ML091050331

Supplemental Request for Additional Information for License Amendment Request for Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09, Supplement 15

ML091050331
Person / Time
Site:	Oconee
Issue date:	04/03/2009
From:	Baxter D Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML091050331 (46)

Text

Duke oDAVE BAXTER Vice President Energy@ Oconee Nuclear Station Duke Energy ON01 VP / 7800 Rochester Highway Seneca, SC 29672 864-873-4460 864-873-4208 fax dabaxter@dukeenergy.

com April 3, 2009 U. S. Nuclear Regulatory Commission Attention:

Document Control Desk Washington, D. C. 20555

Subject:

Duke Energy Carolinas, LLC Oconee Nuclear Station, Units 1, 2, and 3 Docket Numbers 50-269, 50-270, and 50-287 Supplemental Request for Additional Information for License Amendment Request for Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change (TSC) Number 2007-09, Supplement 15 On January 31, 2008, Duke Energy Carolinas, LLC (Duke) submitted a License Amendment Request (LAR) to address replacement of the existing Oconee Nuclear Station (ONS) analog based Reactor Protective System (RPS) and Engineered Safeguards Protective System (ESPS) with a digital computer based RPS/ESPS.

Duke responded to an August 20, 2008 NRC request for additional (RAI) information by letter dated September 30, 2008. NRC issued a supplemental RAI by letter dated March 9, 2009. Enclosure 1 contains Duke's responses to the supplemental RAI. Enclosure 2 contains AREVA NP documents associated with these responses.

Enclosure 2 also includes an updated ONS Unit 1 RPS/ESPS Requirements Traceability Matrix Report (RTMR)and the ONS Unit 1 RPS/ESPS Test Phase V&V Activity Summary Report. As agreed during a Duke/NRC Conference call on March 27, 2009, the Attachments to the RTMR are not included.Information contained in Enclosure 2 is classified by AREVA NP as proprietary.

The appropriate affidavits from AREVA NP are provided in Enclosure 3 in accordance with the provisions of 10 CFR 2.390. Enclosure 4 provides additional information that Duke agreed to provide during recent Duke/NRC teleconferences.

Enclosure 5 provides non proprietary Duke and AREVA NP documents.

If there are any questions regarding this submittal, please contact Boyd Shingleton at (864) 885-4716.Enclosure 2 to this letter contain proprietary information.

Withhold from public disclosure under 10 CFR 2.390.Upon removal of Enclosure 2, this letter is uncontrolled.

A www.duke-energy com U. S- Nuclear Regulatory Commission April 3, 2009 Page 2 I declare under penalty of perjury that the foregoing is true and correct. Executed on April 3, 2009.Sincerely, Dav Baxter, Vice President Oconee Nuclear Station

Enclosures:

1. Duke Response to Supplemental Request for Additional Information

2. AREVA NP Documents

-Proprietary

3. AREVA NP Affidavit 4. Additional Information

-5: AREVA NP and Duke Documents

-Non Proprietary Enclosure 2 to this letter contain proprietary information.

Withhold from public disclosure under 10 CFR 2.390.Upon removal of Enclosure 2, this letter is uncontrolled.

U. S. Nuclear Regulatory Commission April 3, 2009 Page 3 cc: Mr. J. F. Stang, Project Manager Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 0-14 H25 Washington, D. C. 20555 Mr. L. A. Reyes, Regional Administrator U. S. Nuclear Regulatory Commission

-Region II Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, Georgia 30303 Mr. G.. A. Hutto Senior Resident Inspector Oconee Nuclear Station S. E. Jenkins, Manager Infectious and Radioactive Waste Management Section 2600 Bull Street Columbia, SC 29201 Enclosure 2 to this letter contain proprietary information.

Withhold from public disclosure under 10 CFR 2.390.Upon removal of Enclosure 2, this letter is uncontrolled.

TSC 2007-09, Supplement 15 April 3, 2009 Page 1 Enclosure 1 Duke Response to Supplemental Request for Additional Information RAI-101: (Reference Open Item 1) The staff would like to reference the latest revision of position paper 51-9047317-009 "Conformance of the TELEPERM XS (TXS) Application Software with IEEE Std. 1012-1998 in the Safety Evaluation." Please submit this position paper onto the docket?Duke Response:

A copy of AREVA NP document 51-9047317-009, Position Paper Conformance of TELEPERM XS Application Software with IEEE Std 1012-1998, was reviewed by NRC during the audit at Oconee in May 2008. This document is historical in nature and represents an assessment made prior to the License Amendment Request submittal in January 2008. Information on AREVA NP Verification and Validation organizational responsibilities has been superseded by the information in LAR Supplement

4. The information on software integration testing has been superseded by the information in LAR Supplement 4 and the response to RAI 71. The information on software hazard analyses was superseded by the summary of the software safety analyses performed for the Oconee project and provided to NRC in LAR Supplement 11.A copy of AREVA NP document 51-9047317-009 is provided in Enclosure

2. This document is-considered proprietary information by AREVA NP and an affidavit for withholding is provided in Enclosure 3.RAI-1 02: The forthcoming SafetyEvaluation will be written with a scope to include Reactor Protection System/Engineered Safeguard Protection System (RPS/ESPS) digital upgrades for all three Oconee Units. The Software Verification and Validation (SVVP) (51-9010419-00) scope which currently only includes Oconee Unit 1 will need to either be expanded to cover one or both of the other units or statements will need to be written into the safety evaluation, such that the Unit 2 and 3 SWP's would have to be equivalent to the docketed reference as a condition for approval.

Please provide information stating what additional software planning documents if any will be submitted for Unit 2 and 3 to support completion of the Safety Evaluation.

Duke Response:

AREVA NP document 51-9079808-003, Oconee Nuclear Station Unit 3 RPS/ESFAS Controls Upgrade Software Verification and Validation Plan, describes the verification and validation program for Unit 3 of the Oconee RPS/ESPS project. The document is typical of the plan to be developed for Oconee Unit 2. The key differences between the Unit 1 and Unit 3 Software Verification and Validation Plans are: 0 Addition of the Concept Activities for Unit 3 to address the legacy issue for Unit 1, , Enhancements to the presentation of validation testing tasks based on lessons learned from Unit 1, and 0 Enhancements to reporting requirements based on lessons learned from Unit 1.It is also recognized that additional enhancements may be made based on any lessons learned from the Unit 3 verification and validation work; however, the Unit 2 Software Verification and TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 2 Validation Plan will conform to the same requirements as the Unit 3 Software Verification and Validation Plan.A copy of AREVA NP document 51-9079808-003 is provided in Enclosure

2. This document is considered proprietary information by AREVA NP and an affidavit for withholding is provided in Enclosure 3.RAI-1 03: Please provide documentation such as Test Summary Reports for tests that were performed to verify that error checking and fault tolerance features of the TXS system were satisfactorily implemented during the design process.Duke Response:

AREVA NP and Duke met with the NRC in Erlangen, Germany on December 8, 2008 regarding the qualification testing of the TELEPERM XS (TXS) Self-Monitoring Software.

The meeting was held to address the NRC's questions about generic TXS platform testing that addresses certain issues of concern (i.e., qualification testing of the TXS Self-Monitoring Software) since it is credited as a basis for modifying the Channel Functional Test requirements for the Oconee plant.AREVA NP made a presentation that described the following TXS features:* S elf-monitoring features implemented in the software-based modules, such as processing modules, communication modules and input/output modules,* Self-monitoring features in the cabinet monitoring unit, and* Features available for engineered self-monitoring.

The presentation also outlined the fail-safe behavior of TELEPERM XS systems based on the self-monitoring features.

Proprietary and non-proprietary versions of the presentation are included in Enclosure 2.and Enclosure 5 respectively.

