Safety and Nonsafety Communications and Interactions in International Nuclear Power Plants

Current industry and NRC guidance documents such as IEEE 7-4.3.2, Reg. Guide 1.152, and IEEE 603 do not sufficiently define a level of detail for evaluating interdivisional communications independence. The NRC seeks to establish criteria for safety systems communications that can be uniformly applied in evaluation of a variety of safety system designs. This report focuses strictly on communication issues related to data sent between safety systems and between safety and nonsafety systems. Further, the report does not provide design guidance for communication systems nor present detailed failure modes and effects analysis (FMEA) results for existing designs. This letter report describes communications between safety and nonsafety systems in nuclear power plants outside the United States. A limited study of international nuclear power plants was conducted to ascertain important communication implementations that might have bearing on systems proposed for licensing in the United States. This report provides that following information: 1.communications types and structures used in a representative set of international nuclear power reactors, and 2.communications issues derived from standards and other source documents relevant to safety and nonsafety communications. Topics that are discussed include the following: communication among redundant safety divisions, communications between safety divisions and nonsafety systems, control of safety equipment from a nonsafety workstation, and connection of nonsafety programming, maintenance, and test equipment to redundant safety divisions during operation. Information for this report was obtained through publicly available sources such as published papers and presentations. No proprietary information is represented

Diversity Strategies for Nuclear Power Plant Instrumentation and Control Systems

This report presents the technical basis for establishing acceptable mitigating strategies that resolve diversity and defense-in-depth (D3) assessment findings and conform to U.S. Nuclear Regulatory Commission (NRC) requirements. The research approach employed to establish appropriate diversity strategies involves investigation of available documentation on D3 methods and experience from nuclear power and nonnuclear industries, capture of expert knowledge and lessons learned, determination of best practices, and assessment of the nature of common-cause failures (CCFs) and compensating diversity attributes. The research described in this report does not provide guidance on how to determine the need for diversity in a safety system to mitigate the consequences of potential CCFs. Rather, the scope of this report provides guidance to the staff and nuclear industry after a licensee or applicant has performed a D3 assessment per NUREG/CR-6303 and determined that diversity in a safety system is needed for mitigating the consequences of potential CCFs identified in the evaluation of the safety system design features. Succinctly, the purpose of the research described in this report was to answer the question, 'If diversity is required in a safety system to mitigate the consequences of potential CCFs, how much diversity is enough?' The principal results of this research effort have identified and developed diversity strategies, which consist of combinations of diversity attributes and their associated criteria. Technology, which corresponds to design diversity, is chosen as the principal system characteristic by which diversity criteria are grouped to form strategies. The rationale for this classification framework involves consideration of the profound impact that technology-focused design diversity provides. Consequently, the diversity usage classification scheme involves three families of strategies: (1) different technologies, (2) different approaches within the same technology, and (3) different architectures within the same technology. Using this convention, the first diversity usage family, designated Strategy A, is characterized by fundamentally diverse technologies. Strategy A at the system or platform level is illustrated by the example of analog and digital implementations. The second diversity usage family, designated Strategy B, is achieved through the use of distinctly different technologies. Strategy B can be described in terms of different digital technologies, such as the distinct approaches represented by general-purpose microprocessors and field-programmable gate arrays. The third diversity usage family, designated Strategy C, involves the use of variations within a technology. An example of Strategy C involves different digital architectures within the same technology, such as that provided by different microprocessors (e.g., Pentium and Power PC). The grouping of diversity criteria combinations according to Strategies A, B, and C establishes baseline diversity usage and facilitates a systematic organization of strategic approaches for coping with CCF vulnerabilities. Effectively, these baseline sets of diversity criteria constitute appropriate CCF mitigating strategies for digital safety systems. The strategies represent guidance on acceptable diversity usage and can be applied directly to ensure that CCF vulnerabilities identified through a D3 assessment have been adequately resolved. Additionally, a framework has been generated for capturing practices regarding diversity usage and a tool has been developed for the systematic assessment of the comparative effect of proposed diversity strategies (see Appendix A)

