ML12170A866

6/13/2012 Summary of Meeting Via Teleconference with Pacific Gas and Electric Company to Discuss Digital Replacement of Process Protection System at Diablo Canyon Power Plant, Units 1 and 2 (TAC Nos. ME7522 and ME7523)

ML12170A866
Person / Time
Site:	Diablo Canyon
Issue date:	06/27/2012
From:	Joseph Sebrosky Plant Licensing Branch IV
To:	Pacific Gas & Electric Co
Sebrosky J M
References
TAC ME7522, TAC ME7523
Download: ML12170A866 (49)

Text

"I'll UNITED STATES vV'-.... 01'... NUCLEAR REGULATORY t:! WASHINGTON, D.C. 20555*0001 C') .t' ., t-' June 27, 2012 Pacific Gas and Electric Company Diablo Canyon Power Plant, Unit Nos. 1 and 2

SUMMARY

OF JUNE 13,2012, TELECONFERENCE MEETING WITH PACIFIC GAS AND ELECTRIC COMPANY ON DIGITAL REPLACEMENT OF THE PROCESS PROTECTION SYSTEM PORTION OF THE REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM AT DIABLO CANYON POWER PLANT (TAC NOS. ME7522 AND ME7523) On June 13, 2012, a Category 1 teleconference public meeting was held between the U.S. Nuclear Regulatory Commission (NRC) and representatives of Pacific Gas and Electric Company (PG&E, the licensee) at NRC Headquarters, One White Flint North, 11555 Rockville, Maryland. The purpose of the teleconference meeting was to discuss the license amendment request (LAR) submitted by PG&E on October 26, 2011, for the Digital Replacement of the Process Protection System (PPS) Portion of the Reactor Trip System and Engineered Safety Features Actuation System at Diablo Canyon Power Plant, Unit Nos. 1 and 2 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML 113070457).

A list of attendees is provided in Enclosure

1. The teleconference meeting is one in a series of publicly noticed teleconference meetings to be held periodically to discuss issues associated with the NRC staff's LAR review. Preliminary issues that the NRC staff identified during the initial review, and the licensee's responses to these preliminary issues, were discussed during the teleconference meeting. The list of preliminary issues is provided in Enclosure

2. Items 16, 17, and 22 in Enclosure 2 relate to questions associated with the PPS factory acceptance testing (FAT). Subsequent to the last public meeting on the subject, which occurred on May 16, 2011, the NRC staff provided a document with comments to the licensee for its consideration related to the FAT. The staff's comments are provided in Enclosure

3. The staff indicated that any questions related to the FAT would be formally sent to the licensee as requests for additional information (RAls). The NRC staff and licensee confirmed that the next meeting on this topic would be held on July 11,2012. There were several action items associated with the meeting. Specifically, the NRC took the following as action items: Schedule the next public meeting for July 11, 2012. Formally issue RAls associated with the Phase 1 documentation that the NRC staff has reviewed.

-Check the status for open item 20 in Enclosure 2 and update the status for items that have RAls that are issued or are in the process of being issued Check on open item 34 in Enclosure 2 because of similarity to open item 16 and 23 in Enclosure

2. If there are differences in the open items, provide more specifics.

If the items are the same, delete the duplicate entry. Arrange a phone call with Westinghouse to discuss the Advanced Logic Systems (ALS) schedule for issuing the topical report safety evaluation report (SER) that is referenced in the PG&E LAR. The purpose of the phone call is to determine the schedule for the completion of this review and identify what effect, if any, the ALS topic report SER schedule will have on the PG&E LAR review. PG&E took the following as action items: Provide a status of the phase 2 ALS documents. Provide a matrix for phase 2 documents similar to what was done for the phase 1 documents in accordance with Digital Instrumentation and Controls (DI&C)-ISG-06, "Task Working Group #6: Licensing Process, Interim Staff Guidance, Revision 1," dated January 19, 2011 (ADAMS Accession No. ML 110140103).

The phase 1 matrix is available as Enclosure 3 of a meeting summary dated February 29,2012 (ADAMS Accession No. ML 120590119) In response to open item 20, PG&E agreed to place additional documents on the Share Point site for the NRC staff to view in order to better understand the design. If the staff determines that the documents need to be placed on the docket, the documents will be requested through the RAI process. The documents requested included a functional block diagram of the input output devices for the PPS.

-Docket Nos. 50-275 and

1. List of attendees

2. Staff identified issues 3. Staff comments associated with PPS FAT cc w/encls: Distribution via Listserv LIST OF JUNE 13, 2012. TELECONFERENCE MEETING PACIFIC GAS AND ELECTRIC COMPANY DIABLO CANYON POWER PLANT DIGITAL DOCKET NOS. 50-273 AND NAME Ken Schrader Scott Patterson John Hefler J. Rengepis J. Basso W. Odess-Gillet Roman Shaffer Rich Stattel Bill Kemper Rossnyev Alvarado Joe Sebrosky Shiattin Makor Gordon Clefton ORGANIZATION Pacific Gas and Electric Pacific Gas and Electric Altran Altran Westinghouse Westinghouse I nvensyslT riconex U.S. Nuclear Regulatory Commission U. S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Commission Nuclear Energy Institute Enclosure 1

June 11,12 DCPP PPS Open Item Summary Table Page 1 of 40 r-No 001 SrcIRl AR (BD) Issue Description P&GE response:

[ISG-06 Enclosure B, Item 1.3] Deterministic Nature of Software:

The Diablo Canyon Specific Application should identify the board access sequence and provide corresponding analysis associated with digital response time performance.

This analysis should be of sufficient detail to enable the NRC staff to determine that the logic-cycle;

a. has been implemented in conformance with the ALS Topical Report design basis, b. is deterministic, and c. the response time is derived from plant safety analysis performance requirements and in full consideration of communication errors that have been observed during equipment qualification.

As stated in the LAR, information pertaining to response time performance will be submitted as a Phase 2 document.

Please ensure this matter is addressed accordingly.

P&GE response:

ALS Diablo Canyon PPS document 6116-00011, "ALS System Design Specification", Section 7.5, identifies the ALS board access sequence and provides an analysis associated with digital response time performance.

a. The Diablo Canyon PPS ALS system is configured in accordance with the qualification requirements of the ALS platform topical report, b. The analysis in Diablo Canyon PPS document 6116-00011, "ALS System Design Specification", Section 7, describes a logic cycle that is deterministic.

c. The requirements for the response time of the PPS processing instrumentation (from input conditioner to conditioned output signal) is specified as not to exceed 0.409 seconds in Section 3.2.1.10 of the "Diablo Canyon Power Plant Units 1 & 2 Process Protection System Replacement Functional Requirements Specification (FRS)", Revision 4 submitted as Attachment 7 of the LAR. In Section 1.5.8 of the "Diablo Canyon Power Plant Units 1 & 2 Process Protection System Replacement Interface Requirements Specification (IRS)", Revision 4, submitted as Attachment 8 of the LAR, the 0.409 seconds PPS processing instrumentation response time Status Closed RAI No. (Date Sent) RAII# 19 RAI Response (Due Date) Comments 4/18/2011

-Staff reviewed time response calc on share point and agrees that this is the correct information to support the SE. Requested that these cales be docketed.

Response received April 2, 29, 2012. Staff will review and discuss further if needed at subsequent telecom meeting. Response acceptable; waiting on PG&Eto provide the time response calculation for the V10 Tricon PPS Replacement architecture by April 16, 2012. Enclosure 2

June 11, 12 DCPP PPS Open Item Summary Table Page 2 of 40 No Src/RI Issue Description P&GE response:

Comments Status RAI No. RAI Response (Due Date) (Date Sent) is allocated between the ALS and Tricon as follows: ALS: 175 ms for RTD processing Tricon: 200 ms Response time calc Contingency:

34 ms received The 0.409 seconds PPS processing instrumentation value is the same as the Letter: value that is currently allocated to PPS processing instrumentation.

As as the 0.409 second PPS processing instrumentation value is not (ML 12131A513) the total response time values assumed in the plant safety analyses contained in FSAR Table 15.1-2 will not be exceeded; 7 seconds for Calc: Overtemperature AT RT and Overpower AT RT functions, 2 seconds for High (ML 12131A512 pressurizer pressure RT, Low pressurizer pressure RT, and Low Low SG water level RT functions, 1 second for Low reactor coolant flow RT function, 25 seconds for Low pressurizer pressure, High containment pressure, and Low steam line pressure Safety Injection initiation, 60 seconds for Low low SG water level auxiliary feedwater initiation, 18 seconds for High containment pressure, Low pressurizer pressure, and Low steam line pressure Phase A containment isolation, 48.5 seconds for High High containment pressure containment spray initiation, 7 seconds for High High containment pressure steam line isolation, 66 seconds for High High SG water level auxiliary feedwater isolation, and 8 seconds for Low steam line pressure steam line isolation.

The ALS response time will be verified as part of the FAT and the results will included in the FAT summary report to be submitted by Tricon Invensys provided detailed information on the deterministic operation of the V10 Tricon in Invensys Letter No. NRC V1 0-11-001, dated January 5, 2011. In support of the V10 Tricon safety evaluation, Invensys submitted document 9600164-731, Maximum Response Time Calculations, describing the worst-case response time for the V10 Tricon Qualification System. Included in document 9600164-731 are the standard equations for calculating worst-case response time of a given V10 Tricon configuration.

The time response calculation for the V1 0 Tricon PPS Replacement architecture was submitted on April 30, 2012. The System Response Time Confirmation Report, 993754-1-818, will be submitted to the staff as part of the ISG-06 Phase 2 submittals at the completion of factory acceptance testing of the V1 0 Tricon PPS Replacement.

_ .... __.__.... _ .... _ .... _ ....

June 11,12 DCPP PPS Open Item Summary Table Page 3 of 40 r o SrclRI Issue Description P&GE response:

Status RAI No. RAI Comments (Date Sent) Response (Due Date) -The T ricon response time will be verified as part of the FAT and the results will be included in the FAT summary report to be submitted by 12/31/12.

