ML21112A254

Request for Additional Information Digital Upgrade to the Core Protection and Control Element Assembly Calculator System (EPID L 2020 Lla 0164) - Redacted Version

ML21112A254
Person / Time
Site:	Waterford
Issue date:	04/29/2021
From:	Perry Buckberg NRC/NRR/DORL/LPL4
To:	Entergy Operations
Buckberg P
Shared Package
ML21112A252	List: ML21112A254
References
EPID L 2020 LLA 0164
Download: ML21112A254 (15)

Text

OFFICIAL USE ONLY PROPRIETARY INFORMATION April 29, 2021 Site Vice President Entergy Operations, Inc.

Waterford Steam Electric Station, Unit 3 17265 River Road Killona, LA 70057-3093

SUBJECT:

WATERFORD STEAM ELECTRIC STATION, UNIT 3 - REQUEST FOR ADDITIONAL INFORMATION RE: DIGITAL UPGRADE TO THE CORE PROTECTION AND CONTROL ELEMENT ASSEMBLY CALCULATOR SYSTEM (EPID L-2020-LLA-0164)

Dear Sir or Madam:

By letter W3F1-2020-0038 dated July 23, 2020, as supplemented by letters W3F1-2021-0002, W3F1-2021-0015, W3F1-2021-0025, and W3F1-2021-0026 dated January 22, January 29, March 5, and March 19, 2021, respectively (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML20205L588, ML21024A005, ML21029A156, ML21064A535, and ML21082A393, respectively), Entergy Operations, Inc. (the licensee) applied for a license amendment to Renewed Facility Operating License NPF-38 for the Waterford Steam Electric Station, Unit 3 (Waterford 3). The proposed amendment would revise Waterford 3 Technical Specifications in order to implement a modification replacing an existing digital core protection calculator system.

Based on its review of the application, the U.S. Nuclear Regulatory Commission (NRC) staff determined that it needs a response to the enclosed request for additional information (RAI) to complete its review. On April 28, 2021, NRC and licensee staff held a clarification call, which resulted in non-substantive editorial revisions to the RAI. Based on a discussion with Mr. Remy Devoe of the licensees staff during the clarification call, the NRC requests the licensee to respond to this request on or before June 2, 2021, except for RAI-06. The NRC staff will communicate to licensee staff the due date for the response to RAI-06 after it receives the response to the other RAIs.

Enclosure 1 to this letter contains proprietary information. When separated from the Enclosure 1, this document is DECONTROLLED.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION The NRC staff has been using an open item process (ADAMS Accession No. ML20289A267) to support the licensing review and identify potential RAIs. The enclosed RAI references open item numbers discussed during partially closed meetings held on September 22, October 21, November 4, and November 18, 2020; and January 6, January 21, February 3, February 17, March 3, and March 17, 2021. The NRC maintains open items in a spreadsheet that is attached to the meetings summaries dated October 22 and December 17, 2020; February 19, February 22, April 1, April 2, and April 8, 2021 (ADAMS Accession Nos. ML20288A742, ML20315A267, ML20325A321, ML20325A241, ML21032A013, ML21039A268, ML21071A286, ML21075A032, and ML21085A865, respectively).

The NRC has also audited various licensee documents to support its licensing review and identified potential RAIs. The NRCs audit plan dated October 1, 2020, as supplemented by e-mail dated March 22, 2021, is in ADAMS at Accession Nos. ML20268B324 and ML21084A255, respectively. RAIs generated from the audit are included in Section 2.0 of the enclosure.

The NRCs RAI is enclosed. The NRC staff has determined that the RAI contains proprietary information pursuant to Title 10 of the Code of Federal Regulations Section 2.390, Public inspections, exemptions, request for withholding. Proprietary information, which is provided as , is indicated by bold text enclosed with ((double brackets)). Accordingly, the NRC staff has prepared a redacted publicly available nonproprietary version of the RAI, which is provided as Enclosure 2.

If you have any questions, please contact Audrey Klett at 301-415-0489 or at Audrey.Klett@nrc.gov.

