ML14015A315
| ML14015A315 | |
| Person / Time | |
|---|---|
| Site: | Texas A&M University |
| Issue date: | 12/17/2013 |
| From: | Hassan Y Texas A&M Univ |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| Download: ML14015A315 (7) | |
Text
DWIGHT LOOK COLLEGE OF ENGINEERING ATM I TEXAS A&M U N I V E R S I T Y Department of Nuclear Engineering December 17, 2013 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Docket No.50-059
SUBJECT:
RESPONSE TO "TEXAS A&M UNIVERSITY AEROJET GENERAL NUCLEONICS MODEL 201-MODIFIED REACTOR CONFIRMATORY ACTION LETTER REGARDING SHUTDOWN RELATED TO REACTOR SAFETY SYSTEM."
In response to the letter dated July 30, 2013, Texas A&M University (TAMU) will address the concerns of the Nuclear Regulatory Commission (NRC) regarding the reactor safety system. Operations of the AGN reactor have ceased as of June 25, 2013. In the interim, several paths forward have been investigated to determine the best way to proceed in order to alleviate the safety concerns of the NRC. The facility will divorce the installed digital safety system inputs from the reactor safety system and install new analog safety system inputs for the affected automatic shutdowns. The inputs that will be replaced with hardwired analog inputs are: High Power Nuclear Safety #2, High Power Nuclear Safety #3, Low Power Nuclear Safety #2, Low Power Nuclear Safety #3, and Reactor Period. Additionally, rod position indication will be incorporated into the "Channel Display Panel." Attached is a description and analysis of the proposed changes.
I look forward to resolving this issue in order to return our reactor to its intended function as a training tool for our students. If you need additional information, please feel free to contact me via phone at (979) 845-4161 or by email at y-hassan@tamu.edu.
I declare under penalty of perjury that the foregoing is true and correct. Executed on December 17, 2013.
Best regards, Yassn i"as'san, Ph.D; Professor and Department Head, Department of Nuclear Engineering Sallie and Don Davis '61 Professor of Engineerhlg Professor, Departmnent of Mechanical Engineering encl.
337 Zachry Engineering Center 3133 TAMU College Station, TX 77843-3.133 p
Tel. 979.845.4161 Fax. 979.845.6443 nuclear.tamu.edu
Introduction Upgrade of the Texas A&M AGN reactor control console incorporated a custom digital instrumentation and control (DI&C) system. The system includes a computer program providing indication of rod position, power level, and a graphical representation of power over time. This system currently provides input to the reactor protection system via high/low power scram signal for log and linear channels, as well as calculation of the reactor period and its associated scram signal. Inclusion of this system without any complimentary analog inputs introduces a single point of vulnerability that is inconsistent with the existing design basis documentation.
Description AGN facility Modification Authorization (MA) #2008-1 implemented the reactor console instrumentation and electronics upgrade. This modification included the replacement of portions of the previous analog instrumentation and control system with off-the-shelf digital components designed to perform comparable functions while increasing the overall reliability of the system. Also included in the upgrade was the introduction of a computer serving as an operator aid to monitor reactor power and rod position.
Additionally, this computer provides input to the reactor safety system by providing an input signal to the scram circuit for log and linear high/low power and calculation of the reactor period. These functions are carried out by a locally coded Visual Basic program. This MA failed to formally address the introduction of a common cause failure (CCF) mode resulting from the introduction of digital instrumentation into the safety system. During the design and build phase, a watchdog circuit was incorporated into the computer program to protect against the CCF mode, although no provisions were made for this automatic shutdown in the Technical Specifications. Additionally, the safety significance of introducing the CCF mode was not analyzed.
To correct this oversight, the facility will return the log and linear instrument channels to an analog system providing input to the reactor protection system for all associated automatic protection shutdowns.
Scram signals generated from the analog system will include High Power Nuclear Safety #2, High Power Nuclear Safety #3, Low Power Nuclear Safety #2, Low Power Nuclear Safety #3, and Reactor Period.
These scrams will be hardwired to the reactor protection system. The AGN computer will continue to provide users with a real-time indication of reactor power and rod position indication as a secondary indication but will have no input to the reactor protection system.
