ML22007A265
| ML22007A265 | |
| Person / Time | |
|---|---|
| Site: | Armed Forces Radiobiology Research Institute |
| Issue date: | 01/07/2022 |
| From: | US Dept of Defense, Armed Forces Radiobiology Research Institute |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML22007A263 | List: |
| References | |
| EPID L-2020-NFA-0012 | |
| Download: ML22007A265 (16) | |
Text
Responses to Open Ite ms Related to the Licen se A mend ment Reque st for the Upgrade of the Instrumentation and Control System for the Armed Forc es Radiobiology Research Institute TRIGA Reactor
7 January 2022 The following are responses to open items from the on-going audit in support of the Digital Instrumentation and Control System Upgrade for the AFRRI TRIGA Reactor (EPID L-2020- NFA-001 2).
- 1. Identify the correct definition for the RWP acronym. Some sections of the LAR use the term rod withdrawal inhibit (RWI), while other sections use the term rod withdrawal prevents and/or rod withdrawal prohibit (RWP). Furthermore, the List of Abbreviations, Acronyms and Symbols in the LAR defines the acronym RWP as Rod withdrawal permit.
The abbreviation RWP and RWI refer to rod withdrawa l prevent, prohibit, inhibit or interlock.
The terms prevent, prohibit, and inhibit are used inter changeably. The term prohibit is generally preferred.
In the Table of Abbreviations for the LAR and the Sup plement to the LAR the abbreviation RWP erroneously list s P as "permit". This should be prohibit.
- 2. Section 2.1.4.2. 1.4 of the system requirements specifi cation identifies interlock signals to be displayed in the control console. However, this list does not include all interlocks identified in Section 7.3.4 of the SAR. Clarify why the control console would not display all rod withdrawal interlocks.
From the System Requirements Specification (SRS) (T3 A100B7101-SYR Rev A) Section 2.1.4.2.1.4, the following interlocks are listed:
- RWP: NLW 1kW
- RWP: NLW Period
- RWP: NLW HV Low
- RWP: Two Up (two up butto ns pressed simultaneously)
- TR: Fire Invalid (can't press the Fire button a t this time)
- RWP: Two Up (two UP buttons, no t counting TR UP).
- RWP: Demin Inlet Temp High
- RWP: Low Pool Level
- RWP: NP, NPP, NFT, NLW, or NM P Loss of Comms The only interlock that is specified in the SRS and no t i ncluded in the as -built configuration is the Los s of Comm from the n uclear instrument (NI) channels. When a loss of communications with an NI occurs, the console simulates all trips in that NI being set, but the actual trips in the NI unit continue to be con trolled by the analog hardware. Neither the software in the console nor the sof tware in the NI modules have the ability to set those trips; they are completely hardware controlled. Note that af ter an NI comm failure (assuming the NI is otherwise still functional) the NI continues to monitor their inputs an d set the trips accordingly.
Reference:
General Atomics TRIGA Reactor Instrumentation and Control System Operation and Maintenance Manual (O&M) - T3A10 0B7911-1OM Re vision A, Section 4.11, Page 4-21.This is discussed in Site Acceptance Tes t (SAT) Procedure Part 1 (T3A10 0B7373-SAT Rev A) Section 1.2.7 (Page 8) and tested in SAT Part 1 Section 2.3.4.2 (Page 16).
Fi g ure 2 Interlock Pane of the AFRRI Control C onsole.
Not all conditions that prohibit UP rod motion are disp layed on the console. During the following four (4) modes of operation the UP buttons are disabled:
- 1. SCRAM Mode. In SC RA M mode the system will automatically counteract any ro d drive motion up when a scram is ac tive. In other words, if the operator attempts to withdraw the rod drive mechanism, the system will automatically drive the mechanism back down. The actual con trol rod will not move and will remain fu lly inserted since there is no magnet power. This is described in the O&M pages 3-9 and 4-16.
