NRC Generic Letter 1995-02
IUNITED STATESNUCLEAR REGULATORY COMMISSIONOFFICE OF NUCLEAR REACTOR REGULATIONWASHINGTON, D.C. 20555April 26, 1995NRC GENERIC LETTER 95-02: USE OF NUMARC/EPRI REPORT TR-102348, "GUIDELINE ONLICENSING DIGITAL UPGRADES," IN DETERMINING THEACCEPTABILITY OF PERFORMING ANALOG-TO-DIGITALREPLACEMENTS UNDER 10 CFR 50.59
Addressees
All holders of operating licenses or construction permits for nuclear powerreactors.
Purpose
The U.S. Nuclear Regulatory Commission (NRC) staff is issuing this genericletter to inform addressees of a new staff position on the use of NuclearManagement and Resources Council/Electrical Power Research Institute(NUMARC/EPRI) Report TR-102348, "Guideline on Licensing Digital Upgrades,"dated December 1993, as acceptable guidance for determining when an analog-to-digital replacement can be performed without prior NRC staff approval underthe requirements of Section 50.59 of Title 10 of the Code of FederalRegulations (10 CFR 50.59). The report applies to all digital equipment thatuses software and, in particular, to microprocessor-based systems. Thereport, together with the clarifications discussed in this generic letter,represents a method acceptable to the staff for use in making a determinationof whether or not an unreviewed safety question exists with respect to10 CFR 50.59 requirements. It is expected that recipients will consider theinformation in this generic letter when performing analog-to-digitalinstrumentation and control systems replacements. However, suggestionscontained in this generic letter are not NRC requirements; therefore, nospecific action or written response is required.
Description of Circumstances
The age-related degradation of some earlier analog electronic systems and thedifficulties in obtaining qualified replacement components for those systems,as well as a desire for enhanced features such as automatic self-test anddiagnostics, greater flexibility, and increased data availability haveprompted some operating reactor licensees to replace existing analog systemswith digital systems. After reviewing a number of these digital systemreplacements and digital equipment failures in both nuclear and non-nuclearapplications, the staff has identified potentially safety-significant concernspertaining to digital systems in nuclear power plants. The concerns of thestaff stem from the design characteristics specific to the new digitalelectronics that could result in failure modes and system malfunctions thateither were not considered during the initial plant design or may not havebeen evaluated in sufficient detail in the safety analysis report. These9504140227 PDR ADOCK 0SQO00o03 P 9 S o q(2/71 GL 95-02April 26, 1995 concerns include potential common mode failures due to (1) the use of commonsoftware in redundant channels, (2) increased sensitivity to the effects ofelectromagnetic interference, (3) the improper use and control of equipmentused to control and modify software and hardware configurations, (4) theeffect that some digital designs have on diverse trip functions, (5) impropersystem integration, and (6) inappropriate commercial dedication of digitalelectronics.As a result of the above concerns, the NRC staff issued a draft generic letterfor public comment in the Federal Register (57FR36680) on August 14, 1992,wherein a position was established that essentially all safety-related digitalreplacements result in an unreviewed safety question because of thepossibility of the creation of a different type of malfunction than thoseevaluated previously in the safety analysis report. The staff concluded,therefore, that prior approval by the NRC staff of all safety-related digitalmodifications was necessary. However, subsequent discussions and comments onthe draft generic letter have resulted in the staff position as described inthis letter.DiscussionTo assist licensees in effectively implementing digital replacements byaddressing the concerns indicated