Te 1402 Web
Te 1402 Web
Te 1402 Web
, a value of fading is
well-known [6]);
determination of design accident conditions.
After the analysis of the findings, the route for carrying out of non-destructive diagnostics is
set and samples of cables to be removed are selected for running of on-going qualification.
3.1.2. Monitoring of cable line conditions in operation
Now the weight of works on cable ageing management falls on monitoring of their
condition in service. In the future, this "weight" of works will be shifted to qualification tests
of new cable types on the new units, where cables are more resistant to degradation effects,
and with putting into action the qualification tests with a smaller degree of conservatism.
Before carrying out of cable condition monitoring on a part of selected representative cables,
the check for integrity of cable lines is performed using:
117
time-domain reflectometry for searching local defects, which resistance is < 1 kOhm,
and for identifying locations of moistening of cable lines, including moistening of
penetration;
bridge methods for searching local defects which resistance may reach 10 Ohm.
The following methods find the most widest use to determine a degree of cable ageing:
local mechanical indenting of polymeric cable jackets (indenter measurements);
taking of insulation and cable jacket microsamples of a few mg for subsequent
investigation of change in their composition and structure by the following
physicochemical methods: differential scanning calorimetry, thermogravimetry, IR -
Fourier analysis;
elongation at break for samples of cables removed from service;
return voltage for power cables with paper-oil insulation (a method of return voltage is
perspective as well for ageing assessment of control cables with different types of
insulation).
3.1.3. Main reasons of cable ageing by the results of condition monitoring
Ageing of cables was caused by simultaneous effects of several degradation factors in the
cable line locations because of:
poor-quality installation of cables resulting in violation of cable jacket and consequent
insulation ageing under exposure to elevated temperature (over 40
), humidity,
radiation (more than 1 kGy/year), and mechanical vibration (the presence of fire
protection covering complicates this situation it is more difficult to detect defects);
local overheating in a route caused by operating equipment, neighboring pipelines, and
in points of the power cable connection to equipment, etc.;
steam leakages of the coolant in cables near to pipeline valves;
existence of locations with an increased level of radiation and temperature, for example,
in the steam generator room;
presence of reactive substances, for example, ingress of oil;
high humidity for cables installed in protective metal pipes;
overfall of heights in route, vibration from operating equipment and elevated ambient
temperature for power cables with paper-oil insulation;
possible effects of a maximal design accident (it can cause failure of a pre-aged cable
with PVC insulation by electrical parameters, thus the mechanical characteristics of
insulation materials may not reach the limiting values).
3.1.4. Recommendations for the further service of cables
The analysis of outcomes of condition monitoring has allowed to make specific proposals on
operation of cable lines of safety-related systems:
monitoring of service conditions (temperature, radiation, humidity, etc.) in hot spots;
118
105
actions for reduction of service hot spots (installation of additional cooling,
installation or restoring of thermal protection against heat sources, correction of possible
steam effect by control of hermetic sealing of junction boxes, etc.);
periodic cable condition monitoring in hot spots (application of modern, non-
destructive, highly sensitive methods of diagnostics);
to limit application of cables with PVC insulation in old power units under possible
maximal design accident event that means step-by-step withdrawal of such cables from
operation in places with service temperature above 40
)
In-Confinement Out-Confinement
40 28,1 64,8
45 16,6 39,3
50 10,0 24,0
55 4,3 14,8
60 2,7 9,2
3.2. Service Life Management of Relay Protection Logics and Automatic Facilities
The most comprehensive inspection of relay protective and automatic facilities (RP&AF), the
main components of which are electromagnetic relays, was conducted in units 3 and 4 of the
Novovoronezh NPP and unit 1 of the Leningrad NPP during works on prolongation of service
life of these power units. The ageing programme in power units, as a rule, includes RP&AF of
safety-related systems. The design stipulates that the transition of RP&AF to the ultimate state
in these systems does not lead to disastrous consequences. The RP&AF maintenance is based
on their actual technical condition, which monitoring is possible during scheduled-preventive
repairs. For RP&AF, the processes of simultaneous ageing and obsolescence are
characteristic.
For RP&AF, the mean operating time between failures is a normalized index of reliability, the
mean restoration time is a normalized index of repairability, and the mean useful life is a
normalized index of durability.
The primary tasks, which are solved under the management of RP&AF service life, are as
follows:
classification by executable functions, type, and service conditions;
visual survey;
accelerated laboratory tests (such possibility is realized only when it is possible to
remove samples from service);
instrumental control;
119
statistical processing of data on defects and failures of both relays and component parts;
assessment of residual service life by estimated and experimental methods;
recommendations to further service.
3.2.1. Condition monitoring of relay protective and automatic facilities in a power unit
At the first stage of work, the analyses of the following things are carried out:
project documentation and specifications,
documentations available from manufacturers of RP&AF and its component parts;
service form and records developed in NPP;
documentation for the engineering maintenance system;
reporting documentation on inspections, trials and investigations of defects, failures and
malfunctions in RP&AF operation.
