RS-06-062, Supplemental Information Concerning License Amendment Request to Revise License Basis to Allow Ganged Rod Drive Capability of the Rod Control Management System

Supplemental Information Concerning License Amendment Request to Revise License Basis to Allow Ganged Rod Drive Capability of the Rod Control Management System

ML061370101
Person / Time
Site:	LaSalle
Issue date:	05/10/2006
From:	Bauer J Exelon Nuclear
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RS-06-062
Download: ML061370101 (5)

Text

Exelon.

Exelon Generation www.exeloncorp.com Nuclear 4300 Winfield Road Warrenville, IL60555 10 CFR 50.90 May 10, 2006 RS-06-062 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 LaSalle County Station, Units 1 and 2 Facility Operating License Nos. NPF-11 and NPF-18 NRC Docket Nos. 50-373 and 50-374

Subject:

Supplemental Information Concerning License Amendment Request to Revise License Basis to Allow Ganged Rod Drive Capability of the Rod Control Management System (RCMS).

Reference:

Letter from J. A. Bauer (Exelon Generation Company, LLC) to NRC, dated March 15, 2006, "Request for a License Amendment to Revise License Basis to Allow Ganged Rod Drive Capability of the Rod Control Management System (RCMS)"

In the referenced letter, Exelon Generation Company, LLC (EGC) submitted a license amendment request (LAR) for Facility Operating License Nos. NPF-1 1 and NPF-18 for LaSalle County Station (LSCS), Units 1 and 2 requesting NRC review and approval of a change to the LSCS Licensing Basis. The proposed Licensing Basis change revises the LSCS Updated Final Safety Analysis Report (UFSAR) to include the description of a potential ganged rod withdrawal error as an "infrequent incident," consistent with the description of a single control rod withdrawal error in UFSAR Section 15.4.1.2, "Continuous Rod Withdrawal During Reactor Startup." Approval of the LAR will enable EGC to implement a new operational capability (i.e.,

ganged rod movement) as part of the new LSCS Rod Control Management System (RCMS).

EGC will install the new RCMS modification pursuant to 10 CFR 50.59, "Changes, tests, and experiments."

In a conference call on April 11, 2006, representatives from EGC and the NRC discussed several issues concerning the proposed LAR. These issues are summarized in Attachment 1, along with an EGC response to each issue. Attachment 2 provides the General Electric Company (GE) Rod Control Management System Failure Modes and Effects Analysis (FMEA),

which was requested by the NRC during the April 11, 2006 teleconference.

40()

May 10, 2006 U.S. Nuclear Regulatory Commission Page 2 contains information considered proprietary to GE. Therefore, EGC requests that this information be withheld from public disclosure in accordance with 10 CFR 2.390, Public inspections, exemptions, requests for withholding," paragraph (a)(4), and 10 CFR 9.17, "Agency records exempt from public disclosure, paragraph (a)(4). A GE affidavit attesting to the proprietary nature of this document is included in Attachment 3, along with a non-proprietary version of the document.

As noted in Attachment 1, EGC will provide additional information by the end of May 2006, which will provide a complete response to all of the NRC issues documented in Attachment 1.

This supplement will also address the major design considerations of the RCMS, relative to applicable acceptance criteria for non safety-related control systems, as described in NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," Section 7.7, "Control Systems."

If you have any questions regarding this information, please contact Mr. John L. Schrage at (630) 657-2821.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 10h day of May 2006.

Respectfully, oseph A. Bauer Manager, Licensing Attachments Response to NRC Issues, LaSalle County Station LAR, Ganged Rod Movement Capability Proprietary Version: General Electric Rod Control Management System Failure Modes and Effects Analysis General Electric Affidavit and Non-Proprietary Version: General Electric Rod Control Management System Failure Modes and Effects Analysis

Attachment 1 Response to NRC Issues LaSalle County Station LAR Ganged Rod Movement Capability

1. Section 1.0, "Description," of the License Amendment Request (LAR), states that Exelon Generation Company, LLC (EGC) has completed a Failure Modes and Effects Analysis. That analysis should be submitted for review.

Attachment 2 provides a proprietary version of the General Electric Company (GE) Failure Modes and Effects Analysis (FMEA), while Attachment 3 provides a non-proprietary version, including a GE affidavit attesting to the proprietary nature of this document.

2. Section 2.0, "Proposed Change," states that "EGC has reviewed this new potential accident and has determined that there Is no single failure that would cause the uncontrolled withdrawal of ganged rods, and thus the postulated accident is an non-credible event." That review should be submitted for review.

EGC will provide a supplement to the referenced LAR to clarify the single failure analysis that was described in LAR Section 2.0 and provided in LAR Section 4.1. This revised single failure analysis will explicitly address the mitigation of potential software failures, hardware failures, and human errors, as part of a defense-in-depth assessment of the Rod Control Management System (RCMS), relative to a potential ganged rod withdrawal error. EGC will provide this supplement by the end of May 2006. This supplement will also address the major design considerations of the RCMS, relative to applicable acceptance criteria for non-safety-related control systems described in NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," Section 7.7, "Control Systems."

3. The brand and type of system Is not mentioned. EGC should provide that Information.

As stated during the April 11, 2006 teleconference, the RCMS hardware and software that EGC will install is a first-of-a-kind installation. The non-safety-related RCMS system was designed by General Electric and will replace the discrete digital logic hardware of the existing non-safety-related Reactor Manual Control System with a software-based system, greatly enhancing the operability, surveillance, and maintenance capabilities of the rod control system.