AREVA NP noted that the TXS Self-Monitoring Software was qualified by the independent test institutes:

Institut fOr Sicherheitstechnologie (Institute for Safety Technology known as ISTec)and Technischer Oberwachungs-Verein Nord (German Technical Inspection Agency known as TUV Nord). The following test documents were discussed:

1. ISTec and TUV Nord Certificate No. TXS-SUE-0802-02 for the Digital Safety Instrumentation and Control System TELEPERM XS Software:

Self Test, Version 2.00, dated August 14, 2002 2. ISTec Test Report, Supplementary Technical Test Report on the Type Test of the Self Test for Computers of the Digital Safety I&C System TELEPERM XS, Version 2.00, August 2002 (translated from German)AREVA NP agreed to provide copies of these documents to the NRC. The ISTec Test Report is considered proprietary information by AREVA NP. A copy of this report is provided in Enclosure 2. A copy of the certificate, which is non-proprietary, is provided in Enclosure 5.An affidavit for withholding the proprietary document is provided in Enclosure

3.

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 3 RAI-1 04: During the Oconee Unit One RPS/ESPS Factory Acceptance Tests, test personnel were applying a plus/minus 0.3 % of full-scale tolerance to determine whether the subject test had passed. This tolerance was not prescribed in either the test procedure or the test specification as is stipulated by IEEE Std 829-1983 "IEEE Standard for Software Test Documentation" Section 4.2.7. Please provide documentation to support the use of these tolerances as acceptance criteria for the system test results. Also, please provide a description of any.changes made to the Test Specifications, or Test Procedures because of this issue.Duke Response:

The technical basis for using 0.3% of the full-scale tolerance is drawn from ISA-67.04, Setpoints for Nuclear Safety-Related Instrumentation, Approved September 1994 (endorsed by Regulatory Guide 1.105, Revision 3, December 1999), which states: Section 4.4.1, Square-root-sum-of-squares method (SRSS), states: It is acceptable to combine uncertainties that are random, normally distributed, and independent by the SRSS method. When two independent uncertainties, (+ a) and (+/- b), are combined by this method, the resulting uncertainty is (+ c), where c = (a 2 + b2)11 2 (see Note 1)The Oconee Factory Acceptance Test milliamp measurements were affected by the three independent uncertainties associated with the'SAA1 conditioning module, the S466 analog input module, and the TXS ERBUS output channel..

The uncertainties associatedwith these components and the resulting total uncertainty is shown in the table below.Table 1. The calculation result for 0.3% full-scale tolerance (from TXS technical documents)

TXS ERBUS output channel (0 -20 mA) 0.2%SAA1 conditioning module 0.12%S466 analog input module 0.2%

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 4 The above table associated with the milliamp measurements is provided in the pass/fail criteria section of the following procedures: " Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Small Break LOCA Factory Acceptance Test Procedure, Document No. 63-9014398" Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade One Pump Coast Down Factory Acceptance Test Procedure, Document No. 63-9014397

• Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Normal Startup and Shutdown Factory Acceptance Test Specification, Document No.62-908.1518 Similar table will be provided or referenced in the pass/fail criteria section of the following procedures:

• Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade RPS Factory Acceptance Test Functional Test Procedure, Document No. 63-9009706

• Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade GSM- Factory Acceptance Test Procedure, Document No. 63-9067378 Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Gateway to OAC Factory Acceptance Test Procedure, Document No. 63-9070638

• Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Startup/Shutdown Acceptance Test Procedure, Document No. 63-9018592

• Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade ESFAS Factory Acceptance Test Functional Test Procedure, Document No. 63-9013611 This will satisfy 4.2.7 of IEEE 829-1998 or 4.2.5 of IEEE 829-1983 "IEEE Standard for Software Test Documentation" (see Note 2).Note 1 There is a typo in this equation quoted in Section 4.4.1, ISA-67.04, Setpoints for Nuclear Safety-Related Instrumentation, Approved September 1994 (endorsed by Regulatory Guide 1.105, Revision 3, December 1999). This typo was corrected in this response.

This typo was also corrected in Section 4.5.1, ANSI/ISA-67.04.01-2006, Setpoints for Nuclear Safety-Related Instrumentation.

Note 2 There is no such section as 4.2.7 in 'the IEEE 829-1983.

However, there is Section 4.2.5 about the test pass/fail criteria.

Section 4.2.7 of IEEE 829-1998 should be also applied.and it is about the test pass/fail criteria.RAI- 05: During the Oconee Unit 1 RPS/ESPS Factory Acceptance Tests, a software tool was used to transfer test data into a spreadsheet for the purpose of.evaluating the acceptability of test TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 5 results. Please provide supporting documentation for this tool to demonstrate that the tool did not introduce errors into the Verification and Validation (V&V) test results evaluation process.(Reference Ol's 2008-6288, and 2008-6554).

Duke Response:

During Unit 1 Factory Acceptance Test (FAT), an Excel macro tool was used to compare and document the difference between the expected results and the FAT test results.Although, the documentation of the test evaluation results provide an inherent validation of the Excel macro tool, this tool was checked, verified, and validated manually.

The manual check, verification, and validation were conducted to ensure that the Excel macro tool would not introduce errors into the verification and validation test results evaluation process. However, steps of the manual check, verification, and validation of the Excel macro tool were not.documented formally.AREVA NP document 63-9067048-001, Oconee Nuclear Station, Unit 1, 2, and 3 RPS/ESFAS Controls Upgrade Factory Acceptance Test Validation Procedure, provides instructions for implementing the FAT Plan and to manage the performance of individual FAT Procedures.

It will be revised to provide direction and instruction to verify and validate the Excel macro tool before its use. The new controls will establish a formal verification and validation check for the tool to ensure that it does not introduce errors into the test results evaluation process.The following sections were added to the latest revision to the FAT Validation Procedure (AREVA NP document 63-9067048-002) issued on March 13, 2009: Test Results Evaluation An Excel macro may be used as an aide in the process of reviewing test results.This Excel macro shall be verified and validated daily both before and after use during Factory Acceptance Testing. The Excel macro will be validated by test personnel prior to testing activities by consecutive manual comparisons of test data. A sample test case evaluation is identified in Attachment

8. This case will be used to verify the Excel macro prior to use by the test personnel each day.Attachment 8 identifies the daily expected test results, the results data being evaluated, and the correct output of the Excel macro after execution.

The following steps summarize the installation and execution of the Excel macro: Installation The Addin can be installed by the following steps: " Retrieve FATcomparisonaddin.xla from this document's zip file in Documentum

• Extract xla file into folder location (some folders maybe hidden):, C:\Documents and Settings\(username)\Application Data\Microsoft\Addlns\

• In Excel Workbook goto Tools->Add-ins, place a check next to FAT comparisonaddin and Click OK.

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 6 Execution The daily test can be executed by the following steps:* Retrieve Expected_ResultsTest.xls'from this document's zip file in Documentum

• Extract xis file into folder location: 'C:\ExpectedResults\

• Retrieve ResultsTest.dat from this document's zip file in Documentum

• Extract dat file into folder location: C:\ExpectedResults\

Run the FATcomparison addin by clicking the starting cell in the* Expected_ResultsTest.xls to be analyzed.

The starting cell is the first cell that contains a step number. Press CTRL-SHIFT-C and the program will execute.Browse to and select the Results Test.dat and click OPEN. Two new sheets will be added one is all the DAT file data and the other is a copy of the Expected results sheet with the corresponding DAT file data inserted.

Any discrepancies

• should be bolded and highlighted in Yellow: This process will ensure that the tool is verified and validated

("calibrated")

before use and is re-verified and re-validated

("recalibrated")

again after its use. This will eliminate the possibility that the Excel macro tool may introduce errors into the verification and validation test results evaluation process.RAI-106: Section 3.1 of the Software Configuration Management Procedure (SCMP) provides a list of Configuration Items but does not provide definitions.

IEEE Std 828-1990 Section 2.3.1.1 requires that these definitions be recorded in the plan. Please provide the definitions for each of the Configuration Items listed in Table 2-1 in the SCMP.Duke Response:

AREVA NP revised Operating Instruction 01-1460 to add an appendix which includes a summary definition for each configuration item discussed in Table 3-1.A copy of Operating Instruction 01-1460-10, TELEPERM XS Software Configuration Management Plan, is provided in Enclosure

2. A copy of AREVA NP document 51-9019354-004, Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Software Configurations Items List, is provided in Enclosure

2. Both of these documents are considered proprietary information by AREVA NP and affidavits for withholding are provided in Enclosure

3.