002 AR [ISG-06 Enclosure B, Item 1.4] (RA) Software Management Plan: Regulatory Guide (RG) 1.168, Revision 1, "Verification, Validation, Reviews and Audits for Digital Computer Software Used in Safety Systems of Nuclear Power Plants," dated February 2004 endorses IEEE (Institute of Electrical and Electronics Engineers) 1012-1998, "IEEE Standard for Software Verification and Validation," and IEEE 1997,"IEEE Standard for Software Reviews and Audits," with the exceptions stated in the Regulatory Position of RG 1.168. RG 1.168 describes a method acceptable to the NRC staff for complying with parts of the NRC's regulations for promoting high functional reliability and design quality in software used in safety systems. Standard Review Plan(SRP)

Table 7-1 and Appendix 7.1-A identify Regulatory Guide 1.168 as SRP acceptance criteria for reactor trip systems (RTS) and for engineered safety features Closed Licensee representatives stated that PG&E will provide the Tricon Time response calc's in a document submitted on the docket. 4/23/2011

-Staff has confirmed that the new version of the ALS SWP is available for review Response received April 2, 29, 2012. Staff will review and discuss further if needed at subsequent telecom meeting. (Kemper 4/12/12)Westinghouse/ALS 6116-00000 Diablo Canyon PPS Management Plan, Figure 2-2, shows the Verification and Validation (V&V) organization Response reporting to the Project Manager. This is inconsistent with the information acceptable; the described in the ALS Management Plan for the generic system platform, staff received the where the V&V organization is independent form the Project Manager. This June 11,12 DCPP PPS Open Item Summary Table Page 4 of 40 No Issue Description P&GE response:

SrclRI RAJ No. RAI Comments I (Date Sent) Status Response (Due Date) is also inconsistent with the criteria of RG 1.168 and will need to be revised W/ALS reconciled during the LAR and ALS L TR reviews. PPS MP on April 2, 2012 and will review for consistency with P&GE response:

RG 1.168. I ALS The PPS Replacement LAR referenced Westinghouse document 00000 Diablo Canyon PPS Management Plan, dated July 25, 2011, that was based on CSI document 6002-00003 ALS Verification and Validation Plan, Revision 4. CS Innovations subsequently submitted a revised V&V plan, "6002-00003 ALS Verification and Validation Plan", Revision 5, on 11,2011, that revised the required V&Vorganization structure such that management of the verification personnel is separate and independent of the management of the development personnel.

The Westinghouse 6116-00000 Diablo Canyon PPS Management Plan was revised to require a V&V organization structure in which the management of the verification personnel is separate and independent of the management of the development personnel.

PG&E submitted the revised Westinghouse 6116-00000 Diablo Canyon PPS Management Plan, Revision 1, document on April 2, 2012. AR N/A 3 [ISG-06 Enclosure B, Item 1.91 Closed Response Software V&V Plan: The ALS V&V plan states that Project Manager of the (RA) received April 2, supplier is responsible for providing directions during implementation of V&V 2012. Staff will activities.

Also, the organization chart in the Diablo Canyon PPS review and discuss Management Plan shows the IW manager reporting to the PM. further if needed at subsequent The ALS V&V plan described in ISG-6 matrix for the ALS platform and Diablo Canyon PPS Management Plan do not provide sufficient telecom meeting. about the activities to be performed during V&V. For example, the ALS V&V Plan states that for project specific systems, V&V activities are determined Status: Fig. 3 of the on a project by project basis and are described in the project Management PPS SWP (Pg.Plan, in this case, 6116-00000, "Diablo Canyon PPS Management Plan." 16/46) indicates However, the 6116-00000 Diablo Canyon PPS Management Plan states: sufficient"See the ALS V&V Plan for more information and the interface between the organizational IV&V team and the PPS Replacement project team."

i June 11, 12 DCPP PPS Open Item Summary Table Page 5 of 40 -No Issue Description P&GE response:

Comments SrclRI Status RAI No. RA/ (Date Sent) Response (Due Date) . independence The Triconex V&V plan states that the Engineering Project Plan defines the between the scope for V&V activities.

As mentioned before, the Triconex EPP is not listed Nuclear Delivery in the ISG-6 matrix. (Design) Organization and These items will need further clarification during the LAR review to the IV&V demonstrate compliance with Regulatory Guide (RG) 1.168, Revision "Verification, Validation, Reviews and Audits for Digital Computer Organization.

Used in Safety Systems of Nuclear Power Plants," Fig. 3 of the PPS P&GE response:

PMP ALS 905) (pg. 22/81)The Westinghouse 6116-00000 Diablo Canyon PPS Management Plan was also denotes the revised to include details on how the IV&V team has an independent DCPP PPS project organizational reporting structure from the design and implementation the Scottsdale Operations Director and the ALS Platform & Systems organization, and report to different Westinghouse Vice Presidents.

The IW Manager and provides sufficient Scottsdale Operations Director both report to the same Westinghouse Vice independence President, but via independent reporting structures.

between the ND and IV&V Description of 6116-00000 Diablo Canyon PPS Management Plan V&V was Organizations.

also revised to add information on the activities being performed for the V&V. Close the Invensys Management Plan that includes the above changes on April 2, 2012. PG&E submitted the revised Westinghouse 6116-00000 Diablo Canyon PPS part of the 01. Tricon W/ALS response The organizational structure of Invensys Operations Management comprises, acceptable; in part, Engineering and Nuclear Delivery.

Each of these organizations a specific role in the V10 Tricon application project life cycle. (Kemper 4/12/12) Engineering is responsible for designing and maintaining the V10 Tricon the staff received platform, and Nuclear Delivery is responsible for working with nuclear the revised W/ALS customers on safety-related V10 Tricon system integration projects.

PPS MP on April 2, Invensys Engineering department procedures require "Engineering Project 2012 and will Plans (EPP)," whereas Nuclear Delivery department procedures require review for "Project Plans." Invensys Engineering is not directly involved in system I June 11,12 DCPP PPS Open Item Summary Table Page 6 of 40 No SrclRI Issue Description P&GE response:

Status RAI No. RA/ Comments I (Date Sent) Response (Due Date) , integration, but Nuclear Delivery may consult with Engineering on technical consistency with issues related to the V10 Tricon platform.

RG 1.168. The NRC applied ISG-06 to the V10 Tricon safety evaluation.

Invensys submitted a number of documents pertaining to the design ofthe V10 Tricon I platform as well as process and procedure documents governing Invensys Engineering activities, including the EPP. In most cases, these platform-related documents are preceded with document number 9600164. The Status: Fig. 3 of the PPS SWP (Pg. platform-level documents reviewed by the staff during the V10 Tricon safety 16/46) indicates evaluation will not be resubmitted by Nuclear Delivery during application-sufficient specific system integration projects.

organizational independence In support of the PG&E LAR for the DCPP PPS Replacement, Invensys between the Nuclear Delivery is required to submit the application design documents as defined in ISG-06. These project documents are preceded by document number 993754. The Phase 1 submittal under Invensys Project letter \ 993754-026T, dated October 26,2011, contained, in part, the following:

Nuclear Delivery (Design) Organization and the IV&V PPS Replacement Project Management Plan (PMP), 993754-1-905. "Project Organization.

Management Plan" was used to more closely match BTP 7-14 with regard to "management plans"; and Fig. 3 ofthe PPS PPS Replacement Software Verification and Validation Plan (SWP), PMP 993754-1-802.

905) (pg. 22/81) also denotes the The PMP describes the PPS Replacement Project management activities DCPP PPS project within the Invensys scope of supply. The guidance documents BTP 7-14 and NUREG/CR-6101 were used as input during development of the PMP. organization, and provides sufficient With regard to compliance with RG 1.168, the PPS Replacement PMP and SWP both describe the organizational structure and interfaces of the PPS Replacement Project. The documents describe the Nuclear Delivery (NO) independence between the NO and IV&V design team structure and responsibilities, the Nuclear Independent Organizations.

Verification and Validation (IV&V) team structure and responsibilities, the interfaces between NO and Nuclear IV&V, lines of reporting, and degree of independence between NO and Nuclear IV&V. In addition, the PMP describes organizational boundaries between Invensys and the other Closethelnvensys part of the 01.

June 11, 12 DCPP PPS Open Item Summary Table Page 7 of 40 No Src/RI Issue Description P&GE response:

Status RAJ No. (Date Sent) RAI Response (Due Date) Comments external entities involved in the PPS Replacement project: PG&E, Altran, Westinghouse, and Invensys suppliers.

The combination of the PMP and SWP demonstrate compliance of the Invensys organization with RG 1.168. 4 AR (RA) [ISG-06 Enclosure B, Item 1.10] Software Configuration Management Plan: The LAR includes PG&E CF2.ID2, "Software Configuration Management for Plant Operations and Operations Support," in Attachment

12. However, the document provided in Attachment 12 only provides a guideline for preparing Software Configuration Management (SCM) and SOA plans. Though it is understood that the licensee will not perform development of software, PGE personnel will become responsible for maintaining configuration control over software upon delivery from the vendor. The staff requires the actual plan to be used by the licensee for maintaining configuration control over PPS software in order to evaluate against the acceptance criteria of the SRP. For example, the ALS Configuration Management (CM) Plan (6002-00002) describes initial design activities related to ALS generic boards. This plan does describe the configuration management activities to be used for the development and application of the ALS platform for the Diablo Canyon PPS System. The staff requires that configuration management for this design be described in the DCPP project specific plan. These items will need further clarification during the LAR review to demonstrate compliance with BTP-14. Open N/A (Kemper 4-12-12) Response received April 2, 2012. Staff will review the PG&E SyCMP procedure when it arrives on May 31,2012. P&GE response:

PG&E developed a SCMP procedure to address configuration control after shipment of equipment from the vendor and submitted the SCMP on June 6, 2012, in Attachment 4 to the Enclosure of PG&E Letter DCL-12-050.

June 11, 12 DCPP PPS Open Item Summary Table Page 8 of 40 No 5 SrclRI Issue Description P&GE response:

AR [ISG-06 Enclosure B, Item 1.111 (RA) Software Test Plan: The V10 platform documents identified in ISG6 matrix state that the interface between the NGIO (Next Generation Input Output) Core Software and 10-specific software will not be tested. It is not clear when and how this interface will be tested, and why this test is not part of the software unit testing and integration testing activities.

Further, the 993754-1-813 Diablo Canyon Triconex PPS Validation Test Plan states that the DCPP's TSAP will not be loaded on the system; instead Triconex will use another TSAP for the validation test. It is not clear why the DCPP's TSAP will not be used for the validation test or when the DCPP's TSAP will be loaded on the system and validated for the Diablo Canyon PPS System. These items will need further clarification during the LAR review to demonstrate compliance with BTP-14. P&GE response:

Tricon The next-generation input/output (110) modules qualified for the V10 Tricon are the 3721 N 4-20 mAo 32-point analog input (AI) module, and the 3625N 24 Vdc, 32-point digital output (DO) module. Technical data on these two modules was provided to the NRC in support of the V10 Tricon safety evaluation.

Configuration and functional testing is performed when the 1/0 modules (hardware and embedded core firmware) are manufactured.

From the factory the 110 modules are shipped to Invensys Nuclear Delivery for use in nuclear system integration projects, i.e., application specific configurations.

Because the module hardware and embedded core firmware are within the scope of the V10 Tricon safety evaluation, the verification and validation of the embedded core firmware will not be repeated as part of application-specific system integration projects.

There are certain design items that must be done with TriStation 1131 (TS1131), such as specifying which 110 module is installed in a particular

_ ... Status Closed RA/ No. (Date Sent) N/A RA/ Response (Due Date) Comments Response received April 2, 29,2012. Staffwill review and discuss further if needed at subsequent telecom meeting. Tricon Next Generation Input Output (NGIO) Core software is tested and qualified as a platform component.

As such, it does not need to be separately tested during the application development process. TSAP is a Test Specimen Application Program used for purposes of platform qualification.

June 11,12 DCPP PPS Open Item Summary Table Page 9 of 40 No SrclRI Issue Description P&GE response:

Status RA/ No. (Date Sent) RA/ Response (Due Date) Comments physical slot of the Tricon chassis, resulting in each module having a unique hardware address in the system. Also, TS1131 is used to specify which I nvensys stated application program parameters (i.e., program variable tagnames) are that assigned to a particular point on a given 110 module. The design items The Diablo Canyon configured in TS 1131 will be within the scope of validation activities Application will be conducted by Invensys Nuclear IV&V for application-specific system loaded onto plant integration projects.

