TMI-09-100, Supplement to Technical Specification Change Request (Tscr) No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods

Supplement to Technical Specification Change Request (Tscr) No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods

ML092400175
Person / Time
Site:	Three Mile Island
Issue date:	08/21/2009
From:	Cowan P Exelon Generation Co, Exelon Nuclear
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TMI-09-100
Download: ML092400175 (7)

Text

Exelon Nuclear www.exeloncorp.com Exelkn@

200 Exelon Way Nuclear Kennett Square, PA 19348 10 CFR 50.90 TMI-09-100 August 21, 2009 U.S. Nuclear Regulatory Commission Attn: Document Control Desk 11555 Rockville Pike Rockville, MD 20852 Three Mile Island Nuclear Station, Unit 1 Facility Operating License No. DPR-50 NRC Docket No. 50-289

Subject:

Three Mile Island Unit 1 - Supplement to Technical Specification Change Request (TSCR) No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods

References:

(1) Letter from P. B. Cowan (AmerGen Energy Company, LLC) to U.S. Nuclear Regulatory Commission, "Three Mile Island Nuclear Station, Unit 1, "Technical Specification Change Request No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods," dated September 29, 2008 (2) Letter from P. Bamford (U.S. Nuclear Regulatory Commission) to C. Pardee (Exelon Generation Company, LLC), "Three Mile Island Nuclear Station, Unit 1 - Request for Additional Information Regarding Control Rod Drive Control System Replacement License Amendment (TAC NO. MD9762),"

dated April 6, 2009 (3) Letter from P. B. Cowan (Exelon Generation Company, LLC) to U.S. Nuclear Regulatory Commission, "Three Mile Island Unit 1 Response to Request for Additional Information Related to Technical Specification Change Request No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods," dated May 6, 2009 (4) Letter from P. B. Cowan (Exelon Generation Company, LLC) to U.S. Nuclear Regulatory Commission, "Three Mile Island Unit 1 - Supplement to Technical Specification Change Request (TSCR) No. 342: Control Rod Drive Control System Upgrade and Elimination of the Axial Power Shaping Rods," dated June 23, 2009 (5) Letter from P. Bamford (U.S. Nuclear Regulatory Commission) to C. Pardee (Exelon Generation Company, LLC), "Three Mile Island Nuclear Station, Unit 1 - Request for Additional Information Regarding Control Rod Drive Control System Replacement License Amendment (TAC NO. MD9762),"

dated August 11, 2009 Ac

U.S. Nuclear Regulatory Commission August 21, 2009 Page 2 By letter dated September 29, 2008 (Reference 1), AmerGen Energy Company, LLC (now Exelon Generation Company, LLC (Exelon)) requested a change to the Technical Specifications to accommodate the proposed changes resulting from the Digital Control Rod Drive Control System (DCRDCS) Upgrade Project and the elimination of the Axial Power Shaping Rods.

References 2 - 4 involved additional information requested by the NRC associated with the proposed change.

Subsequently, the NRC determined that additional information is needed to complete its review (Reference 5).

Exelon's response to the NRC questions in Reference 5 is provided in Attachment 1 to this letter. Attachment 2 contains a copy of the Nuclear Logistics Incorporated (NLI) dedication program document requested for the Reactor Trip Breakers.

Exelon has determined that the information provided in this response does not change the proposed Technical Specifications marked-up pages (Reference 1, Attachment 2) and does not impact the conclusions of the No Significant Hazards Consideration as stated in Reference 1.

There are no regulatory commitments contained in this letter.

A copy of this letter and its attachments are being provided to the designated State official and the chief executives of the township and county in which the facility is located.

Should you have any questions concerning this letter, please contact Frank J. Mascitelli at (610) 765-5512.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 2 1 st day of August 2009.