Sincerely,

/RA - A. Klett for/

Perry H. Buckberg, Senior Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-382

Enclosures:

1. RAI (proprietary)

2. RAI (nonproprietary) cc w/o Enclosure 1: Listserv OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION ENCLOSURE 2 (NONPROPRIETARY)

REQUEST FOR ADDITIONAL INFORMATION ENTERGY LOUISIANA, LLC ENTERGY OPERATIONS, INC.

WATERFORD STEAM ELECTRIC STATION, UNIT 3 DOCKET NO. 50-382 Proprietary information pursuant to Section 2.390 of title 10 of the Code of Federal Regulations has been redacted from this document.

Redacted information is identified by blank space enclosed within ((double brackets)).

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION REQUEST FOR ADDDITIONAL INFORMATION RELATED TO LICENSE AMENDMENT REQUEST RE:

TECHNICAL SPECIFICATIONS TO SUPPORT DIGITAL UPGRADE MODIFICATION RENEWED FACILITY OPERATING LICENSE NO. NPF-38 ENTERGY LOUISIANA, LLC ENTERGY OPERATIONS, INC.

WATERFORD STEAM ELECTRIC STATION, UNIT 3 DOCKET NO. 50-382

1.0 BACKGROUND

By letter W3F1-2020-0038 dated July 23, 2020, as supplemented by letters W3F1-2021-0002, W3F1-2021-0015, W3F1-2021-0025, and W3F1-2021-0026 dated January 22, January 29, March 5, and March 19, 2021, respectively (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML20205L588, ML21024A005, ML21029A156, ML21064A535, and ML21082A393, respectively), Entergy Operations, Inc. (the licensee) applied for a license amendment to Renewed Facility Operating License NPF-38 for the Waterford Steam Electric Station, Unit 3 (Waterford 3). The proposed amendment would revise Waterford 3 Technical Specifications (TSs) in order to implement a modification replacing an existing digital core protection calculator system (CPCS). Based on its review of the application, the U.S. Nuclear Regulatory Commission (NRC) staff determined that, to complete its review, it needs a response to its requests for additional information (RAIs) in Section 2 below.

The NRC staff has been using an open item (OI) process (ADAMS Accession No. ML20289A267) to support the licensing review and identify potential RAIs. The RAIs below reference OI numbers discussed during partially closed meetings held on September 22, October 21, November 4, and November 18, 2020; and January 6, January 21, February 3, February 17, March 3, and March 17, 2021. The NRC maintains OIs in a spreadsheet that is attached to the meetings summaries dated October 22 and December 17, 2020; and February 19, February 22, April 1, April 2, and April 8, 2021 (ADAMS Accession Nos. ML20288A742, ML20315A267, ML20325A321, ML20325A241, ML21032A013, ML21039A268, ML21071A286, ML21075A032, and ML21085A865, respectively).

The NRC has also audited various licensee documents to support its licensing review and identify potential RAIs. The NRCs audit plan dated October 1, 2020, as supplemented by e-mail dated March 22, 2021, is in ADAMS at Accession Nos. ML20268B324 and ML21084A255, respectively). RAIs generated from the audit are included in Section 2.0 below.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION 2.0 REQUEST FOR ADDITIONAL INFORMATION Diversity and Defense-in-Depth (DID)

For nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999 (Waterford 3 received its construction permit on November 14, 1974), Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, Section 50.55a(h), Protection and safety systems, requires protection systems to meet the requirements in Institute of Electrical and Electronic Engineers (IEEE)

Standard (Std) 279-1968, Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, IEEE Std 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, or the requirements in IEEE Std 603-1991, Criteria for Safety Systems for Nuclear Power Generating Stations, and the correction sheet dated January 30, 1995.

General Design Criterion 22, Protection system independence, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 states:

The protection system shall be designed to assure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function, or shall be demonstrated to be acceptable on some other defined basis.

Design techniques, such as functional diversity or diversity in component design and principles of operation, shall be used to the extent practical to prevent loss of the protection function.

SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor (ALWR) Designs, dated April 2, 1993 (ADAMS Accession No. ML003708021), Item II.Q, as clarified by Staff Requirements Memorandum (SRM)-SECY-93-087 (ADAMS Accession No. ML003708056), Item 18, describes the NRC position concerning defense against potential common -mode failures in digital instrumentation and controls (I&C) systems. NRC Branch Technical Position 7-19, Revision 7, Guidance for Evaluation of Diversity and Defense-in Depth in Digital Computer-Based Instrumentation and Control Systems Review Responsibilities, of NUREG-0800, Standard Review Plan for the Review of Safety analysis Reports for Nuclear Power Plants: LWR [Light-Water Reactor]

Edition (SRP), dated August 2016 (ADAMS Accession No. ML16019A344), provides guidance to NRC staff for evaluating an applicants diversity and DID assessment, design, and the design of manual controls and displays to ensure conformance with the NRC position on diversity and DID and to confirm that the licensee has reasonably addressed vulnerabilities to common-cause failures.

RAI-01 (DID, OI-35.1)

The licensees licensing technical report (LTR), LTR-TA-19-154, Waterford 3 Core Protection Calculator System Safety Function Table, Table A-1, identifies fifteen events described in Chapter 15 of the Updated Final Safety Analysis Report (UFSAR) that credit the Waterford 3 CPCS. The NRC staff requests the licensee to confirm that the events described in the UFSAR that credit the CPCS trips are limited to those events listed in LTR-TA-19-154, Table A-1. This RAI corresponds to OI 35.1.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION RAI-02 (DID, OI-35.2)

The NRC staff requests the licensee to identify the backup safety-related analog trip for each of the fifteen Chapter 15 events (discussed in the previous RAI) that credit the CPCS. If a backup analog trip does not exist for a specific event, then the NRC staff requests the licensee to identify if an alarm or other means is provided so that the licensee can take manual actions to cope with the event. This RAI corresponds to OI 35.2.

Equipment Qualification (EQ)

For nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999 (Waterford 3 received its construction permit on November 14, 1974),

10 CFR 50.55a(h) requires protection systems to meet the requirements in IEEE Std 279-1968, IEEE Std 279-1971, or IEEE Std 603-1991, and the correction sheet dated January 30, 1995.

In its license amendment request (LAR), the licensee indicated that the CPCS design meets certain clauses in IEEE Std 603-1991. Clause 5.4 of IEEE Std 603-1991 requires, in part, that safety system equipment shall be qualified by type test, previous operating experience, analysis, or any combination of these three methods to substantiate that it will be capable of meeting, on a continuing basis, the performance requirements as specified in the design basis.

A similar clause is IEEE Std 279-1971, Clause 4.4, Equipment Qualification, which the LTR states is in the licensees current licensing basis.

RAI-03 (EQ, OI-31)

In its LAR supplement dated January 22, 2021, the licensee provided the report, EQ-QR-412-CWTR3, Revision 1, Core Protection Calculator System Upgrade Project Equipment Qualification Summary Report for Waterford Unit 3, which provides EQ testing results for various equipment. The report states that some project devices, such as the Auxiliary Protective Cabinet multiplexer, analog input module AI688, analog output module AO650, and the 24-volt direct current core protection calculator (CPC) power supply assembly, failed to comply with certain EQ testing requirements. The NRC staff understands that the licensee developed new tests. The NRC staff requests the licensee to describe the resolution of the failure of electromagnetic compatibility EQ testing for applicable project equipment. This RAI corresponds to OI 31.

RAI-04 (EQ, OI-33)

In its LAR supplement dated January 22, 2021, the licensee provided the report, EQ-QR-412-CWTR3, Revision 1, which describes various EQ tests. The NRC staff finds that the project equipment under test is different for the electromagnetic compatibility, environmental, and seismic testing. The NRC staff understands that some devices were already qualified and not included in the equipment under test. The NRC staff requests the licensee to explain why the equipment under test is different for the three different types of EQ testing. This RAI corresponds to OI 33.

RAI-05 (EQ, OI-31, 33)

The NRC staff requests the licensee to provide the latest revision of EQ-QR-412-CWTR3 (if not Revision 1) as an attachment to the RAI response.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION LTR WCAP-18484 RAI-06 (LTR, various OIs)

The licensee provided WCAP-18484, Licensing Technical Report for the Waterford Steam Electric Station Unit 3 Common Q Core Protection Calculator System, in an attachment to its LAR. The LTR describes how the licensee intends to meet the applicable regulatory criteria and review guidance in NRCs Digital I&C Interim Staff Guidance (ISG)-06, Revision 2, Licensing Process, dated December 2018 (ADAMS Accession No. ML18269A259). The licensee provided the NRC, via a Web-based audit portal, a draft LTR update, which would address various OIs when submitted formally to the NRC. The NRC staff requests the licensee to provide the final version of the LTR as a supplement to the LAR.

