoi Nguyen. I'm an engineer 2 from the Engineering Branch in the Division of 3 Engineering and External Hazards in NRR. I'm here to 4 present the Draft Guide 1374, the proposed revision of 5 the Reg Guide 1.152, Criteria for Programmable Digital 6 Devices in Safety-Related Systems of Nuclear Power 7 Plants.
8 Next slide, please.
9 As you see and as shown on the slide, the 10 development of this draft guide involved the staff 11 from six divisions of the three different offices.
12 Next slide, please.
13 This slide shows the outline of today's 14 presentation.
15 Next slide, please.
16 The scope of the Draft Guide 1374 is to 17 endorse IEEE Standard 7-4.3.2-2016 as an acceptable 18 approach to meet the regulatory requirements for 19 promoting the high-functional reliability, desired 20 quality, and secure development and operational 21 environment for the use of programmable digital 22 devices in the safety-related systems of nuclear 23 power-generating stations.
24 For the purpose of this meeting, I would 25 like to use the term 7-4.3.2 for IEEE Standard 7-4.3.2 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
9 1 and the term SDOE for secure development and 2 operational environment.
3 Next slide, please.
4 This slide shows the major changes in the 5 standards of the 7-4.3.2-2016 version. It 6 incorporates the SDOE guidance from Reg Guide 1.152 7 Revision 3. It provides the specific criteria on the 8 use of software tools in the digital devices and the 9 development of hardware, software, firmware, and 10 programmable logic. It also revised Annex D, 11 Identification and Control of Hazards.
12 Next slide, please.
13 The proposed change under this revision of 14 the draft guide to remove the SDOE guidance from Reg 15 Guide 1.152 Rev 3, that has been incorporated into the 16 7-4.3.2-2016 version. It endorsed Revision 2016 of 7-17 4.3.2 with exceptions and clarifications, including 18 additional guidance for fault detection and self-19 diagnostics if used in digital I&C systems.
20 It provides guidance and clarification for 21 control of access and endorsement of the Annex D, 22 Identification and Control of Hazards. Finally, it 23 includes additional guidance for providing safeguards 24 for safety-related programmable digital devices before 25 installation.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
10 1 Next slide, please.
2 CHAIRMAN REMPE: Before you leave that 3 slide -- again, I apologize for missing the 4 subcommittee meeting, but I did look over the slides 5 and the transcript.
6 There were a lot more changes in your 7 earlier, more in-depth presentation incorporated. And 8 one of them that I don't see here that was not only in 9 your earlier slide pack but discussed a lot by the 10 subcommittee was the fact that you've drawn in some 11 language from ISG-04 related to independence.
12 During the discussions, the subcommittee 13 members explored about when you're going to retire 14 ISG-04. There was a lot of discussion about a need 15 for a road map and things like that because of the 16 spaghetti of regulations.
17 And I guess I'd like to explore that a 18 little here because I noticed you don't even list it 19 here, and I saw the subsequent slides that you're 20 going to be going through about the changes and the 21 comments. That one was not mentioned in today's 22 package.
23 Why do you not mention that and the fact 24 that -- it was one of the major points that the 25 subcommittee emphasized about trying to decide whether NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
11 1 ISG-04 was -- what parts of it were still applicable 2 or not. Could you elaborate a bit about why you're 3 not mentioning it today?
4 MR. NGUYEN: There's no particular reason 5 I didn't include that clarification for ISG-04 in this 6 presentation. But if you want to know why I didn't 7 include it, as stated in the slide, this draft guide 8 endorses the standard with exception and 9 clarification.
10 It has an inclusive list of details of all 11 the changes. We endorse the standard with 12 clarification. And some of them from the ISG-04 13 didn't incorporate into 7-4.3.2. So in this draft 14 guide we put the guidance from ISG-04 in the guidance, 15 but there's no new guidance included.
16 CHAIRMAN REMPE: So one of the points the 17 subcommittee members made was how does an applicant 18 know they still need to look at ISG, certain parts of 19 it that are not brought into this reg guide.
20 I guess I thought that was something that 21 the staff had kind of agreed, yes, maybe we need a 22 better road map and we need to identify that ISG still 23 holds until we can get where we retire it. And then 24 when I looked at the subcommittee discussion, I never 25 saw a clear time table when ISG-04 would be retired.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
12 1 MR. BENNER: This is Eric Benner. We took 2 it that that discussion was offline from this, that 3 the bigger picture of the road map to help the 4 committee understand how all this stuff fits together 5 was separate from this document.
6 The reality is all of the ISGs are 7 guidance to the staff. And so they won't get sunset 8 until that guidance gets incorporated into the formal 9 staff guidance of the standard review plan. In the 10 meantime, we also allow licensees to look at staff 11 guidance to understand where the staff is coming from.
12 So in reality, I believe we really should 13 have companion guidance in both the guidance to 14 industry, which is typically in the form of regulatory 15 guides, and the guidance to staff, which is namely 16 embodied in the standard review plan.
17 ISG-04 won't, strictly speaking, be 18 retired until it gets morphed into the standard review 19 plan. But this is now the guidance we're putting out 20 to the industry on these topics.
21 CHAIRMAN REMPE: This helps me. You've 22 got to go and get all of the SRP. But in your 23 perspective, this discussion about ISG-04, you need to 24 remind people it should not be put in the reg guide 25 because it's --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
13 1 MR. BENNER: Correct.
2 CHAIRMAN REMPE: Okay. That helps me 3 understand your perspective. We'll see what the 4 committee's perspective is, but yes.
5 MEMBER BROWN: Before he goes on -- this 6 is Charlie -- that is brought up in the letter, Joy.
7 So we had our opportunity to address this in one way 8 or the other.
9 CHAIRMAN REMPE: I'm aware of that. I 10 just was curious because it's not here in today's 11 presentation. Yes, I did see it. Again, I know it's 12 not in the presentation and I just wanted to make sure 13 it was on the table here.
14 The discussion about the road map was also 15 not in your letter but it was discussed heavily during 16 the discussion meeting -- your draft letter. Thanks.
17 MR. NGUYEN: Next slide, please.
18 During the November 17th subcommittee 19 meeting the staff received several feedbacks from the 20 members. This slide and the next few slides will show 21 those feedbacks and the staff-proposed response.
22 For feedback number one, the concern was 23 the draft guide does not contain guidance addressing 24 external electronic data communication control and 25 access. The staff will revise the draft guide to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
14 1 provide an example indicating the use of hardware-2 based uni-directional communication. It's an approach 3 that the staff considers acceptable.
4 Any questions on this slide?
5 Next slide, please.
6 The second feedback was the use of the 7 wireless capability for measure and test equipment, or 8 MTE, will potentially compromise the safety 9 functionality, such as potential unwanted software is 10 downloaded wirelessly prior to disabling the wireless 11 function. Thus, the MTE becomes a pathway for 12 unwanted software.
13 However, significant guidance in the 14 document exists to provide for both control and the 15 use of wireless technology at the nuclear power 16 plants. These include the design and operational 17 controls, as noted in the slide.
18 IEEE Standard 7-4.3.2 requires that 19 portable MTE be maintained, controlled, and accessed 20 in a secure location with access limited to authorized 21 persons only. Further, in addition to the all the 22 restrictions for use of the wireless technology, Reg 23 Guide 5.71 contains specific operational controls that 24 require the MTE is checked prior to use in a critical 25 reach of access.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
15 1 Therefore, the staff believes these 2 controls are adequate and sufficient. And the staff 3 does not intend to incorporate additional guidance 4 into Reg Guide 1.152.
5 MEMBER BROWN: I have a comment on that.
6 I looked at C-4.2 and I had a hard time finding this 7 that states the checking and documenting. I've been 8 through all the 4.1, 2.1, 2.2, et cetera, et cetera.
9 And 5.71 is the general document that says this is how 10 you configure your entire program.
11 The comments I was making in the 12 subcommittee meeting were referring to how you do this 13 operationally. We've got M&TE. We've got wireless 14 stuff hooked up to those things to bring you whatever 15 they're doing, updates or other stuff that you're 16 going to use as part of your test and evaluations, 17 stuff like that.
18 I'm not quite sure how we'll address this 19 thought process in the letter now. I do have a 20 discussion of it, but this is a very generalized 21 overall what you should do, not how do you execute 22 when you're doing the design.
23 Guide 1.152 is the design. You say that 24 in your thing. It's one of the primary design 25 documents and guidance that you have. The idea that NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
16 1 in this other programmatic thing sitting over here 2 somewhere it says you ought to be doing something, the 3 actual execution, I'm still somewhat wary of that. We 4 can discuss this more after you finish.
5 MR. NGUYEN: Yes.
6 MEMBER BROWN: We'll probably do that when 7 I do the letter because I do have a section on this 8 issue in the letter.
9 MR. NGUYEN: Thank you for the comment.
10 Mike, can you bring up the document, IEEE 11 Standard 7-4.3.2, on page 29?
12 MR. EUDY: Sure. Hold on a second.
13 MR. NGUYEN: Yes, on the slide.
14 MEMBER BROWN: You said Reg Guide 5.71 15 contains the following and that's C-4. It's not in 16 the --
17 MR. NGUYEN: Yes.
18 MEMBER BROWN: Okay. I just wanted to 19 make sure we were on the same page.
20 MR. NGUYEN: Because you said these are 21 the programmatic documents. I would like to bring up 22 7-4.3.2 as endorsed by Reg Guide 1.152 for the exact 23 guidance. If you look at page 29 and the subclause 24 5.9.1, the last three paragraphs on that subclause 25 provide the guidance on how to safely control the MTE.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
17 1 MEMBER BROWN: All it says is access to 2 permanent or portable engineering work stations and to 3 M&TEs shall be limited to a defined set of authorized 4 employees. You're talking about 5.9.1?
5 MR. NGUYEN: Yes.
6 MEMBER BROWN: That's the last -- I've got 7 the document open right in front of me.
8 MR. NGUYEN: If you look at the last three 9 paragraphs, the three short paragraphs --
10 MEMBER BROWN: Yes.
11 MR. NGUYEN: -- these provide the specific 12 guidance for how to control the MTE equipment.
13 MEMBER BROWN: It's if you think wireless 14 is okay, it tells you what you should do. If you 15 don't think wireless should be used, it doesn't. The 16 issue is should you or should you not be using 17 wireless communications to update and utilize M&TE and 18 that type of stuff. This thing says you've got to be 19 careful if you use wireless.
20 MR. NGUYEN: No. This particular 21 subclause doesn't provide guidance for wireless. It's 22 for MTE. If you want to use MTE in the safe zone 23 inside the fence, you have to follow this guidance 24 first, regardless of if you have the wireless capable 25 or not. All the MTE has to follow these provisions.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
18 1 MEMBER BROWN: Scroll a little higher to 2 access controls. Lower, I mean, so that access 3 controls comes up. It closes out the first paragraph.
4 Now down a little bit. Put those three paragraphs --
5 now bring in more of 5.9.1. Scroll down -- no, up a 6 little bit so you get those last -- that's it.
7 It's the last paragraph down there that 8 talks about disabling and once you go to do the 9 hookup. There's two aspects here. Nobody's going to 10 disagree with that.
11 You're obviously not -- well, maybe it's 12 not obvious, but the point was this effectively says 13 we allow the use of wireless to update, do whatever it 14 wants to do to all the M&TE equipment and anything 15 else we decide we're going to use, portable work 16 stations or other work stations.
17 And then up above that it says if you're 18 going to do it then you're going to only have good 19 people, cleared people. Permanently connected work 20 stations shall be installed in a plant area that's not 21 accessible, that provides physical security. That's 22 not wireless security.
23 And in the first paragraph it says 24 engineering stations that interface with safety 25 equipment shall be maintained, controlled, and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
19 1 accessed in a physically secure location. It has 2 nothing to do with is wireless okay or not. It just 3 says if you protect it physically, you're happy.
4 And the issue that I have -- this is me.
5 The rest of the committee may not agree with me when 6 we go through the letter. The issue I have is 7 physical protection isn't worth a hangnail in this 8 circumstance. It's the fact that it's sitting out 9 there downloading stuff at other times, updates, 10 whatever they are.
11 You disconnect everything and it's in a 12 nice, physically secure location. That still doesn't 13 protect you with wireless unless you put a copper 14 shield around the entire building so you don't get any 15 wireless, which you might as well just disconnect the 16 wireless in the first place.
17 That's the point. Now, whether anybody 18 agrees with me or not is another issue. I'm just 19 saying that's something that we will have to settle 20 amongst ourselves.
21 I understand your point about the physical 22 security, the access via the IEEE standard. I don't 23 have any problem with those in terms of what they say.
24 They are valid. But they don't address the basic 25 where I'm sitting here all alone in a secure facility.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
20 1 I can be attacked, downloaded, and have some stuff 2 residing.
3 And to think you're going to go in --
4 every time you go to get a maintenance test or every 5 time you sit down with a portable work station, you're 6 going to disable that and then run through a complete 7 virus scan for everything that's on it, that is 8 operationally probably not real doable.
9 MR. BENNER: This is Eric Benner. Member 10 Brown, we don't dispute that vulnerability. But for 11 us, like Khoi started with the main purpose of this 12 document, our endorsement of this document is a 13 methodology to meet the requirements in 10 CFR 14 50.55(h), which incorporates by reference IEEE 603.
15 So that's why not only do we say this 16 exists from that standpoint, but the concerns you've 17 talked about we see more as -- I think you alluded to 18 them -- operational concerns. And the operational 19 management of M&TE falls more under the program that 20 licensees do in response. And our staff's guidance is 21 5.71. Those things are complementary.
22 So it's a matter of those requirements, 23 the cyber security requirements aren't contained in 24 50.55(h) or IEEE 603. So that's why --
25 MEMBER BROWN: It was 1991.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
21 1 MR. BENNER: That's right.
2 MEMBER BROWN: But that's --
3 MR. BENNER: I understand. But from our 4 standpoint, cyber security is regulated as an 5 operational program in a different part of the 6 requirements. And this guidance isn't in any way for 7 demonstrating compliance to those requirements.