These measures allow to conduct their classification according to executable functions and
type and to estimate the quality of maintenance and repair beforehand.
At the second stage of work, the visual survey is carried out to detect signs of wear and
ageing, excess of thermal and electrical loads, mechanical and corrosion damages, and also
with the purpose of estimating quality of mounting and dismantling on replacements of the
component parts. Special attention is given to the condition of contact relay units and other
commutative units of RP&AF. Their transient resistances were measured to check if there
were suspicions of oxidation of contacts. Proceeding from external signs of wear and ageing,
recommendations are given to the staff concerning the replacement of some relays.
The visual survey allows to test the correspondence of actual component parts of RP&AF to
the technical documentation. Under external examination of the relays and other components
of RP&AF, the year of manufacturing of these products is necessarily established. The
experience of RP&AF examination has shown that the previous replacements of products of
the same type in old power units were not frequently documented. Therefore, a production
date of the relay may be a unique source of information when estimating the residual life of
RP&AF, operating in a standby mode, as the life is spent mainly when carrying out an
engineered function.
Knowing the periodicity or actual dates of maintenance and control, and a year of the
component service start, it became possible to assess a residual service life of RP&AF at 75 %
of the setting life, as a minimum for all components.
The instrumental control is a final stage of operations in the power unit. The instrumental
control is required for check of the correspondence of operation parameters such as voltages,
currents and operation time to their specifications and also for determination of actual
operation modes of the relays and RP&AF as a whole. For measurement of the above
indicated parameters of the relays it is enough to have a digital oscillograph furnished with a
notebook.
120
107
During the instrumental control, the actual levels of climatic, mechanical and radiation effects
on RP&AF are determined as well. From the instrumental control, recommendations are
given to replacements of those relays whose parameters have overstepped limits of
permissible ones.
3.2.2. Laboratory tests and assessment of residual service life
With extending the service life of RP&AF in units 3 and 4 of the Novovoronezh NPP, an
opportunity offered to conduct as a matter of fact on-going qualification of these devices,
using for this purpose the similar relays that have served over all the campaign in the
temporarily closed down NV NPP units 1 and 2. For testing, the most severe of permissible
operational modes for the given type of a relay were selected. The results of these
conservative trials have shown that the transient resistance of the contact is the most
vulnerable parameter of the relays. Other parameters of the relay (time, current, the operation
voltage) were within permissible limits along the whole testing. The results of change in a
contact resistance of the relay under tests for the commutative wear resistance are given
below in Figure 1.
Figure 1. Results of the relay tests for commutative wear resistance.
The statistical processing of data on defects and failures of the relays and other components of
RP&AF obtained from the analysis of technical documentation and during the technical
examination has allowed developing estimated - experimental methods for the evaluation of
residual service life of electromagnetic relays and RP&AF as a whole from the results of their
service. The most spread defects of relays are the breaking of clockwork drive of the time-
delay relay and breakages or closure of relay coils. The lowest value of gamma-percent
service life 0.95 = 34 years is obtained for EV100 and 200 time-delay relays. For all
remaining examined relays, 0,95 exceeds 50 years. This fact and also that the residual
service life of the examined relays exceeds 75% of the target one have allowed to make a
conclusion about the possibility to extend service life of the examined RP&AF from 9 to 15
years under condition of replacement of all EV100 and 200 time-delay relays before the
expiration of their gamma - percent service life.
3.2.3. Future possibilities and service conditions for electromagnetic relays
The safety maintenance under long term operation of RP&AF is grounded on the following
statements:
121
faultless maintenance;
minimization of ageing and wearing effects;
the technically proven replacement of critical components of RP&AF.
The first two positions are based on the maintenance and repair system and its scientific and
technical support. The latter from the above-enumerated positions is actually defined by the
common strategy of the branch on introduction of advanced designs of element base,
including for RP&AF. At present, the works are being carried out on service life prolongation
of RP&AF, which were designed and manufactured over three decades ago on the basis of an
electromagnetic relay, obviously out-of-date from the point of view of technical advance.
For relays as well as for all products renewed after failure, a normalized reliability index is the
failure rate or gamma-percent mean failure time . According to the available information
of the RAO ES, which combines the non-nuclear producers of electrical energy of the
country, for 2002 a percent of false operations of relays was 0,5% for electromagnetic relays;
4,0% for electronic relays; 0,8% for microprocessor relays.
In terms of failure rate, the reliability of electromagnetic relays exceeds that of electronic ones
and, at least, is on a par with that of microprocessor ones. In terms of additional index for
products of a multiple cyclic operation, i.e. a minimum number of operations during , the
electromagnetic relays are at a disadvantage in relation to electronic and microprocessor ones.
However, as the RP&AF inspection of emergency power supply systems and the own needs
of units 3 and 4 of the NV NPP and unit 1 of the Leningrad NPP has shown, the number of
relay operations for a 30-year service does not exceed 25 % of the prescribed figure.
