ML22007A265
| ML22007A265 | |
| Person / Time | |
|---|---|
| Site: | Armed Forces Radiobiology Research Institute |
| Issue date: | 01/07/2022 |
| From: | US Dept of Defense, Armed Forces Radiobiology Research Institute |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML22007A263 | List: |
| References | |
| EPID L-2020-NFA-0012 | |
| Download: ML22007A265 (16) | |
Text
Responses to Open Items Related to the License Amendment Request for the Upgrade of the Instrumentation and Control System for the Armed Forces Radiobiology Research Institute TRIGA Reactor 7 January 2022
The following are responses to open items from the on-going audit in support of the Digital Instrumentation and Control System Upgrade for the AFRRI TRIGA Reactor (EPID L-2020-NFA-0012).
- 1.
Identify the correct definition for the RWP acronym. Some sections of the LAR use the term rod withdrawal inhibit (RWI), while other sections use the term rod withdrawal prevents and/or rod withdrawal prohibit (RWP). Furthermore, the List of Abbreviations, Acronyms and Symbols in the LAR defines the acronym RWP as Rod withdrawal permit.
The abbreviation RWP and RWI refer to rod withdrawal prevent, prohibit, inhibit or interlock.
The terms prevent, prohibit, and inhibit are used interchangeably. The term prohibit is generally preferred.
In the Table of Abbreviations for the LAR and the Supplement to the LAR the abbreviation RWP erroneously lists P as "permit". This should be prohibit.
- 2.
Section 2.1.4.2.1.4 of the system requirements specification identifies interlock signals to be displayed in the control console. However, this list does not include all interlocks identified in Section 7.3.4 of the SAR. Clarify why the control console would not display all rod withdrawal interlocks.
From the System Requirements Specification (SRS) (T3A100B7101-SYR Rev A) Section 2.1.4.2.1.4, the following interlocks are listed:
RWP: NLW 1kW RWP NLW Low Src (Note that this has been moved to the NMP)
RWP: NLW Period RWP: NLW HV Low RWP: Two Up (two up buttons pressed simultaneously)
TR: Fire Invalid (can't press the Fire button at this time)
RWP: Two Up (two UP buttons, not counting TR UP).
RWP: Demin Inlet Temp High RWP: Low Pool Level RWP: NP, NPP, NFT, NLW, or NMP Loss of Comms The only interlock that is specified in the SRS and not included in the as-built configuration is the Loss of Comm from the nuclear instrument (NI) channels. When a loss of communications with an NI occurs, the console simulates all trips in that NI being set, but the actual trips in the NI unit continue to be controlled by the analog hardware. Neither the software in the console nor the software in the NI modules have the ability to set those trips; they are completely hardware controlled. Note that after an NI comm failure (assuming the NI is otherwise still functional) the NI continues to monitor their inputs and set the trips accordingly.
Reference:
General Atomics TRIGA Reactor Instrumentation and Control System Operation and Maintenance Manual (O&M) - T3A100B7911-1OM Revision A, Section 4.11, Page 4-21.This is discussed in Site Acceptance Test (SAT) Procedure Part 1 (T3A100B7373-SAT Rev A) Section 1.2.7 (Page 8) and tested in SAT Part 1 Section 2.3.4.2 (Page 16).
Figure 2 Interlock Pane of the AFRRI Control Console.
Not all conditions that prohibit UP rod motion are displayed on the console. During the following four (4) modes of operation the UP buttons are disabled:
- 1. SCRAM Mode. In SCRAM mode the system will automatically counteract any rod drive motion up when a scram is active. In other words, if the operator attempts to withdraw the rod drive mechanism, the system will automatically drive the mechanism back down. The actual control rod will not move and will remain fully inserted since there is no magnet power. This is described in the O&M pages 3-9 and 4-16.
- 2. AUTOMATIC Mode. For AUTOMATIC mode rod motion UP can still occur but this is controlled by the system computer and not by the operator. All UP buttons are disabled in AUTOMATC mode.
- 3. PULSE Mode. All UP buttons are disabled in PULSE mode.
- 4. SQUARE-WAVE Mode. For SQUARE-WAVE Mode, the time prior to pushing the FIRE button the UP buttons are disabled. For the time after pushing the FIRE button, rod motion UP can occur by the system computer and also by the operator, but the operator can only press one UP button at a time. This is known as the TR: Two Up interlock. This interlock is only active during SQUARE-WAVE Mode. After the transient rod is fired, the system has 30 seconds to obtain the specified power level. If two up buttons (SHIM, SAFE, or REG) are pressed at the same time this interlock will occur, but only during this 30 second Square Wave ramp up time. Once the specified power level is reached then the system switches to AUTOMATIC mode and all UP buttons are disabled as noted above. Refer to SAT Part 1 Page 44.
