ML25154A659
| ML25154A659 | |
| Person / Time | |
|---|---|
| Site: | 99902041, PROJ0728 |
| Issue date: | 06/30/2025 |
| From: | Ngola Otto Licensing Processes Branch |
| To: | Elliott G Framatome |
| Shared Package | |
| ML25154A657 | List: |
| References | |
| EPID L-2024-TOP-0029 | |
| Download: ML25154A659 (9) | |
Text
OFFICIAL USE ONLY - PROPRIETARY INFORMATION OFFICIAL USE ONLY - PROPRIETARY INFORMATION MARCH 31 - APRIL 4, 2025, REGULATORY AUDIT REPORT REGARDING FRAMATOME INC. TOPICAL REPORT ANP-10357P, REVISION 0 TXS COMPACT PLATFORM TOPICAL REPORT PROJECT NO. 728 EPID L-2024-TOP-0029
1.0 BACKGROUND
By application dated August 2, 2024 (Agencywide Documents Access and Management System (ADAMS) Package Accession No. ML24218A279), Framatome, Inc. submitted Topical Report (TR) ANP-10357P, Revision 0, TXS Compact Platform Topical Report, for U.S. Nuclear Regulatory Commission (NRC) staffs review and approval. The TXS Compact Platform is based on a field programmable gate array (FPGA) technology and includes different module options that are designed for implementation in safety-related instrumentation and control (I&C) system applications in nuclear power plants (NPPs). On March 31-April 4, 2025 (ADAMS Accession No. ML24352A156), the NRC staff conducted an in-person regulatory audit of the TXS Compact Platform at Framatome headquarters in La Defense business district in Courbevoie, France. The audit supports the NRC staffs safety evaluation (SE) pertaining to the TXS Compact Platform TR (hereafter referred to as the TR) review. This audit was performed in accordance with the Office of Nuclear Reactor Regulation procedure as described in LIC 111, Regulatory Audits, and regulatory guidance listed in the audit plan.
The scope of the audit included equipment qualification (EQ), system development life cycle process, and quality assurance (QA) which covered several topic areas of the TR including the following: TXS Compact Platform architecture, modules, communications, configuration, diagnostic, monitoring, EQ, life cycle management, reliability, failure modes effects and analysis, QA, security, and regulatory compliance.
Per the NRC staffs request, a list of reference documents was available on the Framatome online portal to support the audit, and additional documents were added to facilitate responses to the NRC staffs questions. The NRC staffs informational needs requests were addressed by Framatome representatives during the audit.
2.0 REGULATORY AUDIT OBJECTIVES The overall objectives and goals for the audit are provided below. The in-person audit facilitated the NRC staffs review through direct interaction with Framatomes technical experts.
Equipment Qualification Ensuring common cause failure is negligible due to environmental, electromagnetic interference and radio frequency interference, seismic, and Class 1E to non-Class 1E isolation effects.
Review documentation and observe simulations to ensure that the TXS Compact Platform can perform its intended safety function.
OFFICIAL USE ONLY - PROPRIETARY INFORMATION OFFICIAL USE ONLY - PROPRIETARY INFORMATION accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents.
Appendix A, GDC 21, Protection System Reliability and Testability, of 10 CFR Part 50 requires, in part, that protection systems be designed for high functional reliability commensurate with the safety function to be performed.
10 CFR 50.55a(h) states that protection systems of nuclear power reactors of all types must meet the requirements specified in 10 CFR 50.55a(h), and each combined license for a utilization facility is subject to the conditions in 10 CFR 50.55a(h). 10 CFR 50.55a(h)(2) mandates compliance with the requirements stated in IEEE Standard (Std) 279-1968, Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, IEEE Std 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, or IEEE Std 603-1991, IEEE Criteria for Safety Systems for Nuclear Power Generating Stations, and the correction sheet dated January 30, 1995, for NPPs with construction permits (CPs) issued before January 1, 1971. 10 CFR 50.55a(h)(2) requires compliance with their plant-specific licensing basis or CPs issued between January 1, 1971, and May 13, 1999. For NPPs, IEEE Std 603-1991 and the correction sheet dated January 30, 1995. For applicants for CPs, operating licenses, combined licenses, standard design approvals, design certifications, or manufacturing licenses filed after May 13, 1999, 10 CFR 50.55a(h)(3) requires compliance with IEEE Std 603-1991 and the correction sheet dated January 30, 1995.
