W3F1-2021-0015, Revised Vendor Oversight Plan Summary - License Amendment Request to Implement a Digital Upgrade to the Core Protection Calculator (CPC) System and Control Element Assembly Calculator (Ceac) System

Revised Vendor Oversight Plan Summary - License Amendment Request to Implement a Digital Upgrade to the Core Protection Calculator (CPC) System and Control Element Assembly Calculator (Ceac) System

ML21029A156
Person / Time
Site:	Waterford
Issue date:	01/29/2021
From:	Gaston R Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
W3F1-2021-0015
Download: ML21029A156 (18)

Text

Entergy Operations, Inc.

1340 Echelon Parkway Jackson, MS 39213 Tel 601-368-5138 Ron Gaston Director, Nuclear Licensing 10 CFR 50.90 W3F1-2021-0015 January 29, 2021 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Revised Vendor Oversight Plan Summary - License Amendment Request to Implement a Digital Upgrade to the Core Protection Calculator (CPC) System and Control Element Assembly Calculator (CEAC) System Waterford Steam Electric Station, Unit 3 NRC Docket No. 50-382 Renewed Facility Operating License No. NPF-38

Reference:

Entergy Operations, Inc. letter to U.S. Nuclear Regulatory Commission (NRC),

"License Amendment Request to Implement a Digital Upgrade to the Core Protection Calculator (CPC) system and Control Element Assembly Calculator (CEAC) system," dated July 23, 2020, (ADAMS Accession No. ML20205L587)

In Reference 1, Entergy Operations, Inc. (Entergy) submitted, to the U.S. Nuclear Regulatory Commission (NRC), a proposed amendment to Appendix A, "Technical Specifications" (TS) of Renewed Facility Operating License No. NPF-38 for Waterford Steam Electric Station, Unit 3 (Waterford). The proposed change would revise the Waterford TS in order to implement a planned digital instrumentation and control (DI&C) modification at Waterford. The DI&C modification will replace the existing digital minicomputers of the Core Protection Calculator (CPC) system and Control Element Assembly Calculator (CEAC) system with the more reliable, digital system based on the Westinghouse Electric Company (Westinghouse) Common Qualified (Common Q) Platform.

As specified in NRC DI&C Interim Staff Guidance (ISG)-06, "Licensing Process," Revision 2, Section C.2.2.1, the referenced license amendment request (LAR) included a description of the Entergy Vendor Oversight Plan (VOP) for the CPC/CEAC replacement project. This was provided as Attachment 14, "CPC Replacement Project Vendor Oversight Plan (VOP)

Summary" (VOP Summary).

W3F1-2021-0015 Page 2 of 2 Subsequent to submittal of the referenced LAR, Entergy has revised the VOP, and has incorporated applicable changes into a revised VOP Summary. The Enclosure to this letter provides the revised VOP Summary. This document replaces the original VOP Summary (i.e., 4 of the referenced LAR) in its entirety. Changes to the original VOP Summary are identified with underlined text and revision bars in the right margin.

The No Significant Hazards Consideration determination provided in the Referenced LAR submittal is not altered by the information provided in this letter.

There are no new regulatory commitments included in this letter.

In accordance with 10 CFR 50.91(b)(1), "Notice for public comment; State consultation," a copy of this letter, without the proprietary attachments, is being provided to the designated State Official.

Should you have any questions or require additional information, please contact Paul Wood, Regulatory Assurance Manager, Waterford, at (504) 464-3786 or pwood1@entergy.com.

I declare under penalty of perjury, that the foregoing is true and correct. Executed on January 29, 2021.

Respectfully,

!"# %&'()* $

Ron Gaston RWG/jls

Enclosure:

CPC Replacement Project Vendor Oversight Plan (VOP) Summary, Revision 1 cc: NRC Region IV Regional Administrator NRC Senior Resident Inspector - Waterford Steam Electric Station, Unit 3 Louisiana Department of Environmental Quality NRC Project Manager Waterford Steam Electric Station, Unit 3

Enclosure W3F1-2021-0015 CPC Replacement Project Vendor Oversight Plan (VOP) Summary, Revision 1

W3F1-2021-00015 Enclosure Page 1 of 15 CPC Replacement Project Vendor Oversight Plan (VOP) Summary, Revision 1