Installation of hardwired rod position indication will also be included to ensure rod position can be verified in the case of an automatic shutdown, independent of the computer display. Rod status will be indicated as Rod Down, Carriage Down, Rod Engaged, and Rod/Carriage Up. Indicating lights will be integrated into existing analog circuits prior to input to the digital computer system.
The resulting I&C system will include an analog and digital system operating in parallel. The digital portion of the system will provide an operator aid while controlling the reactor with no safety system input. The analog portion of the system will be used to provide indication of reactor power for the log and linear channels as well as perform the period calculation and indication while providing an input into the reactor protection system along with all other previous inputs to the safety system. This will restore the reactor control console to a completely analog reactor safety system. An updated logic diagram is presented in Figure 7.2.1-1.
Channel 2(Log Channel)
The existing digital log channel receives an input signal from its associated neutron detector. This signal is processed by a Keithley Model 6487 Picoammeter then passed to the AGN computer through a serial
interface via a PCI Data acquisition card. The installed AGN Visual Basic program calculates log power level and reactor period. Log power level is displayed and graphed on the computer display while the period indication is sent to a meter face. These values are compared to the safety system set point(s) every 100 milliseconds. If these values meet or exceed a safety set point, a scram signal is generated and sent to the scram circuit and alarm panel, initiating a protective action resulting in power interruption to the electro-magnets and the corresponding alarm light illumination.
The proposed analog circuit is outlined in the functional block diagram presented in Figure 1.1. The portion of the figure enclosed by the dashed line indicates the proposed analog portions of the log channel including appropriate inputs to the reactor safety system. The portions outside the dashed box represent existing equipment. The log channel ion chamber output signal is received by the buffer circuit. This buffer circuit will utilize an op-amp buffer to replicate the input signal and provide independent outputs to the analog and digital portions of the log channel. The buffer circuit will also act as a current follower to ensure the digital and analog portions of the system are isolated from one another. The analog output is sent to the pre-amp where the incoming signal is amplified before it is passed to the low pass filter. The low pass filter removes high frequency noise, including comnnion 60 Hz interference. This filtered signal is passed to the averaging approximate filter to create a moving average approximation. The following equation will be used to implement this filter:
Ha(iw) = ao + al(iw) + a (iw) 2 bo + bl(jw) + b 2 (jw) 22 + b 3 ('w) 3 The log amplifier enables log representation of the input signal by converting the output signal through the following method:
( lin Vout = Log This signal will then be used to calculate the reactor period, provide input to the reactor protection system, and display reactor power level. The reactor period will by calculated by using a derivative configuration and use the following equation:
( dVin Vout = -RC The output of the derivative is 1800 out of phase; therefore, an analog inverter has been included in the configuration. The output signal of the log amplifier will also be sent to a high and low power comparator to determine if a safety shutdown should occur given the input. If this value meets or exceeds a safety set point, a scram signal is generated and sent to the scram circuit and alarm panel, initiating a protective action resulting in power interruption to the electro-magnets and the corresponding alarm light illumination. The log amplifier also drives indication of reactor power while the derivative function provides input to reactor period indication.
The new hybrid log channel will be composed of a digital interface used solely as an operator aid and will provide no contribution to the reactor protection system. The other portion of the log channel will be an analog circuit providing input to the reactor protection system in accordance with Appendix A to License No. R-23, section 3.2.
Ion Chamber en* Pre Amp Low Pass I Filter I-- -- - --- --
l [ T ]* .. ] Averaging I Buffer Circuit Approximate Filter E
I Picoammeter I Log Amp 1 High Power Trip Setting
, I
- . ...... .[ B uffer - . . ... ... ..
Coniguration Low Power Comparator Comparator Trip Setting or]
Buffer Period Trip Setting SCRAM SCRAM Period eLJe ý]rtrH CRMI PwrMeter Figure 1.1: Channel 2 Functional Block Diagram Channel 3(Linear Channel)
The existing digital linear channel receives an input signal from its associated neutron detector. This signal is processed by a Keithley Model 6487 Picoamnmeter then passed to the AGN computer through a serial interface via a PCI Data acquisition card. The installed AGN Visual Basic program calculates linear power level which is displayed and graphed on the computer display. This value is compared to the safety system set point(s) every 100 inilliseconds. If this value meets or exceeds a safety set point, a scram signal is generated and sent to the scram circuit and alarm panel, initiating a protective action resulting in power interruption to the electro-magnets and the corresponding alann light illumination.
r - - - - - - - - --- -
I Pre Amp nFilte
" Low Pass I I'
Filter I
JI L.....................