above and in determining which upgrades canbe performed under 10 CFR 50.59 without prior NRC staff approval, Report TR-102348 has been published. The NRC staff reviewed and provided comments onthis report while it was in draft form, and the final report reflects acoordinated effort between industry and the NRC staff. The NRC staff believesthat, when properly implemented, modern digital systems offer the potentialfor greater system reliability and enhanced features such as automatic self-test and diagnostics, as well as greater flexibility, increased dataavailability, and ease of modification.Report TR-102348 contains guidance that will assist licensees in implementingand licensing digital upgrades in such a manner as to minimize the potentialconcerns indicated above. It describes actions to be taken in the design andimplementation process to ensure that the digital upgrade licensing and safetyissues are addressed, and ways to consider these issues when performing the10 CFR 50.59 evaluation. It is not the intent of the report or of the NRCstaff to predispose the outcome of the 10 CFR 50.59 process, but rather toprovide a process that will assist licensees in reaching a proper conclusionregarding the existence of an unreviewed safety question when undertaking adigital system replacement. However, as shown in Example 5-6 of the report,when using this document as guidance for the analysis of modifications of somesafety-significant systems such as the reactor protection system or anengineered safety feature system, it is likely these digital modificationswill require staff review when 10 CFR 50.59 criteria are applied. Report TR-102348 states in the introduction that the guidance is supplemental to andconsistent with that provided in NSAC-125, "Guidelines for 10 CFR 50.59 SafetyEvaluations." Licensees should bear in mind that NSAC-125 has not been GL 95-02April 26, 1995 endorsed by the NRC, and therefore any use of those guidelines is advisoryonly, and that nothing in NSAC-125 can be construed as a modification of10 CFR 50.59. While the guidelines of NSAC-125 can be useful in theevaluation of systems, and are representative of logic used in making a10 CFR 50.59 determination, the actual determination of whether or not anunreviewed safety question exists must be done in accordance with10 CFR 50.59.10 CFR 50.59(a)(2)(i) and (ii) states that a proposed change, test orexperiment involves an unreviewed safety question if the probability orconsequences of an accident or malfunction previously evaluated in the safetyanalysis report may increase, or if the possibility for an accident ormalfunction of a different type than any previously evaluated in the safetyanalysis report may be created. If during the 10 CFR 50.59 determinationthere is uncertainty about whether the probability or consequences mayincrease, or whether the possibility of a different type of accident ormalfunction may be created, the uncertainty should lead the licensee toconclude that the probability or consequences may increase or a new type ofmalfunction may be created. If the uncertainty is only on the degree ofimprovement the digital system will provide, the modification would notinvolve an unreviewed safety question. If, however, the uncertainty involveswhether or not this modification is more or less safe than the previous analogsystem, or if no degree of safety has been determined, an unreviewed safetyquestion is involved.The staff believes that two clarifications to Report TR-102348 are appropriateas follows:1. 