Respectfully, Pamela B. Cowan Director - Licensing & Regulatory Affairs Exelon Generation Company, LLC Attachments: 1) Response to Request for Additional Information Regarding Control Rod Drive Control System Replacement License Amendment (TAC NO. MD9762),

dated August 11, 2009

2) NLI Report VVR-042181-1, Revision 8 Verification and Validation Report for Square D Masterpact Circuit Breaker (Including the Micrologic Trip Unit) cc: S. J. Collins, Administrator, USNRC Region I D. M. Kern, USNRC Senior Resident Inspector, TMI Unit 1 P. J. Bamford, USNRC Project Manager, TMI Unit 1 D. Allard, Director, Bureau of Radiation Protection-PA Department of Environmental Resources Chairman, Board of County Commissioners of Dauphin County Chairman, Board of Supervisors of Londonderry Township

Attachment 1 Response to Request for Additional Information Regarding Control Rod Drive Control System Replacement License Amendment (TAC NO. MD9762),

dated August 11, 2009

Page 1 of 4 Attachment 1 The following are the questions received in a letter from P. Bamford (U.S. Nuclear Regulatory Commission) to C. Pardee (Exelon Generation Company, LLC), "Three Mile Island Nuclear Station, Unit 1 - Request for Additional Information Regarding Control Rod Drive Control System Replacement License Amendment (TAC NO. MD9762),"

dated August 11, 2009, followed by the corresponding Exelon response to each question.

In order for the NRC staff to complete its review of the LAR, a response to the following request for additional information concerning the microcontrollers is requested.

Question 1:

The licensee has stated that the Square D MasterPact NT RTBs contain a firmware microcontroller in the undervoltage and shunt trip devices. What is the full model number of the MasterPact NT breakers that are being used?

Response

The Reactor Trip Breaker (RTB) model number is Schneider/Square D Masterpact NT 08 NA.

Question 2:

Please describe the operating experience for this model of Square D MasterPact NT breakers in safety related applications. Include any known instances of component or sub-component failure that impacted, or had the potential to impact, the ability of the breaker to perform its safety related function. Also, please provide any available reliability data.

Response

Schneider/Square D Masterpact Model NT and NW circuit breakers utilize a microcontroller in the undervoltage (UV) device, the shunt trip device, and the close coil.

Nuclear Logistics Incorporated (NLI) has provided approximately 240 safety related breakers and approximately 210 non-safety related Schneider/Square D Masterpact breakers (series NW and NT) that contain these coils. There have been no coil hardware or firmware failures reported to NLI.

The NRC web site contains a 10 CFR Part 21 Report on Potentially Defective Micrologic Trip Units (Event Number: 42168). There is other operating experience (OE) on the Micrologic trip units on Schneider/Square D breakers. The TMI RTBs do not contain Micrologic overcurrent trip units; therefore, that OE on Micrologic trip units does not apply to the TMI application.

Commercial Operating experience: There have been no revisions to either the code or the hardware on the microcontrollers since the production release in 2002. Schneider has been shipping the same version since 2002. To date, none have been recalled. No firmware failures have been identified. Approximately 100,000 devices (UV, shunt trip

Page 2 of 4 Attachment 1 and close coils) containing microcontrollers have been sold worldwide in the past two years.

Search of the NRC web site and industry databases did not reveal any fail-to-trip events for Masterpact NT breakers.

Reliability data can be found in Attachment 2, VVR-042181-1 Section 5.

Question 3:

Provide the common cause software failure analysis and, if there is the potential for software failure to impact the ability of the breaker to function properly, provide the resulting plant coping (diversity and defense-in-depth) analysis. Include potential impacts to both the undervoltage and shunt trip devices in this discussion.

Response

Software (firmware) common mode failure was evaluated and the determination made that firmware common mode failure does not prevent the safety function. The close coil does not perform a safety function in the TMI application. There is no failure mode for the microcontroller on the UV device, including common cause firmware failure, which would prevent trip of the RTB by keeping the UV device energized on a trip signal from the Reactor Protection System (RPS).