- 2. AUTOMATIC Mode. For AUTOMATIC mode rod motion UP can still occur bu t this is controlled by the system compu ter and no t by the ope rator. All UP buttons are disabled in AUTOMATC mode.
- 3. PULSE Mode. All UP buttons are disabled in PULSE mode.
- 4. SQUARE-WA VE Mode. For SQUARE-WAVE Mode, the t ime prior to pushing the FIRE button the UP buttons are disabled. For the time after pushing the FIRE button, rod motion UP can occur by the system computer and also by the operato r, but the opera tor can only press one UP button at a time. This is known as the TR: Two Up in terlock. This interlock is only active during SQUARE-WAVE Mode. After the transient rod is fired, the system has 30 seconds to obtain the specified power level. If two up buttons (SH IM, SAFE, or REG) are pressed a t the same time this interlock will occur, but only during this 30 seco nd Square Wave ramp up time. Once the specified power level is reached then the system switches to AUTOMATIC mode and all UP buttons are disabled as noted above. Refer to SAT Part 1 Page 44.
The interlocks that are displayed on the cons ole (refer to Figure 2-1) are for those modes of operation where rod motion is allowed but a specific condition has occurred to prohibit rod motion UP.
Two examples are listed below.
(1) The reactor is in MANUAL mode and operator is increa sing reactor power, rod motion is allowed but if operator exceeds the 3 second peri od, the PI: NLW Period interlock will trip and will prevent further rod o ut motion and will be displayed on the console.
(2) The reactor is in AUTOMATIC mode and water temperature to the inlet of the demineralizer exceeds the setpoint which trips the RW P: Demin Temp interlock.
This will prevent further rod ou t motion and will be displayed on the console.
In NRC Audit Open Item 26, the following interlocks where listed (
Reference:
General Atomics TRIGA Reactor Instrumentation and Control System Op eration and Maintenance Manual ( O&M)
- T3A100B79 11-1OM Revision A, Page 3-9):
- 1. Scrams not reset. NOTE: If a s cram condition is active, then the control rod drives will be driven down and cannot be raised until the scram con dition has cleared. This does not apply to the transient rod. Described in the O&M page 3-9 and 4-16. This is not displayed on the console as an interlock.
- 2. Pulse Mode prohibit Above 1 kW (NLW). This is displayed as TR: NLW 1 kW
- 4. Less than 3-second Period (NLW). This is displayed as PI: NLW Period
- 6. Temperature greater than 60°C (RTD). This is displayed as RWP: Demin Temp
- 7. Pool Level below 1 (FLOAT). This is displayed as RWP: Low Pool
- 8. Control Rod UP prohibit if more than one UP button is pushed. (not cou nting the transient rod). This is displayed as RWP: Two Up
- 9. UP buttons are inactive while in AUTOMATIC mode, DOWN buttons are always active.
This is not displayed as an interlock.
- 10. UP buttons are inactive while in PULSE mode, DOWN buttons are always active. This is not displayed on the console as an interlock.
- 11. UP buttons are inactive while in SQUARE -WAVE Ready mode, DOWN buttons are always active. This is not displayed on the console as a n interlock.
- 12. Prevent air to transient rod in s teady state mode unles s the drive cylinder is fully inserted (Fire Invalid). This is displayed as TR: Fire Invalid
- 13. In SQUARE-WA VE Mode after the FIRE button is pressed if two (or more) Rod UP buttons (Shim/Saf/Reg) are pressed. This is displayed as TR: Two Up
- 3. During a pulsing operation, an additional Inhibited field will be shown for the NLW and NMP channels and an additional Bypassed field will be shown for the NP channel in the control console. Describe what signals generate the Inhibited field signal?
The control console has always performed the bypass f or the NP-1000 overpower scram during Pulse Mode operation. This software contr ol has been maintained in the new control system.
Refer to Figure 3 Pulse Mode Functional Block Diagram for the Old AFRRI Control Console which is from previous control console Opera tion and Maintenance Manual E117 -100 6, Figure 3-11.
