TMI-09-057, Response to Request for Additional Information Related to Technical Specification Change Request No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods
| ML091260765 | |
| Person / Time | |
|---|---|
| Site: | Three Mile Island  |
| Issue date: | 05/06/2009 |
| From: | Cowan P Exelon Generation Co, Exelon Nuclear |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| TAC MD9762, TMI-09-057 | |
| Download: ML091260765 (11) | |
Text
10 CFR 50.90 TMI-09-057 May 6,2009 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 Three Mile Island Nuclear Station, Unit 1 Facility Operating License No. DPR-50 NRC Docket No. 50-289
Subject:
Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods
References:
(1) AmerGen Letter 5928-08-20132. Three Mile Island Unit 1, "Technical Specification Change Request No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods," dated September 29, 2008.
(2) Letter from P. Bamford (U.S. Nuclear Regulatory Commission) to C. Pardee (Exelon Generation Company, LLC), "Three Mile Island Nuclear Station, Unit 1 - Request for Additional Information Regarding Control Rod Drive Control System Replacement License Amendment (TAC NO. MD9762),"
dated April 6, 2009.
By letter dated September 29, 2008 (Reference 1), AmerGen Energy Company, LLC (now Exelon Generation Company, LLC (Exelon>> requested a revision to the Technical Specifications to accommodate the changes resulting from the Digital Control Rod Drive Control System Upgrade Project and the elimination of the Axial Power Shaping Rods.
The U. S. Nuclear Regulatory Commission (NRC) staff has been reviewing the Reference 1 submittal and has determined that additional information is needed to complete its review. The NRC staff requested additional information on April 6, 2009 (Reference 2).
Exelon's response to the NRC questions is provided in the attachment to this letter.
Subsequent to the Reference 1 submittal, Nuclear Logistics Incorporated (NLI) notified Exelon that the Square D Masterpact NT Reactor Trip Breakers contain microcontrollers. Additional information on the microcontrollers is contained in the attachment to this letter.
Exelon has determined that the information provided in response to this request for additional information does not impact the conclusions of the No Significant Hazards Consideration as stated in Reference 1.
U.S. Nuclear Regulatory Commission May 6,2009 Page 2 of 2 There are no regulatory commitments contained in this submittal.
A copy of this letter and its attachment is being provided to the designated State Official and the chief executives of the township and county in which the facility is located.
Should you have any questions concerning this letter, please contact Frank J. Mascitelli at (610) 765-5512.
I declare under penalty of perjury that the foregoing is true and correct. Executed on the th 6 day of May, 2009.
Respectfully, i
Pamela B. Cowan Director - Licensing & Regulatory Affairs Exelon Generation Company, LLC
Attachment:
Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods cc: S. J. Collins, USNRC Administrator, Region I D. M. Kern, USNRC Senior Resident Inspector, TMI Unit 1 P. J. Bamford, USNRC Project Manager, TMI Unit 1 D. Allard, Director, Bureau of Radiation Protection-PA Department of Environmental Resources Chairman, Board of County Commissioners of Dauphin County Chairman, Board of Supervisors of Londonderry Township
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods Introduction The Reactor Trip Breakers (RTBs) planned for installation at TMI have microcontrollers in the undervoltage (UV) and shunt trip devices. Use of the microcontrollers is new information received by Exelon from Nuclear Logistics Incorporated (NU) via Technical Bulletin TB-09-002, Rev 0, Masterpact Coils, dated 4/22/09. This recent information about the microcontrollers affects statements in the License Amendment Request (LAR) about the replacement breakers not being a digital upgrade and the statement about the UV and shunt trip devices being low impedance devices.
The use of microcontrollers in the RTBs is considered to be a digital upgrade to a Safety System. NLI has a dedication program verifying that Masterpact breakers are acceptable for use in Safety Related applications at nuclear plants and has addressed the microcontrollers. Based on the qualification testing of the breakers, including EMI/RFI testing, Exelon has evaluated the use of microcontrollers in this application as acceptable per the NEI 01-01 Guideline on Licensing Digital Upgrades.
Additional information on the UV and shunt trip devices is provided in the response to the questions below.
Background for questions 1-7 (as stated in the NRC's April 6, 2009 Request for Additional Information): According to the LAR, the existing RTBs at TMI-1 are General Electric (GE) models AK-15 and AK-25 with direct current (DC) and alternating current (AC) control power. The proposed replacement breakers are Square D type Masterpact NT.
