Protecting People and the EnvironmentUNITED STATES NUCLEAR REGULATORY COMMISSION
1
1 UNITED STATES
2 NUCLEAR REGULATORY COMMISSION
3 ***
4 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
5 ***
6 SUBCOMMITTEE ON PLANT SYSTEMS
7
8 Tuesday, October 31, 2000
9
10 The subcommittee met, pursuant to notice at 8:30
11 a.m.
12
13 BEFORE:
14 AMARJIT SINGH
15
16
17
18
19
20
21
22
23
24
25
. 2
1 P R O C E E D I N G S
2 [8:30 a.m.]
3 CHAIRMAN UHRIG: Good morning. The meeting will
4 now come to order. This is a meeting of the ACRS
5 Subcommittee on Plant Systems. I am Robert Uhrig, Chairman
6 of this subcommittee.
7 Other ACRS members in attendance are Dr. Dana
8 Powers, Graham Leitch, and Jack Sieber.
9 The purpose of this meeting is to discuss the
10 safety evaluation reports for the Westinghouse/ABB/CE and
11 Siemens digital I&C applications.
12 Mr. Amarjit Singh is the cognizant ACRS staff
13 engineer and designated Federal official for this meeting.
14 The rules for participation in today's meeting
15 have been announced as part of the notice of this meeting
16 previously published in the Federal Register on October 18,
17 year 2000.
18 A transcript of the meeting is being kept and will
19 be made available as stated in the Federal Register notice.
20 It is requested that speakers first identify themselves and
21 speak with sufficient clarity and volume so that they can be
22 readily heard.
23 We have received no written comments or requests
24 to make oral statements from members of the public.
25 We will now proceed with the meeting and I call
. 3
1 upon Mr. Larry Erin, of Siemens, to begin.
2 MR. ERIN: My name is Larry Erin, work for Siemens
3 Power Corporation. I'll be giving an overview of the
4 Teleperm access safety system that's been designed by
5 Siemens and used for nuclear power plants applications.
6 The first slide that you see here is just a
7 picture of our overall I&C solutions. It's a combined
8 architecture of the Teleperm XS, which is used for safety
9 applications, and the Teleperm XP, which is used for
10 non-safety applications.
11 The platforms, again, with an interface with
12 filled components, both 1E safety applications and non-1E,
13 which are non-safety and control systems.
14 The Teleperm XS is used for the safety
15 applications. The Teleperm XP platform, an automation
16 system, is used for the non-safety applications. Typical
17 safety applications are for reactor protection, safeguards
18 actuation, safety controls, nuclear instrumentation system.
19 Also, we have a Teleperm XP operation and
20 monitoring system that is used for the plant computer type
21 applications. And the Teleperm XP also has a capability to
22 interface with other plant types of buses that are used
23 throughout the plant.
24 I'm going to give an overview of the Teleperm XS,
25 which is the safety system. Some of the basic design goals.
. 4
1 When the Teleperm XS system was developed, for the safety
2 applications, were to have short response times. Typically,
3 the I&C portion of the channel needs to respond at something
4 less than about 200 milliseconds. Proof of required
5 reliability, this needs to be highly reliable systems
6 because of the applications. And the ability to control all
7 of the postulated events.
8 Some of the important criteria for digital-based
9 safety systems would no event-driven interrupts, no code
10 optimization, and simple software structures.
11 CHAIRMAN UHRIG: Could you elaborate on that no
12 code optimization?
13 MR. ERIN: Some of the compilers that can be used
14 have methods of, I'd say, optimizing the code, minimizing
15 the usage, and some of the criteria that's been given back
16 to us from industry is that they operate more reliably if
17 you don't use the optimization features of the compilers.
18 CHAIRMAN UHRIG: Thank you.
19 MR. ERIN: Some of the elements that go into the
20 make-up of the system, standard hardware components. Some
21 of these in the I/O area have been used elsewhere in
22 industrial applications in Siemens products.
23 We have specific systems software that was
24 developed specific for the safety system applications. And
25 we have an engineering system that provides the interface
. 5
1 between the engineer and designing the application.
2 The engineering system gives us one common tool
3 that's used for both the specification of the hardware and
4 the software design, provides automatic code generation, and
5 our code generators were independently verified and
6 validated.
7 The specific systems software is based on a
8 deterministic operating system, no event-driven interrupts.
9 I've put together software libraries that have been verified
10 and used specifically for the safety system applications.
11 DR. POWERS: Could we come back to this statement
12 you made, event-driven interrupts? You said there are none?
13 MR. ERIN: That's correct.
14 DR. POWERS: I guess I don't understand what that
15 means.
16 MR. ERIN: It means once we get into our execution
17 cycle for an application, there is nothing external to the
18 system that can cause that execution cycle to be interrupt
19 and not proceed to completion of the cycle.
20 For example, if there was some other event in the
21 plant or in another channel of equipment, it is not
22 permitted to interfere. You're familiar with the
23 multi-tasking capabilities of your PC that you have at home.
24 The systems that are used for safety-related applications
25 are designed to preclude any sort of multi-tasking.
. 6
1 Once you begin to execute the safety function, you
2 have to complete that execution cycle to completion without
3 being interrupted.
4 DR. POWERS: I would just comment that, I think I
5 understand what you're saying here on this particular issue,
6 but in the documentation, there's a lot of discussion of
7 system generated interrupts and the question that came to my
8 mind throughout was the question of how interrupts are
9 handled between system generated interrupts and external
10 interrupts when they're coincident and how coincident do
11 they have to be to be coincident.
12 MR. ERIN: There are -- I think what you refer to
13 when you talk about the system generated interrupts, these
14 can be something that results from an internal diagnostic or
15 some failure fault is detected internal to the system. And
16 because of the recognition of that fault, the system fails
17 to some predetermined state.
18 Those are going to be part of the system design.
19 I guess the comment about them being coincident is there is
20 not a way or a design path for an external type of event or
21 interrupt to influence our system the way that it's
22 designed.
23 DR. POWERS: I'm sure you don't mean what you say.
24 If there's no way for the outside to influence your system,
25 then the system is not very useful.
. 7
1 MR. ERIN: Other than the, of course, the
2 naturally designed interface between the external sensors
3 and the input to the system.
4 DR. POWERS: And that's what I'm talking about.
5 If you get a system signal in or even an internally
6 generated, the one that comes immediately to mind is a
7 divide by zero error coming in because of the input to the
8 system, at the same time you get a system generated input.
9 At what points do they have to be coincident and
10 how does the system handle it?
11 MR. ERIN: I'm not sure how to respond to that
12 scenario.
13 DR. POWERS: Just bear it in mind as you go
14 through the presentation.
15 MR. ERIN: Okay.
16 DR. POWERS: I'm sure it will come up again.
17 MR. ERIN: Okay. Due to the capabilities of the
18 digital equipment and the design of existing analog systems
19 that we're upgrading, we get into situations where we're
20 able to combine many of the existing systems onto one
21 digital platform.
22 For example, typically, you have separate systems
23 currently in the plants for process protection, your ESFAS,
24 relay protection, sequencer. These functions, because they
25 share many of the same inputs, can be combined into single
. 8
1 platforms using just a few subsystems of the digital
2 platform and because of this, you end up eliminating many of
3 the hardware interfaces that exist between the current
4 systems, because you accept the input signals, do all the
5 processing in a more centralized location and then have your
6 interface with the outputs.
7 This picture is a hierarchical view of the
8 Teleperm XS system, starting with the field sensors, coming
9 in through the signal conditioning. We show that we have
10 typically have four redundant protection channel sets, a
11 monitoring and service interface, an isolation device and
12 gateway to the TXP, which is non-safety applications, and a
13 service unit that is used for the monitoring and service
14 interface.
15 Over here, also, there's a capability for inputs
16 for monitoring and manual controls.
17 This picture may be a little more clear in your
18 handout. It represents the capabilities of the space
19 engineering system, which is part of the service interface.
20 This is the engineering system that I mentioned earlier
21 that's used for hardware design, determines module location,
22 cabinet location, the network diagrams, the interfaces
23 between the communication links, the functional diagrams for
24 the system, and provides diagnostics and monitoring.
25 You can actually use this service unit to
. 9
1 interrogate the inner workings of the system, follow a
2 signal through all of its function blocks, look at its
3 signal values anywhere within the internal functional
4 diagram.
5 This whole system is based on a graphical user
6 interface to build the functional design on the screen. The
7 other functions are completed automatically by the design of
8 the system.
9 CHAIRMAN UHRIG: Is there a navigational problem
10 of going from one to the other? How do you -- what I'm
11 getting at here is, is this a hierarchical system and each
12 one that you have to sort of go down through it? Can you
13 jump from somewhere low in, say, network diagrams over to
14 somewhere in the lower part of diagnostics and monitoring,
15 or do you have to go to the top of diagnostics and
16 monitoring and go down?
17 MR. ERIN: I need to defer to someone who knows
18 the answer, and he just nodded yes. The internal links
19 allow you to go automatically from one screen to the other.
20 MR. WINKLER: My name is Martin Winkler, with
21 Siemens. The systems supports, both horizontal and vertical
22 navigation features to go through those diagrams, so the
23 different types of diagrams are connected by those
24 navigation features.
25 CHAIRMAN UHRIG: Okay. So you should have no
. 10
1 problem of going wherever you want to go directly without
2 having to go through a whole sequence.
3 MR. ERIN: Correct.
4 CHAIRMAN UHRIG: Like you typically do on a
5 computer.
6 MR. ERIN: This is just a single line
7 representation of the signal flow through the system. At
8 the top, for protection channel set one, you have your data
9 acquisition block. It comes into the processing portion of
10 the TXS and down below we have an actuation voting, where
11 two out of four function is completed.
12 Now, the lines that you see toward the redundant
13 channel sets, these represent communications between
14 channels. It's not a mandatory configuration, but in our
15 typical recommended configuration for the reactor protection
16 system, we'll take the information that's in protection
17 channel set one and share it with protection channel sets
18 two, three and four and it gives you the capability to do
19 the two out of four voting for any parameter four times.
20 It can be done in each of the four redundant
21 channel sets and then it can be done by this voting logic
22 one more time down below just to vote whether or not two of
23 the four channel sets had voted two out of four for a
24 particular function.
25 So it's an extra layer of two out of four voting
. 11
1 is provided as a capability beyond what you would get in the
2 analog system.
3 DR. POWERS: Is it clear that having an extra
4 layer of two out of four voting is a good thing?
5 MR. ERIN: I think there is an opinion that it's a
6 good thing. It gives you some advantages in terms of
7 operability when you're performing surveillance tasks and
8 doing maintenance.
9 One of the protection channel sets can be defeated or shut
10 down for maintenance and you still have the capability of
11 two out of three in the remaining channel sets, where if you
12 wanted to design the application to default the one out of
13 three, you can do that, also. It's up to the user and there
14 is going to be an interface with the plant-specific tech
15 specs on which way they decide to go.
16 But in my opinion, there's operability advantages
17 from having the extra voting and being able to effectively
18 be in a bypass condition when you perform surveillance tests
19 and when you're doing maintenance.
20 CHAIRMAN UHRIG: So you can take any one of those
21 sets out of service for maintenance, signals coming from
22 that particular channel.
23 MR. ERIN: Yes.
24 CHAIRMAN UHRIG: Could you take two out
25 simultaneously?
. 12
1 MR. ERIN: Two redundant channel sets?
2 CHAIRMAN UHRIG: Yes. Or if you had a glitch --
3 say you had one out for maintenance and you had a glitch, a
4 transient of some sort in one system, this could handle that
5 then.
6 MR. ERIN: That's the idea of going into bypass.
7 If you take one out for maintenance and you stay two out of
8 three on the remaining three as opposed to going one out of
9 three, that transient on one of the three remaining systems
10 doesn't trip the plant.
11 CHAIRMAN UHRIG: Yes. I thought it was, but I
12 wanted to make sure.
13 MR. ERIN: Yes. That's the operability advantage.
14 CHAIRMAN UHRIG: Okay. This feeds into then two
15 trains that are virtually independent.
16 MR. ERIN: Train A, train B, completely
17 independent trains.
18 CHAIRMAN UHRIG: Even though they're feeding from
19 the common set of signals coming from sets one, two, three
20 and four.
21 MR. ERIN: These are isolated data links. So that
22 no fault on one side of the data link can go back and
23 degrade a function on the input side of the data link.
24 What you end up with here, take steam generator
25 level, for example, you have four channels of steam
. 13
1 generator level. Say you're looking at your low level
2 protection. Instead of having channel one, two, three and
3 four for a particular steam generator, just spread over the
4 four redundant sets.
5 Each one of these redundant channel sets votes two
6 out of four on the steam generator level. So you're two out
7 of four on steam generator level here, here, here and here
8 and what we're doing with this voter is simply saying did
9 two of the four redundant channel sets vote at least two out
10 of four low level for steam generator level.
11 In the analog system, no voting would be done
12 until you got down here to the voting portion, to the relay
13 portion of the system, because these protection channel sets
14 would not communicate with each other in the analog system.
15 CHAIRMAN UHRIG: Is there a way of propagating a
16 problem with one of the four channels there from one to the
17 other? You're showing the cross links there. Suppose you
18 had a short in a signal coming into set one or within the
19 protection logic, for instance.
20 MR. ERIN: The isolation would protect you from
21 any electrical types of faults. Now, the other thing that
22 we can do and we typically designed it into the application
23 is that we will compare each input versus the other three
24 and if one of the inputs deviates from the other three by
25 some predetermined amount, then it is rejected from being
. 14
1 processed further through, because it's considered to be a
2 failed signal.
3 CHAIRMAN UHRIG: And this is all sample systems,
4 so that you -- each sampled set goes through that test.
