Modernization Projects of NPP Instrumentation and Control Systems Related to Power Uprates and Licence Renewals Project

1. 1 Modernization Projects of NPP Instrumentation and Control Systems Related to Power Uprates and Licence Renewals Project Licensing of I&C Modifications Matjaž Podjavoršek Slovenian Nuclear Safety Administration

2. 2

3. 3 Five Divisions, 47 employees Division of Nuclear Safety, Inspection, Division of Radiation Safety and Materials, Division of Analysis and Consulting, Office of International Cooperation Functions inspection and licensing processes in the area of radiation and nuclear safety, development of regulatory infrastructure, review and assessment, analyses of operational events and experience, preparation of reports on nuclear safety… First priority supervision over nuclear safety at the Krško NPP SLOVENIAN NUCLEAR SAFETY ADMINISTRATION

4. 4 REVIEW AND ASSESSMENT Review of design modifications Review and assessment of new plants documents Environmental Qualification Programme (cover also I&C) Ageing Management Programme Maintenance Rule Programme etc. Findings discussed with plant managers, most of findings taken into account by plant's specialists New Slovenian regulations will include additional requirements on I&C, environmental qualification, maintenance, testing…

5. 5 SNSA staff does not perform safety analysis lack of manpower and tools for issues that might have impact on safety SNSA issues project bidding results of project are included into SNSA approach to plant modification as equivalent document to plant modification package, results are forward to plant upon request. Utility is responsible for safety it decides who will perform the safety analysis it decides who will review the safety analysis it finances those experts SLOVENIAN NUCLEAR SAFETY ADMINISTRATION

6. 6 REGULATORY (I&C) CONSIDERATIONS Design requirements/Specifications Inspectability Testability Documentation requirements Change process requirements Separation of diagnostic and core functions

7. 7 GOALS OF I&C INSPECTION Identify unauthorized or unintentional modifications (maintenance personnel, un-qualified personnel) Identify configuration management issues (inadequate evaluations for modifications..) Identify the addition of new programmable digital equipment Identify new IT security issues (new external connections to site computer systems or system interconnections) Identify Test performance non-conformances (verify procedure compliance) Identify that test procedures address the current configuration Identify the adequacy of test procedures (specialist & inspector) Evaluate corrective actions for test failures Maintain awareness of plant trends, Identify system errors through the review of system logs/local indicators Verify equipment environmental conditions remain as designed (temp, humidity, EMF)

8. 8 WHAT TO INSPECT? Surveillance tests Inspection of maintenance work orders Inspection of engineering design change packages Inspection of procurement documents/receipt process/component qualification process General plant awareness – general walkdowns (identification of new equipment, environmental changes, changes in IT systems…) Interactions with plant staff (system engineers, operations, maintenance) Inspect plant process for general network control (security) and modifications Review system logs, reports, indicator light status Review problem identification reports and corrective actions

9. 9 INSPECTION SKILLS Basic knowledge of design and operation Knowledge of software lifecycle Basic knowledge of digital system operations and sensitivities Ability to understand maintenance and vendor site activities Understanding of QA documentation Identification of I&C equipment (field programmable) Knowledge of Indicators of unintended or unauthorized modifications Site work order process Site purchasing process Security devices (intrusion detection systems) Laptops (awareness of possible changes to configurations) Physical changes in plant Configuration identification document Ability to validate electronic document integrity (digital signatures…) Knowledge of system performance indicators Logs History reports Indicating lights Site problem identification systems Knowledge of Inspection Tools Specialized software tools used by the utility Basic circuit test equipment

10. 10 Act on Protecting against Ionizing Radiation and Nuclear Safety, 2002 Modifications which affect or could indirectly affect the content of safety report: 1. cat.: modifications that shall be only notified to the regulatory body submission of information at latest six months after the work done 2. cat.: modifications that intention of their implementation must be reported to the regulatory body the plant may commence the implementation after the regulatory body confirm that shall not be necessary to obtain permit for modification 3. cat.: modifications of significance for radiation or nuclear safety of which a permit from the regulatory body must be obtained SLOVENIAN LEGISLATION - MODIFICATIONS