- 1) The undervoltage (UV) device is used on GE AK type breakers to trip the breaker when loss of voltage occurs on the undervoltage device coil. The undervoltage device is used as a trip device because of the inference that it is fail safe i.e., it directly trips the breaker with mechanical action when all normal sources of control voltage have become unavailable for shunt trip type operations. The LAR indicates that the UV device on the Square D breakers is de-energized to trip. Describe how the undervoltage tripping circuit functions upon loss of control power in the proposed Square D breakers.
Response
Like the GE AK breaker, the UV trip device on the Square D breaker also trips the breaker when loss of voltage occurs. The UV trip device on the Square D breaker has a plunger that is spring return to the trip position. The UV trip device is normally energized and is powered by the 120Vac signal from the Reactor Protection System (RPS). Removal of voltage from the UV trip device will cause the breaker to trip.
1
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods The UV trip device on the Square D breaker has a firmware microcontroller built into the device. The electronic switch monitors the input voltage and when the input voltage exceeds the preset threshold, the activation coil is energized to operate the plunger. After the plunger is activated the electronic switch shuts off the activation coil and energizes the maintenance coil to maintain the plunger in the activated position.
Energizing the coils on the UV trip device retracts a plunger allowing the Reactor Trip Breaker (RTB) to be closed. When the voltage is removed from the UV coil, a spring returns the plunger to the extended position, mechanically tripping the breaker. The only source of power to the UV trip device is the signal from the RPS. Voltage is removed when the RPS trips so there is no failure mode for the microcontroller that could keep the coil energized. The single-function microcontroller in the UV trip device and shunt trip device controls the plunger for that device by energizing or de-energizing its coils. The customer cannot change the microcontroller function or settings.
No external source of control power is required for the UV trip device to trip the RTB. The UV trip device plunger prevents closing the breaker when the UV trip device is in the de-energized position. The UV trip device on the Square D breaker is functionally equivalent to that on the GE AK breaker.
- 2) GE Service Advisories and NRC Information Notice (IN) No. 88-38: "Failure of Undervoltage Trip Attachment on General Electric Circuit Breakers," document low design margins of the torque available to trip GE AK breakers with the UV device.
The torque available to trip the General Electric AK type breakers by the UV device is critical to proper operation. Compare and contrast:
a) The torque available from the UV trip mechanism in the proposed Square D breakers and the existing GE breakers.
b) The torque available from the shunt trip mechanism in the proposed Square D breakers.
c) The torque required by the trip bar in the proposed Square D breakers and the existing GE breakers.
Response
The GE AK breaker has a Trip Shaft with bearings. Trip shaft torque is measurable on the GE AK Breaker. The trip shaft torque required to trip the GE AK Breakers is 20 ounce-inches in refurbished condition and the maximum allowed torque is 24 ounce-inches.
Available torque values for the GE AK Breaker UV and shunt trip devices are not listed in publicly available GE documentation and Exelon has not found the values for these parameters in any approved reports.
2
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods NLI took force measurements on a Square D Masterpact NT breaker. The units are pounds force.
Methodology:
- Each measurement was taken 3 times using a calibrated force gauge.
- The travel required for the UV and shunt trip plungers to hit the trip latch and trip the breaker was documented. The force measurements were made at this measured distance of travel.
Result of UV Trip Device tests
- Force provided by UV (spring return; not a function of control voltage):
measured 2.1-2.2 Ibf.
- Force on the UV trip latch required to trip the breaker: measured 1.1-1.3 Ibf.
Result of Shunt Trip Device tests
- Force provided by the shunt trip (125vdc): measured 6.3-6.9Ibf.
- Force provided by the shunt trip (95vdc): measured 3.2-3.9Ibf.
- Force on the shunt trip latch required to trip the breaker: 1.1-1.2Ibf.
Exelon calculated margins based on the data from the sample Square D breaker UV Trip Device Minimum force measured from UV 2.1 Ibs force Maximum force measured to trip 1.3 Ibs force Percent margin 62%
Shunt Trip Device at 125vdc Minimum force measured from device 6.3 Ibs force Maximum force measured to trip 1.2 Ibs force Percent margin 425%
Shunt Trip Device at 95vdc Minimum force measured from device 3.2 Ibs force Maximum force measured to trip 1.2 Ibs force Percent margin 167%
Exelon concludes that the margin is acceptable and that periodic functional testing required by Technical Specification Table 4.1-1 along with trending breaker trip time from each trip device during preventive maintenance provides reasonable assurance of completing the safety function.
3
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods
- 3) The GE breakers had a response time of less than 80 milliseconds (ms) for operation. Lubrication problems with the trip shaft roller bearings of the GE breakers resulted in slower response times. According to the LAR, the proposed Square D breakers have a response time (open) of 50 ms. Provide details on any planned actions to monitor degradation in the response time due to aging or other unknown failure mechanisms. Will the response time of the automatic shunt trip feature and undervoltage trip be independently tested periodically to verify that the timing is less than or equal to that assumed in the safety analyses?