5 MR. ERIN: Correct.
6 CHAIRMAN UHRIG: This set might have one signal
7 thrown out, the next one might be all four would be
8 satisfactory.
9 MR. ERIN: If you were right on the edge, that's a
10 possibility.
11 MR. LEITCH: Could this system be utilized in an
12 application where there were four trains?
13 MR. ERIN: It could be. The system is just basic
14 building blocks and the user can configure and interconnect
15 those building blocks in accordance with whatever his
16 specification or functional design is.
17 Just a little more detail here from the previous
18 figure. You can see the four redundant channel sets, one,
19 two, three and four. The independent voters, train A and
20 train B that we talked about.
21 An interface with the main control board
22 enunciator system and the interface with our monitoring and
23 service interface equipment, which connects with the service
24 unit, which is used for the monitoring and the engineering
25 functions associated with the system.
. 15
1 These are the gateways which allow the conversion
2 of the digital information in the safety system to be passed
3 on to the plant bus, the XP plant bus and the TXP operation
4 and monitoring system.
5 This picture is a representation of surveillance
6 tests and combined automatic and user initiated testing
7 that's provided with the TXS system.
8 Over on the left-hand side you can see the on-line
9 monitoring. This on-line monitoring is done automatically,
10 executed every cycle. The periodic testing is tests that
11 are not done automatically, but they are initiated by the
12 user.
13 CHAIRMAN UHRIG: Once they're initiated, are they
14 then automatically carried out?
15 MR. ERIN: There's a degree of automation in each
16 of these. For example, the startup self-test when you
17 reboot the system. There's a sequence of tests that are
18 performed every time on a reboot and, of course, that's
19 automatic.
20 We have the cyclic self-monitoring that's done
21 every cycle, monitoring on the bus communication system.
22 There are tests that are done, these engineered input checks
23 are called engineered checks because these are designed by
24 the user. They're part of the application.
25 If you decide to do that check of one redundant
. 16
1 sensor versus the other three and compare it versus some
2 delta, that's something that the user can set up. So we
3 call it an engineered check.
4 There's a capability to check the relay output
5 signals. We have check-backs built in that's automated into
6 the design.
7 And there's automatic cabinet and sub-rack
8 monitoring, things like power available to the sub-racks,
9 cabinet door open alarms, all these types of things are part
10 of the on-line monitoring.
11 Over on the periodic testing, there is a startup
12 self-test that would be done periodically when you reboot
13 the processor subsystems. There is an input test that could
14 be initiated by the user. It's like a traditional test you
15 would do on an analog system, disconnect the sensor, inject
16 the signal, follow the signal, check the calibration
17 accuracy of your equipment.
18 Output tests are available both go and non-go,
19 where you can actuate the interface or choose not to actuate
20 it if it's one that you would not want to actuate in the
21 plant, and we have the capability for response time test.
22 MR. LEITCH: When you say disconnect the signal, I
23 assume the system is built in such a way that that does not
24 involve any actual lifting of leads or --
25 MR. ERIN: Correct.
. 17
1 MR. LEITCH: That the system is built to
2 facilitate this. There's no jumpers, no lifted leads.
3 MR. ERIN: No jumpers, no lifted leads. We have a
4 portable test machine that facilitates the test and we're
5 able to automatically disengage the sensor from the system
6 and inject our test signal.
7 CHAIRMAN UHRIG: Is your test signal digital or
8 analog? Does it go through the A-to-D converter?
9 MR. ERIN: Yes, it does. It's an analog input.
10 CHAIRMAN UHRIG: It checks the converter then.
11 MR. ERIN: We need to do that to check the
12 calibration accuracy of the front-end portion of the
13 equipment.
14 This is a picture of a typical Teleperm XS rack
15 and subsystem. These are the ones that have been used in
16 applications in Europe.
17 Up at the top of the cabinet here, you see the
18 microprocessor subsystem, our processing boards,
19 communication processors.
20 Some of the I/O devices are shown down here at the
21 bottom. The interfaces for communication data links are
22 over on the left-hand side. This is just a little larger
23 picture of the subsystem over here on the left-hand side.
24 Just to give you an idea physically of what the equipment
25 looks like.
. 18
1 CHAIRMAN UHRIG: What are the dimensions, standard
2 rack width?
3 MR. ERIN: Nineteen inch racks.
4 CHAIRMAN UHRIG: Does this whole system fit in one
5 rack, several racks?
6 MR. ERIN: It depends on the amount of I/O in the
7 application, but what we have seen in typical applications
8 is that we're able to reduce the amount of cabinet space
9 that was required for the analog system. There's a space
10 efficiency that's gained by going to the digital equipment.
11 CHAIRMAN UHRIG: On a backfit, you would have
12 plenty of room.
13 MR. ERIN: Yes. We end up having some of the
14 cabinets that previously had analog equipment in them become
15 spares on the backfits.
16 And these are just some pictures of the various
17 boards, TXS processing module, communication, digital output
18 module, and the analog input module, where the A-to-D
19 conversion is done.
20 CHAIRMAN UHRIG: What accuracy on the A-to-D
21 conversion, 16-bit or 12-bit?
22 MR. ERIN: It's 12-bit.
23 CHAIRMAN UHRIG: A tenth of a percent. No. It's
24 better than that.
25 MR. ERIN: A little higher. This was just a
. 19
1 summary of some of the features we had just talked about.
2 They're in the handout. I don't think I'll read them to
3 you.
4 The next portion of the presentation was a
5 discussion --
6 MR. LEITCH: I have a couple of general questions.
7 Maybe this is going to be covered later, but what are the
8 typical customers for this type of a system now? In other
9 words, is this an existing nuclear plant that wants to
10 retrofit with this kind of equipment or is this being
11 proposed for brand new plants or how does that work?
12 MR. ERIN: Depending on the region of the world
13 where we're working. In China, for example, we're
14 installing this equipment in two completely new Russian
15 designed plants, where we're providing the I&C with the
16 Siemens Teleperm platforms.
17 In the United States, the current market is
18 completely retrofit. We have a lot of customers that have
19 equipment that's 15-20 years old, many of them are currently
20 going for life extension, and they're looking to modernize
21 the I&C systems for a variety of reasons, spare parts and
22 maintenance being one of the big ones.
23 And we're taking this equipment and retrofitting
24 it into the existing cabinets and removing the analog
25 equipment.
. 20
1 MR. LEITCH: Is that retrofit then an all or
2 nothing situation or can one have this platform, if that's
3 the right term, and partially retrofit?
4 MR. ERIN: It's always going to be done piecemeal,
5 just because of the shear logistics of the amount of time
6 that it takes to remove an existing system and install a new
7 one compared to the typical outage time that's available.
8 So we look for ways where it makes sense to
9 combine certain systems to replace at particular outages and
10 then the next outage you move to the next group of systems
11 that make sense. So it's always done in a piecemeal type of
12 way.
13 MR. LEITCH: But the basic Teleperm system, as I
14 understand it, would be installed once and then at
15 subsequent outages you could retrofit certain portions or
16 certain systems.
17 MR. ERIN: On the safety side, typically, it's
18 done a couple systems at a time and these can be interfacing
19 types of systems. For example, you would almost always want
20 to take your process protection where you acquire your
21 temperatures, pressures, flows and levels, the process side,
22 and interface with the loading. You take those signals, you
23 read them, you go through by stables where you compare them
24 to their set points and then you do the two out of four
25 voting.
. 21
1 In the current plants, the process portion and the
2 voting portion are almost always different equipment types,
3 but you would want to combine those and replace them during
4 the same outage if you're going to a digital system because
5 it makes sense due to the information that's already
6 available as inputs to the system.
7 But you might have a stand-alone system, like a
8 diesel generator load sequencer, that's independent of the
9 process protection and that could be done on a stand-alone
10 basis or at a different outage, if someone chooses to
11 upgrade that system.
12 MR. LEITCH: And would the main motivation be
13 obsolescence of existing equipment or is there a reliability
14 improvement perceived with this system?
15 MR. ERIN: I believe there's always reliability
16 improvements with the digital platforms that are available
17 today. But it doesn't seem to be the motivation. The
18 utility motivation seems to be obsolescence issues,
19 maintenance issues, cost of spare parts and in addressing
20 those problems, if they're able to improve reliability and
21 operability, then those are benefits that also come along
22 with the upgrade.
23 Occasionally you might have a troublesome system
24 that you want to upgrade because it's causing you so many
25 maintenance problems or maybe even occasionally causes a
. 22
1 plant to trip and that would be a good reason for targeting
2 that system at the very front part of your upgrade schedule.
3 MR. SIEBER: How sensitive is your system to
4 disturbances in input power? For example, both A/C and D/C
5 buses in a power plant are very noisy, with circuit breakers
6 closing and loads starting up and inductive devices doing
7 their thing.
8 MR. ERIN: There's requirements that are very
9 specific for EMI/RFI and surge protection and as I go
10 through the NRC review, I will make reference to some of the
11 standards that were used regarding acceptance criteria in
12 that area.
13 MR. SIEBER: Does your equipment do the power
14 conditioning or is that something that the owner has to
15 apply when he installs your equipment?
16 MR. ERIN: We accept 118 volts A/C that has gone
17 somewhat through the owner's power system. It's coming from
18 a Class 1E inverter. The input signal that we see.
19 MR. SIEBER: I ask that question because I've had
20 a couple of ugly experiences with digital systems on D/C
21 buses where the opening and closing of contactors put surges
22 in the line and would reset the CPUs, and it was bad news.
23 MR. ERIN: This figure represents some of the
24 criteria that were looked at as part of our generic
25 qualification of the system and also provides some
. 23
1 separation between elements that were looked at generically
2 and things that still remained to be looked at on a
3 plant-specific application basis.
4 As part of the generic qualification, we just
5 mentioned EMI/RFI and surge withstand qualification to
6 environmental conditions and environment, seismic
7 conditions, depending on the plant and the floor responses
8 and rack responses. We need to satisfy a seismic
9 qualification criteria.
10 There is a generic verification/validation of our
11 system software design, no engineering tools that are used
12 by the user for the system. Diversity and defense-in-depth
13 methodology is one of the items that was looked at on a
14 generic basis.
15 As you get into the particular application with
16 any specific utility, they're going to have specific design
17 requirements, functional requirements, that have got to be
18 implemented and verified for that application. There is
19 going to be a plant-specific diversity and defense-in-depth
20 assessment that's going to be specific to their particular
21 I&C configuration. It's going to be specific to their
22 particular Chapter 15 accident analysis.
23 And there are going to be validation tests that
24 have to be performed on a plant-specific basis in order to
25 validate that the equipment has been designed properly and
. 24
1 the application has been installed properly on the digital
2 equipment.
3 As part of our review process with the NRC staff,
4 I guess I will mention that this was one of the first major
5 applications that's been reviewed since the new standard
6 review plan, and I believe the ACRS had some input to.
7 There were a variety of documents that we
8 submitted to the staff in order to support our system.
9 There was a topical report that was done. It was a general
10 topical report which described the system, described the
11 system hardware, the software design, compliance with key
12 criteria.
13 In addition to that, there were a number of other
14 reports that were submitted along the way.
15 We had a specific report to discuss all the
16 periodic surveillance test capabilities of the TXS system.
17 There was a report for the shielding and grounding
18 guidelines for application of the Teleperm XS.
19 CHAIRMAN UHRIG: Now, these three reports have
20 been submitted and have been approved by the NRC, correct?
21 MR. ERIN: They were all reviewed and discussed in
22 the safety evaluation.
23 CHAIRMAN UHRIG: So that a vendor -- I mean, a
24 utility now could come in with an application to install
25 this equipment and make reference to these reports.
. 25
1 MR. ERIN: Sure. That was the idea of submitting
2 reports up front, having a generic review, and then for a
3 plant specific application, the utility makes reference to
4 the generic reports and addresses the plant specific open
5 items that were discussed in the staff safety evaluation.
6 CHAIRMAN UHRIG: These are the three main ones.
7 Are there any others?
8 MR. ERIN: We've got a few more here.
9 CHAIRMAN UHRIG: Okay.
10 MR. ERIN: We had a couple on diversity and
11 defense-in-depth. One was a methodology to show how we
12 would recommend going about being consistent with Branch
13 Technical Position 19 and NUREG-6303, which was discussed in
14 BTP-19.
15 And we also did a typical application of our methodology to
16 show how, for a typical plant, using our methodology and our
17 recommended architecture, we would end up addressing
18 diversity and defense-in-depth and how we would segregate
19 our various systems.
20 This is just a summary of the systems that can be
21 upgraded using the TXS, your typical plant safety systems,
22 process protection, logic voters, ESFAS, diesel generator
23 load sequencers, safety-related BLP functions and Class 1E
24 controls would be the target systems.
25 CHAIRMAN UHRIG: Typical installation by a utility
. 26
1 would involve all of these or would it be one or two or what
2 has been your experience so far? What do you anticipate?
3 MR. ERIN: We've seen customer interest and
4 proposals ranging from any one of these systems to utilities
5 that have a vision that they want to replace all of these
6 systems in some sort of phased approach.
7 It's really been a combination of all of the
8 above.
9 CHAIRMAN UHRIG: So that you could install just
10 one of these, make reference to the appropriate documents
11 that you just listed.
12 MR. ERIN: Sure.
13 CHAIRMAN UHRIG: And submit it to the NRC and
14 address the open items.
15 MR. ERIN: Yes. And further generic aspects of
16 the equipment qualification, the system software design, the
17 verification and validation that was done on the platform.
18 It doesn't matter what the application is. So those generic
19 things, I think the NRC safety evaluation addresses very
20 well and the items that would be plant-specific open items
21 were also identified in the safety evaluation by the staff.