10 CFR 50.59 requires determination of whether "a possibility for anaccident or malfunction of a different type than any evaluatedpreviously in the safety analysis report may be created." As a part ofthis determination, Report TR-102348 suggests looking for "any new typesof system-level failures that would result in effects not previouslyconsidered in the FSAR." (For example, see TR-102348, Section 4.5,Question 6.) It is the NRC staff's position that the system-levelconsidered in this regard should be the digital system being installed.The staff believes that this clarification is necessary because10 CFR 50.59 does not refer to an accident or malfunction that resultsin a "system-level" failure different from any previously analyzed butrather to the malfunction of the equipment important to safety beingmodified. It is the change in the facility as described in the safetyanalysis report that is to be analyzed under 10 CFR 50.59 to determineif it involves an unreviewed safety question, that is, the digitalequipment that replaced the analog equipment, rather than the otherwiseunchanged system of which that equipment is a part is to be analyzed.This does not mean that all digital equipment usage will automaticallyresult in an unreviewed safety question simply as a result of the use ofsoftware. Software failure, including common-mode failure, must be GL 95-02April 26, 1995 considered during the 10 CFR 50.59 evaluation as a possible differenttype of malfunction. However, if software failure cannot cause anequipment malfunction of a different type than any previously evaluatedin the safety analysis report, then no unreviewed safety question existswith respect to this criterion, and in the absence of otherdisqualifying criteria, the replacement can be performed under10 CFR 50.59 without prior NRC approval. For many digital systemmodifications involving relatively simple systems such as discussed inexample 5-5 of NUMARC/EPRI Report TR-102348, the NRC staff believes thata conclusion may be reached that there is no possibility that adifferent type of malfunction may be created.As an example, when installing an upgraded digital high pressurefunction of the reactor trip system, it is the digital instrumentationand control circuitry associated with the high pressure reactor tripfunction that would be subject to the questions on failure modes andeffects (equipment malfunctions) identified in the report that would beanalyzed to determine involvement of an unreviewed safety question, notthe entire reactor trip system. If the entire trip system is beingreplaced with a digital upgrade, then the entire replacement digitalinstrumentation and control system would be subject to the failure modesand effects analysis, not the full range of instrumentation and controlsystems being actuated to respond to a transient or accident.2. 10 CFR 50.59 requires maintaining records that "include a written safetyevaluation which provides the bases for the determination that thechange, test, or experiment does not involve an unreviewed safetyquestion." Section 3.1.2 of the report points out that the use ofqualitative engineering judgment is typically involved in areas that arenot readily quantifiable, such as likelihood of the failure, itsimportance to the system and to the plant, and the practicality andincremental improvements of various options available for resolving thefailure. Such judgments may be difficult to duplicate and understand ata later time. It is the NRC staff's position that the basis for theengineering judgment and the logic used in the determination should bedocumented to the extent practicable. This type of documentation is ofparticular importance in areas where no established consensus methodsare available, such as for software reliability, or the use ofcommercial-grade hardware and software where full documentation of thedesign process is not available.EPRI Report TR-102348, together with the clarifications discussed in thisgeneric letter, can be used as guidance by licensees in both designing analog-to-digital replacements and, with respect to unreviewed safety questiondeterminations, determining if an analog-to-digital replacement can beperformed under 10 CFR 50.59 without prior staff approval.