Response
The response (trip) time of the Square D breaker is :s 50 ms for either Shunt Trip device or UV trip device trip. A separate Voltage Relay controls the shunt trip and adds additional delay to the total trip time via the shunt trip. This Voltage Relay and shunt trip circuit for the Square D breaker is similar in design to the circuit used with the existing GE AK breaker. The total time for the shunt trip path for the new design remains within the 80 ms assumed for the RTB response time. The shunt trip and UV trip will be functionally tested separately in accordance with Technical Specification Table 4.1-1.
The Square D breaker utilizes Mobil 28 grease as the lubricant. Nuclear Logistics Inc. (NLI) qualified the Square D breakers for TMI. NLI performed aging tests on the Square D Masterpact NT breakers, with no change in performance after aging for an equivalent of 40 years at 50Qe. Based on use of Mobil 28 grease and the results of aging tests performed by NLI, lubrication hardening that affects the breaker performance is not expected during the qualified life of the breaker.
The trip time of each Square D breaker will be periodically verified using the shunt trip device and the UV trip device independently during breaker preventive maintenance. The trip times from each device will be trended to monitor for degradation in performance. The periodic maintenance procedure will include a test to verify that the breaker cannot be closed with the UV trip device de-energized.
- 4) The LAR indicates that a common mode failure for the Masterpact breakers due to radio frequency interference (RFI) or electromagnetic interference (EMI) was not credible since the undervoltage trip device and the shunt trip device are low impedance devices and are not susceptible to failures from EMI/RFI. Please summarize the results of the evaluation and/or testing done on the Masterpact breakers to show that the undervoltage/shunt coils are not susceptible to EMI/RFI.
The Masterpact circuit breakers are typically equipped with Micrologic trip system to protect circuits and loads. This protective device has electronic components and a microprocessor. If the Micrologic trip system is used at TMI-1, then describe:
4
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods a) The testing conducted to verify that the protective system is not susceptible to RFI/EMI failures.
b) Planned actions to prevent unauthorized access and programming capabilities, local and remote, to the Micrologic system that could lead to inadvertent actuations of the system.
c) Planned actions to maintain control over the hardware, software and procedures used to test and calibrate the Micrologic protective system.
Response
The Micrologic trip system is not installed or used in the TMI reactor trip breakers. The TMI Reactor Trip Breakers are not used for fault current protection; they are basically electrically operated switches. Actions to maintain control over hardware and software of Micrologic protective systems are not applicable.
SUbsequent to the LAR submittal, NLI identified that the UV trip device and the shunt trip device on the Square D Masterpact breakers each contain a firmware microcontroller. NLI tested the UV and shunt trip devices for susceptibility to EMil RFI for service conditions per EPRI TR-102323 revision 3. The test verified that the microcontroller and coil operation was not affected in either the de-energized or energized positions.
There is no human-machine interface with the microcontroller and there are no user adjustments or options. Firmware control will be maintained under the vendor QA program.
Exelon evaluated for common mode failure. No common mode has been identified between the UV trip device and the shunt trip device since one device is energized to trip and the other is de-energized to trip.
Failure of the microcontroller cannot prevent de-energization of the UV coil since there is only one source of power to the device. Trip of the RPS removes that source of power to the trip device. There is no internal battery that could delay trip.
Failure of the microcontroller could prevent operation of the shunt trip device.
This would cause loss of the diverse tripping means but the UV trip device would still trip the breaker so there would be no loss of function. Failure of the microcontroller on the shunt trip device would have the same effect as coil failure, loss of power or blown fuse, which is similar to the existing design's failure modes.
5
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods
- 5) According to the LAR, the shunt trip device for the proposed Square D breaker has a maximum rating of 137 Volts (V) DC for a nominal 125 VDC system. Will the shunt trip coils be subjected to voltages higher than their rating during battery float and charging conditions?
Response
No, the shunt trip devices will not be subjected to voltages higher than their maximum rating. Each TMI station battery section has 58 cells. The equalize voltage for each section is 135 VDC with a band from 134.0 to 136.0 VDC.
Normal Float Voltage is 130 VDC.
- 6) The LAR provides DC ratings for the shunt trip device and AC ratings for the UV device. In addition, the LAR describes the control power source for the non safety related existing and new Control Rod Drive Control System as the incoming sources for the RTBs. Describe the control power scheme for the operation of the new breakers and provide details on separation/isolation devices between safety and non-safety related portions of the control power.