22 CHAIRMAN UHRIG: Now, each one of these modules
23 here has its own microprocessor system and its own
24 programming, so that you don't in any way tie those
25 together.
. 27
1 MR. ERIN: Typically, that's correct. The ESFAS
2 and the process protection sometimes are intermingled,
3 because some of the functions that are in process protection
4 are also in the front-end for ESFAS. So you get some
5 intermingling in that area.
6 And that is one of the things that is looked at
7 when you do the diversity and defense-in-depth evaluation.
8 You break your system into like blocks, you postulate
9 potential common cause failures of those like blocks, and
10 you make sure that you have adequate protection remaining
11 for the plant.
12 CHAIRMAN UHRIG: Do you use your own
13 microprocessors or do you use --
14 MR. ERIN: Siemens, we use our own.
15 CHAIRMAN UHRIG: You use your own.
16 MR. ERIN: Yes. The design of our microprocessor
17 boards, we go back to Intel for some of our chips. But the
18 microprocessor boards are Siemens' design.
19 CHAIRMAN UHRIG: Like the Intel is something like
20 Pentium?
21 MR. ERIN: 486's, Pentiums, we've used various
22 Intel processors.
23 MR. SIEBER: The diesel generator load sequencer,
24 that's a stand-alone device, is it not? Generally powered
25 by D/C.
. 28
1 MR. ERIN: I'm not certain.
2 MR. SIEBER: Well, if you have a station blackout,
3 that's all that's left.
4 MR. ERIN: Okay.
5 MR. SIEBER: Getting back to my other question,
6 this is where all the spikes come from. Is that tested so
7 that a spike on a D/C bus won't reset the load sequencer and
8 prevent the diesel from loading?
9 MR. ERIN: Any of our input power signal
10 conditioning would have to undergo surge withstand testing.
11 That's a requirement for any safety-related system.
12 In the area of equipment qualification, I wanted
13 to mention briefly the approach that was used. We were
14 looking for some industry document that had the best
15 collection of requirements and acceptance criteria in this
16 area and the one that we used, and was also used by the
17 staff during the review, was EPRI Topical Report 107-330.
18 It was a generic requirement specification for
19 commercially available PLCs that was written over the last
20 couple of years.
21 It was a very good benchmark document because
22 there was a broad range of industry representation on the
23 group that wrote the requirements document, including staff
24 representation, and then through EPRI, they submitted that
25 topical report to the staff for review and safety
. 29
1 evaluation.
2 So it became what I will say is a very good
3 benchmark and very good precedence for the current
4 requirements in the area.
5 We had prepared a report and submitted it to the
6 staff, TR-114-017, which compared all of our system design
7 and qualification items versus the EPRI requirements.
8 So once we had a benchmark established, we then
9 prepared a matrix showing exactly where we stood versus all
10 the EPRI requirements and that was part of the review
11 process.
12 CHAIRMAN UHRIG: Now, this is for PLCs. But
13 you're using microchips.
14 MR. ERIN: The PLCs really are very close to a
15 distributed processing system. And the requirements for a
16 digital PLC and a distributed processing system are very
17 much the same.
18 CHAIRMAN UHRIG: Physically they are, the
19 difference being one is better logic or some hard
20 programming versus the software.
21 MR. ERIN: Typically designed maybe for more
22 stand-alone applications, smaller applications, but PLCs in
23 recent years have become very powerful and some of the more
24 state-of-the-art PLCs can do most of the things that a
25 distributed system would do.
. 30
1 Some of the criteria that was used by the staff
2 during the review for which we responded to. Of course,
3 NUREG-0800, revision of the standard review plan, Section 7
4 on I&C provided a lot of guidance, a lot of details. Branch
5 Technical Position HICB-8 is guidance for application of Reg
6 Guide 1.22, discussed some of the requirements for periodic
7 surveillance testing. HICB-14 was one of the new ones that
8 was in the rewrite of the standard review plan guidance on
9 software reviews for digital computer-based systems, was
10 used throughout the review.
11 HICB-17 provided guidance on self-test and
12 surveillance test provisions. Again, that was one of the
13 new branch technical positions that was written for digital
14 systems.
15 HICB-19, I mentioned a little earlier, provided
16 the guidance for evaluation of diversity and
17 defense-in-depth; also references NUREG-6303, which was
18 used.
19 The EPRI document I talked about a little earlier
20 provided a benchmark for qualificational requirements. And
21 in the area of EMI/RFI and surge withstand, EPRI-107-330
22 refers to EPRI TR-102-323, which was the document which gave
23 the results of all the surveys that were done by the EPRI
24 group to try and come up with enveloping environments of EMI
25 and RFI for the nuclear power plants.
. 31
1 CHAIRMAN UHRIG: What about things like smoke,
2 fire resistance? Is there any testing as far as smoke is
3 concerned, any attempt to address that?
4 MR. ERIN: I don't recall a specific NRC criteria
5 for smoke resistance. We don't run any special test for
6 smoke. I think there are some guidelines for using fire
7 retardant materials as you design your system, but the
8 specific test of the equipment for smoke is not done.
9 CHAIRMAN UHRIG: The concern here is the arc-over
10 associated with ionization brought on by the smoke in this
11 type of thing. I guess that's still a research area.
12 MR. ERIN: I don't know. If you have a control
13 room fire, there may be some other actions that are
14 necessitated prior to worrying about the equipment. You
15 probably be in some sort of administrative action to shut
16 down anyhow.
17 MR. SIEBER: Have you done any aging tests of your
18 equipment to see how long it will function properly?
19 MR. ERIN: There's a sequence of testing that is
20 done to address aging. The environmental test, for example,
21 are done prior to seismic tests. EMI/RFI tests are done.
22 We perform what I will say are thousand hour tests as part
23 of our type testing and in addition to what I'll say are the
24 sequence of testing, aging is also addressed through
25 periodic test process. We establish periodic test intervals
. 32
1 that are effective to catch failures and make sure the
2 equipment is still reliable.
3 We don't, for example, if you're asking if we take
4 equipment and test it for five or ten years, that type of
5 long-term aging, that's not done for the equipment.
6 Some of the plant specific interfaces that remain
7 that you might be interested in. I showed before on a
8 pyramid that each plant is going to have a plant specific
9 diversity and defense-in-depth assessment. There will be a
10 safety analysis confirmation for accuracy and time response,
11 technical specification confirmation, depending on how you
12 want to use these capabilities for bypass during test and
13 maintenance that affects your plant tech specs.
14 We need to make sure that the plant specific
15 environment has been enveloped by EPRI-107-330 and 102-323.
16 I haven't seen any cases where they're not.
17 There's plant specific enunciator and status light
18 arrangements and plant specific configuration management
19 procedures once they accept the new equipment.
20 And the conclusion, which came out of our safety
21 evaluation we received from the staff, it was based on the
22 information provided and review conducted.
23 The staff concluded that the design of the TXS
24 system was acceptable for safety-related I&C applications
25 and meets the relevant regulatory requirements.
. 33
1 DR. POWERS: I think I read that you tested the
2 material for -- the system for seismic concerns.
3 MR. ERIN: Yes.
4 DR. POWERS: And in that test, you operated in a
5 system that vibrated it at right at frequencies for one
6 minute.
7 MR. ERIN: I'm not certain about the one minute,
8 but there's IEEE-344 guidelines for the OBEs and the SSEs.
9 DR. POWERS: A relatively short period of time.
10 Have you also considered how it would perform during a plant
11 blow-down and the associated and very long-term vibrations
12 of the system during blow-down?
13 MR. ERIN: We haven't done anything beyond the
14 requirements in IEEE-344.
15 DR. POWERS: Would you imagine that there might be
16 some challenges there?
17 MR. ERIN: Something I hadn't considered.
18 DR. POWERS: I guess what I'm asking is in this
19 relatively short seismic test, which presumably the system
20 passed with flying colors, was there any indication that had
21 it gone on for an hour, like a blow-down might, would the --
22 that it might not have passed?
23 MR. ERIN: I can tell you, just based on our
24 experience, we used the same test specimen for many, many
25 different seismic tests, to the point where we stressed that
. 34
1 equipment, I would say, in four or five different seismic
2 test programs without causing any failures in that equipment
3 due to fatigue.
4 I would say, just based on that experience, I
5 would feel like, from a structural mechanical standpoint,
6 we're pretty robust.
7 DR. POWERS: That's what I was looking for.
8 MR. ERIN: I have a few minutes left. The last
9 section I have just provides some information on references
10 where the Teleperm XS has actually been used.
11 These sheets provide references for both our
12 Teleperm XS and our Teleperm XP platforms. Over on the
13 right-hand side, we show columns one for TXP and one for
14 TXS.
15 The ones that are currently in operation in
16 nuclear power plants have check marks over on the right-hand
17 side. We talked a little bit right at the very beginning
18 of the presentation, some of the US applications that are
19 planned, both the Callaway and Comanche Peak plants plan to
20 use both Teleperm XS and Teleperm XP for comprehensive I&C
21 upgrades and these are just beginning. We entered into a
22 contract with Callaway in the spring and with Comanche Peak
23 just a couple of months ago.
24 Some of the applications in Europe for TXS are for
25 reactor control limitation systems. I show some other ones
. 35
1 here. Reactor protection system, neutron flux measurement
2 at the Paks power plant in Hungary. That's a four-unit
3 application.
4 Bohunice is a reactor protection and limitation
5 system. A few more on this sheet. Beznau is a reactor
6 protection system upgrade and NSSS control system upgrade in
7 Switzerland that has recently been installed and the one I
8 mentioned in China is Tianwan, there are two brand new
9 nuclear power plants, Russian designed plants, and Teleperm
10 XS and XP is being used for the complete I&C, both safety
11 and non-safety.
12 CHAIRMAN UHRIG: Are those VVER?
13 MR. ERIN: Yes, VVR-1000.
14 CHAIRMAN UHRIG: The neutron flux measurement
15 system, is this the complete system or is it just you, for
16 instance, put in the self-power detectors or is that part of
17 the system that you just attach on and take the signals from
18 there?
19 MR. ERIN: I'll defer. Do you know, Mark?
20 MR. WINKLER: We are talking about the Teleperm XS
21 application and the Teleperm XS, of course, has to receive
22 the analog signals somehow from the nuclear detectors.
23 So there are different possibilities. Either you
24 maintain the existing analog portion, which provides voltage
25 level signals, or we also have a different product line
. 36
1 capabilities to directly get the information from the
2 nuclear detectors.
3 CHAIRMAN UHRIG: But you don't provide the
4 detector, the whole system.
5 MR. WINKLER: Siemens also provides detectors.
6 CHAIRMAN UHRIG: It does. So you could, for
7 instance, put in a whole monitoring system.
8 MR. WINKLER: Siemens has the capabilities, yes,
9 to provide that.
10 CHAIRMAN UHRIG: Are you finished?
11 MR. ERIN: Yes. That's all I had prepared. Are
12 there any questions from the committee members?
13 DR. POWERS: I wonder if I could just ask some
14 questions for personal information, because I don't
15 understand, and it's on this signal on-line validation using
16 the second minimum principal, second maximum principal. I
17 guess my question is you're avoiding using the first minimum
18 and the first maximum because you think they may not be
19 correct. And why do you think the second is correct?
20 MR. ERIN: One of the reasons could be that you
21 don't think the first is correct, the -- what we're really
22 accomplishing by using that second minimum or second maximum
23 is it's another way of performing a two out of four voting.
24 If you're, say, for example, looking at steam
25 generator low level protection and if you operate your
. 37
1 comparitor based on the second minimum and you have all four
2 signals represented and your function is off the second
3 minimum, it gives you the same functional effect as a two
4 out of four vote, and that's really how it is used in each
5 of the four channel sets.
6 You would use the second max, if it's a trip on
7 high function.
8 DR. POWERS: Thank you.
9 MR. LEITCH: With these European plants, where the
10 system is in operation, have you had significant startup
11 problems resulting in, say, reactor trips or other
12 misoperations before you --
13 MR. ERIN: No, we haven't, and one thing that I
14 meant to point out and didn't is in all the operating
15 experience that we have in Europe, we've never experienced a
16 software failure in the field.
17 So the experience has been very good. The
18 reliability of the hardware components in actual operation
19 has exceeded our design calculations that we expected for
20 reliability, also. So we are very pleased with the
21 experience that we've had to date.
22 MR. LEITCH: Can you say a word or is it beyond
23 the scope of what you do, that is, the training of utility
24 personnel. In other words, I'm a little -- what concerns me
25 is you put in this system and it works fine and you lock up
. 38
1 the door and leave. Is there anybody in the power plant
2 that really understands the operation of this system?
3 Do you do some training of I&C techs?
4 MR. ERIN: We do a lot of training of both
5 technician and engineering personnel on the application of
6 the system and as part of that training, they also come to
7 understand the design fairly well, also.
8 But certainly the utility people become very
9 experienced and very proficient with the capabilities and
10 the application of the equipment.
11 MR. LEITCH: Are there protections against I&C
12 personnel interfering with or somehow, say, changing the
13 software inadvertently?
14 MR. ERIN: There's certainly levels of password
15 protection that are used for various personnel that have
16 various authorization privileges. There's key lock
17 switches; of course, there's administrative controls,
18 there's door open alarms. There is a sequence of
19 protections that would have to be violated for an
20 unauthorized person to somehow access and change the
21 software.
22 MR. LEITCH: My concern is that we're very
23 concerned in licensed reactor operators. Yet, I think in
24 some cases, we're putting in the hands of I&C techs
25 capabilities or decision-making that could be as significant
. 39
1 or more significant than the licensed operator.
2 MR. ERIN: In the analog world, you have
3 technicians going in and adjustment the potentiometer with a
4 screwdriver. In the digital world, he's in installing a
5 piece of software or digitally entering a data value for a
6 set point. But ultimately it comes down to training and
7 administrative controls, procedures and documentation.