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 7 RAI-107: IEEE Std 1042-1987 Section 3.2.2 states that if a specific software configuration management department or group is identified in the management section, the SCMP provides a specific description of the role this organization will play in the overall Software Configuration, Management (SCM) process.Though Areva has not specified a.SCM department or group, the SCM roles are assigned to individuals and groups via Table 2-1. This table does not provide descriptions of the roles that these individuals will play in the overall SCM process. To meet the intent of the standard, these descriptions should be included.

Please provide these role descriptions or justification for exception.

Duke Response:

AREVA NP revised Operating Instruction 01-1460 to expand the discussion of roles and responsibilities in Section 2.2.A copy of Operating Instruction 01-1460-10, TELEPERM XS Software Configuration Management Plan, is provided in Enclosure

2. This Operating Instruction is considered proprietary information by AREVA NP and an affidavit for withholding is provided in Enclosure 3.RAI-108: IEEE Std 1042-1987 Section 3.3.4 states, "At a minimum, when the product baseline is established and whenever it is subsequently changed due to the release of a new version of the.computer program, the configuration should be audited".

The AREVA Software Configuration Management Plan Section 3.2.4 only describes Annual performance of audits. Referenced 01 1457 also does not make mention of any requirement to perform an audit at baseline.

Please provide documentation that audits were conducted in accordance with IEEE 1042-1987.

Duke. Response: IEEE Std 828-1990, IEEE Standard for Software Configuration Management Plans, has the following requirement regarding configuration audits: 2.3.4 Configuration Audits and Reviews.Configuration audits determine to what extent the actual CI reflects the required physical and functional characteristics.

Configuration reviews are management tools for establishing a baseline.The Plan shall identify the configuration audits and reviews to be held for the project. At a minimum, a configuration audit shall be performed on a CI prior to its release.IEEE Std 1042-1987, IEEE Guide to Software Configuration Management, is a guideline document that provides useful information for the development of a software configuration management plan; however, as a guideline, it does not contain requirements.

In addition to the statements quoted in the RAI text, IEEE Std 1042-1987 has the following guidance in 3.3.4 Audits and Reviews.

TSC 2007-09, Supplement 15 Enclosure 1, April 3, 2009 Page 8 The theme of subsection 3.4 of the Plan involves the procedures used to verify that the software product (executable code) matches the configuration item descriptions in the specifications and documents, and that the package being reviewed is complete.Audits are one means by which an organization can ensure that the developers have done all their work in a way that will satisfy any external obligations.

Audits vary in formality and rigor, depending on the legal liability of external obligations.

They are a check on the completeness of a computer program product.Generally, there should be a physical configuration audit (PCA) and a functional configuration audit (FCA) of configuration items prior to the release of a product baseline or an updated version of a product baseline.The objectives of a PCA/FCA are for the developers to provide notice that contractual obligations are nearing completion, and to provide sufficient evidence for the clients or user organization to accept the product and initiate the transition into operational usage.NRC Regulatory Guide 1.169, Configuration Management Plans for Digital Computer Software Used in Safety Systems of Nuclear Power Plants, provides the following guidance regarding configuration audits: 1.4 Configuration Audit IEEE Std 610.12-1990 refers the definition of configuration audit to two other audits without specifying whether one or both definitions are meant. In the context of an audit for delivery of a product, a configuration audit includes, both a functional configuration audit and a physical configuration audit.The Duke vendor (AREVA NP) position is that physical and functional configuration audits be ,performed prior to the release of software products to the customer.

These audits would be required for each software release to the customer.AREVA NP Operating Instruction 01-1460-10, TELEPERM XS Software Configuration Management Plan, Section 3.4.2, is used to implement the Physical Configuration Audit'requirements in the following manner:* The Physical Configuration Audit shall compare the software loaded on the target hardware to the information contained in the Code Configuration Document, Software Library records, and the Configuration Items List.* The Physical Configuration Audit shall be performed after the software to be used during FAT is installed on the target hardware and before the start of FAT.* The Physical Configuration Audit shall be executed under the lead of an independent certified lead auditor and may consist of member of the Test group, IV&V group, and other QA personnel in accordance with applicable AREVA NP procedures.

Once the Audit is complete, FAT is allowed to begin.

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 9 AREVA NP Operating Instruction 01-1460-10, TELEPERM XS Software Configuration Management Plan, Section 3.4.3, is used to implement the Functional Configuration Audit requirements in the following manner:* The Functional Configuration Audit shall verify that that all requirements specified in the SRS have been met by the Software tested during FAT. The FAT Reports and supporting test data shall be audited to ensure the completeness and the accuracy of the FAT tests. This includes verifying that all areas of the FAT Plan, Specifications, and Procedures are addressed.

• The Functional Configuration Audit shall be performed after the completion of FAT and prior to the delivery of the software to the customer.* The Functional Configuration Audit shall be executed under the lead of an independent certified lead auditor and may consist of member of the Test group, IV&V group, and other QA personnel in accordance with applicable AREVA NP procedures.

• Once the Audit is complete, the software may be delivered to the customer.Similarly, Operating Instruction 01-1457-08, TELEPERM XS Software Quality Assurance Plan, Section 6.2.2, has the following requirements regarding the Physical Configuration Audit:* The Physical Audit is held prior to software release for testing and verifies internal consistency of the software and its documentation, and their readiness for release.* This Audit, along with the Functional Audit in Section 6.2.3, serves as a Configuration Audit per IEEE-828-1990." As part of the physical audit, current versions of all programs loaded on the hardware, and all design and testing tools shall be audited and compared against the version in the software library, and against the configuration status reports issued under the Software Configuration Management Plan." This Audit shall be accomplished by the QA organization in accordance with applicable AREVA NP procedures.

Operating Instruction 01-1457-08, TELEPERM XS Software Quality Assurance Plan, Section 6.2.3, has the following requirements regarding the Functional Configuration Audit:* The Functional Audit is held prior to software delivery to the customer to verify that all requirements specified in the SRS have been met.* The audit shall verify that acceptance test data is complete, accurate and addresses all areas specified in plans, specifications, and procedures.

• This Audit, along with the Physical Audit in Section 6.2.2, serves as a Configuration Audit per IEEE-828-1990.

This Audit shall be accomplished by the QA organization in accordance with applicable AREVA NP procedures.

AREVA NP conforms to the requirements of IEEE Std 828-1990 for Physical and Functional Audits, as endorsed by Regulatory Guide 1.169. AREVA NP also considered the guidance of IEEE Std 1042-1987 in the development of the TELEPERM XS Software Configuration Management Plan in developing the specific approach to performing.

the two audits.

TSC 2007-09,.

Supplement 15 Enclosure 1 April 3, 2009 Page 10 RAI-109: Please provide the information needed, to complete the evaluation of the new features and'functions in LAR against IEEE 603-1991 Clause. 4.ý It isunderstood that the design basis for the existing features has not changed (and therefore no evaluation against IEEE 603-1991 'Clause 4 is' required).

Please'identify where in the docketed information a statement is made to this affect.Duke Response: IEEE 603-1998 Clause 4. states that a specific basis shall be established for the design of each safety system of the nuclear power generating station. The design basis shall also be available as ýneeded to facilitate the determination of the adequacy of the safety system, including design changes. The design basis shall be consistent with the requirements of ANSI/ANS 51.1-1983 or ANSI/ANS 52.1-1983 and shall document the following items as a minimum: Clause 4 Item a) The design basis events applicable to each mode of operation of the generating station along with the initial conditions and allowable limits of plant conditions for each such event.Response to Clause 4 Item a)The design basis events applicable to each mode of operation for the Oconee RPS/ESPS are unchanged as a result of the Oconee RPS/ESPS digital upgrade.Section 3.2 of the RPS/ESPS LAR submitted on January 31,; 2008, outlines information concerning the design criteria and bases of the Oconee RPS/ESPS.

