ML13339A344

Enclosure 3 - Nuclear Safety System Upgrade - Dwk 250 Digital System

ML13339A344
Person / Time
Site:	MIT Nuclear Research Reactor
Issue date:	10/31/2013
From:	Massachusetts Institute of Technology (MIT)
To:	Office of Nuclear Reactor Regulation
References
Download: ML13339A344 (49)

Text

Non-proprietary Version MIT RESEARCH REACTOR NUCLEAR REACTOR LABORATORY MASSACHUSETTS INSTITUTE OF TECHNOLOGY IThis Is a nan-proprietary version from which the proprietary Information has been removed according to 10 CFR 2.390.

In this document the removed sections of proprietary Information are Indicated by two opening and two closing brackets as shown here: (( ))

NUCLEAR SAFETY SYSTEM UPGRADE

- DWK 250 Digital System October 2013 138 Albany Street Building NW12 Cambridge, MA 02139

Non-proprietary Version Table of Contents

1.

INTRODUCTION TO UPGRADED SYSTEM CONFIGURATION.............................

1 1.1 Nuclear Safety System..................................................................................................

1 1.2 The Scram Logic System.............................................................................................

3 1.3 The Magnet Power Supply System and the Rundown Relay Circuit..........................

4 1.4 Quality Assurance.......................................................................................................

5

2.

DESIGN CRITERIA & DESIGN BASES......................................................................

6

3.

NUCLEAR SAFETY SYSTEM......................................................................................

8 3.1 DETECTOR SYSTEM...................................................................................................

8 3.1.1 Fission Chamber Detectors.......................................................................................

8 3.1.1.1 Fission Chamber Integral Cable......................................................................

13 3.1.1.2 Fission Chamber Coaxial Cable......................................................................

15 3.1.2 Pre-am plifier..........................................................................................................

.. 16 3.1.3 Physical Layout.......................................................................................................

19 3.2 NEUTRON FLUX MONITOR DW K 250..................................................................

23 3.2.1 NI 21 Pulse Discriminator....................................................................................

27 3.2.2 NA 33 AC-Input Module / AC Correlator...........................................................

27 3.2.3 NZ 21 JI/ -Processor..............................................................................................

28 3.2.4 NZ 12 Central Processor.......................................................................................

30 3.2.5 NK 21 Serial Interface...........................................................................................

32 3.2.6 NB 28 Relay Module..............................................................................................

32 3.2.7 NS 01 Keyswitch Module.....................................................................................

32 3.2.8 NA 06 Display Module.........................................................................................

33 3.2.9 NE 37 Pulse Decoupling Module...........................................................................

33 3.3 PERFORMANCE EVALUATION

SUMMARY

34

4.

SCRAM LOGIC SYSTEM...........................................................................................

35 4.1 Development of the Scram Logic Circuit.................................................................

35 4.2 Inputs To Scram Logic System..................................................................................

39

5.

SECURITY AND CYBER VULNERABILITY EVALUATION.............................

40

- H

Non-proprietary Version MIT RESEARCH REACTOR REACTOR PROTECTION SYSTEM UPGRADE

1.

INTRODUCTION TO UPGRADED SYSTEM CONFIGURATION The MIT research reactor has a Reactor Protection System (RPS) that is designed to promptly and automatically place the reactor in a subcritical, safe shutdown condition (scram) and then maintain it there whenever any of the reactor monitored parameters exceeds a limit as determined in the reactor's Safety Analysis Report (SAR).

These parameters include various process system flow rates, temperatures, coolant tank levels, checks of containment building integrity, etc. Also among the monitored parameters are reactor power and its rate of change (displayed as reactor period in seconds). The parts of the RPS that are related to these latter two parameters are to be replaced with new instruments. These parts include the Nuclear Safety System, the Scram Logic System, the Magnet Power Supply System and the Rundown Relay Circuit. The Withdraw Permit Circuit (WPC) is also a part of the RPS but is not replaced here. The WPC receives all reactor scram signals as defined in the reactor's SAR and Technical Specifications, and interrupts the Magnet Power Supply System and activates the Rundown Relay Circuit, thereby shutting down the reactor.

The following describes briefly the parts of the RPS that are to be replaced (the Nuclear Safety System, the Scram Logic System, the Magnet Power Supply System and the Rundown Relay Circuit) and their functions in the RPS to protect the reactor.

Figure One is a block diagram that shows the basic relations between them in the upgraded system.

1.1 Nuclear Safety System The new Nuclear Safety System (NSS) is composed of four independent, identical nuclear safety channels. Each channel has its own fission chamber detector, a pre-amplifier located a short distance downstream from the detector, and a wide-range neutron flux monitor (designated here as "DWK 250", based on "Mirion Technologies model DWK 250"). In this arrangement, the wide-range monitors are the only digital instruments that are microprocessor-based. They use prescribed and specific firmware to process the signals output by the fission chamber detectors.

Non-proprietary Version Shim Blade

& Reg. Rod Drive Control Circuits Shim Blade Magnets Nuclear Safety System Withdraw Permit Circuit Figure One: Block Diagram of MIT Reactor Protection System Non-proprietary Version The fission chamber detectors are placed at the perimeter of the reactor core, replacing existing neutron detectors in four available instrument beam ports.

The ports are at different locations selected to maximize independence from each other as well as from reactor experiments, while also providing redundancy. Each detector outputs its signal to its pre-amplifier ("pre-amp"), which is connected to the detector with the shortest cable run possible to reduce noise pick-up prior to amplification.

The amplified signals remain analog and continue on to the corresponding DWK 250 monitor.

Each DWK 250 receives the amplified analog signal, processes it as neutron flux level and neutron flux rate-of-change (reactor period), and outputs a trip signal if either of these values exceeds its preset limit. An in-depth discussion on the operation of the DWK 250 is presented in Section 3.2.

The DWK 250 outputs trip signals in binary (relay closing or opening) form.

There are eight binary trip outputs from each DWK 250.

Two are for operator warning, and six are for the scram Logic System. The trip relays are energized and closed under normal operating conditions.

The trip output ports are connected to downstream components of the RPS via opto-isolators.

1.2 The Scram Lofic System The Scram Logic System consists of two identical logic cards built with discrete solid-state components. For trip signals from the DWK 250 monitors, each circuit independently performs a two-out-of-four coincidence logic comparison, and each will output a reactor scram signal if coincidence is met. Six of the eight trip outputs from each DWK 250 are routed to both circuits, which perform simultaneous logic comparisons for redundancy.

The Scram Logic System also outputs a signal to an independent latching indication panel for operator interface. The panel provides information on the source of the scram and the initiating conditions, even when the trip condition no longer exists. However, the operator must clear the trip condition and the reset latching alarm on this panel prior to any reactor restart operation. Additionally, this indicator panel sends a signal to the reactor's main annunciator alarm panel for redundancy.

The operator will also have to clear and reset alarms on the main alarm panel to allow a reactor start.

Non-proprietary Version 1.3 The Magnet Power Supply System and the Rundown Relay Circuit The scram signal from the Scram Logic System interrupts the magnet power supply system, cutting off electrical power to the electromagnets of the reactor's six shim blades. Each magnet holds the weight of its shim blade. This will result in shim blades disconnecting from their magnets and traveling vertically by gravity into the reactor, thereby scramming or shutting down the reactor in less than one second. The output of the Scram Logic System also interrupts the Withdraw Permit Circuit (WPC),

which itself independently interrupts the magnet power supply. The WPC is not within the scope of this upgrade.

Upon power interruption, the Magnet Power Supply System activates the Rundown Relay Circuit, which operates all the shim blade drives in the insertion direction until they reach their full-in positions. This automatic action of the drives ensures that all six shim blades and the regulating rod are physically at the bottom of the reactor core following a scram.

The Magnet Power Supply System and the Rundown Relay Circuit will be built with current industrial components in this upgrade. There is no change to their basic designs. Therefore this document does not include detailed description of the two systems.

Non-proprietary Version 1.4 Quality Assurance This upgrade of the reactor protection system using digital neutron flux monitors will require a license amendment application to NRC and their approval prior to going into service for reactor operation.

The MITR Quality Assurance program applies to all equipment used for the upgrade. Factory acceptance tests and site acceptance tests were both performed on each DWK 250, their associated pre-amplifiers, and fission chamber detectors. Where necessary, 10 CFR 50.59 reviews are completed prior to various stages of installation and testing.

The DWK 250s, their firmware and their pre-amps were designed and manufactured in Germany for reactor protection purposes. In the years 1988 to 1991 the DWK 250 channels have all been qualified through TUV (Technischer fYberwachungs-Verein, or Technical Inspection Association) according to German nuclear regulatory KTA guidelines 3501, 3505, 3507, and 1401.

These KTA guidelines apply to the type approval tests of safety-related Instrumentation & Control systems that perform measurement and control functions in accordance with Category A of international standard IEC 61226.