Response Times (RT)

For nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999 (Waterford 3 received its construction permit on November 14, 1974),

10 CFR 50.55a(h) requires protection systems to meet the requirements in IEEE Std 279-1968, IEEE Std 279-1971, or IEEE Std 603-1991 and the correction sheet dated January 30, 1995. In its LAR, the licensee indicated that the CPCS design meets applicable clauses in IEEE Std 603-1991. Clause 5.5, System Integrity, of IEEE Std 603-1991, requires that the safety system be designed to accomplish its safety functions under the full range of application conditions enumerated in the design basis. A similar clause, Clause 4.5, Channel Integrity, is in IEEE Std 279-1971, which the LTR states is in the licensees current licensing basis.

RAI-07 (RT, OI-17)

Section 3.2.6, CPCS Design Function, of Attachment 4 to the LAR, describes the estimated impact of the CPCS delay time on thermal margin degradation. This section of the LAR indicates that the basis for the estimate is the control element assembly (CEA) rod drop time LAR (ADAMS Accession Nos. ML15197A106 and ML15226A346)1 submitted in 2015 that increased the CEA rod drop time in the safety analysis by an additional 200 milliseconds (ms) because of a hold coil delay that needed to be accounted for. The licensees method for the CPCS delay time estimate on thermal margin results extrapolates the thermal margin degradation of the CEA rod drop for a 200-ms delay with the increase in CPCS response times.

The NRC staff requests the licensee to:

a) explain the acceptability of the extrapolation method used to estimate the effect of the CPCS delay time on thermal margin degradation, and the methods that will be used for performing the reload analysis. This RAI corresponds to OIs 17.1 and 17.1.1.

b) identify and justify the values of the CPCS delay times used in the thermal margin estimate for each of the applicable transients and accidents listed in Table 3.2.6-1 of Attachment 4 to the LAR. This RAI corresponds to OI 17.2.

1 The NRC approved License Amendment No. 246 for Waterford 3 on November 13, 2015 (ADAMS Accession No. ML15289A143).

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION c) discuss the actions to ensure that the values of the CPCS delay time used in the thermal margin estimate are the limiting values applicable to Waterford 3 when the CPCS is installed for operation. The NRC staff also requests the licensee to clarify the adequacy of the response time requirements specified in the reference design in terms of the thermal limits (i.e., departure from nuclear boiling ratio and linear heat generation rate) calculation. This RAI corresponds to OIs 17.3 and 17.3.1.

d) explain whether the CPCS delay time values used in the thermal margin estimate are limiting values. If not, then explain the actions taken to ensure that the thermal margin estimate for the preinstalled CPCS condition is acceptable. This RAI corresponds to OI 17.4.

RAI-08 (RT, OI-36.1)

In its LAR supplement dated March 5, 2021, the licensee provided the report, LTR-GIC-20-003, Revision 1, Waterford 3 CPCS Response Time Information for FSAR [Final Safety Analysis Report] and Technical Specification, in which Table 2 identifies the proposed response times to be used in the safety analysis. Table 2.4.1.3-1, CPCS Response Times, in the report WNA-DS-04517-CWTR3, Revision 5, System Requirements Specification for the Core Protection Calculator System, identifies the minimum CPCS response times to be used in the safety analysis. Some of the response times identified in Table 2.4.1.3-1 are lower than those identified LTR-GIC-20-003. The NRC staff requests the licensee to identify which response times will be used for the proposed safety analysis criteria. This RAI corresponds to OI 36.1.

Software Development (SD)

For nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999 (Waterford 3 received its construction permit on November 14, 1974),

10 CFR 50.55a(h) requires protection systems to meet the requirements in IEEE Std 279-1968, IEEE Std 279-1971, or IEEE Std 603-1991 and the correction sheet dated January 30, 1995. In its LAR, the licensee indicated that the CPCS design meets applicable clauses in IEEE Std 603-1991. Clause 5.5, System Integrity, of IEEE Std 603-1991, requires that the safety system be designed to accomplish its safety functions under the full range of application conditions enumerated in the design basis. A similar clause, Clause 4.5, Channel Integrity, is in IEEE Std 279-1971, which the LTR states is in the licensees current licensing basis.