Therefore, the replacement of electromagnetic relays with relays of a new generation, at least,
does not improve the RP&AF reliability, and the introduction of new relays should be started
in systems which do not concern those important to safety (for example, in systems of the
main circuits).
4. DEVELOPMENT OF SENSORS WITH A POSSIBILITY OF IN-SERVICE
VERIFICATION AND CALIBRATION
One of the major components of ageing management is the creation of equipment, in
particular, sensors for NPP, which can provide calibration and verification without removing
them from service. Thus, the process of calibration can be carried out automatically (self-
calibration) or manually with the help of specially designed devices depending on the specific
type of the sensor. New sensors of such type were created at FSUE Research Institute of
Physical Measurements. Technical solutions, applied in instruments included in navigation
systems and systems of artificial satellites orientation and space stations, where direct
calibration and verification of instruments cannot be conducted, were used.
4.1. Sensors for the System of Industrial Anti-seismic Protection
For the system of industrial anti-seismic protection (SIAP) of the Balakovo NPP, a unit of
seismic sensors BSD 1 have been designed which appearance is presented in Figure 4.1a, and
for NPP "BUSHER", the similar unit SD 4 is being developed. The units of seismic sensors
BSD 1 and SD 4 contain three orthogonally installed seismic receivers, which are static-
dynamic accelerometers, and a processing circuit that implement the functions of weakening
122
109
or amplification of accelerometer output signals, squaring, summing up, taking the square
root, forming of standard output emergency discrete and analog signals.
A characteristic operational property of BSD 1 and SD 4 within SIAP is their "on duty" mode
operation, i.e. they practically do not function prior to the occurrence of an earthquake or
other seismic effects. In such operation mode the SIAP does not know whether the instrument
is operable or not. Besides, as the units are measuring instruments, they should be calibrated
periodically or verified for confirmation of their metrological characteristics. As a rule, the
functional test of the sensors without their removal from objects of control is a rather
complicated engineering task, anticipating the signal feed of the measured parameter at the
input of the sensor, in this case, for example, a seismic effect with normalized parameters that
is obviously unreal.
Figure 4.1a Appearance of a
transmitter BSD 1.
Figure 4.1b The schematic of transmitter
BSD 1 operation.
In the accelerometers used in BSD 1 and SD 4 for improvement of reliability and accuracy,
and also for compensation of the influence of permanent gravitational acceleration, a scheme
of equilibrium conversion was applied (Figure 4.1b). The sensing element of the
accelerometer contains an elastic component (pendulum) 1, capacitive converter of movings 2
and magnetoelectric reversible transducer consisting of permanent magnet 3 and coil 4. The
reversible transducer provides reproduction of a balancing force on the accelerometer
element, recognizing acceleration (inertial mass). The electronic circuit of the accelerometer
consists of a generator (G), amplifier - demodulator (AD), dc-amplifier (DCA), low-pass filter
(LPF), and generator of automatic calibration (AG). Such a structure allows all measuring
section to be verified and calibrated without the removal of the seismic sensor unit from the
object of control and without disconnecting it from the SIAP. The given verification can be
carried out both manually, for example, during incoming control, and automatically within the
SIAP by its command. In sensors SD 4 a circuit of self-diagnostics has been inserted, in
which the calibration is carried out periodically with the seismic sensors of unit SD 4 itself,
without the request of the SIAP.
4.2. Sensor Monitoring System of Tension of Reinforcing Ropes
The protective ferro-concrete shields of reactors are in pre-stressed state that is provided with
the tension of reinforcing ropes disposed inside the walls of the protective shield. As time
goes on, the ropes are stretched and the tension is weakened. Control of a tension value of
ropes is performed with the force sensors NV 005, which is a part of the system designed for
the tension monitoring of reinforcing ropes. Figure 4.2a shows in-service installation of a
sensor. The sensing components NV 005 are under measurement condition all the time, thus
123
experiencing great loads (up to 1200 on) at ambient temperatures of - 45
to 65
. For
these reasons, the deviations of the output signal may arise in the sensor. For 15 years they
can reach a value of 23%.
Figure 4.2 Placement of the force sensor
NV005 on the dome of the
Balakovo NPPs reactor.
Figure 4.2b Scheme of in-service
calibration of the sensor
NV005.
The sensors are located on the dome of the protective shield of the reactor at a height of about
50 m, their weight is 120 kg and to dismount them for calibration under metrological centre
conditions, it is required to remove loads from reinforcing ropes at a considerable labor input.
For the verification of the sensors without their dismounting the original technique using
specially designed reference sensors NV 006 has been developed. The reference sensors are
installed under four supports of a hydraulic jack (see Figure 4.2b), which, stretching a rope,
weakens force affecting the sensor NV 005. The value of weakening measured by the sensor
NV 005 will be equal to the sum of efforts applied to the sensors NV 006. Thus, the sensor
NV 005 is calibrated in service without its dismounting. In this case the use of the NV 006
reference sensors does not require special metrological equipment, such as a hydraulic jack
applied in order to provide tension of the reinforcing ropes.
