ML092940611

Summary of Category 1 Public Meeting with Exelon to Discuss Proposed Control Rod Drive Control System License Amendment Request

ML092940611
Person / Time
Site:	Three Mile Island
Issue date:	11/02/2009
From:	Peter Bamford Plant Licensing Branch 1
To:	Exelon Generation Co
Bamford, Peter J., NRR/DORL 415-2833
Shared Package
ml092940600	List: ML092940611
References
TAC MD9762
Download: ML092940611 (23)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 Novernber 2, 2009 LICENSEE: Exelon Generation Company, LLC (Exelon)

FACILITY: Three Mile Island Nuclear Station, Unit 1

SUMMARY

OF OCTOBER 20, 2009, MEETING WITH EXELON TO DISCUSS PROPOSED CONTROL ROD DRIVE CONTROL SYSTEM LICENSE AMENDMENT REQUEST (TAC NO. MD9762)

On October 20, 2009, a Category 1 public meeting was held between the U.S. Nuclear Regulatory Commission (NRC) and representatives of Exelon Generation Company, LLC (Exelon, the licensee). The purpose of the meeting was to discuss the current status of Exelon's license amendment request (LAR) regarding a planned upgrade to the Control Rod Drive Control System and the remaining issues yet to be resolved.

The licensee provided an overview of the changes to the reactor trip breakers that are being proposed as part of the LAR. The presentation specifically addressed the microcontrollers that are included in the design of the breaker undervoltage and shunt coils. The NRC staff asked questions about the design and commercial grade dedication process used for the breakers and the associated microcontrollers. At the conclusion of the meeting the NRC staff agreed to review the docketed material concerning this LAR and determine if any further requests for additional information will be required to reach a regulatory determination for this amendment.

No regulatory decisions were made at the meeting.

No proprietary information was discussed at the meeting. In addition to the licensee contractor personnel from Nuclear Logistics Incorporated (NLI) that were present on the call, one member of the public was in attendance. No comments were presented to the NRC staff during the public portion of the meeting. A list of attendees is provided in Enclosure 1. Enclosure 2 contains handout material provided by the licensee and Enclosure 3 contains handout material provided by the NRC staff during the meeting.

-2 Please direct any inquiries to me at 301-415-2833 or peter.bamford@nrc.gov.

Il&~~

Peter Bamford Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-289

Enclosures:

1. List of Attendees

2. Licensee Handouts

3. NRC Handout cc w/encls: Distribution via ListServ

LIST OF ArrENDEES OCTOBER 20,2009, MEETING WITH EXELON GENERATION COMPANY, LLC THREE MILE ISLAND, UNIT 1 CONTROL ROD DRIVE CONTROL SYSTEM UPGRADE LICENSE AMENDMENT REQUEST EXELON Todd Wicke I Pam Cowan Dave Helker Frank Mascitelli Chuck Behrend Bill Carsky Randy Ezzo Dennis Hull Jennifer Lytle Charlie Hartman Ray DiSandro NLI Archie Bell (telecon)

Aron Seiken (telecon)

Peter Bamford Barry Marcus William Kemper Harold Chernoff Gush Singh Paul Loeser Ed Miller Bob Nelson Allen Howe PUBLIC Eric Epstein (telecon)

Enclosure 1

, Exelon Handouts EXELON PRESENTATION TO NRC REGARDING REACTOR TRIP BREAKER MODIFICATION OVERVIEW

1. REACTOR TRIP BREAKER (RTB)

CONFIGURATION.

• PLANT CONFIGURATION

• UNDERVOLTAGE (UV) AND SHUNT TRIPS

• DESIGN HISTORY

• MICROCONTROLLER OVERVIEW

2. MICROCONTROLLER BLOCK DIAGRAM

3. CONCLUSIONS

4. NRC questions 1

RTB Configuration

-The revised TMI Reactor Trip Breaker (RTB) arrangement includes four (4) breakers.

-There are two breakers in each of the two parallel power trains

-At least one breaker in each train must open to trip the reactor.