8 There's different guidance for demonstrating 9 compliance to those requirements.
10 Certainly the committee will deliberate 11 and come to the conclusion it comes to. But for us, 12 we're trying on one level to keep some of this 13 cleaner.
14 We try to reference appropriately where 15 these -- we do believe that licensing and cyber 16 security clearly have complementary aspects to them.
17 So we work heavily with NSIR to try to make sure the 18 right linkages are there, both from a design and 19 licensing standpoint and an operational oversight 20 standpoint. We'll certainly respect where the 21 committee comes out.
22 MEMBER KIRCHNER: I share Charlie's 23 concern. Does a piece of test equipment if it's 24 connected to a safety-related digital system or 25 digitally based system, does that by default become a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
22 1 critical digital asset, and therefore before you would 2 connect such test equipment to a safety-related system 3 you would have to check it for malware?
4 MR. BENNER: I see that Kim Lawson-Jenkins 5 has her hand up, and she could speak much more 6 authoritatively than me on this.
7 MS. LAWSON-JENKINS: Hi. Thank you.
8 My name is Kim Lawson-Jenkins. I work in 9 the Cyber Security Branch of NSIR. And yes, it is a 10 requirement.
11 First of all, the M&TE is not a CDA.
12 However, when it is connected to a CDA or a safety-13 related device, it has to be protected at the same 14 level as the device it's connecting to. So if a 15 vendor comes in and connects to that device, they have 16 to assure the licensee that it is protected at that 17 level when they're connecting it.
18 That is one of the main reasons we don't 19 have the requirement on what the vendor does when he's 20 using the M&TE within a secure development 21 environment. Once you're connected to the device is 22 when it's really important to know that there is no 23 malware on that device.
24 There are best practices. They are not in 25 this document. For instance, you have things like NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
23 1 least functionality, which I think is exactly what 2 you're alluding to when you're saying no wireless 3 capability should be on the device.
4 But that in itself does not inherently 5 make the device more secure. I know it may seem like 6 it that you think there are less attack pathways, but 7 what's really making it secure is that you have, as 8 we've said in this document that we're looking at 9 right now, tightly controlled access to that device.
10 If malware ever gets on the M&TE, it is 11 there. The salient point then isn't how it got on 12 there. It's to be able to recognize that you have 13 malware on a device and then to remove it before 14 connecting it to a critical digital asset.
15 So I'm not disputing or saying that 16 wireless is not important at all, but the important 17 thing that you have to do when you're connecting MT&E 18 to a device is, first of all, not to do it wirelessly; 19 to have a wired connection so that when you're doing 20 the data transfer there's no question that you have a 21 secure connection.
22 And the next step is to make sure that 23 before you connect that device, that MT&E, that it is 24 clean; it does not have malware on it. And if a 25 vendor has done all the other best practices of having NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
24 1 the least amount of software on there, to have 2 functions only needed to support the critical digital 3 asset, that should make it secure.
4 So I just question -- and I understand the 5 issue about wireless, but removing that access before 6 you even do a connection doesn't really inherently 7 make it more secure. That's the point I'm trying to 8 make. I'm not saying it doesn't, that it absolutely 9 doesn't make a difference. I'm not saying that.
10 But the amount of benefit that you're 11 getting, more benefit would be coming from verifying 12 that you have the least amount of functionality that 13 you need on there to support that digital critical 14 asset. And then to be able to do comprehensive scans 15 of that device to make sure that there's no 16 unauthorized software on it and there's no known 17 viruses on that device.
18 I know that was a long answer to the 19 original question. We're trying to ensure that when 20 you connect that device, it's protected at the same 21 level as the CDA that you're connecting to. And the 22 history of how things got on it may not be relevant.
23 You just want to make sure at that moment when you're 24 connecting it that it is secure.
25 MEMBER BROWN: I don't disagree with that, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
25 1 that it's secure when you connect it, but it's not 2 always just a vendor that comes in and brings his own 3 stuff in. The plants have their own operational 4 equipment where they have to do periodic this or 5 periodic that, and that's M&TE at the same site of the 6 same kind.
7 MS. LAWSON-JENKINS: Yes.
8 MEMBER BROWN: If it's sitting in a room 9 physically secure but wireless connected, that means 10 it's open. Depending on the configuration of it at 11 the time, a lot of stuff -- when I've got my laptop 12 just sitting around and it's off, information gets 13 into it. I find that out when I turn it back on.
14 Once you've got a connection of any kind, 15 whether it's a hardwired connection or a wireless 16 connection, it's downloading. So that means every 17 time you go to use that piece of test equipment, a 18 plant technician, before he does anything he's got to 19 go do a complete whatever, virus protection. They've 20 got to go through the whole rigmarole --
21 MS. LAWSON-JENKINS: Yes, they do.
22 MEMBER BROWN: -- before they actually go 23 in and do any calibrations, testing, or anything else.
24 That's what that would mean.
25 MS. LAWSON-JENKINS: Yes.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
26 1 MEMBER BROWN: So I understand that the 2 plant would have to --
3 MEMBER KIRCHNER: That's what I was 4 asking, Charlie --
5 MEMBER BROWN: Yes.
6 MEMBER KIRCHNER: -- if that is explicitly 7 stated somewhere. If not in this reg, does it exist 8 in --
9 MEMBER BROWN: That's the licensee --
10 MEMBER KIRCHNER: -- in your world -- I'm 11 trying to think of which of the applicable reg guides 12 for cyber security, but is that explicitly stated?
13 MS. LAWSON-JENKINS: That is explicitly 14 stated in the section that was referenced on the 15 slides that were presented. It's also in the same reg 16 guide for portable media and mobile devices.
17 That includes M&TE where it says that you 18 must connect it -- when you connect it, it has to be 19 protected at the same level. I know I gave Khoi some 20 information about scanning the devices also.
21 Admittedly, all of these things happen in 22 the operational state. I absolutely agree with Member 23 Brown on that. That is where it's occurring. And 24 even before the device comes to the plant it has to be 25 checked, and there has to be assurance that it has NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
27 1 been maintained in a secure fashion. So part of the 2 oversight that is occurring when you're speaking to 3 the vendor is how do they keep these devices secure.
4 And at the --
5 MEMBER BROWN: Excuse me. It's not just 6 vendors. I mean, you don't call vendors in just to do 7 stuff you have to do routinely, I don't think. We 8 used to do it ourselves. Our operators did all the 9 testing and everything else.
10 I'm not a commercial plant operator, but 11 I'd presume commercial plants have electronic 12 technicians on their staff that do all their 13 calibrations and updates. You don't call in 14 Westinghouse or whoever did it at the time, whoever 15 designed the stuff to do that for you every time.
16 So bringing stuff into the plant, that's 17 covered. If you're going to bring something in and 18 it's going to be from outside the plant, people are 19 going to say, hold it. You can't use that until --
20 and they'll go check it. If the wireless is disabled 21 when they do that, you're probably golden.
22 I'm talking about stuff that's available 23 to the plant operators and the technicians, and it's 24 sitting in a secure facility where it's controlled.
25 It's logged and it knows the calibration period. It's NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
28 1 all set up. So that's all parked in, but it's got a 2 wireless connection.
3 Most of the new test equipment is all 4 software controlled. You can't get away from it 5 except the old analog volt meter. Well, not even 6 those anymore. They've got microprocessors in them.
7 So it's just a source that now says if you 8 allow that stuff to be updated -- again, if your 9 wireless is connected, even if it's off, it's 10 downloading. That means every time you go test that 11 stuff, even though it's been validated and checked 12 before the last time you used it, you've got to go 13 through the whole drill of reverifying whether it has 14 been contaminated or some cyber attack has gotten 15 through to it.
16 MS. LAWSON-JENKINS: And that is true.
17 MEMBER BROWN: Okay. So we're on the same 18 page from that stance.
19 MS. LAWSON-JENKINS: Yes. Okay.
20 MEMBER BROWN: The one way to get around 21 that is to not have test equipment ever hooked up to 22 wireless. If you need to update it, hook it up to a 23 cable where you know when you do it explicitly. And 24 then you can download and check that you didn't get 25 any malware downloaded.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
29 1 Although remember, all your cyber security 2 equipment, you're checking for what you already know, 3 not for what you don't know. It's very reactive.
4 That's why everybody keeps getting hacked. Somebody 5 figures out how to do it again. So I'm just 6 skeptical.
7 Again, this is my view. This is not the 8 committee's view. This is my view. And I've included 9 a section in the letter that we'll be able to discuss 10 it and come to an agreement. This has been, I think, 11 a helpful discussion to let everybody hear a little 12 bit more than me talk.
13 MEMBER BLEY: Charlie?
14 MEMBER SUNSERI: I think you're right --
15 MEMBER BROWN: Matt, what did you say?
16 MEMBER SUNSERI: Let Dennis go.
17 MEMBER BROWN: Okay. I don't want to 18 forget you.
19 Dennis?
20 MEMBER BLEY: Yes. I'm following that 21 discussion or trying to. I want to make sure I get 22 your point on this. It's almost like you're telling 23 the folks in the plants they don't want to do this and 24 they've got to make sure it doesn't have that 25 capability.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
30 1 I'm curious from the staff's point of 2 view, even if you don't have wireless access, you have 3 a physically secure place but people can go in and out 4 of there who are authorized. The thing I've been 5 hearing is this is a lot of burden to have to do a 6 full scan on the test equipment you bring out of that 7 secure facility.
8 Even if they don't have wireless access, 9 do you still have to do the same kind of scans and 10 things?
11 MEMBER BROWN: I would think -- sorry, 12 Dennis.
13 MEMBER BLEY: I wanted to hear from the 14 staff on that, Charlie.
15 MEMBER BROWN: Okay. I didn't know who 16 you were asking.
17 MS. LAWSON-JENKINS: Yes. They will have 18 to do the same procedure because it isn't a matter of 19 -- they have to maintain the integrity of the device.
20 As you just mentioned, you have physical access.
21 Even when you have wired access, if you 22 have an affected vendor, the website where you're 23 going to do the download, and if you have a wired 24 connection that you're connecting to the internet, it 25 is still possible to download malware that way.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
31 1 MEMBER BLEY: Okay. So I'm trying to get 2 this straight. From the point of view Charlie's been 3 arguing, if you get rid of one of those vectors to 4 come in, that means you've cut out one possible route 5 but there are still others.
6 From the practical side of I go in and get 7 a piece of equipment, I've got to do the same checks 8 on it whether or not there's wireless capability. So 9 there isn't any real savings in a practical sense 10 other than we know we've cut out one possible vector 11 out of many.
12 MS. LAWSON-JENKINS: And if you're 13 allowing wireless in the plant, they're doing scans to 14 see the type of connections that are occurring. So I 15 believe one of the concerns that Member Brown has 16 should be captured in the scans, especially in areas 17 where you have maintenance equipment that you're going 18 to be connecting to other devices.
19 MEMBER BLEY: Okay. Thanks.
20 Charlie, I kind of cut you off. Did I 21 misstate your concerns?
22 MEMBER BROWN: You didn't misstate. You 23 just didn't -- what's the right -- you said if you 24 don't have wireless. And somebody said you've got to 25 connect by cable. Well, it goes two ways.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
32 1 The M&TE is not connected to anything.
2 It's not connected by cable. It's not connected by 3 wireless. Physically you can control the cable. You 4 can't control the wireless as easy if it's on, whereas 5 with a cable you disconnect it and away you go.
6 You can do the same thing with the 7 wireless. That's the best way to do it, to not have 8 it at all. And then when somebody comes in to get the 9 equipment, it has been certified the last time. If 10 it's physically secure and nobody's come in, that 11 doesn't prevent the same thing we always worry about.
12 Even a vendor can come in to upgrade 13 software on a piece of safety equipment, which 14 everybody says is okay but somehow down there it's 15 buried. They introduce it and away you go. That's a 16 physical check that you have to do every time. It's 17 just one more way for equipment to be compromised.
18 Matt, you were going to say something.
19 MEMBER SUNSERI: I was just --
20 CHAIRMAN REMPE: Jose's had his hand up 21 too, just to keep track.
22 MEMBER BROWN: Okay. I didn't see that.
23 MEMBER SUNSERI: This is Matt. I was just 24 going to confirm -- at least my time in the plants is 25 getting pretty dated now -- the plants are very NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
33 1 attuned to that and calibrating what they're going to 2 connect into the plant. So they do the scans all the 3 time.
4 MEMBER BROWN: Okay.
5 MEMBER SUNSERI: They check it out. As I 6 recall, there was even two people involved so that you 7 weren't relying on a single person that could be 8 coding something in there without somebody watching 9 them.
10 MEMBER BROWN: Jose?
11 MEMBER MARCH-LEUBA: Yes. Thank you.
12 MEMBER BROWN: Are you done, Matt?
13 MEMBER SUNSERI: (No audible response.)
14 MEMBER BROWN: Jose, go ahead.
15 MEMBER MARCH-LEUBA: Yes. I just wanted 16 to warn against the false sense of security that I 17 keep hearing from the staff. We have a requirement 18 that the thing be clean and you will clean it. Yes.
19 Everybody in the world will scan their Windows 20 computer and Google Chrome for vulnerabilities, and it 21 was coming out green and clean.
22 Just this week Google issued an emergency 23 patch for a vulnerability that was being exploited.
24 So just because we were running Windows Defender or 25 sophisticated McAfee on the system and we were not NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
34 1 finding a vulnerability, it doesn't mean it wasn't 2 there. Everybody that has a Windows computer or 3 anybody that uses Google Chrome had a vulnerability 4 that was scanned negative last week and it was a false 5 negative. So just the fact that you scan doesn't mean 6 it's not there.
7 Let me give an example from other areas of 8 our field. We our design our pipes to be seismically 9 qualified. We scan them regularly for cracks. But 10 nevertheless, we assume the pipes will break and you 11 will have LOCAs. Even though you design it to be 12 perfect and you scan it to be perfect, you still say, 13 what happens if it breaks.