The necessary collateral (system build documents, system hardware configuration tables, test procedures, test results, etc.) will be submitted to during FAT. the NRC to support the staff's technical review of the PPS Replacement LAR in accordance with ISG-06. The Phase 1 submittal under Invensys Project Letter 993754-026T, dated October 26,2011, contained, in part, the Validation Test Plan (VTP), Staff re-examined 1-813. This document describes the scope, approach, and resources of the Invensys doc. testing activities that are required for validation testing of the V1 0 Tricon "Validation Test portion of the PPS Replacement, including:

Plan (VTP), Preparing for and conducting system integration tests 993754-1-813," Defining technical inputs to validation planning Section 1.3.2 of the Defining the test tools and environment necessary for system validation VTP that describes testing the Hardware Scheduling (and resource loading of the schedule)

Validation Test Section 1.3.2 of the VTP describes the Hardware Validation Test activities and Section 1.3.3 of the VTP describes the V10 Tricon portion of the Factory Acceptance Test activities for the V10 Tricon portion of the PPS Replacement.

Details on the application program are proprietary and need activities and Section 1.3.3 of the VTP and determined that the application program to be provided to the staff separately.

TSAP will be used for the FAT (Section 5.1.5 FAT) Close this portion of the 01.

June 11, 12 DCPP PPS Open Item Summary Table Page 10 of 40 No SrclRI Issue Description P&GE response:

Status RAI No. (Date Sent) RA/ Response (Due Date) Comments 6 AR (SM) [ISG-06 Enclosure B, Item 1.14} Equipment Qualification Testing Plans -The LAR Sections 4.6,4.10.2.4 and 4.11.1.2 provide little information on the plant specific application environmental factors. The Tricon V10 Safety Evaluation, ML 11298A246, Section 6.2 lists 19 application specific actions Items (ASAl's) that the licensee should address for plant specific applications.

The licensee should address each of these for Tricon portion of the PPS replacement.

Similar information for the ALS portion of the PPS replacement will also be required.

Closed Develop a generic RAI to provide a response to ASAls for both platforms when the SERs are issued. Response received April 2, 29,2012. Staff will review and discuss further if needed at subsequent telecom meeting. Staff agreed that PG&E should submit a separate P&GE response:

ALS PG&E will respond to ALS ASAl's when they are available.

RA#01 submittal (LAR amendment) to Tricon address the ASAls for both platforms.

IN PROGRESS.

All of the Application Specific Action Items will be it is not necessary addressed by March 21,2012. to delineate exactly what will be done for each ASAI in this 01 matrix. 7 AR (BK) [JSG-06 Enclosure S, Item 1.16] Design Analysis Reports: The LAR does not appear to comply with the SRP (ISG-04) regarding the connectivity of the Maintenance Work Station to the PPS. The TriStation V10 platform relies on software to effect the disconnection of the TriStation's capability to modify the safety system software.

Based on the information provided in the L TR, the NRC staff determined that the Tricon V10 platform does not comply with the NRC Closed Drafted RAJ # 17 &18 to obtain an answer I report to address (Kemper 4-12-12) Response received April 2, 29, 2012. Staff reviewed this item and still need additional guidance provided in ISG-04, Highly Integrated Control Rooms-Communications Issues, (ADAMS Accession No. ML083310185), Staff Position 1, Point 10, hence the DCPP PPS configuration does not fully comply with this guidance.

In order for the NRC staff to accept this keyswitch function as an acceptable this topiC. information to close this item. The staff will need to review this item further during an NRC June 11, 12 DCPP PPS Open Item Summary Table Page 11 of 40 7\Jo SrclRI Issue Description P&GE response:

Status RAI No. (Date Sent) RA/ Response (Due Date) Comments deviation to this staff position, the staff will have to evaluate the OCPP PPS specific system communications control configuration--including the operation of the keyswitch, the software affected by the keyswitch, and any testing performed on failures of the hardware and software associated with the keyswitch.

The status of the AlS platform on this matter is unclear at this time and will be resolved as the AlS l TR review is completed.

Moreover, the Tricon V10 system Operational Mode Change (OMC) keyswitch does change operational modes of the 3008N MPs and enables the TriStation 1131 PC to change parameters, software algorithms, etc, related to the application program of the safety channel without the channel or division being in bypass or in trip. As stated in Section 3.1.3.2 of the Tricon V10 SER, the TriStation 1131 PC should not normally be connected while the Tricon V10 is operational and performing safety critical functions.

However, it is physically possible for the TriStation PC to be connected at all times, and this should be strictly controlled via administrative controls (e.g., place the respective channel out of service while changing the software, parameters, etc). The LAR does not mention any administrative controls such as this to control the operation of the OMC (operational mode change) keyswitch.

Furthermore, in order to leave the non-safety TriStation 1131 PC attached to the SR Tricon V10 system while the key switch is in the RUN position, a detailed FMEA of the TriStation 1131 PC system will be required to ascertain the potential effects this non-safety PC may have on the execution of the safety application program/operability of the channel or division.

These issues must be addressed in order for the NRC staff to determine that the OCPP PPS complies with the NRC Staff Guidance provided in Staff Position 1, Point 11. The status of the AlS platform on this point is unclear at this time. --_.__ .... ....

_-_ .... _ ........ _.... _ audit at the Invensys facility.

All the items noted below will be the scope of the audit. 3/21/12 update: it was agreed that PG&Ellnvensys and PG&ElWestinghou se/CSI would provide a report (LAR supplement) to explain how these two issues will be resolved and submit to NRC-Date to be provided TBO. Waiting for the V10 Tricon portion of the PPS Replacement Failure Modes and Effects Analysis, an ISG-06 Phase 2 document to be submitted to NRC in May 2012. P&GE response:

Tricon The OMC keyswitch controls only the mode of the V10 Tricon 3008N MPs. In RUN position the 3008N MPs ignore* all commands from external devices, whether WRITE commands from external operator interfaces or program-related commands from TS1131. .... -.... ....--... ...... ........ ...._

June 11, 12 DCPP PPS Open Item Summary Table Page 12 of 40 No '----SrclRI Issue Description P&GE response:

The keyswitch is a four-position, three-ganged switch so that the three Main Processor (MP) modules can monitor the position of the switch independently.

The Operating System Executive (ETSX) executing on the MP application processor monitors the position of the keyswitch.

The three MPs vote the position of the keyswitch.

The voted position of the keyswitch is available as a read-only system variable that can be monitored by the TSAP. This allows alarming the keyswitch position when it is taken out of the RUN position.

TS1131 messages to and from the Tricon (i.e., ETSX executing on the MPs) are of a defined format. TS1131 messages for control program (i.e., TSAP) changes -whether download of new control programs or modification of the executing control program -are uniquely identifiable.

Such messages are received by ETSX and appropriate response provided depending upon, among other things, the position of the keyswitch.

When a request from TS1131 is received by ETSX to download a new control program or modify the executing control program, ETSX accepts or rejects the request based on the voted keyswitch position.

If the keyswitch is in RUN, all such messages are rejected.

If the keyswitch is in PROGRAM, the Tricon is considered out of service and ETSX runs through the sequence of steps to download the new or modified control program, as appropriate.

Multiple hardware and software failures would have to occur on the V1 0 Tricon (in combination with human-performance errors in the control room and at the computer with TS 1131 installed) in order for the application program to be inadvertently reprogrammed.

Therefore, there is no credible single failure on the V10 Tricon that would allow the safety-related application program to be inadvertently programmed, e.g., as a result of unexpected operation of the connected computer with TS 1131 installed on it. The above conclusion will be confirmed (for the V10 Tricon portion of the PPS Replacement) in the Failure Modes and Effects Analysis, an ISG-06 Phase 2 document planned for submittal to NRC in May 2012. Additionally, Invensys Operations Management will support the staff's review of the hardware and software associated with the OMC keyswitch by making all of the technical data available for audit. Status RAI No. (Date Sent) RAI Response (Due Date) Comments 3/21/12 Update: PG&E/lnvensys needs to provide a technical explanation of how the MP3008N processor actually ignores all commands when in RUN-address the items in the 01. 4/4/12 Update: Need to explain how this message format works to reject messages from the Tristation when in RUN?? Graphs and visual presentation of these concepts would be helpful. This issue will also have to be addressed for the ALS platform.

PG&Ellnvensys needs to provide a June 11,12 DCPP PPS Open Item Summary Table Page 13 of 40 'ivo SrclRI Issue Description P&GE response:

Status RAJ No. (Date Sent) RA/ Response (Due Date) Comments *TS1131 contains function blocks that allow WRITE-access to a limited set of parameters programmed into the application software, but only for a limited duration after which the capability is disabled until WRITE-access is re-enabled. However, without these function blocks programmed into the application program neither the application program nor application program parameters can be modified with the OMC keyswitch in the RUN position.

technical explanation of how the MP300BN processor actually ignores all commands when in PG&E Administrative controls on use of keyswitch will be provided with commitment to include in procedures in response.

Note, TS1131 is not used to change setpoints and protection set is inoperable when keyswitch is not in RUN position.

RUN-address the items in the 01. B AR (RS) [ISG-06 Enclosure B, Item 1.21] Setpoint Methodology:

The NRC staff understands that a summary of SP (setpoint)

Calculations will be provided in Phase 2, however, section 4.10.3.B of the LAR also states that PGE plans to submit a separate LAR to adopt TSTF 493. The NRC cannot accept this dependency on an unapproved future licensing action. The staff therefore expects the licensee to submit a summary of setpoint calculations which includes a discussion of the methods used for determining as-found and as-left tolerances.

This submittal should satisfy all of the informational requirements set forth in ISG6 section D.9.4.3.B without a condition of TSTF 493 LAR approval Closed NIA Discussed at 4/1B/2011 CC. Requested that PGE add to the response a statement that the setpoint changes associated with this modification will be submitted for evaluation independently with no reliance on TSTF 439 licensing action. (Kemper 4-12-12) Response received April 2, P&GE response:

The evaluation of the setpoints for the PPS replacement will need to be performed by Westinghouse in two phases in order to provide sufficient documentation to support 95/95 setpoint values for the setpoints.

This is because the NRC staff has been requesting additional information and additional data and analysis to demonstrate that the uncertainties used in the June 11,12 DCPP PPS Open Item Summary Table Page 14 of40 No SrclRl Issue Description P&GE response:

setpoint calculation have been based on a statistically sufficient quantity of sample data to bound the assumed values (to justify the confidence level of the calculation is appropriate) during recent Westinghouse projects involving setpoints.