NMIS with Imaging and Gamma Ray Spectrometry for Pu, HEU, HE and Other Materials

The Nuclear Material Identification System (NMIS) has been under development at ORNL and the National Nuclear Security Administration (NNSA) Y-12 National Security Complex since 1984. In the mid-1990s, what is now the US Department of Energy (DOE) Office of Nuclear Verification (ONV) realized that it was a useful technology for future arms control treaty applications and supported further development of the system. In 2004, fast-neutron imaging was incorporated into the system. In 2007, the ONV decided to develop a fieldable version of the system, designated as FNMIS, for potential use in future treaties. The FNMIS is being developed to be compatible with the eventual incorporation of gamma-ray spectrometry and an information barrier. This report addresses how and what attributes could be determined by the FNMIS system with gamma-ray spectrometry. The NMIS is a time-dependent coincidence system that incorporates tomographic imaging (including mapping of the fission sites) and gamma-ray spectrometry. It utilizes a small, lightweight (30 lb), portable deuterium-tritium (DT) neutron (14.1 MeV) generator (4 x 10{sup 7} neutrons/second) for active interrogation and can also perform passive interrogation. A high-purity germanium (HPGe) gamma-ray detector with multichannel analysis can be utilized in conjunction with the source for active interrogation or passively. The system uses proton recoil scintillators: 32 small 2.5 x 2.5 x 10.2-cm-thick plastic scintillators for imaging and at least two 2 x 2 arrays of 27 x 27 x 10-cm-thick plastic scintillators that detect induced fission radiation. The DT generator contains an alpha detector that time and directionally tags a fan beam of some of the neutrons emitted and subdivides it into pixels. A fast (1 GHz) time correlation processor measures the time-dependent coincidence among all detectors in the system. A computer-controlled scanner moves the small detectors and the source appropriately for scanning a target object for imaging. The system is based on detection of transmitted 14.1 MeV neutrons, fission neutrons, and gamma rays from spontaneous, inherent source fission of the target, fission neutrons and gamma rays induced by the external DT source, gamma rays from natural emissions of uranium and plutonium, and induced gamma-ray emission by the interaction of the 14.1 MeV neutrons from the DT source. The NMIS can and has been used with a time-tagged californium spontaneous fission source. It has also been used with pulsed interrogation sources such as LINACs, DT, and deuterium-deuterium (DD) sources. This system is uniquely suited for detection of shielded highly enriched uranium (HEU), plutonium, and other special nuclear materials and detection of high explosives (HE) and chemical agents. The NMIS will be adapted to utilize a trusted processor that incorporates information barrier and authentication techniques using open software and then be useful in some international applications for materials whose characteristics may be classified. The proposed information barrier version of the NMIS system would consist of detectors and cables, the red (classified side) computer system, which processes the data, and the black (unclassified side) computer, which handles the computer interface. The system could use the 'IB wrapper' concept proposed by Los Alamos National Laboratory and the software integrity (digital signatures) system proposed by Sandia. Since it is based entirely on commercially available components, the entire system, including NMIS data acquisition boards, can be built with commercial off-the-shelf components. This system is being developed into a fieldable system (FNMIS) for potential arms control treaties by the ONV. The system will be modularly constructed with the RF shielded modules connected to the processor by appropriate control and signal cable in metal conduit. The FNMIS is presently being designed for eventual incorporation of gamma-ray spectrometry and an information barrier to protect classified information. The system hardware and software can be configured to obtain the following: plutonium presence, plutonium mass, Pu-240/239 ratio, plutonium geometry, plutonium metal vs non-metallic (absence of metal), time (age) since processing for plutonium (or last purification), uranium presence, uranium mass, uranium enrichment, uranium geometry, uranium metal vs non-metallic compound (absence of metal), beryllium presence and mass, tritium and deuterium gas bottle presence, HE, and chemical weapons. A matrix of the quantities determined, the method of determination, whether active (external neutron source) or passive, and the measurement equipment involved is given in the Tables 1-4. Some of these attributes can be obtained by multiple data analysis methods. The gamma-ray spectrometry methods for HEU, plutonium, and HE have been developed by other laboratories, are well known, and will be incorporated

Pulsed Neutron Measurments With A DT Neutron Generator for an Annular HEU Uranium Metal Casting

Measurements were performed with a single annular, stainless-steel-canned casting of uranium (93.17 wt% 235U) metal ( ~18 kg) to provide data to verify calculational methods for criticality safety. The measurements used a small portable DT generator with an embedded alpha detector to time and directionally tag the neutrons from the generator. The center of the time and directional tagged neutron beam was perpendicular to the axis of the casting. The radiation detectors were 1x1x6 in plastic scintillators encased in 0.635-cm-thick lead shields that were sensitive to neutrons above 1 MeV in energy. The detector lead shields were adjacent to the casting and the target spot of the generator was about 3.8 cm from the casting at the vertical center. The time distribution of the fission induced radiation was measured with respect to the source event by a fast (1GHz) processor. The measurements described in this paper also include time correlation measurements with a time tagged spontaneously fissioning 252Cf neutron source, both on the axis and on the surface of the casting. Measurements with both types of sources are compared. Measurements with the DT generator closely coupled with the HEU provide no more additional information than those with the Cf source closely coupled with the HEU and are complicated by the time and directionally tagged neutrons from the generator scattering between the walls and floor of the measurements room and the casting while still above detection thresholds

