ML100080281 

UNITED STATES 

NUCLEAR REGULATORY COMMISSION 

OFFICE OF NUCLEAR REACTOR REGULATION 

OFFICE OF NEW REACTORS 

WASHINGTON, DC 20555-0001 

May 28, 2010 

NRC INFORMATION NOTICE 2010-10: IMPLEMENTATION OF A DIGITAL CONTROL 

SYSTEM UNDER 10 CFR 50.59 

ADDRESSEES

All holders of an operating license or construction permit for a nuclear power reactor issued 

under Title 10 of the Code of Federal Regulations (10 CFR) Part 50, “Domestic Licensing of 

Production and Utilization Facilities,” except those who have permanently ceased operations 

and have certified that fuel has been permanently removed from the reactor vessel. 

All holders of or applicants for a combined license issued under 10 CFR Part 52, “Licenses, 

Certifications, and Approvals for Nuclear Power Plants.” 

PURPOSE 

The U.S. Nuclear Regulatory Commission (NRC) is issuing this information notice (IN) to inform 

addressees about NRC inspection findings regarding a licensee’s evaluation under 

10 CFR 50.59, “Changes, Tests, and Experiments,” for a plant modification that implemented a 

digital control system. The NRC expects that recipients will review the information for 

applicability to their facilities and will consider actions, as appropriate, to avoid similar problems. 

Suggestions contained in this IN are not NRC requirements; therefore, no specific action or 

written response is required. 

DESCRIPTION OF CIRCUMSTANCES 

In December 2009, NRC inspectors completed an inspection of a plant modification to replace 

an analog-based rod control management system (RCMS) with a computer-based system at 

LaSalle County Station, Unit 2. The RCMS is a nonsafety related system; however, it remains 

important to safety because it directly affects core reactivity. The licensee’s evaluation of this 

modification under 10 CFR 50.59 concluded that this modification could be performed without 

prior NRC approval. However, the NRC inspectors found that the licensee’s 10 CFR 50.59 

evaluation did not meet 10 CFR 50.59(d)(1), because the licensee failed to perform a written 

evaluation that adequately provided a basis for the determination that the RCMS digital upgrade 

did not require a license amendment. Specifically, while the licensee used Nuclear Energy 

Institute (NEI) 01-01, “Guideline on Licensing Digital Upgrades,” issued March 2002 

(Agencywide Documents Access and Management System (ADAMS) Accession 

No. ML020860169) when performing the upgrade, the licensee did not properly evaluate the 

RCMS modification in accordance with the NRC-endorsed guidance in NEI 01-01. The licensee 

did not appropriately address the questions in NEI 01-01, Appendix A, “Supplemental Questions 

for Addressing 10 CFR 50.59 Evaluation Criteria.” These questions are part of the appropriate 
IN 2010-10 

Page 2 of 4 

method that ensures the adequacy of the 10 CFR 50.59 evaluation and, as stated in NEI 01-01, 

the questions “should be answered in sufficient detail, either by reference to a source document 

or by direct statements, that an independent third party can verify judgments.” 

The NRC inspectors determined that the licensee had not properly evaluated questions 

associated with software common-cause failure and the potential for spurious, uncontrolled 

simultaneous withdrawal of four control rods. The licensee also had not adequately addressed 

important aspects of the modification in terms of the effects of the resulting increase in 

complexity. 

NEI 01-01 states the following: 

Additional measures are appropriate for systems that are highly safety 

significant (i.e., high consequences) to achieve an acceptable level of risk. For 

digital upgrades to such systems, the defense-in-depth and diversity in the 

overall plant design are analyzed to assure that where there are vulnerabilities to 

software common cause failure, the plant has adequate capability to cope with 

these vulnerabilities. This defense-in-depth and diversity analysis is considered 

a beyond design basis concern, reflecting an understanding that while not 

quantifiable, the likelihood of a software common cause failure in a high quality 

digital system is significantly below that of a single active hardware failure. The 

analysis is performed as part of the design process, as the results could affect 

the design of the digital upgrade. 

The NRC inspectors noted that the licensee’s 10 CFR 50.59 evaluation did not address 

software faults as a source of common-cause failure, even though the RCMS is a highly safetysignificant system in which certain software common-cause failures could potentially place the 

plant in a condition outside its design basis by causing unanalyzed abnormal operating 

occurrences, which could potentially result in fuel cladding damage. 

During discussions with the NRC inspectors, the licensee technical staff stated their belief that a 

software common-cause failure did not need to be considered in the 10 CFR 50.59 evaluation, 

based on the guidance in NEI 01-01, Section 4.4.6. The licensee interpreted this guidance to 

allow changes if the likelihood of a software common-cause failure could be justified as 

sufficiently low because of the quality of the software application. The licensee determined that 

the software quality was sufficiently high to provide reasonable assurance that the likelihood of 

software failure was not credible and that therefore the digital upgrade would not require prior 

NRC review on the basis of software common-cause failures. 