Significant information is required from the transmitter and RTD vendors, that has never been obtained before, to support development of calculations that can support 95/95 setpoint values. The first phase of the evaluation of the setpoints will include evaluation of the PPS replacement setpoints for the Tricon and ALS architecture using expected bounding uncertainty values. A setpoint summary evaluation which includes a discussion of the methods used for determining the as-found and as-left tolerances will be submitted by May 31,2012. This is a change to the commitment 31 in Attachment 1 to the Enclosure to the PPS Replacement LAR. The setpoint information associated with the PPS replacement is being submitted independently of the LAR for TSTF-493 and does not rely on a TSTF-493 licensing action. Status RAI No. (Date Sent) RAI Response (Due Date) *Comments 29, 2012. PG&E's commitment to provide summary calc's by May 31, 2012 and not revise these setpoints via a TSTF-439 LAR addresses this 01. Close this 01. 3/7/12 update: PG&E stated that all setpoints determinations will be addressed as The second phase of the evaluation of the setpoints will include development of Westinghouse calculations of the PPS replacement setpoints for the Tricon and ALS architecture using sufficient information from vendors to substantiate that the setpoints are 95/95 values. The Westinghouse calculations will be completed by December 31,2012 and will be available for inspection by NRC staff in Washington DC with support provided by Westinghouse setpoint group personnel.

The NRC staff inspection of Westinghouse calculations in Washington DC has been performed for another recent utility project involving setpoints.

part of this LAR, and NOT submitted as a TSTF-493 licensing action. 3/21/12 update: The staff may chose to review the Westinghouse calculations at the Westinghouse office in Washington DC. However, if the safety finding is dependent on these calculations, _.... _.... _....-'-----_.. -.... _ ..

June 11,12 DCPP PPS Open Item Summary Table No SrclRI Issue Description P&GE response:

Status 9 AR L TR Safety Conclusion Scope and Applicability

-Many important sections of Closed (BK) the DCPP PPS LAR refer the reader to the ALS licensing topical report (L TR) to demonstrate compliance of the system with various Clauses of IEEE 1991, IEEE 7-4.3.2-203, and ISG-04. However, many important sections of the ALS LTR state that compliance with various Clauses of these IEEE Stds and ISG-04 are application specific and refer the reader to an application specific license amendment submittal (Le., the DCPP PPS LAR in this case). The staff has not yet had time to evaluate all the LAR information in detail and compare this information with that provided in the ALS L TR to ensure there is no missing information.

However, PG&E and its contractors are encouraged to review these two licensing submittals promptly to verify that compliance with these IEEE Stds and ISG-04 are adequately addressed within both licenSing documents.

P&GE response:

PG&E and Westinghouse have reviewed the LAR 11-07 and the ALS topical report to verify information is provided to justify compliance with IEEE 603-1991, IEEE 7-4.3.2-2003, and ISG-04 in either the LAR or the ALS topical report. As a result of the review, it was identified that neither the LAR nor the ALS topical report contain a matrix that documents compliance with ISG-04 Table 5-4 for the DCPP ALS platform.

PG&E will submit a matrix that documents compliance with ISG-04 Table 5-4 for the DCPP ALS platform by May 31, 2012. Page 15 of 40 RA/ No. RA/ Comments (Date Sent) Response (Due Date) then the setpoint calculations will be required to be submitted on the docket per NRC licensing I procedures I No (Kemper 4-12-12) specific Response RAI received April 2, needed 29,2012. The for this PG&E response to 01. RAI this item address #4 the 01. Close this addresse 01. s this item as noted below in 0115. complian ce matrix for the ALS platform.

10 RS Plant Variable PPS Scope -In the Description section of the LAR, section Closed 4.1.3, nine plant variables are defined as being required for RTS and section 4.1.4 lists seven plant variables that are required for the ESFAS. Three RAI02 June 11.12 DCPP PPS Open Item Summary Table Page 16 of 40 No Comments SrclRI Issue Description P&GE response:

Status RAI No. RAI (Date Sent) Response (Due Date) additional plant variables were also listed in section 4.10.3.4.

Some variables are not listed in section 4.10.3.4 as being PPS monitored plant parameters.

It is therefore assumed that these parameters are provided as direct inputs to the SSPS and that the PPS is not relied upon for the completion of required reactor trip or safety functions associated with them. Please confirm that these plant parameters and associated safety functions will continue to operate independently from the PPS and that the replacement PPS will not adversely impact the system's ability to reliably perform these functions.

P&GE response:

The PPS Replacement LAR Sections 4.1.3 and 4.1.4 describe the plant variables from which RTS and ESFAS protective functions are generated.

The initiation signal outputs to the SSPS coincidence logic are generated in Neutron Flux is an the PPS or other, independent systems, or in some cases, by discrete input to Tricon but it devices. Section 4.1.3 items 6 (RCP bus UF, UV, and breaker position, 8 is not listed in (Main Turbine trip fluid pressure and stop valve position) and 9 (seismic Table 4-2 "Process acceleration) are generated by discrete devices outside the PPS and provide Variable inputs to direct contact inputs to the SSPS. Section 1.4 items 6 (Containment Exhaust Tricon" Radiation) and 7 (RT breaker position Permissive P-4) are also outside the PPS and are direct contact inputs to the SSPS. The Signals not signals associated with these plant parameters operate independently from associated with the PPS. The replacement PPS will not adversely affect the reliable PPS functions will performance of the safety functions associated with these plant parameters.

be designated as such in the SE and The three signals (Wide Range RCS Temperature and Pressure and Turbine they will not be Impulse Chamber Pressure) not listed in Sections 4.1.3 and 4.1.4 are described since monitored by the PPS per Section 4.10.3.4.

The Wide Range RCS Pressure they are not in and Temperature signals are used to generate the L TOP function described

-

June 11,12 DCPP PPS Open Item Summary Table Page 17 of 40 No SrC/RI Issue Description P&GE response:

in DCPP FSAR Section 5. The PPS uses Turbine Impulse Chamber Pressure to generate an initiation signal that is used by the SSPS coincidence logic to develop Permissive P-13 as discussed in RAI 3, below. Status RAI No. (Date Sent) RA/ Response (Due Date) Comments scope. Neutron Flux should be added to Section 4.2 Table 4-2 as follows: Neutron Flux (Power Range, Upper & Lower) -Input to Overtemperature t::. Temperature (OTDT) RT I Input to Overpower t::. . 'Iemperature (OPDT) RT 11 RS Power Range NIS Function -Section 4.1.7 describes the Existing Power Closed* N/A Range NIS Protection Functions and it states that the Power Range nuclear OnlyPPS instrumentation provides input to the OTDT, and OPDT protection channels.

Functions will be It is not entirely clear whether any of the described NIS protection functions described in the will be performed by the PPS system. Please clarify exactly what the role of SE.. the PPS system is for these NIS Protection functions.

5/30/12 P&GE response:

Determined that no Power range analog inputs are provided by the NIS to each PPS Protection RAI is needed for Set for use in the calculation of the Overtemperature Delta-T and Overpower this item. Delta-T Setpoint in the Delta-TlTavg channels.

No other NIS signals interface with the PPS. The NIS Protection functions (RT and power range permissives) are generated independently by Nuclear Instrumentation bistable comparators.

The NIS bistable outputs are sent directly to the SSPS and have no physical interface with the PPS. RS Permissive Functions

-Several Permissive functions are described within the LAR. It is not clear to the staff whether any of these functions are to performed by the PPS or if the PPS will only be providing input to systems that in turn perform the permissive logic described in the Closed Section 4.1.9 states that "Settings of the bistable comparators used develop the permissives are not affected by the PPS Replacement

---June DCPP PPS Open Item Summary Table Page 18 of 40 , No SrC/RI Issue Description P&GE response:

Status RAI No. RAI Comments (Date Sent) which implies that all of these permissive functions are performed by systems other than the PPS. However, it is still unclear if this statement applies to all permissive functions described throughout the LAR or if it applies only to those permissives relating to Pressurizer Pressure.

It is also possible that the permissive functions are being performed by the existing PPS and will continue to be performed by the replacement system and therefore remain "not affected" by the PPS replacement project. Please provide additional information for the following permissive functions to clearly define what the role of the PPS system will be for each. P-4 Reactor P-6 Intermediate Range P-7 Low Power Permissive (Bypasses low P pzr reactor trip) P-8 Loss of Flow P-9 Power P-10 Power Range Power Low P-11 Low Pressurizer Pressure SI Operational P-12 No-Load Low-Low Tave Temperature P-13 Turbine Low Power Permissive P-14 Hi-Hi Steam Generator

• The LAR states that "These signals are generated in the PPS" P&GE response:

Permissive function initiation signals generated within the existing PPS will continue to be performed by the replacement PPS and therefore remain "not affected" by the PPS replacement project. Permissive function initiation signals that are generated independently of the existing PPS will continue to be generated independently. Permissive P6, P-8, P-9, and P-10 initiation signals are bistable comparator outputs from the independent NIS to the SSPS. There is no interface with the PPS. Permissive P-4 initiation signals are direct contact inputs to the SSPS The NRC understands that all permissives are developed within Response (Due Date)

June 11, 12 DCPP PPS Open Item Summary Table Page 19 of 40 No SrclRI Issue Description P&GE response:

Status RA/ No. (Date Sent) RA/ Response (Due Date) Comments coincidence logic generated from contacts in the Reactor Trip Breakers (RTB). There is no interface with the PPS.

• Permissive P-11, P-12, P-13, and P-14 initiation signals are generated by bistable comparator outputs generated in the PPS and sent to the SSPS.

• Permissive P-7 is generated in the SSPS from 3 out of 4 power range NI channels (from NIS -P-10) below setpoint and 2/2 turbine impulse chamber pressure channels below setpoint (From PPS -P13). The bistable initiation signals described above are monitored by the SSPS. The SSPS generates the Permissive when appropriate coincidence of initiation signals is detected.

No SSPS permissive or safety function coincidence logic is changed by the PPS replacement project. Permissives P-6, P-7, P-8, P-9, P-10, and P-13 are functionally described in FSAR Table 7.2-2. Permissives P-4, P-11, P-12, and P-14 are functionally described in FSAR Table 7.3-3. The bistable comparator setpoints for the above-listed permissives are not expected to change at this time. the SSPS system. Permissives P11 -P14 use inputs provided by PPS system. All other permissives use inputs generated by external systems that are independent of the PPS. See 13 below. 13 RS '--_.. P12 Permissive Contradiction

-The second paragraph of section 4.1.20 describes the P-12 interlock and states that "These signals are developed in the PPS". This statement is then contradicted in the third paragraph by the following statement; "These valves are not safety-related, but are interlocked with the P-12 signal from the SSPS." In conjunction with the response to RA13, please provide a resolution for this contradiction in section 4.1.20 of the LAR. .... _.... __-... __._.. _.... _ .... __......... Closed --_.... _ .. N/A The NRC understands that June 11, 12 DCPP PPS Open Item Summary Table Page 20 of 40 No SrclRI Issue Description P&GE response:

Status RAI No. (Date Sent) RA/ Response (Due Date) Comments the P12 signal is generated by the SSPS using signals developed in the PPS. 5/30/2012 Determined that no RAJ will be needed for this item. P&GE response:

The word "signals" in the referenced Section 4.1.20 sentence, "These signals are developed

... " is referring to the bistable comparator outputs which are monitored by the SSPS. The PPS does not generate the P-12 Permissive itself. The actual P-12 Permissive is generated by the SSPS when appropriate coincidence of initiation signals is detected.