There is a clause in both IEEE Std 279 and Std 603 on EQ requiring safety system equipment shall be qualified by type test, previous operating experience, or analysis, or any combination of these three methods, to substantiate that it will be capable of meeting, on a continuing basis, the performance requirements as specified in the design basis.
Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50 prescribes requirements for QA to ensure that SSCs will perform satisfactorily in service. This includes:
o Criterion II, Quality Assurance Program, requires the identification of SSCs to be covered by the QA program.
o Criterion III, Design Control, requires in part that (1) measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of SSCs, and (2) quality standards be specified and that design control measures shall provide for verifying or checking the adequacy of design.
o Criterion IV, Procurement Document Controls, requires that measures be established to assure that applicable regulatory requirements, design bases, and other requirements are suitably included or referenced in the documents for procurement of materials, equipment, and services.
o Criterion V, Instructions, Procedures, and Drawings, requires in part that activities affecting quality shall be prescribed by documented procedures of a type appropriate to the circumstances Branch Technical Position (BTP) 7-14 of the NRC outlines such procedures for software quality assurance.
OFFICIAL USE ONLY - PROPRIETARY INFORMATION OFFICIAL USE ONLY - PROPRIETARY INFORMATION Figure 1: TELEPERM XS Compact in Cabinet3 During the audit the NRC staff covered the following areas of review to verify that the TXS Compact modules were qualified and tested for use in U.S. NPP applications. The NRC staff observed tests of the prototype TXS Compact Platform during the demonstrations. A summary of the results of the audit are described below.
Life cycle process o User V-model o IV&V o Secure development and operational environment o Test coverage o Tools qualification - all tools used o Functional block development process o Self-diagnostic capabilities o Security by design - ensure that the safety function is not impaired.
Based on the results of the review and discussions, the NRC staff observed that:
Presentations made by the Framatome staff and demonstrations of the TXS Compact development activities in their laboratory confirmed that a well-documented process is being followed in compliance with industry codes and standards.
3 https://www.framatome.com/solutions-portfolio/portfolio/product/A3169/txs-compact-digital-safety-i-c-platform. TELEPERM XS (TXS) Compact.
OFFICIAL USE ONLY - PROPRIETARY INFORMATION OFFICIAL USE ONLY - PROPRIETARY INFORMATION Framatome staff provided details related to mean times before failure (MTBF) which demonstrated the long lifetime of the modules. Requirements for periodic maintenance will be addressed in operations & maintenance manual.
NRC staff witnessed the use of TXS Compact toolchain to build, load and monitor I&C applications.
The NRC staff witnessed the use of FPGA development independent V&V tool sets that are certified and broadly used in the industry with a large experience base.
Concurrent with the NRC review of the TXS Compact platform, Framatome is pursuing International Electrotechnical Commission (IEC) 61513 certification by TÜV Sud, which is requiring a rigorous evaluation of the TXS Compact platform development lifecycle activities.
A tour of the TXS Compact development lab confirmed a secure system development environment.
Equipment qualification o Climatic (environmental) testing o Seismic testing o EMC testing o Isolation testing Based on the results of the review and discussions, the NRC staff observed that:
o Criterion VII of Appendix B to 10 CFR Part 50, Control of Purchased Material, Equipment, and Services," requires, in part, that measures shall be established to assure that purchased material, equipment, and services, whether purchased directly or through contractors and subcontractors, conform to the procurement documents. These measures shall include provisions, as appropriate, for source evaluation and selection.
During the regulatory audit, the NRC staff noted that EQ testing service for the TXS Compact Platform was conducted by third parties contracted by Framatome GmbH.
