ML25336A022

Component Interface Module Common Cause Failure Excerpt from Limerick Digital Instrumentation and Controls License Amendment Request Draft Safety Evaluation

ML25336A022
Person / Time
Site:	Limerick
Issue date:	11/13/2025
From:	Marshall M Plant Licensing Branch 1
To:	Rickey A Constellation Energy Generation, Constellation Nuclear
References
EPID L-2022-LLA-0140
Download: ML25336A022 (0)

Text

From:

Michael Marshall To:

ext Ashley Rickey Cc:

Para, Wendi E: (Constellation Nuclear); Rector, Matthew K: (Constellation Nuclear); Samselski, Mark:

(Constellation Nuclear)

Subject:

RESPONSE REQUESTED: CIM CCF Excerpt From Limerick Digital I&C LAR Draft Safety Evaluation (L-2022-LLA-0140)

Date:

Thursday, November 13, 2025 3:38:00 PM Hello Ashley,

By letter dated September26, 2022 (Agencywide Documents Access and Management System Accession No. ML22269A569; non-public), as supplemented by letters dated August12, 2022 (ML22224A149), November29, 2022 (ML22333A817),

February8, 2023 (ML23039A141), February15, 2023 (ML23046A266), March30, 2023 (ML23089A324), April5, 2023 (ML23095A223), June26, 2023 (ML23177A224),

July31, 2023 (ML23212B236), September12, 2023 (ML23255A095), October30, 2023 (ML23303A223), November21, 2023 (ML23325A206), January26, 2024 (ML24026A296), February26, 2024 (ML24057A427), March7, 2024 (ML24067A294), March18, 2024 (ML24057A426), April23, 2024 (ML24114A322),

May3, 2024 (ML24124A043), June13, 2024 (ML24165A264), June14, 2024 (ML24166A114), June28, 2024 (ML24180A157), February5, 2025 (ML25037A286),

February21, 2025 (ML25055A156), April4, 2025 (ML25094A145), June3, 2025 (ML25154A616), July2, 2025 (ML25183A133), July10, 2025 (ML25191A223),

July30, 2025 (ML25211A294), September8, 2025 (ML25251A214), September26, 2025 (ML25269A191), and October 1, 2025 (ML25274A140).,Constellation Energy Generation, LLC (Constellation, the licensee) submitted license amendment requests (LAR) for Limerick Generating Station, Units 1 and 2 to the U.S.Nuclear Regulatory Commission (NRC) staff for review. Enclosed for Constellation review and comment is a copy of the NRC staffs draft safety evaluation (SE) for the LAR. The supplement dated September12, 2023, replaces in its entirety the original LAR dated September26, 2022. The licensee replaced the original submittal, because the licensee had mistakenly included proprietary information in the non-proprietary parts of the request. The NRC staff made all the original submittal non-public. With the exceptions noted by the licensee in the letter dated September12, 2023, the content of the replacement and the original are the same.

On November 13, 2025, using the Microsoft External SharePoint Sharing service, the NRC staff sent Constellation an excerpt from the NRC staffs draft safety evaluation.

The excerpt is the subsection of the draft safety evaluation that contains the NRC staffs review of defense-in-depth and diversity evaluation of the component interface module portion of the proposed Limerick plant protection system. Pursuant to Section2.390 of Title10 of the Code of Federal Regulations, we have determined that the excerpt contains proprietary information. If Constellation believes that any information in the enclosure is proprietary and has not been identified with appropriate portion markings (i.e., double bold brackets), please identify such information linebyline using line numbers and page numbers. Also, we have determined that the excerpt does not contain any export control information. If Constellation believes that any export control information is in the excerpt, please identify such information linebyline using the line numbers and page numbers. While

reviewing the draft SE to confirm proprietary information has been properly marked and export control information has been excluded, if Constellation believes it has identified any factual errors or has clarity concerns, please identify such errors or concerns linebyline using the line numbers and page numbers.

To facilitate the NRC staffs review of Constellations comments, if any, please provide a markedup copy of the excerpt showing proposed corrections and provide a summary table of the proposed corrections. Note, at this stage of the review process, the NRC staff has completed our review of the submitted information and will not entertain additional technical arguments. The NRC staff conclusions and conditions will not change unless new information is provided on the docket that was not available during our review. The review of any additional information will delay the issuance of the NRCs decision on the Limerick digital instrumentation and controls license amendment request.