Category A is equivalent to IEEE 323 Classification 1E equipment for nuclear power stations, and to IEEE 344 Classification 1E equipment with regards to seismic qualification.

Since 1991 the Digital Wide Range Channel is used by different nuclear power plants and research reactors throughout Europe. It has gained very respectable operational experience.

The following section describes the overall design criteria and design bases of the upgrade. The sections after that describe in detail the operation of various systems that are within the scope of this upgrade of the RPS.

Non-proprietary Version

2.

DESIGN CRITERIA & DESIGN BASES The new Nuclear Safety System, the Scram Logic System, the Magnet Power Supply System, and the Rundown Relay Circuit have the following design criteria, system performance requirements and design bases, to ensure that the Reactor Protection System is capable of completing its intended protective actions:

(1)

The Nuclear Safety System consists of four Nuclear Safety Channels. Each Nuclear Safety Channel is composed of a fission chamber detector, a pre-amplifier, and a wide-range neutron flux monitor (DWK 250).

The four Nuclear Safety Channels are each capable of independently measuring and monitoring the reactor neutron flux level and its period (reciprocal of rate-of-flux change in seconds).

(2)

Each fission chamber detector is designed with set thicknesses of enriched U-235 coating for optimum sensitivity to neutrons at their final positions. All four are capable of accurately sensing neutrons even in the presence of high gamma radiation in their relative locations.

The four detectors are positioned independently and separately exterior to and around the reactor core. They do not interfere with each other, and are positioned to have minimum interference from reactor experiments.

(3)

Each DWK 250 is able to continuously interpret the fission chamber detector signals covering the range from subcritical source multiplication to well beyond the licensed maximum power level of 6.0 MW for the MIT reactor, and providing an indication of logarithmic reactor power level and reactor period for display and recording.

(4)

Upon determination of a monitored parameter reaching its preset limit - high reactor power, short reactor period, or a 100 kW operation high power (when enabled)

- the DWK 250 generates a trip signal to scram the reactor. The time from initiation of the trip signal to movement of each operable blade from its current position to its 80% inserted position in the fuel core must be less than one second. The basis of this design criterion is industry practice. Accident analyses in the SAR use a 1.0 second scram time to determine set points that will not result in any damage to the fuel.

(5)

Multiple and independent trip actions are designed into the RPS for redundancy and reliability of scram action. All trip signals (six from each DWK 250, as listed in design basis #6, for a total of 24) travel downstream from the DWK 250s to the Scram Logic System, which consists of two parallel logic circuits. Each logic circuit performs a coincidence comparison, providing a scram signal if there are any trip signals from two or more DWK 250s simultaneously.

The outputs from the Scram Logic System open contacts in the WPC which then interrupts magnet power supplies, thereby scramming the reactor.

As a redundancy, the outputs from the Scram Logic System also disrupt the main power to the Magnet Power Supply System, again scramming the reactor.

Non-proprietary Version (6)

Whenever there are two or more DWK 250 simultaneously sensing a high reactor power,

" a high reactor power in 100 kW operation mode,

" a short reactor period, an internal fault, an abnormally low fission chamber detector count-rate, or

" the channel in test mode then a trip signal will be generated by the Scram Logic System to scram the reactor.

This ensures that there will always be two functioning Nuclear Safety Channels.

(7)

The scram logic system consists of two identical logic circuits built with discrete solid-state components.

Each circuit performs a two-out-of-four logic comparison so that it will scram the reactor if it senses trip signals from two of the four DWK 250 monitors.

Six binary outputs from each of the four DWK 250s are routed to both circuits, which perform identical logic comparisons for redundancy.

(8)

The paths between the DWK 250s and the Scram Logic System have optical isolation devices to protect the DWK 250s from any interference by downstream circuitry or instrument. The opto-isolators have their own power supplies. If an opto-isolator fails, it will open the signal path, equivalent to one of the six trip conditions from a DWK 250, and send a trip signal to the Scram Logic System.

(9)

When reactor operation is switched to full power mode, the high power trip is set at 6.5 MW in the DWK 250s. When reactor operation is switched to 100 kW mode (reactor criticality is allowed at less than 100 kW without forced flow in the primary coolant system), the 100 kW high power trip is enabled on the DWK 250s. In this case, the reactor primary system low flow / pressure scrams from instrument gages MP-6 and MP-6A will be automatically bypassed.

(10)

All discrete solid-state components in the scram logic circuits shall conform to the Aerospace Qualified Electronic Component ANSI standard, ANSI/GEIA STD-0002-1, which defines requirements for commercial components used in demanding environments such as military, avionic, and medical applications.

(11)

All relays used in the new system will be 24 VDC components except where they interface with the existing Reactor Protection System. All relays are energized in the closed position during normal operating mode, so that any loss in continuity of signal paths, or loss of power, will result in a reactor scram. The exception is with relays along the signal path for the 100 kW trip. During normal full power operation, when reactor power is in excess of 100 kW, the DWK 250's 100 kW high power trip signal is on, that is, its binary relay output is "open", and all the relays along this signal path are open. Since the 100 kW keyswitch is in the "Full-Power" position, those relay contacts are bypassed and will not scram the reactor. If this keyswitch is turned to "100 kW" during full power operation, it will result in a reactor scram.

(12)

Each logic circuit in the Scram Logic System must be designed to be fail-safe, that is, it scrams the reactor if it fails.

Non-proprietary Version

3.

NUCLEAR SAFETY SYSTEM This section describes the physical layout of major components and wiring for the new Nuclear Safety System (NSS).

Every component in the NSS has been examined with "fail-safe" operation in mind. Key component failures were taken into account during design and implementation to ensure that single-mode or common-mode failure will not hamper the intended function of the overall Reactor Protection System.

The new Nuclear Safety System (NSS) is composed of four identical but independent Nuclear Safety Channels. Each channel has its own fission chamber detector, a pre-amplifier immediately downstream from the detector, and a wide-range neutron flux monitor (designated "DWK 250", based on manufacturer "Mirion Technologies model DWK 250").

The DWK 250 processes signals from its corresponding fission chamber detector. In the following sections, each component of the nuclear safety channels will be described in detail, starting with the fission chamber detectors and their pre-amplifiers as the Detector System in Section 3.1, and then the DWK 250 monitors in Section 3.2.

3.1 DETECTOR SYSTEM Each nuclear safety channel consists of a fission chamber detector and its associated pre-amplifier unit downstream from the detector.

Each detector / pre-amplifier pair is independent from the other three. All four detectors are secured in different instrument ports. They are physically separated from each other and cover different areas outside the reactor core. The pre-amplifiers for each of the detector are also mounted in physically separated locations at the reactor floor and the reactor basement. Each detector outputs its signal to its pre-amplifier unit that then sends the amplified detector signals to its corresponding DWK 250 mounted in the Control Room.

The cable distance between the detector and its pre-amplifier is kept to a minimum in order to minimize noise pickup by the connecting cable prior to signal amplification.

3.1.1 Fission Chamber Detectors Each fission chamber detector is a Mirion (1ST) Technologies model

1. NY-10887, a coaxial design (single cable) with an isolated 6061 aluminum outer chamber as casing, for wide-range / multi-mode operation.

The detector can be considered as composed of three concentric aluminum tubes. The outer tube is the chamber casing which is hermetically sealed. Of the two inner tubes, one is the signal electrode and the other is the high voltage (HV) electrode, both made of 1100 aluminum. The most inner one forms the Signal HV electrode. The middle one forms Non-proprietary Version the Return HV electrode and is thinly coated on the inner surface with no more than 0.2 grams of uranium as the neutron conversion material (>93% enriched uranium-235).

The three concentric tubes are secured in place, tightly fitted by compression into sintered alumina (A120 3) ceramic insulator grooves on the end plates. A 6061 aluminum tension rod at the center of the three concentric tubes holds the end ceramic caps together. The chamber is filled with Argon-Nitrogen (Ar-N 2) gas at one atmosphere (760 mm Hg) as the ionization medium. The composition of the gas is mainly argon with 1% to 5% nitrogen.

See Figure 3-1 for a functional electrical schematic of a fission chamber detector.

HERMETIC CASE AC SGAIS & CONNECTOR RETUN HV(OUER)

LECTODEHMG VOLTAG3E 0IS I

SFGNAL HV (Fi ERi ELECTRODE of QARTZ CABLE OS =Outer Shl~dd IS = mer Shield WIDE-RANGE FISSION CHAMBER CC = Center Cendutor CERAM4C CERNAMC END CAP ENDCAP Figure 3-1 Functional Electrical Schematic of MITR Fission Chamber Detector During operation, an electrical voltage of up to 1000 VDC is applied across the Signal HV electrode and the Return HV electrode. This voltage power is supplied from the corresponding DWK 250 neutron flux monitor for the fission chamber detector. Incoming thermal neutrons interact with the uranium on the Return HV electrode and produce energetic fragment particles of fission products. These particles traverse the argon-nitrogen gas medium and cause ionization by bombarding the gas molecules and producing many ion pairs along their paths as a function of the fragments' linear energy transfer (LET). Under the influence of the applied electrical potential (high above the recombination voltages), the electrons and positive ions are swept and travel across to their respective electrodes, with positive ions to the Signal HV electrode and the electrons to the Return HV electrode. Proper operating voltage is validated by measurements of chamber saturation characteristic when the reactor is at power.