However, Framatome did not perform commercial grade dedication (CGD) for the EQ testing service until the EQ testing service was already completed. This observation will be addressed by a request for additional information asking the applicant to clarify or justify the use of the EQ testing service provided by third parties without prior implementation of CGD.
o The NRC staff identified additional documents including EQ testing plans, specifications, procedures, and testing results which need to be submitted and docketed to support the NRC staffs SE.
Quality Assurance The NRC staff reviewed the QA documentation associated with Framatomes oversight of Framatome SAS and its subsidiary companies for the design, development, and manufacturing of the TXS Compact Platform. Specifically, the NRC staff reviewed and discussed with Framatome Inc. staff the:
o Framatome Inc.s QA Program Description o Framatome Integrated Management System Manual
OFFICIAL USE ONLY - PROPRIETARY INFORMATION OFFICIAL USE ONLY - PROPRIETARY INFORMATION o Framatome Inc. audit report, including the associated findings for Framatome SASs QA Program implementation for the TXS Compact Platform design, development, procurement, and manufacturing activities o Procedures and work instructions for the design and development of a safety related I&C platform and products, and dedication of commercial grade items and services o TXS QA Plan for TXS Compact AS FPGA o TXS Compact Quality Management Plan o TXS Compact CGD Plan for manufacturing services and TXS Compact commercial grade survey checklist and report for a TXS compact module manufacturer o Purchase order issued from Framatome SAS to its supplier Based on the results of the review and discussions, the NRC staff observed that:
o Framatome Inc. (based in the U.S.), the submitter of the TR, does not own the design of the TXS Compact Platform and it does not intend to be the owner.
o Framatome Inc. intends to procure the platform from Framatome SAS and GmbH as a safety-related product; however, based on the results of Framatome Inc.s audit of Framatome SAS and GmbH, ((
))As such, Framatome Inc. could not place Framatome SAS and GmbH on the approved supplier list of Framatome Inc without conditions.
o Framatome Inc. stated that the resolution of findings it identified during a 2023 QA audit of Framatome SAS and GmbH will not be resolved until the ((
)) in a best-case scenario.
o Framatome SAS and GmbH did not have ((
)) of the versions of the TXS Compact modules (as referenced in the Framatome Inc. TXS COMPACT TR).
o Since the creation of the Framatome SAS ((
)) However, the NRC staff identified during the regulatory audit that Framatome SAS failed to recognize that the scope of services provided ((
)) included hardware design, which ((
)). Framatome SAS stated it created a corrective action report in response to the NRC staffs observation.
5.0 CONCLUSION
The NRC staffs audit objectives were accomplished through face-to-face discussions with the Framatome technical experts and engineers, document review, and verification of information and test results. More specifically, the NRC staff gained an in-depth understanding of the TXS Compact Platform and verified the associated functional and performance results. Additionally, the NRC staff verified that the process used to establish requirements specifications for the TXS Compact Platform and audited the use of the requirements traceability matrix at all phases of digital system development lifecycle activities. The NRC staff confirmed that acceptable plans
OFFICIAL USE ONLY - PROPRIETARY INFORMATION OFFICIAL USE ONLY - PROPRIETARY INFORMATION were prepared to control FPGA and tools development activities and there was evidence that the plans were followed in an acceptable FPGA and tools development lifecycle, and evidence that the lifecycle process produced acceptable design outputs.
Finally, the NRC staff assessed all non-docketed EQ program documentation including testing plans, specifications, and procedures utilized to perform qualification testing (e.g., environmental, seismic, EMC, and Class 1E to non-Class 1E isolation). Performance of the critical functional requirements under the specified hazards, such as built-in self-diagnostic capabilities resulting in safe state, fail-safe actions, internal fault detections resulting in desired outcome, etc., and handling of anomalies identified during digital system development lifecycle processes were observed.
No regulatory decisions were made during the audit. The NRC staff and Framatome representatives held a follow-up meeting on May 22, 2025 (ADAMS Accession No. ML25164A315).