Fi g ure 3 P ulse Mode Functional Block Diagram for the Old AFRRI Control C onsole.
These signals are generated by the control console computer. The sequence of events are (refer to Section 2.19 Pulse Mode of SAT 1 (page 6 7):
- Enter Pulse Mode.
- Press the FIRE pushbutton.
- Computer verifies that all conditions are satisfied (1 kW interlock, transient rod on bottom, etc.).
- The computer sends a signal to the to the NP (bypass the overpower scram), the NLW (disconnect the electrometer) and NMP (disconnect th e electrometer); signal is sent to the NPP for gain adjustment during pulse.
- The console display will show the NP bypassed, NMP and NLW inhibited fields.
- The pulse occurs.
- The pulse timer scram o ccurs.
- The units automatically drop out of bypass/inhibited; NPP gain reverted.
From LAR Rev 1 Page 3-10 Via co nnector pins on the r ear of the module; the module accepts remote Trip Reset, Remote Test mode selection, and remote si gnal to disconnect the detector input for pulse mode operation. ( Note: this is performed via software).
NOTE: The AFRRI T echnical Specifications Table 2 explicitly does not require the NP and NPP overpower scrams during pulse mode operation.
Software contr olled relays during Pulse Mode
- 1. Pulse Gain
- 2. NP Scram Bypass Refer to Drawing T3A300E1 51 Sheet 3 of 3.
Fi g ure 3 Relay Drawer of the Data Acquisition Cabinet
- 4. Provide information regarding the NVT (total energy) integrator. The NVT integrates the area under the power curve of a reactor pulse and returns a value that is proportional to the total energy of the pulse. Additionally, the NVT is shown in the scram loop for the NPP. Describe the purpose of the scram (protective function or experiment control), as well as how the 5 0 MW-s trip setpoint was selected. Also, describe and how the channel will be calibrated.
The AFRRI Technical Specifications has a requirement for an NVT Integrating circuit but there is no associated scram requirement. The only scram asso ciated with pulsing is the Pulse Timer with a maximum setpoint of 15 seconds.
The previous AFRRI Control Console had a NVT Total a nd NVT Peak bargraphs but there was not a scram associated for either parameter. The current s etpoint of 50 MW -s was taken from the maximum values displayed on the old (and new) bargraphs. Refer to Figure 4-1.
The NVT To tal Energy scram is not required by the technical specifications nor is AFFRI proposing a specification for this scram. There is no cu rrent purpose for this scram functionality therefore it is set for the maximum value, so for all intents and purposes the scram is disabled since it should never be tripped. General Atomics GA -7882 Kinetic Behavior of TRIGA Reactors shows that the energy released from pulse is approximately linear relative to reactivity insertion. From Table VII, of the same document, using the most conservative model and interpolating from the $3 and $5 data points would yield about 38.3 MW-sec for a $3.5 p ulse.
Therefore, even with a TS maximum $3.5 pulse it is not possible to obtain 50 MW-s.
Note that the scram circuit and scram mechanisms do not respond fas t enough to counteract a pulse and that it is t he large negative temperature feedback inherent to TRIGA fuel that is solely responsible for preventing fuel temperature limits from being exceeded, therefore having a scram associated with NVT to tal energy would not pro vide any safety function.
The NVT circuit is an integrator that is calibrated for a particular ramp rate based on site specific parameters and is scaled from steady-state power calibration values. The time constant of the integrator circuit is known, so integrated power is just a ratio of the charge accumulated on a capacitor during the pulse. There is a threshold circuit so the NVT circuit only starts accumulating charge above 100% power and s tops integrating once power falls below that value.
NPP-1000, Nuclear Power Module User Manual T3281000- 1UM Section 4 and Section 7 details the calibration procedure.
Fi g ure 4 NVT Total and NVT Peak Bargraphs of Old & New AFRRI Control Console
- 5. The GA Software quality assurance verification and validation plan states that a software quality assurance report would be prepared for AFRRI. Wa s this report prepared?
A SQA report cannot be located. It is possible it was ne ver produced, or has been lost.