Operational characteristics are evaluated with consideration given to conditions of higher than nominal operating power.

Non-proprietary Version The fission chamber detector housing is 10.7" long with a 2.6" outer diameter, and 1" long ceramic insulator caps mounted at both ends. The total length is 12.7".

The ceramic end caps are of slightly larger outer diameter, at 2.9", so as to ensure isolation and provide electrical insulation of the metallic portion of the detector casing from the instrument port. The aluminum outer casing is connected to the outer shield of its signal cable to form a Faraday cage. See Figure 3-2, Manufacturer drawing of Coaxial Fission Chamber for MITR Wide Range Operation (Model #NY-10887), and its specifications in Figure 3-3.

For MITR applications, the fission chamber design is slightly modified for high neutron flux operation. The changes aim to adjust this model of fission chamber detector for improved compatibility with the higher neutron fluxes at the MITR instrument beam ports where these detectors will be installed.

These modifications include a shortened neutron sensitive volume (about 3" length total; centerline scribed on the chamber outer-casing), lowered uranium density, and reduced thickness uranium coating to reduce thermal neutron sensitivity.

The final uranium oxide coating is 0.5 mg/cm 2. Final sensitivity is lowered to about 1xl0"16 A/nv, or about 0.7 mA signal current output for a neutron flux of 7.2x10 12 nv.

The final designed neutron flux range is 20 nv to 7xl010 nv. The four fission chambers are intended for use at the MITR in neutron fields having fluxes around 108 nv when the reactor is at full power. Section 3.1.1.3 describes the four instnrnent beam ports where the four fission chamber detectors will be installed.

Thermal neutron flux distributions in these beam ports were measured using gold foils and will be presented in that section.

The fission chamber's operational integrity will be validated annually by examination of its gas characteristics via plateau tests, in which the detector response in DC current at high reactor power (close to full power) is plotted against applied voltage.

The resulting curve is analyzed for plateau approach shape and plateau length.

Non-proprietary Version I

2 a,

4 i

3 4

(4 FT) 7 FT k6 IN (CABLE LENGTH) 220MAX A

5 A A,

12 70+/- 25 (107)

A CENTERLINE SENSITIVE LENGTH D

D II (SEE TABLE FOR VARIANTS)

I (026) -

02,9000 C

(7 4)

/

,_- EPOXY A CENTER CONDUCTOR

~

jIfIH~

E TRIAXIAL CABLE CABLE INNER SHIELD (IS)

AND OUTER SHIELD (OS)

ARE ELECTRICALLY COMMON WITH CONNECTOR SHELL COAXIAL HN FEMALE CONNECTOR SHOW WITH LIFT CABLE ASSEMBLY INSTALLED AND WITH HN CONNECTOR 1 CONVERSION BLE COATING BLY URANIUM OXIDE)

ICUSTOMER APPROVAL REQUIRED ED 055 nvTcmz LOSE0F nr,_.4 MIRI"N Sing Systems Division C

0'-

B TRIAXIAL PLUG CONNECTOR A B

NY-1CE08 GR4VARLANT CONNECTORS GR04JP DETECTOR CABLE I

LIFr CA I

MATING ASSEMN I DIM. J IDIM G/

GR16-TRIAXIAL - PLUG 15 0 1 105 INCLUDED LOOSE ATTACf 016-2 HR - FEMALE COAXIAL 5 6 o066 NOT INCLUDED SPLED GR-3 I-E/- FEMALE COAXIAL 5 6 0686 NOT INLUED ATC 4R-TED TBD 0 5 mo(cmz TBD SEE SHEET 2 OF 2 FOR NOTES

- DENOTES CHANGE

~II.II ~

ofseheads NewYoI-k A

T Y~ung 86/203872013COAXIAL FISSION CHAMBER FOR WIDE RANGE I MULTI-MODE OPERATION NY-10687 A

I I

-C I

IK n-I-I

-- 1 11 1 I I

WI-IrI I R*V I B

8/2(2012 ANGLXES *5' REOVEALMMlOISi~

ALL TH-th CL2ACO 20 0TYROSHALL WU OER" N. NItPattt ~

IS~ -

BI I

E-4198 I B h....

IAlI I

6/712013 r-

ý 1 OF 2

-A--

1 1F 4

Figure 3-2 Manufacturer Drawing of MITR Coaxial Fission Chamber Model #NY-10887

~11-

Non-proprietary Version I

9

,I A

0 C

Notes

• 16 Were rope assembly removal and i 1

Aluminum chamber noisig Wire rope assembly, including term to under Side Remove 3 bSos and 2

Nickel jacketed, low noise quartz cable Slide top insulator away from chao Mechanical Rerimoval On terrinal stud. back Nickel jacket diameter 0 260 in remove inboard nut, a Fiberglass insulating tape 0370 in Installation On teirminal stud. back Minlrnm bend radius termirnal stud into top i Multiple bends Z 6inch insulator) Iristall Ios Permanent bends 2 3 inch just protrude from nut Note that the cable is constructed with thin walted tubing and all bends must be smooth Re-secure top Insulator onto charot Electrical alcohol as lubrcant on bolt threads Characteristi impedane 75 ohms Alternatively, the wire rope can be 3 All cables covered with fiberglass insulating tape or sleeving wire rope, top rut, and cone (wire n Wire rope etectrically insulated from fission chamber and integral quartz cable 017 List of Materiala for Neutron Actroat

• 4. If chamber cable terminated with a tnaxial plug interface connector (equivalent to Amplenol 53175 with 7/8-20 mating threads), a lotse Arnphenol 52975 mating tnanof lack (Because they awe bloatedo xtohe connector is included for customer terinration of their organic field cable It chamber cable TrrxuA Conrector Termrontion and is terminated wrth HN Female coaxial connector, no loose mabng connector rs supplied Matenal Alloy / Type 5 Ceramic insulators provide electrical insulation frorn istrumenit well Chamber (Proper)

Cable end ceramic ws not field removable I replaceable Alulinum 110 Alumtinumr W061 6 Centertlne of - 3 inch sensitive volume length is scrbed on case Titanium Stainless Steel 300 series 7 Neutron cornersion material HEU o 93%vt U-235 U-235 con*ert = 0 2g max Nilckel-tron 42 Chamber gas is Ar-N 2 at 76 m Hg Alumit*la (A1203)

Uraniunm 235 8 Operating Temperature 250 F, maxirmurm Cables External pressure 180 pes, rnmmum Steel Ennronmwrt Surrounding atmospthere to be drl and rotn-corrosive NI plated Copper B-355 Operaton voltage: 800 Vdc nominal, 1000 Vdc maximum (see note 13)

Nickel 2001201 Quartz 9 Wire rope length can be shortened by repositionig two clamps and tromble Ef-Glas 10 Max worerng load 352 lbs DO NOT LIFT using chamber's quartz cable Fierglass

-18 Itstewo rrnended that tle cdetecto 11 Epoxy seal using Tyco tRaychem VlISF-N ant 12 Target Neutron Flux Range: 20 to 7 x 10 " nv using wide range (nulti-ireode signal processng

[e g Counting, Campbelflng (RMS 2

). and OC] Count rates at low neutron flux levetl may be Imfited by mondtoreg equipment (I e. - Integration or "gate" time may be too stho to obtain a stable statistially valid count rate) 13 High neutron flux operation and proper operating voltage sthould be validated by reviwing in-situ chamber saturation characteristic at full reactor power Operational characteristics should be evaluated welh consideration given to over power conditions (i e margin) 14 1% Neutron Sensitiity Loss: 1.6 x 101-ovt (besed solely on neutron I ctharge partice consersion material and an effectve cross-section of 614 Barne) 015 OS = Chamber case and tnaxrial cable order shield IS = Outet space charge volume electrode and triaxial cable inner shield (saial return)

CC = Ilner space charge voluae electrode and triaxial cable center conductor (signal)

• DENOTES CHANGE I CUSTOMER APPROVAL REQUIRED J statiabon instructions See vanants table for 'as suppled' attachmrent contiguration rintl stud, is installed or removed by disengaging the top insulator to provide access washers (bolts are secured into locking thread Iserts) Set aside for later re-estattetion Per head Be careful not to impose any stressors onto the detectors quartz cable