4.3. Differential Pressure Transmitter for the System of Accident Localization
For the system of localization of emergency processes, the differential pressure transmitter
DMV 001 has been designed. It is shown in Figure 4.3a. The sensor serves for measuring a
rate of drop in pressure in pipelines of circuits I and II of WWER-type reactors. On the one
hand, the differentiator performs its functions only under emergency conditions when the
pressure within it is falling owing to rupture of the pipeline; on the other hand, the coolant
pressure in the pipeline permanently effects on a sensing element of the differentiator
(pressure differentiator Bm 212). The schematic diagram of DMV 001 is shown in
Figure 4.3b.
For diagnostics of the differentiator, a special device a calibrator has been designed, which
generates an electrical signal appropriate to a signal, coming to the input of an electric circuit
of the differentiator from the sensing component (pressure transmitter m 212) with a
particular rate of drop in pressure. When connecting the calibrator to a special diagnostic
input of DMV 001, there is a signal at the output of the latter, which corresponds to the rate of
fall in pressure specified by the calibrator. The value of the signal defines the service
124
111
capability of the electric circuit of DMV 001. The service capability of the transmitter
m 212 and its correspondence to metrological requirements is determined by a value of
static pressure measured by it in the pipeline, which at the moment of the normal operating
mode is known with an adequate accuracy.
Figure 4.3a External appearance
of the transmitter
DMV 001.
Figure 4.3b Schematic diagram of DMV 001: Bm 212 -
pressure unit, SP - stabilizer of power
supply, NA - normalizing amplifier, MCDV
measuring circuit of drop in voltage, LPF
low pass filter, VCC voltage - current
converter.
It should be noted that DMV 001 uses a manual mode of calibration only because a variant of
the built-in calibrator" will require a large increase in the volume of the differentiator and its
price.
The approaches to the design of the transmitters at issue are applicable also to other kinds of
sensors and equipment related to instrumentation in an NPP. The sensors and instruments
constructed on such principles allow to extend the service life of equipment, to improve
operation reliability of different systems of NPPs and, finally, to improve NPP safety as a
whole.
5. DEVELOPMENT AND INTRODUCTION OF NEW METHODS FOR OPERATIVE
DIAGNOSTICS
One of the primary problems that are solved during upgrading of monitoring and management
systems is the introduction of new systems of operative diagnostics (SD) for a reactor
installation and equipment, which fulfill functions missing in design systems. The main
purpose of SOD is the detection of off-design effects on equipment and its off-design state at
an early stage of their occurrence.
The systems of operative diagnostics allow reducing the degree of equipment damage, to
lower probability of initial emergency events and as a result to improve the NPP safety.
Besides, the SOD-based control allows to evaluate and forecast the real operational life of
equipment so that by the beginning of the next audit to know weak spots of equipment, first
of all, subject to repair or replacement, i.e. to conduct scheduled-preventive maintenance
according to real technical condition and not just on due dates. In this sense, the systems of
operative diagnostics are the information support of the periodic control systems.
The developer of the SOD for WWER in the Russian Federation is ZAO DIAPROM. Now
this company is developing and introducing different local systems of diagnostics: a noise
125
diagnostics system (NDS), regime diagnostics system (RDS), dynamic diagnostics system
(DDS), and emergency diagnostics system (EDS). The complex of such systems based on the
common ideology of the reactor operative diagnostics, which interacts with regular
monitoring and control systems of the reactor installation, is capable to provide both
completeness and depth of diagnostics that meets the modern requirements for safe
maintenance of an NPP.
The NDS operates only if a reactor is in stationary state, uses the fluctuating part of a signal,
and due to its sharp response to anomalies it is aimed mainly at the detection of faults at the
earliest stages of their development when they still have not been shown at all in the
deterministic signals of regular detectors.
The NDS has the developed pre-computer electronics (analogue and digital) that processes
rather weak signals in comparison with their constant components. According to methods for
noise diagnostics, the NDS can be subdivided into systems of signature diagnostics and
diagnostic systems on a physical level.
Signature noise diagnostics does not require comprehensive physical interpretation of noise
performances and is based on continuous comparison of the current probability characteristics
with the pre-estimated references.
Another trend, the noise diagnostics on the physical level is based on the analytical
description of noise images or, at least, on the analytical description of dominating sources. It
allows the noise image to be presented in the terms of physical properties, more often not
measured regularly (reactivity coefficients, thermo-hydraulic parameters of the active region
and separate sections of circuits, characteristic frequencies of vibrations of in-housing
components, mode of oscillations of the reactor housing, etc.). Their continuous estimation by
noise channels improves an observability of the object and carries the information not only
about the fact of the fault origin but also about its localization and reasons of the origin.