- 6. During the audit, the staff noted that modifications were made to the SAT, Part 1, that require clarifications. (a) Section 2.21 indicates that tests operation of the auxiliary panel was performed. Why was this performed if the auxiliary panel was not changed in the LAR? (b)
Section 1.1 includes red font to describe test of the RWP. Why is this font red? What does it mean?
(a) There is an error in SAT Part 1. The auxiliary panel was not changed. T he sub heading Auxiliary Panel between steps 9 and 10 should be changed to Reactor Mode Control Panel. SAT Part 1 will be revised to correct this error prior to the performance of the test during the Reactor Restart Plan.
(b) This section was not part of the SAT Part 1 but was ad ded as an addendum after the Low Current Source interlock was moved from the NLW to the NMP. SAT Part 1 will be revised to incorporate this change prior to the performance of the test during the Reactor Restart Plan.
- 7. In the LAR, AFRRI proposed a Technical Specification change to replace the setpoint for the rod withdrawal interlock for the NMP-1000. The modification would change the setpoint for the power level from <0.5 cps. to <1x1 0-5 watts. Explain whether these setpoints are equivalent, and provide the calculation that shows this conversion.
The NMP-1000 channel provides the Low So urce Interlock. The NMP-1000 uses a compensated ion chamber, and as su ch, outpu ts a current an d is designed to display in watts and not coun ts per second (cps), therefore the interlock setpoint needs to be spe cified in watts.
Neither the NLW-1000 nor NMP-1000 provides a readi ng in cps. The NLW-1000 displays percent full power while the NMP-1000 displays watts. Providing an equivalency from either instrument to cps would be difficult and inaccura te.
The design function of the low source interlock is to on ly permit rod withdrawal when there are sufficient neutrons to provide proper instrument resp onse for bringing the reactor critical under controlled conditions. Therefore, it is only necessary to verify that the channel is capable of performing this design function. This is accomplished by using a neutron source to ensure that the channel is responding to neutr ons and n ot jus t ga mmas. The neutron source used a t AFRRI is a 3 curie (Ci) americium -be r y ll i um ( A m-Be), cyl i ndri cal-shaped, double encapsulated sour ce. The source is located in the core, and remains there during operation, bu t ca n be removed for training, maintenance, and to verify the functionality of the source interlock.
During the functionality test, the sour ce is removed from its normal in core location and the power monitoring instrument, NMP-1000, is allowed to drop below the interlock setpoint which trips the rod withdraw interlock and prohibits the with drawal of control rods. T his test ensures that t he interlock is set properly.
From Figure 7-1, i t is shown that a setpoint of 1x10-5 w atts is well above the level when the source is removed which provides assurance that chan nel is operating correctly by detecting sufficient source neutron prior to s tartup. Therefore, it is concluded tha t the proposed change to Table 3 of TS 3.2.2 for the sour ce range interlock will continue to perform the design function required by this channel.
In the unlikely event that the NMP-1000 fails to provide the proper response and the operator attempts to start the reac tor with little or no source n eutrons, this could result in a reac tivity insertion event. This event would be bounded by the analysis presented in the Chapter 13 of the SAR and in Section 1.3.5 of the Supplement to the LAR, therefore, the consequences would be mi nimal.
1MW
100 kW
10 kW
1 kW
100 W
10 W
1 W
0.1 W
0.01 W
0.001 W
Source Level with Am-Be Source Installed 0.0001 W
Low Source Interlock Setpoint 0.00001 W Source Level with Am-Be Source Removed
0.000001 W
Fi g ure 7 Ranges of Operation for the NMP -1000
- 8. GA-ESI AFRRI TRIGA Console System Test Summary Report, T3A100B7369-TST, Rev. A, Section 1.6.1, identifies two defects that were not resolved. Explain why these defects were not resolved and whether the defects will be re solved before the restart of the reactor.
The two items are:
(a). C ONS-278 SCRAM Timer Red Sometimes.