Response
Each of the four circuit breakers is part of a separate safety channel. The UV trip device is powered from the 120Vac safety related signal from the RPS. The shunt trip circuit is powered from 125Vdc from the same channel as the RPS.
The closing circuit for the breaker is 120Vac non-safety related.
a) Each channel is routed through separate conduit into the switchgear.
b) The terminal blocks for each channel will be installed in separate switchgear cubicles. The cubicles are physically isolated from each other by metal barriers.
c) Six-inch physical separation or thermal sleeving will be used to separate wiring groups.
d) Non-safety related 125vdc power is taken from the safety related 125vdc power. Each leg of the non-safety related power is isolated with one Class 1E fuse.
e) Where required, safety related relays are utilized for separation between the contacts and coil of the relays.
- 7) Provide a summary of failure modes and effects analysis performed for the Square D Masterpact NT breaker and the modified trip logic system.
Response
Engineering performed a Failure Modes and Effects Analysis (FMEA) for the new RTB configuration inclUding the UV trip device and shunt trip devices.
The FMEA concluded that no single failure of an RTB would prevent completion of the Reactor Trip Function. Each RTB has a UV trip device and a 6
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods shunt trip device providing a diverse means of tripping. The trip devices will be tested separately.
Failure of the shunt trip will not prevent tripping of the breaker by the UV device. Failure of the UV trip device could spuriously trip the associated RTB but will not prevent the RTB from being tripped by the shunt trip device.
Failure of the RTB mechanism could prevent tripping of that breaker but will not prevent the Reactor Trip Function since there is a redundant breaker in each power train to the CRD System.
Failure of the microcontroller in the UV trip device will not affect the trip function since the coil will be de-energized on RPS trip. Failure of the microcontroller on the shunt trip device would cause loss of that feature but the affected breaker would trip as a result of the UV device.
- 8) The final paragraph of Page 8 of Attachment 1 in part states that, "The DCRDCS does not perform a nuclear safety-related function and failure of the control system will not prevent the RPS from tripping the reactor." In this statement, does the term "failure" imply a complete loss of functionality, or are there other failure modes that do not involve a complete loss of functionality (e.g., ones where unintended operations are spontaneously initiated due to programmatic error) that could adversely impact the reactor protection system?
Response
The term "failure" includes incorrect operation and partial failure as well as a complete loss of functionality of the DCRDCS control system. No failure modes of the control system can prevent the RPS function due to the independence of the two systems. The DCRDCS input to the RTB trip circuit is isolated from the RPS input by qualified devices and the RTBs are upstream of the CRD Control System such that no failure of CRD controls can prevent a reactor trip when demanded by RPS.
When the Control Room Operator presses the TRIP RESET pushbutton, the DCRDCS sends a close signal to the RTBs. An inadvertent Close signal will not override the Trip signal from the UV device on the RTB.
The DCRDCS also provides trip signals to the RTBs that serve an equipment protection function for the Control Rod Drive Mechanisms (CRDMs). The trip signals provide protection from ratchet trip on low voltage and stator winding protection on high voltage. These non-safety control signals perform the same function as an existing circuit on the Control Rod Drive system. A failed closed contact in the DCRDCS will trip the RTB. A failed open contact will have no effect on trip capability. The contact from the DCRDCS is isolated from the safety related trip circuit by a qualified relay and fuses.
7
Attachment Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342:
Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods
- 9) The first paragraph of Page 10 of Attachment 1 in part states that, "changes to CRDM patching will only be available when the system is offline and requires recompiling the application software." In addition, the third paragraph of Page 10 of Attachment 1 in part states that, "to modify DCRDCS rod patching, the system must be offline with the reactor shutdown (all rods in)." Do these two sections refer to the same system, or different systems (Le., is "CRDM patching" the same as "DCRDCS rod patching")? Also, for these systems, please explain why it is not possible for patching to occur if system is online and/or if the reactor is not shutdown.
Specifically is patching modification not physically possible, or is this restriction simply enforced by information technology policy?
Response
Both terms refer to the same system and the same function. "CRDM patching" is the same as "DCRDCS rod patching". Patching is the assignment of control rods to a Control Rod Group.
Rod patching is accomplished in the DCRDCS control system software. In order to change the patching scheme, the software must be recompiled and downloaded. Downloading the recompiled software trips the reactor since the DCRDCS processors stop running the control algorithm when a download is in progress.
Changing the DCRDCS rod patching without detection while the reactor is on line is not possible since downloading the software to the DCRDCS processors causes the control rods to be de-energized resulting in a Reactor Trip.
Changing the Control Rod patch is a configuration change that is controlled by the Design Change Process.
8