1. Background DI&C-ISG-06 Section C.2.2 provides Licensee Prerequisites for use of the Alternate Review Process (ARP) (Reference 7). In Section C.2.2.1, DI&C-ISG-06 describes that to use the ARP, the license amendment request (LAR) should provide a description of the licensee's Vendor Oversight Plan (VOP). Section C.2.2.1 says that the LAR should include:

A description of the licensees Vendor Oversight Plan. The plan, when executed, can be used to ensure that the vendor: (1) executes the project consistent with the LAR, and (2) uses an adequate software QA program. The Vendor Oversight Plan, when executed, helps ensure that the vendor will meet both the process and the technical regulatory requirements. Vendor oversight is a series of licensee interactions with the vendor and progresses throughout the entire system development life cycle. The plan should address the intended interactions among the vendors design, test, verification and validation (V&V), and QA organizations.

The VOP is an important element of the ARP. Since the LAR approval is requested earlier in the project lifecycle than for the other DI&C-ISG-06 review processes (i.e. Tier 1, 2 or 3), the Staff needs to understand how the licensee intends to ensure that the vendor produces high quality software and system.

Entergy Operations, Inc. (Entergy) developed a VOP for the Waterford Steam Electric Station, Unit 3 (Waterford) Core Protection Calculator (CPC) System (CPCS) modification to ensure that Westinghouse executes the project consistent with:

Entergy procurement documents (Reference 1)

Westinghouse Software Program Manual (SPM) and Westinghouse platform-related documentation, which have been NRC-approved as described in LTR Section 6.1 (LAR Attachment 4)

Project description consistent with the LAR This revision to the VOP Summary summarizes the contents of Entergy document VOP-WF3-2019-00236, Core Protection Calculator System Vendor Oversight Plan, Revision 3, and replaces, in its entirety, the original VOP Summary which was submitted to the NRC as 4 to Entergy's July 23, 2020 LAR (ADAMS Accession No. ML20205L587). This document has been issued for use. The project team is currently conducting vendor oversight activities of Westinghouse. The following is the VOP Table of Contents.

W3F1-2021-00015 Enclosure Page 2 of 15 Waterford Core Protection Calculator System Replacement Project Vendor Oversight Plan Table of Contents Table of Contents

1. Project Scope and Description............... ............ .................... .................... ........ ............ ................... 5 Vendor Oversight Plan (VOP) Scope ................ ...... .......... .... ............................... ............................ 6

3. Abbreviations ........... ..................................................................................................................... 10

4. Reference .......................................................... .......................................................... ................. 12

5. Project Organization and Roles (Stakeholde ) ................ ...................... .. .. ..................................... 13

6. De\elopment and Assessment of Potential Project and Technical Risk Factors ......... ... ....... .......... .. 16

7. Determine Performance Measures and Acceptance Criteria .......... .... ...... ........ ..... ............... .. ... ....... 18 Critical Characteristics .......... .......... .... ...... ...... .... .......... ........ .......... ..... ... .. ..... ..... .... ...... ......... .......... .. 18 Ph sical Critical Characteristics ........................ .... .............. .. .................... ..................................... 18 Perfonnance Critical Characteristics ........................................ .................. .................... ................ 20 Em ironmental Critical Characteristics .......... .................... .................... .................... .................... . 2 1 cyber Critical Characteristics ... ..... ..... ..... ..... .......... ..... ..... .......... ..... ..... .......... ......... .......... .......... .. 22 Design A11ifacts .. ............ ...... .................... ........ .......... ..... ... .. .......... ..... ... .. .. ... ..... ........ ....... ............. ... 22 Progranunatic Elements .................................................................................. ................... ................ 24 Quality Assurance ....... ............ .................... .. ..... .............................. ........... ............. ...................... 25 Configuration Management. ............. .......... ... .... ............. ... ................................... ...... .......... ......... . 25 Software Verification and Validation (V& V) ....... ... ..... ... .. ....... ... ..... ..... ....... ... ....... ... ....... ... ....... .. .. 27 Sofu1Vare Safety ...... .......... ........ .......... ..... ..... .......... ..... ..... .......... ..... ..... .......... ......... ........... ......... .. 29 Secure De\ elopment Environment ........ ... ..... .......... ..... ..... .......... .... .... .. .. ... ..... .... .... ....... ..... ...... ... .. 29 Cyb er Security ............................................................................................................... ................ 30 Software Lifec.ycle Processes ............................. ..................... .................... ... ................................ 30 Hardware Requiren1ents .............. .................. .................... ............ ........ .... ...... ..... ......... ..... ....... .... . 31 Plant Specific. Action Items (PSAis)...... ... ..... .......... ..... ..... .......... .......... .......... ......... ........... ......... .. 32