Please provide Constellations comments, if any, within 10 working days of the date of this email. If you have any questions, please contact Michael Marshall via phone at 301415-2871 or via email at michael.marshall@nrc.gov.

Best Regards, Michael L. Marshall, Jr.

Senior Project Manager

Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

301-415-2871

1 2

3 4

5 6

7 8

9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 OFFICIAL USE ONLY - PROPRIETARY INFORMATION 3.3.4.2 D3 Evaluation of the CIM Portion of the PPS This section provides the NRC staff's evaluation of the licensee's D3 evaluation of the CIM portion of the proposed Limerick PPS. This section includes the NRC staff's evaluation of the licensee's statements that the CIM used in the proposed Limerick PPS does not contain latent design defects, and therefore, is not vulnerable to a CCF. In addition, it includes the NRC staff evaluation of self-diagnostics available in the proposed Limerick PPS, independent displays and controls that are not affected by a failure of a CIM or CIMs, existing plant features, existing procedures, and existing operator actions available to respond to an event if the normal means to initiate a safety (i.e., protection) function becomes unavailable (e..

, f ilure of multiple CIMs due to CCF within the CIM portion of the PPS).

Applicable Regulations Limerick's principal design criteria are the same as t

• a listed in Appendix A to 1 0 CFR 50. The NRC staff consid ign criteria requirements when performing the D3 evaluati portion of t imerick PPS GDC 21, "Protection system reliability anct es ability,". ates, in part, that t e protection system shall be designed for high functiona eliabilit a d in-service testability commensurate with the safety fnctions to be rfc>nped. Redundancy and independence designed into tt<e rotion syste shall be sufficient to assure that no single failure results in loss of t e P.FO ectiunction Th protection system shall be designed to permit periodic testin f i s'fl.l_ncti0ning wh n"t reactor is in operation, including a capability to test channls independen y, to dete ine failures and losses of redundancy that m y1fave occurred GDC 22, "Prot epen ence, s a es, m part, that the protection system shall be t the effe natural phenomena, and of normal operating p

d accident conditions on redundant channels

,,..-----=

r function or shall be demonstrated to be accepts as n techniques, such as functional diversity or di -rs

• n and principles of operation, shall be used to the extent tical rotection function.

The C taff evaluated e CIM po i of the proposed Limerick PPS ability to preclude or withstanci Cts.( due to laten d sign defects to ensure there is no loss of safety (i.e., protection) function and ensure high fu ctional reliability of the system.

NRC Staff Revie Guidance..for Evaluating Digital System CCF The NRC staff rev;$, qyilnce for evaluating the adequacy of defense in depth and diversity in a proposed digital protection system is contained in NUREG-0800 Chapter 7, Branch Technical Position BTP 7-19. The review criteria for determining whether a licensee for a proposed digital l&C safety system design has adequately eliminated the potential for CCF from further consideration is contained in Sections B.3.1 through B.3.3 of BTP 7-19. Evaluation criteria endorsed by the NRC staff are also contained in Clause 5.16 of IEEE Std 7-4.3.2-2016.

In its letter dated September 26, 2025, the licensee stated that "[f]or the CIM, an alternative approach was taken to best ensure the CIM does not have a latent design defect." The NRC staff evaluation considered the licensee's alternative approach for eliminating CCF OFFICIAL USE ONLY - PROPRIETARY INFORMATION

1 2

3 4

5 6

7 8

9 10 11 12 13 14 15 16 17 18 19 20 OFFICIAL USE ONLY - PROPRIETARY INFORMATION ln Attachment 8 of the licensee's letter dated July 31, 2023, Constellation describes how the CIM is used in the proposed Limerick PPS. The licensee states that the CIM is an FPGA component utilized as a priority module as described in Dl&C-ISG-04, Position 2, Command Prioritization.

In Section 2.2 of WNA-AR-01074-GLIM-P, the licensee states that "[t]he CIM, due to its design, is still considered available and not susceptible to a CCF."