Additional redundancy is being added to the Reactor Coolant Pump Power Monitor (RCPPM)which will allow the UFSAR Chapter 15 safety analysis to credit the RCPPM redundancy for additional analysis margin. However, the revision of the Chapter 15 safety analysis will occuir separate, from the Oconee RPS/ESPS digital upgrade.Clause,4 Item b) The safety functions and corresponding protective actions of the execute features for each design basis event.Response to Clause 4 Item b)The safety functions and corresponding protective actions of the execute features for each design basis event for the Oconee RPS/ESPS are unchanged as a result of the Oconee RPS/ESPS digital upgrade. In the LAR submitted on January 31, 2008,Section 3.2 outlines information concerning the design criteria and bases of the Oconee RPS/ESPS.Clause 4 Item c) The -permissive conditions fo"r each operating bypass capability'that is to be provided.-

Response'to Clause 4 Item c)The operating bypass capability designed into the Oconee RPS/ESPS digital upgrade is captured in the design as the Shutdown Bypass function.

The Shutdown Bypass function design basis is the same as the Shutdown Bypass function on the analog RPS/ESPS.

The response to RAI-1 10 of this supplement has additional details of the operation of the Shutdown Bypass. Section 3.3.16.6 of the LAR submittal provides .

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 11 information aboutthe operation of the Shutdown Bypass. In addition, a Manual Bypass function is provided in the Oconee RPS/ESPS.

The operation of the Manual Bypass is explained in Section 3.3.16.7 of the LAR submittal.

Clause 4 Item d) The variables or combinations of.variables, or both, that are to be monitored to manually or automatically, or both, control each protective action; the analytical limit associated with each variable, the ranges (normal, abnormal, and accident conditions);

and the rates of change of these variables to be accommodated until proper completion of the protective action is ensured.Response to Clause 4 Item d)The safety variables or combinations of variables that are to be monitored have not been changed as a result of the Oconee RPS/ESPS digital upgrade. In addition, the analytical limit associated with each variable to be accommodated until proper completion of the protective action is ensured has not been changed for the Oconee RPS/ESPS digital upgrade. Thus, the information concerning safety variables and analytical limits for the existing analog RPS/ESPS have been maintained.

Section 3.2 of the January 31, 2008 LAR outlines information concerning the design criteria and bases of the Oconee RPS/ESPS.

Section 313.16 provides information concerning the sense and command functions of the Oconee RPS/ESPS.Clause 4 Item e) The protective actions identified in item b) that may be controlled by manual means initially or subsequently to initiation.

See IEEE Std 497-1981 [B10]. The proactive actions are as follows: 1) The points in time and the plant conditions during which manual control is allowed.2) The justification for permitting initiation or control subsequent to initiation solely by manual means....3) The range of environmental conditions imposed upon the operator during normal, abnormal, and accident conditions throughout which the manual operations shall be performed.

4) The variables in item d) that shall be displayed for the operator to use in taking manual action.Response to Clause 4 Item e)The safety functions and corresponding protective actions of the execute features for each design basis event for the Oconee RPS/ESPS are unchanged as a result of the Oconee RPS/ESPS digital upgrade. This includes the actions that need to be performed manually by operators.

Section 3.2 of the January 31, 2008 LAR outlines information concerning the design criteria and bases of the Oconee RPS/ESPS.

Section 3.3.16 provides information concerning the sense and command functions of the Oconee RPS/ESPS which covers the manual operation.

Since the Software Common Mode'Failure (SWCMF) has to be considered for RPS/ESPS, a manual override feature is included in the ESPS to allow operators.

to mitigate a spurious actuation of the ESPS. The use of the manual override feature is covered in Section 3.3.16 of the LAR submittal.

RAI-1 11 of this supplement provides additional details regarding the design and operation of the ESPS Emergency Override feature.

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 12 Clause 4 Item f) For those variables in item d) that have a spatial dependence (i.e., where the variable varies as a function of position in a particular region), the minimum number and locations of sensors required for protective purposes.Response to Clause 4 Item f)As noted in the response to item d), the safety variables or combinations of variables which are to be monitored have not been changed as a result of the Oconee RPS/ESPS digital upgrade. Thus, the information concerning the minimum number and locations of sensors required for protective purposes has not been impacted for the Oconee RPS/ESPS digital upgrade. Section 3.3.16 of the LAR provides information concerning the sense and command functions of the Oconee RPS/ESPS.

As was noted in the response to item a), additional redundancy is added to the RCPPM in order to allow for additional margin in the Chapter 15 safety analysis.

The minimum number of sensors and location of the sensors required for RPS/ESPS protective purposes were not changed as a result of this redundancy.

Clause 4 Item g) The range of transient and steady-state conditions of both motive and control power and the environment (e.g., voltage, frequency, radiation, temperature, humidity, pressure, vibration, and electromagnetic interference) during normal, abnormal, and accident conditions throughout which the safety system shall perform.Response to Clause 4 Item g)The range of transient and steady-state conditions during normal, abnormal, and accident conditions has not been changed as a result of the Oconee RPS/ESPS digital upgrade. Thus, the information concerning transient and steady-state conditions for the existing analog RPS/ESPS have been maintained.

Section 3.3.4 of the LAR outlines information concerning the environmental qualification of the Oconee RPS/ESPS.Section 3.3.5 of the LAR provides information about the range conditions that the Oconee RPS/ESPS shall be required to operate within. Section 3.3.18 provides information about the power system requirements associated with the Oconee RPS/ESPS digital upgrade.Clause 4 Item h) The conditions having the potential for functional degradation of safety system performance and for which provisions shall be incorporated to retain the capability for performing the safety functions (e.g., missiles, pipe breaks, fires, loss of ventilation, spurious operation of fire suppression systems, operator error, failure in non-safety-related systems).Response to Clause 4 Item h)The conditions having the potential for functional degradation of the safety system performance have not been changed as a result of the Oconee RPS/ESPS digital upgrade. Thus, the information concerning conditions having the potential for functional degradation of the safety system performance for the existing analog RPS/ESPS have been maintained.

Section 3.2 of the LAR outlines information concerning the design criteria and bases of the Oconee RPS/ESPS.Clause 4 Item i) The methods to be used to determine that the reliability of the safety system design is appropriate for each safety system design and any qualitative or quantitative reliability goals that may be imposed on the system design.

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 13 Response to Clause 4 Item i)The methods for determination of the reliability of the safety system design have not been revised by the Oconee RPS/ESPS digital upgrade project. The means of ensuring that the RPS/ESPS is a reliable system is based on the use of a 2 out of 4 system for the RPS design and 2 sets of a 2 out of 3 system for the ESPS design. For the ESPS design, a redundant set of 2 out of 3 system is provided to increase the reliability of the system and decrease the amount of unavailability of the ESPS. The decrease in unavailability is due to the fact that a channel of ESPS can be removed from service without entering a Technical Specification action statement.

Section 3.3.15 of the LAR provides additional information concerning the reliability analyses that were performed for the Oconee RPS/ESPS digital upgrade.Clause 4 Item j) The critical points in time or the plant conditions, after the onset of a design basis event, including:

1) The point in time or plant conditions for which the protective actions of the safety system shall be initiated.

2) The point in time or plant conditions that define the proper completion of the safety function.3) The point in time or the plant conditions that require automatic control of protective actions.4) The point in time or the plant conditions that allow returning a safety system to normal.Response to Clause 4 Item j)The critical points in time or plant conditions, after the onset of a design basis event, has not been revised by the Oconee RPS/ESPS digital upgrade project. Thus, the existing design basis is utilized for the Oconee RPS/ESPS digital upgrade project as outlined in the Oconee UFSAR. Section 3.2 of the LAR outlines information concerning the design ,.criteria and bases of the Oconee RPS/ESPS.

Section 3.3.16 provides information concerning the sense and command functions of the Oconee RPS/ESPS.Clause 4 Item k) The equipment protective provisions that prevent the safety systems from accomplishing their safety functions.

Response to Clause 4 Item k)The equipment protective provisions that prevent the safety systems from accomplishing their safety functions have been maintained the same as the existing analog RPS/ESPS.The current RPS/ESPS is design such that once the protective features are actuated they will continue until complete prior to being able to be manually reset. Section 3.3.2 of the LAR contains additional design information about the completion of protective actions.Clause 4 Item I) Any other special design basis that may be imposed on the system design (e.g., diversity, interlocks, regulatory agency criteria).