Subcriticality Measurements with HEU (93.2) Metal Annular Storage Castings

These carefully performed and documented measurements with unreflected and unmoderated highly enriched uranium (HEU) castings can be used to benchmark calculational methods for the time decay of the fission chain multiplication process as measured with small (1 x 1 x 6 in. thick plastic scintillators with 1/4-in.-thick lead on all detector surfaces) detectors adjacent to the tightly fitting stainless steel cans that contained the HEU ({approx}93 wt%) metal. Prompt time decay measurements were performed stimulating the fission chain multiplication process with a timed, tagged Cf spontaneous fission source that emitted fission-spectrum neutrons and a time and directionally tagged 14.1-MeV neutrons from the DT reaction in a steady state generator with an embedded alpha detector. Time decay measurements were performed with HEU masses varying from 18 to 90 kg for a wide variety of source-detector-casting configurations. The use of a DT generator provided no addition information about the fission chain behavior beyond that provided by a time-tagged Cf spontaneous fission source. The main quantities obtained in the measurements were (1) the time distribution of the counts in a detector after a neutron fission in the Cf source or after the alpha detection coincident with the emission of a neutron from the DT generator (the equivalent of a pulsed neutron measurement with a randomly pulsed source) and (2) the time distribution of counts in one detector after a count in another detector (the equivalent of a two-detector Rossi-alpha measurement). Monte Carlo calculations using the MCNP-PoliMi coupled gamma-neutron transport code generally agreed with the measurement results except for some differences early in the fission chain decay process. The measurements that were performed with the HEU about 1 m above the floor were considerably affected by room return neutrons at times as early as 100 ns, and at times after 300 ns, a major portion of the time response was associated with the interaction of the HEU assemblies with the floor. This room-return effect increased with the size of the assembly because the larger assemblies subtend a larger solid angle to a neutron returning from the floor

Diversity Strategies for Nuclear Power Plant Instrumentation and Control Systems

This report presents the technical basis for establishing acceptable mitigating strategies that resolve diversity and defense-in-depth (D3) assessment findings and conform to U.S. Nuclear Regulatory Commission (NRC) requirements. The research approach employed to establish appropriate diversity strategies involves investigation of available documentation on D3 methods and experience from nuclear power and nonnuclear industries, capture of expert knowledge and lessons learned, determination of best practices, and assessment of the nature of common-cause failures (CCFs) and compensating diversity attributes. The research described in this report does not provide guidance on how to determine the need for diversity in a safety system to mitigate the consequences of potential CCFs. Rather, the scope of this report provides guidance to the staff and nuclear industry after a licensee or applicant has performed a D3 assessment per NUREG/CR-6303 and determined that diversity in a safety system is needed for mitigating the consequences of potential CCFs identified in the evaluation of the safety system design features. Succinctly, the purpose of the research described in this report was to answer the question, 'If diversity is required in a safety system to mitigate the consequences of potential CCFs, how much diversity is enough?' The principal results of this research effort have identified and developed diversity strategies, which consist of combinations of diversity attributes and their associated criteria. Technology, which corresponds to design diversity, is chosen as the principal system characteristic by which diversity criteria are grouped to form strategies. The rationale for this classification framework involves consideration of the profound impact that technology-focused design diversity provides. Consequently, the diversity usage classification scheme involves three families of strategies: (1) different technologies, (2) different approaches within the same technology, and (3) different architectures within the same technology. Using this convention, the first diversity usage family, designated Strategy A, is characterized by fundamentally diverse technologies. Strategy A at the system or platform level is illustrated by the example of analog and digital implementations. The second diversity usage family, designated Strategy B, is achieved through the use of distinctly different technologies. Strategy B can be described in terms of different digital technologies, such as the distinct approaches represented by general-purpose microprocessors and field-programmable gate arrays. The third diversity usage family, designated Strategy C, involves the use of variations within a technology. An example of Strategy C involves different digital architectures within the same technology, such as that provided by different microprocessors (e.g., Pentium and Power PC). The grouping of diversity criteria combinations according to Strategies A, B, and C establishes baseline diversity usage and facilitates a systematic organization of strategic approaches for coping with CCF vulnerabilities. Effectively, these baseline sets of diversity criteria constitute appropriate CCF mitigating strategies for digital safety systems. The strategies represent guidance on acceptable diversity usage and can be applied directly to ensure that CCF vulnerabilities identified through a D3 assessment have been adequately resolved. Additionally, a framework has been generated for capturing practices regarding diversity usage and a tool has been developed for the systematic assessment of the comparative effect of proposed diversity strategies (see Appendix A)