The acceptance criterion for testing activities is contained in the SRP, Branch Technical Position 7-14, Revision 6, Guidance on Software Reviews for Digital Computer Based Instrumentation and Control Systems, Section B.3.2.4, Acceptance Criteria for Testing Activities, (ADAMS Accession No. ML16019A308).

RAI-09 (SD, OI 41)

The NRC staff audited WNA-PD-00594-CWTR3, Software Development Plan for the Core Protection Calculator, Revision 2. Section 5.5, Software Test Plan, of WNA-PD-00594-CWTR3 states that the Waterford 3 Test Plan is derived from the Common Q Software Program Manual (SPM), Section 7, and provides a reference for the Waterford 3-specific test plan, WNA-PT-00303-CWTR3, Test Plan for the Common Q Core Protection Calculator System.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION However, the LTR does not mention the use of a Waterford 3 specific test plan. Section 5.2.9 of the LTR states, Testing will be conducted in accordance with the Common Q SPM, Section 7 describing the levels of testing of the software modules and units (e.g., MTP [maintenance and test panel] and OM [operator module]) culminating with an integrated system test. Section 7 of the SPM also describes the methodology for response time testing.

The NRC staff requests the licensee to (1) explain how WNA-PT-00303-CWTR3 is derived from the SPM, Section 7, and (2) how WNA-PT-00303-CWTR3 will be used in conjunction with Section 7 of the SPM. This RAI corresponds to OI 41.

Technical Specifications (TSs)

The regulations in 10 CFR 50.90, Application for amendment of license, construction permit, or early site permit, 10 CFR 50.34, Contents of applications; technical information; and 10 CFR 50.36, Technical specifications, require that whenever a holder of an operating license under this part desires to amend the license, the application for an amendment must fully describe the changes desired and follow the form prescribed for original applications, including proposed TSs. To ensure that the amendment contains the correct TSs, the NRC staff requests the following information.

RAI-10 (TS, OI-19)

The cover page for Attachment 2 to the LAR lists TS page 3/4 2-6a as a clean TS page; however, the mark-up and submitted clean TS page is numbered 3/4 2-6 rather than 3/4 2-6a.

The NRC staff requests the licensee to confirm that the page number (3/4 2-6a) listed in the cover page was a typographical error and that 3/4 2-6 is the correct page number.

This RAI corresponds to OI 19.

RAI-11 (TS, OI-20)

The cover page of Attachment 1 to the LAR lists TS page 3/4 10-2 as having markups; however, the marked up version of this page is not provided in the LAR. The cover page of Attachment 2 lists page 3/4 10-2, however, a clean version of this page is not included in Attachment 2. The NRC staff requests the licensee to confirm whether it intended to propose changes to this TS page and, if so, to provide the proposed marked up and clean TS pages, as applicable. This RAI corresponds to OI 20.

Vendor Oversight Plan (VOP)

For nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999 (Waterford 3 received its construction permit on November 14, 1974),

10 CFR 50.55a(h) requires protection systems to meet the requirements in IEEE Std 279-1968, IEEE Std 279-1971, or IEEE Std 603-1991 and the correction sheet dated January 30, 1995.

Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50, provides quality assurance requirements that shall be applied to the design, fabrication, construction, and testing of the structures, systems, and components.

Revision 2 of ISG-06, defines the licensing process used to support the review of LARs associated with safety-related digital I&C equipment modifications in operating plants. The OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION Alternate Review Process described in ISG-06, Revision 2, allows the NRC staff to decide whether to approve a LAR after the system design is completed and evaluated but before the system has been built and factory acceptance testing completed. Acceptability of the application-specific digital I&C platform system is partially based on the licensees oversight and evaluation of the vendors digital I&C system development process activities, as described in the licensees VOP and VOP Summary.