8. Implement Appropriate Oversight Methods ........................ .................... .................... .................... 32

9. Perform Correcti e Actions ................................. .................. .................... .................... ................ 33

10. Docutnentation ........................................................................................ .................... .............. 34 Attachment 1 CPCS Replacement Project Organization Chart .............................................................. 35 Entergy CPCS Project Organization Chart ............ .................... .......... .. ...... .. .... ...... ..... ......... ..... ...... ...... 36 Westinghouse CPCS Project Organization Chart ... ..... ..... ..... ..... .......... ..... ..... .......... ..... ................... ...... . 37 Attachment 2 CPCS Replacement Project Division of Responsibility ..................................................... 38

W3F1-2021-00015 Enclosure Page 3 of 15

2. Vendor Oversight Plan (VOP) Scope This scope of the VOP is for the Westinghouse scope of the CPCS Replacement Project. The Westinghouse scope includes the hardware, software, design documentation, and licensing documentation. The VOP does not cover vendor oversight of the Architect Engineer (A/E) performing the modification process activities. The A/E does not provide any oversight of Westinghouse activities or digital products. The A/E does not perform the DI&C-ISG-06 (Reference 7) activities associated with the "vendor". For Waterford, the A/E is typically referred to as the Engineer of Choice (EOC) in the project documents. Waterford vendor oversight of the A/E is performed by Entergy engineering procedures and owners acceptance review separate from this VOP (Reference 19).

Stakeholders identified in VOP Section 5 will participate in vendor oversight activities to the extent that vendor activities can affect their needs. The level of vendor oversight follows a procedure-driven graded approach, based on project and technical risk factors, which are described in VOP Section 6. All levels of the graded approach will include specifically defined performance measures and acceptance criteria which are described in VOP Section 7. The performance measurements described in the VOP include critical characteristics, design artifacts, and programmatic elements. The various levels of graded oversight are described in VOP Section 8. The site Corrective Action Process (CAP) will be used to document and ensure resolution of issues/problems. This is described in VOP Section 9. Finally, oversight results will be documented as described in VOP Section 10.

Vendor oversight activities include:

Conducting audits Conducting Quality Surveillances of vendor activities under Waterford Quality Assurance (QA) program including activities for the CPCS Replacement Project Critical Procurement Plan (CPP). Note: QA surveillances are governed by existing Entergy procedures (Reference 4).

Providing input to and review/confirmation of specific vendor activities and related information items Reviewing vendor design artifacts (e.g., specifications, drawings, analyses)

Observing or witnessing specific vendor activities Participating directly in specific vendor activities Coordinating multi-disciplined interactions between various stakeholders Communicating status, schedule, and results of oversight activities through daily or weekly Waterford/Westinghouse Project Management team teleconferences, Waterford/Westinghouse Engineering team teleconferences, Waterford/Westinghouse Licensing team teleconferences Capturing issues in Waterford/Westinghouse corrective action programs Elevating emerging risks and issues (if necessary) to decision makers with higher authority Updating the VOP (if necessary) based on emerging results

W3F1-2021-00015 Enclosure Page 4 of 15 The VOP is an umbrella document covering the range of activities in which Entergy is engaged to perform effective vendor oversight.

The Quality Assurance Program Manual (QAPM) (Reference 30) provides a consolidated overview of the quality program controls which govern the operation and maintenance of Entergys quality related items and activities. The QAPM implements 10 CFR 50 Appendix B, and the QAPM is implemented through the use of approved procedures (e.g., policies, directives, procedures, instructions, or other documents) which provide written guidance for the control of quality related activities and provide for the development of documentation to provide objective evidence of compliance.