14 In the area of cyber security, we have to 15 keep everything very controlled. We have to scan for 16 vulnerabilities. But you have to do the extra step of 17 assuming that LOCA is going to happen. What will you 18 do then? How will you prevent it?
19 I keep hearing this extremely false sense 20 of security from the staff. We had it 12 years ago.
21 They told us they were going to keep it clean. They 22 don't. They cannot do it. Okay, just getting it on 23 the record.
24 MEMBER BROWN: Any other comments?
25 MS. LAWSON-JENKINS: This is Kim Lawson-NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
35 1 Jenkins. I would like to briefly reply to that. I 2 honestly don't believe anyone in the cyber security 3 community has a false sense of assurance about 4 attacks.
5 The hackers are very sophisticated. They 6 are always changing their methods. They are always 7 trying to exploit vulnerabilities. They are always 8 trying to misuse protocols or functions that will 9 become vulnerabilities that they can exploit.
10 So I'm sorry if I gave the impression that 11 scanning is the end-all to be all. It is only one 12 tool in the tool box, which must be used correctly to 13 be able to identify, as you said, known 14 vulnerabilities. I mentioned having a reduced amount 15 of software and only necessary things on the device 16 will help with those unknown vulnerabilities, things 17 that people can exploit in the future.
18 MEMBER MARCH-LEUBA: Yes. I want to make 19 a point to apologize to you because I know you are 20 very good and you take it seriously.
21 Just think of what other people do, 22 especially the ones that come from the management 23 side. We had a member just mention how seriously they 24 take the scans. When you don't know as much as you 25 and I know, you think that the scan saves you. A scan NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
36 1 is just one thing you should and must do, but it 2 doesn't protect you 100 percent.
3 When we leave the money man in charge of 4 the implementation, there is a big tendency to save 5 money. You have to because otherwise your plant won't 6 run and you have to close it.
7 MS. LAWSON-JENKINS: I'm afraid I've 8 hijacked Khoi's meeting. I didn't want this to become 9 a cyber security discussion. I honestly look forward 10 to continuing these discussions, but I want Khoi to be 11 able to finish his presentation.
12 MEMBER BROWN: You're doing just fine, 13 Kim. Don't worry about it.
14 MEMBER MARCH-LEUBA: Yes. I see my job in 15 life to scare everybody, put a little bit of the scare 16 I have in my blood into yours. Thank you.
17 MR. BENNER: This has been a good time.
18 This is Eric Benner again. I turned it over to Kim.
19 I'm glad Kim led the discussion because she has a lot 20 more of the detail as to how cyber security works.
21 I'm going to bring it back to a different 22 level in that the words that are in the standard are 23 the words in the standard. We influence standards.
24 The NRC has membership on the standards. We influence 25 the standards but we don't dictate what's in the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
37 1 standards.
2 And for our purposes, when we look at a 3 standard we're looking at: is there anything here 4 objectionable? We certainly don't find anything 5 objectionable in that last statement. We understand 6 about wireless capability shall be disabled prior to 7 connecting. We certainly don't find anything 8 objectionable to that part of the standard.
9 We don't use -- as I alluded to, this is 10 for the staff's review. This guidance was reviewed as 11 a way for licensees to meet IEEE 603, which is in the 12 safety-related portions of the standard, 10 CFR Part 13 50. None of that is about cyber security.
14 So where we're at is there is other 15 guidance for how you address cyber security, including 16 control of wireless, access, and connections. What 17 I'm going to keep repeating is no matter what we put 18 in this guidance document, it has no bearing on what 19 a licensee does operational to demonstrate compliance 20 with the security requirements in 10 CFR Part 73.
21 That's why we're drawing a distinction here.
22 MEMBER BROWN: Before you go on, I will 23 continue this for just a moment since I'm kind of 24 leading this from my standpoint. I'll either have the 25 final word or somebody else will want to say something NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
38 1 else.
2 The perspective I come to, I'm dividing it 3 between work stations and M&TE. We've been talking 4 about M&TE. To me, M&TE equipment sits in a room 5 where it's logged. It has a set of paperwork that 6 goes along with it or software work on some other 7 computer that says it was last calibrated at a certain 8 time and therefore it's okay to be used through this 9 period.
10 And if that equipment is sitting on a 11 shelf and it's not connected either wirelessly or by 12 cable, the likelihood of something interfering or 13 coming into that piece of equipment is pretty darn 14 low. There's no doors.
15 You put away the wireless, but now let's 16 say you've got it connected to an internet connection.
17 Well, that's a problem. I would disagree with that 18 also.
19 If you need to upgrade the software 20 because the vendor who makes that test equipment says 21 we're not measuring that stuff right and we have an 22 error in our software, he'll come in. You don't want 23 him to send any of it down to you.
24 You want his little body to go trucking 25 through the plant with all the other security to make NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
39 1 sure it's the right guy, with the right credentials, 2 with the right whatever to change and update all the 3 same pieces of equipment to the new software where 4 they can then do the scans and it's done. It doesn't 5 mean he didn't bring something in, but you 6 theoretically would check to make sure he didn't bring 7 something in with some capability that the site had 8 put together.
9 So my viewpoint that I come from, at least 10 in the programs I operated and developed for 22 years 11 once we had computer stuff, is just because 12 something's nice and easier to do, you ought not do it 13 if it has the potential to cause problems. With M&TE 14 it's easy to not do it.
15 Work stations are a character. You're 16 doing stuff. They're communicating with things.
17 They're bi-directional. They're getting information 18 in.
19 By hooking them up wirelessly and you say 20 all wireless should be disabled, to me, I don't know 21 if that means when somebody's following this guidance 22 that the work stations that you've got in various 23 locations would have no wireless connection. They may 24 have an internet connection because of their bi-25 directional operation in and of itself, but they don't NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
40 1 have another pathway where something can come in.
2 Do I read that first sentence correctly?
3 It says shall be disabled on work stations. Kim, 4 would you expect a licensee to follow that rigorously?
5 Are you still there?
6 MS. LAWSON-JENKINS: I'm still here. All 7 capabilities disabled, all wireless work stations --
8 MEMBER BROWN: Yes. All wireless 9 capabilities shall be disabled on work stations.
10 There are two sentences in that last paragraph.
11 MS. LAWSON-JENKINS: Yes, I see both of 12 them.
13 MEMBER BROWN: I'm not talking about M&TE 14 now. Put that one aside.
15 MS. LAWSON-JENKINS: Okay. If that's the 16 requirement. That's why they say disabled too. My 17 preference would be not even to have the capability.
18 MEMBER BROWN: Absolutely. I love you.
19 MS. LAWSON-JENKINS: Yes. It could even 20 be that if you're going to do something, I would 21 prefer not to have the capability rather than 22 disabled. But they may not be able to --
23 MEMBER BROWN: No work station should have 24 wireless enabled, attached, or involved.
25 MS. LAWSON-JENKINS: That's a very NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
41 1 customized work station where you don't even have that 2 capability, which is why this standard is probably 3 written this way.
4 MEMBER BROWN: All right.
5 MEMBER BLEY: Charlie?
6 MEMBER BROWN: Yes, Dennis.
7 MEMBER BLEY: We've gotten into an area 8 where the words matter and how the words are 9 interpreted matter, and that's not in what we're 10 reading.
11 Even quite a few years ago there were 12 places to go with your computer where you weren't 13 allowed to have a camera on board the computer. And 14 it hit a point I forget how many years ago where you 15 can't even buy one. You'd have to design it yourself.
16 But when you ran into language like that, 17 it didn't mean to turn a switch and turn it off. It 18 meant you had to have somebody go in and remove the 19 actual camera from the device.
20 I guess it's not clear to me what this 21 precise word means by disabled. Does that mean it's 22 removed, it's destroyed, so it's not just turning a 23 switch and turning it off?
24 MEMBER BROWN: It's not clear. You're 25 right. I interrupted you. I'm sorry. I thought you NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
42 1 were done.
2 MEMBER BLEY: It's the staff's words so 3 I'm wondering what it means to them.
4 MEMBER BROWN: This is the IEEE standard 5 now, the 7-4.3.2.
6 MEMBER BLEY: Well, yes but through the 7 reg guide they're endorsing it.
8 MEMBER BROWN: Absolutely.
9 It's muted. I hear nothing.
10 MR. NGUYEN: So this is a long discussion.
11 The staff appreciates all the comments and questions, 12 but I would like to summarize the staff decision on 13 this subject.
14 MEMBER BLEY: I guess there's no answer to 15 that question.
16 MEMBER BROWN: We'll have to discuss it 17 more on our letter when we get there, how we want to 18 deal with this discussion.
19 MR. NGUYEN: So the staff believes that --
20 MEMBER BROWN: Were you going to say 21 something else, Matt? You looked like you --
22 MEMBER SUNSERI: No. I mean, I'm going 23 back on my memory again but when we were working with 24 the interfaces, if it said disabled, it was disabled.
25 You couldn't use it anymore. It was physically NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
43 1 plugged or disconnected or something. It wasn't 2 turned off.
3 MEMBER BLEY: That's what I would have 4 expected. That's what I had to do with the camera in 5 my old computer.
6 MEMBER SUNSERI: I remember the early days 7 of laptops. Disabled meant in terms of portable media 8 that epoxy was put into the plug-in ports on the 9 computer to prevent people from doing bad things.
10 MEMBER BROWN: Disabled is a stronger word 11 than turned off. I read that strongly, but you bring 12 a good point. I didn't think of your thought process, 13 Dennis.
14 MEMBER BLEY: That's what it meant to me, 15 but I thought it would be very clear to the staff. It 16 wasn't supposed to be a hard question.
17 MEMBER BROWN: Any other comments on this 18 subject?
19 We'll let Khoi continue. Thank you very 20 much for allowing us to diverge.
21 MR. NGUYEN: Before I continue to the next 22 subject, I would like to summarize this. I mean, it's 23 a lengthy discussion but the staff's decision on this 24 subject is it's very important that a requirement is 25 in place to make sure there's no malware in the M&TE NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
44 1 devices before connecting to the safety equipment.
2 And we feel both the IEEE standard and the 3 Reg Guide 5.71 -- we found there's significant 4 guidance and measures in place that ensure there's no 5 malware existing in the M&TE before connecting to the 6 CDA.
7 So regardless of whatever method that the 8 malware gets into the M&TE, I think there's a measure 9 in place that's protecting, scanning, or whatever to 10 identify any malware and remove it before connecting 11 to the CDA. I think that is a sufficient safety 12 measure, for the M&TE to be connected through the CDA.
13 MEMBER KIRCHNER: Khoi, could you go back 14 to your view graphs? I just wanted to look at the 15 view graph again.
16 MEMBER BROWN: Back to the presentation?
17 MEMBER KIRCHNER: The presentation, sorry.
18 MR. NGUYEN: Mike, could you bring back 19 the slide?
20 MR. EUDY: Will do. Give me a second.
21 MEMBER BROWN: I think it was slide 8.
22 MR. EUDY: It's up. Does everyone see it?
23 MR. BENNER: Yes. Thank you, Mike.
24 MR. NGUYEN: Do you have a question on 25 this slide?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
45 1 MEMBER KIRCHNER: Okay. Thank you.
2 MEMBER BROWN: That's where we were. So 3 you can proceed now.
4 MR. NGUYEN: Slide 9, please, Mike.
5 For the third feedback, the concern was 6 Clause 5.17 of the 7-4.2.3, the self-reference to 7 Annex C, Dedication of Existing Commercial Computers.
8 This reference in a way contradicts the exception of 9 endorsement of the Annex C. In other words, we are 10 not endorsing Annex C. We are endorsing Clause 5.17, 11 but the clause is a reference to Annex C. So there's 12 a contradiction.
13 The staff will revise the draft guide to 14 clarify that Clause 5.17 provides criteria that the 15 NRC staff finds acceptable for the use of commercial 16 equipment in safety-related systems in nuclear power 17 plants.
18 Clause 5.17 references Annex C for 19 additional information on commercial-grade items 20 except for the dedication. However, while there is a 21 useful history record and referenced information in 22 Annex C, the NRC staff does not see the need to 23 endorse such information. So the staff will make a 24 clarification --
25 MEMBER BROWN: I totally lost the bubble.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
46 1 MR. NGUYEN: Okay. This draft guide 2 endorses Clause 5.17 of IEEE Standard 7-4.3.2. But 3 the staff has not endorsed Annex C of the standard.
4 MEMBER BROWN: Got it.
5 MR. NGUYEN: However, Clause 5.17 6 references Annex C.
7 MEMBER BROWN: So by default you endorse 8 it?
9 MR. NGUYEN: We make the statement in the 10 standard that --
11 MEMBER BROWN: I know you said that, but 12 I said by default. That was our discussion that we 13 had in the last subcommittee meeting.
14 MR. NGUYEN: Right. So the staff will 15 make the clarification in the draft guide to make it 16 clear that we endorse Clause 5.17 --
17 MEMBER BROWN: But you are endorsing the 18 alternate methodology as opposed to 1.164 and 1.250, 19 which had a rigorous review. This has not.
20 I'm paraphrasing our discussion from the 21 subcommittee meeting. This just popped in. We spent 22 a large amount of time. NEI documents, topical 23 reports, two different -- TR is this, TR is that; 24 1.164 and 1.250 are examples of what they meant.
25 And here there's kind of a broad brush.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
47 1 A page and half says it's okay, just do -- I'm 2 paraphrasing. I'm not saying do whatever you want.
3 But the method here, which is not as 4 rigorous at all compared to what we just went through 5 and wrote a letter on in great detail and yet by 6 definition you're endorsing that -- I guess in my 7 personal opinion, I wouldn't endorse 5.17. That's my 8 personal opinion.
9 MR. NGUYEN: May I have --
10 MEMBER BROWN: Of course you can.
11 MR. NGUYEN: We admit that we didn't have 12 the clear answer at the subcommittee meeting. But 13 after the meeting we went back and we looked at 1.250.