The RDS and DDS are the systems that analyze signals of regular detectors with the purpose
of assessment of the current technical condition. The RDS functions only under steady
conditions, diagnostics in transient regimes are carried out by another system - DDS, and the
continuity of diagnostics is achieved by the integration of the RDS and DDS.
The RDS is realized on the basis of a logical diagnostic model, taking into account features of
the reactor as an object of diagnostics (availability of the own feedbacks and actions of
automatic controllers). Diagnosing is carried out according to the graphs of faults - time
sequences of falls of diagnostic signs outside the assigned limits. The RDS performs early
diagnostics prior to fall of any signal outside the regular preventive setting. The RDS is
capable of diagnosing a reactor installation with the indistinctly formalized images of faults.
The self-diagnostics of detectors is carried out by function links and balance relations intrinsic
to the given reactor installation.
The RDS is:
a system of functional diagnostics identifying the technical condition of a reactor
installation without specially organized test effects, in regular operation modes of the
reactor, and with the regular detection equipment;
an on-line, real-time, all-mode, independent, continuously operated system, not
requiring control of the diagnosing process on the part of the operator, with automatic
setting of diagnosis;
126
113
a system of early diagnosing;
an adjustable system open for changes in the number of information channels,
diagnostic signs, diagnosed situations, modes of diagnosing, depth of memory, value of
diagnostic thresholds, and time step of diagnosing;
a self-protected system against indistinct knowledge of experts, keeping the initial
quality of diagnosing even under detector failures;
a system producing self-diagnostics of detectors;
a system forecasting a technical condition of the reactor after the detection of anomalies.
The DDS is based on an analytical model of the object dynamics. In the ideal case, such
models are real-time references, with which the current transient state of the object is
compared at any moment. The continuous monitoring of a difference between measured
signals of the object and signals of a dynamic standard model allows the diagnostics task to
be fixed. Thus, the DDS can be present as a collection of reference and RDS models.
The emergency diagnostics system (EDS) starts evaluating the technical condition of the
object after the activation of emergency protection (EP). The EDS operation results in the
detection of reasons of the EP activation, prediction of accident evolution, advices on
management of the out-of-order object, control of emergency automatic procedures, control of
safety systems operation, archiving of emergency transients, diagnostics of detectors. Post-
emergency diagnostics, which defines the stationary state of the object on completion of all
emergency transients, is the EDS function as well.
The complex diagnostics system (CDS) integrates different systems of diagnostics. Its
creation has solved the problems originating in attempt to design a diagnostic model that
describes all stages of developing failures of a reactor installation. For early diagnostics it is
important to detect a fault at a stage of its origin; therefore, the sensitivity properties of the
diagnostic model are more important than its localizing properties.
On the contrary, during diagnostics of the object being in the emergency state, when the fault
has been shown in signals of many detectors and the problem of its detection has been
resolved, the diagnostic model should precisely find a cause, localize and predict a fault. At
different time stages of its development, the compromise between the enumerated competing
factors is necessary.
The CDS uses information from the NDS, RDS, DDS, and ADS. This information is
represented in the CDS as balance relations, which describe the service capability of the
reactor installation as a whole:
balance of mass (consumption) for detecting leaks of the coolant and faults associated
with redistribution of the coolant flow;
balance of energy (power) for detection of faults bound with change in an efficiency
factor of a power installation;
balance of reactivity for detection of faults connected with unauthorized perturbation of
neutron power.
127
The change in value of the balance relation testifies the presence of faults. Their search is
conducted by logical models only for those faults, which a priori result in the established
upsetting of the balance.
Along with the diagnostics of the object, the task of diagnostics of detection equipment is
solved. It is especially important for a reactor, which has a high degree of independence, as an
object of diagnostics. The problem of diagnostics and the object as well as its detectors is
incorrect; there is an element of a vicious circle here: the information flow generated for the
object diagnostics is used as well for self-diagnostics of detectors causing this information
flow. All ways of diagnosing the object and its detectors with the same information flow are
based on the so-called detection redundancy included in a reactor design. The redundancy can
be reached by backup of detectors, by functional and stochastic correlation of signals from
different detectors because of correlations of physical processes in the object.
REFERENCES
[1] NP 017-2000, Main requirements for prolongation of service life of an NPP unit,
Moscow, 2000.
[2] RD EO 0281-01, Statement on management of the life characteristics of NPP power
units, Rosenergoatom concern.
[3] RD EO 0322-02, Statement on determination of technical condition and ageing cable
management in NPP, Rosenergoatom concern.
[4] RD EO 0321-02, Methodical instructions for technical condition assessment and
reassignment of service life of NPP relay devices, Rosenergoatom concern.
[5] INTERNATIONAL ATOMIC ENERGY AGENCY, Assessment and management of
ageing of major nuclear power plant components important to safety: In-containment
instrumentation and control cables, Volume 1-2, IAEA-TECDOC-1188, Vienna (2000).