8 CHAIRMAN UHRIG: I've been groping for the
9 significance of the small triangles on your chart.
10 MR. ERIN: I think the purpose was just to
11 identify some of the more significant or larger TXS
12 applications, since TXS was the topic for today's
13 discussion.
14 CHAIRMAN UHRIG: Okay. Are there any comments
15 from the staff?
16 MR. CALVO: I think Erin has done a good job. Al
17 I can tell you is that some of the questions you had asked
18 we had done. We had asked those questions. I think you
19 cannot miss something he says about how can you prevent the
20 operator from -- an I&C technician. They have a lot of
21 memories in this computer and protected memory. Nobody can
22 guess in there and you've got a special way to to do it.
23 Also, they've got addressable -- for fuel burn-up
24 and things like this. Those are limited. So if you make a
25 mistake, you catch it. Also, you only can mess with one
. 40
1 channel at the same time. On top of all this, you still
2 introduce the potential for common mode failure. That will
3 be the focus also in defense-in-depth. What else do you
4 have in case that potential is cascaded to all four
5 channels. So we asked all these kind of things.
6 CHAIRMAN UHRIG: Thank you. If there are no
7 further questions, thank you very much, Larry.
8 MR. ERIN: Thank you.
9 CHAIRMAN UHRIG: And we will move on to the second
10 system, which is Westinghouse's ABB/CE system, and Ken.
11 MR. SCAROLA: I need a moment to set up.
12 MR. SINGH: Can we take a break for five minutes?
13 CHAIRMAN UHRIG: Why don't we take a five-minute
14 break while he sets up.
15 [Recess.]
16 CHAIRMAN UHRIG: We'll come back into session.
17 This is Ken Scarola who will give the presentation.
18 MR. SCAROLA: Good morning, gentlemen. Thank you
19 very much for letting us have this opportunity to talk about
20 Common Q, the Westinghouse Nuclear Automation Common
21 Qualified Platform.
22 As Mr. Uhrig said, my name is Ken Scarola and I am
23 from Westinghouse Nuclear Automation. Before I get into the
24 presentation, I would also like to introduce some of the
25 other key players that are here with us. Our Licensing
. 41
1 Manager, Denny Popp; our Manager of Protection Systems, Mark
2 Stofko; we have our lead engineer for hardware
3 qualification, and that's Marty Ryan; and our lead engineer
4 here for software qualification, and that's Warren
5 Odess-Gillett.
6 So these are the people that will be answering the
7 tough questions. I'll be answering the easy ones.
8 Since the last time I was here several years ago,
9 we were just, at that time, ABB, things have happened, I
10 think many of you know that Westinghouse has now acquired
11 the nuclear facilities of ABB, the nuclear assets, and now
12 we are long large I&C organization.
13 These yellow boxes represent the old ABB locations
14 and down at the bottom, the original Westinghouse locations.
15 So this is effectively now Westinghouse Nuclear Automation.
16 I thought it was important that I first really
17 give you that perspective, since there are a lot of changes
18 going on.
19 Now we will talk about the common qualified
20 platform and I first wanted to go through what our overall
21 program objective was for this.
22 We were looking to qualify an I&C platform for
23 safety for what we call safety critical Class 1E
24 applications and we were really looking at a building block
25 approach that would allow us to build very simple safety
. 42
1 systems, such severe accidents things like diesel sequencers
2 that are relatively simple; in fact, reactor protection
3 systems that are relatively simple.
4 But then, also, much more complex systems, like
5 core protection calculators for CE plants, Combustion
6 Engineering plants, and things like post-accident monitoring
7 systems that have fairly sophisticated data reduction
8 algorithms for things like core temperature monitoring.
9 So the intent was a building block approach that
10 would handle very simple systems and also fairly complex
11 safety critical applications.
12 And then we also recognized that the strategy that
13 many utilities would have would vary from system by system
14 replacements to full plant-wide upgrades and we had to
15 realize an approach that would really accommodate both ends
16 of the spectrum. So that was our goal.
17 We also discussed this with many of our own
18 customers. We listened to them and, in fact, this whole
19 program was partially funded by the CE Owners Group, and
20 these were the major messages that they gave us.
21 One is they wanted us to use industrially proven
22 products. They didn't want something new for the nuclear
23 industry. They wanted something that had a long history of
24 successful operation, and nobody wants to be first.
25 They wanted maximum standardization. It's best
. 43
1 for them if they can use the same widget everywhere, but
2 there is also a recognition that dealing with common mode
3 failure somewhat goes against this idea of standardization,
4 so there is this issue of dealing with diversity. Very
5 important recognition.
6 In any modernization effort, when you're doing
7 things that the industry has not done before, there is
8 always licensing risks, so they want a product that was
9 fully pre-licensed.
10 Also, when you look at modern digital systems, one
11 of the major expectations is that you will improve the
12 reliability with less manual effort, with less frequent
13 periodic surveillance.
14 So therefore, they wanted really to see that the
15 NRC was going to accept that, that we were, in fact, going
16 to get some relief on manual surveillance testing, and still
17 achieve very high reliable systems.
18 And then lastly, a very significant concern of
19 many utilities is they wanted to make sure that this year's
20 solution is not next year's obsolescence problem. I think
21 many of you who have desktop computers know that this
22 technology moves at the speed of light and we really have to
23 be conscious of this issue.
24 What we really are looking at here is a snapshot in time of
25 a product, and all of these products have ongoing life
. 44
1 cycles, and dealing with that life cycle management was a
2 very critical issue.
3 This chart depicts our licensing strategy,
4 essentially the basis of the Westinghouse topical report.
5 It builds on a foundation of the qualification of the
6 product building blocks, the basic elements of the design
7 and I will talk about those in a few minutes.
8 It also, in this foundation, builds on the methods
9 that are used to build the applications software. I think
10 everybody realizes what we're talking about here is a
11 product that comes with some base software, but it really
12 doesn't do reactor protection systems until you do a lot
13 more with the application level.
14 So the NRC has reviewed this fundamental piece and
15 this is a subject of the safety evaluation report. Then on
16 top of that, we talk about what we call generic applications
17 and we have submitted to the staff and the staff has
18 reviewed the application of these building blocks to systems
19 such as the reactor protection system, engineered safety
20 feature actuations, core protection calculators,
21 post-accident monitoring.
22 This, again, was all the subject of our topical
23 report, because we felt that it was important not only to
24 see the product, but how it will be used in various
25 applications.
. 45
1 CHAIRMAN UHRIG: Is this core protection
2 calculator essentially the same one that's installed in a
3 number of units or is this an upgraded system?
4 MR. SCAROLA: Functionally identical to what's
5 installed in operating units, but now on this new platform.
6 Then these really represent stand-alone system
7 applications, but we all recognize that where utilities were
8 heading is plant-wide modernization. And when you start
9 doing a plant-wide modernization, you have to look at how
10 you integrate all these together, because really the main
11 efficiency that comes through digital systems is when you
12 can start sharing functions, such as sharing maintenance
13 panels, sharing the data communication buses.
14 So instead of looking at each one of these as a
15 stand-alone application, in this appendix, for the topical,
16 we looked at the integrated solution, how they all fit
17 together and how we share these services and how that
18 sharing does not compromise the functionality or the
19 performance.
20 CHAIRMAN UHRIG: That's what I was going to ask,
21 is that a two-edged sword, so to speak, when you try to
22 combine them.
23 MR. SCAROLA: It can be. If it's not done
24 correctly, it certainly can be.
25 CHAIRMAN UHRIG: Common mode failure.
. 46
1 MR. SCAROLA: You can introduce all kinds of
2 problems when you do that and, therefore, we felt it was
3 very important that we present to the staff our method of
4 doing it and they review that we have sufficiently addressed
5 all those issues.
6 So these three tiers of this pyramid have all been
7 addressed in this topical report and it's what we call the
8 CE Owners Group/EPRI, because there was also some funding in
9 this from EPRI, phase two.
10 We are now through this, we feel we have set the
11 foundation for future licensing submittals that may address
12 new generic new generic applications; for example, though
13 here you don't see the diesel load sequencer, as a standard
14 application, so we would expect that maybe in the future
15 that would be at this tier.
16 And then, also, we know that every utility has
17 very specific things in their plants and we feel that
18 through this, we have now established the framework of what
19 the NRC is expecting to see for a new application.
20 So we were really hoping that through this
21 program, we would not only license a product, but also
22 establish a process for the application of this product.
23 That's really where we are now.
24 Now, we are moving into what we call phase three
25 of these Common Q program. We are now in phase three and
. 47
1 what you will see is phase three has a new building block
2 that we call the flat panel display.
3 Now, this was addressed in phase two. It is in
4 the SER, but we didn't really finish all of the effort, and,
5 therefore, this is an open issue in the existing SER, and we
6 hope to close it out shortly.
7 What I wanted to do was just give you a little bit
8 of a timeline here to give you a feel for when we started
9 and when we actually finished. Our first submittal was in
10 March of 1999 on this topical, but the initial discussions
11 we had with the staff go back to May of 1998, where we first
12 came in and we said this is what we're thinking about, does
13 this make sense to everyone.
14 And then it took us a while for us to get our act
15 together and write some documentation and then our first
16 submittal was in March of '99.
17 All of these submittals address the basic building
18 blocks, as well as specific applications, such as the
19 integrated solution, the RPS, et cetera.
20 Now, we also said to the staff very early on in
21 the program this is what we want to get out of this. These
22 are our expectations, are these lining up with what you
23 think we contract get, because that's very important.
24 Sometimes we go through these things and find out that we
25 don't really line up.
. 48
1 So then in August, the staff issued their safety
2 evaluation report in August of this year. So this has been
3 a substantial effort from a number of people on both sides
4 working very hard to get to the end.
5 CHAIRMAN UHRIG: Just for point of clarification.
6 This basically -- the genesis of this system is the ABB/CE
7 system, not the Sizewell B.
8 MR. SCAROLA: Right. This is from the ABB side of
9 the business, and I will be going through the building
10 blocks, so you see that.
11 The topical report format had a main body of the
12 document where we described the basic building blocks and we
13 addressed what we felt were the key standard review plan
14 issues, things like hardware and software qualification,
15 configuration management, the application development tools,
16 and, of course, 3D, diversity and defense-in-depth.
17 And then in addition, in the topical, we had
18 appendices for each one of these significant applications.
19 I will start by going through the building blocks.
20 The heart of this Common Q system is the ABB Advant
21 controller, the AC-160. So this really gets back to your
22 question, this is really from the ABB product line.
23 Now, this is not a new product or a specific
24 product for nuclear applications. This is a product that
25 ABB has been applying our fossil business unit since 1997
. 49
1 and this is actually a second generation product from
2 something that we called the AC-110, that was introduced in
3 1993.
4 So there's a long, very long history of industrial
5 application. The product is used today in boiler protection
6 systems and also turbine protection systems and it was
7 certified last summer by Tuv for boiler protection in
8 Germany.
9 So this was the thing that originally gave us real
10 solid confidence that we would be successful here.
11 Fundamentally, this controller will handle a
12 variety of I/O modules, up to 1,500 I/O points for a single
13 controller. And it supports six parallel processors. Now,
14 this is really the key to building very simple systems,
15 where we may use one processor and maybe very sophisticated,
16 complex systems, where we require several more, and it's
17 this flexibility that really gives this system its wide
18 range of applicability.
19 CHAIRMAN UHRIG: Now, each one of these processors
20 basically is a microprocessor such as a --
21 MR. SCAROLA: It's a micro-controller. It's a
22 Motorola --
23 CHAIRMAN UHRIG: Is this Intel chips?
24 MR. SCAROLA: We use Motorola. It's a Motorola
25 68,000 base processor and each one of these processors is
. 50
1 basically a stand-alone module that slips into this rack,
2 but they all share one common back plane, so they can
3 exchange information very, very quickly, very rapidly.
4 In a typical application, we'll essentially have
5 functional segmentation between the processors. One might
6 be doing a DNBR calculation, another one might be doing a
7 local power density calculation, another one might be doing
8 some other function or maybe handling data communication.
9 But the idea is that we can take very
10 sophisticated functions and distribute them.
11 Now, what makes the system suitable for nuclear
12 applications is it's a highly deterministic system. The
13 operating system runs cyclically. All of the application is
14 executed all of the time regardless of what the logic may
15 actually indicate in the application. So we set flags and
16 execute all of the building block elements and all of the
17 network communications is fully cyclical.
18 We are sending thousands of times a second no
19 trip, no trip, no trip, no trip. Then sooner or later we
20 may send trip. So this is fully cyclical data
21 communications, not event dependent.
22 Also, the system has extensive self-diagnostics.
23 So we monitor things like RAM integrity. We do bit checks
24 continuously on the internal memory of the system to make
25 sure that there are no errors. We are doing continuous data
. 51
1 link communication checks. We do continuous verification
2 that the CPUs can actually talk to the I/O modules and that
3 there is no disconnect there where things might be freezing.
4 So these extensive diagnostics, along with highly
5 deterministic performance, make this a very suitable product
6 for these nuclear safety critical applications.
7 MR. SIEBER: What happens if you detect a RAM
8 error, for example?
9 MR. SCAROLA: Well, a RAM error is what we would
10 call a fatal failure. So in this particular case, we
11 actually shut down the processor. We actuate an output
12 relay in this case and depending upon the application, we
13 either fail actuated or we simply alarm. For example, in
14 the case of a reactor protection function, reactor trip, we
15 typically fail in the actuated mode, so we force something
16 to happen.
17 MR. SIEBER: So this fails, a RAM chip fails, that
18 trips the plant.