14 We note that the draft guide provides guidance for the 15 dedication process when affecting the dependability.
16 MEMBER BROWN: That's still dependability.
17 MR. NGUYEN: If the applicant or licensee 18 chooses to use a third party, then they can use that 19 draft guide as a supplemental guidance for commercial-20 grade dedication.
21 Clause 5.17 provides the traditional 22 commercial-grade dedication process. We have been 23 using and reviewing the commercial-grade dedication.
24 So there's no conflict with the two.
25 We didn't answer clearly at the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
48 1 subcommittee meeting that there's different methods.
2 One draft guide is for the specific guidance and this 3 reg guide for the traditional method.
4 MEMBER BROWN: The 1.250 was admittedly 5 still level with dependability, but it also was highly 6 dependent upon the previous 1.164, the NEI documents 7 and topical report, a couple of those as a matter of 8 fact.
9 And this did not seem to be as thorough as 10 the other approach. It was tough to dig out why this 11 is now okay as well as the other method, which 12 involved NEI documentations and examples of how they 13 would go about executing it.
14 MR. BENNER: It doesn't replace those. I 15 mean, our thoughts in the first bullet here gets to 16 that point. Clause 5.17 isn't in conflict with the 17 guidance.
18 Khoi was focused on 1.250, which is on 19 using self-certification for dependability. Reg Guide 20 1.164 is the overall staff guidance for commercial-21 grade dedication programs. And this doesn't change 22 that.
23 MEMBER BROWN: But if it is, why has 24 something else --
25 MR. BENNER: Because it's not in conflict.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
49 1 Our judgement here is do we find it objectionable, and 2 we don't. We don't find Clause 5.17 objectionable 3 because it's consistent with the regulations and the 4 guidance we have out there. It's not as detailed.
5 But I think if your concern is someone is 6 going to say, for my commercial-grade dedication 7 program I just followed 5.17 and I didn't follow Reg 8 Guide 1.164, the staff wouldn't find that. When they 9 went out to inspect the licensee's commercial-grade 10 dedication program, they wouldn't find that 11 acceptable.
12 And even when we talk about Clause 5.17 in 13 the reg guide, it references Reg Guide 1.164 as the 14 staff's overall guidance for commercial-grade 15 dedication.
16 MEMBER BROWN: Yes. So you accept this as 17 a standard but that doesn't --
18 MR. BENNER: Right.
19 MEMBER BROWN: -- that doesn't say you 20 can't use 5.17 and 1.164. You can do it aside from 21 1.164. You can -- I don't want to say discard it.
22 You can set that aside. You can use this procedure.
23 And you're saying you're satisfied with that, the 24 staff is?
25 MR. BENNER: I'm saying they can't satisfy NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
50 1 1.164 just because -- it goes back to the purpose of 2 this guidance document is for a licensee to 3 demonstrate compliance with the regulations in 10 CFR 4 50.55a. Commercial-grade dedication is under 10 CFR 5 Part 21.
6 If you look at the purpose of this reg 7 guide, it says nothing about 10 CFR Part 21. If you 8 want to comply with 10 CFR Part 21, you still have to 9 follow all the staff guidance available or provide an 10 alternative to where we've articulated what licensees 11 need to do to meet 10 CFR Part 21.
12 MEMBER BROWN: Okay. I'm going to go back 13 and read this one also just for fun.
14 MR. BENNER: It's good, light reading.
15 MEMBER BROWN: So design analysis is part 16 of the overall thing. You can do it for 1.164.
17 MR. BENNER: Um-hum.
18 MEMBER BROWN: And 5.17.4 literally says 19 performing one method for documenting this as opposed 20 to what we say is in Topical Report 106439, which is 21 the NEI topical report that was referenced via 1.164.
22 MR. BENNER: Um-hum.
23 MEMBER BROWN: That means you can set that 24 aside and use what was before for performing the 25 analysis. And I did not go back to the 1.164 and the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
51 1 topical report, unless somebody wants to pay me for 2 another two weeks' worth of time over and above my 3 allotment.
4 So right now it seems to me that, in a 5 way, we've got some dueling approaches. They are not 6 both the same. You're saying it looks okay, but it's 7 not the same as the other one per se.
8 MR. BENNER: It's not in conflict and it's 9 not guidance for complying with 10 CFR Part 21, which 10 is where you would address commercial-grade 11 dedication. We would only take issue with this if 12 there were something there that was in conflict with 13 our regulatory requirements. And we just don't see 14 that.
15 MEMBER BROWN: You don't see that in 5.17?
16 MR. BENNER: No.
17 MEMBER BROWN: Okay. Any other comments?
18 MR. BENNER: One, it's not in conflict.
19 And two, it is not a guidance for demonstrating 20 compliance with the regulation in question.
21 MEMBER BROWN: Okay. Using Dennis' 22 approach of words have meaning, you're saying if they 23 went through 5.17, that would not be enough to 24 demonstrate compliance unless they did something for 25 some other documents as well; 10 CFR, whatever it was.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
52 1 MR. BENNER: Um-hum.
2 MEMBER BROWN: Because this is not in 3 whatever part it is, fundamentally they can't use 5.17 4 exclusively. They have to use it in conjunction 5 with --
6 MR. BENNER: Well, they can't use this reg 7 guide. This reg guide isn't for purposes of 8 demonstrating compliance with that regulation period.
9 MEMBER BROWN: It said it's okay for 10 approving commercial dedication of EDD. That's what 11 this is all about, right?
12 MEMBER SUNSERI: Charlie, I think it goes 13 like this. The commercial-grade dedication has a 14 part, right. For digital there's some greyness in one 15 of the areas. And this satisfies that part, but 16 you've still got to do the other three.
17 MEMBER BROWN: Well, the way the words 18 read in that one section for the analysis is the other 19 part is one method, but not necessarily, because 20 there's a bunch of things they say before getting into 21 that which define what design analysis is plus some 22 other stuff. It's okay. I got your point.
23 Any other comments from anybody on this 24 slide?
25 Okay. Khoi?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
53 1 MR. NGUYEN: Next slide, please, slide 10.
2 The last feedback would be --
3 MEMBER BLEY: Can I sneak in something?
4 MR. NGUYEN: Yes.
5 MEMBER BLEY: I've been stewing over that 6 conversation a little bit.
7 MEMBER BROWN: The previous slide?
8 MEMBER BLEY: Well, I don't need the 9 slide.
10 MEMBER BROWN: Okay.
11 MEMBER BLEY: It's the concept of the NRC 12 staff approach to looking at a standard. I had always 13 assumed, I guess, that you go to a standard when there 14 exists a standard to cover something you want to 15 include in your guidance. You don't just go out and 16 endorse standards by themselves if they don't have a 17 real need for the areas you want to provide guidance.
18 This idea that it doesn't conflict with 19 our other guidance seems -- it just feels odd to me.
20 It feels like if you don't need it for what you're 21 doing now, why would it be endorsed? You'd leave out 22 some parts of standards or their attachments because 23 they aren't necessary.
24 And this is kind of taking the other view.
25 Well, we keep it all in unless it conflicts with NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
54 1 something on our side. I'm just stating an unease 2 about the way that process goes. And maybe that's the 3 way it always goes but it doesn't feel that way to me.
4 I don't know what to do with it, Charlie.
5 I just wanted to get it out there.
6 MEMBER BROWN: Your point being why 7 endorse it if it doesn't satisfy -- if you've got a 8 process in place and it doesn't satisfy anything new?
9 MEMBER BLEY: If it doesn't satisfy any of 10 the purposes of this particular reg guide.
11 MEMBER BROWN: Okay. Thank you, Dennis.
12 Any other comments before we move on 13 again?
14 All right. Are we on the next slide, 15 Khoi?
16 MR. NGUYEN: All right. We are on slide 17 number 10.
18 So for feedback number four, the concern 19 was the draft guide does not contain any discussion of 20 the I&C safety system architecture, including the 21 fundamental design principles.
22 It should be noted that the scope of Reg 23 Guide 1.152 is to endorse IEEE Standard 7-4.3.2 as an 24 acceptable approach to meet the regulation 25 requirements, which is IEEE Standard 603.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
55 1 The I&C safety system architecture is 2 evaluated by the staff in the context of meeting the 3 four fundamental design principles. It doesn't say 4 independent and deterministic diversity and defense-5 in-depth, or D3. The staff performs its evaluation 6 using the licensing process guidance in Interim Staff 7 Guidance or ISG-06 and the Design Review Guide or DRG.
8 Staff believes that while the fundamental 9 design principles are considered by the staff when 10 evaluating the I&C safety system architecture, 11 deterministic D3 are not part of the IEEE 603 12 requirements. And therefore, they are out of the 13 scope of this reg guide.
14 Therefore the staff does not intend to 15 include these design principles in this draft guide 16 because the staff thinks that this discussion of these 17 principles in ISG-06 and the DRG is the most 18 appropriate location for that discussion, not in this 19 draft guide.
20 MEMBER BROWN: I would counter that with 21 the point that you made in here. I understand ISG-06, 22 as I've wrote reports on it and also on all the DRGs.
23 I don't disagree with your point relative 24 to big, big, big picture thought processes. You state 25 yourself that Reg Guide 1.152 is one of the primary NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
56 1 documents for the use of computers and I&C systems.
2 And the purpose of including this up in 3 the introduction would be to -- not down in the text 4 but in the introduction -- put the application of 5 software-based, computer-based systems, or PDDs in the 6 new, more expansive view of the world, is to convey 7 the application of those approaches within an overall 8 system design, which the architecture is the key 9 feature of those.
10 So it doesn't dictate anything. It just 11 says the fundamental without any words. It gives you 12 new stuff, but it brings a lot of baggage along with 13 it that you've got to consider when you're doing the 14 application.
15 It doesn't dictate anything, but it does 16 state that you've got to be careful because the 17 primary protection against CCS is a robust, redundant 18 architecture which has these characteristics. So I 19 would disagree that that's, from a principle 20 standpoint, not an unreasonable thing to put in as a 21 lead into the reg guide.
22 It doesn't dictate doing A, B, or C. It 23 just says, hey, in the context of applying these 24 things, they're applied in the overall thing. So it's 25 a primary document, like you say, the ISG-06, the DRG, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
57 1 but also BTP 7-19 and Reg Guide 5.71 eventually.
2 So 1.152 is one of the linchpin documents.
3 The concept of how it's applied in an overall 4 architecture and what is the intent of applying it, 5 that to me is a philosophical thing that should be 6 part of it, just as we've included this thought 7 process into ISG-06 and BTP 7-19.
8 Even though BTP 7-19 is fundamentally 9 defense-in-depth and diversity, it covers the overall 10 point of we've got this giant stuff we're providing.
11 Here's the overarching principles and architecture.
12 If the architecture is the key to safe 13 operation of all these critical safety systems, 14 protection systems and the safeguards in particular, 15 all those that require redundant systems. And that 16 concept ought to be that this document is part of 17 that, but here's the overarching thought process. And 18 that's the purpose of the discussion point that we 19 talked about in the subcommittee meeting.
20 So I'll just leave it right there. We can 21 go ahead to the next slide.
22 MEMBER KIRCHNER: We can leave it there.
23 I would emphasize that we are redundant, Charlie.
24 MEMBER BROWN: That's good, isn't it?
25 MEMBER KIRCHNER: Yes, that's good in this NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
58 1 case.
2 MEMBER BROWN: You should not be using BTP 3 7-19 absent this thought process. You shouldn't be 4 doing 5.71 without knowing what the system 5 architecture should be -- what should be embodied.
6 You shouldn't be doing 1.152 without 7 knowing what that is, and you shouldn't be doing ISG-8 06 or the review guides without that centralized 9 overall architecture thought process in terms of the 10 safety-related protection systems. That was the 11 point.
12 Yes, it is redundant. We've put it in 13 every place. For new people coming in, they start 14 working on something. Oh, I didn't know that. I'm 15 over here working, beavering away on diversity.
16 You're doing that in the context of --
17 MEMBER KIRCHNER: Charlie, I thought you 18 were going to bring up control of access.
19 MEMBER BROWN: It's in my letter. The 20 reason control of access is not in this list is I 21 didn't figure that out eight years and ten years ago 22 when we did the first Design Review Guide and we did 23 one of the earlier design certifications. I learned 24 later.
25 CHAIRMAN REMPE: So I just wanted to do a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
59 1 time check. I would have thought more slides would 2 easily be accomplished in the last 20 minutes, but we 3 do have public comment periods so I just wanted to 4 make sure that everybody is aware of the time here.
5 MEMBER BROWN: Yes. I'm done with that.
6 I just wanted to put the context of what this one was.
7 It doesn't need any more elaboration.
8 MR. BENNER: This is Eric Benner. I'll 9 take the first step in responding and we'll see if I 10 get any lifelines.
11 MEMBER BROWN: Is this the same slide or 12 are you going on?
13 MR. BENNER: No, the same. I'm responding 14 to --
15 MEMBER BROWN: You want to argue with me?
16 MR. BENNER: No, no, no. I don't want to 17 argue at all. I think from the standpoint of the 18 philosophy, the staff is on board with the philosophy.
19 And the staff has incorporated that philosophy into 20 the staff review guidance.
21 The challenge we have is the purpose for 22 regulatory guides is, in this case, endorsing guidance 23 that can be used to meet the regulatory requirements.
24 And the philosophy is not embedded in the regulatory 25 requirements.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
60 1 We do get some pushback when we try to put 2 philosophy in guidance to licensees. The caution we 3 get is, you should have a really good line of sight 4 between anything you're putting in the guidance and 5 the regulatory requirements. That's why we continue 6 to point to the staff guidance.
7 We can get into more of those discussions 8 because it tells how the staff is going to do its 9 business. And in all honesty, it can get into 10 philosophy. That's really all I wanted to say in 11 addition to what we have on the slide.
12 MEMBER BROWN: Well, I will amplify that 13 because 603-1991 actually embodies at least three, 14 maybe even four of these. It's independence, 15 redundancy, and deterministic. It doesn't say 16 deterministic. I think it's called repeatable or time 17 response.