[6] VIJ D.R., editor, Thermoluminescent Materials, PTR Prentice Hall, Englewood Cliffs,
New Jersey 07632 (1993) 535 pp. ISBN 0-13-915091-9.
128
115
ANNEX C.6.
REPLACEMENT OF THE REACTOR CONTROL AND
PROTECTION SYSTEM IN UNIT 1 & 2
OF THE BEZNAU NUCLEAR POWER PLANT
C. Hangartner
NPP Beznau, Switzerland
1. ABSTRACT
The Beznau Nuclear Power Plant (KKB) consists of two identical units and is located in the
lower Aare River valley. The plant has an electrical capacity of 760 MW and is operated by
Nordostschweizerische Kraftwerke (NOK). Both units are pressurized-water reactors, each
with two steam generators and two turbine sets. Unit 1 came on-line in 1969, and Unit 2
followed in 1971.
A programme of retrofitting and upgrading aimed at keeping the power plant up to date in
terms of safety has been carried on with the replacement of the reactor control and protection
system by a state-of-the-art computer-based system. The old safety control system, which had
operated without malfunctions, had to be changed because the system supplier no longer
provided technical support and thus no spare were available.
Project PRESSURE (the name is a German acronym meaning reactor control and protection
system replacement) went through several intensive phases, dating back to 1990. They
included a number of feasibility studies and bid invitations to suppliers all over the world. The
management of the project lies with a team of our own in-house engineers, who have not only
special knowledge of control systems but also good knowledge of the processes in the
existing plant. The replacement was successful. Since then both plants are in undisturbed
operation.
2. PROTECTION SYSTEM REPLACEMENT
The first consideration for a replacement of the reactor control and protection system is dating
back to 1990, when the supplier of the existing FOXBORO H-line system announced, that the
support for this system would no longer be guaranteed. The main activities for the project
started in 1994.
The project objective was a functional replacement of the reactor control and protection
system in consideration of suitable interfaces, compliance with state-of-the-art requirements,
no special outage for installation and commissioning and no change of the well-proved
operation philosophy.
On this basis, 20 new cabinets replaced 41 cabinets. The cabinets for the four redundant
reactor protection systems were placed in four separate rooms. The new reactor control and
protection system is based on the digital I&C System TELEPERM XS.
The project was divided into four phases: the preliminary study (1), the pre-project (2), the
main project (3) and the realization and implementation phase (4). In early 1998, after
completion of phase 3, the contract for delivery, installation and commissioning of the reactor
129
protection and control system by SIEMENS/KWU, meanwhile FRAMATOME ANP (FANP),
was signed. A key factor of this decision was the conviction, that TELEPERM XS is the most
qualified and future oriented system for functions important to safety in nuclear power plants.
The further project process included the two main activities, the design, manufacturing and
test field activities and the approval activities. In all these activities, up to 20 persons of the
KKB staff was included for design review, for installation and commissioning planning and
for co-operation in the test facility. This co-operation had the advantage of an on the job
training to get familiar with the new system.
At the end of September 1998, the formal request for the concept approval was submitted to
the Swiss Nuclear Safety Inspectorate (HSK). During the approval process, which was
terminated at the end of 1999, some modifications in the concept and the design were
requested. The approval process was also characterized by an intensive correspondence
between HSK and KKB as well as by several meetings.
After completion of comprehensive tests at the test facility, lasting from January until April
2000, the cabinets were shipped to Beznau where pre-installation work, e.g. cable routing and
wiring had started in the meantime. The newly built space made it possible to install the
cabinets for redundancies 2 and 4 even before plant shut down. Likewise, some early
commissioning tests could be performed.
The shut down of unit 1 for the outage was on July 21 and the main activities for dismantling
and installation started on July 29, after the reactor was unloaded. Reloading of the reactor
began on September 16 and full power was reached on October 8.
The schedule for unit 2 was similar to unit 1. The outage started on July 13, 2001 and the
main replacement activities on July 21. We reached full power on September 24. Since then
the plant has been in an undisturbed operation.
130
117
ANNEX C.7.
I&C AGEING MANAGEMENT IN US NUCLEAR POWER PLANTS
H.M. Hashemian
Analysis and Measurement Services Corp., United States of America
1. ABSTRACT
There are 103 operating nuclear power plants in the USA, as of 2003. Most of these plants
have already passed or are close to passing their mid-life of 20 years, as the licensed life of a
nuclear power plant in the USA is 40 years. Over the last ten years, the economics of nuclear
power plants in the USA has improved dramatically, and most plants have announced that
they will apply for life extension to 60 years. In fact, as of February 2003, nearly ten nuclear
power plants have already received or are in the process of receiving government approval for
life extension to 60 years.
With life extension in full swing in the USA, the ageing questions have become more
important. In fact, ageing is a significant issue in the U.S. nuclear power industry, and great
efforts have been spent over the last two decades to address the ageing of all-important
Systems, Structures, and Components (SSCs). As a result, a large volume of useful
information and data has emerged on ageing characteristics of SSCs and on what can be done
to manage the ageing process and cope with its consequences. In this paper, the relevant
activities of I&C ageing management in the USA are summarized.