The interlocks that are displayed on the console (refer to Figure 2-1) are for those modes of operation where rod motion is allowed but a specific condition has occurred to prohibit rod motion UP.
Two examples are listed below.
(1)
The reactor is in MANUAL mode and operator is increasing reactor power, rod motion is allowed but if operator exceeds the 3 second period, the PI: NLW Period interlock will trip and will prevent further rod out motion and will be displayed on the console.
(2)
The reactor is in AUTOMATIC mode and water temperature to the inlet of the demineralizer exceeds the setpoint which trips the RWP: Demin Temp interlock.
This will prevent further rod out motion and will be displayed on the console.
In NRC Audit Open Item 26, the following interlocks where listed (
Reference:
General Atomics TRIGA Reactor Instrumentation and Control System Operation and Maintenance Manual (O&M)
- T3A100B7911-1OM Revision A, Page 3-9):
- 1. Scrams not reset. NOTE: If a scram condition is active, then the control rod drives will be driven down and cannot be raised until the scram condition has cleared. This does not apply to the transient rod. Described in the O&M page 3-9 and 4-16. This is not displayed on the console as an interlock.
- 2. Pulse Mode prohibit Above 1 kW (NLW). This is displayed as TR: NLW 1 kW
- 4. Less than 3-second Period (NLW). This is displayed as PI: NLW Period
- 6. Temperature greater than 60°C (RTD). This is displayed as RWP: Demin Temp
- 7. Pool Level below 1 (FLOAT). This is displayed as RWP: Low Pool
- 8. Control Rod UP prohibit if more than one UP button is pushed. (not counting the transient rod). This is displayed as RWP: Two Up
- 9. UP buttons are inactive while in AUTOMATIC mode, DOWN buttons are always active.
This is not displayed as an interlock.
- 10. UP buttons are inactive while in PULSE mode, DOWN buttons are always active. This is not displayed on the console as an interlock.
- 11. UP buttons are inactive while in SQUARE-WAVE Ready mode, DOWN buttons are always active. This is not displayed on the console as an interlock.
- 12. Prevent air to transient rod in steady state mode unless the drive cylinder is fully inserted (Fire Invalid). This is displayed as TR: Fire Invalid
- 13. In SQUARE-WAVE Mode after the FIRE button is pressed if two (or more) Rod UP buttons (Shim/Saf/Reg) are pressed. This is displayed as TR: Two Up
- 3.
During a pulsing operation, an additional Inhibited field will be shown for the NLW and NMP channels and an additional Bypassed field will be shown for the NP channel in the control console. Describe what signals generate the Inhibited field signal?
The control console has always performed the bypass for the NP-1000 overpower scram during Pulse Mode operation. This software control has been maintained in the new control system.
Refer to Figure 3 Pulse Mode Functional Block Diagram for the Old AFRRI Control Console which is from previous control console Operation and Maintenance Manual E117-1006, Figure 3-11.
Figure 3 Pulse Mode Functional Block Diagram for the Old AFRRI Control Console.
These signals are generated by the control console computer. The sequence of events are (refer to Section 2.19 Pulse Mode of SAT 1 (page 67):
Enter Pulse Mode.
Press the FIRE pushbutton.
Computer verifies that all conditions are satisfied (1 kW interlock, transient rod on bottom, etc.).
The computer sends a signal to the to the NP (bypass the overpower scram), the NLW (disconnect the electrometer) and NMP (disconnect the electrometer); signal is sent to the NPP for gain adjustment during pulse.
The console display will show the NP bypassed, NMP and NLW inhibited fields.
The pulse occurs.
The pulse timer scram occurs.
The units automatically drop out of bypass/inhibited; NPP gain reverted.
From LAR Rev 1 Page 3-10 Via connector pins on the rear of the module; the module accepts remote Trip Reset, Remote Test mode selection, and remote signal to disconnect the detector input for pulse mode operation. (Note: this is performed via software).
NOTE: The AFRRI Technical Specifications Table 2 explicitly does not require the NP and NPP overpower scrams during pulse mode operation.
Figure 3 Relay Drawer of the Data Acquisition Cabinet Software controlled relays during Pulse Mode 1.
Pulse Gain 2.
NP Scram Bypass Refer to Drawing T3A300E151 Sheet 3 of 3.
- 4.
Provide information regarding the NVT (total energy) integrator. The NVT integrates the area under the power curve of a reactor pulse and returns a value that is proportional to the total energy of the pulse. Additionally, the NVT is shown in the scram loop for the NPP. Describe the purpose of the scram (protective function or experiment control), as well as how the 50 MW-s trip setpoint was selected. Also, describe and how the channel will be calibrated.
The AFRRI Technical Specifications has a requirement for an NVT Integrating circuit but there is no associated scram requirement. The only scram associated with pulsing is the Pulse Timer with a maximum setpoint of 15 seconds.