Response to Clause 4 Item]l)The only special design basis item that has been imposed on the Oconee RPS/ESPS digital upgrade concerns the installation of a Diverse HPI Actuation System and Diverse LPI Actuation System. Section 2.4.2 of the LAR outlines the design requirements of the Diverse HPI Actuation System and Diverse LPI Actuation System. The Defense in Depth and Diversity assessment credits a previously approved manual operator action to TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 14 trip the reactor. This is discussed in detail in Duke's response to RAI 3 submitted September 30, 2008 (Supplement 5).RAI-110: Please provide a description of how the RPS Shutdown bypass conforms to IEEE Std 603-1991 Clause 6.6 or IEEE Std 279, as appropriate.

It is understood that in some cases if the shutdown bypass switch is placed in the wrong position, then the reactor will trip. It is not clear that this will occur in all cases where such behavior is required to conform to IEEE Std 603-1991 Clause 6.6.Duke Response: IEEE 603-1998 Clause 6.6, which is the standard utilized in the design of Oconee RPS/ESPS digital upgrade, has the following requirement."Whenever the applicable permissive conditions are not met, a safety system shall automatically prevent the activation of an operating bypass or initiate the appropriate safety function(s).

If plant conditions change so that an activated operating bypass is no longer permissible, the safety system shall automatically accomplish one of the following actions: a) Remove the appropriate active operating bypass(es).

b) Restore plant conditions so that permissive conditions once again exist.c) Initiate the appropriate safety function(s)." The proposed digital RPS isdesigned to automatically initiate a channel trip.,if the shutdown (SD) bypass permissive conditions are no longer met. Since the digital RPS automatically initiates the appropriate safety function, the requirements of IEEE 603 Clause 6.6 are satisfied since the digital RPS automatically accomplishes one of the actions listed (a, b, or c). The digital RPS design is consistent with the existing RPS design, which is described in existing UFSAR Section 7.2.3.8 (see excerpt below).Administrative controls are used to activate/reset the SD bypass function in accordance with Technical Specification (TS) 3.3.1 (see excerpt from existing TS 3.3.1 Bases below)., Excerpt from Existing UFSAR Section 7.2.3.8 Bypassing Each protective channel is provided with two key-operated bypass switches, a channel bypass switch and a shutdown bypass switch.The channel bypass switch enables a protective channel to be bypassed without initiating a trip.Actuation of the switch initiates a visual alarm on the main console which remains in effect during any channel bypass. The key switch will be used to bypass one protective channel during on-line testing. Thus, during on-line testing, the system will operate in 2-out-of-3 coincidence.

The use of the channel bypass key switch is under administrative control.The shutdown bypass switch enables the power/imbalance/flow, power/RC pumps, low pressure, and pressure-temperature trips to be bypassed allowing control rod drive tests to be TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 15 performed after the reactor has been shut down and depressurized below the low reactor coolant pressure trip point. Before the bypass may be initiated, a high pressure trip bistable, which is incorporated in the shutdown bypass circuitry, must be manually reset. The setpoint of the high pressure bistable (associated with shutdown bypass) is set below the low' pressure trip point. If pressure is increased with the bypass initiated, the channel will trip when the high pressure bistable (associated with shutdown bypass) trips. The Use of the shutdown bypass key switch is under administrative control., Excerpt from Existing Technical Specification

3.3.1 Bases

During unit cooldown and heatup, it is desirable to leave the safety rods at least partially withdrawn to provide, shutdown capabilities in the event of unusual positive reactivity additions!(moderator dilution, etc.).However, the unit is also depressurized as coolant temperature is decreased.

If the sýfetyrods are withdrawn and coolant pressure is decreased, an RCS Low Pressure trip will occur at 1800 psig and the rods willfall into the core. To avoid this, the protective system allows the operator to bypass the low pressure trip and maintain shutdown capabilities.

During the cooldown and depressurization, the safety rods are inserted prior to the lowpressure

'trip of 1800 psig. The RCS pressure is decreased to less than 1720 psig, ,.then each RPS channel is'placed in shutdown bypass.In shutdown bypass, a normally closed contact opens when the operator closes the shutdown bypass key switch (status shall be indicated by a light). This action bypasses the RCS Low Pressure trip, Nuclear Overpower Flux/Flow Imbalance trip, Reactor Coolant Pump to Power trip, and the RCS Variable Low Pressure trip, and inserts a new RCS High Pressure, 1720 psig trip.The 'operator can now withdraw the safety rods for additional rapidly insertable negative reactivity.

The insertion of the new high pressure trip performs two functions.

First, with a trip setpoint of 1720 psig, the bistable prevents operation at normal system pressure, 2155 psig, with a portion of the RPS bypassed.

The second function is to ensure that the bypass is removed prior to normal operation.

When the RCS pressure is increased during a unit heatup, the safety rods are inserted prior to reaching 1720 psig. The shutdown bypass is removed,-which returns the RPS to normal, and system pressure is increased to greater than 1800 psig. The safety rods are then withdrawn and remain at the full out condition for the rest of the heatup.In addition to the Shutdown Bypass RCS High Pressure trip, the high flux trip setpoint is administratively reduced to < 5% RTP prior to placing the RPS in shutdown bypass. This provides a backup to the Shutdown Bypass RCS High Pressure trip and allows low power physics testing while preventing the generation of any significant amount of power.RAI-11 1: Please provide a description of how the "ESPS Emergency Override" (See LAR Enclosure 1 Section 2.3.5) functions complies with IEEE 603-1991.

Please pay particular attention to the documentation of the design basis for this override functionality.

What are the administrative controls that will be applied to the use of this feature.

TSC 2007-09, Supplement 15 Enclosure 1 April 3, 2009 Page 16 Duke Response: As stated in the RPS/ESPS LAR, the Oconee RPS/ESPS digital upgrade is designed in accordance with IEEE 603-1998 instead of IEEE-603-1991.

For the ESPS Emergency Override feature, compliance to IEEE 603-1998, Clause 6.2 is addressed in Section 3.3.16.2.2 of the January 31, 2008 RPS/ESPS LAR. The Emergency Override function is manually initiated as a means to mitigate the failure of a voter in the actuated state when all other mitigation interfaces are unresponsive.

Separate pushbuttons are provided for the Odd and the Even Voter circuits.The manual activation of the Emergency Override feature requires entry into Technical Specification 3.3.7 Condition A for an inoperable ESPS Actuation Output Logic. Use of the ESPS Emergency Override manual pushbutton will be governed by plant operating procedures similar to the ESPS Voter Manual Bypass keyswitches.

Additional information related to design requirements of the Emergency Override are provided in the response to RAI-1 09 of this LAR supplement and in Sections 2.3.5 and 3.3.16.2.2 of the RPS/ESPS LAR.

TSC 2007-09, Supplement 15 April 3, 2009 Page 1.Enclosure 3 AREVA NP Proprietary Affidavits AFFIDAVIT COMMONWEALTH OF VIRGINIA ss.CITY OF LYNCHBURG 1. My name is Mark J. Burzynski.

I am Manager, Product Licensing, for AREVA NP Inc. and as such I am authorized to execute this Affidavit.

2. I am familiar with the criteria applied by AREVA NP to determine whether certain AREVA NP information is proprietary.

I am familiar with the policies established by AREVA NP to ensure the proper application of these criteria.3. I am familiar with the AREVA NP information provided to the NRC in support of a Duke Power Company LLC License Amendment Request for Oconee Nuclear Station, Units 1, 2, and 3 (Docket Numbers 50-269, 50-270, and 50-287) entitled Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09. The following AREVA NP document is provided and referred to herein as the "Document."* AREVA NP document 51-9047317-009, Position Paper Conformance of TELEPERM XS Application Software with IEEE Std 1012-1998 Information contained in this Document has been classified by AREVA NP as proprietary in accordance with the policies established by AREVA NP for the control and protection of proprietary and confidential information.

4. This Document contains information of a proprietary and confidential nature and is of the type customarily held in confidence by AREVA NP and not made available to the public.Based on my experience, I am aware that other companies regard information of the kind contained in this Document as proprietary and confidential.

5. This Document has been made available to the U S. Nuclear Regulatory Commission in confidence with the request that the information contained in this Document be withheld from public disclosure.

The request for withholding of proprietary information is made in accordance with 10 CFR 2.390. The information for which withholding from disclosure is requested qualifies under 10 CFR 2.390(a)(4) "Trade secrets and commercial or financial information"..