2. I&C AGEING MANAGEMENT
In the area of I&C, the ageing concerns are mostly focused on cables. This is evident from the
great number of research projects sponsored over the last two decades by the U.S. Nuclear
Regulatory Commission (NRC) and the U.S. Department of Energy (DOE) at the Sandia
National Laboratory, Brookhaven National Laboratory, and elsewhere. Also, the Electric
Power Research Institute (EPRI), National Institute of Standards and Technology (NIST),
National Aeronautics and Space Administration (NASA), Department of Defense (DOD), and
Department of Transportation (DOT) have conducted research programmes to understand the
ageing characteristics of cables, including both the cable insulation materials and the
conductor, and to develop cable condition monitoring techniques. The NRC organized a
conference over the period of April 23 to 25, 2002, under the title International Conference
on Wire System Ageing. The proceedings of this conference (NUREG/CP-0179) provides
significant insight on the importance of cable ageing and the need for routine cable condition
monitoring in the nuclear power industry. In particular, development of effective cable
condition monitoring techniques for installed cables was identified in the NRC conference as
an urgent need.
The main problem with ageing of cables is that the cable insulation material can become dry
and brittle and fail, causing moisture intrusion in the cable, fire, and other problems.
Fortunately, there are objective means to detect cable degradation and failure, thereby
avoiding such consequences. This includes electrical measurements, mechanical
measurements, chemical tests, and visual inspections. Some of these measurements require
access to the cables or a sample of the cable for the test. It is for this reason that cable depots
are used in the containment of nuclear power plants to induce natural ageing in samples that
131
are then used to evaluate the condition of the installed cables. Most of the electrical tests can
be performed in-situ. With the in-situ tests, a sample is not normally needed, and the tests can
often be performed remotely from the control room area or cable spreading room while the
plant is operating. For example, the Time Domain Reflectometry (TDR) test can be performed
in-situ while the plant is operating to identify and locate problems such as increased areas of
resistance in cables and connectors. The TDR test can also reveal problems about the cable
insulation material.
In addition to the basic tests mentioned above, a great number of advanced techniques are
under development or already available for testing of cables, especially for non-destructive
testing. These include ultrasonic tests, thermography, Nuclear Magnetic Resonance (NMR)
techniques, optical diagnosis, etc. A description of these and other cable testing techniques is
given in NUREG/CP-0179, the proceedings of NRCs 2002 Conference on Wire System
Ageing.
Neutron detector cables are of particular importance in nuclear power plants. In many
occasions, flux measurement problems involving neutron detectors have been traced to cables.
As such, testing of neutron detector cables is important. Core exit thermocouples are also
prone to problems due to cables. Recently, a U.S. plant replaced a core exit thermocouple in
response to a temperature measurement problem. However, the problem did not disappear
with the thermocouple replacement. An investigation revealed that the problem was in the
thermocouple cables and not in the thermocouple itself.
The ageing of I&C sensors, such as Resistance Temperature Detectors (RTDs), pressure,
level, and flow transmitters have also been of concern. This is evident in ageing research
projects that the NRC funded in the 1990s resulting in publications of a number of NRC
reports including NUREG/CR-5560, NUREG/CR-5851, NUREG/CR-5383, NUREG/CR-
5501, and others. These efforts have concluded that sensor ageing can be managed through
periodic testing including calibration and response time testing. In fact, due to ageing
concerns and regulatory requirements, new techniques have been developed in recent years to
allow routine in-situ response time testing of sensors and on-line calibration verification. For
example, the loop current step response (LCSR) technique was developed for in-situ response
time testing of nuclear plant RTDs and the noise analysis technique was developed for in-situ
response time testing of pressure transmitters. The noise analysis technique also identifies
sensing line problems, such as blockages, which can cause the response time of a pressure
sensing system to increase drastically. As for on-line calibration verification, the cross-
calibration method has been developed for RTDs and the on-line monitoring approach has
been developed for pressure transmitters. The details of these methods are presented in the
references given at the end of this report.
Another sensor ageing issue in nuclear power plants is the degradation of core exit
thermocouples in pressurized water reactors (PWRs) due to moisture intrusion through the
sheath. This problem not only causes thermocouples to produce erratic reading, but also can
allow radioactive water to diffuse into the sensor and find a way outside the pressure
boundary. The latter is not only an I&C problem, but also a safety problem. This problem can
be identified in-situ through measurement of insulation resistance, LCSR measurement, and
cable testing.
In addition to ageing, obsolescence is a major I&C issue in the USA. Many I&C components
in the U.S. plants come from only a few manufacturers. Due to the small size of the nuclear
market, the components that are specific to nuclear power plants are sometimes removed from
132
119
product lines and no longer produced. This places a tremendous burden on the nuclear
industry to find replacement parts.