'up top side nut Until it reaches hox body Push loosened terminal stud into insulator nd detach wire rope assenbtly up top side nut Latl it reaches hex hody Rerrove lower nut and lower flat washer Install nsulator (top nut, lock washer, and flat washer should be present on out board side of top e lat washer and loose nut onto terrrmal stud Thread nut onto terminal stud until threads (1 + nut width). Tighten top nut until terminal stud is secure Do rot overbghten ter head using original 3 bolts and washers Do not overthgten bollts Use sopropyt to facilitate installation into looking thread inserts empty removed from the temial sW by unthreadrng top nut of terminal stud and removing rpe spreader) Terminal stud body will protrude as depicted on drawing en Analyses he tugh resc flux area the fllowing are *r imiluded Cable Thinbl/eCl*aps Termiatron)

Approx Mass Note 793 g 477 g 16g 122 g 4g 764 g Internal and External Ceramic Insulators 29 gotx Neutron I Charged Particle Conversien Material (may be significantly lower)

Approx Masslfoot 13 gMft WIre Rope 5 git Quartz Cable Conductors 29 gift Quartz Cable Outer Shield Not listed Quartz Cable I:nsuation CWOS Not lsted Quartz Cable In.atin I15 Not listed Quartz Outer Insulation cable to field cable masted connection be environmenlstly protected Seal mated connectors res lined ahredWit tubing and JCI selfti-ond*ng waterproof sealant or equivalerl D

I,-

B MIRION Sensing SystemsDiNewYon 14 1 1--out.Horseheads. New Yark A

001

/73 SUBJECT COAXIAL FISSION CHAMBER FOR WIDE RANGE I q

MULTI-MOOE OPERATION. NY-10087 A

rip'-

B1 I j E-4198 IlB jI r is I-P t_?.Jj-1 2 OF2 1

2 3

4 Figure 3-3 Manufacturer Specifications for MITR Coaxial Fission Chamber Model #NY-10887

~12-

Non-proprietary Version 3.1.1.1 Fission Chamber Integral Cable Triaxial cable emerges from one end of the detector. It is an integral quartz-insulated cable designed with 75 ohms electrical impedance.

The quartz cable is constructed with thin-wall nickel (200/201 alloy) tubing, also called the "nickel jacket", for better noise shielding, and wrapped externally in fiberglass insulating tape or sleeving. The final outer diameter of this mineral-insulated cable is about 0.4".

The cable is terminated with a triaxial plug interface connector or an HN-female coaxial connector.

Including the triaxial or coaxial plug connector, and the environmental seal leading cylinder, the integral quartz cable is about 7.5' long, and has a smooth permanent bend radius of at least 3 inches. It is a triaxial cable constructed with three concentric electrical conductors:

a center-conductor (CC) wire, a concentric inner shield (IS) tube, and a concentric outer shield (OS) tube that is the thin-walled nickel jacket mentioned above. The center-conductor (CC) wire and the inner shield (IS) are both nickel-coated copper and are connected to the detector chamber concentric electrodes to form the circuit path, with the center-conductor (CC) wire connected to the Signal HV electrode and the inner shield (IS) connected to the Return HV electrode. The outer shield (OS) is connected to the detector chamber case and forms a Faraday cage for overall electrical shield. See Figure 3-4, Functional Electrical Schematic of Detector Integral Quartz Cable.

The space between the center-conductor, the inner shield, and the outer shield are filled with quartz dielectric Fiberglass Tape Outer Shield - Quartz Inner ic-Shield Quartz Dielectric JPrCeter 1

~l Conductor OutrShierld Tape Wrap provide6 uuulaon iTli'-Mled Ilae the Irulatfe t connected to from msitnurent vveN niddle tiA" Outer M"el Iner Shield chamber pressurized to from nthe

1. om the casng to 3 atm N, Iner Shild Center form a Fara-Conductor day Cage Figure 3-4 Functional Electrical Schematic of Detector Integral Quartz Cable material to ensure electrical insulation of the three conductors.

Inside the nickel jacket, the cable is pressurized with three atmospheres of nitrogen gas for mitigation Non-proprietary Version of electrical breakdown pulse noise and other material degradations. Finally, the cable is externally wrapped in fiberglass tape to insulate the nickel jacket from the instrument port.

A stainless steel wire rope assembly is built in, and runs in parallel with the mineral-insulated cable.

This wire rope is electrically isolated from the fission chamber and its integral quartz cable. It is rated for a maximum loading of 350 lbs.

(based on the strength of its attachment point in the chamber's end cap) and is used exclusively to lift, pull, or support the weight of the fission chamber. One must not lift the detector chamber using the integral quartz cable or rest its weight on the cable.

When used in a horizontal beam port, the wire rope may be removed if there is not enough space in the port plug. However, if the wire rope terminal stud body on the ceramic cap end of the fission chamber is to remain in place, it protrudes out -2 inches from the ceramic end cap.

Figure 3-5, MITR Coaxial Fission Chamber within Insulated Shield, shows a finished MIT fission chamber detector with its integral quartz-insulated cable and plug connector at the end. The wire rope is also visible as the thinner item coming from the top of the detector.

Figure 3-5 MITR Coaxial Fission Chamber within Insulated Shield

-14

Non-proprietary Version 3.1.1.2 Fission Chamber Coaxial Cable Field cable is coaxial and will connect on one end to the coaxial plug of the detector's quartz-insulated integral cable and on the other end to the pre-amplifier TKV 23. So the cable remains outside of the neutron flux. The field coaxial cable is industrial grade RG216/U cable.

It is 0.425" diameter, 75-ohm doubly-shielded polyvinyl chloride (PVC) jacket flexible cable, as illustrated in Figure 3-6, RG216/U Flexible Coaxial Cable. From the center-conducting wire to the outer jacket, it is constructed of four layers of materials. The inner conductor is tin-plated, seven-strand copper. It is wrapped in polyethylene (PE) dielectric insulator. Outside the PE cover are two layers of braided copper shields. The outer jacket is black PVC material. The cable electrical impedance is 75 ohms with a capacitance of 20.7 pF/ft. Its maximum operating voltage is 3,700 volts, well above the maximum 1,000 volts operating voltage needed for the fission detector.

PVC Jacket Outer Copper Shield Inner Copper Shield Dielectric Seven Strand Cen-ter Conductor Figure 3-6 RG216/U Flexible Coaxial Cable Non-proprietary Version 3.1.2 Pre-amplifier The pre-amplifier is a Mirion Technologies Model TKV 23 wide-range unit.

Its full designation for the MITR is "TKV 23.1 1". The extension digits are assigned by the manufacturer to differentiate variants of a model, such as for different impedances, gains, settings, number of functional units, detector voltage, etc. For this document, TKV 23 is used for simplicity. The TKV 23 pre-amplifier is an analog electronic device that uses solid-state components such as transistors, diodes, integrated circuits, resistors, and capacitors. Its operation does not use software.

The TKV 23 amplifies in separated stages the fission chamber detector output signal including its pulse and AC components, passing the amplified signal to the DWK 250 for processing. It decouples the DC component of the output signal. The TKV 23 module also has a built-in pulse-signal test generator and a built-in AC-signal test generator [

1]

During operation at low power, the fission chamber detector signal is in pulses as fission fragments generate pulse discharges inside the detector.

As power increases, neutron flux increases, and the output signal pulses begin piling up such that the output signal resembles a DC current.

However, at higher power and higher fluxes, the operating temperature of the detector also increases. This inherently results in degradation of material properties, such as electrical isolation of the detector and interconnecting cables. A leakage current is produced that adds or superimposes onto the detector's DC current output.

Moreover, the current from the alpha-decay of uranium at low signal levels as well as the gamma-current generated from the core both add to the DC current. As a result, the overall DC signal output is no longer a linear function of the reactor power. However, due to the random nature of the nuclear events in the fission detector chamber, this DC signal has a fluctuating current superimposed onto it. According to Campbell's formula for stochastic signals, the mean-square value (MSV) of this alternating current is an accurate measure of the true direct current generated by the neutron-uranium fission events.

The necessary squaring also yields a highly effective discrimination against the smaller pulses caused by alpha and gamma radiation. This squaring or Campbell algorithm is performed in the DWK 250 neutron flux monitors downstream from the TKV 23.

The TKV 23 wide-range amplifier decouples the pulses and the alternating current signals from the fission chamber detector signal, amplifies them and transmits Non-proprietary Version them over long-distance coaxial cable to the DWK 250s in the Control Room. ((

1]

The pre-amplifier's input and output impedances are both 75 ohms, to correspond with the impedance of the detector's quartz-insulated triaxial cable. For physical protection and better noise shielding, the MIT Reactor encases each TKV 23 pre-amplifier in a standard steel outer enclosure with cover at the site of the installation. For reduction of electrical noise pickup and attenuation of signal strength, the distance between the detector and the pre-amplifier is minimized to the extent practical.