GL 95-02April 26, 1995 This generic letter requires no specific action or written response. If youhave any questions about this matter, please contact the technical contactlisted below or the appropriate Office of Nuclear Reactor Regulation projectmanager.y .mie antAssociate Direct rojectsM;;4d-a nf Mlu-1aa Rartor ReaulatiornTechnical contact:Lead project manager:Attachment:List of Recently IssuedPaul J. Loeser, NRR(301) 504-2825Robert M. Pulsifer, NRR(301) 504-3016NRC Generic Letters~ t~l I
AttachmentGL 95-02April 26, 1995 LIST OF RECENTLY ISSUED GENERIC LETTERSGenericDate ofT e. e a nt ,Teciiad TnP ..L .Letter bUD.ieCt --------V89-04,SUPP. 195-0194-0494-0394-0294-01GUIDANCE ON DEVELOPINGACCEPTABLE INSERVICETESTING PROGRAMSNRC STAFF TECHNICAL POSI-TION ON FIRE PROTECTIONFOR FUEL CYCLE FACILITIESVOLUNTARY REPORTING OFADDITIONAL OCCUPATIONALRADIATION EXPOSURE DATAINTERGRANULAR STRESSCORROSION CRACKING OF CORESHROUDS IN BOILING WATERLONG-TERM SOLUTIONS ANDUPGRADE OF INTERIMOPERATING RECOMMENDATIONSFOR THERMAL-HYDRAULICINSTABILITIES IN BOILINGWATER REACTORSREMOVAL OF ACCELERATEDTESTING AND SPECIAL RE-PORTING REQUIREMENTS FOREMERGENCY DIESEL GENERATORS04/04/9501/26/9509/02/9407/22/9407/11/9405/31/95ALL HOLDERS OF OLs ORCPs FOR NUCLEAR POWERREACTORS.ALL CURRENT LICENSEES& APPLICANTS FOR URANIUMCONVERSION & FUELFABRICATION FACILITIES.ALL HOLDERS OF OLs OR CPsFOR NPRs, RADIOGRAPHYLICENSEES, FUEL PROCES-SING LICENSEES, FABRICA-TING & REPROCESSINGLICENSEES, MANUFACTURERS& DISTRIBUTORS OF BY-PRODUCT MAT'L, INDEPEND-DENT SPENT FUEL STORAGEINSTALLATIONS, FACILITIESFOR LAND DISPOSAL OF LOW-LEVEL WASTE, & GEOLOGICREPOSITORIES FOR HIGH-LEVEL WASTE.ALL HOLDERS OF OLs OR CPsFOR BOILING WATERREACTORS EXCEPT FOR BIGROCK POINT, WHICH DOESNOT HAVE A CORE SHROUD.ALL HOLDERS OF OLs FORBOILING WATER REACTORSEXCEPT BIG ROCK POINTALL HOLDERS OF OLs FORNPRsOL = OPERATING LICENSECP = CONSTRUCTION PERMITNPR = NUCLEAR POWER REACTORS
a-XGL 95-02April 26, 1995 This generic letter requires no specific action or written response. If youhave any questions about this matter, please contact the technical contactlisted below or the appropriate Office of Nuclear Reactor Regulation projectmanager.Roy P. ZimmermanAssociate Director for ProjectsOffice of Nuclear Reactor RegulationTechnical contact:Lead project manager:Attachment:List of Recently IssuPaul J. Loeser, NRR(301) 504-2825Robert M. Pulsifer, NRR(301) 504-3016ed NRC Generic LettersNOTE: JHConran's 4/12/95 e-mail to PJLoeser indicated that ELJordan haddetermined that further formal review of the generic letter by CRGR is notneeded.* SEE FJMiraglia 4/3/95 memo to ELJordan for PREVIOUS CONCURRENCEs** SEE PREVIOUS PAGE FOR CONCURRENCESDOCUMENT NAME: 95-02.GL iTo receive a copy of th document, Indicate In the box: wC' -Copy without chmentJncos wEd -Copy wit atachmentlenosure 'N' = No copyOFFICEDNAMEDATETA:DOPS/NRR** 7AJKugler04/17/95r D:DOPS/NRR** IBGrimes04/17/95ADOlRP41Nma GL 95-XXApril XX, 1995 This generic letter requires no specific action or written response. If youhave any questions about this mat te, ple0S0 contact the technical contactlisted below or the appropriate Office of Nuclear Reactor Regulation projectmanager.Roy P. ZimmermanAssociate Director for ProjectsOffice of Nuclear Reactor RegulationTechnical contact:Lead project manager:Attachment:List of Recently IssuedPaul J. Loeser, NRR(301) 504-2825Robert M. Pulsifer, NRR(301) 504-3016NRC Generic LettersNOTE: JHConran's 4/12/95 e-mail to PJLoeser indicated that ELJordan haddetermined that further formal review of the generic letter by CRGR is notneeded.* SEE FJMiraglia 4/3/95 memo to ELJordan for PREVIOUS CONCURRENCEsDOCUMENT NAME: S:\DOPS SEC\A2D.GLTo mraviwe a conv of this document. Indicate In the box: 'C = Copv without attachment/enclosure'E' = Copy with attachmentlenclosure 'N' e No copy.OFFICE HICB* SC:HICB* l BC:HICB* D: DRCHI TECH ED*NAME PLoeser JMauck JWermiel BBoger MMejacDATE 03/07/95 03/07/95 03/07/95 103/09/95 03/01/95OFFICE PM:DRCH* OGC* A DTfjR jJ G CI:NRR INAME RPulsipher SLewis AThadani AKugler % , BGries_DATE 03/08/95 03/21/95 03/21/95 04/./dy/95 r 04//OFFICEADP:NRRI1INAME RPZimmermanDATE 04/ /95 _