19 MR. SCAROLA: No, because we have a multi-channel
20 system. So what we're talking about here is an architecture
21 where you would have similar to what Siemens showed, four
22 divisions. If you have a single controller failure, you may
23 fail one of those four divisions and then we ultimately vote
24 at the final element, so that that single failure may result
25 in one of four trip legs, but it takes one more to trip the
. 52
1 plant.
2 Now, we have other functions in the plant that we
3 may designate as not fail-safe functions. For example,
4 things like containment spray. You don't necessarily want
5 to spray down containment on a failure. So we may designate
6 those as not fail safe and in those cases, we would simply
7 have an alarm on these failures and not actually send an
8 actuation.
9 So it's really application dependent.
10 The second major building block is what we call
11 the ABB Advant field bus and we designate this as the AF-100
12 bus. This is the network communications that we use within
13 a division, so the A division will have a network, the B
14 will have an independent network, C has its own, D has its
15 own, and this network allows multiple controllers to talk
16 and exchange information.
17 It allows multiple controllers to send information
18 up to a maintenance and test panel. It allows it to send
19 information up to the operator's module that's in the main
20 control room.
21 This is a multi-drop network up to 79 nodes, so
22 you may start an installation in a power plant with three
23 nodes, but over time, when you start to add more and more
24 systems, you're building on that same network and you may
25 get up to 60 nodes in the typical power plant installation.
. 53
1 Again, this is a highly deterministic bus. We
2 have what we call a bus master that actually is the internal
3 traffic cop and we rotate that master continuously.
4 We can establish various transmission cycles for
5 things that have to happen very rapidly and things that can
6 happen more slowly. It's optical fiber media, so we
7 maintain electrical independence between these various
8 controllers, so we don't propagate electrical faults.
9 Similar to the CPUs, there are self-diagnostics
10 and we have automatic reconfiguration so that if you fail or
11 have a failure of one of these 79 nodes, that's not going to
12 take down the other 78 nodes, and when you re-initialize
13 that failed node, it automatically gets back into the data
14 communication sequence. So we don't end up taking down the
15 whole system.
16 Now, the third major building block is what we
17 call the flat panel video display. This is, in fact, a VDU,
18 video display unit, that is intended to replace the
19 conventional analog meters, control switches that you would
20 have in a typical power plant.
21 We have these in operation today for our CPC
22 functions at various operating plants, not this exact same
23 unit, but very similar VDU based HSI, and also for the
24 post-accident monitoring systems.
25 So we felt that this was a very important part of
. 54
1 the building block set. Now, this is a simple touch-screen
2 VDU, where you can navigate by touch and you can select and
3 modify set points, if this is appropriate for the
4 application.
5 It is an X-86 based processor, so this is the
6 Intel side of the product line, and this is used for really
7 two major functions. One is the maintenance and test panel,
8 which is where you would go to resolve these diagnostic
9 errors or to load software into the system, and it's also
10 used for the operators' modules inside the main control room
11 for effectively the information monitoring inside the plant.
12 In a typical installation, where you have four
13 divisions of a system, A, B, C and D, you would have four of
14 these operators modules, again, to protect for single
15 failures.
16 Now, there are more building blocks in the system,
17 but in the essence of time, I focused on those three major
18 ones, which are really the core building blocks.
19 Now I would like to talk about equipment qualification, then
20 we'll talk about software qualification and a number of
21 other major issues.
22 The qualification tests encompassed, first,
23 electromagnetic interference, in accordance with the EPRI
24 guidelines, and before you had asked about surges on things
25 like power supply buses.
. 55
1 One of the tests in this is a four KV surge test
2 on the power bus feeding the system. And we also do a two
3 KV test on all of the input/output signal lines.
4 So we really believe that we have encompassed our
5 worst case situation and based on operating experience with
6 our CPCs, which are digital systems that have been in
7 operation in nuclear power plants since the late `70s, we
8 really feel we have encompassed any worst case conditions
9 here.
10 CHAIRMAN UHRIG: Thank you.
11 MR. SCAROLA: We also do environmental testing in
12 accordance with IEEE-323. Now, this is essentially elevated
13 temperatures, elevated humidity for extended periods of
14 time, and seismic qualification in accordance with IEEE-344.
15 Now, one of the things that we looked at for the
16 seismic qualification are really the target markets. I
17 think everybody knows that the seismic boundaries for the
18 west coast of the US are far different than the east coast
19 and also we have very high levels in South Korea, fairly
20 mild applications in Europe.
21 But what we did is we established our bounding
22 seismic test criteria for all of these target markets.
23 So we think we have a large market base covered.
24 We have completed the testing on the AC-160, which is what I
25 said was the core product. We will be doing additional EQ
. 56
1 testing to be completed the first quarter of next year, and
2 this will encompass the flat panel display.
3 We will do testing on power supplies and we are
4 also doing a new series of tests on what's called the
5 PM-646A, which is the latest processor for this AC-160
6 product.
7 What we did before as part of the SER was the
8 PM-645C. We had some prototypes of PM-646A, but we didn't
9 have full production units and now we're going to do the
10 full gamut of testing again. So we have very high
11 confidence that once we get through this, we will have no
12 open issues.
13 MR. SIEBER: Now, all of these devices, like the
14 flat panel display and power supplies, they're all mild
15 environment, right?
16 MR. SCAROLA: Everything is mild environment.
17 Right. Nothing is intended for in-containment use.
18 MR. SIEBER: So what's the test consist of, just
19 elevated temperature and running for a long time or what?
20 MR. SCAROLA: I will ask for some help. Marty,
21 can you help on what the actual test levels were for the
22 elevated temperatures?
23 MR. RYAN: Marty Ryan, from Westinghouse. The
24 environment test consisted of testing three different
25 profiles for different temperature and humidity conditions,
. 57
1 where we expected the worst case high temperature and the
2 low temperature for periods of eight hours with mixed
3 humidity, so as to accommodate the ventilation requirements
4 in the mild environments that currently exist.
5 MR. SIEBER: And that testing then sets the
6 environmental limits on the rooms or cubicles in which the
7 equipment would be installed.
8 MR. RYAN: That's correct. We actually did it in
9 an open frame, so we tested the physical equipment to the
10 highest level that we would expect, as the equipment goes
11 inside an enclosure.
12 MR. SIEBER: Thank you.
13 MR. SCAROLA: One thing I will add is that we test
14 both what we consider the normal long-term operating range
15 with normal HVAC conditions in the room, but we also test
16 boundary conditions that would be indicative of the HVAC
17 failures in the room, as well.
18 DR. POWERS: And the test was for eight hours?
19 MR. SCAROLA: It's actually a series of plateaus
20 for eight hours at each plateau. There were four plateaus,
21 three plateaus. Okay. Three plateaus at eight hours each.
22 And the actual details of that testing are in the
23 topical report.
24 MR. SIEBER: Do you actually do that until you get
25 a failure someplace or that would give you the ultimate
. 58
1 envelope?
2 MR. SCAROLA: No. We don't do a catastrophic test
3 to find out the limits of the equipment. We basically
4 establish the boundary conditions and we ensure that the
5 equipment functions to those boundary conditions.
6 MR. SIEBER: Thank you.
7 DR. POWERS: When you do your seismic test, what
8 are you looking for?
9 MR. SCAROLA: Failures, functional failures as
10 well as physical integrity failures, but essentially the
11 real focus is for functional failures.
12 DR. POWERS: I guess what I'm asking is a little
13 more detail. Where do you think the system is most
14 vulnerable?
15 MR. SCAROLA: I'll look for help. I'm not sure I
16 fully understand the question. We are trying to make sure
17 that all the safety-critical functions in this system will
18 not be compromised during the seismic event.
19 DR. POWERS: I could imagine that you're looking
20 for conductors coming unlatched, modules falling out of
21 slots, pins coming out of sockets.
22 MR. SCAROLA: We are particularly sensitive to the
23 electro-mechanical interfaces all around the system, whether
24 it's a circuit board seated into its end connector, a data
25 communication coax cable, whatever it might be. Those are
. 59
1 the things that we are particularly designing to enhance for
2 seismic durability. Marty, would you add something to that?
3 MR. RYAN: Yes. With regard to what we look for
4 in seismic, we're looking for the mechanical aspects, as
5 mentioned, but also for the functional aspects, where we
6 have an off-line monitored set of test equipment, where
7 we're looking at the functionality of test software and test
8 functions being executed in the specimen.
9 We also took the equipment up to the maximum level
10 that we could see in any particular location. It was
11 actually the maximum level of Wylie's test table at the
12 Huntsville, Alabama facility.
13 DR. POWERS: When you expose it to a -- you do the
14 seismic test, how long does the vibration typically go on?
15 MR. RYAN: The requirement in 344 is to subject
16 the specimen for 30 seconds. So each of the tests that are
17 run in the triaxial mode, whether it be the OBE, which is a
18 half strength, we run a minimum of five of those, followed
19 by an SSE. Each of those test sequences are 30 seconds
20 duration.
21 DR. POWERS: How do you think your system would
22 perform in a much longer duration exposure to harsh
23 vibrations?
24 MR. RYAN: We would expect it to operate without
25 any incident. The reality is that we have not seen, based
. 60
1 on field experience, any incidents due to low level
2 vibration. Part of the testing is also to look at a sine
3 sweep to see if the frequencies covered outside of the
4 seismic would present any susceptibility and during those
5 tests, we found no problem areas, we well.
6 DR. POWERS: Even if it went on for an hour?
7 MR. RYAN: I'd have to speculate, but one would
8 think that based on the installed type of equipment that we
9 have in the plant, which is subjected to the same physical
10 area of the plant, we have no indication that that is a
11 problem, so we would suspect that this would not be a
12 problem to the new equipment, as well.
13 MR. SCAROLA: I think one of the real key issues
14 here is that we look for resonance frequencies in this
15 equipment when we do these seismic sweeps.
16 DR. POWERS: That's the sine sweep that he was
17 speaking of.
18 MR. SCAROLA: Right.
19 DR. POWERS: And where do you see resonance?
20 MR. RYAN: We see resonance typically, depending
21 upon the fixture that we mount the equipment, but we have
22 traditionally tried to put a fixture that had no resonance
23 in it, a rigid test fixture. So whatever the table is
24 imparting, it imparts it directly to the specimen.
25 But in a cubicle, we typically see resonance
. 61
1 somewhere between 12 and probably 15 hertz.
2 CHAIRMAN UHRIG: For your Pacific Rim countries,
3 what is the typical OBE and SSE?
4 MR. SCAROLA: I'm sorry?
5 CHAIRMAN UHRIG: The operating basis earthquake
6 and your safety shutdown.
7 MR. SCAROLA: For which country?
8 DR. POWERS: For South Korea, for example.
9 CHAIRMAN UHRIG: South Korea.
10 DR. POWERS: What is the ZPA for South Korea?
11 MR. RYAN: The ZPA is typically running about OBE
12 12 hertz G with a ZPA of around one to one and a half. And
13 the SSE for worst case profile at the location is somewhere
14 around 24 G's and we test up to about a two, two and a half
15 ZPA.
16 CHAIRMAN UHRIG: Is that horizontal component, is
17 that --
18 MR. RYAN: That's all three components.
19 CHAIRMAN UHRIG: All three components.
20 MR. RYAN: Yes. What we've attempted to do is
21 integrate a generic qualification process, where we looked
22 at the different geographical frequencies and composed a
23 composite type test environment, and that actually envelopes
24 what the machine limitation curve is at the test facility.
25 CHAIRMAN UHRIG: Those G limits are for the
. 62
1 instrumentation and control. That's not the for the whole
2 plant, I assume.
3 MR. RYAN: That's for the typical location where
4 we would install this equipment in the protection rooms of a
5 typical power plant.
6 MR. SCAROLA: One of the real challenges is
7 attempting to establish your boundary conditions, because we
8 really are doing this as a statistical sample testing. Then
9 what we're hoping is that we have encompassed all of these
10 potential installation locations.
11 So we really test a very high G levels, as Marty
12 said, 25 G's, with the expectation that if you look at all
13 of these accelerations from the ground through the building,
14 from the bottom of the cabinet to the very highest point
15 inside the cabinet, that we have, in fact, encompassed and
16 through all the years of experience we have with seismic
17 qualification, we believe that we have, in fact, encompassed
18 almost every location we would find.
19 Now, of course, we have to confirm that for every
20 installation, but we do believe that we're covered.
21 CHAIRMAN UHRIG: That number 25 was considerably
22 higher than I expected.
23 MR. SCAROLA: Let me show you what the test
24 fixture looks like, because this will give you a feel for
25 what the seismic testing is. What you can see here is this
. 63
1 a rigid test fixture, as Marty explained, and the intent of
2 that test fixture is to impart the vibration from the table
3 right to the electronic equipment with no acceleration.
4 So we know that what we got at the table is what
5 we got there. But the real challenge is the recognition
6 that we are qualifying building blocks and building blocks
7 can be configured in many different ways and in many
8 different mounting methods.
9 For example, here you see front panel mounting
10 where the rear of this electronic chassis is actually bolted
11 to what would be considered the frame of the cabinet.
12 On the other hand, here you see what we call rack
13 mounting, which means that the rack assembly is actually
14 bolted from the front and, therefore, is now cantilevered in
15 the back.
16 So one of the real challenges was establishing
17 what we felt were the boundary conditions for this seismic
18 test. Similarly, we had to establish boundary conditions
19 that encompassed the building block configurations for the
20 EMC testing. Again, a significant challenge because you can
21 have many different combinations of modules inside any
22 particular rack.
23 So establishing these boundaries as a worst case
24 test was an important part of the program. Then we
25 addressed software qualification. Now, an important point
. 64
1 here is that this is a product that was developed for the
2 industrial market, not the nuclear market.