The previous AFRRI Control Console had a NVT Total and NVT Peak bargraphs but there was not a scram associated for either parameter. The current setpoint of 50 MW-s was taken from the maximum values displayed on the old (and new) bargraphs. Refer to Figure 4-1.
The NVT Total Energy scram is not required by the technical specifications nor is AFFRI proposing a specification for this scram. There is no current purpose for this scram functionality therefore it is set for the maximum value, so for all intents and purposes the scram is disabled since it should never be tripped. General Atomics GA-7882 Kinetic Behavior of TRIGA Reactors shows that the energy released from pulse is approximately linear relative to reactivity insertion. From Table VII, of the same document, using the most conservative model and interpolating from the $3 and $5 data points would yield about 38.3 MW-sec for a $3.5 pulse.
Therefore, even with a TS maximum $3.5 pulse it is not possible to obtain 50 MW-s.
Note that the scram circuit and scram mechanisms do not respond fast enough to counteract a pulse and that it is the large negative temperature feedback inherent to TRIGA fuel that is solely responsible for preventing fuel temperature limits from being exceeded, therefore having a scram associated with NVT total energy would not provide any safety function.
The NVT circuit is an integrator that is calibrated for a particular ramp rate based on site specific parameters and is scaled from steady-state power calibration values. The time constant of the integrator circuit is known, so integrated power is just a ratio of the charge accumulated on a capacitor during the pulse. There is a threshold circuit so the NVT circuit only starts accumulating charge above 100% power and stops integrating once power falls below that value.
NPP-1000, Nuclear Power Module User Manual T3281000-1UM Section 4 and Section 7 details the calibration procedure.
Figure 4 NVT Total and NVT Peak Bargraphs of Old & New AFRRI Control Console
- 5.
The GA Software quality assurance verification and validation plan states that a software quality assurance report would be prepared for AFRRI. Was this report prepared?
A SQA report cannot be located. It is possible it was never produced, or has been lost.
- 6.
During the audit, the staff noted that modifications were made to the SAT, Part 1, that require clarifications. (a) Section 2.21 indicates that tests operation of the auxiliary panel was performed. Why was this performed if the auxiliary panel was not changed in the LAR? (b)
Section 1.1 includes red font to describe test of the RWP. Why is this font red? What does it mean?
(a)
There is an error in SAT Part 1. The auxiliary panel was not changed. The subheading Auxiliary Panel between steps 9 and 10 should be changed to Reactor Mode Control Panel. SAT Part 1 will be revised to correct this error prior to the performance of the test during the Reactor Restart Plan.
(b)
This section was not part of the SAT Part 1 but was added as an addendum after the Low Current Source interlock was moved from the NLW to the NMP. SAT Part 1 will be revised to incorporate this change prior to the performance of the test during the Reactor Restart Plan.
- 7.
In the LAR, AFRRI proposed a Technical Specification change to replace the setpoint for the rod withdrawal interlock for the NMP-1000. The modification would change the setpoint for the power level from <0.5 cps. to <1x10-5 watts. Explain whether these setpoints are equivalent, and provide the calculation that shows this conversion.
The NMP-1000 channel provides the Low Source Interlock. The NMP-1000 uses a compensated ion chamber, and as such, outputs a current and is designed to display in watts and not counts per second (cps), therefore the interlock setpoint needs to be specified in watts.
Neither the NLW-1000 nor NMP-1000 provides a reading in cps. The NLW-1000 displays percent full power while the NMP-1000 displays watts. Providing an equivalency from either instrument to cps would be difficult and inaccurate.
The design function of the low source interlock is to only permit rod withdrawal when there are sufficient neutrons to provide proper instrument response for bringing the reactor critical under controlled conditions. Therefore, it is only necessary to verify that the channel is capable of performing this design function. This is accomplished by using a neutron source to ensure that the channel is responding to neutrons and not just gammas. The neutron source used at AFRRI is a 3 curie (Ci) americium-beryllium (Am-Be), cylindrical-shaped, double encapsulated source. The source is located in the core, and remains there during operation, but can be removed for training, maintenance, and to verify the functionality of the source interlock.
During the functionality test, the source is removed from its normal in core location and the power monitoring instrument, NMP-1000, is allowed to drop below the interlock setpoint which trips the rod withdraw interlock and prohibits the withdrawal of control rods. This test ensures that the interlock is set properly.
From Figure 7-1, it is shown that a setpoint of 1x10-5 watts is well above the level when the source is removed which provides assurance that channel is operating correctly by detecting sufficient source neutron prior to startup. Therefore, it is concluded that the proposed change to Table 3 of TS 3.2.2 for the source range interlock will continue to perform the design function required by this channel.