For the CPCS procurement process outlined in CPP-WF3-2019-002 (Reference 6), the main implementing procedures for the QAPM are as follows:

EN-MP-100, Critical Procurements (Reference 13),

EN-QV-108, QA Surveillance Process [QAPM C.2] (Reference 4),

EN-LI-102, Corrective Action Program [QAPM A.1, A.6, A.7, B.13, B.15] (Reference 21),

EN-DC-149, Acceptance of Vendor Documents [QAPM B14.a, b - Document Control]

(Reference 18) and EN-DC-115, Engineering Change Process [QAPM A.7, B.2, B.8, B.11, B.15] (Reference 19).

The VOP works in coordination with existing Entergy Quality Assurance processes and procedures. The coordination with existing QA processes, procedures and staff ensures that all vendor documents, software and equipment meet all quality and design requirements.

The remainder of this section details the references that were used to create the VOP and how the existing Entergy procedures ensure the VOP and QA processes are interrelated.

The following key documents provide input to vendor oversight activities:

Critical Procurement Plan (CPP) (Reference 6)

Procurement specification and other Westinghouse contract documentation, Project-specific specifications, NRC DI&C-ISG-06 Rev. 2 Licensing Process, WCAP-16096 Common Qualified Platform Software Program Manual (Reference 9),

EPRI Digital Engineering Guide (DEG) (Reference 3) and EPRI Handbook for Evaluating Critical Digital Equipment and Systems (Reference 8).

There are several Entergy procedures which are being utilized to conduct vendor oversight activities under the VOP. Those procedures are described below:

EN-MP-100 (Reference 13) provides guidance for the establishment of oversight activities to ensure critical materials and related services are planned and executed such that all applicable requirements are met. Monitoring, verification and acceptance phase activities are defined in the CPP during the Planning Phase. Verification can be either through the normal Receipt Inspection process or other activities outlined in the CPP. The CPP may require activities during manufacturing, testing, receipt inspection, pre-installation or post-installation testing.

W3F1-2021-00015 Enclosure Page 5 of 15 The CPP provides a summary of the requirements and necessary actions including on-site services (when required), to ensure that the Critical Procurement will meet Entergys expectations. The CPP provides details for the project scope, the focus areas or scope of the project design and implementation, and the project risks for the procurement process. The scope of supply in Contract 10575450-01 (Reference 1), and the scope details in SPEC 00005-W (Reference 5), provide details for the CPC modification and equipment.

The CPP credits the management of the procurement risks based on the Westinghouse software verification and validation process, factory acceptance testing, performance of site acceptance testing, and rigorous software testing. QA surveillances will be performed to ensure the approved Westinghouse processes were followed. Actions in the CPP are controlled and documented as Waterford work tracking items.

EN-DC-149 (Reference 18) provides guidance for the review and approval of Westinghouse documents and drawings. EN-DC-149 establishes the process to be used to control the receipt, distribution, review, and revision of technical vendor documents originating from outside Entergy. The overall process governing the preparation, revision, review, approval, acceptance and use of vendor produced calculations is addressed in EN-DC-126 (Reference 25). The overall Engineering Report process is addressed by EN-DC-147 (Reference 26). For such documents, the vendor acceptance should be documented as per the guidance in the above referenced procedures.

The technical review per EN-DC-149 will be performed to the level of detail described in Table 5.1 for Risk Ranked Review of Vendor Supplied Documents. The risk ranking is developed with the Pre-Job Brief in accordance with Sections 5.2 and 5.3 of EN-HU-104 (Reference 27). .6 of EN-HU-104 provides the methodology for determining the overall risk level of the activity.

EN-HU-104 (Reference 27) provides direction for the risk assessment of technical work, senior management notifications of results, pre-job briefs, independent third-party reviews (ITPR), and post-job briefs to capture lessons learned. The CPC Replacement project risk rank is 1 or high-high. This risk ranking requires a Challenge Board, which includes station and fleet personnel with expertise in the area. An Independent Third-Party Review by A/E, consultant, or Off-site Specialists (ITPR) is being performed since this project is risk rank 1. EN-OM-132 (Reference

28) is being used to perform a risk assessment.

EN-OM-132 provides a consistent method within Entergy to evaluate and manage risks and can be applied to a broad range of issues. This process describes the method to perform risk assessments and is designed to be used when prompted or required by specific processes, such as EN-HU-104.