Non-proprietary Version Figure 3-7 Fission Chamber Detector and Pre-Amplifier Electrical Schematic 18 -

Non-proprietary Version 3.1.3 Physical Layout Each fission chamber detector is installed around the MITR core in an instrument port, which is a beam port designated for neutron flux monitoring. Four such beam ports are selected for the upgrade - two horizontal instrument ports (41111 and 41H3), and two vertical beam ports (3GV2 and 3GV5). See Figure 3-8 for a horizontal cross-sectional view of the relative locations of the four instrument ports.

(Note: "41HI" can be regarded as "4 inch internal diameter Instrument Horizontal port #1". Likewise "3GV2" can be read as: "3 inch internal diameter Graphite region Vertical port #2".) Any instrument port or vertical port could be used, but these four were selected to optimize spatial symmetry and accessibility of the detectors.

,40HI 6SHI 66THI

". .d.:- :'"

IPH I "40H2

\\Thermal

,6SHZ Shield 41H3 41H4 41HI 41H2 Figure 3-8 Horizontal Cross-Sectional View of Instrument Port Locations 41H1, 41H13, 3GV2, and 3GV5

_19-

Non-proprietary Version Access to the two 41H ports is from the Reactor Floor. When standing in front of the 12SH1 beam port facing the reactor, instrument port 41HI is on the right, and 41H3 is on the left. Both ports are physically below the core tank. Access to 41HI is inside the same port box as 41H2, with 41HI centerline at 10" above that of 41112.

Likewise, access to 41113 is via the same port box as 41H4, with 41H3 centerline at 10" above that of 41114. Vertically, the 41HI and 41H3 port center-points are both at 19" below the bottom of the core tank. It is important to point out that the tips of both horizontal port plugs are just outside the reactor thermal shield. So neutrons arriving at the fission chamber detectors in the port plugs will have to travel across the light water in the main core tank, the D20 in the reflector tank, and the graphite region outside of the reflector tank.

Thermal neutron flux distribution was measured in these beam ports using gold foils. Figure 3-9 shows the values and the flux profile in 41Hl. The flux for 41H3 is expected to be similar to 41H11, as the two ports are symmetric about the reactor core.

Distace (ifnhoo Thermal N.et~on Flux to oA d pn) t$c_42.1 X Full Po Thermal Neutron Flux in 41111 Instrument Beam Port at Full Power 0

3 99E-10 OOr÷ 4

6 68E09 12 1 15E+09 16 2 26E-09 20 1 97E+08 w o.00+7 24 1 33E.08 26 1 63E+08 32 3 97E+07 0

5 1

i5 20 2S 3S 40 3d 6 73E.07 Distance from HlWh-Flux Tip of Beam Port [Inches)

Div-,0 nowhes The~mui NoAoon Flux f-top ofpol) I#/32. aot Full Por Thermal Neutron Flux in 3GV4 Vertical Beam Port at Full Power 44 3 75E+11 0....

40 7 18E.10 edo 36 2 12E.10 N

32 7 82+09 1000.o0 28 3 46E"09 24 1 43E-09 20 6 68E+08 16 3 59E08 OE100 7 12 2 111.08 0

8 1 296+08 4

916E00 5

10 Is 20 25 30 35 40 so50 0

1 14E+08 Distance from Top of Beam Port [inches]

Figure 3-9 4111 and 3GV4 Measured Flux Values and Flux Profiles

Non-proprietary Version Access to the two 3GV ports is from the Reactor Top area.

These vertical ports are physically located about 1200 apart.

Both enter the reactor's graphite region outside the core tank and the reflector tank at an inclination of 3* away from the vertical axis. See Figure 3-10 for a side view of a 3GV port inside the reactor's graphite region.

Thermal neutron flux distribution was measured in these beam ports using gold foils. Figure 3-9 also shows the values and the flux profile in 3GV4 at full power.

1*

.--1--- 30 angle Reactor Top Deck Plate Upper Concrete Shield 3' 6" 4' 1/4" Lower Concrete Shield Detector 2' 611 4' 10"1 Graphite Reflector Boral Plate Fuel Elevation 11" Core 1' 5" MITR II 4

21 411 Figure 3-10 Vertical Cross-Section of a 3GV Port in the Reactor's Graphite Region

ý* ----Z 1/4" 21-

Non-proprietary Version Figure 3-11 depicts the relative locations of the four fission chamber detectors, and the way their signal cables are routed to their corresponding pre-amplifiers and DWK 250s in the Control Room.

Reactor Top

- Approximate Chamber Position Reactor Floor Utility Shelf 41H3 LrC =.

I

_m Reactor Basement Control Room r coo Figure 3-11 Relative Locations of the Four Fission Chamber Detectors Non-proprietary Version 3.2 NEUTRON FLUX MONITOR DWK 250 There are four neutron flux monitors, each connected to its corresponding fission chamber detector and pre-amplifier upstream. Each neutron flux monitor is a Mirion Technologies Digital Measuring System proTK / TK 250 Model DWK 250 digital wide-range monitor.

DWK is "Digitaler Weitbereichs-Kanal" in German, "Digital Wide-range Channel" in English. It performs dual-mode signal processing, converting the amplified detector signal outputs into reactor power and its rate of change (reactor period) throughout both the source range and the power range. There is no operator action needed for transitioning between the two ranges. When these signals go beyond their preset threshold values, the DWK 250 outputs a trip signal that the user facility can use to scram the reactor.

It is important that the neutron detector is compatible with the DWK 250 wide-range monitor. The type selected has been described in previous sections. The output signal from the fission chamber detector is passed into the TKV 23.11 pre-amplifier in which the DC component is decoupled, and the pulse signal and the AC signal are amplified and passed onto the DWK 250, for start-up range and wide-range monitoring. The amplified analog signals are first electronically conditioned in the DWK 250 and then converted into a digital signal.

The digitized signal is then transmitted to the central signal processor, which computes and outputs neutron flux level and the relative change rate (reciprocal of "reactor period"). See Figure 3-12 on signal processing in the Nuclear Safety Channel.

At low power, the DWK 250 acquires fission chamber detector pulse signals.

At high power, the DWK 250 acquires the AC detector current and generates the wide-range signal by merging the pulse signal with the AC signal. It performs signal smoothing using a programmable filtering curve. It converts the wide-range signal into units of neutron flux or % power, selectable by the user. It also calculates the neutron flux change rate, i.e. the reciprocal of the reactor period.

The signal processing and calculations are handled by three dedicated microprocessors in each DWK 250 monitor, discussed in detail in the following sections. In brief, one microprocessor, NZ 21, is the I/O processor. It handles input /

output signals and controls internal tasks. A second microprocessor, NZ 12, is the central processor.

It handles execution of digital algorithms.

The third microprocessor, NK 21, handles serial interface and communication with external devices, if any.

Each microprocessor performs its specific function as set by the firmware permanently programmed into its non-volatile EPROM memory.

The firmware is 23-

Non-proprietary Version 1]

Figure 3-12 Signal Processing in the Nuclear Safety Channel

Non-proprietary Version concise and robust. The NZ 21 firmware is written in assembly language and contains 2600 lines (about 2.5 kilobytes of program code) ((

)) They have been used in all DWK 250 and other TK 250-series monitors since 1989 at European nuclear power plants and have performed reliably.

The DWK 250 provides a number of user-selected outputs. There are two analog outputs in linear or logarithmic form for user indicator meters or recorders.

The MITR uses these analog output signals for display of reactor power (in % power) and reactor period (in units of seconds) on analog meters.

There are eight binary (close / open) signal outputs which MITR specifies as trip signals "High Power Trip",

"Short Period Trip", "High Power 100 kW Operation Trip", "Low Count Rate Trip",

"High Power Warning Trip", "Short Period Warning Trip", "Test Status", and "Fault Trip". Additionally, there are two digital signal outputs that the MITR uses for data acquisition and recording only. For periodic testing, test signals are generated from a dedicated signal generator circuit within the TKV 23.11 pre-amplifier, based upon command triggered by the operator from the corresponding DWK 250 in the Control Room. While in service, the DWK 250 performs continuous functional checks on its internal functions and operations, as detailed in the following sections.

The DWK 250's hardware and software are modularly designed and combined with components of the TK 250-series Digital Signal Processing System. The MITR's DWK 250 monitors each consist of 14 modules. All plug-in modules are fitted in a 19" rack casing.

See Figure 3-13 photo of an installed DWK 250 in the Control Room, and Figure 3-14 schematic diagram depicting functions of various modules within a DWK 250 monitor. These modules are described in the following sections, in the order in which input signals coming from the fission chamber detector are processed.