In recent years, digital I&C equipment has become prevalent in the nuclear power industry.
The digital I&C products have been very useful to the industry, but the obsolescence problem
is a greater concern with digital equipment compared to the old analog equipment. Almost all
digital I&C products are upgraded on a frequent basis. Thus, obsolescence is a big problem
with digital equipment.
There is not much data available on the ageing characteristics of digital I&C equipment, as
this equipment has only been used in nuclear power plants over the last decade. What is
known of the digital I&C equipment is their subtle failures and the fear of common mode
problems. In fact, common mode failure concerns and the software validation and verification
(V&V) issues have been at the center of debate as to whether or not to use digital I&C
equipment in critical systems in nuclear power plants. This is aside from the obsolescence and
ageing concerns.
The IAEA TECDOC-1147 (June 2000) provides additional useful information on ageing of
I&C equipment in nuclear power plants and how the I&C ageing may be managed.
Two databases are maintained in USA to track the performance of important plant equipment
including I&C. These databases are referred to as Licensee Event Report (LER) database that
is maintained by the NRC, and the Nuclear Plant Reliability Data System (NPRDS) database
that is maintained by the nuclear power industry. These databases are very useful in
determining if there are components in nuclear power plants that suffer from a common
problem. Both the LER and NPRDS databases have been used to provide data on ageing
degradation and failure of I&C equipment. In fact, a number of ageing research projects have
focused on analysis of LER and NPRDS databases to arrive at information on ageing
characteristics of key components in nuclear power plants.
Among other related developments in the USA is the maintenance rule that went into effect
in 1996. The maintenance rule requires nuclear power plants to track the performance of
equipment, including process instrumentation, to identify the onset of failures. The
maintenance rule was published as a U.S. government document called 10CFR50.65,
Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants.
REFERENCES
[1] HASHEMIAN, H.M., et al., Effect of Ageing on Response Time of Nuclear Plant
Pressure Sensors. U.S. Nuclear Regulatory Commission, NUREG/CR-5383, (June 1989).
[2] HASHEMIAN, H.M., et al., Ageing of Nuclear Plant Resistance Temperature
Detectors. U.S. Nuclear Regulatory Commission, Report Number NUREG/CR-5560,
(June 1990).
[3] HASHEMIAN, H.M., et al., Advanced Instrumentation and Maintenance Technologies
for Nuclear Power Plants, U.S. Nuclear Regulatory Commission, NUREG/CR-5501,
(August 1998).
[4] HASHEMIAN, H.M., et al., Long Term Performance and Ageing Characteristics of
Nuclear Plant Pressure Transmitters, U.S. Nuclear Regulatory Commission,
NUREG/CR-5851, (March 1993).
133
[5] HASHEMIAN, H.M., HOLBERT, K.E., KERLIN, T.W., UPADHYAYA, B.R., A Low
Power Fourier Transform Processor. NASA Goddard Space Flight Center, Contract
Number NAS5-28635, (July 1985).
[6] HASHEMIAN, H.M., Determination of Installed Thermocouple Response. U.S. Air
Force, Arnold Engineering Development Center, Report Number AEDC-TR-86-46,
(December 1986).
[7] HASHEMIAN, H.M., HOLBERT, K.E., THIE, J.A., UPADHYAYA, B.R., KERLIN,
T.W., PETERSEN, K.M., BECK, J.R., Sensor Surveillance Using Noise Analysis. U.S.
Department of Energy, Contract Number DE-AC05-86ER80405, (March 1987).
[8] HASHEMIAN, H.M., New Technology for Remote Testing of Response Time of
Installed Thermocouples. United States Air Force, Arnold Engineering Development
Center, Report Number AEDC-TR-91-26, Volume 1 - Background and General Details,
(January 1992).
[9] HASHEMIAN, H.M., and MITCHELL, D.W., New Technology for Remote Testing of
Response Time of Installed Thermocouples. United States Air Force, Arnold
Engineering Development Center, Report Number AEDC-TR-91-26, Volume 2
Determination of Installed Thermocouple Response Research Data, (January 1992).
134
CONTRIBUTORS TO DRAFTING AND REVIEW
Bock, H.W. Framatome ANP GmbH NLL, Germany
Burgis, R. AECL, Canada
Eiler, J. Paks NPP, Hungary
Hashemian, H.M. Analysis and Measurement Services Corporation (AMS),
United States of America
Kim, K.H. Korea Nuclear Instrumentation and Control R&D Centre,
Republic of Korea
Kononenko, A.I. Research Institute of Scientific Instruments, Russian Federation
Manners, S. Institute de Radioprotection et de Sret Nuclaire (IRSN), France
Thoma, K. Nordostschweizerische Kraftwerke, Kernkraftwerk Beznau, Switzerland
Yamamoto, T. Japan Power Engineering and Inspection Corporation, Japan
Consultancy Meeting
Vienna, Austria: 2427 September 2002
Advisory Group Meeting
Vienna, Austria: 58 May 2003
135