GL 95-02April 26, 1995 This generic letter requires no specific action or written response. If youhave any questions about this matter, please contact the technical contactlisted below or the appropriate Office of Nuclear Reactor Regulation projectmanager.Roy P. ZimmermanAssociate Director for ProjectsOffice of Nuclear Reactor RegulationTechnical contact:Lead project manager:Attachment:List of Recently IssuedPaul J. Loeser, NRR(301) 504-2825Robert M. Pulsifer, NRR(301) 504-3016NRC Generic LettersNOTE: JHConran's 4/12/95 e-mail to PJLoeser indicated that ELJordan haddetermined that further formal review of the generic letter by CRGR is notneeded.* SEE FJMiraglia 4/3/95 memo to ELJordan for PREVIOUS CONCURRENCEsDOCUMENT NAME: 95-02.GLTo rsceive a cop of this document. Indilcate hI the box: 'C' -Copy without attachmentlenclosure *E- -Cope with attachmentVenclasure'N' -No copyOFFICE HICB* I SC:HICB* I BC:HICB* I D:DRCH* I TECH ED* INAME PLoeser JMauck JWermiel BBoger MMejacDATE 03/07/95 03/07/95 03/07/95 03/09/95 03/01/95OFFICE PM:DRCH* I OGC* ADT:NRR* I OGCB:NRR I DORS:NRRNAME RPulsipher SLewis AThadani AKugler BGrimesDATE 03/08/95 03/21/95 03/21/95 04/ /95 04/ /95_ _ .=. ..1OFFICEADP:NRRIINAME RPZimmerman IDATE 04/ /95 1 Ed...8 I 1>,A, Uw4IU L. *uua d -£ -Ifrom the Nuclear Energy Institute (NEI) and three from utilities endorsing theNEI comment) concerned the scope of the system to be considered whendetermining whether a different type of accident or malfunction is created asdefined in 10 CFR 50.59. The NEI comment was submitted to the Office of theGeneral Counsel (OGC) for review and legal interpretation. OGC stated thatthe NEI comment was an incorrect interpretation of the requirements of10 CFR 50.59 and that the original statement in the draft generic letter wascorrectly worded. However, OGC provided additional clarifying language, whichwas incorporated in the final generic letter. The fifth comment was fromFlorida Power & Light Company and addressed the Institute of Electrical andElectronic Engineers standards referenced in Report TR-102348. Attachment 2is a redline version of the generic letter showing the final changes made onthe basis of the public comments.Attachments 3-7 contain the comment letters received from NEI, Florida Power &Light Company, PECO Energy Company, Baltimore Gas and Electric Company, andVirginia Power. Attachment 8 contains the staff response to the comments.Attachment 9 contains the responses to the questions in Section IV.B of theCRGR Charter. Attachment 10 is a copy of the original generic report TR-102348, 'Guideline on Licensing Digital Upgrades.'No actions are requested by this proposed generic letter.No further regulatory activity is anticipated.The Office of the General Counsel has reviewed this generic letter, the publiccomments, and the changes as a result of the public comments, and has no legalobjections.The generic letter is sponsored by Bruce A. Boger, Director, Division ofReactor Controls and Human Factors.Attachments:1. Proposed Generic Letter, Use of WUIARC/EPRI Report TR-102348. %Guideline an Licensing DigitaLUpgrades,' in Determining the Acceptability of Performing Analog-to-DigftaL Replacements Under10 CFR 50.59"2. Redline version of generic letter3. Nuclear Energy Institute letter dated January 12, 19954. Florida Power & Light Company letter dated January 17, 19955. PECO Energy Company letter dated January 20, 1956. BaLtimore Gas and Electric Company letter dated January 23. 19957. Virginia Power letter dated January 24, 1995S. Staff response to coments9. Responses to CRGR Charter Questions10. TR-102348, KGudeline on Licensing Digital Upgradesmcc: J. T. Larkins, ACRSDISTRIBUTION:B. K. Grimes, NRR Central Files B. J. Shelton, IRM HICB R/FR. K. Ingram, NRRSEE PREVIOUS CONCURRENCE*DOCUMENT KME: A:NEUCRGR.PKGTo , *a awy o Oh dbamu. Woni h Or bez*n acs -Cwr wfttaA &Uashrnmw/mh nnf e T -C, rcbwo ' No *qMOFFICE N B* IS C I J -C:HICs