EN-FAP-PM-004 (Reference 29) drives consistency and certainty in project delivery capabilities and outcomes through a process for project development, planning and execution. The Project Manager establishes and updates the risk assessment, which is the Quantitative Risk Assessment (QRA). This process provides a comprehensive framework for project development, planning, and execution.

EN-PM-100 (Reference 12) establishes requirements and guidance to ensure a standard and predictable approach to project management throughout the life cycle of the project. This procedure provides requirements and guidance for risk and issue identification and management. The Project Manager is responsible for ensuring all risks and issues are identified, evaluated and managed properly.

W3F1-2021-00015 Enclosure Page 6 of 15

3. Project Organization and Roles (Stakeholders)

The following stakeholder roles and responsibilities are described in the VOP.

Entergy Project Team Project Manager Assistant Project Manager Quality Assurance (QA) Representative Lead Responsible Engineer Digital or I&C Engineers Cyber Security Engineer System Engineer Lead Licensing Engineer Human Factors Engineer Maintenance Representative Operations Representative Simulator Representative Various Test Coordinator/Engineers Westinghouse Project Team Project Manager Quality Manager Design Engineers Cyber Security Engineer Simulator Project Representative Test Engineers and Software V&V Engineers CPCS Product Manager CPCS Technical Advisor CPCS Technical Lead CPCS Licensing lead

4. Development and Assessment of Potential Project and Technical Risk Factors EN-HU-104 (Reference 27) provides direction for the risk assessment of technical work, senior management notifications of results, pre-job briefs, independent third-party reviews (ITPR), and post-job briefs to capture lessons learned. Based on EN-HU-104, the CPC Replacement project risk rank is a 1 or high-high. An Independent Third-Party Review (ITPR) is being performed for critical documents.

All modes of plant operation were considered when assessing consequence risk factors.

The consequence risk factors assessment includes an evaluation of the following criteria:

Reactivity Management Reactor Scram or Lost/limited Generation Radiological release or exposure Potential for creating a serious personnel safety issue Operability issue affecting multiple trains of safety related system Regulatory non-compliance Unplanned Tech Spec entry into a shutdown LCO less than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Unplanned Safety System Actuation/Loss

W3F1-2021-00015 Enclosure Page 7 of 15 Regulatory open item created or not addressed Operator Workaround or challenge created or not addressed Unplanned Component Unavailability Tech Spec violation Reportable environmental consequence Repeat functional failure of Maintenance Rule systems, structures or components with potential to create new (a)(1) system Reactor coolant or steam generator chemistry transient outside of acceptable band As a result of the high-high risk ranking (EN-HU-104, Risk Rank 1), EPRI DEG Table 5-1 was considered to evaluate additional project and technical risk factors. The following project and technical risk factors were assessed in accordance with EPRI DEG (Reference 3), Table 5-1:

Schedule Technical Staff Conceptual Design Hazards Procurement Human Factors Engineering Data Communications Cyber Security Plant Integration Design Testing Configuration Management Training Per EPRI DEG Section 5.2.3, moderate risk factors indicate a need for supplemental oversight methods. Based on the risk categorization, vendor oversight activities have been prioritized.

5. Determine Performance Measures and Acceptance Criteria Performance measures and their acceptance criteria are included in the VOP. The scope of vendor oversight is expected to evolve during the project. Project-specific performance measures that warrant vendor oversight are updated as this list changes.

The performance measures are divided into three categories with acceptance criteria provided for each:

Critical Characteristics, Design Artifacts, and Programmatic Elements.

1. Critical Characteristics The Critical Characteristics are those important design, material, and performance characteristics of a system that, once verified, will provide reasonable assurance that the system will perform its intended critical functions. Note that the critical characteristics are drawn, in part, from the projects Critical Procurement Plan (Reference 6) and EPRI Topical Report 1011710 (Reference 8).

W3F1-2021-00015 Enclosure Page 8 of 15 The critical characteristics are divided into the following categories:

Physical, Performance, Environmental, and Cyber.

Design inputs and/or Critical Characteristics, Cyber Security (Reference 23), Software Quality Assurance (Reference 24) or other design requirements specific to the procurement of the CPCS are evaluated in the CPP. This includes critical characteristics to be verified during construction of the CPCS modification. Critical characteristics will be verified during factory testing and V&V activities, which will bound the design requirements.