Safety Significance of the Consequence of CCF of the CIM Portion of the PPS The NRC staff recognized that highly reliable operations of the CIMQmperative for the proposed Limerick digital architecture to achieve its required sat ty ffinctions. With a CCF affecting all CIMs, attempts to automatically or manually co

ntfol pr guired field components (valves and pumps) to initiate safety-related functions (e.g., H Cl, Alit_S, CS, RHR-LPCI, NSSSS, RHR cooling modes, RCIC and SLCS) from witnf t e control'r.

using either the PPS, DPS, or DCS would fail (see figure below).

21 Figure 1 - Simplified Diagram of the Proposed Limerick O/&C Architecture 22 23 Licensee Proposed Alternative Approach for Demonstrating that the CIM Does Not Have a 24 Latent Design Defect 25 26 In its September 26, 2025, letter, the licensee stated that "[f]or the CIM, an alternative approach 27 was taken to best ensure the CIM does not have a latent design defect. The licensee's 28 alternative approach consists of two parts:

29 OFFICIAL USE ONLY - PROPRIETARY INFORMATION

1 2

3 4

5 6

7 8

9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 OFFICIAL USE ONLY - PROPRIETARY INFORMATION The NRC staff reviewed Chapter 15 of the Limerick UFSAR and determined that the licensee appropriately identified the 13 applicable events. For each of these events, the licensee provided information regarding operator response, including the information available to operators, equipment availability, and the location of required actions (i.e., MCR, RSP, or local).

Of the 13 events, 11 require operator action. For these 11 events, the licensee stated in its letter dated September 26, 2025, that it conducted walk-throughs using the Limerick glass-top simulator to demonstrate that the required operator actions are feasible, can be completed within the necessary timeframes, and that the applicable acceptance criteria, as described below, would be met.

The licensee used the acceptance criteria from NUREG/CR-63(l3, *~ ethod for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection y te~," which describes a method for analyzing computer-based nuclear reactor prot cti n syst ms that discovers design vulnerabilities to common-mode failure. The specific ana ysis guideline a as follows:

For anticipated operational occurrences as e eribed in Guideline 1 O in ombination with primary protection system failure),

e 9_?81 of defen..se-in-depth anal sis using best-estimate (realistic assumptions) methodol~Y:~s to show t at no more tha~

small fraction (10 percent) of the 10 CFR 100 dos~ m*t is x eded, and that the integrity of the primary coolant pressure boundary is not vi la e For design basis accidents as {

ri~

Guidelin 1 (('.l combination wrth primary protection system failure), the goal et a"efense-iQ::ieptfi analysis using best-estimate methodology is to show that any c ealble failure aoes no1'1': suit in exceeding the 1 O CFR 100 dose limi s, iolation of ie integ ":ty'of.4tie" >r-jp1ary coolant pressure boundary, or vio atiowof-.the

• tegrity f ne,ontainment/"

In its letter dated ~

tember 26, 29251 the licen~ee stated that both the Limerick ANSI simulator and the Limerick glas~ m~ simulator l!ltilize the C'OR.YS' THOR thermal-hydraulic modeling software. The licensee"s so utions~

ra e-eng ering-grade modeling tools, immersive virtual envjr-onments an~

gll-f),delity control-.

replicas or emulations. The THOR code is a five-equafio ;"'f10R~q ilibrium multiphase thermal-hydraulic model that has undergone exte s ve qualificatio a is

• e recognized as an industry-standard advanced simulation tool.

Because R is not an NRC-approved thermal-hydraulic evaluation model, the licensee is not using it as ~ u stitute for its ~ fety analysis, but rather is using it as a simplified simulator code and model to enable real~

e performance. These results are intended to demonstrate that operators have a~

s to su cient equipment and can perform the necessary functions within an appropriate timeframe to ensure the plant remains in a stable condition in the event of a CCF of the Cl Ms. Therefore tlie NRC staff finds the use of the Limerick simulator, in this specific case, as a best-estimate tool to demonstrate the plant can successfully meet the analysis guideline limits in NUREG/CR-6303 assuming a CCF of the Cl Ms.

For the majority of the evaluated events, the licensee used reactor vessel water level as a surrogate indicator to assess whether the applicable dose acceptance criteria are met.

Specifically, the licensee concluded that if the water level remains above the top of the active fuel, there would be no fuel damage and no challenge to the regulatory dose limits. The NRC staff finds this approach acceptable, as maintaining fuel coverage ensures that decay heat is OFFICIAL USE ONLY - PROPRIETARY INFORMATION