6. The following criteria are customarily applied by AREVA NP to determine whether information should be classified as proprietary: (a) The information reveals details of AREVA NP's research and development plans and programs or their results.(b) Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.(c) The information includes test data or analytical techniques concerning a' process, methodology, or component, the application of which results in a competitive advantage for AREVA NP.(d) The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for AREVA NP in product optimization or marketability.(e) The information is vital to a competitive advantage held by AREVA NP, would be helpful to competitors to AREVA NP, and would likely cause substantial harm to the competitive position of AREVA NP.The information in this Document is considered proprietary for the reasons set forth in paragraphs 6(b), 6(d) and 6(e) above.

7. In accordance with AREVA NP's policies governing the protection and control of information, proprietary information contained in this Document has been made available, on a limited basis, to others outside AREVA NP only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8. AREVA NP policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.9. The foregoing statements are true and correct to the best of my knowledge, information, and belief.SUBSCRIBED before me on this______

day of M'tUA!-(1 2009.Sherry L. McFaden NOTARY PUBLIC, COMMONWEALTH OF VIRGINIA MY COMMISSION EXPIRES: 10/31/2010 Registration

1. 7079129 SHERRY L. MCFADEN Notary Public I Commonwealth of Virginla o 7079129 My Commission Expires Oct 31, 2010 AFFIDAVIT STATE OF GEORGIA) ss.COUNTY OF FULTON Mark J. Burzynski personally appeared before me and took an oath that the following is true and correct: 1. My name is Mark J. Burzynski.

I am Manager, Product Licensing, for AREVA NP Inc. and as such I am authorized to execute this Affidavit.

2. I am familiar with the criteria applied by AREVA NP to determine whether certain AREVA NP information is proprietary.

I am familiar with the policies established by AREVA NP to ensure the proper application of these criteria.3. I am familiar with the AREVA NP information provided to the NRC in support of a Duke Power Company LLC License Amendment Request for Oconee Nuclear Station, Units 1, 2, and 3 (Docket Numbers 50-269, 50-270, and 50-287) entitled Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09. The following AREVA NP document is provided and referred to herein as the "Document."* AREVA NP document 51-9079808-003, Oconee Nuclear Station Unit 3 RPS/ESFAS Controls Upgrade Software Verification and Validation Plan Information contained in this Document has been classified by AREVA NP as proprietary in accordance with the policies established by AREVA NP for the control and protection of proprietary and confidential information.

4. This Document contains information of a proprietary and confidential nature and is of the type customarily held in confidence by AREVA NP and not made available to the public.Based on my experience, I am aware that other companies regard information of the kind contained in this Document as proprietary and confidential.

5. This Document has been made available to the U S. Nuclear Regulatory Commission in confidence with the request that the information contained in this Document be withheld from public disclosure.

The request for withholding of proprietary information is made in accordance with 10 CFR 2.390. The information for which'withholding from disclosure is requested qualifies under 10 CFR 2.390(a)(4) "Trade secrets and commercial or financial information".

6. The following criteria are customarily applied by AREVA NP to determine whether information should be classified as proprietary: (a) The information reveals'details of AREVA NP's research and development plans and programs or their results.(b) Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.(c) The information includes test data or analytical techniques concerning a process, methodology, or component, the application of which results in a competitive advantage for AREVA NP.(d) The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for AREVA NP in product optimization or marketability.

(e) The information is vital to a competitive advantage held by AREVA NP, would be helpful to competitors to AREVA NP, and would likely cause substantial harm to the competitive position of AREVA NP.The information in this Document is considered proprietary for the reasons set forth in paragraphs 6(b), 6(c) and 6(d) above.7. In accordance with AREVA NP's policies governing the protection and control of information, proprietary information contained in this Document has been made available, on a limited basis, to others outside AREVA NP only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8. AREVA NP policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.9. The foregoing statements are true and correct to the best of my knowledge, information, and belief.(Sig ure of A ant)Sworn to (or affirmed) before me on this 196 day of ,2009.(Signature of Notary)KENDRICK SMART NOTARY PUBLIC, CHEROKEE COUNTY, GA MY COMMISSION EXPIRES DEC. 15, 2009 Notary Public, State of Georgia AFFIDAVIT STATE OF GEORGIA) ss.COUNTY OF FULTON Mark J. Burzynski personally appeared before me and took an oath that the following is true and correct: 1. My name is Mark J. Burzynski.

I am Manager, Product Licensing, for AREVA NP Inc. and as such I am authorized to execute this Affidavit.

2. I am familiar with the criteria applied by AREVA NP to determine whether certain AREVA NP information is proprietary.

I am familiar with the policies established by AREVA NP to ensure the proper application of these criteria.3., I am familiar with the AREVA NP information provided to the NRC in support of a Duke Power Company LLC License Amendment Request for Oconee Nuclear Station, Units 1, 2, and 3 (Docket Numbers 50-269, 50-270, and 50-287) entitled Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09. The following AREVA NP documents are provided and referred to herein as the "Documents."" AREVA NP Presentation entitled TELEPERM XS On-line Self-monitoring" ISTec Test Report, Supplementary Technical Test Report on the Type Test of the Self Test for Computers of the Digital Safety I&C System TELEPERM XS, Version 2.00, August 2002 (translated from German)Information contained in these Documents has been classified by AREVA NP as proprietary in accordance with the policies established by AREVA NP for the control and protection of proprietary and confidential information.

4. These Documents contain information of a proprietary and confidential nature and is of the type customarily held in confidence by AREVA NP and not made available to the public. Based on my experience, I am aware that other companies regard information of the kind contained in these Documents as proprietary and confidential.

5. These Documents have been made available to the U S. Nuclear Regulatory Commission in confidence with the request that the information contained in these Documents be withheld from public disclosure.

The request for withholding of proprietary information is made in accordance with 10 CFR 2.390. The information for which withholding from disclosure is requested qualifies under 10 CFR 2.390(a)(4) "Trade secrets and commercial or financial information".

6. The following criteria are customarily applied by AREVA NP to determine whether information should be classified as proprietary: (a) The information reveals details of AREVA NP's research and development plans and programs or their results.(b) Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.(c) The information includes test data or analytical techniques concerning a process, methodology, or component, the application of which results in a competitive advantage for AREVA NP.(d) The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for AREVA NP in product optimization or marketability.

(e) The information is vital to a competitive advantage held by AREVA NP, would be helpful to competitors to AREVA NP, and would likely cause substantial harm to the competitive position of AREVA NP.The information in these Documents is considered proprietary for the reasons set forth in paragraphs 6(b), 6(c) and 6(d) above.7. In accordance with AREVA NP's policies governing the protection and control of information, proprietary information contained in these Documents has been made available, on a limited basis, to others outside AREVA NP only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8. AREVA NP policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.9. The foregoing statements are true and correct to the best of my knowledge, information, and belief.Signature Affiant)~tA w Sworn to (or affirmed) before me on this day of 2009.(Signature of Notary)KENDRICK SMART NOTARY PUBUC, CHEROKEE COUNTY, GA MY COMMISSION EXPIRES DEC. 15, 2009 Notary Public, State of Georgia AFFI DAVIT COMMONWEALTH OF VIRGINIA) ss.CITY OF LYNCHBURG

)1. My name is Mark J. Burzynski.

I am Manager, Product Licensing, for AREVA NP Inc. and as such I am authorized to execute this Affidavit.

2. I am familiar with the criteria applied by AREVA NP to determine whether certain AREVA NP information is proprietary.

I am familiar with the policies established by AREVA NP to ensure the proper application of these criteria.3. I am familiar with the AREVA NP information provided to the NRC in support of a Duke Power Company LLC License Amendment Request for Oconee Nuclear Station, Units 1, 2, and 3 (Docket Numbers 50-269, 50-270, and 50-287) entitled Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09. The following AREVA NP document is provided and referred to herein as the "Document."* AREVA NP document 01-1460-101 TELEPERM XS Software Configuration Management Plan Information contained in this Document has been classified by AREVA NP as proprietary in accordance with the policies established by AREVA NP for the control and protection of proprietary and confidential information.