Oversight of critical characteristics utilizes the following vendor oversight activities:

Conducting vendor audits and quality surveillances Reviewing Westinghouse design output documents Participating in Factory Acceptance Testing Conducting Site Acceptance Testing Observing or witnessing specific vendor activities Capturing issues in Waterford/Westinghouse corrective action programs

2. Design Artifacts The Design Artifacts are the set of design output documents described in the Westinghouse procurement documentation. These documents are generated in accordance with the Westinghouse SPM, which is NRC-approved. Examples of design artifacts include: System Requirements Specification (SyRS), Software Requirements Specification (SRS), Availability Analysis, Licensing Technical Report (LTR).

Waterford engineering procedures and processes provide the review framework for these design documents. Entergy procedure EN-DC-149, Acceptance of Vendor Documents, provides the process to be used to control the receipt, distribution, review, and revision of technical vendor documents. This process:

Ensures review by appropriate departments and disciplines, Ensures that affected documents, programs, and data bases are updated, Ensures that the vendor is in compliance with the design specification and purchase order, Ensures the document is consistent with plant licensing and design basis, and Ensures technical review is performed based on the risk ranking of the project documents.

W3F1-2021-00015 Enclosure Page 9 of 15 In addition, Waterford is utilizing the independent third-party review (ITPR) review process for critical design artifacts (e.g., SyRS, SRS, LTR, etc.). This independent review, by industry subject matter experts, allows:

Entergy to provide additional, independent oversight of the Westinghouse products Entergy to receive independent feedback on the quality of their vendor oversight of Westinghouse design artifacts Oversight of the design artifacts utilizes the following vendor oversight activities:

Conducting vendor audits Reviewing Westinghouse design output documents (e.g., specifications, drawings, analyses)

Providing input to and review/confirmation of specific vendor activities and related information items Coordinating multi-disciplined interactions between various stakeholders Capturing issues in Waterford/Westinghouse corrective action programs

3. Programmatic Elements The Programmatic Elements include the vendors programs and processes relevant to the project. The elements of the system lifecycle are described in the Westinghouse SPM (Reference 9). The SPM describes the requirements for the software design and development process including the software/hardware interface. The SPM also describes the requirements for the use of software in Common Q systems.

The following SPM plans are developed:

Software Safety Plan, which identifies the processes that, will reasonably assure that safety-critical software does not have hazards that could jeopardize the health and safety of the public.

Software Quality Assurance Plan (SQAP), which describes the process and practice of developing and using software. The SQAP addresses standards, conventions, reviews, exception reporting and other software quality issues.

Software Verification and Validation Plan (SVVP), which describes the method of assuring correctness of the software.

Software Configuration Management Plan (SCMP), which describes the method of maintaining the software in an identifiable state at all times.

Software Test Plan, which describes the method for testing software.

Some of these SPM plans will have project-specific instances (i.e., SVVP, SCMP, and Software Test Plan). These project-specific plans will be evaluated to ensure they are developed in accordance with the SPM.

W3F1-2021-00015 Enclosure Page 10 of 15 The SPM describes the software lifecycle phases as:

Concept Requirements Analysis Design Implementation or Coding Test Installation and Checkout Operation and Maintenance Retirement Reviews will be performed of verification and validation (V&V) for each applicable lifecycle phase for each plan through Test. The Installation and Checkout, Operations and Maintenance, and Retirement phases are Entergy responsibility and not included in scope of VOP. However, per SPM PSAI #4, Entergy will review the Westinghouse Technical Manual, provided in accordance with Reference 1, to verify it satisfies the requirements for the Software Operations Plan per the Common Q SPM.

Oversight of the programmatic elements utilizes the following vendor oversight activities:

Conducting vendor audits Reviewing Westinghouse design output documents Providing input to and review/confirmation of specific vendor activities and related information items Observing or witnessing specific vendor activities Participating directly in specific vendor activities Coordinating multi-disciplined interactions between various stakeholders Capturing issues in Waterford/Westinghouse corrective action programs The VOP provides acceptance criteria related to the following important system development topics. Example Acceptance criteria are provided in sub-bullets below:

Quality Assurance o Ensure that Westinghouse complies with the requirements of Appendix B to 10 CFR Part 50 and 10 CFR Part 21 to control the quality of safety-related materials, equipment, and services, o Ensure the Software Quality Assurance (SQA) program in accordance with the SPM is effective in controlling the software development process to assure quality, and meets the commitments described in the LAR for SQA.