18 So three of them are embodied in IEEE 603-19 1991, which existed before computer stuff ever really 20 became involved in these equipments. And the internet 21 was a bare fledgling of its present capability.
22 If you ever had to operate with -- what 23 was the first thing? It wasn't email. It was so old 24 that even I can't remember it now. The first email 25 stuff, the way you got stuff was sending AOL. Back in NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
61 1 the old, old, old --
2 MR. BENNER: Over your phone?
3 MEMBER BROWN: Yes, over the phone 4 connection.
5 MR. BENNER: We forgot what that was like.
6 MEMBER BROWN: For a minute.
7 MR. BENNER: And those attributes that are 8 explicitly in 603, that carries through.
9 MEMBER BROWN: That's what these emphasize 10 in the reg guide.
11 MR. BENNER: And this goes beyond what's 12 in 603. That's sort of our challenge.
13 MEMBER BROWN: We'll have to disagree on 14 that -- with me on that.
15 MR. BENNER: Um-hum.
16 MEMBER BROWN: Next slide. Joy wants to 17 get that slide 11.
18 CHAIRMAN REMPE: Just want to keep us on 19 schedule.
20 MR. NGUYEN: Okay, slide 11. Reg Guide 21 1.152 is one of the primary reg guides used by the 22 applicants and licensees in development of the I&C 23 applications, the reactor applications. And these are 24 the I&C topical reports.
25 MEMBER BROWN: A whole panoply. It's a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
62 1 linchpin, primary reg guide. I love that. You just 2 argued -- no, you just articulated -- excuse me --
3 what I've said before.
4 MR. NGUYEN: Yes.
5 MEMBER BROWN: Go ahead. I couldn't 6 resist.
7 MR. NGUYEN: Okay.
8 MEMBER BROWN: We've got fifteen minutes 9 left.
10 MR. NGUYEN: So the update to Reg Guide 11 1.152 is a high priority based on the recent licensing 12 experience and direction with the stakeholders that 13 contributed to the update to 7-4.3.2 in 2016.
14 Next slide, please.
15 The staff reports the revision of Reg 16 Guide 1.152 to update information and guidance in the 17 areas of functional reliability, design quality, and 18 the SDOE for programmable digital devices in the 19 safety-related systems of nuclear power plants to 20 support NRC guidance and practices to ensure that the 21 guidance in these areas is current and consistent with 22 the staff position. Therefore, revision will enhance 23 the efficiency and the effectiveness of the licensing 24 review.
25 That will conclude my presentation.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
63 1 MEMBER BROWN: I'm not going to be 2 contrary here. I wouldn't disagree with that. I 3 actually thought the revision was pretty well put 4 together.
5 So I didn't have any real problem with the 6 approach. I thought you did a good job of 7 incorporating stuff that was in other places. I 8 understand the separation of church and state that you 9 want to accomplish in some circumstances.
10 And I did check between the old 7-4.3.2 11 and the new one, paragraph by paragraph, to see what 12 was there. That was painful. And a comparison of the 13 old Rev 3 of the reg guide to this one.
14 It seemed to connect the dots with the 15 exception of these obvious discussion points that 16 we've been through. So I don't disagree that it's 17 good to update it the way you did.
18 Are there any other member comments right 19 now? Anybody on the outside, members?
20 MEMBER KIRCHNER: Charlie, I had one.
21 MEMBER BROWN: Go ahead. I didn't hear 22 you.
23 MEMBER KIRCHNER: I think Dennis raised it 24 during the subcommittee meeting and I think I did as 25 well. I really would like to see some kind of flow NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
64 1 chart that pulls all of your digital I&C guidance 2 together. I think it would be very valuable for you, 3 the staff, to have it in your interactions with the 4 commissioners as well so you can show the progress 5 that you've made in this area.
6 And I think it would be very useful for 7 applicants to sort through how you've connected the 8 dots, and leave that behind for your successors as 9 well to show how you can demonstrate that by using 10 these reg guides and other staff guidance, meeting the 11 regulations that we were bantering back and forth 12 today.
13 MR. NGUYEN: Thank you. Thank you for the 14 comment. You made a good comment.
15 MR. BENNER: Yes. And maybe we 16 disconnected -- we thought that was outside of the 17 discussion of this. I recalled it was --
18 MEMBER BROWN: I figured it was in the reg 19 guide.
20 MR. BENNER: -- we were talking about an 21 informational brief that we could give to the 22 committee as to how it all fits together.
23 MEMBER BROWN: That's in the transcript.
24 That point was made. I went back to that and looked 25 at that to make sure.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
65 1 I did include yours and Dennis' -- there's 2 an additional discussion that I put in. We can see if 3 we want to do it, whatever we want to do, however we 4 want to rephrase it. I just wanted to make sure I 5 captured a little bit of the thought process.
6 We need to go to --
7 CHAIRMAN REMPE: Well, before you do that, 8 when I was looking at the transcript everyone agreed 9 it should be done. But when does the staff envision 10 this will be prepared, available, and what document?
11 Could you give us some details about how you intend to 12 get it done? I'm just curious.
13 MR. BENNER: Right now, I mean, we have 14 two things that we could probably provide to the 15 committee immediately. We had a public meeting with 16 stakeholders on a body of reg guides and how we are 17 looking to transition those from what they are now to 18 what they are in the future.
19 Separately, a staff has been looking at 20 the entire SRP, Standard Review Plan, and doing what 21 we call SRP modernization. And in the area of digital 22 I&C we've looked at the entire chapter and how we 23 would reformat that chapter. We have a presentation 24 on that that we've made internally for how we're doing 25 SRP modernization.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
66 1 So we could provide those two things right 2 away. Now, when we would have an information 3 briefing, we could certainly negotiate with you as to 4 when you would like such a briefing.
5 CHAIRMAN REMPE: It's good to inform us, 6 but I think it's more important to inform the 7 applicants.
8 MEMBER KIRCHNER: For new applicants is 9 what I was thinking, advanced reactors. The first 10 blush, we've run into this. There's this idea that 11 LWR stuff doesn't apply to us, is not applicable, or 12 it's too specific. But in looking at your body of 13 work, I have seen very little. It's very technology 14 neutral --
15 MR. BENNER: Right.
16 MEMBER KIRCHNER: -- or inclusive, I 17 guess, is the right buzz word these days. And so I 18 think such an information road map would be invaluable 19 for newcomers for advanced reactor designs. We 20 present it literally but I think you hear, oh, that's 21 all -- 10 CFR Part 50 and 52, that's really not 22 applicable to me because I've got a new design.
23 But most of your work, I would think, from 24 what we've seen is very technology inclusive. So it 25 would be a valuable document for new designs as well NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
67 1 as the existing players.
2 MR. BENNER: Yes. In several forms we've 3 had workshops with industry led by my staff that was 4 mainly the operating fleet to talk about these 5 changes. We've participated in a number of the 6 advanced reactor activities, whether they were more 7 general workshops or pre-application meetings with 8 individual licensees.
9 We've tailored those discussions to what 10 I would call the sophistication of the applicant. So 11 we certainly don't have a one-size-fits-all 12 presentation for those audiences, but we do as we have 13 different avenues.
14 That's a little different than what we 15 were thinking of as to one thing that explains all of 16 this that we would share with any stakeholder. We 17 found a lot more customization has been useful in the 18 discussions we've had.
19 MEMBER KIRCHNER: I'm just thinking 20 though, it would be a while before 53 -- if it becomes 21 a rule, in the interim people are going to come to you 22 under the banner of 50 and 52. So giving them a road 23 map through the system will be very useful.
24 CHAIRMAN REMPE: Maybe a good place to 25 start is to have a briefing with us, but you might end NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
68 1 up at the end of the briefing with something that 2 heavily encourages the staff to make this available to 3 a broader audience.
4 Anyway, I think we're done with that 5 additional comment. Did you want to talk to the folks 6 out in the --
7 MEMBER BROWN: I was going to ask if there 8 was anybody on the phone lines that would like to make 9 a comment.
10 Hearing none, I turn it back over to you, 11 Joy.
12 CHAIRMAN REMPE: Great. Thank you. Do 13 you want to have a 15-minute break? We'll come back, 14 if I did my math correctly, at ten 'til 3:00 on the 15 East Coast time. We'll have someone bring your letter 16 up and you can do a read-through. Does that sound 17 good?
18 MEMBER BROWN: Um-hum.
19 CHAIRMAN REMPE: Okay. We're going to 20 recess. We'll be back at ten 'til.
21 (Whereupon, the above-entitled matter went 22 off the record at 2:34 p.m. and resumed at 2:54 p.m.)
23 CHAIRMAN REMPE: Okay. We are back in 24 session.
25 Member Brown, would you read us your NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
69 1 letter?
2 MEMBER BROWN: Yes. Before I start I will 3 give you an outline. Are you going to talk with Walt 4 or do you want me to read?
5 CHAIRMAN REMPE: We'd like you to read.
6 MEMBER BROWN: Okay. Let me at least 7 talk. This is an introduction of all the subjects 8 that we covered, both in the subcommittee meeting and 9 in this meeting. It's broken down into five items.
10 Can you all hear me?
11 PARTICIPANT: You've got to have it in 12 front of you.
13 MEMBER BROWN: Yes, I know. I just yell 14 at everybody.
15 I'll leave the whole thing. But before we 16 go detailed, we ought to decide what we want to cover 17 and what we don't want to cover. So let me read the 18 whole thing and then I'll tell you when we're 19 switching. And then we can figure out when I finish 20 what to do or not do, okay? All right.
21 Subject, Proposed Draft Reg Guide 1.152 22 Revision 4, Criteria for Programmable Digital Devices 23 in Safety-Related Systems for Nuclear Power Plants.
24
Dear Mr. Dorman,
During the 701st meeting 25 of the Advisory Committee on Reactor Safeguards, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
70 1 November 29 through December 2, 2022, we reviewed 2 Proposed Draft Regulatory Guide 1.152 Revision 4, 3 Criteria for Programmable Digital Devices in Safety-4 Related Systems in Nuclear Power Plants.
5 Our Digital Instrumentation Controls 6 Committee also reviewed this matter on November 17, 7 2022. During this review we had the benefit of 8 discussions with the representatives of the United 9 States Nuclear Regulatory Commission. We also had the 10 benefit of the documents referenced.
11 Conclusion and Recommendation. In 12 general, we agree with the proposed revision, 1.152 13 Revision 4, but it should not be issued for public 14 comment until resolution of the five issues in the 15 discussion have been incorporated into the reg guide.
16 Introduction. CFR 50.55a(h)(2) and (h)(3) 17 mandate compliance with the requirements stated in 18 IEEE Standard 279, various dates, and IEEE Standard 19 603-1991, IEEE Criteria for Safety Systems for Nuclear 20 Power Generating Stations for Post-1991 Safety System 21 Applications and Development. These standards were 22 written and applied for analog systems.
23 For applications for computer-based 24 systems, Reg Guide 1.152 series endorsing IEEE 25 Standard 7-4.3.2, IEEE Standard Criteria for NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
71 1 Programmable Digital Devices in Safety Systems of 2 Nuclear Power Generating Stations, various dates, were 3 developed and first issued in 1985. These standards 4 use the term safety system, consistent with the NRC's 5 definition --
6 (Whereupon, the above-entitled matter went 7 off the record at 2:58 p.m. and resumed at 3:45 p.m.)
8 CHAIRMAN REMPE: Okay. We're back in 9 session. At this point I'm going to ask Member 10 Ballinger to lead us through the SHINE discussion.
11 MEMBER BALLINGER: Okay. I have one 12 sentence. Who brought the champagne? I'll connect 13 the dots. This is the last, we hope, meeting on the 14 SHINE application. It's been a long, long process, 15 but to my mind a rewarding one.
16 We'll have a presentation from the SHINE 17 folks first and then from the staff. I think Josh is 18 going to give a few words.
19 MR. BORROMEO: Yes. I have some quick 20 opening remarks.
21 My name is Josh Borromeo. I'm Chief of 22 the Non-Power Production and Utilization Facility 23 Licensing Branch in the Office of Nuclear Reactor 24 Regulation.
25 Today you'll be hearing an overview from NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
72 1 SHINE and the staff regarding the review of the SHINE 2 Medical Technologies Operating Licensing Application.
3 This is a first-of-a-kind review that required 4 extensive coordination across the agency and required 5 unique licensing approaches, which the staff will 6 discuss today.
7 While the finalization of the staff's SER 8 is a major milestone for the operating license for the 9 SHINE facility, this is only part of the NRC's 10 decision to issue the operating license. There are 11 several inspection activities planned related to the 12 construction and operational readiness of the facility 13 that are required to be completed prior to the 14 issuance of the license, and the staff will highlight 15 those areas in the presentation today.
16 I want to thank ACRS for all the engaging 17 interactions that we've had thus far. And I'm 18 especially thankful for the flexibility that ACRS has 19 extended to us as we had to make changes throughout 20 the review.
21 And finally, I want to especially thank 22 the NRC staff for all their diligent work on this 23 challenging review and pushing it here to the finish 24 line. So thanks.
25 MEMBER BALLINGER: Think we're ready to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
73 1 go? Is it Catherine or Jeff?
2 MS. KOLB: Yes. My name is Catherine 3 Kolb. I'll be giving the presentation for SHINE.
4 Tracy was unfortunately unable to meet with us in 5 person today.
6 MEMBER BALLINGER: You're going to have to 7 be a little closer.
8 MS. KOLB: All right. Okay, got it.
9 So my name is Catherine Kolb. I'm the 10 Senior Director of Plant Operations for SHINE. I'll 11 be giving our presentation today. Tracy was unable to 12 make it here in person.
13 We have an overview of the SHINE process.
14 We'll start with the site overview, some status of the 15 construction of our facility, an overview of the 16 process which you've all seen before, and summaries of 17 our technological approach and safety philosophy.