3 So we are using standard ABB software for what's
4 called the Advant controller base software, this is inside
5 the AC-160, and inside the flat panel display, we're using
6 an operating system from a company in Canada, QNX Software
7 Systems Limited. Again, standard off-the-shelf software
8 with a long history of performance in industrial
9 applications.
10 Then what we had to do are really two major
11 things, a design life cycle evaluation and an operating
12 history evaluation. What we did through this life cycle
13 evaluation, we evaluated the OEM software development
14 process to confirm that it was essentially equivalent to
15 what we would expect in the nuclear industry.
16 And where we found deficiencies, we would
17 accommodate those through additional review by our own
18 people, for example, code reviews. We would do supplemental
19 testing. We would ask the vendor in some cases to modify
20 his process for future software revisions or for error
21 reporting and correction.
22 In some cases, we required more documentation.
23 And in some cases, we would say this part of the software
24 may not have been developed to the level that we would
25 really expect; therefore, it's an application restriction.
. 65
1 We may not use it in safety-critical applications.
2 So this whole design life cycle evaluation was a
3 very important part of the program. We also evaluated the
4 operating history of these products. Are they, in fact,
5 good products; what is their performance record, and we
6 ensured that all of the applicable problems had been
7 resolved or the supplier has a mechanism in place that they
8 will be resoled and we have a tracking interface for that.
9 So, again, we must recognize that these are life
10 cycle products. This is a snapshot in time of a product,
11 making sure that we maintain this product for its useable
12 life in the nuclear industry is as important as what the
13 product is today.
14 Then the other part of the software qualification
15 pertains to the application software itself. That's the
16 part that will be specific for nuclear application and
17 there, with the staff, we have established coding standards,
18 testing standards, standards for documentation and
19 verification and validation.
20 All of this is encompassed in what we call our
21 software program manual, which effectively becomes the bible
22 of how you apply this product in future nuclear applications
23 and it establishes the basis for what the NRC is expecting
24 to see when a licensee applies this product.
25 Another very important area is what we call
. 66
1 configuration management. This is the issue of ensuring
2 that the nth of a kind product that you build is the same as
3 the one that you put through qualification and licensed.
4 And we have supply agreements with our key suppliers that
5 establish configuration control of both hardware and
6 software and also proactive obsolescence management
7 programs, where we don't wait and find out that something is
8 obsolete. We're actually out there all the time discussing
9 with Motorola, with Intel, with all of the key suppliers for
10 what we call the critical components what are their plans.
11 It's a very significant program.
12 Now, we have contracts in place already with ABB
13 and as we move further into the maturity of things like the
14 flat panel display, we will have other contracts in place
15 with those key suppliers, as well.
16 As a result of this, we can ensure that the nth
17 product is equivalent to the qualification specimen and we
18 can ensure 20-plus years longevity for these products. So
19 we protect the utility's investment all the way through.
20 This, though, I would say is probably one of the
21 more substantial efforts of the entire program. This is not
22 an easy thing to do in this day and age, where this
23 electronics industry is moving at the speed of light.
24 So I really cannot over-emphasize the importance
25 of this program.
. 67
1 MR. SIEBER: A question on the control of
2 obsolescence. You know, Intel or Motorola or some
3 chip-maker, they'll make a CPU chip for a year and then
4 somebody thinks of something better and they quit making
5 that and start making something else.
6 Does that mean your circuit cards that may employ
7 these OEM chips will change from time to time to incorporate
8 the so-called advances? In other words, if I own one of
9 your processors and say, uh-oh, I think I need a new card,
10 the card I get is going to be different than the one I take
11 out.
12 MR. SCAROLA: You are describing exactly the
13 problem that we are dealing with and the way we deal with
14 this problem, number one, is we know when the parts are
15 changing and I can't necessarily say that about every
16 product in the industry. Sometimes these OEMs will do
17 things and the end users have no knowledge of it.
18 So you think you're getting the same thing, when,
19 in fact, you're not. So the first step in here is
20 establishing a process with the key suppliers where we, in
21 fact, know that they have a problem with components. And
22 then at that point, we have the option, we can do one of two
23 things.
24 We can buy these components and stock them. For
25 example, say, Motorola says, look, I'm only going to build a
. 68
1 specific CPU for another year and then I know I'm going to
2 obsolete it. At that point, we can buy whatever we need for
3 our existing customers and our future customers in the
4 near-term. We also have the option at that point of
5 redesigning their next generation chip into the new board
6 and ensuring form fit function replacement.
7 So even though there is a new part in there, we
8 are supervising the application design with the supplier so
9 that we ensure that the next generation product is, in fact,
10 a form fit function replacement, and then we also would, at
11 that point, do the evaluation of any new requalification
12 needs.
13 Sometimes you can analyze the equivalency of new
14 chips, but sometimes you can't. And you actually have to go
15 back through the hardware qualification and software
16 qualification process. But the real key is knowing that you
17 have the problem and then you can do something about it.
18 MR. SIEBER: Now, the same question applies to
19 software. Some bright person can say there's a better way
20 to do this particular calculation or what have you and come
21 up with a changed software that satisfies form fit and
22 function. On the other hand, it may change the duty on the
23 CPU or RAM or what have you or change the whole timing of
24 the computer.
25 MR. SCAROLA: Absolutely, and that's why
. 69
1 configuration control of software is as equally important as
2 it is to hardware.
3 We have very strict controls over the firmware
4 that is embedded in these products at every point in the
5 product, whether it's the CPU, the firmware that may be
6 inside a simple I/O module, the firmware that may be inside
7 a network communication module, we are controlling that
8 firmware and we ensure that these suppliers have processes
9 and we audit those processes, because I agree with you. You
10 can get yourself into a lot of trouble if these things are,
11 in fact, changed and you don't know about them.
12 So we get to evaluate every change. Some changes
13 we can accept, some changes we cannot accept and, therefore,
14 we will use a previous revision of the software. We don't
15 necessarily always upgrade the software to the latest
16 revision.
17 MR. SIEBER: So you will, in fact, then, be the
18 only qualified supplier for those software, firmware and
19 hardware.
20 MR. SCAROLA: For this product.
21 MR. SIEBER: Right.
22 MR. SCAROLA: Absolutely.
23 MR. SIEBER: Thank you.
24 MR. SCAROLA: Another major issue is what we call
25 diversity and defense-in-depth, and here we have established
. 70
1 a methodology where the analysis addresses common mode
2 failures and effects for all postulated initiating events
3 and we credit diverse non-safety I&C systems for coping.
4 Some examples of the systems that we credit are
5 the non-safety control systems, the ATWS systems, but in
6 many cases, we find that even they are not sufficient and we
7 need to supplement the RPS and ESFAS functions with some
8 supplemental trips in these diverse platforms.
9 So there is an entire methodology that we have
10 established. We executed this methodology the first time on
11 the System 80+ ALWR and we are following the same
12 methodology for future upgrades.
13 One of the real challenges in this is when you
14 start dealing with modernization in phased upgrades, where
15 my first upgrade might be the post-accident monitoring
16 system and then the next one is the CPCs and you can get
17 yourself into an analysis quagmire.
18 So what we have established is a methodology where
19 we do the analysis one time and then we confirm the
20 applicability of that analysis through each phase of the
21 upgrade.
22 Now, I addressed basically the main body, which
23 you can't see here, but now I would like to talk a little
24 bit about the appendices.
25 As I said, there are four major -- there are four
. 71
1 key appendices that were submitted to the staff for these
2 functions, PAMS, CPCR, PS and ESFAS, and the integrated
3 solution.
4 The intent of the appendix is to show the system
5 configuration for each of these major applications. So we
6 defined to the staff the process or architecture in a
7 specific application like RPS, it may take eight processors.
8 In an application like PAMS, maybe only two.
9 We define both the intra-division within a
10 division of communication and the inter-division between
11 division communication methods, and we also defined expected
12 variations for the plants that we were knowledgeable of that
13 are out there.
14 So we said this is a base configuration, but we
15 envision that the architectures may change in this way, this
16 way and this way. We defined significant plant interfaces.
17 We defined features such as automatic testing, manual
18 testing and bypass features.
19 For each of these appendices, we submitted a
20 failure modes and effects analysis for that configuration
21 and we provided technical input for 50.59 evaluations and
22 also for tech spec changes that would relate to extending
23 manual surveillance intervals.
24 Now, we know that the staff cannot approve 50.59
25 evaluations in a topical report, and we know that they
. 72
1 cannot approve tech spec changes in a technical report, but
2 we did want to get the staff's reaction on our technical
3 basis for these things. We feel we had very good
4 interaction on that.
5 Now, the appendices, as I said, address
6 stand-alone system configurations, but the fourth appendix,
7 the integrated solution, shows how all these things fit
8 together, how we share the building blocks and the effects
9 of that sharing.
10 So the intent of Common Q is to address the entire
11 spectrum of what we envision as safety critical Class 1E
12 applications in any operating power plant today.
13 We have submitted applications for various or
14 submitted appendix material for various applications, but we
15 feel we have now laid the groundwork so that utilities can
16 do this in the future with our help for future applications.
17 Now, I wanted to just go through some places where
18 the system is being applied. Its first application is at
19 the Oskarsham-1 modernization in Sweden, where the
20 applications include the full spectrum of safety-critical
21 functions, reactor protection engineered safety features,
22 the load sequencer for the emergency diesel, and component
23 control for every class 1E safety-related pump and valve in
24 the plant.
25 And this system will be in operation in September
. 73
1 of 2001. So we're not very far away from having that system
2 up.
3 CHAIRMAN UHRIG: How long was the plant down to do
4 this?
5 MR. SCAROLA: Actually, the plant is not down yet.
6 They will start their down sequence of April of next year.
7 They will actually come down.
8 CHAIRMAN UHRIG: So April to --
9 MR. SCAROLA: So the installation will be very
10 aggressive. It will be about four months for installation.
11 CHAIRMAN UHRIG: So it's essentially a complete
12 replacement.
13 MR. SCAROLA: Right. This is a full
14 modernization, and it's in one shot. It's not a phased
15 installation, as we talked about before. This is one-shot,
16 do everything at one time.
17 CHAIRMAN UHRIG: But you might be able to split it
18 up into two or three shorter sequences.
19 MR. SCAROLA: For other utilities, if that's what
20 they desire, right. But for this particular utility, they
21 wanted to do it all in one shot.
22 MR. SIEBER: How long will that take, just out of
23 curiosity?
24 CHAIRMAN UHRIG: He said about four months.
25 MR. SCAROLA: About four months for the
. 74
1 installation.
2 MR. SIEBER: Okay.
3 MR. SCAROLA: The second application is at
4 Ulchin-5 and 6 in South Korea. There we are doing a reactor
5 protection and engineered safety features, and that will be
6 operational in 2003. Ringhals Unit 2 in Sweden, again, is a
7 full modernization; again, in one step, shut down the plant,
8 rip out the old equipment, install the new equipment, and
9 the operation there is expected 2004.
10 One of the additions here over the Oskarsham is we
11 will now be using this flat panel display product, so we
12 will have video human systems interfaces, whereas at
13 Oskarsham is still discreet HIS.
14 We also building KEDO-1 and 2 now in North Korea.
15 This is a recent contract and that's actually several years
16 out.
17 This will actually be a duplicate of the Ulchin 5
18 and 6 plants in South Korea. And then as we speak today we
19 are in discussions with many US utilities about
20 modernization, either on a small system basis or a
21 plant-wide modernization basis. It runs a full gamut.
22 CHAIRMAN UHRIG: Ulchin is a plant under
23 construction?
24 MR. SCAROLA: It's under construction.
25 CHAIRMAN UHRIG: So this is new installation.
. 75
1 MR. SCAROLA: Yes. These are new plants -- well,
2 this is a new plant, this is a new plant, and Oskarsham and
3 Ringhals are operating plants.
4 So that's the specifically application of the
5 Common Q platform, but I also wanted to explain that this
6 ABB Advant Technology, through predecessors and related
7 products, is in operation in many nuclear power plants today
8 in Europe, at Forsmark-1 and 2, also plants in Finland,
9 TVO-1 and 2, and in the U.S. we actually have operation of
10 the AC-160 predecessor, which is the AC-110, for rod
11 position indication systems at Beaver Valley and also
12 Ringhals-2 in Sweden.
13 So this equipment has been around in a number of
14 different places. We hope we have achieved this goals.
15 MR. LEITCH: Excuse me just a second. Can you
16 help to orient me? I had -- I was at Maine Yankee for a
17 while and we had a -- I'm not sure of the terminology.
18 Before I was there, they had installed a digital platform of
19 some type that supported feedwater control. Would that be a
20 forerunner of this system or are you familiar with that
21 system at all?
22 MR. SCAROLA: I'm not specifically familiar with
23 it, but I'm sure it was not the forerunner of this system.
24 Feedwater control systems are what we would view as
25 non-safety systems and they would use the Advant non-safety
. 76
1 platform, whereas this is a safety-critical platform for
2 safety-critical applications, like reactor protection.
3 MR. LEITCH: This would have been installed maybe
4 in the 1991 or 2 timeframe, so it would likely have been
5 non-safety related.
6 MR. SCAROLA: Non-safety and not this product.
7 MR. LEITCH: Not this product.
8 MR. SCAROLA: Probably another product line.
9 MR. LEITCH: My question was going to be could
10 that product line still have been supported or is that one
11 of those -- in other words, I'm getting back to this system
12 of obsolescence. That system was put into overcome
13 obsolescence on the order of magnitude of eight years ago
14 and I'm wondering could that still be supported.
15 MR. SCAROLA: It depends on --
16 MR. LEITCH: Perhaps it's an unfair question if
17 you're not familiar with that.