Figure 1.2: Channel 3 Functional Block Diagram The proposed analog circuit is outlined in the functional block diagram presented in Figure 1.2. The portion of the figure enclosed by the dashed box indicates the proposed analog portions of the linear channel including appropriate inputs to the reactor safety system. The portions outside the dashed box represent existing equipment. The linear channel ion chamber output signal is received by the buffer circuit. This buffer circuit will utilize an op-amp buffer to replicate the input signal and provide independent outputs to the analog and digital portions of the linear channel. The buffer circuit will also act as a current follower to ensure the digital and analog portions of the system are isolated from one another. The analog output is sent to the pre-amp where the incoming signal is amplified before it is passed to the low pass filter. The low pass filter removes high frequency noise, including common 60 Hz interference. The filtered signal is amplified to increase the gain for further processing. The output signal of the amplifier is sent to a high and low power comparator to determine if a safety shutdown should occur given the input. If this value meets or exceeds a safety set point, a scram signal is generated and sent to the scram circuit and alarm panel, initiating a protective action resulting in power interruption to the electro-magnets and the corresponding alarm light illumination. The amplified signal is also passed to
the linear power meter and a scale indicator which provide visual indication of power level and decade of power.
The new hybrid linear channel will be composed of a digital interface used solely as an operator aid and provides no contribution to the reactor protection system. The other portion of the linear channel will be an analog circuit providing input to the reactor protection system in accordance with Appendix A to License No. R-23, section 3.2.
Safety Analysis Analog hardwired scram inputs will replace the current digital inputs for the following reactor protection functions: low power nuclear safety #2, high power nuclear safety #2, reactor period, low power nuclear safety #3, and high power nuclear safety #3. Installation of the analog hardwired scrams coupled with divorcing the AGN computer from any reactor protection function will remove the concern of a single point of vulnerability due to the CCF mode. The installation of these hardwired scrams will ensure the reactor protection system conforns to the previously reviewed safety analysis.
Restoration of the reactor protection system to include hardwired analog scram functions does not represent an increase in the likelihood of the occurrence of the Maximum Hypothetical Accident (MHA).
The hardwired analog scrams are designed to initiate a protective action when the applicable parameter is outside the range specified in Table 3.1 of Appendix A to License No. R-23. Detection of any value outside the allowable range will generate a scram signal securing power to Safety Rod #1, Safety Rod #2, and Coarse Control Rod magnet(s). Upon loss of magnet power, the three scram rods will drop out of the core, shutting down the reactor. Continuity of the fission product barrier and protection against fuel damage will continue to be based on the ability of the core thernmal fuse to shut down the reactor in the event of a large reactivity addition as outlined in the AGN 201 Preliminary Design Study and the Hazards Evaluation of the AGN 201 Nuclear Reactor (Docket No. F-32).
In the event of component failure during reactor operations, a false high or low signal will be sent to the respective comparator and a scram signal will be generated and sent to the scram circuit. This signal will interrupt magnet power causing an automatic reactor shutdown. This safety function will be identical to the previously reviewed safety analysis.
Testing and verification of circuit design will be completed using LT SPICE and reviewed by an independent consultant upon completion of the design. Once the analog system is installed and tested, the computer input(s) to the reactor protection system will be removed to ensure that scram signals are not received from the computer system.
Relative rod position will continue to be monitored through the Visual Basic user interface. In the event rod position indication is lost or unresponsive, the operator will be required to perform a manual reactor shutdown. Installation of hardwired rod position indication will ensure the operator can verify all rods have been removed from the core.
INDICATOR PANEL MANUAL ALARM PANEL COMPUTER z
0 0
Linear Power 1.o0Power Rod Engaged Up/DownfEngaged Rod Up Rod Down Up!Dowil~ngaged Rod Position