18 The SHINE facility, which was envisioned 19 to produce medical isotopes, is located in Janesville, 20 Wisconsin, about four miles south of the city center 21 in the southern edge of the city. It is about two 22 miles from Interstate 3990 and directly to the east of 23 the Southern Wisconsin Regional Airport.
24 In the next slide here you'll see our site 25 plan. The large building in blue in the middle is the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
74 1 main production facility. That is where the 2 irradiation process and the chemical separation 3 processes take place.
4 To the south is the storage building.
5 That is primarily a warehouse, but it also contains 6 maintenance areas and office areas.
7 To the east of the site is the material 8 staging building. That is where we temporarily store 9 waste prior to shipment off-site for disposal.
10 The green building to the north of that is 11 the resource building. That houses support equipment 12 for the main production facility, including boilers 13 and a standby natural gas generator.
14 And then the very small building in yellow 15 is the nitrogen purge system building or the N2PS 16 building. That is a safety system that is used on a 17 loss of off-site power.
18 Here is a rendering of what the completed 19 campus will look like. You can see the main 20 production facility in the center, to the left the 21 storage building, the warehouse over on the right, and 22 in the back the resource and material staging 23 buildings.
24 In our next slide you'll see what they 25 actually look like as of a couple of days ago. The NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
75 1 main production facility you can see we're still 2 working on some of the architectural details, but the 3 facility structure is essentially complete. Inside we 4 are working on process equipment and mechanical, 5 electrical, and plumbing auxiliary equipment, which we 6 have pictures of in another couple of slides.
7 The resource building, the small building 8 that has support equipment, is also constructed. And 9 we are installing equipment inside of that. The 10 storage building is upright, but we haven't started 11 outfitting the inside of that to any great extent.
12 Here are some photos of inside the main 13 production facility. On the left is a picture of 14 workers installing process piping in the subgrade 15 trenches. You can see some of the piping. It's the 16 scaffolding there. We have approximately 50 percent 17 of all the process piping installed and about 60 18 percent of it welded out.
19 In the center picture, that yellow 20 structure is actually a temporary crane that will be 21 used to construct direct to the supercell. We have 22 about half of the shipping containers containing the 23 supercell pieces on-site, and we are beginning that 24 installation there. We needed a temporary crane so 25 that we can both construct the supercell and the areas NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
76 1 to the right in the photo, which have the subgrade 2 tanks and the other process equipment.
3 And finally, on the right is a photo of 4 the radiological ventilation zone 2 air handling 5 units. Those are part of the mechanical, electrical, 6 and plumbing scope of which 50 percent is completed.
7 These are the support equipment and the 8 auxiliary equipments mostly in the non-safety-related 9 portions of the building. You can see some of the 10 conduit, hangers, and lighting also installed in the 11 overhead there, so that is also well underway.
12 The next couple of slides are just a brief 13 overview of the SHINE process. The SHINE facility, if 14 you start at number one there, is the target solution 15 preparation area where we take depleted uranium metal, 16 oxidize it, and dissolve it in sulfuric acid in order 17 to form uranyl sulfate target solution. This is done 18 only periodically in the life of the facility, mostly 19 up front. And then that room is used for making make-20 up solution ongoing.
21 The target solution is directed into a 22 hold tank, shown as number two there in the center of 23 the rendering. From the hold tank the target solution 24 is lifted by our vacuum and transfer system into the 25 target solution vessel, which is the upright portion NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
77 1 of the T-shaped vessel shown underwater in that pool.
2 We fill to 95 percent by volume of criticality.
3 Then we irradiate for about five and a 4 half days using the accelerator, which is the blue 5 pressure vessel in the white box, where a beam of 6 deuterium ions are directed into a tritium gas target 7 which create a fusion reaction, which produces helium 8 and neutrons which are used to fission the uranyl 9 sulfate target solution. Of the fission products 10 moly-99 is one of those, which is our main target 11 isotope.
12 After about five and a half days, we drain 13 the solution from the target solution vessel into the 14 dump tank. We let the very short-lived fission 15 products decay. Then we send the solution via the 16 underground pipe trenches, which you saw in the 17 previous picture, over to the supercell.
18 The solution is passed through an 19 extraction column where the molybdenum adheres to the 20 media. The bulk of the solution returns to the hold 21 tank by the same underground pipe trenches. The 22 extraction column is then washed.
23 The washes are directed into a waste tank, 24 shown as number five in the photo. And the moly is 25 then eluted off of the column, purified, tested for NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
78 1 product quality, and packaged in the supercell.
2 So the technological approach of the SHINE 3 facility is based on a couple of principles. Our 4 systems are small. A maximum license power of 125 5 kilowatts per unit, which is hundreds of times less 6 power than reactors that are being used currently to 7 produce medical isotopes.
8 The low source term helps ensure safety of 9 the public and of our workers. The decay heat of the 10 system produces less than one kilowatt within five 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> after the end of the irradiation, so it requires 12 no forced cooling. It is all passively cooled by the 13 pool that you saw in the previous rendering.
14 The low size also minimizes the production 15 of waste nuclides compared to reactors, which both 16 need to irradiate to their target for making medical 17 isotopes and their reactor fuel.
18 Our targets are usable, as we talked about 19 in the last slide. The solution is irradiated, 20 processed, and irradiated again. This reduces waste 21 in this process. It's using uranium and making moly 22 via fission. It produces high specific activity moly-23 99, which is completely compatible with the current 24 supply chain for our customers. Using the LEU target 25 solution also eliminates the need to use highly NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
79 1 enriched uranium.
2 Our process is driven by a low-energy 3 electrostatic accelerator, so it does not produce a 4 self-sustaining critical reaction. It is driven by 5 the accelerator. So if power is shut down, if the 6 accelerator's shut down, the fission process 7 eventually terminates, leading to an inherently safe 8 design.
9 And finally, you saw in the previous slide 10 there were many units. There are eight irradiation 11 units in the facility and three processing trains 12 within the supercell. Each unit can be directed to at 13 least two different supercell processing trains, which 14 provide operational skill ability and flexibility for 15 our facility and allow us to more reliably manufacture 16 products to deliver to our customers.
17 The safety philosophy of the SHINE 18 facility -- this is my last slide to go over this --
19 the system is designed to operate at low pressure/low 20 temperatures as compared to some reactor designs. And 21 it produces low decay heat, as I mentioned previously.
22 This results in minimal stored energy when compared to 23 alternatives, leading to essentially a safer facility.
24 The eight independent irradiation units 25 are independent. They each have their separate and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
80 1 dedicated target solution reactivity protection 2 system, a safety-related I&C system. So this design 3 limits common cause failures between the eight 4 irradiation units.
5 MEMBER BALLINGER: This is Ron Ballinger.
6 I'm just curious as to -- how does that limit common 7 cause failures? I mean, it seems to me that you could 8 have common cause failures.
9 MEMBER KIRCHNER: You could have common 10 cause in all eight.
11 MEMBER BALLINGER: Yes.
12 MS. KOLB: You could have the same cause 13 in all of them because they all have the same design.
14 I guess what we meant by this slide is no single 15 failure. One failure would affect all eight units at 16 the same time.
17 MEMBER BALLINGER: Right, okay. Thanks.
18 MS. KOLB: I apologize.
19 The third bullet there, operating --
20 MEMBER KIRCHNER: You could throw in the 21 word redundant.
22 MEMBER BALLINGER: As opposed to -- yes.
23 MEMBER KIRCHNER: Yes.
24 MS. KOLB: When we present this again we 25 will take that into consideration. I understand.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
81 1 Operator actions in our design are not 2 required to mitigate the consequences of an accident.
3 So operators are not required to do anything after a 4 design-basis accident. The systems are designed to 5 either automatically or passively handle the 6 situations that they were designed for.
7 In the event of an upset condition, the 8 safety-related I&C system initiates a shutdown of the 9 system. There are two independent safety-related dump 10 valves, which both open, each controlled by a separate 11 division of the TRPS system. The solution is gravity-12 drained into a TSV dump tank, which is designed to be 13 favorable geometry for all uranium concentrations.
14 And the hydrogen that's generated by the 15 fission process is maintained below the lower 16 flammability limits by our off-gas system blowers, 17 which are powered from an uninterruptable power 18 supply, a safety-related electrical system. So 19 following the short amount of time that the blowers 20 need to be powered from the safety-related UPS system, 21 the plant is passively safe.
22 We've done calculations that 90 days 23 without cooling of the solution results in a pool 24 temperature rise that is not more than 13 degrees 25 Fahrenheit.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
82 1 And the nitrogen purge system is in place 2 to sweep any hydrogen that is produced by a radiolysis 3 from the various tanks in the facility and the dump 4 tank after potential loss of off-site power and the 5 loss of the blowers or other active systems.
6 And that is the end of our presentation.
7 MEMBER KIRCHNER: Is the UPS run time a 8 proprietary number? I don't remember.
9 MR. BORROMEO: I believe the run time in 10 the Chapter 8 tables are not proprietary.
11 MEMBER KIRCHNER: Just for the public 12 record, how long can you run your off-gas system 13 blowers before you switch over to nitrogen purge?
14 MS. KOLB: The blowers are required to run 15 for five minutes, at which point they automatically --
16 MEMBER KIRCHNER: Five minutes?
17 MS. KOLB: Five minutes, yes, at which 18 point they would come off the battery. And the 19 nitrogen purge system would take over and provide the 20 hydrogen mitigation function.
21 MEMBER KIRCHNER: Thank you.
22 MEMBER SUNSERI: Catherine, this is Matt.
23 Just one question. You're in this stage because of 24 the supply chain and delivery of the irradiation 25 units. Do you have a sense for how that schedule is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
83 1 coming? Is the supply chain supporting your 2 construction schedule or are they getting farther out, 3 the delivery of the units?
4 MS. KOLB: I know that we have had some 5 challenges with supply chain, particularly on 6 commodity items. Most of our process equipment is on 7 order or sitting in a warehouse. But some things like 8 hangers and other normal commodities, the lead times 9 have been getting longer.
10 MEMBER SUNSERI: Yes. The only reason I 11 even mentioned that, just so you know what my 12 relevance was, is just the longer that you have some 13 operating units under construction -- just trying to 14 minimize that in your objective as well.
15 MEMBER BALLINGER: We all set? Other 16 members online?
17 CHAIRMAN REMPE: I have one just final 18 comment because this may be the last time you're here.
19 I think that all of us were very pleased to see the 20 responsiveness of SHINE. The visit helped make things 21 more concrete for us.
22 Again, I think that efficient regulation 23 and review by ACRS really depends a lot on the 24 applicant. And you guys did a great job. So thank 25 you.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
84 1 MEMBER BALLINGER: And I was mentally 2 processing those photos in the first few slides and 3 comparing it to the last time we were there, and 4 there's quite a different. There's quite a 5 difference. So thank you.
6 I guess we're ready for the staff. I 7 don't know. Who's the presenter?
8 MR. BORROMEO: It'll be Mike Balazik.
9 MR. BALAZIK: Hi. This is Mike Balazik.
10 Can everybody me okay?
11 MEMBER BALLINGER: Yes.
12 MR. BALAZIK: Okay. We'll start here in 13 a second. All right.
14 Good afternoon, everyone. My name is Mike 15 -- can you guys hear me okay?
16 MEMBER BALLINGER: I can.
17 MR. BALAZIK: Okay. I'll go ahead.
18 Good afternoon, everyone. My name is Mike 19 Balazik. I'm the Project Manager and Inspector in the 20 Non-Power Production and Utilization Facility 21 Licensing Plant in the Office of Nuclear Reactor 22 Regulation. Today I'll be providing an overview of 23 the staff's review of the application, some background 24 information, and some upcoming next steps of the 25 process.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
85 1 Next slide, please.
2 NRC staff is committed to conducting 3 efficient and effective reviews of applications and 4 inspections in accordance with applicable regulatory 5 requirements using appropriate regulatory guidance and 6 acceptance criteria while ensuring the protection of 7 the health and safety of the public.
8 NRC licensing and oversight activities 9 support the US national security interest in nuclear 10 nonproliferation policy objectives to establish a 11 domestically available and reliable supply of 12 molybdenum-99 without the use of highly enriched 13 uranium.
14 The NRC licensing activities include 15 initial licensing and subsequent license amendment 16 requests for facilities proposing to manufacture, 17 irradiate, and process low-enriched uranium and 18 molybdenum targets. The NRC oversight activities 19 include construction, inspection, operational 20 readiness reviews, safety and security inspection, and 21 licensing of operators.
22 Next slide, please.
23 The Division of Advanced Reactors and Non-24 Power Production and Utilization Facilities, otherwise 25 known as DANU, has the lead responsibility for NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
86 1 licensing of non-power production and utilization 2 facilities licensed under Part 50.
3 The following type of facilities can be 4 licensed as a 103 facility, which is a commercial 5 facility, or a 104 facility, which is for medical 6 therapy and research and development facilities. Some 7 of these facilities include non-power reactors, 8 subcritical operating assemblies similar to what SHINE 9 is, and production facilities. SHINE also contains a 10 production facility.
11 NRR relies on lots of expertise for this 12 type of review. We reached out to a lot of the other 13 offices that have supported the review in the areas of 14 emergency planning, physical security, accident 15 analysis, crit safety, and cyber security.
16 Next slide, please.
17 Now to touch on some background 18 information. The NRC received a two-part construction 19 permit application, received an environmental report 20 and a preliminary safety analysis report, otherwise 21 known as a PSAR, back in 2013.
22 As mentioned earlier, SHINE is planning to 23 produce molybdenum-99 from the fission of low-enriched 24 uranium targets in an irradiation facility consisting 25 of eight irradiation units. The molybdenum-99 is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
87 1 recovered through the irradiated target solution 2 processing in the radioisotope production facility, 3 which consists of a series of hot cells.
4 The construction permit was issued on 5 February 29th of 2016 and SHINE commenced construction 6 of the facility back in September of 2019.
7 Next slide, please.
8 Now I'll touch upon the licensing 9 overview. As mentioned earlier, the irradiation 10 facility houses eight subcritical irradiation units.