4. This Document contains information of a proprietary and confidential nature and is of the type customarily held in confidence by AREVA NP and not made available to the public.Based on my experience, I am aware that other companies regard information of the kind contained in this Document as proprietary and confidential.

5. This Document has been made available to the U S. Nuclear Regulatory Commission in confidence with the request that the information contained in this Document be withheld from public disclosure.

The request for withholding of proprietary information is made in accordance with 10 CFR 2.390. The information for which withholding from disclosure is requested qualifies under 10 CFR 2.390(a)(4) "Trade secrets and commercial or financial information".

6. The following criteria are customarily applied by AREVA NP to determine whether information should be classified as proprietary: (a) The information reveals details of AREVA NP's research and development plans and programs or their results.(b) Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.(c) The information includes test data or analytical techniques concerning a process, methodology, or component, the application of which results in a competitive advantage for AREVA NP.(d) The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for AREVA NP in product optimization or marketability.(e) The information is vital to a competitive advantage held by AREVA NP, would be helpful to competitors to AREVA NP, and would likely cause substantial harm to the competitive position of AREVA NP.The information in this Document is considered proprietary for the reasons set forth in paragraphs 6(b), 6(d) and 6(e) above.

7. In accordance with AREVA NP's policies governing the protection and control of information, proprietary information contained in this Document has been made available, on a limited basis, to others outside AREVA NP only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8. AREVA NP policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.9. The foregoing statements are true and correct to the best of my knowledge, information, and belief.SUBSCRIBED before me on this day of -,2009.Sherry L. McFaden NOTARY PUBLIC, COMMONWEALTH OF VIRGINIA MY COMMISSION EXPIRES: 10/31/2010 Registration

1. 7079129 SHERRY L. MCFADEN Notary Public 1 Commonwealth of Virginia 7079129 My Commission Expires Oct 31, 2010 AFFIDAVIT COMMONWEALTH OF VIRGINIA) ss.CITY OF LYNCHBURG 1. My name is Mark J. Burzynski.

I am Manager, Product Licensing, for AREVA NP Inc. and as such I am authorized to execute this Affidavit.

2. I am familiar with the criteria applied by AREVA NP to determine whether certain AREVA NP information is proprietary.

I am familiar with the policies established by AREVA NP to ensure the proper application of these criteria.3. I am familiar with the AREVA NP information provided to the NRC in support of a Duke Power Company LLC License Amendment Request for Oconee Nuclear Station, Units 1, 2, and 3 (Docket Numbers 50-269, 50-270, and 50-287) entitled Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09. The following AREVA NP documents are provided and referred to herein as the "Documents."* AREVA NP document 51-9062040-003, Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Requirements Traceability Matrix Report" AREVA NP document 51-9105739-000, Oconee Nuclear Station Unit 1 RPS/ESFAS Controls Upgrade Test Phase V&V Activity Summary Report Information contained in these Documents has been classified by AREVA NP as proprietary in accordance with the policies established by AREVA NP for the control and protection of proprietary and confidential information.

4. These Documents contains information of a proprietary and confidential nature and is of the type customarily held in confidence by AREVA NP and not made available to the public. Based on my experience, I am aware that other companies regard information of the kind contained in these Documents as proprietary and confidential.

5. These Documents have been made available to the U S. Nuclear Regulatory Commission in confidence with the request that the information contained in these Documents be withheld from public disclosure.

The request for withholding of proprietary information is made in accordance with 10 CFR 2.39.0. The information for which withholding from disclosure is requested qualifies under 10 CFR 2.390(a)(4) "Trade secrets and commercial or financial information".

6. The following criteria are customarily applied by AREVA NP to determine whether information should be classified as proprietary: (a) The information reveals details of AREVA NP's research and development plans and programs or their results.(b) Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.(c) The information includes test data or analytical techniques concerning a process, methodology, or component, the application of which results in a competitive advantage for AREVA NP.(d) The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for AREVA NP in product optimization or marketability.(e) The information is vital to a competitive advantage held by AREVA NP, would be helpful to competitors to AREVA NP, and would likely cause substantial harm to the competitive position of AREVA NP.The information in these Documents are considered proprietary for the reasons set forth in paragraphs 6(b), 6(c) and 6(d) above.

7. In accordance with AREVA NP's policies governing the protection and control of information, proprietary information contained in these Documents has been made available, on a limited basis, to others outside AREVA NP only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8. AREVA NP policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.9. The foregoing statements are true and correct to the best of my knowledge, information, and belief.SUBSCRIBED before me on this -day of ,2009.NOTARY PUBLIC, COMMONWEALTH OF VIRGINIA AFFIDAVIT COMMONWEALTH OF VIRGINIA ss.CITY OF LYNCHBURG 1. My name is Mark J. Burzynski.

I am Manager, Product Licensing, for AREVA NP Inc. and as such I am authorized to execute this Affidavit.

2. I am familiar with the criteria applied by AREVA NP to determine whether certain AREVA NP information is proprietary.

I am familiar with the policies established by AREVA NP to ensure the proper application of these criteria.3. I am familiar with the AREVA NP information provided to the NRC in support of a Duke Power Company LLC License Amendment Request for Oconee Nuclear Station, Units 1, 2, and 3 (Docket Numbers 50-269, 50-270, and 50-287) entitled Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09. The following AREVA NP document is provided and referred to herein as the "Document." AREVA NP document 32-9009296-005, Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Response Time Calculation Information contained in this Document has been classified by AREVA NP as proprietary in accordance with the policies established by AREVA NP for the control and protection of proprietary and confidential information.

4. This Document contains information of a proprietary and confidential nature and is of the type customarily held in confidence by AREVA NP and not made available to the public.Based on my experience, I am aware that other companies regard information of the kind contained in this Document as proprietary and confidential.

5. This Document has been made available to the U S. Nuclear Regulatory Commission in confidence with the request that the information contained in this Document be withheld from public disclosure.

The request for withholding of proprietary information is made in accordance with 10 CFR 2.390. The information for which withholding from disclosure is requested qualifies under 10 CFR 2.390(a)(4) "Trade secrets and commercial or financial information".

6. The following criteria are customarily applied by AREVA NP to determine whether information should be classified as proprietary: (a) The information reveals details of AREVA'NP's research and development plans and programs or their results.(b) Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.(c) The information includes test data or analytical techniques concerning a process, methodology, or component, the application of which results in a competitive advantage for AREVA NP.(d) The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for AREVA NP in product optimization or marketability.(e) The information is vital to a competitive advantage held by AREVA NP, would be helpful to competitors to AREVA NP, and would likely cause substantial harm to the competitive position of AREVA NP.The information in this Document is considered proprietary for the reasons set forth in paragraphs 6(b), 6(c) and 6(d) above.

7. In accordance with AREVA NP's policies governing the protection and control of information, proprietary information contained in this Document has been made available, on a limited basis, to others outside AREVA NP only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8. AREVA NP policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.9. The foregoing statements are true and correct to the best of my knowledge, information, and belief.SUBSCRIBED before me on this- 31 day of iiL-.,ruK, , 2009.NOTARY PUBLIC, COMMONWEALTH OF VIRGINIA AFFIDAVIT COMMONWEALTH OF VIRGINIA )) ss.CITY OF LYNCHBURG

)1. My name is Mark J. Burzynski.

I am Manager, Product Licensing, for AREVA NP Inc. and as such I am authorized to execute this Affidavit.

2. I am familiar with the criteria applied by AREVA NP. to determine whether certain AREVA NP information is proprietary.

I am familiar with the policies established by AREVA NP to ensure the proper application of these criteria.3. i am familiar with the AREVA NP information provided to the NRC in support of a Duke Power Company LLC License Amendment Request for Oconee Nuclear Station, Units 1, 2, and 3 (Docket Numbers 50-269, 50-270, and 50-287) entitled Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09. The following AREVA NP document is provided and referred to herein as the "Document."* AREVA NP document 51-9019354-004, Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Software Configuration Items List Information contained in this Document has been classified by AREVA NP as proprietary in accordance with the policies established by AREVA NP for the control and protection of proprietary and confidential information.

4. This Document contains information of a proprietary and confidential nature and is of the type customarily held in confidence by AREVA NP and not made available to the public.Based on my experience, I am aware that other companies regard information of the kind contained in this Document as proprietary and confidential.