After the software is restarted, the SCRAM Timer box comes up with a red background.
This issue was found after testing and it does not affect the performance of the system, therefore, it was decided tha t it will not be fixed, since that would involve having to repeat the entire software verification and validation process.
(b). C ONS-269 When changing tabs on the display, set NPPGain false.
To ensure tha t the NPP is properly displaying data, the @NPPGain variable must be false. However, it needs to be left on after a pulse s o that the analog bargraphs display data properly. In order to solve this, it is necessary to s et @NPPGain to false when switching from one tab (e.g., PULSE) to another.
This how the sof tware is configured, therefore this ite m is resolved.
- 9. Provide additional information to supplement Section 2.3 of LAR, Rev. 1, regarding the operation of the dolly switch.
As part of the digital instrumentation and control upgr ade, a core dolly override switch was added to the front of the Facility Interlock Cabinet (FIS). The O&M Manual briefly describes the override switch as toggle switch RP2. Refer to Page 3-28 of t he O&M Manual and Drawing T3A100E8 40 Rev B. Figure 5-1 shows a close up of the switch, while Figure 5-4 shows that location of the switch on the FIS cabinet.
The switch has the following positions shown in Figure 1.
Left - Region 1
Center - OFF
Right - Region 3
Fi g ure 5 Core Dolly Override Switch
The switch is momentary, i.e., it will spring return to th e center or OFF position when not actively held to the left or right positions. It is important to note that the override switch does not ac tually move the core dolly, it only permits the co re dolly to be moved. The actual movement of the core dolly is still controlled with pushbuttons on the Reactor Mode Control Panel (or foot pedals) in the co ntrol room.
For each region there are two limit switches that will stop core dolly movement - the inner and outer limit switches. Refer to Figure 5-2 for a diagram of the switches. The o uter limit switch stops the core dolly when it reaches the far end of the travel to prevent con tacting the pool liner. The outer switches cannot be overridden. To pre vent conta ct with the lead shield doors, the inner limit switch stops the core dolly from further movement if the lead shield doors are not fully opened.
Fi g ure 5 Core Dolly Limit Switch Diagram
For example, take the scenario of the operator moving the core dolly toward region 3 with the lead door closed. Once the core dolly comes off of the inner limit switch (switch is now open) the core d olly will stop and further movement of the core dolly is prohibited, this includes movement back toward region 1. Originally, the only way to recover from this scenario was to manually actuate the switch. This was accomplished by inserting a finger through a cutout in the core dolly rail and pushing down on the lever arm of the switch. Refer to Figure 5-3 below.
Fi g ure 5 Core Dolly Limit Switch Access Point This introduced a p otential pinch/crush hazard to personnel who performed this task. This scenario would occur ( twice, Steps 3 and 69) during th e performance of M033 Facility Interlock Checklist procedure. To eliminate the hazard, the previous FIS was modified and an override switch was added to the inside of the cabinet. Refer to Figure 5-6. The new FIS cabinet maintains this functionality.
The use of the override switch is administratively controlled such that trained reactor person nel are required to be directly supervising the core movement while the switch is engaged. This requirement is inherently enforced since the override switch is momentary and has to be actively held in place to permit movement of the core dolly. In the event of operator error or equipment malfunction the torque generated by core dolly drive mechanism is limited by a slip clutch. The slip clutch is set to prevent damage if the core shroud or any other par t of the core dolly comes into contact with an obstruction, su ch as the core shroud con tacting the lead shield doors. As such, a failure resulting in inadvertent contact between the core shroud and an obstruction has minimal consequences. Therefore, movement of the core dolly in region 2 while the lead shield doors are closed during maintenance activities does not does no t impose any undue risk to the health and safety of the reactor, reactor personnel or to the public.
Core Doll y Overrid e Switch
Fi g ure 5 Core Dolly Override Switch Fi g ure 5 Core Dolly Wiring Schematic T3A100E840
Fi g ure 5 Previous Core Dolly Override Switch Previo us Core Dolly O verride Swi tch