11 Catherine mentioned earlier that each one's licensed 12 for 125 kilowatts.
13 So this is comparable in power level and 14 safety considerations to existing non-power reactors 15 licensed under 10 CFR Part 50. A majority of the 16 reactors that are licensed are trigger reactors. I'd 17 say most of those have a licensed power limit of 18 approximately one megawatt.
19 What's different with SHINE is that SHINE 20 operates -- it's a subcritical operating assembly, so 21 it didn't meet the definition of a utilization 22 facility as defined in 50.2. And it couldn't be 23 licensed under 10 CFR Part 70.
24 So in order to align these processes with 25 the potential hazards, the NRC issued a direct final NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
88 1 rule. In chief, the 10 CFR 50.2 definition is to 2 include the SHINE irradiation units.
3 So now in 50.2, under the definition of 4 utilization facility it also includes an accelerator-5 driven subcritical operating assembly used for the 6 irradiation materials containing special nuclear 7 material, as described in the application assigned 8 Docket No. 50-608, which is SHINE. This final rule 9 was published in October of 2014. It became effective 10 in December of 2014.
11 Next slide, please. Perfect.
12 Okay. So just to touch upon the licensing 13 overview, the radioisotope production facility 14 consists of a series of hot cells for molybdenum-99 15 separation and purification. This facility was 16 defined as a production facility based on the batch 17 size, that the batches are greater than 100 grams. So 18 it meets the definition under 10 CFR 50.24, Production 19 Facility.
20 While the NRC has licensed production 21 facilities in the past, there are no such facilities 22 that are currently operating. There are a few 23 facilities in the past that have conducted similar 24 activities to SHINE.
25 There was the Cintichem, which was a five-NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
89 1 megawatt reactor. They did produce and process 2 molybdenum-99. However, it was done under 10 CFR Part 3 70 because the size of the batches were less than 100 4 grams.
5 West Valley was a privately owned facility 6 that was reprocessing fuel. So that was defined as a 7 production facility. They ceased operation back in 8 the early '70s. And I think Cintichem, they ceased 9 their activities -- I think it was in 1990.
10 So this is the first production facility 11 that's been licensed in quite some time. That's my 12 point here.
13 Next slide, please. Thanks.
14 The safety reviews for operating license 15 applications are conducted with the Commission's 16 regulations. The main guidance that we use for this 17 review was NUREG-1537, guidelines for preparing and 18 reviewing applications for licensing of non-power 19 reactors.
20 We also used the ISG. It expands the 21 guidance for NUREG-1537 to include aqueous homogeneous 22 non-power reactor technology and guidance for the 23 production facilities for the separation of byproduct 24 material from special nuclear material.
25 We also used standard industry guidance, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
90 1 such as certain ANS standards and industry standards.
2 These were documented in the Safety Evaluation Report.
3 Next slide, please.
4 I just want to touch upon the licensing 5 process. For an operating license application, we 6 accepted and of course documented the review. We 7 performed the safety and environmental reviews. And 8 also, we obtained information through a request for 9 additional information and conducted audits to 10 understand some of the underlying information.
11 So here today we're at the Advisory 12 Committee on Reactor Safeguards review, so this has 13 been going on since early this year where we presented 14 the different chapters in the SER.
15 For hearings, there are no mandatory 16 hearings required for an operating license. There is 17 the potential for it to have a contested hearing. The 18 staff did put out an FRN for the opportunity to 19 request a hearing. That was issued back in January 20 6th of 2020.
21 There were no hearing requests that were 22 received. So the next step here is the decision to 23 grant or deny the license, and I'll talk about that in 24 a second here.
25 Next slide, please.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
91 1 I just want to touch upon the license 2 application itself real quick. SHINE submitted the 3 license application in July of 2019.
4 SHINE requested a single operating license 5 under Part 50. The irradiation units will be licensed 6 as utilization facilities and the hot cells will be 7 licensed as a production facility.
8 SHINE did request a 30-year license, a 9 Class 103, which is a commercial license, per the 10 requirements of 50.33, which requires general 11 information in the application. And it states to 12 request the duration of the license and what type of 13 license it is.
14 SHINE did submit a supplement to the 15 license application in January 2022. This was 16 providing information with a phased approach to 17 operation. The big picture consists of four phases of 18 construction. The operation and construction will be 19 occurring simultaneously.
20 The staff did evaluate the phased approach 21 to operation that's documented in Appendix A of the 22 Safety Evaluation Report. The staff's approach to 23 this review was to look at the deltas between the full 24 design and the phased approach design.
25 Next slide, please.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
92 1 Here is a list of some of the interactions 2 that the NRC staff has had with the subcommittee.
3 Back in February we presented an overview of the 4 review to the full committee. I'm just showing all 5 the different interactions and the different 6 information that was presented during the subcommittee 7 meetings.
8 Next slide, please.
9 So now let me get to the basis for issuing 10 of an operating license. The following findings must 11 be made to issue an operating license. It's based on 12 10 CFR 50.7.
13 These are that the constructions would 14 substantially complete; the facility will operate in 15 conformity with application regulations; reasonable 16 assurance that operation will not endanger public 17 health and safety; applicant technically and 18 financially qualified; the provisions of Part 140 are 19 satisfied, which is financial protection requirements; 20 and issuance of a license will not be inimical to 21 common defenses of security.
22 In the SER the staff has made a majority 23 of these findings at the end of each chapter.
24 However, for example, the construction has been 25 substantially complete. As a result of oversight NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
93 1 activities, those findings will be made. So I guess 2 I'll just say there's a lot more activity that needs 3 to be done in the oversight space before an operating 4 license is issued.
5 Also, the staff will have the operational 6 readiness inspection, which is a tool to provide more 7 input for NRC decisions regarding the issuance of an 8 operating license.
9 Next slide, please.
10 So we'll talk about a couple of next 11 steps. The staff plans to issue the Final Safety 12 Evaluation Report. We do understand that there's the 13 potential that as the facility moves towards 14 substantially complete, there may be a need for design 15 changes.
16 The staff will be ready to determine 17 whether these design changes impact the informational 18 findings in the SE, and potentially supplement the SE 19 as needed. And of course we'll notify ACRS of any 20 substantial changes to the SER.
21 Also, we're going to continue on with the 22 construction oversight activities under Inspection 23 Procedures 69020 and 69021. At this point we have 24 issued three inspection reports related to 25 construction oversight activities, which I've got NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
94 1 documented there.
2 Next slide, please.
3 The NRC staff is developing a SHINE-4 specific inspection plan using Inspection Procedure 5 69022, which is Inspections for Operational Readiness 6 During Construction in Non-Power Production and 7 Utilization Facilities. What I've got listed on the 8 screen are some of the areas that we are planning to 9 perform inspections. There may be more added later 10 on, but this is what we're at least starting off with.
11 Also, the operational readiness 12 inspections. We'll conduct these inspections once 13 SHINE informs the NRC that they're ready for each 14 inspection activity.
15 The final slide is that SHINE is expected 16 to notify the NRC in writing when the construction of 17 the facility is substantially complete. In our 18 inspection activities we'll support the basis on the 19 10 CFR 50.57 findings are satisfied, which allow 20 issuance of the operating license.
21 That's my last slide. I don't know if 22 there's any questions that I can answer.
23 MEMBER KIRCHNER: Mike, this is Walt 24 Kirchner. Have you found any major design changes 25 that would impact materially your SER?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
95 1 MR. BALAZIK: No, not at this point.
2 There have been some design changes throughout the 3 review. One of the changes was related to the carbon 4 delay beds and changing sensors, but there haven't 5 been any substantive design changes. Most of them are 6 minor.
7 However, going forward there's that 8 potential that there may be substantive design 9 changes. Right now we're just not knowing until the 10 facility is substantially complete.
11 MEMBER KIRCHNER: Can you give us an idea 12 of an estimated schedule for issuance of the operating 13 license?
14 MR. BALAZIK: I think I would let SHINE 15 answer that question based upon their construction 16 schedule.
17 MR. BARTELME: This is Jeff Bartelme, 18 Director of Licensing from SHINE. We are working 19 through some schedule updates right now. We do have 20 construction going through the majority of next year, 21 but we're still working through an update. We're 22 committed to getting the staff a letter in the near 23 term providing a schedule update.
24 MEMBER BALLINGER: This is Ron Ballinger.
25 I guess for the staff it's probably a bit subjective, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
96 1 but is there a threshold for which you need to modify 2 the SER? In other words, what constitutes enough 3 change so that you would have to modify the SER and 4 then maybe come before ACRS?
5 MR. BALAZIK: I think it's just dependent 6 upon what we've got documented in there, if it would 7 impact a finding. I think under that circumstance 8 that we'd have to come back to the ACRS. I think 9 we're going to have to do this as we see these design 10 changes and make that determination.
11 And of course, we can share all design 12 changes to the ACRS. It's just for their knowledge.
13 But again, I think it just depends on how we've 14 documented the design in the safety evaluation itself.
15 MEMBER BALLINGER: So it is a bit 16 subjective? There's no manual anywhere that says if 17 this happens then you have to do this?
18 MR. BALAZIK: That's correct.
19 MEMBER SUNSERI: This is Matt. They are 20 using a 50.59-like process, right, a 50.59 or a 50.59-21 like process, aren't they?
22 MR. BALAZIK: They are --
23 PARTICIPANT: Is it for construction?
24 MR. BALAZIK: SHINE is using that for 25 modifications for the facility.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
97 1 MEMBER SUNSERI: Right. I would think at 2 least one threshold would be anything that didn't 3 screen past 50.59 and required NRC approval prior to 4 implementing would be one that you would want to bring 5 forward.
6 MR. BORROMEO: This is Josh Borromeo. I 7 think the ultimate threshold is if they make a design 8 change and we're not aware of it. And then when we go 9 to make our 50.57 finding, if it doesn't align with 10 the FSAR, they don't get an operating license.
11 That's the ultimate backstop. Anything 12 that goes to that level, they'll have to address their 13 FSAR and we'll have to address our SE so that they are 14 in alignment and we can issue the license.
15 MEMBER BALLINGER: So how does this 16 process interact with the finding of substantially 17 complete construction?
18 MR. BORROMEO: SHINE will notify the staff 19 when they believe that they are substantially complete 20 with the facility. And then we'll inspect to ensure 21 that the facility is built in conformance with the 22 FSAR and we'll be able to operate it in conformance 23 with the FSAR. If we can't come to that finding, then 24 we won't issue an operating license.
25 MR. BALAZIK: One of the modules in the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
98 1 Operational Readiness Inspection Program are design 2 changes. So that's where we can get a look at all 3 those if needed.
4 MEMBER BALLINGER: Thank you.
5 Questions from the members? I'm not sure 6 who's online anymore.
7 MR. BALAZIK: Thank you, everyone, for 8 your time.
9 MEMBER BALLINGER: I hear no other 10 questions.
11 Is it appropriate for public comments?
12 CHAIRMAN REMPE: Yes.
13 MEMBER BALLINGER: Okay. So now we should 14 ask for public comments. If there are members of the 15 public that would like to make a comment, please 16 unmute yourself, state your name, and make your 17 comment.
18 This is a bit anti-climatic. Hearing 19 none, we're through with the presentations.
20 I'm sure that I speak for the rest of the 21 committee that we, if you can use the word, enjoyed 22 the review process. And we thank you very much for a 23 very thorough, both the staff and the applicant -- I 24 don't think we ever found any question that we didn't 25 get an answer to very quickly. Again, it sounds a bit NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
99 1 anti-climatic but thank you.
2 Madam Chairman?
3 CHAIRMAN REMPE: Thank you for your 4 leadership and getting us through that timely.
5 At this time, I'd like to ask the court 6 reporter to close the record for the transcript and 7 come back tomorrow at 8:30. Okay, Allegra?
8 COURT REPORTER: Yes.
9 CHAIRMAN REMPE: We're going off the 10 record.
11 (Whereupon, the above-entitled matter went 12 off the record at 4:24 p.m.)
13 14 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
Advisory Committee on Reactor Safeguards SHINE Medical Technologies, LLC Operating License Application Review Michael F. Balazik, Project Manager/Inspector Non-Power Production and Utilization Facility License Branch Division of Advanced Reactors and Non-power Production and Utilization Facilities Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission November 29, 2022
Supporting Domestic 99Mo Production
- NRC staff committed to efficient reviews of applications and inspections in accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR)
- Licensing and oversight activities support U.S. national security interests and nuclear nonproliferation policy objectives of establishing a domestically-available and reliable supply of molybdenum-99 (99Mo) without the use of highly-enriched uranium
- Applications include initial license and license amendment requests for facilities proposing to manufacture, irradiate, and process low enriched uranium and molybdenum targets
- Oversight activities focused on construction inspection of utilization and production facilities 2
Responsibilities and Coordination
- The Division of Advanced Reactors and Non-Power Production and Utilization Facilities (DANU) is responsible, in part, for initial licensing activities associated with NPUFs licensed under 10 CFR Part 50.