18 MR. SCAROLA: Let me ask the other people from
19 ABB. Did we install that equipment? Okay. This was not an
20 ABB installation and not a Westinghouse installation. It
21 was probably done by Maine Yankee with a third party
22 supplier.
23 So I have no idea what sort of arrangements they
24 had in place for obsolescence. But I can tell you that
25 enough utilities have been burned by obsolescence management
. 77
1 because they thought they were solving an obsolescence
2 problem only to find out they installed an obsolescence
3 problem.
4 MR. LEITCH: Exactly.
5 MR. SCAROLA: And I think we're much smarter
6 consumers now than we were back in the early `90s.
7 MR. LEITCH: Yes. I think you're quite correct,
8 by the way. I was thinking at first it was an ABB system,
9 but now that you've refreshed my memory, you're quite
10 correct. It was not. Thank you.
11 MR. SCAROLA: In looking at the goals we
12 established, one common solution, very important for
13 utilities, in that it reduces technical support costs and it
14 reduces unique spare parts cost. One thing we all have to
15 realize is spare parts and maintenance for utilities of a
16 major factor and right now they're maintaining in any power
17 plant probably no less than about 25 different
18 safety-related platforms of different things and getting
19 them down to one is a major economic improvement.
20 And then through this modern technology, we really
21 are seeing improved reliability, but allowing an extension
22 of manual surveillance intervals.
23 You know, one can be a tradeoff over the other.
24 You can extend manual surveillance intervals and not be as
25 reliable, but the real key is to find a way to extend them
. 78
1 and also improve reliability, and that is what we have
2 achieved.
3 This is all through low power consumption
4 electronics that have much longer MTVF ratings than the old
5 analog stuff that was heat-producing. We have internal
6 self-diagnostics that essentially pick up probably near 100
7 percent of the failures within milliseconds. Then we have
8 automated testing that really tests the function of the
9 system.
10 In closing, I would just like to say that you've
11 seen a lot of pictures and a lot of words here, but we'd
12 really like for you to come to Pittsburgh, if any of you
13 have a chance, and we'd like to demonstrate this equipment.
14 You can see it, you can touch it, you can feel it. We have
15 a very extensive customer demonstration facility there where
16 we can actually show the operation of the equipment, as well
17 as the HSI, the human-systems interface.
18 A few years ago, when we were doing the System 80+
19 licensing, we actually brought the equipment to the ACRS. I
20 don't know if any of you remember that. But it's much
21 easier to get you to come to Pittsburgh. So I extend the
22 invitation.
23 We would love to have you.
24 MR. SIEBER: What's the address?
25 MR. SCAROLA: 286 Golden Mile Highway in
. 79
1 Monroeville.
2 DR. POWERS: Let me remind the subcommittee that
3 in the discussions with Commissioner Diaz, he certainly
4 thinks that the ability to go to digital systems like this
5 is key to the future for the nuclear industry in so many
6 respects, and because of the importance that he ascribes to
7 it, I think we should give serious thought to this
8 invitation. The more exposure we get to this, the better
9 prepared we are to supply the answers to Mr. Diaz when he
10 asks questions about these digital systems.
11 MR. SCAROLA: I think seeing it, touching it,
12 interacting with it is worth much more than whatever I could
13 give you.
14 DR. POWERS: If you don't mind, the next time I
15 have a chance to talk with Commissioner Diaz, I will remind
16 him of this capability you have to demonstrate this. He may
17 be very interested himself.
18 MR. SCAROLA: We'd extend the invitation to the
19 whole staff, as well.
20 DR. POWERS: It very much is uppermost on his mind
21 right now in connection with the future.
22 MR. SCAROLA: Thank you gentlemen. Any questions?
23 MR. LEITCH: Yes, a couple questions. I notice
24 that in the safety evaluation report, there is some generic
25 open items, about ten in number. Are they -- at least as I
. 80
1 understand it, they're not plat-specific, but as the heading
2 says, generic open items.
3 Are they on their way to resolution?
4 MR. SCAROLA: Yes.
5 MR. LEITCH: What is the status of those issues?
6 MR. SCAROLA: Most of those issues relate to the
7 building blocks within the Common Q platform that we had not
8 fully completed. For example, we talked about the flat
9 panel display. We talked about the power supply system. We
10 also have a few new analog interface modules that we need
11 for some specific applications such as the CPC, core
12 protection calculator. All of these hardware qualifications
13 will be completed the first quarter of 2001.
14 So we are on the way to essentially closing out
15 all of these issues. We will be talking with the staff
16 about our submittal schedule. This is probably the first
17 time they're seeing 2001 in a date, but we have to sit down
18 and work it out and work out the details.
19 MR. LEITCH: You said one of your objectives was
20 to relax the manual surveillance test intervals. Have you
21 achieved that objective or is that still unclear?
22 MR. SCAROLA: We think we have achieved it in the
23 sense that the staff has reviewed our basis for that, the
24 technical basis, and they have accepted that basis.
25 However, tech spec changes can only occur through license
. 81
1 amendment. So there are probably still some fine points
2 that will be worked out.
3 But in essence, we think we have achieved it.
4 MR. LEITCH: And is that a significant reduction?
5 MR. SCAROLA: Significant, because we now test
6 many functions quarterly or even monthly and we will now go
7 to 18 month intervals.
8 MR. LEITCH: So it's getting to once per refueling
9 type of situation.
10 MR. SCAROLA: Well, it's once per cycle. When you
11 say once per refueling, some utilities get upset about that
12 because they don't want to do anything more during refueling
13 than they have to. So the important thing is once per cycle
14 and all of the testing that we require for manual testing
15 can be done with the pliant on-line.
16 So even though it's once every 18 months, when
17 they do it is entirely up to them. We're not forcing things
18 to be done during refueling and that's an important issue
19 for many utilities.
20 MR. LEITCH: Are your cabinets locked and alarmed?
21 MR. SCAROLA: Locked and alarmed.
22 MR. LEITCH: And this testing can be done without
23 jumpers, lifting leads and so forth.
24 MR. SCAROLA: Yes. Most of the testing can be
25 done through the operator's module and the maintenance and
. 82
1 test panels. With regard to the injection of analog
2 signals, what we have proposed is that we do continuous
3 cross-channel monitoring of all redundant sensors and that
4 is the basis for extending that interval.
5 So we will detect sensor drift immediately.
6 MR. LEITCH: As it occurs.
7 MR. SCAROLA: Right, as it occurs.
8 MR. LEITCH: I apologize, I was called out of the
9 room a little bit, but is this -- do you have any operating
10 experience in Europe with this system or anyplace, do you
11 have any operating experience?
12 MR. SCAROLA: We have extensive experience with
13 the predecessor, AC-110, in nuclear applications. We have
14 extensive experience with the AC-160 in fossil applications,
15 in many fossil applications. But the actual first
16 installation of the AC-160 in a nuclear facility will be at
17 Oskarsham-1 and that's operational 2001.
18 MR. LEITCH: Now, with the predecessor of the
19 system, when retrofitting nuclear plants, did you experience
20 serious startup problems?
21 MR. SCAROLA: No. Actually, for example, Beaver
22 Valley, when we replaced the Westinghouse analog rod
23 position indication system with the AC-110 system, the
24 installation including all of the testing was done in 15
25 days. There were some minor hiccups, but nothing of any
. 83
1 significant.
2 MR. LEITCH: Do you train utility personnel in the
3 operation and maintenance of the system?
4 MR. SCAROLA: Yes. Not only do we train them, but
5 we encourage the utilities to be part of our design staff
6 when we do an application for them. For example, we are now
7 in discussions with many US utilities about applications and
8 a major element of each one of those programs is their
9 people working in our shop side by side with our design
10 team.
11 MR. LEITCH: Okay.
12 MR. SCAROLA: So it's not only important that we
13 do the training, but there's only so much you can get from
14 training. We really want their people in our staff working
15 with our people.
16 MR. LEITCH: Thank you.
17 CHAIRMAN UHRIG: Other questions? Any comments
18 from the staff?
19 MR. CALVO: No. I think the presentation covered
20 it.
21 CHAIRMAN UHRIG: With this, we will recess and
22 come back at 11:00.
23 [Recess.]
24 CHAIRMAN UHRIG: We will come back into session.
25 Go ahead.
. 84
1 MR. MARINOS: My name is Evangelos Marinos. I am
2 the Section Chief for the Instrumentation and Control
3 Section in the Electrical Instrumentation Branch in NRR.
4 There are two sections, the electrical section and the
5 instrumentation section.
6 In the instrumentation section, of course, we do
7 all the instrumentation reviews, including the digital
8 reviews that you have heard today.
9 We have staff over here that conducted these
10 reviews and if any questions arise that are specific to the
11 review and the SER that you have copies of, they'll be ready
12 to address them.
13 There are also people here from Research who help
14 us in maintaining our status with the advanced issues as
15 they emerge and we look to them to keep us abreast of what
16 is happening.
17 And with that, I will start and give you a quick
18 overview of how we conducted the review. A lot of what I'm
19 going to present is redundant with the presentations you've
20 heard already, but this is a major thing.
21 The reason for replacing the digital equipment, as
22 you already heard, is analog equipment are going obsolete.
23 Plant components are aging and maintenance costs are
24 increasing and vendors that support analog equipment will no
25 longer provide equipment.
. 85
1 Digital equipment and components are readily
2 available with potential for performance and reliability
3 improvements, as you also heard today from Siemens and ABB.
4 The replacements, of course, include the -- they
5 are expected to replace reactor protection systems,
6 engineered safeguards systems, management systems and
7 balance of plant equipment, which are, to a certain degree,
8 already in place, balance of plant, like feedwater systems
9 controls are replaced with digital systems.
10 Presently, we have the status of our reviews are
11 as you see in the slide. We have completed the Siemens
12 review and the Westinghouse ABB/CE. We have in-house right
13 now, we're reviewing the ASICS, which is application
14 specific integrated control circuit, and this is a digital
15 system that is just a specific function type of platform.
16 It doesn't have the extent of the main platforms that were
17 described today.
18 The unique features, that is that this kind of
19 circuit design, it can be fully tested and we can have
20 better confidence in its performance.
21 We are still reviewing this and we expect to have
22 it completed this year, by the end of this next month.
23 An additional review we're doing is the Triconex,
24 which just arrived for review, and that platform is
25 essentially the same magnitude as the two that you have
. 86
1 heard today.
2 A large platform and the features of that platform
3 is about the same as the ones that were described today.
4 CHAIRMAN UHRIG: Are there other systems that you
5 expect coming in in the next year or two or are these the
6 three principal --
7 MR. MARINOS: I heard, in fact, yesterday, from a
8 new employee we have, that a French company, I don't recall
9 the name of it, which provides the platforms for French
10 reactors, is considering to submit a topical report for our
11 review, which will be similar to the ones you've heard
12 today.
13 But this is just, I guess, a rumor or just an
14 information that really has no --
15 CHAIRMAN UHRIG: Is that Gillett? It makes no
16 difference.
17 MR. MARINOS: Would you tell me the company's
18 name? Schnela Electric.
19 In our review, we've used the guidelines as
20 security Siemens and ABB/CE presented. The principal
21 guidelines is, of course, the Chapter 7 of the SRP and
22 IEEE-603 and 7-4.3.2.
23 All these documents, particularly the standard
24 review plan, of course, has been fully reviewed by ACRS and
25 over the years that is relevant on a standard review plan
. 87
1 Section 7, Chapter 7, and ACRS is familiar with the contents
2 of that.
3 More specifically, in those guidelines, we have,
4 of course, the branch technical positions that deal with
5 individual areas, like the software review, the branch
6 position 14, defense-in-depth, as you heard today from both
7 vendors. We've reviewed defense-in-depth and have
8 guidelines and criteria which we follow and vendors, of
9 course, know it, to address the specifics that we're
10 interested in.
11 Real-time performance is, of course, we make sure
12 that the platforms can meet the time requirements for an
13 accident event, for a design basis event, time of functions
14 that need to be performed.
15 The on-line periodic testing, as you've heard
16 again today, we evaluate the capability for doing that
17 on-line periodically or continuously, however they prefer to
18 do it. And we look at the level of detail of design. We
19 have, of course, a branch position there. And, of course,
20 programmable logic controllers, their design, software and
21 everything.
22 We have a position that identifies the --
23 highlights the areas that we will be interested in the
24 design.
25 Verification and validation reviews and audits of
. 88
1 software and hardware and their criteria there, Regulatory
2 Guides and IEEE standards that provide guideline by which
3 tells the vendors how they should conduct the verification
4 and validations to assure that the product, the end product
5 meets the expectations of the design.
6 Of course, we also have requirements, lots of
7 them, for software configuration management, which you heard
8 again today, is important to know that the product you have
9 is the product you designed for.
10 The test documentation, software unit testing, of
11 course, more software requirement specifications and
12 software life cycle process, we, again, emphasize that in
13 our review, the planning through the operation of any
14 digital system will make sure that they have proper
15 procedures and documentation to assure that the life cycle
16 is credible.
17 Challenges in the review of the design system,
18 there are many challenges that we have as we're reviewing
19 those things. The rapidly changing software engineering
20 technology, as Ken Scarola indicted, it's changing with the
21 speed of light. I'm afraid we are operating at the speed of
22 sound, but we try and catch up with it, we do the best we
23 can to maintain that
24 CHAIRMAN UHRIG: Isn't the rapid change occurring
25 in the hardware as opposed to the software or is it both?
. 89
1 MR. MARINOS: It's both, but the hardware, I'm
2 sure, is the one that's changing faster than the software.
3 There is, of course, changes in the languages that are being
4 used right now, but they're basically the same, small
5 variations in the software languages being used.