The licensee submitted the report, WF3F1-2021-0015, CPC Replacement Project Vendor Oversight Plan (VOP) Summary, Revision 1, in Attachment 14 of its LAR. The VOP Summary identifies the sections of the VOP and summarizes how the VOP will ensure the licensees oversight of its vendors (Westinghouse Electric Company, LLC (WEC)s) involvement (e.g., hardware, software, design documentation, and licensing documentation) in the CPCS replacement project. The NRC staff reviewed Revision 1 of the VOP Summary to verify that its described activities will ensure that all process and technical regulatory requirements will be met, and that there is reasonable assurance that the digital systems will be appropriately developed, implemented, and tested with appropriate vendor oversight by the licensee.

RAI-12 (VOP, OI 38)

The licensees execution of the VOP, as described in the LAR, as supplemented, provides confidence that the licensee will verify that its vendor executes the project consistent with the LAR, and provides reasonable assurance that the as-built and tested CPCS will continue to meet the design and quality regulatory requirements of 10 CFR 50.55a(h), via IEEE Stds 279-1971 and 603-1991, and applicable criteria in Appendix B to 10 CFR Part 50.

The NRC staff audited VOP-WF3-2019-00236, WF3 Core Protection Calculator System Replacement Project Vendor Oversight Plan, Revision 3, to identify details supporting the VOP Summarys description of vendor oversight activities and associated processes to perform these activities. However, the licensee does not describe in its LAR, the change control requirements for the VOP. Therefore, the NRC staff does not have sufficient information to determine whether the VOP will be executed as described in the LAR, with reasonable assurance that controls are in place to prevent changes in the oversight activities identified in VOP version audited by the NRC staff and the corresponding VOP Summary version reviewed by the staff that could invalidate the NRC staffs safety conclusions.

In response to OI 38, the licensee stated, in part:

The Vendor Oversight Plan (VOP) will be updated to provide wording to notify personnel of the need to review the approved Safety Evaluation Report (SER) prior to approval of changes to the document. The VOP will then be formally loaded into the Entergy document control system as an engineering controlled document via the Engineering Change process, which is governed by existing Entergy procedure EN-DC-115. Future changes to the VOP would require an Engineering Change, and as part of that change process, personnel would review the SER per added wording in the VOP to ensure non-conservative changes are not made (i.e., non-conservative changes refer to changes that reduce Entergys oversight of vendor actions or ability to meet both the process and technical regulatory requirements).

The NRC staff requests the licensee to provide this OI response in a supplement to its LAR and to clarify whether the VOP will be classified as a design document for safety-related systems OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION that is controlled under the Quality Assurance Program (QAP) for Waterford 3 and, therefore, will be subject to the engineering change control process under the QAP. This RAI corresponds to OI 38.

RAI-13 (VOP, OI 6(b), OI 9(c), OI 10, OI 27, OI 30.1)

Appendix B, Criterion III, Design Control, of 10 CFR Part 50, requires, in part, that quality standards be specified and that design control measures shall provide for verifying or checking the adequacy of design. Appendix B, Criterion VII, Control of Purchased Material, Equipment, and Services, requires, in part, that measures be established to assure that purchased material, equipment, and services from contractors (e.g., vendors) conform to procurement documents.

The licensee submitted the report, WNA-DS-04517-CWTR3, as part of its LAR. This document identifies the system requirements for the Waterford 3 CPCS. WNA-DS-04517-CWTR3 states that each requirement adopted without modification from Westinghouse Specification 00000-ICE-30158, System Requirements Specification for the Common Q Core Protection Calculator System, Revision 14, applies to the Waterford 3 CPCS. When there is a difference between the requirements in 00000-ICE-30158, Revision 14 and the Waterford 3 CPCS functional requirements, WNA-DS-04517-CWTR3 identifies how the requirements in 00000-ICE-30158, Revision 14 were modified for the Waterford 3 CPCS.

The NRC staff audited VOP-WF3-2019-00236 to identify details supporting the VOP Summarys description of vendor oversight activities and associated processes to perform these activities.

The NRC staff observed that the VOP and VOP Summary did not adequately describe how the licensee will ensure that its vendor has verified each requirement in WNA-DS-04517-CWTR3 during implementation of the CPCS system development lifecycle and, thus, how the licensee meets the requirements of Criterion III and Criterion VII of Appendix B to 10 CFR Part 50 and how the CPCS system meets the requirements of Clause 4.3 of IEEE Std 279-1971 and Clause 5.3 of IEEE Std 603-1991. Therefore, the NRC staff requests the licensee to (1) confirm it has revised the VOP to provide information regarding how the system requirements within WNA-DS-04517-CWTR3 that were adopted without modification from 00000-ICE-30158, Revision 14, will be verified, including tested as part of factory acceptance testing, by the licensees vendor oversight activities, and (2) supplement the LAR with the corresponding changes to the VOP Summary to reflect these VOP changes. This RAI corresponds to OI 6(b),

OI 9(c), and OI 30.1.