11. 11 Act requires preparation of new regulation for modifications which shall include: methodology of modification evaluation, detailed criteria for classification of modifications into categories requirements for application and reporting Old regulation on the condition for sitting, construction … (E1): positive experts opinion about project modification shall be submitted to the application for modification, expert shall not be engaged to neither supervising the production process and not proposing this modification Old regulation on the compilation and contents of the safety report … (E2): application shall contain analyse of the influences of proposed modification on: ingoing data all other parts of the safety report SLOVENIAN LEGISLATION - MODIFICATIONS

12. 12 SLOVENIAN LEGISLATION - MODIFICATIONS Draft issue of new regulation for modifications includes: detailed criteria for classification of modifications into categories based on US 10 CFR 50.59 requirements for application: application for 3. category of modification shall contain: cause, description, influence on operation and conformance with design basis, legislation and standards, list of equipment effected, safety evaluation screening and safety evaluation, possible critical states, effected by safety function, deterministic safety analysis, supplementary documentation that support modification, experts opinion. requirements for reporting: safety report shall be at least 6 months after outage or every 2 years updated

13. 13 SLOVENIAN LEGISLATION - MODIFICATIONS Draft issue of new regulation for modifications includes (cont.): reporting for 2. and 3. category of modification, when they are supported by PSA: summary of calculated contributions to risk, including intermediate results and their justifications, accidental consequences of events with special emphasis to new prevailing risk factors, analyse of PSA sensitivity and uncertainty, survey of PSA model changes. risk increase due to modification is not allowable except in special case ? 3. category of modification: risk increase < 5·10-7 for CDF, risk increase < 1·10-8 for LERF. All WENRA requirements regarding modifications will be included in the new regulation

14. 14 New Regulation on Authorized expert on Ionizing Radiation and Nuclear Safety, 2006: old authorization for experts became out of force in December 2006 new authorization shall be renewed at least every 5 years SNSA is in position to dispossess authorization in compliance with the conditions of the Act include: setting up the commission for checking up experts (individual or legal person) applications compliance with the legal requirements, methodology for acquisition of authorization, experts annual reporting to the SNSA SLOVENIAN LEGISLATION - MODIFICATIONS

15. 15 SLOVENIAN (I&C) LEGISLATION Some WENRA requirements on I&C systems are already included in current Slovenian nuclear legislation New regulation will be consistent with all WENRA requirements on I&C systems Most of the WENRA requirements are already implemented in the Krško NPP

16. 16 

17. 17 Major NPP Krško I&C systems modifications implemented since 1983 ATWS Mitigation Safeguard Actuation Circuitry (AMSAC) Inadequate Core Cooling Monitoring System (ICCMS) Process Information System (PIS) Annunciator System Off-line data acquisition of chemical analysis data (prim & sec. sampling) - Chemnet RCP and TU Vibration monitoring Core Monitoring and Operations Support System, BEACON-TSM System Meteorological Monitoring System Seismic Instrumentation

18. 18 SG Blowdown Control (digital discrete controllers and digital indicators) Heater Drain Control, PLC Condensate Polishing, PLC Water Treatment, PLC Switchyard Control & Monitoring (ABB Micro SCADA - although it has remote control capabilities in the MCR it is used for switchyard monitoring only) Emergency Response Data System (ERDS) FP- Fire protection (Detection) system Major NPP Krško I&C systems modifications implemented since 1983, cont

19. 19 PROCESS INFORMATION SYSTEM (PIS) The Process Information System (PIS) was installed in NEK in 1992 as part of the post TMI requirements The main purpose of the PIS was to monitor critical functions (Critical Function Monitoring System - CFMS) CFMS was designed to meet SPDS (Safety Parameter Display System) requirements of NUREG-0696 (Functional Criteria For Emergency Response Facilities), NUREG-0737 (Clarification of TMI Action Plan Requirements) Item I.D.2, and NUREG-0737 Supplement 1 Major features of the CFMS include: A Critical Safety Function Monitor which defines conditions to assess the status of six critical safety functions (criticality, core cooling, heat sink, RCS integrity, containment and RCS inventory), Engineering Safety Features equipment monitoring Plant process and area radiation monitoring, and Meteorological conditions monitoring

20. 20 PROCESS INFORMATION SYSTEM (PIS) Other functions of the PIS are: Insufficient Core Cooling Monitoring System (ICCMS) Post-trip review data acquisition Nuclear process calculations Primary to secondary leakage calculations Calorimetric calculations QPTR evaluations PIS is a non-safety related system used to provide supplementary information to the operator and to inform him of off-normal conditions Data is collected by the redundant data acquisition equipment and transmitted to a fully redundant distributed computer system PIS data is also obtained from other process computers through separate serial or fast Ethernet communication links