Configuration Management o Ensure that the Westinghouse Configuration Management Release Reports identifies, names, and describes the documented physical and functional characteristics of the code, specifications, design, and data elements to be controlled for the project. Verify that Westinghouse follows the configuration management process in the NRC-approved Common Q SPM.

W3F1-2021-00015 Enclosure Page 11 of 15 Software Verification and Validation (V&V) o Verify that Westinghouse follows the V&V requirements in the NRC-approved Common Q SPM. The description of the software V&V processes will address the following:

V&V organization responsibilities, V&V processes, activities, and tasks, V&V reporting, V&V administrative controls for anomaly resolution and reporting, task iteration policy, and deviation policy, and V&V test documentation.

Software Safety o Verify that documentation exists to show that the safety analysis activities have been successfully accomplished for each life cycle activity group. In particular, the documentation will show that:

System safety requirements have been adequately addressed for each activity group, No new hazards have been introduced; that the software or logic requirements, design elements, and code elements that can affect safety have been identified, and All other software or logic requirements, design, and code elements will not adversely affect safety.

Secure Development Environment o Verify that the Westinghouse has a development environment that complies with the requirements the NRC-approved Common Q SPM, Section 12. SDE documentation exists for key attributes including:

Having a method for identifying the origin of critical components and ensuring that all critical asset components are compliant with the suppliers security requirements and free of counterfeits.

Cyber Security o Verify that all known cyber security vulnerabilities of the operating system, vendors software, firmware, or hardware is remediated or a description of why the vulnerability is not a concern for the system as installed is supplied.

Software Lifecycle Processes o Verify that Westinghouse plans and performs application software lifecycle activities in a traceable and orderly manner in accordance with the SPM. The VOP evaluates the following lifecycle areas:

Software Requirements - Ensure that project requirements are examined, understandable, and unambiguous. Reference is made to applicable drawings, specifications, codes, standards, regulations, procedures or instructions. Verify that security requirements are specified commensurate with the risk from unauthorized access or use. The requirements traceability shows where in the software or application logic design, the required action is being performed as well as providing traceability back to the system requirements that generated these software requirements.

W3F1-2021-00015 Enclosure Page 12 of 15 Software Design - Verify that the architecture is sufficiently detailed to allow for understanding the operation, flow of data, and the deterministic nature of the software or logic. Verify the technical adequacy of the design and ensure internal completeness, consistency, clarity, and correctness of the software design.

In addition, the software or logic design specification will be reviewed to determine that it is understandable and traceable to the software requirements. While the software design will consider the operating environment, measures to mitigate the consequences of problems will also be an integral part of the design.

Hardware Requirements o Verify the hardware is designed and manufactured to meet the physical and functional requirements described in the procurement specification, SyRS(s),

and design documents and drawings.

Plant Specific Action Items (PSAIs) o Ensure that PSAIs identified in the Topical Reports and further discussed in the Licensing Technical Report (LTR), are addressed as described in the LAR.

Entergy engineering procedures and processes provide the review framework for these design documents. Entergy procedure EN-DC-149, Acceptance of Vendor Documents, provides the process to be used to control the receipt, distribution, review, and revision of technical vendor documents (Reference 18). This process:

Ensures review by appropriate departments and disciplines Ensures that affected documents, programs, and data bases are updated Ensures that the vendor is in compliance with the design specification and purchase order Ensures the document is consistent with plant licensing and design basis Ensures technical review is performed based on the risk ranking of the project documents

6. Implement Appropriate Oversight Methods As discussed in Section 4 above, vendor oversight is based on risk factors. Therefore, the amount and specific focus of the oversight activities vary as the project evolves.

Oversight of Westinghouse occurs based on the various Risk Factors (VOP Section 5) and Performance Measures (VOP Section 6). Waterford may adjust the risk factors as the project progresses.