6 The continuous performance, which is, of course, sequential
7 performance of the analog systems are hard-wired. Its
8 parameter, its function is wired there and you constantly
9 see it in an analog form. In the digital, you rely in the
10 cycle to come back to it.
11 So there is a challenge there to make sure that
12 timing is correct and we have sufficient time to come back
13 to the function that we left.
14 Software reliability is one of the principal areas
15 that gives us a challenge. In large platforms, like the
16 ones described today, testing is, to a large degree,
17 limited. You cannot test all the functions that you can have
18 in a platform like this, so you can have unintended
19 functions, you can have failures that cannot be identified.
20 So as you heard, we rely a lot on the diversity
21 and defense-in-depth to compliment the reliability that we
22 may e losing from the software, lack of full testability.
23 Of course, detecting design errors would be one of
24 those errors in the software. With hardware, it could be
25 minimized through the periodic testing and the diagnostics
. 90
1 that are available.
2 Complete testing refers to the software
3 reliability.
4 Potential for common mode failures is, as we
5 talked about, software errors. The complexity of operating
6 systems. Complexity in the operating systems are mainly the
7 systems that are used as the ABB/CE is a commercial grade
8 type of system that is being applied in nuclear service. We
9 need to look at more carefully how we qualify that, and
10 that's the commercial dedication area.
11 Equipment sensitivity environment and temperature,
12 humidity and EMI and RFI was discussed. We have specific
13 criteria for qualification and we place a great attention to
14 that. And vendors have addressed those issues.
15 In our reviews, this is going to be a little
16 redundant, we look at the principally the adequacy of
17 commercial grade dedication process to assure safety grade
18 quality platform.
19 This is a serious process. There are a lot of
20 criteria that have been generated, as we indicated earlier.
21 There's EPRI documents that have been generated that we have
22 endorsed and IEEE standards that vendors need to follow in
23 order to commercially dedicate platforms that are not
24 specifically designed and qualified for nuclear service.
25 System requirements, hardware and software
. 91
1 specifications and equipment qualification documents and
2 test data are also being reviewed by the staff. The formal
3 design process, the life cycle was discussed earlier. We
4 look at that and make sure that what they have there will be
5 what they intended to have in the planning, is what the
6 operation will provide, and we look at all the planning of
7 the design, implementation, testing and the final operation
8 aspects of the designs of the life cycle.
9 And adequacy of configuration management and
10 system software. System software is what was discussed
11 earlier
12 today. Again, we place great emphasis in our reviews, and
13 various other documentation.
14 Verification and validation. We look carefully at
15 independence of the people that do the verification and
16 validation to make sure that the designers are not
17 influenced by their own, of course, scheduling and funding
18 requirements and constraints when they do verification and
19 validation. So we try to make sure that the people that do
20 that work are not constrained by the same problems that the
21 designers are, so that the product comes out as more
22 reliable.
23 CHAIRMAN UHRIG: They probably learned out of the
24 same book.
25 MR. MARINOS: They may have learned, but they're
. 92
1 presumably different people with different manners of
2 organization, they have different interests.
3 CHAIRMAN UHRIG: I understand.
4 MR. MARINOS: And we do conduct audits. We go to
5 the sites and we look at some of the documentation from the
6 design through the implementation and testing of some of the
7 software.
8 Environmental qualifications, the platform, as we
9 talked already about this. And interfaces with other
10 equipment and human-machine interfaces.
11 CHAIRMAN UHRIG: What are the environmental
12 requirements for the systems that we're talking about here?
13 Are they that it has to survive a LOCA, a LOCA environment?
14 MR. MARINOS: No, because as stated earlier, those
15 -- the equipment are either in relay rooms or control rooms,
16 usually in the relay room where the cabinets are being
17 replaced.
18 In fact, a lot of them would tend to retain the
19 cabinets that they had before and put the equipment in the
20 old cabinets that have the seismic qualification already.
21 So the environment that was required for analog
22 systems, of course, may be more sensitive for the digital,
23 but that is the kind of qualification that they will need.
24 We don't expect -- now, in smart transmitters,
25 which is something that is coming to us, the transducer
. 93
1 actually is replaced, the traditional transducer with a
2 digital and actually the I/O is right in there and you get
3 the digital signal right out of the transducer.
4 So the qualification of that instrument may be a
5 little different because of the environment that it's in.
6 CHAIRMAN UHRIG: More severe.
7 MR. MARINOS: Correct. But we don't have them yet
8 in safety applications.
9 Interface with existing equipment, communications,
10 timing requirements. Timing requirements to assure that the
11 execution of the whole cycle meets the design basis
12 requirements for actuation of a system when it's needed.
13 MR. LEITCH: Excuse me. I notice that in the
14 Westinghouse SER, there are ten generic issues listed, but I
15 don't see a similar listing in the Siemens. Might I
16 conclude that there are no generic issues related to the
17 Siemens?
18 MR. MARINOS: I'm coming to them in the
19 presentation and maybe we can discuss it then, if I may.
20 MR. LEITCH: Okay. Fine. In the plant specific
21 reviews, now, which will be different than the platform, we
22 will look at the plant specific requirements as they
23 interface with the design details, how were differences in
24 existing nuclear plant equipment interfaces, how they
25 interface with the platform, application specific software
. 94
1 integration with qualified platforms.
2 Of course, they have to generate new software for
3 the application area, so we will apply the same sort of
4 review criteria as we did for the platform for software and
5 hardware and so basically we do the same thing.
6 We will look at the control room design and see
7 how it is amenable to this change. Technical specification
8 modifications, you've heard, again, today, the modification
9 will be essentially relaxing requirements and we are
10 prepared to do that to evaluate those relaxations in
11 extending the surveillance intervals on the basis of the
12 continuous monitoring and testing of the equipment and the
13 reliability of the hardware mainly, because the hardware is
14 continuously monitored, which analog systems generally were
15 not.
16 So we expect significant relaxations for this
17 equipment. Defense-in-depth and diversity, a determination
18 will be -- there is a methodology, as they pointed out today
19 in the platform presentations, generic methodology that the
20 vendors will provide, but then there is a plant specific
21 defense-in-depth based on the design of the systems, what
22 kind of equipment, what kind of systems they will use to
23 compliment the platform in terms of to address the
24 defense-in-depth.
25 So, therefore, we will do a specific determination
. 95
1 of the adequacy of defense-in-depth and diversity on a plant
2 specific basis. And the implementation of design.
3 In the Siemens Teleperm review, we completed the
4 SER, as you saw, 5/5/2000 and we find it acceptable, with
5 the following items that remain open.
6 We identified four items; power supply to be
7 qualified according to the EPRI document, the EPRI document
8 we have endorsed and addresses the quality of the power
9 supply for the digital equipment.
10 The environmental qualifications are addressed
11 also in the same topical report. The seismic qualifications
12 that you heard, it was presented, now we still have open
13 items. I think Siemens did not indicate there was an open
14 area, I'm not sure, but there is an area we still need to
15 get information on.
16 And the EMC qualification, according to another
17 topical report, an EPRI topical report 102323.
18 So I think that Siemens is planning to address
19 that or if not, we will address it on a plant specific
20 basis. If a platform comes in with specific application and
21 it's not addressed by, it will be addressed one way or
22 another, either by Siemens or by plant specific application.
23 MR. LEITCH: Does EMC include RFI?
24 MR. MARINOS: Yes. EMI/RFI is both of them.
25 Plant specific review for the Teleperm XS review we will
. 96
1 look for, of course, set point analyses, how they address
2 the set points for the accident analysis and make sure that
3 the accidents in Chapter 15 or whatever chapter it is for
4 the particular plant are addressed in their evaluation of
5 that, in the implementation of the platform.
6 Again, plant specific technical specifications will be
7 looked at before we address any relaxations in how the tech
8 specs, the present inspection of plant apply to this.
9 The power supply quality, again, is an area that
10 we will look at, because the plant specific area will have
11 separate power supplies.
12 Isolation devices to be qualified, and those are
13 the devices that would be used when information is taken
14 from the platform into communication areas for sharing. We
15 want to make sure that no unwanted transients are affecting
16 redundant channels in the system.
17 The Westinghouse/CE Common Q review was completed
18 August 2000 and the area that we have open, as Ken Scarola
19 addressed them earlier, is the flat panel display system,
20 which is presently non-safety and they will address the
21 safety aspects of it at a later date.
22 Hardware, non-AC-160 hardware have not undergone
23 commercial dedication. Now, as we said before, commercial
24 dedication of hardware and software is something that we
25 look at and that is not completed yet for that particular
. 97
1 area.
2 And the technical specifications that NEI has a
3 more generic review of that, so we will wait for them before
4 address the technical specifications.
5 Again, the plant specific areas for the
6 Westinghouse type will be -- well, suitability of the 600
7 I/O modules, I think Ken Scarola addressed that earlier, how
8 it's going to be applied in plant specific applications.
9 Environmental data, plant specific temperatures and humidity
10 and seismic qualification requirements, as enveloped by the
11 Common Q qualification, to make sure that the plant specific
12 are enveloped. If not, they will have to do a more special
13 qualification.
14 The life cycle, again, plant specific hardware and
15 software life cycle process, we will evaluate, that is an
16 area that needs to be addressed.
17 Timing analysis, again, we make sure that the
18 timing of the events are consistent with the application of
19 that platform.
20 And modification of plant specific technical
21 specifications. And the capacity of shared sources, the
22 common mode, make sure that the power supplies meet all the
23 requirements.
24 In conclusion, we expect, in the near future, to
25 receive plant specific applications and license amendments
. 98
1 for the two platforms that are already out there. We will
2 continue to review the Triconex and the Westinghouse
3 platforms. And we're seeking to increase our qualified
4 staff. We're always short on staff and we are anticipating
5 a large number of reviews in plant specific areas. We will
6 need more staff to continue this and train ourselves.
7 CHAIRMAN UHRIG: Given the pressure to maintain or
8 actually reduce manpower within the Commission, is this
9 going to be a severe problem getting people with expertise?
10 MR. MARINOS: I don't think so. I think our
11 management is sensitive enough and have been informed enough
12 and, as you pointed out earlier, the Commission is aware of
13 this and, no, I don't think this area is, in fact -- I'm
14 encouraged to put out a vacancy announcement to get
15 technical --
16 CHAIRMAN UHRIG: The problem will be getting
17 somebody to respond to a vacancy notice. Not many people
18 out there that are really qualified.
19 MR. MARINOS: That is the problem. So we've got
20 to maintain what we have and increase our staff and also
21 maintain, of course, the expertise as the technology is
22 moving at the speed of light, as Ken indicated.
23 So we have a great challenge there. So as I
24 mentioned earlier, we are cooperating with Research.
25 Research is doing a lot of searching into maintain our
. 99
1 expertise and keep us in touch with the changing technology
2 and there are a number of issues that we usually have
3 identified and they are having contracts with specialists in
4 various labs or other technical areas, organizations to
5 maintain our status.
6 That's it.
7 MR. LEITCH: I notice that Westinghouse has
8 withdrawn the E3.
9 MR. MARINOS: Yes.
10 MR. LEITCH: Is there any suggestion that in light
11 of the acquisition of ABB/CE, that the ASICS may be
12 withdrawn?
13 MR. MARINOS: I'm not sure. I suspected this. It
14 was not as far along as the ABB was when we were reviewing
15 it. It was mostly in the planning stages and my guess is it
16 is, but maybe Westinghouse can address that.
17 MR. SCAROLA: I can address it. No, there is no
18 intention to withdraw the ASICS application. We really view
19 these as different products for different markets. So the
20 ASICS application will stay intact.
21 MR. LEITCH: The E3.
22 MR. SCAROLA: The E3 has been withdrawn and the
23 AC-160, the Common Q platform is now the Westinghouse
24 standard product for all safety system replacements.
25 MR. MARINOS: The question was why was it
. 100
1 withdrawn.
2 MR. SCAROLA: I'm sorry. It was withdrawn because
3 they were overlapping products and when Westinghouse
4 acquired ABB, we were much further along with the Common Q
5 licensing than Westinghouse was with E3. So it was just a
6 business decision. There was no need for two platforms.
7 The ASICS is a different product because it's
8 really targeted for essentially spare part type of
9 replacements, one for one module replacements, not full
10 system replacements. It's a different market.
11 CHAIRMAN UHRIG: E3 was essentially the Sizewell B
12 technology?
13 MR. SCAROLA: No. In fact, the E3 was a
14 combination of the Sizewell software with the Ovation
15 product hardware. It was a merging of the two platforms.
16 CHAIRMAN UHRIG: Thank you. Any comments from
17 committee members?
18 MR. LEITCH: I see in the discussion of the
19 Siemens there is a lot of specific general design criteria
20 that it says it meets this, it meets this, it meets this.
21 That seems to be absent in the Westinghouse -- is it just a
22 difference in presentation?
23 MR. MARINOS: Style. It's different reviewers.
24 Though we had the peer review and most everyone in the group
25 that has this expertise participated in the review of all of
. 101
1 them, of both of those topical reports, it was a specific
2 reviewer, however, designated, or two. So it was a
3 different style of review. We didn't really pay that much
4 attention to make it as consistent as it might have been,
5 but that's not the case. They all meet the same criteria.
6 MR. LEITCH: Thank you.
7 MR. MARINOS: That's exactly right.
8 CHAIRMAN UHRIG: Any other questions?
9 MR. LEITCH: No.
10 CHAIRMAN UHRIG: Well, thank you very much.
11 MR. SIEBER: I think we can close this session at
12 this time. I guess I'd like to extend our appreciation to
13 all the presenters today. I think it was well done and at
14 this time we will recess the meeting and go to lunch.
15 [Whereupon, at 11:29 a.m., the meeting was
16 concluded.]
17
18
19
20
21
22
23
24
25