RAI-14 (VOP, OI 21, OI 30.2)

In its LAR, the licensee stated that the CPCS design meets applicable clauses in IEEE Std 603-1991, which has the following clauses:

Clause 5.4, Equipment Qualification, requires that safety system equipment shall be qualified by type test, previous operating experience, or analysis, or any combination of these three methods, to substantiate that it will be capable of meeting, on a continuing basis, the performance requirements as specified in the design basis. A similar clause, Clause 4.4, Equipment Qualification, is in IEEE Std 279-1971, which the LTR states is in the licensees current licensing basis.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION Clause 5.5, System Integrity, requires that the safety system be designed to accomplish its safety functions under the full range of application conditions enumerated in the design basis. A similar clause, Clause 4.5, Channel Integrity, is in IEEE Std 279-1971, which the LTR states is in the licensees current licensing basis.

Clause 5.6.1, Independence Between Redundant Portions of a Safety System, requires, in part, that redundant portions of a safety system provided for a safety function shall be independent of and physically separated from each other to the degree necessary to retain the capability to accomplish the safety function. A similar clause, Clause 4.6, Channel Independence, is in IEEE Std 279-1971, which the LTR states is in the licensees current licensing basis.

Clause 5.6.3, Independence Between Safety Systems and Other Systems, requires, in part, that the safety system design shall be such that credible failures in and consequential actions by other systems shall not prevent the safety systems from meeting the requirements of this standard. A similar clause, Clause 4.7, Control and Protection System Interaction, is in IEEE Std 279-1971, which the LTR states is in the licensees current licensing basis.

Criterion III of Appendix B to 10 CFR Part 50 requires, in part, that quality standards be specified and that design control measures shall provide for verifying or checking the adequacy of design. Criterion VII requires, in part, that measures be established to assure that purchased material, equipment, and services from contractors (e.g., vendors) conform to procurement documents.

Section 5, Determine Performance Measures and Acceptance Criteria, of the VOP Summary identifies physical, performance, environmental, and cyber as critical characteristics that, once verified, will provide reasonable assurance that the system will perform its intended critical functions. Section 5 of the VOP Summary identifies the oversight activities that will be performed to verify these critical characteristics.

The NRC staff audited VOP-WF3-2019-00236, Revision 3, to verify details supporting the VOP Summarys description of the VOP. Section 7 of the VOP provided detailed descriptions of each type of critical characteristic. In addition, for performance characteristics, the VOP identified a list of functions that will be confirmed as a minimum for the CPCS project. The NRC staff reviewed this list of functions and did not find the central processing unit (CPU) load design restrictions for the CPCS project as functions that will be verified by the licensee under this list.

As stated in Section 3.2.7.2.7 of WCAP-18484-P, ((

)) Therefore, verifying that the CPCS meets the CPU load restrictions is critical for ensuring deterministic behavior of the CPCS. As such, the CPU load restriction is a critical characteristic that the licensee should specifically verify in the as-built CPCS in order to demonstrate that the complete designed, implemented, and tested CPCS meets the deterministic behavior criteria in Clause 5.5 of IEEE Std 603-1991 and Clause 4.5 of IEEE Std 279-1971.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION In addition, the VOP Summary does not contain sufficient information regarding the description of the environmental, performance, and physical characteristics necessary for the NRC staff to conclude that the complete designed, implemented, and tested CPCS meets the standards in Clauses 5.4, 5.5, 5.6.1, and 5.6.3 of IEEE Std 603-1991, and the corresponding Clauses 4.4, 4.6, and 4.7, respectively, in IEEE Std 279-1971. Specifically, the VOP Summary does not provide a description of:

the environmental characteristics that the licensee will verify as part of the VOPs vendor oversight activities, the CPU load design restrictions and the response time and throughput for the system as performance characteristics that the licensee will verify as part of the VOPs vendor oversight activities, and the physical characteristics that the licensee will verify as part of the VOPs vendor oversight activities.