Figure 3-13 DWK 250 Installed in the Control Room 25

Non-proprietary Version F]

Figure 3-14 DWK 250 Schematic Diagram 26-

Non-proprietary Version 3.2.1 NI 21 Pulse Discriminator This is a pulse signal input module. At low power, the incoming detector pulse signal is shaped or pre-processed by the NI 21 pulse discriminator unit. Pulses that exceed a preset (adjustable from 0 to +/-5 V) discriminator threshold at the NI 21 are filtered and allowed to pass along to a pulse counter within the NZ 21 I/0-processor immediately downstream. [f JI

((

11 I[

The NI 21 module can be considered as a specialized analog-to-digital converter. It makes use of both analog components, the CMOS ICs mentioned above, and bipolar ICs for analog signal processing and binary signal processing.

3.2.2 NA 33 AC-Input Module / AC Correlator This is an AC-signal input module. The NA 33 module performs the Campbell processing, or so called "campbelling", which carries out squaring of the AC signal for its mean-square value (MSV). The module contains a solid-state analog circuit to perform this squaring and smoothing function continuously.

The TKV 23 pre-amplifier transmits detector AC output signal to the NA 33 module, becoming more linear at elevated power levels.

The amplitude of the AC signal increases as the reactor power is increasing. ((

I]

Non-proprietary Version There is one CMOS-IC chip on the NA 33, which is used for the measuring range selection. All other ICs on the circuit board are bipolar ICs.

3.2.3 NZ 21 1/0-Processor This module processes input signals, transmits output signals, and controls internal tasks of the DWK 250. In addition, the NZ 21 performs pre-processing of signals and supplies them to the NZ 12 central processor. ((

11 Signal inputs to the NZ 21 module include discriminated and conditioned pulse signals from the NI 21 pulse discriminator, AC signal that has been mean-squared and conditioned from the NA 33 AC-Correlator, detector voltage feedback (for voltage monitoring) from the TKV 23 pre-amplifier, operating voltage (for monitoring) of the DWK 250 monitor, and discriminator voltage (for monitoring) from the NI 21 module.

Binary signal inputs to the NZ 21 module enable auto-ranging up-shifts and down-shifts (change-over of the measuring ranges).

Additionally, the NZ 21 module receives two data streams calculated by the NZ 12 central processor module (described in Section 3.2.4) consisting of flux change rate (reactor period) and logarithmic wide-range neutron flux (reactor percent power).

The NZ 21 module performs D/A conversion of these two signals and outputs them in analog form for display purposes.

-28

Non-proprietary Version

))

The NZ 21 microprocessor is considered one of the three main signal-processing units. Its functions are carried out by software, which is stored in an EPROM that cannot be altered. Information stored in the EPROM also includes the default value of the discriminator threshold, time-constants for the low-pass filters, alarm and trip levels, etc. The firmware program code is 2600 lines in assembly language. ((

))

The NZ 21 1/0 processor cyclically calculates a checksum of its program code.

The NZ 12 central processor compares this result to a set value, and also monitors the I/O processor's program sequence. If there is a mismatch, the NZ 12 central processor generates a fault message. Additionally, the NZ 21 I/O processor cyclically tests its external (RAM) memory, performs a central processing unit test, and sends a fault signal to the NZ 12 central processor if an error is found.

29

Non-proprietary Version 3.2.4 NZ 12 Central Processor The NZ 12 central processor handles calculation of the wide-range signal and its relative rate of change, signal-channel monitoring, and an operator interface control and display panel. ((

I]

For MITR applications, the NZ 12 central processor provides eight binary outputs (BO) to the NB 28 relay-driver module, which transmits them to the reactor protection system. Two of the eight binary signals are factory-default messages "BO 07: Test Status" and "BO 08: Fault / Equipment Malfunction".

The other six are defined by MITR as "BO 01: High Power Trip", "BO 02: Short Period Trip", "BO 03:

High Power 100 kW Operation Trip", "BO 04: Low Count Rate Trip", "BO 05: High Power Warning Trip" and "BO 06: Short Period Warning Trip".

Additionally, the NZ 12 central processor provides five binary signal outputs for activation of test generators (pulse signal and AC signal) in the TKV 23 pre-amplifier, activation of the test generator ("crystal frequency" 1.95 kHz and 500 kHz) in the NI 21 pulse discriminator module, and activation of the test generator in the NA 33 AC-input module.

The operator interface control and display panel on the NZ 12 central processor's front panel is the only built-in user interface on the DWK 250 monitor.

See Figure 3-14 for DWK 250 Front Operator Interface Control and Display Panel.

The two-line alphanumeric liquid-crystal display with 16 characters per line is used for displaying measured values, parameter settings, and status message text. The eight function keys on its front panel allow control of its operation, such as setting parameters and launching built-in test and simulation (test signal generation) procedures, initiated by the users only when the appropriate keyswitch is enabled. The continuous signal processing and operating functions of the DWK 250 monitor proceed in parallel and will not be affected by the choice of items called for display.

The changes in parameter settings do not become effective until the user pushes the "Store" key. After that, continuous signal processing will use the new parameters.

Non-proprietary Version The upper keyswitch on the NS 01.12 keyswitch module enables testing procedures, and the lower keyswitch there enables parameter set-up. At MITR, the enable keys are kept in locked storage. Only a few authorized senior personnel will have access to the keys for the performance of written calibration procedures when the DWK 250 is taken off-line or when the reactor is shut down.

The NZ 12 central processor cyclically tests its parameter memory and data memories.

It also cyclically calculates a checksum of its program code.

The processor compares this result to a set value. If the calculated EPROM checksum deviates from the expected value, the NZ 12 central processor indicates this error via a "Fault Trip" binary signal output (relay contact). The program sequence of the NZ 12 central processor is monitored by a hardware watchdog and also by the NZ 21 1/0 processor. At the same time, the program sequence of the NZ 21 1/0 processor is monitored by the NZ 12 central processor as described earlier.

If there is any mismatch, the NZ 12 central processor generates the Fault Trip (also known as the "watchdog scram").

The hardware and software of the NZ 12 central processor and NZ 21 1/0-processor are interlinked by an internal serial-bus (S-bus) only and have no means for mutual access to firmware program and data memories. ((

))

Their operations are independent. - The NZ 21 1/0-processor will remain operational even if the NZ 12 central processor should fail.

-~ 31 -

Non-proprietary Version 3.2.5 NK 21 Serial Interface This module implements the communication protocol for a link (RS-232 port or terminal block) to an external computer, and provides the link to the server-task running on the main processor.

Similar to the NZ 21 1/0-processor and the NZ 12 central processor, ((

)), and is one of the three central signal-processing units. Its functions are executed based on the firmware that is stored in the EPROM on the microprocessor board. The software program code is approximately 2 kilobytes.

Parallel to its communication tasks, the NK 21 serial interface microprocessor continuously performs self-monitoring tests:

a CRC checksum for its program memory (i.e. EPROM content); monitoring of internal S-bus; periodically triggering the hardware watchdog on its microprocessor board.

3.2.6 NB 28 Relay Module This module provides eight relays with single-pole, double-throw (SPDT) contacts. These are normally-closed (NC) contacts. They open to disconnect the circuit when a trip signal is received from the NZ 12 central processor. As previously described, the eight relays in the NB 28 module are designated "High Power Trip",

"Short Period Trip", "High Power 100 kW Operation Trip", "Low Count Rate Trip",

"High Power Warning Trip", "Short Period Warning Trip", "Test Status", and "Fault Trip".

When the trip signal is activated, the relay contacts will open. A corresponding LED indicator will light at the front of the DWK 250 chassis for operator information.

3.2.7 NS 01 Keyswitch Module This NS 01.12 module provides two key-operated switches. Each is normally in the "off' position (9 o'clock), which allows the key to be removed. The key is required in order to turn any switch to the "on" position (12 o'clock), which then causes the key to be retained. Keyswitch S I (upper, black) enables initiation of test 32

Non-proprietary Version signals.

Keyswitch S2 (lower, red) enables changes to the DWK 250 parameter settings by the operator.

The key-operated switches may be used together or separately. The keys are kept in secure storage accessible only by senior members of Reactor Operations, and the Instrumentation Supervisor.

3.2.8 NA 06 Display Module This module contains two edgewise analog meters whose indicator faces were specifically made for application at the MIT reactor. One edgewise meter indicates the log of measured neutron power in percentage of full power. The other indicates reactor period in seconds. The range of reactor period from 100 seconds to 50 seconds is colored orange, and from 50 to 30 seconds is colored red. When reactor period shortens to 30 seconds, the DWK 250 triggers a short period warning. The range of reactor period from 30 seconds to 10 seconds is colored white. When reactor period shortens to 10 seconds or less, the DWK 250 triggers a short period trip.

3.2.9 NE 37 Pulse Decoupling Module This module provides a non-discriminated analog pulse output of the amplified fission chamber detector signal. It takes the raw pulse signal from the associated pre-amplifier and outputs it via two BNC-type connectors at the front of the chassis. The upper connector (jack "A") carries a non-discriminated analog signal without distortion. The lower connector (jack "B") carries a discriminated digital signal. The outputs of the NE 37 are decoupled and galvanically isolated from the DWK 250, ensuring absence of feedback effects.