The SSPS output is interlocked with the valves as stated in the third paragraph of Section 4.1.20. The LAR Section 4.1.20 is clarified by the following statement: " ... The P-12 Permissive is developed in the SSPS based on coincidence of the P-12 bistable comparator output initiation signals from the PPS ... Protection System Permissives (P-11 unblock SI from ALS, P13 Turbine power permissive from Tricon, and P-14 Steam Generator Level high-high from Tricon) are generated by coincident logic in the SSPS based on initiating signals (bistable outputs) from the PPS as noted in the response to 01 #12. Permissive development.

including initiating signals and logic coincidence is shown in FSARU Tables 7.2-2 (RTS) and 7.3-3 (ESFAS). The PPS does not perform coincident logic functions and does not "generate" any protection system permissives.

14 RS Section 4.1.1 SSPS contains the following statement in the last paragraph; "Information concerning the P PS status is transmitted to the control board status lamps and annunciators by way of the SSPS control board demultiplexer and to the PPS by way of the SSPS computer demultiplexer." Why would the PPS status need to be transmitted to the PPS as the sentence suggests in the last phrase? Closed . N/A PGE Response resolves this Open Item. Change status to Closed. PG&E response:

The sentence in Section 4.1.1 contains a a typographical error. The sentence should read: .... ....--....

I June 11,12 DCPP PPS Open Item Summary Table Page 21 of 40 No SrC/RI Issue Description P&GE response:

Status RAJ No. (Date Sent) RAI Response (Due Date) Comments (BK) "Information concerning the PPS status is transmitted to the control board status lamps and annunciators by way of the SSPS control board demultiplexer and to the Plant Process Computer (PPC) by way of the SSPS computer demultiplexer." As used in the Section 4.1.1. paragraph, "PPS Status" means "PPS Channel Trip Status.>> An ISG-04 compliance matrix for the DCPP PPS system was not submitted with, or referenced in, the LAR for the W/ALS platform.

Instead the ISG-04 compliance section 4.8 of the LAR refers the reader to the ALS L TR for nearly all the points of ISG-04. Fig. 4.4 and 4.5 of the LAR indicate various 1 E and non-1 E communication pathways to and from ALS processor (e.g., Closed Drafted RAI#4 to obtain an answer I report to (Kemper 4-4-12) No further discussion necessary until May 31,2012. I Maintenance Work Station, plant computer, process control, port aggregator, and 4-20 rna temperature signal to Tricon processor).

These are all application specific features of the PPS and the staff expects a W/CSI ALS document to be submitted, similar in scope and detail to the Invensys "PACIFIC GAS & ELECTRIC COMPANY NUCLEAR SAFETY-RELATED PROCESS PROTECTION SYSTEM REPLACEMENT DIABLO CANYON POWER PLANT DI&C-ISG-04 CONFORMANCE REPORT" Document No. 993754-1-912 Revision 0, to be submitted on the docket, which explains how the ALS portion of the PPS application conforms with the guidance of 04. address this 04 complian ce matrix for the ALS platform.

4/4/12 update: The draft ALS ISG-04 compliance matrix on the AL TRAN Sharepoint website is not detailed enough for the staff to use in approving the ALS portion of the PPS' communications June 11, 12 DCPP PPS Open Item Summary Table Page 22 of 40 No SrclRI Issue Description P&GE response:

Status RAI No. (Date Sent) RAI Response (Due Date) Comments PG&E response:

PG&E is developing the ISG-04 compliance matrixTable for the ALS platform and PG&E will submit the Table by July 31, 2012. design. Suggest PG&E review the Invensys ISG-04 Doc. Document No. 993754-1-912

(-P) Revision 0, and provide guidance for an ALS document at the same level of detail. 16 (BK) --.... , Section 1.4.4 (pg. 12/38) of document 993754-1-813 Diablo Canyon Triconex PPS Validation Test Plan (VTM) states 'The network equipment, including media converter, NetOptics Network Aggregator Tap, and gateway hub, and the MWS will not be within the test scope of this VTP. The Nuclear Delivery (NO) group will coordinate with Pacific Gas & Electric for system staging prior to turn over to Nuclear IV&V. The Nuclear IV&V group will confirm proper operation of network communications system interfaces before beginning testing addressed in this VTP." When, where, and what procedures will be used to test the network equipment??

Closed RAI05 .. -Received two papers discussing integration test plans for PPS system. These papers were discussed at the 4/18/2011 CC. The staff agrees that the analog RTD signal loops may be tested separately at the Tricon FAT and at the ALS FAT to satisfy integration test requirements.

The staff expressed some concerns over the statement that "There is no

___ , PG&E response:

Additional information on the PPS testing is being provided to the staff. The information on the PPS testing was updated on May 9 to address staff comments provided in the 4/18/22 conference call. The VTM will need to be updated based on the additional information.

A date that the updated VTM will be submitted will be provided after feedback from the staff is received on the additional information on the PPS testing.

June 11, 12 DCPP PPS Open Item Summary Table Page 23 of 40 No SrclRl Issue Description P&GE response:

Status RAI No. (Date Sent) RAI Response (Due Date) Comments ... .....-.... _-........... .... .... _-....---........ .... ......... _ ... __....._ _ .... __.._._ .... connection between the Tricon and the ALS." This appears to be a misleading statement since both systems do have connections to the common MWS. Further clarification should be provided and the statement should be revised to describe the nature of the MWS connections to each system. A follow-up discussion was had at the 5/16/12 conference call. The NRC staff feels that the final integration to be performed during SAT as proposed, will have to be complete and the results submitted prior to issuance of the SE.

June 11, 12 DCPP PPS Open Item Summary Table Page 24 of 40 No SrclRI Issue Description P&GE response:

Status RAI No. (Date Sent) RA/ Response (Due Date) Comments 17 (BK) Section 5.1.4.3, Hardware Validation Tests, (pg. 27/38) of document 1-813 Diablo Canyon Triconex PPS Validation Test Plan (VTM) states that the ALS equipment will not be included in the FAT. Where, when, and what procedures will be used to fully test the Integrated PPS system (both Tricon V10 and ALS platforms together) be subjected to FAT. Closed RAI06 This issue was discussed at the 4/18/2011 CC. PGE proposed performance of separate but overlapping tests at each factory to accomplish the integration test. The staff has some concern over the fact that the MWS's to be installed in the plant would only be tested during the Tricon FAT. A fifth MWS to be configured the same as the plant MWS's is to be used during the ALS FAT. One option to resolve this concern may be to credit the SAT test results in the SE. The current schedule for SAT (July 2013) does support this. PG&E response:

Additional information on the PPS testing is being provided to the staff. The VTM will need to be updated based on the additional information.

A date that the updated VTM will be submitted will be provided after feedback from the staff is received on the additional information on the PPS testing.

--18 June 11,12 DCPP PPS Open Item Summary Table Page 25 of 40 No SrclRI Issue Description P&GE response:

RAJ No. RA/ Comments (Date Sent) Status Response (Due Date) (BK) Software Management Plan: Regulatory Guide (RG) 1.168, Revision 1, Closed RA17&8 (Kemper 4/12/12) "Verification, Validation, Reviews and Audits for Digital Computer Software update: The staff has reviewed the Used in Safety Systems of Nuclear Power Plants," dated February 2004 Invensys IEEE endorses IEEE (Institute of Electrical and Electronics Engineers) 1012-1998, 1012 compliance "IEEE Standard for Software Verification and Validation," and IEEE matrix on the 1997,"IEEE Standard for Software Reviews and Audits," with the exceptions PG&E/Altran stated in the Regulatory Position of RG 1.168. RG 1.168 describes a method sharepoint directory acceptable to the NRC staff for complying with parts of the NRC's regulations and it appears to be acceptable.

The for promoting high functional reliability and design quality in software used in matrix appears to safety systems. Standard Review Plan (SRP) Table 7-1 and Appendix 7.1-A be comprehensive identify Regulatory Guide 1.168 as SRP acceptance criteria for reactor trip and indicates no systems (RTS) and for engineered safety features actuation systems exceptions to any (ESFAS) clauses in IEEE The Invensys PPS Replacement Software Verification and Validation Plan 1012. No attempt (SWP), 993754-1-802 does not provide a clear explanation of how the was made to Invensys SWP complies with IEEE 1012-1998.

Please provide a cross reviewlverify that reference table that explains how the Invensys SWP implements the criteria where Invensys of IEEE 1012-1998.

claims compliance with any particular Also, the Westinghouse/ALS 6116-00000 Diablo Canyon PPS Plan, does not provide a clear explanation of how the CSI SWP Clause in the Std, with IEEE 1012-1998.

Please provide a cross reference table that explains that the respective section in their how the W/CSI SWP implements the criteria of IEEE 1012-1998.

SWPis acceptable-the

-... ....-_.... _--.--....-.... .... _-....

June 11, 12 DCPP PPS Open Item Summary Table Page 26 of 40 No Src/RI Issue Description P&GE response:

Status RAI No. (Date Sent) RAI Response (Due Date) Comments PG&E response:

Westinghouse incorporated the IEEE-1012 compliance table in the ALS V&V plan document 6116-00003 in Appendix A Table A-1 and PG&E submited the ALS V&V plan document 6116-00003 to the staff on June 6,2012, in Attachment 7 to the Enclosure of PG&E Letter DCL-12-050.

staff will work through this as the SWP is reviewed and evaluated for approval.

Please submit the document on the docket. This 01 will remain open pending review of the Westinghouse/CSI document.

19 RS Section 4.1.1 of the LAR states that; "The SSPS evaluates the signals and performs RTS and ESFAS functions to mitigate Abnormal Operational Occurrences and Design Basis Events described in FSAR [26] Chapter 15. " however, Chapter 15 of the DCPP FSAR does not use the terms Abnormal Operational Occurrence (AOO) or Design Basis Accident (DBE). Instead, the accident analysis in chapter 15 identifies conditions as follows; CONDITION I -NORMAL OPERATION AND OPERATIONAL TRANSIENTS CONDITION 11-FAULTS OF MODERATE FREQUENCY CONDITION III -INFREQUENT FAUL TS Open RAI9 3/21/12 update: PG&E has created a share point website for NRC to . review PPS design drawings that will address this issue as well as 01 20 and 21. NRC staff will determine if they are needed to be submitted on the docket. PG&E will ensure the website is information is only applicable to this licensing action.

June 11,12 DCPP PPS Open Item Summary Table Page 28 of 40 No SrclRl Issue Description P&GE response:

Status RAI No. (Date Sent) RAI Response (Due Date) Comments 3/21/12 update: PG&E has created a share point website for NRC to review PPS design drawings that will address this issue. NRC staff will determine if they are needed to be submitted on the docket. PG&E will ensure the website is information is only applicable to this licensing action. 5/30/12 Determined that no RAI will be needed for this item. 20 RS The system description provided in Section 4 of the LAR includes "functions performed by other protective systems at DCPP in addition to the PPS functions".

In many cases, there is no explanation of what system is performing the functions described nor is there a clarification of whether the described functions are being performed by the PPS system. As an example, Section 4.1.16 describes a bypass function to support testing of the high-high containment pressure channel to meet requirements of IEEE 279 and IEEE 603. The description of this function does not however, state whether this latch feature is being implemented within the PPS system or in the SSPS. The staff needs to have a clear understanding of the functional scope of the PPS system being modified in order to make its regulatory compliance determinations.