- The following types of facilities may be licensed as commercial or research and development facilities under Sections 103 or 104 of the Atomic Energy Act, respectively:
Non-Power Reactors, including advanced reactor technologies Subcritical Operating Assemblies Production Facilities
- NRR relies on the expertise and support of other offices in the following technical areas to review medical radioisotope facility applications:
Emergency Planning Accident Analysis Physical Security Chemical safety Environmental Criticality Safety Financial Qualifications Cybersecurity Material Control and Accounting 3
SHINE Medical Technologies Background
- NRC received two-part construction permit application Environmental Report (March 26, 2013)
Preliminary Safety Analysis Report (May 31, 2013)
- SHINE proposes to produce 99Mo from the fission of low enriched uranium target solution in an Irradiation Facility consisting of 8 irradiation units
- 99Mo is recovered through irradiated target solution processing in a Radioisotope Production Facility consisting of hot cells
- Construction permit issued on February 29, 2016
- Construction commenced in September 2019 4
Licensing Overview: SHINE Irradiation Facility
- Irradiation facility houses eight subcritical irradiation units, which are comparable in power level and safety considerations to existing non-power reactors licensed under 10 CFR Part 50
- However, due to subcriticality, irradiation units did not meet the existing definition of utilization facility in 10 CFR 50.2 and could not be licensed under 10 CFR Part 70
- To align licensing process with potential hazards, NRC issued direct final rule modifying 10 CFR 50.2 definition of utilization facility to include SHINE irradiation units Published October 17, 2014 Effective December 31, 2014 5
Licensing Overview:
SHINE Radioisotope Production Facility
- Radioisotope Production Facility consists of a series of hot cells for 99Mo separation and purification
- Based on batch size (i.e., greater than 100 grams), facility meets the definition of a production facility as defined in 10 CFR 50.2, Definitions
- While the NRC has historically licensed production facilities, no such facilities are currently operating
- Few previously-licensed facilities have conducted similar activities as SHINE Cintichem (licensed under 10 CFR Part 70)
West Valley (licensed as a reprocessing facility) 6
NRC Safety Review Methodology
- Safety reviews for operating license applications conducted in accordance with Commissions regulations
- Staffs review tailored to unique and novel technology described in operating license application using appropriate regulatory guidance NUREG-1537, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors Interim Staff Guidance Augmenting NUREG-1537 Other guidance (e.g., regulatory guides and industry standards) and engineering judgment used, as appropriate 7
10 CFR Part 50 Licensing Process
- Review process for operating license applications:
Acceptance and docketing review Parallel safety and environmental reviews Request(s) for additional information, as needed Advisory Committee on Reactor Safeguards (ACRS) review Hearing(s) o No mandatory hearing required for an operating license o Potential for contested hearing(s) o Opportunity to request hearing and petition for leave issued on January 6, 2020 (60 days) o No hearing requests received Decision to grant or deny license 8
SHINE Operating License Application
- SHINE submitted operating license application on July 17, 2019
- SHINE requested a single operating license under 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities Irradiation units licensed as utilization facilities Hot cells licensed as production facility
- SHINE requested a 30-year (Class 103) license (ML19211C089)
Per 10 CFR 50.22, Class 103 license is for commercial or industrial activities Per 10 CFR 50.51(a),states that each license will be issued for a fixed period of time to be specified in the license but in no case to exceed 40 years from date of issuance
- SHINE submitted a supplement to the license application in January 2022, providing information on phased approach to operations Consists of four phases Operations and construction occurring simultaneously The staffs evaluation of phased approach to operations is documented in Appendix A of the safety evaluation report (SER) 9
ACRS Subcommittee Engagement
- Subcommittee Topics (March 17)
- Subcommittee Topics (July 19/20)
- Facility Description (Chapters 1, 4)
- Design Criteria (within Chapter 3)
- Site Characteristics (Chapter 2)
- Instrumentation and Control (Chapter 7)
- Coolant Systems (Chapter 5)
- Fire Protection (within Chapter 9)
- Engineered Safety Features (Chapter 6)
- Conduct of Operations (within Chapter 12)
- Operator Training (within Chapter 12)
- Subcommittee Topics (May 6)
- Human Factors Engineering (within Chapter 7)
- Design of Structures, Systems, and Components (Chapter 3)
- Subcommittee Topics (September 9, 2022)
- Electrical Power Systems (Chapter 8)
- Technical Specifications (Chapter 14)
- Auxiliary Systems (Chapter 9)
- Cybersecurity (within Chapter 12)
- Radiation Protection and Waste Management (Chapter 11)
- Subcommittee Topics (October 21, 2022)
- Process Integrated Control System (within
- Subcommittee Topics (May 17/18) Chapter 7)
- Emergency Planning (within Chapter 12)
- Phased Startup Operations (within Appendix A)
- Accident Analysis (Chapter 13)
- Criticality Safety (within Chapter 6b)
- Material Control and Accounting (within Chapter 12) 10
Basis for Issuing Operating License
- The following findings must be made to issue an operating license, based on 10 CFR 50.57, Issuance of operating license.
Construction has been substantially completed [10 CFR 50.57(a)(1)]
Facility will operate in conformity with application and regulations
[10 CFR 50.57(a)(2)]
Reasonable assurance that operation will not endanger public health and safety [10 CFR 50.57(a)(3)]
Applicant technically and financially qualified [10 CFR 50.57(a)(4)]
Provisions of 10 CFR Part 140 satisfied (Financial Protection Requirements) [10 CFR 50.57(a)(5)]
Issuance of license will not be inimical to common defense and security
[10 CFR 50.57(a)(6)]
- These findings are supported by the NRC staffs evaluation of the application, as documented in the SER, and the staffs oversight activities, as documented in inspection reports
- Operational readiness inspection is a tool to provide input for NRC decisions regarding the issuance of an operating license 11 11
Next Steps
- The NRC staff will issue the final safety evaluation report
- If there is a need for design changes prior to the facility being substantially complete Determine whether design change impacts the information and findings in the SER Supplement the SER, as needed Notify ACRS of any substantive changes to the SER
- Construction inspection oversight continues under IMC 69020, Inspections of Safety-Related Items (and Services) During Construction of Non-Power Production and Utilization Facilities and IMC 69021, Inspection of Quality Assurance Program Implementation During Construction of Non-Power Production and Utilization Facilities Inspections completed: May 2022 (ML22154A405), April 2021 (ML21224A127), December 2019 (ML20030A744) 12
Next Steps (continued)
- NRC staff is developing a SHINE facility specific inspection plan using Inspection Procedure (IP) 69022, Inspections of Operational Readiness During Construction of Non-Power Production and Utilization Facilities Process and Effluent Monitoring Criticality Safety Radiation Protection Start-up Plan for Operation Operator Training Requalification Transportation Emergency Preparedness Instrumentation and Control Operations Quality Assurance Physical Security and Cybersecurity
- Operational readiness inspections will be conducted once SHINE informs the NRC of readiness for each inspection activity 13
Next Steps (continued)
- SHINE is expected to notify the NRC in writing when construction of the facility is substantially complete
- Inspection activities will support the basis for the NRCs conclusion that the 10 CFR 50.57 findings are satisfied 14
Overview of the SHINE Medical Isotope Production Facility (Open Session)
TRACY RADEL, VICE PRESIDENT OF ENGINEERING
© SHINE
© SHINE Technologies, Technologies, LLC LLC 1
Outline SHINE Site Overview Construction Status Process Overview Technological Approach Safety Philosophy
© SHINE Technologies, LLC 2
Located in Janesville, WI
© SHINE Technologies, LLC 3
Site Plan
© SHINE Technologies, LLC 4
Site Rendering
© SHINE Technologies, LLC 5
Construction Status Main Production Facility Resource Building Storage Building
© SHINE Technologies, LLC 6
Construction Status Process Piping Crane Structure for Installation of Supercell Air Handling Units
© SHINE Technologies, LLC 7
Process Overview Periodic solution preparation from LEU Solution chemistry check and staging Irradiation for 5.5 days Extraction, purification, QC, and packaging Waste handling
© SHINE Technologies, LLC 8
Technological Approach Small systems: 125 kW, hundreds of times less power than isotope production reactors being used o Low source termhelps ensure safety of public and workforce o Decay heat per system < 1 kW within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> o Minimizes waste nuclide generation compared to reactors Low enriched uranium (LEU) reusable target o Reduces waste o Product compatible with current supply chain o Eliminates need for highly enriched uranium (HEU)
Driven by low-energy electrostatic accelerator o Fission essentially terminate shortly after driver turned off Multiple units and trains provide operational scalability and flexibility
© SHINE Technologies, LLC 9
Safety Philosophy Low decay heat, low pressure, low temperature system o Minimal stored energy Independent units limit common cause failures Operator actions are not required to mitigate the consequences of an accident In the event of an upset condition:
o Target solution vessel (TSV) reactivity protection system (TRPS) initiates trip of system o Two completely independent safety-related TSV dump valves open o Target solution gravity drains to the TSV dump tank (safe for all uranium concentrations) o Hydrogen concentration maintained below lower flammability limit (LFL) by off-gas system blowers Following uninterruptible power supply (UPS) battery run time, entire plant is passively safe o 90 days without cooling: pool temperature rise is not more than 13°F o Nitrogen purge system for hydrogen control
© SHINE Technologies, LLC 10
Draft Guide 1374 - Proposed RG 1.152, Revision 4 Criteria for Programmable Digital Devices in Safety-related Systems of Nuclear Power Plants Advisory Committee on Reactor Safeguards Digital Instrumentation & Controls Systems Full Committee Briefing November 29, 2022
Working Group
- NRR/DEX
- RES/DE
- NSIR/DPCP
- Khoi Nguyen - Michael Eudy - Ismael Garcia
- David Rahn - Paul Rebstock - Kim Lawson-Jenkins
- NRR/DORL
- Michael Marshall
- NRR/DRO
- NRR/DSS 2
Presentation Outline
- Scope of Draft Guide (DG) 1374 and associated Regulatory Guide (RG) 1.152, Rev. 4
- Background
- Proposed Changes
- Subcommittee Feedback and Staff Responses
- Summary
- Q&A 3
Scope of DG 1374 & RG 1.152, Rev. 4 Endorses IEEE Std. 7-4.3.2-2016 as an acceptable approach to meet regulatory requirements for promoting high functional reliability, design quality, and a Secure Development and Operational Environment (SDOE) for the use of programmable digital devices (PDDs) in the safety-related systems of nuclear power generating stations.
4
Background
- Major Changes in IEEE Std 7-4.3.2 - 2016:
- Incorporating secure development and operational environment guidance from RG 1.152, revision 3.
- Providing specific criteria on the use of software tools in digital devices and the development of hardware, software, firmware, and programmable logic.
- Revising Annex D, Identification and Control of Hazards.
5
Proposed Changes
- Remove SDOE guidance from RG 1.152, R3 that has been incorporated into IEEE Std 7-4.3.2-2016.
- Endorse Revision 2016 of IEEE Std 7-4.3.2 with exceptions and clarifications, including:
Additional guidance for fault detection and self-diagnostics, if used, in DI&C systems.
Guidance and clarification for control of access.
Endorsement of Annex D, Identification and Control of Hazards.
Include additional guidance for providing safeguards to safety-related programmable digital devices before installation.
6
Subcommittee Feedback and Staffs Responses Feedback #1 DG-1374 does not contain guidance addressing external electronic data communication control of access.
Response
The staff will revise DG-1374 to provide an example indicating the use of hardware-based uni-directional communication is an approach the staff considers acceptable.
7
Subcommittee Feedback and Staffs Responses (Cont.)
Feedback #2 The guidance for measurement and test equipment (M&ET) in IEEE Std 7-4.3.2 only requires disabling of wireless capability prior to connecting to safety-related equipment.
Response
Significant guidance exists for both the control of M&TE and use of wireless technologies. IEEE Std 7-4.3.2 additionally requires that portable M&TE be maintained, controlled and accessed in a secure location with access limited to authorized personnel only. Additionally, RG 5.71 contains the following guidance:
- Section C.4.2 states checking and documenting all media and mobile devices, such as laptops, containing diagnostic, CDA [critical digital assets], and system and test programs or software for malicious code before the media or mobile device is used in or on a CDA.
- Section B.1.17 states that the licensee/applicant is responsible for: establishing usage restrictions and implementation guidance for wireless technologies, documenting, justifying, authorizing, monitoring, and controlling wireless access to CDAs, and conducting scans for unauthorized wireless access points.
The staff believe these controls remain adequate and does not intend to incorporate additional guidance into RG 1.152.
8
Subcommittee Feedback and Staffs Responses (Cont.)
Feedback #3 The endorsement status of IEEE Std 7-4.3.2 Annex C, Dedication of Existing Commercial Computers, is not clear.
Response
- The staff reviewed Clause 5.17 of IEEE 7-4.3.2 and found that it provides an acceptable approach for performing commercial grade dedication of digital equipment in safety-related systems at nuclear power plants. The staff also finds that Clause 5.17 is not in conflict with the guidance in RGs 1.164 and 1.250; therefore, the staff proposes endorsement of Clause 5.17.
- The staff will revise the draft guide to clarify that Clause 5.17 of IEEE Std 7-4.3.2-2016 provides criteria that the NRC staff finds acceptable for the use of commercial digital equipment in safety-related systems at nuclear power plants. Clause 5.17 references Annex C for additional information on commercial grade item acceptance and dedication.
However, while there is useful historical and reference information in Annex C, the NRC staff does not see a need to endorse such information.
9
Subcommittee Feedback and Staffs Responses (Cont.)
Feedback #4 DG-1374 does not contain the discussion of the I&C safety system architecture, including the fundamental design principles.
Response
The scope of RG 1.152 is to endorse IEEE Std 7-4.3.2 as an acceptable approach to meet regulatory requirements (IEEE Std 603).
I&C safety system architecture is evaluated by the staff in the context of meeting four fundamental design principles: redundancy, independence, deterministic, and diversity and defense-in-depth (D3). The staff performs its evaluation using its licensing process guidance contained in Interim Staff Guidance (ISG) 06 and the Design Review Guide (DRG).
While the fundamental design principles are considered by the staff when evaluating the I&C safety system architecture, deterministic and D3 are not part of IEEE Std 603 requirements and thus are out of scope for this RG.
10
Summary
- RG 1.152 is one of the primary RGs used by applicants and licensees in the development of digital I&C license applications, reactor certifications, and digital I&C topical reports.
- The update to RG 1.152 is a high priority based on recent licensing experience and interactions with stakeholders that contributed to the update to IEEE Std 7-4.3.2 in 2016.
11
Summary (Cont.)
The staff proposes the revision of RG 1.152 to
- Update information and guidance in the areas of functional reliability, design quality, and a SDOE for programmable digital devices in the safety-related systems of nuclear power plants.
- Support NRC guidance and review practices.
- Ensure that the guidance in these areas is current and consistent with the staffs position.
Thus, enhancing the efficiency and effectiveness of licensing review.
12
Questions?