The non-discriminated signal does not go through any signal processing path within the DWK 250. This allows the operator to present the non-discriminated pulse signal to an external Single Channel Analyzer for lab experiments such as I/M reactor startup exercises. ~

Non-proprietary Version 3.3 PERFORMANCE EVALUATION

SUMMARY

One new nuclear safety channel has been successfully installed at the reactor for continuous off-line testing. The installations were done in various test stages. At each stage, a 50.59 safety review was performed. The DWK 250 neutron flux monitor was first installed on a remote section of the control panel.

After satisfactory observation of the DWK 250, the pre-amplifier was installed. Finally the detector cables were laid and the fission chamber detector was installed.

The response time of the DWK 250 to either a high reactor power test signal or a short reactor period test signal was measured to be less than 500 milliseconds, including the signal generator instrument rise time for the high power trip and for the period signal simulation going from 30 seconds to 10 seconds.

Overall system performance was tracked closely, and showed fully satisfactory stability and reliability.

Reactor power and reactor period indications both match closely with expected calibration values.

Non-proprietary Version

4.

SCRAM LOGIC SYSTEM The Scram Logic System contains two identical logic circuits built with discrete solid-state components. Each logic circuit performs coincidence comparison for two-out-of-four scram logic for the signals coming from the four DWK 250 monitors. (The current analog system uses one-out-of-three logic. The additional DWK 250 channel adds reliability, and if any channel is placed in "test" mode or otherwise taken out of service, the system reverts to one-out-of-three logic.)

If coincidence is met, each circuit will independently output a reactor scram signal. Six of the eight trip outputs from each DWK 250 are routed to both circuits, which perform simultaneous logic comparisons for redundancy. The 29 total inputs to the Scram Logic System are described in Section 4.2.

4.1 Development of the Scram Logic Circuit The two-out-of-four logic was designed in-house. A boolean diagram based on logic gates ("AND", "OR", "NOT") was prepared. (See Figure 4-1.) A computer-based logic simulator ("Logic Gate Simulator", South Puget Sound Community College) was used to verify and test the logic design.

Figure 4-1 Illustration of a Boolean Diagram Output from Logic Gate Simulator,

Non-proprietary Version Once the design was finalized, it was written onto a field-programmable gate array (FPGA) development device using Quartus II version 12.1 programmable-logic-development software compiler from Altera Corporation. The FPGA (Figure 4-2) is a pre-constructed, rewritable integrated circuit designed to be configured by a user; the rest of the device provides input and output support. Quartus II performs analysis and synthesis of Hardware Description Language (HDL) designs, using logic diagrams such as from Logic Gate Simulator as its input.

Quartus II interprets the logic diagrams and outputs a reference logic diagram as shown in Figure 4-3.

Figure 4-2 Field Programmable Gate Array (FPGA) Device for Logic Tests 36-

Non-proprietary Version

.-.MRM aae-Figure 4-3 Illustration of a Quartus II Logic Diagram for the Scram Logic Circuit Non-proprietary Version A testing board containing discrete switch components and LED indicator lights was designed to simulate all possible combinations of 29 trip inputs (from the four DWK250s plus the 100kW operation key-switch; see complete listing in Section 4.2). The board was printed by a manufacturer from an in-house design, and populated in-house with the discrete components. This board was then used to test the logic tree implanted into the FPGA. Iteration of this test was used to improve the logic design. Figure 4-4 shows the testing board.

Figure 4-4 Logic Testing Board This logic design was then imported into another circuit design program, NI Multisim by National Instruments. Using NI Multisim, a schematic of the logic circuit was captured and transferred to NI Ultiboard, another industrial software development tool, for a printable circuit board (PCB) layout. NI Ultiboard generated a three-dimensional CAD layout of the circuit card for fabrication of a prototype. Once the card is manufactured, the discrete components will be installed on it in-house, producing a prototype circuit card.

Another testing board, similar to the one in Figure 4-4, will then be constructed to test this prototype card, using voltages that match the trip outputs from the DWK 250s. Several iterations of the above process may be needed until the prototype satisfies all performance requirements. When the scram logic circuit design is finalized, it will be sent to a manufacturer for fabrication.

At every stage of the design and development process, the circuit will be fully testable. A written procedure will document final testing of scram logic circuit cards to make sure a correct scram signal will be produced for every possible combination of input trips. All discrete components that will be mounted on the final circuit card will be tested individually and documented for quality assurance purposes.

Non-proprietary Version 4.2 Inputs To Scram Loeic System There are a total of 29 inputs to the Scram Logic System. Each of these inputs enters the two scram logic circuits.

24 of the inputs are coming from the four DWK 250 monitors as previously described. Another four are resets for the latching alarms coming from each DWK 250. The final input is from the key-operated switch for operation below 100 kW.

pn.ut #

Name of Input 1

DWK 250 #1 High Power Trip 2

DWK 250 #1 Short Period Trip 3

DWK 250 #1 100 kW High Power Trip 4

DWK 250 #1 Low Count Rate 5

DWK 250 #1 Internal Fault 6

DWK 250 #1 Test 7

DWK 250 #2 High Power Trip 8

DWK 250 #2 Short Period Trip 9

DWK 250 #2 100 kW High Power Trip 10 DWK 250 #2 Low Count Rate 11 DWK 250 #2 Internal Fault 12 DWK 250 #2 Test 13 DWK 250 #3 High Power Trip 14 DWK 250 #3 Short Period Trip 15 DWK 250 #3 100 kW High Power Trip 16 DWK 250 #3 Low Count Rate 17 DWK 250 #3 Internal Fault 18 DWK 250 #3 Test 19 DWK 250 #4 High Power Trip 20 DWK 250 #4 Short Period Trip 21 DWK 250 #4 100 kW High Power Trip 22 DWK 250 #4 Low Count Rate 23 DWK 250 #4 Internal Fault 24 DWK 250 #4 Test 25 DWK 250 #1 Latching Reset 26 DWK 250 #2 Latching Reset 27 DWK 250 #3 Latching Reset 28 DWK 250 #4 Latching Reset 29 100 kW Key-Operated Switch 39-

Non-proprietary Version

5.

SECURITY AND CYBER VULNERABILITY EVALUATION The four DWK 250 neutron flux monitors and the scram logic system will be permanently installed in the control room console instrumentation racks. The control room is continuously attended by at least one licensed reactor staff member whenever the reactor is operating. When the reactor is not operating, access to the control room is restricted by the containment building's security system.

As discussed previously, the three main microprocessors for each DWK 250 monitor have firmware, which cannot be altered, permanently burned into their EPROMs.

The firmware and its downloading processes are safeguarded at the manufacturer's Munich production facility.

During operation, the three microprocessors perform continuous self-checking and cross-checking, as described in Section 3.2.4.

Adjustable parameters such as calibration settings, trip set points, alarm set points, voltage monitoring ranges, and discriminator threshold can be changed normally using a keypad on the front of the monitor. However, any such change made to adjustable parameters requires enabling of the S2 keyswitch (lower, red) on module NS 01, as described in Section 3.2.7. Figure 3-15 shows the keypad and the keyswitch module on the front of a DWK 250 monitor. The key will be kept in a monitored, high-security key cabinet and will be accessible only by authorized senior members of Reactor Operations, and the Instrumentation Supervisor.

Figure 3-15 DWK 250 Front Keypad, RS232 Port, and Keyswitches

Non-proprietary Version The adjustable parameters can also be changed via the NK 21 serial interface module. As described in Section 3.2.5, the serial interface module contains one of the three main microprocessors. This module, also shown in Figure 3-15, bears a two-position self-latching toggle switch that selects between an RS232 connector on the front (toggle position up, labeled "front"), and a terminal block on the back (toggle position down, labeled "rear"). Both of these I/O ports reference the same stored information, but only one can be used at a time, based on the selected position of the toggle switch. Figure 3-16 shows the terminal block on the back of a DWK 250 monitor. Terminal block connection precludes use of any standard data cable in that it requires wires to be connected individually, with unit-specific knowledge of which terminals to use.

Figure 3-16 DWK 250 Back Terminal Block These connections allow data acquisition as well as change of the adjustable parameters via a computer. During the testing phase, a dedicated, non-networked computer is used for data acquisition from all four DWK 250s. This computer is for data storage and analysis of the upgraded nuclear safety system, and will also be used to change the parameter settings for tests. When the testing phase is complete, the RS232 connector at the front will be physically removed from each NK 21 module, and the data acquisition computer will be disconnected from the terminal block at the back. This will ensure that the adjustable parameter settings cannot be changed by unauthorized individuals. In terms of safeguarding adjustable parameters, this is a significant increase in security compared to the existing nuclear safety system.