Please provide additional information such as PPS function diagrams to help the staff distinguish PPS functions from functions performed by other external systems. Open N/A PG&E Response:

PPS design drawings have been provided to the staff on the Sharepoint site. 21 RA Westinghouse/CSI document 6116-00005, "Diablo Canyon PPS System Test Plan," states that the ALS-1 02 FPGA design is changed for the DCPPS System. Further, Section 5.3.3 states: "Test as many of the ALS-102 requirements as possible." Open RAI10 3/21/12 update: PG&E has created a share point website for NRC to review PPS design June 11,12 DCPP PPS Open Item Summary Table Page 29 of 40 No SrclRI Issue Description P&GE response:

Status RAI No. (Date Sent) RAI Response (Due Date) Comments Please identify what document describes the design verification test for this board. drawings that will address this issue. NRC staff will determine if they are needed to be submitted on the docket. PG&E will ensure the website is information is only applicable to this licensing action. NRC-the response provided does not address the question.

PG&E response:

PPS design drawings have been provided to the staff on the Sharepoint site. 22 BK Follow-on 01 # 5 question pertaining to the PPS VTP: Section 1.4.4 (pg. 12/38) states "The network equipment, including media converter, NetOptics Network Aggregator Tap, and gateway hub, and the MWS will not be within the test scope of this VTP. The Nuclear Delivery (NO) group will coordinate with Pacific Gas & Electric for system staging prior to turn over to Nuclear IV&V. The Nuclear IV&V group will confirm proper operation of network communications system interfaces before beginning testing addressed in this VTP." When, where, and what procedures will be used to test the network equipment??

Also, section 5.1.4 (3) Hardware Validation Tests states that the ALS equipment will not be included in the FAT (pg. 27/38). Where, when, and what procedures will be used to fully test the Integrated PPS system (both Tricon V10 and ALS platforms together) be subjected to FAT. Closed RAI5 PG&E response:

Additional information on the PPS testing is being provided to the staff. The VTP will need to be updated based on the additional information.

A date that the updated VTP will be submitted will be provided after feedback from the staff is received on the additional information on the PPS testing.

June 11, 12 DCPP PPS Open Item Summary Table Page 30 of 40 No SrclRI Issue Description P&GE response:

Status RAI No. RA/ Comments (Date Sent) Response (Due Date) 23 BK Section 4.2.13.1 ofthe LAR (page 85) states; "Figure 4-13 only shows one Closed RAI11 TCM installed in the Tricon Main Chassis (Slot 7L), the PPS replacement will utilize two TCM cards in each main chassis (Slots 7L and 7 -R). This will provide two non-safety-related communication paths to the MWS and the PPC Gateway Computer from each Protection Set to ensure continued communications if a single TCM fails. The NetOptics Model PA-CU/PAD-CU 1 PA-CU port aggregator network tap was approved previously by NRC for a similar application in the Oconee RPS SER Section 3.1.1.4.3

[18J. The NRC staff determined that due to the electrical isolation provided by use of fiber optic cables and the data isolation provided by the Port Tap and the Maintenance and Service Interface (MSI) in the Oconee RPS, there was reasonable assurance that a fault or failure within the Oconee Gateway computer or the Operator Aid Computer will not adversely affect the ability of the Oconee RPS to accomplish its safety functions.

During the SAT PG&E will test the Protection Set communications paths illustrated in Figure 4-13 to verify that there is no inbound communications path associated with port aggregator network tap Port 1. That is, PG&E will verify that communications from Port 1 to either the TCM on Port A or the MWS on Port B of the port aggregator network tap are not permitted.

Results of this test will be documented in final System Verification and Validation Report. Port aggregator dual in-line package (DIP) switch positions will be controlled by DCPP configuration management processes." In order for the Staff to approve the integrated configuration of the PPS, prior to shipment of the PPS equipment to DCPP site, all communications paths will require testing on or before FAT, and before completion of the SER. This testing is typically completed during or before the PPS FAT, otherwise, the SER will not be completed until after the SAT. Please provide a test scheme/procedures that satisfies all regulatory requirements prior to or during the FAT. Otherwise, if this testing will be completed during the SAT, as stated in the LAR, please provide a detailed schedule for this testing so the NRC can revise its PPS LAR Review Plan accordingly.

-1 The NetOptics Model PAO-CU has two one-way output ports but is otherwise identical in function to the PA-CU.

June 11,12 ocpp PPS Open Item Summary Table Page 31 of 40 No 24 SrclRI Issue Description P&GE response:

PG&E response:

Additional information on the PPS testing for ALS is being provided to the staff. A date the additional information will be submitted will be provided after feedback from the staff is received on the additional information on the PPS testing for ALS. RJS a. Section 4.1.17 paragraph 3 discusses the protection functions associated with High -High Steam Generator Level or P-14. In this discussion it is stated that the SI signal initiates the same two functions (Turbine Trip and Feedwater Isolation) however, there is no mention of this in section 4.1.9 or in the discussion of the P-14 permissive.

Please confirm that P-14 can be initiated by either High-High SG Level or by initiation of SI. b. This same section also states that the described latched in function serves to comply with IEEE Std. 279 Section 4.16. The replacement PPS system is not being evaluated against the criteria of IEEE 279. Instead, IEEE 603-1991 is being used and the equivalent criteria is contained in section 5.2 of IEEE 6031991. PGE needs to understand that the criteria of IEEE 279 are not relevant to this review effort. PG&E response:

a. Turbine Trip can be initiated by either the P-14 steam generator level protection function OR by the latched Safety Injection (SI). Section 4.1.17 describes the Steam Generator Level High-High Protection function P-14. Upon sensing high steam generator level, the PPS generates an initiation signal to the SSPS, which generates the turbine trip signal and initiates Auxiliary Feedwater when coincidence of 2 of 33 high-high level signals in any steam generator is detected.

Section 4.1.9 describes Pressurizer Protection Functions, one of which is initiation of Safety Injection through the SSPS when coincidence 3 of 4 Pressurizer Pressure Low-Low signals from the PPS is detected.

The SI actuation signal also actuates turbine trip and Auxiliary Feedwater through the SSPS, but SI is not initiated by Steam Generator Level High-High

_ ... _..._._ .... -The P-14 protection function is initiated ONLY by steam Generator Status Closed RA/ No. (Date Sent) NIA RA/ Response (Due Date) Comments Item initiated on 4/23/2012.

PGE Response accepted.

_ .... _ .... _ .... _... _ .... .... I , , , ,

June 11,12 DCPP PPS Open Item Summary Table Page 32 of 40 No 25 SrC/RI RJS Issue Description P&GE response:

Level High-High.

Through the SSPS, P-14 will trip the turbine and actuate Auxiliary Feedwater.

A SI signal will also actuate Turbine trip and Auxiliary Feedwater, among other actions. Pressurizer Protection functions do not initiate P-14 and Steam Generator Level High-High P-14 does not initiate SI. b. PG&E intended Section 4.1 to describe the existing PPS and to apply only to the existing PPS, which complies with IEEE 279-1971.

Sections 4.2 to 4.13 of the LAR apply to the PPS Replacement.

Section 4.10.2.2 describes compliance of the PPS Replacement with IEEE 603-1991 Section 5.2. PG&E understands and appreciates that IEEE-603 applies to the PPS replacement.

-Sections 4.1.17, and 4.1.21 state that the P-9 permissive is the "Power Range at Power" function while Section 4.1.9 states that the P-10 Permissive is also called the "Power Range at Power" function.

Is it correct that both of these permissives are called "Power Range at Power" and that they perform different functions?

PG&E response:

Both P-9 and P-10 are "Power Range at Power" functions; both are active when the Power Range NI channels are at power. Permissive P-9 blocks reactor trip on turbine trip when 3 of 4 Power Range NI channels are below 50%. Permissive P-10 is active when 2 of 4 Power Range NI channels are above 10%. Permissive P-10 is combined with Turbine Power Permissive P-13 (which is active above approximately 10% turbine load) to provide input to Permissive P-7 that allows blocking several low power reactor trips. In effect, Permissive P-10 is the "Power Range at Power -Low" permissive" and Permissive P-9 is the Power Range at Power -High" permissive.

This is consistent with the response to 01 #12, above. Status Closed RAI No. (Date Sent) NIA RAI Response (Due Date) Comments Item initiated on 4/23/2012.

PGE Response Accepted.

June 11, 12 DCPP PPS Open Item Summary Table Page 33 of 40 I I I No SrclRI Issue Description P&GE response:

Status RAI No. (Date Sent) RAI Response (Due Date) Comments 26 RJS _ ...The PG&E SyQAP defines Supplier tasks that are related to assurance of software quality for each of the following phases of development; Project Initiation and Planning *

• Conceptual Design

• Requirements

• Design

• Implementation

• Integration

• Test These phases do not align with the phases used in the ALS or Tricon development lifecycles.

For instance, the Tricon SOAP defines the phases as Requirements, Design, Implementation, and Test (Validation).

Because of this, it is not clear how assurance of task completion can be accomplished.

During which Tricon phases would those tasks listed under Integration, Initiation and Planning, and Conceptual Design be performed?

The ALS SOAP does not mention phases but the ALS Management plan defines the development phases as; Planning, Development, Manufacturing, System Test, and Installation.

Would it be possible for PGE to provide a mapping of Phases defined in the SyOAP to the Phases of the ALS and Tricon system development processes so that the staff can correctly identify and confirm performance of these QA tasks? Open RAI12 Item Initiated on 4/25/2011 Will need formal response for this item. Therefore this will be an RAI. _ ....

27 June 11, 12 DCPP PPS Open Item Summary Table Page 34 of 40 No SrclRI Issue Description P&GE response:

Status RAI No. RAI Comments , (Date Sent) Response (Due Date) , PG&E response:

PGE will provide a mapping of Phases defined in the SyQAP to the Phases of the ALS and Tricon system development processes.

The determination of the location of the mapping information and date to be submitted is IN PROGRESS.

RA Open RAI13 The PQP will need to be submitted.

The LAR, Attachment 3, describes the project organization, roles and responsibilities for the PPS replacement project. This document does not describe oversight activities that PG&E will perform during the PPS replacement project, as well as the interface between PG&E and Invensys and WEC/CSI, and the methodology to judge quality of the vendor effort. Please provide this information.

Software Management Plan PG&E response: Oversight activities for the project were discussed in Section Appendix B Compliance, of the LAR that discusses the DCPP Assurance Program and Procurement Control Program and states PG&E will audit 10M and CSI during the manufacturing phase under PG&E Nuclear Procurement Program and associated In support of the oversight activities, a PG&E will issue a Project Quality (PQP) that will define the oversight activities to be performed, technical audits, cyber security audits, and software quality assurance The PQP is expected to be issued in June and will be submitted to the Following the performance of the PQP audits, audit reports will be and a PQP Audit Summary Report will be created. PG&E will submit PQP Audit Summary Report to the staff at the time the vendor hardware delivered to PG&E. The vendor hardware is currently expected to delivered to PG&E in Spring June 11,12 DCPP PPS Open Item Summary Table Page 35 of 40 No SrC/R/ Issue Description P&GE response:

The pap audit reports will not be submitted but will be made available to the NRC staff for review. Status RA/ No. (Date Sent) RA/ Response (Due Date) Comments 28 29 -RA RA Software Management Plan Open N/A The LAR, Attachment 3, states that PG&E is responsible for the following activities in the lifecycle:

project initiation and planning phase, conceptual design phase, requirements phase, installation and checkout phase, operation phase, and maintenance phase. Further, Section 3.1.10 states that PG&E will follow the activities described before for software modifications.