5. This Document has been made available to the U S. Nuclear Regulatory Commission in confidence with the request that the information contained in this Document be withheld from public disclosure.

The request for withholding of proprietary information is made in accordance with 10 CFR 2.390. The information for which withholding from disclosure is requested qualifies under 10 CFR 2.390(a)(4) "Trade secrets and commercial or financial information".

6. The following criteria are customarily applied by AREVA NP to determine whether information should be classified as proprietary: (a) The information reveals details of AREVA NP's research and development plans and programs or their results.(b) Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.(c) The information includes test data or analytical techniques concerning a process, methodology, or component, the application of which results in a competitive advantage for AREVA NP.(d) The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for AREVA NP in product optimization or marketability.(e) The information is vital to a competitive advantage held by AREVA NP, would be helpful to competitors to AREVA NP, and would likely cause substantial harm to the competitive position of AREVA NP.The information in this Document is considered proprietary for the reasons set forth in paragraphs 6(b),.6(c) and 6(d) above.

7. In accordance with AREVA NP's policies governing the protection and control of information, proprietary information contained in this Document have been made available, on a limited basis, to others outside AREVA NP only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8. AREVA NP policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.9. The foregoing statements are true and correct to the best of my knowledge, information, and belief.SUBSCRIBED before me this _ _day of __________

___, 2009.Sherry L. McFaden NOTARY PUBLIC, COMMONWEALTH OF VIRGINIA MY COMMISSION EXPIRES: 10/31/10 Reg. # 7079129 SHERRV L. MCPADEN E Notary Pubtli Commonwealth of Virginia y Cm 7079129 O Imy comMi$1lon Explre$ Oct 31, 20101 AFFIDAVIT STATE OF GEORGIA) ss.COUNTY OF FULTON Mark J. Burzynski personally appeared before me and took an oath that the following is true and correct: 1. My name is Mark J. Burzynski.

I am Manager, Product Licensing, for AREVA NP Inc. and as such I am authorized to execute this Affidavit.

2. I am familiar with the criteria applied by AREVA NP to determine whether certain AREVA NP information is proprietary.

I am familiar with the policies established by AREVA NP to ensure the proper application of these criteria.3. I am familiar with the AREVA NP information provided to the NRC in support of a Duke Power Company LLC License Amendment Request for Oconee Nuclear Station, Units 1, 2, and 3 (Docket Numbers 50-269, 50-270, and 50-287) entitled Reactor Protective System/Engineered Safeguards Protective System Digital Upgrade, Technical Specification Change Number 2007-09. The following AREVA NP document is provided and referred to herein as the "Document." AREVA NP Operating Instruction 01-1639-00, Software Review and Audits Information contained in this Document has been classified by AREVA NP as proprietary in accordance with the policies established by AREVA NP for the control and protection of proprietary and confidential information.

4. This Document contains information of a proprietary and confidential nature and is of the type customarily held in confidence by AREVA NP and not made available to the public.Based on my experience, I am aware that other companies regard information of the kind contained in this Document as proprietary and confidential.

5. This Document has been made available to the U S. Nuclear Regulatory Commission in confidence with the request that the information contained in this Document be withheld from public disclosure.

The request for withholding of proprietary information is made in accordance with 10 CFR 2.390. The information for which withholding from disclosure is requested qualifies under 10 CFR 2.390(a)(4) "Trade secrets and commercial or financial information".

6. The following criteria are customarily applied by AREVA NP to determine whether information should be classified as proprietary: (a) The information reveals details of AREVA NP's research and development plans and programs or their results.(b) Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.(c) The information includes test data or analytical techniques concerning a process, methodology, or component, the application of which results in a competitive advantage for AREVA NP.(d) The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for AREVA NP in product optimization or marketability.

(e) The information is vital to a competitive advantage held by AREVA NP, would be helpful to competitors to AREVA NP, and would likely cause substantial harm to the competitive position of AREVA NP.The information in this Document is considered proprietary for the reasons set forth in paragraphs 6(b), 6(c) and 6(d) above.7. In accordance with AREVA NP's policie's governing the protection and control of information, proprietary information contained in this Document has been made available, on a limited basis, to others outside AREVA NP only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8. AREVA NP policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.9. The foregoing statements are true and correct to the best of my knowledge, information, and belief., ature of A rft)Swom to (or affirmed)

UBSCRIBED before me on this 1' day of '2009.(Signature of Notary)KENDRICK SMART NOTARY PUBLIC, CHEROKEE COUNTY, GA MY COMMISSION EXPIRES DEC. 15,2009 Notary Public, State of Georgia TSC 2007-09, Supplement 15 April 3, 2009 Page 1 Enclosure 4 Addtional Information Duke agreed to provide additional information associated with the NRC SER Open Item (01) List for the Oconee RPS/ESPS LAR during weekly conference calls with the NRC.The following provides that information.

01 20 -Duke clarified in the Cyber Security LAR response dated November 6, 2008, that RPS/ESPS Cabinets 17 and 18 are locked but do not alarm when cabinet doors are opened.Refer to Duke response to EICB-5. However, Section 3.4.5.3 of the RPS/ESPS LAR states:* Cabinet door monitoring

-during normal operations, cabinet doors are closed and locked; open cabinet doors are alarmed to allow monitoring by operations personnel This statement indicates that Cabinets 17 and 18 alarm when the cabinet doors are open. The doors on these two cabinets are locked but they do not alarm when opened. Cabinets 17 and 18 contain RPS and ESPS status panels. They do not contain safety processors nor is there any method to communicate with the safety processors from cabinets 17 or 18. This clarification is made to make the RPS/ESPS LAR consistent with the Cyber Security submittal.

01 21 -In the response to RAI 28 Duke stated that a channel would be placed in bypass before placing in parameter change enable. This statement was intended to address a concern NRC identified during the September 2008 AREVA Audit that software changes could be made without manual bypassing a channel. Duke agrees that the channel should be placed in bypass prior to making software change. However, to perform some testing the channel must be placed in parameter change enable without bypassing the channel. Therefore, Duke revises~the RAI 28 response to state that prior to making software changes, a channel will be manually bypassed.01 39 -In response to this 01, Duke agreed to docket AREVA NP Operating Instruction 01-1639, Software Reviews and Audits. This document, which is provided in Enclosure 2, is considered proprietary information by AREVA NP and an affidavit for withholding is provided in Enclosure 3.01 68 -An evaluation to demonstrate that plant parameters are maintained within acceptable limits established for each design basis event in the presence of a single common cause failure is provided in Section 3.2.3 of the RPS/ESPS LAR. Section 3.2.3 addresses IEEE 603-1998 Clause 5.16. As stated in Section 3.2.3, Oconee's evaluation follows the guidance of BTP HICB 19. This guidance is consistent with that provided in IEEE Std 7-4.3.2-1993 and IEEE Std 7-4.3.2-2003.

01 69 -IEEE 603-1998 Clause 6.7 reduces an IEEE 603-1991 Clause 6.7 requirement by using the word "should" in place of "shall." Duke didn't consider this change significant and intends to treat the should as a shall for our application.

Whenever a channel is placed in bypass it's inoperable since it can no longer perform its safety function.

Since the RPS has one more channel than what is required, one channel can be bypassed without affecting the minimum requirements for operability of the system. For ESPS, there are two sets of channels, so one or more channels in a set can be bypassed without affecting the minimum requirements for TSC 2007-09, Supplement 15 Enclosure 4 April 3, 2009 Page 2 operability of the system. If minimum requirements for operability cannot be met then a Technical Specification action statement must be entered to limit the time of inoperability.

This is addressed in more detail in Section 3.3.16.7 of the RPS/ESPS LAR.01 70 -In response to this open item, Duke agreed to docket the current response time analysis and functional requirements specification.

AREVA NP document 32-9009296-005, Oconee Nuclear Station, Unit 1 RPS/ESFAS Controls Upgrade Response Time Calculation, is provided in Enclosure

2. This document is considered proprietary information by AREVA NP and an affidavit for withholding is provided in Enclosure

3. Duke document OSC-8623, Revision 11, Oconee Nuclear Station Unit 1 RPS and ESFAS System Functional Description, is provided in Enclosure 5.