However, based on the NRC inspectors’ concerns regarding software common-cause failure 

and the potential for spurious, uncontrolled withdrawal of four control rods, the licensee revised 

the 10 CFR 50.59 evaluation and addressed the supplemental questions in NEI 01-01, 

Appendix A. The licensee implemented compensatory actions to mitigate the consequences of 

a software common-cause failure of the RCMS, such as performing cycle-specific core analyses 

to demonstrate that the core safety limits could not be exceeded, even if four control rods were 

spuriously withdrawn simultaneously. The NRC staff reviewed the analyses and identified no 

concerns. 
IN 2010-10 

Page 3 of 4 

Additional information is available in LaSalle County Station, Units 1 and 2, NRC Integrated 

Inspection Report 05000373/2009005; 05000374/2009005, dated February 9, 2010 (ADAMS 

Accession No. ML100400240). 

BACKGROUND 

Background information on this issue appears in NRC Regulatory Issue Summary 

(RIS) 2002-22, “Use of EPRI/NEI Joint Task Force Report, ‘Guideline on Licensing Digital 

Upgrades: EPRI TR-102348, Revision 1, NEI 01-01: A Revision of EPRI TR-102348 to Reflect 

Changes to the 10 CFR 50.59 Rule,’” dated November 25, 2002 (ADAMS Accession No. 

ML023160044). 

DISCUSSION

The requirements in 10 CFR 50.59 define the criteria that establish when a license amendment 

is required before implementing plant changes. NEI 01-01 provides guidance to licensees on 

designing and implementing digital upgrades and performing 10 CFR 50.59 evaluations. 

RIS 2002-22 communicated the NRC’s endorsement NEI 01-01 for use as guidance in 

designing and implementing digital upgrades to instrumentation and control systems. 

RIS 2002-02 specifies that statements in the NRC staff’s evaluation of NEI 01-01 qualify the 

NRC staff’s endorsement of the report and provide staff positions on several aspects of the 

design and licensing processes. 

The NRC inspection of the RCMS digital upgrade at LaSalle Unit 2 found a violation of 

10 CFR 50.59(d)(1) for insufficient documentation in the 10 CFR 50.59 evaluation. However, 

because of the lack of clarity in the NRC guidance and requirements for digital modifications, 

the NRC used enforcement discretion and did not issue a violation to address the manner in 

which the licensee addressed common-mode software failures in its 10 CFR 50.59 evaluation. 

The NRC staff intends to further qualify the NRC staff’s endorsement of NEI 01-01 to address 

the issues discussed in this IN. Notwithstanding, the NEI 01-01 guidance clearly indicates that, 

for digital upgrades to systems that are highly safety-significant, licensees should perform a 

defense-in-depth and diversity analysis as part of the design process to ensure that the plant 

has adequate capability to cope with software common-cause failure vulnerabilities. The 

NEI 01-01 discussion of the defense-in-depth and diversity analysis does not exclude from 

consideration software common-cause failure vulnerabilities based on a high-quality software 

design, implementation, and verification and validation program. 
IN 2010-10 

Page 4 of 4 

CONTACT 

This IN requires no specific action or written response. Please direct any questions about this 

matter to the technical contact listed below or to the appropriate Office of Nuclear Reactor 

Regulation (NRR) project manager. 

 /RA/ /RA/ by JTappert for 

Timothy McGinty, Director Glenn Tracy, Director 

Division of Policy and Rulemaking Division of Construction Inspection and 

Office of Nuclear Reactor Regulation Operational Programs 

 Office of New Reactors 

Technical Contact: Bernard Dittman, NRR 

301-415-2947 

E-mail: bernard.dittman@nrc.gov

Note: NRC generic communications may be found on the NRC public Web site, 

http://www.nrc.gov, under Electronic Reading Room/Document Collections. 
IN 2010-10 

Page 4 of 4 

CONTACT 

This IN requires no specific action or written response. Please direct any questions about this 

matter to the technical contact listed below or to the appropriate Office of Nuclear Reactor 

Regulation (NRR) project manager. 

 /RA/ /RA/ by JTappert for

Timothy McGinty, Director Glenn Tracy, Director 

Division of Policy and Rulemaking Division of Construction Inspection and 

Office of Nuclear Reactor Regulation Operational Programs 

 Office of New Reactors 

Technical Contact: Bernard Dittman, NRR 

301-415-2947 

E-mail: bernard.dittman@nrc.gov

Note: NRC generic communications may be found on the NRC public Web site, 

http://www.nrc.gov, under Electronic Reading Room/Document Collections.

ADAMS Accession Number: ML100080281 TAC No.: ME2975

OFFICE EICB:DE:NRR Tech Editor BC:EICB:NRR BC:EB3:RIII D:DE:NRR 

NAME BDittman CHsu WKemper RDaley DSkeen 

DATE 04/20/10 04/12/10 e-mail 04/21/10 e-mail 04/07/10 e-mail 04/27/10 

OFFICE LA:PGCB:NRR PM:PGCB:NRR BC:PGCB:NRR D:DCIP:NRO D:DPR:NRR 

NAME CHawes DBeaulieu MMurphy GTracy JTappert for TMcGinty 

DATE 04/27/10 04/23/10 04/28/10 05/28/10 5/28/10 

OFFICE OGC NLO:NRR OGC NLO:NRO NRGA:DNRL:NRO 

NAME BMizuno JMartin WBurton 

DATE 05/12/10 05/12/10 05/28/10 

OFFICIAL RECORD COPY