Please explain how PG&E will perform software modifications to the Tricon and ALS platforms once the PPS replacement project is completed.

PG&E response:

The control of the software modifications to the Tricon and ALS platforms once the PPS replacement project is completed will be by the Process Protection System Replacement Software Configuration Management Plan, which wassubmitted as part of the Phase 2 document submittal on June 6, 2012, in Attachment 4 to the Enclosure of PG&E Letter DCL-12-050.

Software Management Plan Open N/A The LAR, Attachment 3, states that the PG&E Project Manager will share the responsibility for meeting the software quality goals and for implementing the software quality management throughout the project. Please describe what responsibilities are going to be shared and how this is going to be performed.

_ ... _ .... _--_.... _ .. __....._.... _ ...

June 11,12 DCPP PPS Open Item Summary Table Page 36 of 40 No SrC/RI Issue Description P&GE response:

Status RAI No. (Date Sent) RAI Response (Due Date) Comments PG&E response:

The PG&E Project Manager will share the responsibility for meeting the software quality goals with the PG&E Quality Verification organization personnel.

To implement the oversight activities, the PG&E Quality Verification organization will issue a Project Quality Plan (PQP) that will define the oversight activities to be performed, including technical audits, cyber security audits, and software quality assurance audits. -30 RA Software Development Plan Section 7 of the Invensys Nuclear System Integration Program Manual (NSIPM) requires that non-conforming procedures shall be used to control parts, components, or systems which do not conform to requirements.

Invensys documents 993754-1-906, Software Development Plan, and 993754-1-905, PPS Replacement DCPP Project Management Plan, do not identify non-confirming procedures to be followed when deviations are identified and how deviations should be corrected.

Please provide this information.

Open RAI14 PG&E response:

The Project Management Plan (PMP), 993754-1-905, is the overarching project management document for the Invensys scope of the PPS Replacement Project. It references other Invensys planning documents that discuss procedures to follow when deviations are identified and how they are corrected.

The Software Development Plan, 993754-1-906, describes the software development process for the Invensys scope of the PPS Replacement Project. It will be revised to strengthen references to procedures to be followed when deviations are identified.

In addition, the Invensys Software Quality Assurance Plan, 993754-1-900, Section 8, and the Invensys Software Configuration Management Plan, 993754-1-909, Section 3.2, both provide reference to procedures to follow when deviations are identified and how deviations are corrected.

The revised Invensys project planning documents for the PPS Replacement June 11, 12 DCPP PPS Open Item Summary Table Page 37 of 40 No SrC/RI Issue Description P&GE response:

Status RA/ No. (Date Sent) RA/ Response (Due Date) Comments Project will be submitted as part of the Phase 2 document submittals to the staff by July 31, 2012. 31 RJS Software Ouality Assurance Plan: IEEE 7302002 stipulates in section 4 that "The SOAP shall be approved by the manager of each of the organizations having responsibilities in the SOAP. The PGE SYOAP has been approved by the PGE Diablo PPS Upgrade Project Manager and the Altran Project lead; however, there are several other organizations that have responsibilities delineated in the SOAP. The managers of these organizations have not approved the SYOAP. The following organizations are assigned roles and Responsibilities within Section 3.4 of the SYOAP. Please explain the means by which these organizations have committed to comply with the requirements stated in the SYOAP.

• Vendor IW Projects Managers

• EOC Design Change Package Team

• PGE Project Engineering Team

• OA Organization

• Testing and Integration Team

• V&V Organization Open RAI15 At the 5/16 meeting, the staff explained that PGE should have some commitment from all orgs that have activities in the SyOAP. This could be contractual or through activities that are delineated in other vendor plans or procedures.

PG&E response:

The software quality assurance plan was discussed in Section 4.11.1.1.1 of the LAR, which did not commit to IEEE 730 2002 criteria in developing the SOAP. IEEE Standard 7-4.3.2-2003

[761 Clause 5.3.1 references IEEE Std 730-1998 for guidance but does not require it to be met. PG&E is determining how to address the commitment from all organizations contained in the SyOAP as requested by the staff in the 5/16 meeting. --_ .... --

June 11,12 DCPP PPS Open Item Summary Table Page 38 of 40 No SrclRI Issue Description P&GE response:

Status RA/ No. (Date Sent) RA/ Comments Response (Due Date) 32 RJS Section 4.2.7 "Power Supply" of the LAR describes how power is supplied to the PPS. In this description, the 480V AC vital supply is described in the following ways.

• First it is described as back-up common bus to the 120 V distribution panels. We cannot tell if this is through a transformer or if this refers to the alternate supply to the inverters.

• It is also described as a supply to an inverter.

• It is then described as supply to the battery charger From these descriptions, it is not clear to the staff how these vital power sources are configured in relation to the 120VAC panels that feed the PPS. Would it be possible to provide a simplified diagram to show the relationship between the 125V Batteries I DC Buses, Battery Chargers, Inverters, and the 120V AC distribution Panels that supply power to the PPS, Open RAI16 PGE Response , accepted.

_ .... _ .... _ .... _ ....PG&E response:

The following description clarifies the 120 V vital instrument AC power supply to the pps: 1 Safety-related 480 VAC from vital AC motor control center (MCC) is fed to the UPS and rectified.

2 Rectifier output is fed to the inverter and converted to 120 VAC. 3 Safety related vital DC bus power is fed to UPS as immediate backup supply. The vital DC bus is backed up by the safety-related 125 VDC station battery, which is charged from vital 480 VAC. 4 Inverter output is fed through a static switch with integral manual bypass switch to vital instrument AC power distribution panels. 5 On loss of inverter output, the static switch will select backup regulating transformer output (120 VAC) to distribution panels. 6 The backup regulating transformer receives input from the 480 VAC supply. The backup regulating transformer may be aligned via a transfer switch to either of two 480 VAC busses; the normal supply or an alternate supply. The alternate supply circuit breaker is normally open to prevent interconnection of redundant power supplies due to a failed June 11,12 DCPP PPS Open Item Summary Table Page 39 of 40 No SrclR/ Issue Description P&GE response:

Status RAJ No. (Date Sent) RA/ Response (Due Date) Comments transfer switch. The transfer switch may not be used under load. Refer to the attached block diagram for additional detail. 33 RJS (ALS SOAP) Software tools are used extensively during the FPGA development process. The staff therefore considers these tools to be a key component to the assurance of quality in the ALS system development process. The ALS SOAP states that "no additional tools, techniques, or methodologies have been identified" for the ALS system. The staff considers the development tools, as well as the techniques and methodologies used during system development to be relevant to the assurance of quality for the ALS system. Please provide information on the tools, and methodologies used during system development to ensure quality of the ALS system products.

New Item initiated on 6/5/12. -PG&E response:

IN PROGRESS 34 RJS (Software Integration Plans) The integration planning documentation referenced in section 4.5.4 of the LAR does not include any integration of the two sub systems (ALS integrated with Tricon). The PGE papers provided that discuss how FAT's will be performed may resolve this but these papers would have to be docketed as integration planning documents to support our SE. We also need to come to some agreement on the scope of integration to be accomplished prior to issuance of the SE. New Item initiated on 6/7/2012 PG&E response:

IN PROGRESS .... _... __.... _

DC DC AC SDH (21) Transfer Switch To Protection Set I To Protection Set II Legend: SD12 (22) , 'r+-I J I i I Transfer SD13 (23) T IY131 ---:?1 . (23) AC / IJune 11, 12 DCPP PPS Open Item Summary Table Figure 1 DCPP 120 Volt Vital Instrument AC System (Simplified)

IY: UPS and DC-AC Inverter PY: 120 VAC Distribution Panel SD: 125 VDC Distribution Panel TRY: 480 VACl120 VAC Transformer and Regulator Normal Power Flow (N) Bypass (120 VAq/Backup (125 VDC) Power Flow Alternate Bypass Power Flow (A) Unit 1 ComponentlD's are shown; Unit 2 ComponentlD's are in parentheses.

For example, PY11 is Unit 1 Vital Instrument AC Distribution Panel 1; PY21 is Unit 2 Vital Instrument AC Distribution Panel 1. I--U SWIKn TRY I LTo Protection Set IV Page 40 of 40 480V BUS 1 H (2H Transfer Transfer Switch Swilcl1 To Protection Set III DCPP PPS Replacement Factory Acceptance Testing (FAT) A. Introduction An integrated FAT, with the ALS connected to the Tricon will not be performed because the ALS and Tricon FAT will be performed in different locations.

The overlapping test methodology illustrated in Figure 1 and described below will ensure that all specified PPS safety function requirements for each platform are verified at the Respective FAT1. B. Discussion The ALS and the Tricon are directly connected via the analog Reactor Coolant System temperature channels.

The ALS provides Class IE signal conditioning for the Pressurizer Vapor Space temperature, Reactor Coolant System wide range temperature and narrow range RTD inputs to the Overpower Delta Temperature (OPDT) and Overtemperature Delta Temperature (OTDT) thermal trip functions due to its improved ability to process 200 Ohm RTD inputs vs. Triconex.

The ALS processes the resistance (ohms) RTD input signals and transmits the temperature values to the Tricon as analog 4-20 mA signals for the respective Protection Set. The resistance to milliamp conversion will be tested at the ALS FAT to verify that all requirements specified for converting the resistance to current are met. The Tricon FAT will test these channels by injecting the corresponding 4 to 20 mA signals into the Tricon and verifying that all requirements specified for the temperature channels are met. After the FAT, the equipment will be shipped to DCPP and then both systems will be integrated to perform the Site Acceptance Testing (SAT) which will test the analog interface directly along with others that cannot be tested at the FAT, such as the connection to the Plant Data Network (PDN) Gateway Computer.

Within each Protection Set, the ALS and the Tricon are both connected via digital communication links to the Maintenance Workstation (MWS) as shown in Figure 1; thus, the digital MWS is shared by the ALS and Tricon portions of the replacement PPS. Tricon communications with the MWS are bidirectional (readlwrite) using Triconex NET2 protocol via the fiberoptic media 4352AN Tricon Communications Module (TCM). As discussed in Section 3.1.2.9 of the Triconex V1 0 SER [ML 1209008902], the TCM handles all Tricon communications with external devices, thus providing functional isolation.