The UV trip device on the Schneider/Square D breaker has a plunger that is spring return to the trip position. The UV device is normally energized and is powered by the 120Vac signal from the RPS. The trip signal removes voltage from the UV device and will cause the breaker to trip. The only source of power to the UV device is, the signal from the RPS. Voltage is removed from the UV device when the RPS trips so there is no firmware failure mode for the microcontroller that could keep the coil energized and prevent the safety function.

Firmware failure could prevent the shunt trip device from tripping the RTB. No firmware failures have been identified during NLI testing. The shunt trip is a backup trip feature and the RTB would still perform its safety related function by action of the UV device.

The effects of firmware failure on the shunt trip device are no different than failure of the coil, loss of power, or blown fuse in the existing design.

Technical Specification Table 4.1-1 item 2 requires periodic independent testing of the shunt trip and undervoltage trip features.

There is no common mode firmware failure that prevents the breaker from performing its safety related function.

Question 4:

Is the software in the breakers fully tested or was the software programmed using a high quality process that meets the requirements for development of safety-related software?

Page 3 of 4 Attachment 1

Response

The software (firmware) for the trip coils was developed under the controls of the Schneider/Square D ISO 9001-2000 quality assurance program. The hardware and firmware are dedicated for safety related applications by NLI under the controls of the NLI Nuclear Quality Assurance Program, which complies with Electric Power Research Institute (EPRI) Topical Report (TR)-106439, "Guideline on Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications." NLI performs dedication / factory acceptance tests on 100% of the supplied breakers.

Question 5:

Is the microcontroller capable of being reprogrammed? How can the program be implemented (i.e., online, offline)?

Response

The microcontroller cannot be reprogrammed in the field. Although the microcontroller chip has programming provisions, the microcontroller is contained in the sealed plastic case of the coils with no communication connections. Access to the microcontroller would involve removing the coil from the RTB and destroying the plastic case of the coil to access the microcontroller.

Question 6:

Is the microcontroller connected or capable of being connected to any other circuit, network, programming device, or other equipment that can have an impact on the programming?

Response

There is no physical access to the microcontroller in the field. As stated above, access to the microcontroller would involve removing the coil from the RTB and destroying the plastic case of the coil to access the microcontroller. There is no digital communications between the coils and other devices in the RTB. The RTB does not include the optional communication module that is available. Coils configured for external communication is not a configuration that is qualified by NLI for nuclear plant applications.

Question 7:

Does the microcontroller include a communications interface, such as a Modbus? If so, is it, or will it, be used?

Response

There is no communication interface on the RTB. The microcontroller chip contains a

Page 4 of 4 Attachment 1 serial communications port; however, the port is inside the sealed case of the UV device and shunt trip device and is inaccessible. There is an optional communication version of the shunt trip device but it is not utilized in the RTB. The RTBs do not contain the optional communication module that would provide the communication interface.

Question 8:

Please describe the data communication interfaces between the RTBs and any other devices and address their compliance with Regulatory Guide 1.152 and Nuclear Energy Institute (NEI) 04-04, "Cyber Security Program for Power Reactors."

Response

There are no digital communications between devices on the RTB or between the RTBs and any other device. The RTBs do not contain the optional communication module.

The shunt trip and UV coils are operated using external electrical contacts. Absence of any communication capability complies with Regulatory Guide 1.152, "Criteria for Digital Computers in Safety Systems of Nuclear Power Plants," and NEI 04-04.

Question 9:

Please provide the commercial grade dedication process documentation for the RTBs.

Also, please verify that the commercial grade dedication process used complies with Electric Power Research Institute (EPRI) Topical Report (TR)-106439, "Guideline on Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications" which was accepted by the NRC by letter and safety evaluation dated July 17, 1997 (ADAMS Accession Nos. 9810150221 and 9707240239).

Response

The commercial grade dedication for the RTB including UV and shunt trip device was performed by NLI. The NLI commercial grade dedication process is in accordance with EPRI TR-106439. The NLI Verification and Validation Report VVR-042181-1 used to dedicate the RTB is included as Attachment 2.