LOW RISK factors indicate continued use of routine oversight methods, such as:

Periodic Audits Periodic Surveillances Routine Design Reviews Routine Project Meetings

W3F1-2021-00015 Enclosure Page 13 of 15 MODERATE RISK factors indicate a need for supplemental oversight methods, such as:

Increased surveillance frequency Interim design reviews Challenge boards Increased frequency of project meetings HIGH RISK factors indicate a need for extraordinary oversight methods, such as:

Placement of oversight staff inside the vendors organization Management intervention Stop work order and implement recovery plan

7. Perform Corrective Actions Condition reports for entry into the corrective action program document vendor performance or quality that is in question. The following conditions, as a minimum, trigger a condition report:

Westinghouse noncompliance with the Westinghouses own quality program, software processes, or hardware processes Nuclear safety may be adversely impacted if the digital item is installed and operated Unit generation may be adversely impacted if the digital item is installed and operated Digital item quality simply cannot be assured Digital item quality cannot be assured without a significant project delay Digital item quality is not assured, and identical or similar digital items are already installed in the facility, in other applications, and are considered operable or available Westinghouse has been awarded other Entergy POs or contracts to deliver other digital items, and performance measures indicate that the quality of the other items may not be assured If the Waterford project team identifies performance issues, oversight would be enhanced to include:

Periodic meetings to discuss and resolve issues Additional technical reviews or surveillances Management Intervention Stop work and implement recovery plan

W3F1-2021-00015 Enclosure Page 14 of 15

8. Documentation Per the EPRI DEG, for high consequence and high technology configurability, vendor oversight must be documented. Through DI&C-ISG-06 and public interactions, the NRC has expressed an interest in vendor oversight. Documentation would help provide assurance to the NRC, during an inspection, that Waterford has been conducting oversight of Westinghouse through the system development lifecycle.

Vendor oversight can be documented through multiple methods:

Formal audit plans/reports Comments/feedback on design artifacts through the owner acceptance engineering process Teleconference notes Emails Written correspondence between Waterford and Westinghouse Note that documentation format may vary but the content will provide the vendor oversight level of detail and corrective actions (if any).

9. Attachments The VOP includes attachments for:

CPCS Replacement Project Division of Responsibility CPCS Replacement Project Organization Chart o Entergy CPCS Project Organization Chart o Westinghouse CPCS Project Organization Chart

10. References

1. Entergy procurement documents including Contract 10575450-01

2. American Society of Mechanical Engineers (ASME), NQA-1:2015, Quality Assurance Requirements for Nuclear Facility Applications

3. EPRI Technical Report 3002011816, Digital Engineering Guide (DEG)

4. EN-QV-108, QA Surveillance Process

5. SPEC-18-00005-W, Rev 0

6. CPCS Replacement Project Critical Procurement Project (CPP), CPP-WF3-2019-002 (WTWF3-2019-00236)

7. NRC DI&C-ISG-06, Licensing Process, Revision 2

8. EPRI Topical Report 1011710, Handbook for Evaluating Critical Digital Equipment and Systems

9. WCAP-16096, Westinghouse Software Program Manual (SPM) for Common Q' Systems

10. WCAP-16097, Westinghouse Common Qualified Platform Topical Report

11. CWTR3-19-21 R2, Attachment 1, Compliance Matrix

12. NMM procedure EN-PM-100, Conduct of Project Management

W3F1-2021-00015 Enclosure Page 15 of 15

13. NMM procedure EN-MP-100, Critical Procurements

14. IEEE Std. 1028, Standard for Software Requirements and Audits

15. IEEE Std. 344-1975, Seismic Qualification of Equipment for Nuclear Power Generating Stations

16. RG 1.152, Criteria for Use of Computers in Safety Systems of Nuclear Power Plants, Revision 3

17. CWTR3-19-23, Westinghouse Cyber Security Compliance Matrix

18. NMM procedure EN-DC-149, Acceptance of Vendor Documents

19. NMM procedure EN-DC-115, Engineering Change Process

20. NMM procedure EN-DC-163, Human Factors Evaluation

21. EN-LI-102, Corrective Action Program

22. EN-DC-117, Post Modification Testing and Special Instructions

23. EN-IT-103, Nuclear Cyber Security Program

24. EN-IT-104, Software Quality Assurance Program

25. EN-DC-126, Engineering Calculation Process

26. EN-DC-147, Engineering Reports

27. EN-HU-104, Technical Task Risk & Rigor

28. EN-OM-132, Nuclear Risk Management Process

29. EN-FAP-PM-004, Project Implementation - Segment 3 & 4

30. Entergy Quality Assurance Program Manual, Rev 39, Effective July 16, 2020