21. 21 PROCESS INFORMATION SYSTEM (PIS) Last upgrade of PIS system (May 2006) included: Wax replaced with Alpha technology The newest ABB PMS platform New data connections (MicroScada, Beacon, VibMon, CK-CPS) Upgraded application software – inclusion of ARP procedures GPS time synchronization The effects of the upgrade were: Improvement of overall PIS performance and availability during transients Expanding the PIS capability to receive and send process parameters to different process computers Easier and less expensive maintenance PIS can now also be used for issuing commands to other non-safety digital control systems Issues during licensing: Effects on safety systems (control room ventilation) Expansion of PIS functions – to control other systems

22. 22 ANNUNCIATOR SYSTEM REPLACEMENT Former Annunciator System (Betalarm1000) gathered a switching contact and controlled the operation of a lampbox to turn on and off a dedicated lamp window was installed 25 years ago and it was becoming increasingly more difficult to provide technical support and replacement parts New Annunciator System (SER4100 & BL1500) use of flagship sequential event recorder to record switching contact which are time stamped and processed to a number of outputs (annunciators, visual display units, printers and computer for data archiving and post analysis) the BL1500 has been designed to have the identical form factors as the lampboxes supplied 25 years ago with the BL1000. therefore the operators were presented with an identical control room as before the installation

23. 23 ANNUNCIATOR SYSTEM REPLACEMENT Advantages of the new system: Event recording Post event analysis Redundancy Expandability Re-configuration flexibility Advanced Alarm Filtering capabilities Availability of spares

24. 24 ANNUNCIATOR SYSTEM REPLACEMENT proven design (verified in NPP and large industrial applications full redundancy concept, on-line diagnostics, functional testing and status reporting quality equipment and cable applicable standards, design methods, measures and materials for assuring reliable and safe operation of the system in designed conditions mechanical protection of exposed signal & PWR cables seismic qualification (alarm system racks, ALB boxes & frames) (per original system specification for seismic load of 3g horizontal/ 2g vertical) cable insulation: fire retardant; LO smoke; No Chlorine ((PWR, Control & Signal cables) paint of alarm system racks: fire retardant

25. 25 ANNUNCIATOR SYSTEM REPLACEMENT ITS impacts (Important To Safety) -1/2 Possible Direct ITS- effect: no direct influence to any SR equipment! Possible Indirect ITS-effects or influences: ITS 1- Electrical SR AC PWR Supply Overload / Shorted from NSR source: Highly improbable redundant PWR Supplies for new Alarm System (as NSR system) will be properly electrically separated from Safety Related AC PWR Sources additional load is within acceptable capability of the source. ITS 2 – Fire Hazard: Possibility for fire (induced by new equipment): Highly improbable LO energy (electronic) alarm system consumers, fire retardant, LO smoke, No Chlorine cables used electrical cable overload protection (fuses) fire protection measures: fire detectors (for early warning), fire retardant paint for system racks

26. 26 ANNUNCIATOR SYSTEM REPLACEMENT ITS 3 – Mechanical: Possible mechanical damage of SR equipment around (following a seismic event): highly improbable seismic design & fabrication of alarm system racks and standalone boxes ITS 4 – Environmental: Possible system unavailability due to: surrounding process, environmental and fire effects: highly improbable equipment is located in non-hazard area ( MCB and Cable Spread Room) no high energy equipment ( no potential sources of: fire hazard, missiles, pipe failure) cables are limited to control and I&C functions (and their PWR supply) LO energy PWR cables used - installed in enclosed raceways administrative control of activities in these areas IP54 protection class of the racks

27. 27 ANNUNCIATOR SYSTEM REPLACEMENT Open issue during licensing: approval of software SNSA has taken into consideration: system standards list NPP reference list Post-performance problem inoperability of power supplier new configuration without power supply redundancy

28. 28 Conclusions During the 20 years of commercial operation more than 500 modifications (and a lot of this modifications are related with I&C system) have been implemented in the NPP Krško The next important modifications will be the DEH (Digital Electro Hydraulic) system for the control and supervision of the TG (Turbine-Generator) set (scheduled for outage 2009) All of these modifications are performed on the non-safety related I&C system New regulations will be in compliance with the WENRA requirements

29. 29 THANK YOU!