(Reference Figure 1) 2

RTBConfig uration 480VAC 480VAC Power Supply Power Supply Figure 1 A B I RTBA ~ ----j-<:) t i-<:) I

- - --, RTBB I LC) D !C)

[RTBC i

~ ----r O t i-O [RTBD

- - --, I c

LC) fC)

SRPS A SRPSB

~

CRDMMotors 3

RTB Configuration

• RPS provides a 120VAC signal to the RTB's

• When RPS trips, contacts external to the RTB's open to remove the 120VAC

• An interposing relay de-energizes to close a contact to provide 125VDC to the shunt trip (Reference Figure 2) 4

RTB Configuration Figure 2 125VDC RTB J20VAC

--t-1 H----r-t I /\ /1---<\'4

,/

7 7¥21 RPS 2 UV Device Shunt Trip Device 120VAC

--t-1 H--L-1 I 7~ Ci:?A ~

/' '--'""-"

J25VDC 5

RTB Configuration

• Each RTB has a UV trip and a shunt trip

- Either is capable of tripping the RTB

• The UV device is the primary means of tripping the RTB.

- The UV device is normally energized

- When de-energized a spring loaded plunger on the UV device trips the breaker

• The Shunt Trip is the back-up means of tripping the RTB.

- The shunt trip is normally de-energized

- When energized the shunt trip extends a plunger to trip the RTB 6

RTB Configuration Shunt Trip Design History

• Original TMI design did not utilize the Shunt Trip for Reactor Protection

• ATWS Event occurred at Salem Nuclear Station due to Reactor Trip Breaker (RTB) lubrication issue

• NRC Issued Generic Letter 83-28

• TMI Modification installed external under voltage relay to actuate the RTB Shunt Trip as a backup

• TMI Tech Spec changed to require operability and testing of Shunt Trip feature in addition to Undervoltage (UV) 7

RTB Configuration Microcontroller Overview

• The shunt trip and UV device contain a microcontroller

- The microcontroller monitors input voltage and cycles associated device coils.

- The coils operate a plunger to actuate the trip bar and trip the RTB.

• There is no failure of the microcontroller that can prevent the safety function of tripping the RTB upon a trip signal from RPS.

- The RPS trip signal removes all power to the UV device

- The spring-loaded plunger actuates the trip bar and trips the RTB 8

Block Diagram Block Diagram of Undervoltage and Shunt Trig, Devices in the Reactor Trip Breaker Case J J_Plunger Activation Maintenance Coil Coil Connector for RTB r--

o I I

I 5V Power Protection Supply Circuit, EMC

~

_\

i:

Input Power/

) I I  :

• I ,

I I I Filter, I I ~I Micro-controller and

(

• I ..'I.

RPS Trip I I 0

• I

• I Rectifier Signal I

~

I I

L..

I * - - - - - - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Ei~~t~~nic i.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _.. _ .. _.1iq~!Q._ .._ .._ .._ .._ .._ .....

Notes:

1. Activation and Maintenance Coils are wound on a common spool acting on a spring loaded plunger.

2. For the Undervoltage device, the plunger is spring loaded to extend on loss of power.

3. For the Shunt Trip device, the plunger is spring loaded to retract on loss of power.

4. Reference is Schneider/Square D "Proxima Auxiliary Design File", document 5100512854, revision B. 9

Conclusions

• No firmware failure can prevent the RTB from performing its safety function

• NLI commercial grade dedication of the firmware met the requirements of EPRI 106439 Guideline 10

NRC Questions

1. How complex is this microcontroller?

- How many logical operations are going on?

- What are these logical operations doing?

A block diagram ofthe microcontroller is included as page 9 ofpresentation.

The microcontroller is simple and consists of 8 modules. Details are presented in section 2.2.2.17.2 of the V&V report. The V&V report identifies the operation of the code.

2. On loss of voltage to the UV or Shunt Trip devices, what happens internally to the microcontroller?

The microcontroller is programmed to operate in a~ voltage condition. The microcontroller stops functions upon loss ofpower. When power is established, the microcontroller initializes and starts the operating routines.