4. The method used for the qualification of this system Is not mentioned. EDG should provide that Information, with specific emphasis on system requirements and testing methods.

Although the system, equipment, and software are not safety-related, EGC has implemented an electromagnetic compatibility (EMC) qualification test plan for analysis of the new RCMS system (NUMACTm and GE equipment) to meet the design specification.

The specification requires "No EMI/RFI [Electromagnetic Interference/Radio Frequency Interference] interaction with other plant systems. This includes both emissions and susceptibility."

The EMC test plan will include EMC mapping to ensure that the RCMS digital upgrade is not susceptible to ambient EMI/RFI. EMC measurements will be acquired in accordance with EPRI TR-102323, Revision 2, 'Guidelines for Electromagnetic Interference Testing Power Page 1

Attachment 1 Response to NRC Issues LaSalle County Station LAR Ganged Rod Movement Capability Plant Equipment," and a comparative analysis will be implemented for RCMS hardware components against prior EMC qualifications for similar NUMACTm and GE equipment. Note that over 600 NUMACTM instruments are in operation around the world, with 20 years of experience. Most of this product line has undergone EMC testing per EPRI TR-1 02323.

There has been no evidence of NUMACTM instruments interfering with other instruments.

Similarly, there is no evidence that other plant equipment has interfered with NUMACTM instruments.

The comparative analysis will consider each category of electromagnetic interference described in EPRI TR-102323 to determine additional testing requirements. This data will then be reviewed to determine if the RCMS envelops the LSCS environment.

5. Section 3.2, "Replacement System," states that each channel of rod control Is driven by a 20" touch screen monitor. Section 3.3, "Movement of a Rod Gang," subsection 2, states that rod motion is initiated by touching a hand button on the MCR (Main Control Room) panel. How was the touch screen qualified and dedicated, and how will Inadvertent movement via an unintended touch be prevented? Has this touch screen been qualified by human factors review?

The rod movement control switches in the new RCMS (i.e., the push buttons that are used by the operator to withdraw and insert a control rod) are similar to the same components in the current system (i.e., electromechanical push buttons) and provide identical functionality.

The 20" touchscreen monitor will replace the current Rod Select Matrix. The current system is equipped with individual mechanical push buttons for each control rod.

The touchscreen displays indicate that the operator's finger is over a selectable softkey by a change in color border (i.e., appearance that the softkey is depressed). Softkeys are selected when the finger is over the softkey and released from the touchscreen. Rod motion commands are provided via the rod movement control switches, which are independent of the touchscreen. Thus, inadvertent movement of a control rod or gang cannot result solely from the unintended touch of a touchscreen.

With respect to a human factors review, the graphical user interface screens for the LSCS RCMS were developed under a Human Factor Engineering (HFE) program that defined the information, controls, and alarms for controlling and monitoring the RCMS. Although the RCMS has no safety-related functions, the following codes, standards, and guidelines were used as the basis for the HFE analysis that was performed for this system:

• Institute of Electrical and Electronics Engineers (IEEE) Standard 1023 -1988, "IEEE Guide to the Application of Human Factors Engineering to Systems, Equipments and Facilities of Nuclear Power Generating Stations."

• International Electrotechnical Commission (IEC) Publication 964, "Design for Control Rooms of Nuclear Power Plants, 1989."

• NUREG-0700 Rev.2, "Human-System Interface Design Review Guideline."

• NUREG-071 1, "Human Factor Engineering, Program Review Level."

Page 2

Attachment 1 Response to NRC Issues LaSalle County Station LAR Ganged Rod Movement Capability NUREG-0800 Rev.1, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," Chapter 18, "Human Factor Engineering."

• NUREG/CR-3331, "A Methodology For Allocating Nuclear Power Plant Control Functions to Human and Automated Control."

6. Section 3.2, "Replacement System," states that all of the assorted RCMS components, the Plant Process Computer and Sequence Development Computer are connected to the same Ethernet network. Details on this architecture should be provided, with an emphasis on the cyber security being used In this network.

A complete description of the cyber security for the RCMS hardware and software architecture will be provided in the follow-up supplement described in the EGC response to Issues 2 above.

7. Section 4.2, Common Mode Software Failure In the RCMS Programming, states that:

"This evaluation did not review common mode failure of the software as this was considered to be a non-credible event by the rigor employed In the design process and through the Verification and Validation (V&V)of software development". The NRC Standard Review Plan, Chapter 7, Branch Technical Position 19, states that "despite high quality of design, software errors may stilldefeat safety functions In redundant, safety-related channels", and that "The applicant/licensee should assess the defense-in-depth and diversity of the proposed Instrumentation and control system to demonstrate that vulnerabilities to common-mode failures have been adequately addressed." Industry and NRC experience has shown that software developed under an Appendix B program may still not be free of software errors. 'The licensee needs to perform a diversity and defense-in-depth analysis. In addition, the documentation normally associated with a digital review shown in SRP figure 7.O-A-5, should be submitted for staff review.

EGC recognizes and agrees that software developed under an Appendix B program may not be free of software errors. As such, EGC will provide a revised single failure analysis to explicitly recognize potential software failures. Please note that this supplement was also discussed in the response to Issues 2 and 6 above.

Page 3