The ALS communications with the MWS are via the unidirectional TXB2 communication links from the ALS-1 02 board. The TXB2 communication links are electrically isolated at the ALS-102. Unidirectional communications provides functional isolation from the MWS. The unidirectional nature of the links will be verified at F AT as described below. For each Protection Set, the ALS and the Tricon are both connected via digital communication links to the Plant Data Network (PDN) Gateway computer as shown in Figure 1. A port aggregator network tap is connected between the Tricon and the MWS via bidirectional Port A and Port B. All network traffic between Port A and Port B is reflected to unidirectional Port 1. There is no communication path from Port 1 to either Port A or Port B. In addition to the 1 The gateway switch and gateway computer(s) shown shaded in Figure 1 were installed in the plant by a previous project. As existing installed plant equipment, these two items need not be tested explicitly at the FAT or SAT. 5/16/12 Enclosure 3

DCPP PPS Replacement Factory Acceptance Testing (FAT) functional isolation provided by the TCM, the port aggregator provides further functional isolation between the Gateway computer and the Tricon. The ALS communications with the Gateway computer are via the unidirectional TXB1 communication links from the ALS-102 boards. The TXB1 communication links are electrically isolated at the ALS-102. Unidirectional communications provides functional isolation from the Gateway computer.

The unidirectional nature of the links will be verified at FAT as discussed below. :The ALS also \X>mlTlunicates with ALS Service Unit (ASU)app1iel:ltlQn software in the WANS via the bidirectional TestALS Bus (TAB) c;ommunicatil.)rilirik;P L,STopioa' Report [ML102570797].

Table 5-2,ltem 8, the TAB bus is U$edfor '" " ' icatl,onofjnformatlonfrom and to the ASU with the ALS Platform.

This communication process is Independent from the safety function logic. To enable the TAB bus to the ASU reqvires the setting of a switch which. when enabled. is alarmed locally and in the main control room ... The TAB bus and its interfaces are designed such the buses are non-intrusive in thatthe bus cannot interfere with processing of any information or data on the Reliable ALS Bus (RAB). The FAT will verify that the TAB, when enabled, does not interfere with ALS logic Per the ALS System Design SpeCification 6116-00011

[ML 110600695], the ALS allows for online maintenance of an operational system such as the bypassing and control of individual ALS outputs and the calibration of individual ALS I/O without affecting adjacent non-bypassed Comment [WEK1):

staff wiD need a FAT that 18$\$ aU MWS functJol1$

In an Integrated manner. SIO<le lila MWS will be pe!TIl8ll£lntly attached to J uttlized by both the ALS and Tricon Plalfot'lml forvllffOtlll functions, Ilowwill\hese functions be lestedto demonstrate

!hEi full capability of \he MWS (_WEK 6 comment)??

safety channels.

[rhe ALS Topical Report. Section 3.4. describes calibration of an analog input/output channel using the ASU. The ASU is used to select the channel to be calibrated and place that particular channel in BYPASS mode before the extemal test equipment is connected to the channel wiring on test points located on the field terminal blocks. [rhe is placed e in CALIBRATE mode to perform the calibration.

ALS Topical Report Section 3.5 explains how specific digital output channels may also be placed in BYPASS or OVERRIDE mode from the ASU. The ALS FAT will verify that individual ALS outputs may be bypassed and controlled and individual ALS I/O may be calibrated without affecting adjacent non-bypassed safety channels.

For the Tricon FAT, PG&E will provide the Maintenance Workstation (MWS), port aggregator network tap, network switches, and media converters as needed to test the complete interface between the MWS and the Tricon. Each Protection Set has its own Maintenance Workstation (MWS). The MWS is not shared between or among Protection sets. The ALS Service Unit (ASU) software will be loaded on the MWS to facilitate identification of any interaction between the MWS Wonderware application, the ASU software, and/or the MWS operating system. The Tricon FAT will be performed on all four protection sets. Each protection set will be integrated with all equipment necessary to support FAT. The functionality of the MWS will be tested during the FAT to verify requirements specified in the FRS and Tricon SRS. The FAT will verify correct two-way data communications between the Tricon and the MWS through Ports A and B of the port aggregator.

jrhe FAT will verify that there is no inbound communication path from network port aggregator tap Port 1 to either Port A or Port B. i _ _ _ _ _ _ _

__ PG&E will provide another MWS for the ALS FAT. The port aggregator is not required for the ALS. The communications from both TxB1 and TxB2 one-way RS-422 ports will be tested to verify all specified data is being transmitted correctly.

The MWS Wonderware application will be running to display the read only parameters.

1rhe ASU software running on the WANS will be tested during the FAT to verify its functionality and to identify any interactions between the ALS .'

[WEIC2]; The staff needs 10 review the ALS platform SER 10 ensure thill feature is , approved al the platform level-WEK.

? / Comment [WEK3]; The NeIOptics Aggregator Port Tap approved In the 0_SER was Model 96443 No. PA-CU. SecIIon 4.2.13.1 of the LAR Indlcate$

thai Model PA-CU/PAO-eU PA-CU AgQrega\or Is being used, fQr the DCPP PPS. WhkllllS very lIimllar 10 the O<;onee Aggrega!Qr, bill bIIs 301'118 has two cme-wayoulput ports)...II1eltaff will need information for 1f1i$ ,diffe/'eot

'modaI it is and furn;tiornl the sa,,", B \he p'revlou$ly approved Oconee Aggregator.

2 5/16/12 DCPP PPS Replacement Factory Acceptance Testing (FAT) ASU software, the Mt/VS Wonderware application, and/or the Mt/VS operating system. The way EIA-465 port wilt be tested with a mechanical switch to verify the ability to parameters and to isolate the Mt/VS from the ALS. l_ _ __ _ _ _ _ __ _ __ _ __ _All boards of the same type in the ALS platform have the same capabilities.

The boards can configured by the user to meet the requirements of any protection set. The FAT will performed on each protection set configuration, including power supplies, the Fv1WS, and associated equipment that supports the safety function for the specific protection set. That Protection Set 1 will be configured and tested with all the associated sensor inputs appropriate loads on the digital and analog outputs, IUpon completion of testing, the will be reconfigured as Protection Set 2 and tested, The same process will be used Protection Sets 3 and 4. i . rrhe PG&E SAT will be performed on an integrated system. The oonnection of the channels from the ALS to the Trioon will be verified during the SAT. The SAT will functions and oonnections that cannot be tested at the FAT, prior to installation in the plant. tyhe integrated system used for SAT will also be used to perform training and to develop and operational and maintenance procedures, Any application software changes from the time eqUipment arrives at PG&E facilities until its installation in the plant is subject to management FAT Plan Outline The Tricon FAT will test the safety-related functions specified in the LAR and will also test the following interfaces: Safety-related 4-20 mAde analog temperature input signals from ALS; these Signals will be generated by a loop simulator or equivalent test equipment. The FAT will verify bidirectional non-safety NET2 communications between Tricon TCM1 and TCM2 and the MWS through the two Ethernet media converters, and Ports A and B of the two port aggregator network taps, ALS data acquisition and display and ALS Service Unit (ASU) software will be on the Fv1WS during the Tricon FAT to identify program conflicts and The FAT will verify no inbound communication path from Port 1 of the port network tap to either Port A or Port B exists, per LAR The ALS FAT will test the safety-related functions specified in the LAR and will also test the following interfaces: Safety-related 4-20 mAdc analog temperature output signals to Tricon; these Signals will be monitored by external equipment to verify conversion and scaling, The ALS analog temperature output channels will be terminated with 250 ohm resistors to simulate the Triconex FTP module, Voltage across the resistors will be measured to verify analog output function, COIIIment

[WEK4]: PG&I; should provide an explanation 01 how !he ASU software fuoctions; Speclflcally, since !he ASU SW is on the MWS, II delail\;ld explanation for !he hardware and IlOf\wlIre features 01 the PPS (Including its NSf<. MWS) that justl!Ies how the ASU SW cannot Iffect !he data communications functions Within the MWS performing the bidirectional communications with the Trtoon platform vla PortA and B of !he Port Tap Aggregator, Comment [WEKS): What physical interlocK prevents putting more then 1 Protection Set into maintenance bypass?? COIIIment

[WEK6]1 This is slil problematic, The staff cannot approve an lnltlgrated system without completion of a compte\!!

FAT on !he entire system, This can be done III" vendor's facility, oret!he licensee's facllitt--it makes nodiffe!'9f1ll1il III \I1!1 st!lff; I-jowaver, each PAT activllyshould done III the llama standards II!! deflriaal\;ld InJSG.Q6 and !he LAR (e,g., FAT Test Plan (submilted on !he Docket), test procedIJres (avwlabl&

for audit), and test resIJlts summarized In a final FAT Report (submitted on the Docket), We need to lind a way to resolve this.. , 5/16/12 DCPP PPS Replacement Factory Acceptance Testing (FAT) Unidirectional only non-safety EIA-422 communications from the ALS-102 "A" and 102 "B" TXB1 channels.

The TXB1 channels will be monitored during ALS FAT to data protocol.

The test will verify no inbound communications via the TXB1 channel either ALS-102 "A" or Unidirectional only non-safety EIA-422 communications from the ALS-102 "A" and 102 "B" TXB2 channels to the MWS. The TXB2 channels will be monitored during FAT to verify data protocol.

The test will verify no inbound communications via the channel to either ALS-1 02 "A" or Irricon data acquisition and display and ALS Service Unit (ASU) software will be on the MWS during the ALS FAT to"verify no P!Q9r<!nl

!iQQ ___ ___ COmment [WEI(1J: I would chose the language as revised. This should not be the , forst time eny program conflictS are Identified.Bidirectional EIA-485 TAB communication between ALS Chassis "A" and Chassis "B" ,and ASU software running on MWS can take p[lace only if the communication links are Deleted:

physically connected and enabled. The test will verify there is no between the ALS chassis and the ASU if communications are not phYSically and 5/16/12 DCPP PPS Replacement Factory Acceptance Testing (FAT) Figure 1 Replacement PPS Acceptance Testing with Overlap I I , I I , I , "" / / "" /

/"'-'-..y' " I __y'PftlWUIN.t!R

.... .....--,' :::::: ::::::1 Comtn,lill'lt.£WEKIl:

PG&E', SAT aclMtie6 slloU!<l be executed as part of lhe PPS not responsive to 01# 23. 5 5/16/12

-Please direct any inquiries to me at 301-415-1132 or at Joseph.Sebrosky@nrc.gov.

IRAJ Joseph M. Sebrosky, Senior Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-275 and 50-323

Enclosures:

1. List of attendees

2. Staff identified issues 3. Staff comments associated with PPS FAT cc w/encls: Distribution via Listserv DISTRIBUTION:

PUBLIC RidsRgn4MailCenter Resource LPLIV Reading WMaier, RIV RidsAcrsAcnw_MailCTR Resource TWertz, NRR RidsNrrDeEicb Resource WKemper, NRR/DE/EICB RidsNrrDorl Resource RStattel, NRR/DE/EICB RidsNrrDorlLpl4 Resource RAlvarado, NRRIDE/EICB RidsNrrLAJBurkhardt Resource SMakor, RIVlDRS/EB2 RidsNrrPMDiabloCanyon Resource SAchen, RIV RidsOgcRp Resource MMcCoppin, EDO RIV 2 21 M . S ADAMS Accession Nos. Meeting Notice ML 1214 A 4; eetmg ummary ML12170A866

• via email OFFICE DORULPL4/PM DORULPL4/LA NRRlDE/EICB DORULPL4/BC DORULPL4/PM NAME JSebrosky JBurkhardt WKemper* MMarkley JSebrosky DATE 6/26/12 6/21/12 6/25/12 6/27/12 6/27/12 OFFICIAL RECORD COpy