11

NRC Questions

3. Since same the software is used in both devices, when both UV and Shunt Trip devices fail, what is the result?

• What would the impact be if they failed to remove power when called upon to remove power? Or the opposite (when called upon to energize and not energize)?

Reference Table 1 on slide 14

4. Provide more detail and depth on the review that Exelon performed.

• Did the review include failures to keep the UV device energized when energized Reference Table 1 on slide 14 12

NRC Questions

5. EPRI TR-I06439 question:

• What example (from Chapter 6) was followed in our commercial dedication?

The example in 6.2 "Indicator with Contact Output" is the example closest to this application.

- The UV is a more simple device that the example in the EPRI document, since the UV device fails safe (spring return). The shunt trip device is equivalent to this example, however, the output is mechanical action (plunger actuation), instead ofa contact changing state.

- All of the critical characteristics in Table 6-2a are addressed in the NLI V & V report. The NLI V & V report is more detailed than the requirements in the EPRI documentfor this example.

The example in section 6.3 "Multi-Function Controller" is much more complex than these devices and is not considered applicable.

13

NRC Questions Table 1 - Impact of Microcontroller Failure UVDevice Shunt Trip Inadvertent UV Inadvertent Prevent UV Prevent Shunt Device Trip Shunt Trip Trip Trip Fail On (Closed) Fail On (Closed) No No No No Fail Off Fail Off Yes No No Yes (Open) (Open)

Fail On Fail Off No No No Yes (Closed) (Open)

Fail Off Fail On Yes No No No (Open) (Closed) 14

Freescale Semiconductor, Inc.

GENERAL RELEASE SPECIFICA TlON I -

~:

COP I PH2 OSC 1 I OSC 2 t

---<....-.--. I CPU CONTROL II ALU I

1-

~ l6-BITTIMER 1 INPUT CAPTURE 1 OUTPUT COMPARE

~IPD7ITCAP r---- TCMP 68HCOS CPU

-~ PORTD LOGIC ~ PDS/CKOUT I ACCUMULATOR I CPU REGISTERS ~IPC7N REFH

~

IINDEX REGISTERI ~ w

~STKPNTR I

-- ~

W t-f/)

13 w

t

~

w Z

0 x

J

~

~

PC6/ADO PCS/ADl

~

u u z t o ~ PC4/AD2 PROGRAM COUNTER 0 ~

I I ~

i= 0 <i:

u CL ~ PC3/AD3 w

~

~

COND CODE REG 1S ~ PC2

~

0

~ PCl

~ PCO SRAM -192 BYTES I .- -.

I

~ PA7

~

I w ~ PA6 t-USER EEPROM - 8064 BYTES f/)

I 13 ~IPAS w

- . ~

Z 0

i=

t

~

0

~IPM u CL ~ PA3 w

~

1S ~ PA2 I

EEPROM -128 BYTES I - ~

~

0

~ PAl

~ PAD PBS/S DO~ PORT BAND SlOP PB6/S DI~

REGISTERs..

PB7/S CK~ AND LOGIC Figure 1-1. Block Diagram INTRODUCTION MC68HC805P18 1-2 For More Information On This Product, Go to: www.freescale.com

Masterpact Circuit Breaker V& V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 25 MX: Shunt trip release (SHT). This release instantaneously opens the circuit breaker whenever its supply voltage is 50% over its rated supply voltage. This release may be have a continuous or transient supply.

XF: Shunt close (SHCL). This electromagnet closes the circuit breaker whenever its supply voltage is more than 50% of its rated supply voltage.

2.2.2.17.2 Architecture The architecture of the coils is as follows:

(1) The only difference between MXIXF actuators and MN actuator is mechanical. They have the same electrical characteristics (same microcontroller and coils).

(2) Microcontroller: 8 bit MOTOROLA 68HC805P 18 lWj,.JW, f"~<"~(~' £:.#M.

(3) There have been no firmware revisions since 2002. s r~c:::.l re=iU:Io-rl~

(4) There is no communication in NLI supplied equipment with the trip unit (ASIC or its companion microcontroller).