Therefore, the NRC staff requests the licensee to (1) provide descriptions and examples of functions that it will verify as part of its vendor oversight activities in accordance with Criterion III and Criterion VII of Appendix B to 10 CFR Part 50, for environmental, performance, and physical characteristics within the VOP Summary; (2) confirm it has revised the VOP to include the deterministic performance attributes (e.g., CPU load design restrictions) as a critical characteristic; and (3) supplement the LAR with the corresponding changes to the VOP Summary to reflect these VOP changes, to demonstrate the complete designed, implemented, and tested CPCS meets Clause 5.5 of IEEE Std 603-1991 and Clause 4.5 of IEEE Std 279-1971. This RAI corresponds to OI 21 and OI 30.2.

RAI-15 (VOP, OI 39)

Appendix B, Criterion III of 10 CFR Part 50 requires, in part, that quality standards be specified and that design control measures shall provide for verifying or checking the adequacy of design.

Appendix B, Criterion VII requires, in part, that measures be established to assure that purchased material, equipment, and services from contractors (e.g., vendors) conform to procurement documents.

The NRC staff audited VOP-WF3-2019-00236, Revision 3, to identify details supporting the VOP Summarys description of vendor oversight activities and associated processes to perform these activities. During this audit, the NRC staff also verified whether the licensees performance of the vendor oversight activities for the requirements phase of the CPCS development lifecycle were conducted in accordance with the VOP. The NRC staff had the following observations during the audit:

1. The description of oversight activities related to independent verification and validation (V&V) is distributed over various sections of the VOP. As a result, the VOP does not describe consistently the planned oversight activities of the vendors independent V&V tasks and reports for each phase of the CPCS development lifecycle.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION

2. The terminology used regarding requirements traceability analysis within the VOP does not distinguish between the traceability activities that will be performed by the licensee and the independent V&V activities performed by the vendor.

3. The VOP does not clearly distinguish between design artifacts that would be audited by the licensee and those that would be reviewed and accepted in accordance with the licensees procedures, EN-DC-149, Acceptance of Vendor Documents.

4. The numbering scheme used in the VOP does not allow for oversight activity topics and associated descriptions within each topic to be clearly identifiable.

Because, in part, of the issues identified in these observations, it appears that the licensee had not yet performed certain oversight activities related to vendor independent V&V tasks and outputs for the requirements phase of the CPCS development lifecycle. The VOP Summary is derived from the content of the VOP and, as such, these observations also apply to the VOP Summary. During the audit, the licensee expressed its intention to address the issues identified in the observations. Therefore, the NRC staff requests the licensee to (1) confirm that it has revised the VOP to address the issues identified in the above four observations, and (2) supplement the LAR with the corresponding changes to the VOP Summary to reflect the VOP changes, to demonstrate that the VOP and VOP Summary contain clear and consistent descriptions of vendor oversight activities to meet the requirements of Criterion III and Criterion VII of Appendix B to 10 CFR Part 50.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

ML21112A253 (Non-Public)

ML21112A254 (Public)

OFFICE NRR/DORL/LPL1/PM NRR/DORL/LPL4/LA NRR/DRO/IQVB NAME AKlett PBlechman DZhang DATE 4/15/21 4/26/2021 4/15/21 OFFICE NRR/DSS/SNSB NRR/DSS/STSB NRR/DEX/EICB NAME SSun TSweat JZhao DATE 4/7/2021 4/7/21 4/6/2021 OFFICE NRR/DEX/EICB NRR/DEX/ETLB NRR/DRO/IQVB/BC NAME RStattel SDarbali KKavanagh DATE 4/7/2021 4/7/2021 4/15/21 OFFICE NRR/DSS/SNSB/BC NRR/DSS/STSB/BC NRR/DEX/ETLB/BC NAME SKrepel VCusumano JJohnston (WMorton for)

DATE 4/8/2021 4/7/21 4/12/21 OFFICE NRR/DEX/EICB/BC NRR/DORL/LPL4/BC NRR/DORL/LPL4/PM NAME MWaters JDixon-Herrity PBuckberg (AKlett for)

DATE 4/15/21 4/16/21 4/29/21