Non-proprietary Version In order to maintain data acquisition capability beyond the testing phase, future plans may upgrade the NK 21 serial interface module such that the firmware provides a firewall feature for the RS232 connector and the terminal block which can be enabled and disabled by means of a keyswitch. The firewall could also control which adjustable parameters can be changed through the NK 21 communication ports. Data acquisition would continue to be through a dedicated, non-networked computer connecting to the terminal block at the back.

The computer would be password-protected and will run a proprietary device driver written by the manufacturer for read-only operation.

In this manner, the computer could function as a recorder for the DWK 250s' parameter settings. Data recorded on the dedicated computer would be transferred manually, and only by writing it to optical discs.

In all cases, the official record of the parameter settings will be kept on written procedures that govern the change of the parameters by authorized individuals, and will be checked independently by an operator viewing the settings on the DWK 250's keypad display. Completed procedures will be filed as part of the reactor startup checklists whenever they are performed. During operation, the DWK 250 settings will be inspected on the keypad display and recorded by the console operator at least daily.

As previously described, the DWK 250 monitors are connected to analog components upstream (fission chambers, pre-amplifiers) and downstream (analog console meters for reactor power and reactor period). They are protected from all other directly-connected components, namely the scram logic system downstream, via optical isolators.

The scram logic system itself consists of two identical but independently-operating scram logic circuit cards, both constructed only of discrete solid-state components. None of the detector, pre-amplifier, DWK 250, or scram logic hardware will be connected to a public network.

As a result, there is no cyber vulnerability to the DWK 250 monitors or any of the components in the upgraded nuclear safety system.

42-

MIT RESEARCH REACTOR NUCLEAR REACTOR LABORATORY MASSACHUSETTS INSTITUTE OF TECHNOLOGY Description of EXISTING NUCLEAR SAFETY SYSTEM from the MITR Safety Analysis Report 138 Albany Street Building NW12 Cambridge, MA 02139 AI

SAR

Description:

Existing System Page 1 of 4 7.4 Reactor Protection System The RPS ensures that the limiting safety system settings are not exceeded. It consists of both a nuclear and a non-nuclear component.

7.4.1 Nuclear Safety System The nuclear instrumentation system for the MITR consists of nine neutron or gamma flux monitoring channels. Each channel consists of a detector, high voltage and signal cabling, an output display device, and associated alarm, scram, or control circuitry. Channels 1 and 2 are used as startup channels, and with channel 3, have associated scram trips at a period of 10-11 seconds. Channels 4, 5, and 6 are used as power-range channels and have high flux scram trips corresponding to a reactor power level of 6.6 MW as determined by correlating the previous equilibrium value of each detector's output with the thermal power.

These six instruments comprise the reactor's nuclear safety system. Channels 7 and 8 are part of the control/console display instrumentation system. Channel 7 provides a linear indication of the flux level, and channel 8 provides a flux indication if electrical power is lost. Channel 9 is part of the reactor control system. It provides a signal to the automatic control permit circuit.

All neutron detectors are mounted in either instrument ports or vertical thimbles.

The detectors monitor the leakage flux in the reflector region. The degree of overlap between the channels from source range to full power operation is shown in a bar chart in Figure 7-3.

Power to all nuclear instrumentation channels except channels 3 and 8 is supplied as unregulated voltage from loads L21/L22 via Panel 1. (See Figure 8-1). These loads are supplied by emergency power in the event of a loss of the off-site electrical power. Channels 3 and 8 are supplied by their own self-contained power supplies and do not depend on either off-site or emergency electrical power for operation.

7.4.1.1 Period Channels Channels 1 and 2 are of the same design and are interchangeable. Each uses a fission chamber and an uncompensated ion chamber as the neutron sensing elements. The fission

SAR

Description:

Existing System Page 2 of 4 chamber is operated as a pulsed counter in the source range to provide visible neutron level indication at reactor startup. The uncompensated chamber is operated in the power range once the fission chamber saturates after a four decade power increase.

The output pulses from the fission chamber are amplified by a preamplifier and are then fed to a logarithmic count-rate amplifier. This amplifier first converts the pulses into a d.c.

signal that is proportional to the counting rate and then amplifies the d.c. signal in a logarithmic manner. The output is indicated on a meter on the amplifier chassis and on a duplicate console-mounted meter that displays either channel 1 or 2 level as selected by the console operator. A differentiating circuit in the amplifier chassis is used to derive reactor period which is indicated on a meter on the amplifier chassis and on a duplicate console-mounted meter that displays either channel 1 or 2 period as selected by the operator. The channel output may also be recorded on a strip chart recorder that monitors channel 1, 2, or 3 as selected by the operator.

The d.c. output signal of the period-deriving network is fed to a scram amplifier as part of the nuclear safety system. Each of channels 1 and 2 has an associated safety system scram initiated by its associated scram amplifier at a period between 10 and 11 seconds.

When the fission chambers saturate at the end of their four decade range following startup, the channel is switched over to the uncompensated ion chamber. The two fission chambers are physically connected to the channel at all times and change-over is accomplished by turning down the gain on the fission chamber. This removes the fission chamber component of the signal, leaving the ion chamber, whose signal has just come on scale, as sole input to the channel. The change-over process is coordinated so that there are two operable period channels available at all times.

Channel 3 uses an uncompensated ion chamber, the output of which is fed directly to a logarithmic amplifier. The output is indicated on a meter in the amplifier chassis and on a duplicate console meter. A differentiating circuit in the amplifier chassis is used to derive reactor period with the output displayed on a meter in the amplifier chassis and on a duplicate console meter. The d.c. output of the period network is fed to a scram amplifier as part of the nuclear safety system. Channel 3 provides a safety system scram initiated by its associated scram

SAR

Description:

Existing System Page 3 of 4 amplifier at a period between 10 and 11 seconds. Power to channel 3 is supplied by a replaceable gel cell battery pack. A console meter displays a signal proportional to channel 3 chamber voltage.

A redundant scram has been added to the three period channels (1, 2, and 3) to ensure that the minimum number of channels monitoring reactor period will be on line and functional.

The reactor will scram if two or more of the three period channels are off-scale, in any combination of high or low, simultaneously.

7.4.1.2 Level Channels Channels 4, 5, and 6 use uncompensated boron-lined ion chambers as the neutron sensing elements. The positive d.c. current output of each channel is fed directly to an associated scram amplifier with the magnitude of the output current indicated on an edgewise meter on the front of the amplifier chassis. Each high flux trip is set to provide a reactor scram at a detector output for that channel that corresponds to a reactor power of 6.6 megawatts.

7.4.1.3 Natural Convection Operation There are two low-range amplifiers for use when the reactor is to be operated in the natural convection mode or when certain procedures such as refuelings or blade absorber changes are performed that require work in the core tank. The low-range amplifiers allow the primary system pressure scrams on MP-6 and MP-6A to be bypassed with key switches. These amplifiers are more sensitive than the high range amplifiers because their entire range of operation is only one-twentieth that of the full-range amplifiers.

7.4.1.4 Scram Amplifier Operation Separate scram amplifiers associated with each of the reactor period and level monitoring channels provide a scram capability for the nuclear safety system in the event of a short reactor period or a high neutron flux level. In the case of the period-monitoring channels, a derived positive d.c. signal that is proportional to inverse period is fed to the scram amplifier.

SAR

Description:

Existing System Page 4 of 4 In the case of the flux level channels, the positive d.c. chamber output current is fed directly to the scram amplifier.

The principle of operation of the scram amplifiers is that the positive d.c. input current is compared with a negative d.c. reference current with both the input signal and the reference current being indicated on edgewise meters on the front panel of the amplifier. The differential current produced provides a bias to control the gating operation of a field effect transistor (FET). The bias signal is positive (channel input less then reference current scram trip) during normal operation, and the FET will remain on, allowing a small-amplitude, high-frequency a.c. source signal to pass to an amplification and rectifying circuit where it is changed into a d.c. current to energize the shim blade magnets.

Each scram amplifier directly controls the power supply to its corresponding shim blade magnet (channel 1 supplies shim blade 1, etc.) and to two separate scram relays. The amount of current supplied to each magnet is controlled by a potentiometer and is displayed on an edgewise meter mounted on the face of the corresponding scram amplifier.

When the positive d.c. input zero thereby shutting the FET off. This stops the flow of high frequency a.c. to the d.c. rectifier network. This in turn cuts off d.c. current to the corresponding magnet, drops the associated shim blade, and de-energizes the two downstream d.c. powered scram relays. One relay cuts off all power to the paired magnet power supply (blade No. 4 for channel 1, etc.), and drops that shim blade, while the other relay opens the withdraw penmit circuit thereby dropping the remaining shim blades. As a secondary action, when the withdraw permit circuit opens, the rundown relays de-energize and drop out. This causes all six shim blade drives and the regulating rod drive to be driven to their full-in positions.