(5) Programming language - assembler.

(6) There are no unused software blocks or complied code.

(7) All measured parameters are stored in direct addressed RAM.

(8) Program values are stored in an EEPROM and are read-into the microcontroller ROM during initialization.

(9) The microcontroller initialization sequence verifies hardware and firmware operation.

(10) The total code consists of the following eight code modules

a. RESS.ASM

b. RAM.ASM

c. T CARRE.ASM

d. T U.ASM

e. T IAPP.ASM

f. T IMALASM

g. T BOB.ASM

h. CONST.ASM (11) There are no internal diagnostics other than a time-out watch dog during main loop program operation.

(12) Power to the coils is from the plant control power. A 5 volt power supply is used to power the electronics. The FMEA did not identify the power supply as a critical part in the design life/mean time to failure (MTTF) of the coils (see section 5.1.3).

( 13) There is no battery used.

(14) The hardware/firmware system is testable. The NLI dedication/FAT testing tests the system on 100% of the supplied breakers.

300f245

, NRC Handout TM I Schneider/Square D Masterpact NT Breaker Issue In order for the staff to approve use of a breaker which includes a microprocessor, the staff will need to determine that:

1) A high quality design process was used in the development of the microprocessor

2) Adequate consideration of software common cause failure was considered Item 1 is partially addressed by the Commercial grade dedication process. The staff understands the COTS dedication was performed by Nuclear Logistics, Inc. (NLI) to the requirements of EPRI TR-106439, "Guidelines on Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications." The dedication report will need to be docketed for staff review. In order for the staff to evaluate that report, a sample of the Schneider/Square D documents will be reviewed by the staff. The staff has determined this sample will be:

a. The Schneider/Square D final Verification and Validation report, and the NLI analysis of the documentation (Le., V&V plans, procedures, etc.).

b. The Schneider/Square D configuration management final report on the software used in the Schneider/Square D Masterpact NT Breaker, and the Nl,l analysis of that documentation (l.e., CM plans, procedures, etc.).

c. A detailed description of the microcontroller and how it functions. The staff will also need the NLI analysis of that description and the functions.

The use of a small sample of the overall life cycle documentation and design outputs, as described in BTP 7-14, is justifiable because of the following staff understandings:

1. While the microprocessor is programmable, it has already been programmed, and that programming is not plant or application specific.

2. The programming can not be changed after the breaker is manufactured, and has not changed since 2002.

3. There is a documented history of use of this device, and that history can demonstrate that the programming performs as intended.

The licensee will either need to confirm these understandings, or show where in docketed information this conformation has already been provided.

Item 2, a demonstration of adequate consideration of software common cause failure will require a documented analysis of possible common cause failures and the consequence of those failures. This will need to include not only failure to perform the safety function, but also inadvertent and unneeded actuation. If this inadvertent and unneeded actuation has already been considered in the plant accident analysis, a copy of the previous analysis may be sufficient.

- 2 Please direct any inquiries to me at 301-415-2833 or peter.bamford@nrc.gov.

/raj Peter Bamford Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-289

Enclosures:

1. List of Attendees

2. Licensee Handouts

3. NRC Handout cc w/encls: Distribution via ListServ DISTRIBUTION:

PUBLIC RidsNrrPMThreeMilelsland Resource BMarcus, NRR Branch Reading RidsNrrLAABaxter Resource WKemper, NRR RidsAcrsAcnw_MailCTR Resource RidsRgnlMailCenter Resource LTrocine, EDO Region 1 RidsNrrDorlLpll-2 Resource CTucci, NRR RidsOgcRp Resource NRC Participants ADAMS Accesston

. Nos.: Pack aaeIML092940600 Meef mg N' oticeIML092870673 , Meetinq s ummary ML092940611 OFFICE DORULPLI-2/PM DORULPLI-2/LA DORULPLI-2/BC NAME PBamford ABaxter HChernoff DATE 10/21/09 10/22/09 11/02/09 OFFICIAL RECORD COpy