In the unlikely event that the NMP-1000 fails to provide the proper response and the operator attempts to start the reactor with little or no source neutrons, this could result in a reactivity insertion event. This event would be bounded by the analysis presented in the Chapter 13 of the SAR and in Section 1.3.5 of the Supplement to the LAR, therefore, the consequences would be minimal.
Figure 7 Ranges of Operation for the NMP-1000 1MW 100 kW 10 kW 1 kW 100 W 10 W 1 W 0.1 W 0.01 W 0.001 W 0.0001 W Source Level with Am-Be Source Installed 0.00001 W Low Source Interlock Setpoint Source Level with Am-Be Source Removed 0.000001 W
- 8.
GA-ESI AFRRI TRIGA Console System Test Summary Report, T3A100B7369-TST, Rev. A, Section 1.6.1, identifies two defects that were not resolved. Explain why these defects were not resolved and whether the defects will be resolved before the restart of the reactor.
The two items are:
(a).
CONS-278 SCRAM Timer Red Sometimes.
After the software is restarted, the SCRAM Timer box comes up with a red background.
This issue was found after testing and it does not affect the performance of the system, therefore, it was decided that it will not be fixed, since that would involve having to repeat the entire software verification and validation process.
(b).
CONS-269 When changing tabs on the display, set NPPGain false.
To ensure that the NPP is properly displaying data, the @NPPGain variable must be false. However, it needs to be left on after a pulse so that the analog bargraphs display data properly. In order to solve this, it is necessary to set @NPPGain to false when switching from one tab (e.g., PULSE) to another.
This how the software is configured, therefore this item is resolved.
- 9.
Provide additional information to supplement Section 2.3 of LAR, Rev. 1, regarding the operation of the dolly switch.
As part of the digital instrumentation and control upgrade, a core dolly override switch was added to the front of the Facility Interlock Cabinet (FIS). The O&M Manual briefly describes the override switch as toggle switch RP2. Refer to Page 3-28 of the O&M Manual and Drawing T3A100E840 Rev B. Figure 5-1 shows a close up of the switch, while Figure 5-4 shows that location of the switch on the FIS cabinet.
The switch has the following positions shown in Figure 1.
Left - Region 1 Center - OFF Right - Region 3 Figure 5 Core Dolly Override Switch The switch is momentary, i.e., it will spring return to the center or OFF position when not actively held to the left or right positions. It is important to note that the override switch does not actually move the core dolly, it only permits the core dolly to be moved. The actual
movement of the core dolly is still controlled with pushbuttons on the Reactor Mode Control Panel (or foot pedals) in the control room.
For each region there are two limit switches that will stop core dolly movement - the inner and outer limit switches. Refer to Figure 5-2 for a diagram of the switches. The outer limit switch stops the core dolly when it reaches the far end of the travel to prevent contacting the pool liner. The outer switches cannot be overridden. To prevent contact with the lead shield doors, the inner limit switch stops the core dolly from further movement if the lead shield doors are not fully opened.
Figure 5 Core Dolly Limit Switch Diagram For example, take the scenario of the operator moving the core dolly toward region 3 with the lead door closed. Once the core dolly comes off of the inner limit switch (switch is now open) the core dolly will stop and further movement of the core dolly is prohibited, this includes movement back toward region 1. Originally, the only way to recover from this scenario was to manually actuate the switch. This was accomplished by inserting a finger through a cutout in the core dolly rail and pushing down on the lever arm of the switch. Refer to Figure 5-3 below.
Figure 5 Core Dolly Limit Switch Access Point
This introduced a potential pinch/crush hazard to personnel who performed this task. This scenario would occur (twice, Steps 3 and 69) during the performance of M033 Facility Interlock Checklist procedure. To eliminate the hazard, the previous FIS was modified and an override switch was added to the inside of the cabinet. Refer to Figure 5-6. The new FIS cabinet maintains this functionality.
The use of the override switch is administratively controlled such that trained reactor personnel are required to be directly supervising the core movement while the switch is engaged. This requirement is inherently enforced since the override switch is momentary and has to be actively held in place to permit movement of the core dolly. In the event of operator error or equipment malfunction the torque generated by core dolly drive mechanism is limited by a slip clutch. The slip clutch is set to prevent damage if the core shroud or any other part of the core dolly comes into contact with an obstruction, such as the core shroud contacting the lead shield doors. As such, a failure resulting in inadvertent contact between the core shroud and an obstruction has minimal consequences. Therefore, movement of the core dolly in region 2 while the lead shield doors are closed during maintenance activities does not does not impose any undue risk to the health and safety of the reactor, reactor personnel or to the public.
Figure 5 Core Dolly Override Switch Core Dolly Override Switch
Figure 5 Core Dolly Wiring Schematic T3A100E840
Figure 5 Previous Core Dolly Override Switch Previous Core Dolly Override Switch