Home > NRC Library > Document Collections > General Communications > Information Notices > 1993 > IN 93-57
UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION WASHINGTON, D.C. 20555 July 23, 1993 NRC INFORMATION NOTICE 93-57: SOFTWARE PROBLEMS INVOLVING DIGITAL CONTROL CONSOLE SYSTEMS AT NON-POWER REACTORS Addressees All holders of operating licenses or construction permits for test and research reactors and nuclear power reactors. Purpose The U.S. Nuclear Regulatory Commission (NRC) is issuing this information notice to alert addressees to software problems involving digital control console systems at two non-power reactors. It is expected that recipients will review the information for applicability to their facilities and consider actions, as appropriate, to avoid similar problems. However, suggestions contained in this information notice are not NRC requirements; therefore, no specific action or written response is required. Description of Circumstances Armed Forces Radiobiology Research Institute (AFRRI) On September 4, 1992, at the AFRRI Training Reactor and Isotope Production - General Atomics (TRIGA) reactor, a problem with the interlock logic for the digital control console was discovered during the performance of the items on the daily startup checklist for the shutdown reactor. The digital control console, manufactured by General Atomics, was installed at AFRRI in the summer of 1990 in accordance with an NRC license amendment dated July 23, 1990. The problem was revealed when a trainee depressed the PULSE mode button and the rod UP button simultaneously and a control rod was driven out of the core. This rod movement was inconsistent with a rod withdrawal interlock for the PULSE mode of operation. The rod continued to withdraw even after the rod UP button was released; this continued withdrawal is inconsistent with the design intent of the rod control system. Licensee personnel manually tripped the reactor to stop the withdrawal of the control rod. The licensee investigated this event and found that the same rod withdrawal action would occur when the SQUARE WAVE mode button (instead of the PULSE mode button) and the rod UP button were depressed simultaneously. However, the problem would not occur when the AUTO mode button and the rod UP button were depressed simultaneously. The licensee tested a variety of interlock combinations for the digital control console system and did not find any other problems. 9307190043 . IN 93-57 July 23, 1993 Page 2 of 3 This problem had not been discovered previously for two reasons: (1) General Atomics, the manufacturer of both the TRIGA reactor and the digital control console, considered the simultaneous pressing of the mode selector and rod UP buttons to be inconsistent with the operational design of the reactor, and (2) these buttons were so located on the control console that it was unusual for an operator to press both buttons simultaneously. As an interim measure, pending a permanent modification, the licensee installed a switch configuration that required the operator to use both hands to enter the pulse or square-wave mode of operation. This change prevented an operator from pressing a rod UP button at the same time as an operational mode button. General Atomics has now developed a permanent software modification for this problem, and the licensee installed the modification at AFRRI on September 25, 1992. This modification was also installed at other facilities that have the General Atomics digital control consoles. The temporary solution for the digital control console at AFRRI was maintained until the permanent software modification was fully tested and accepted. Pennsylvania State University (Penn State) On October 5, 1992, with the reactor shut down, operators at the Penn State TRIGA reactor erroneously assigned a positive value to a software parameter for their digital control console. Power was supplied to the control rod magnets at the time, engaging the control rods to their drive mechanisms and resulting in allowing control rod withdrawal on the demand signal from the control system which resulted from the software error. The error resulted in the unanticipated withdrawal of the transient control rod. The transient rod scrammed on a rod withdrawal overspeed trip. Software subroutines in this system are typically designed to reject irrational parameter changes and issue warning messages. However, because this particular parameter has a wide range of valid positive and negative inputs, the software cannot prevent the operator from inputting erroneous values. The digital control console, manufactured by Atomic Energy of Canada, Ltd., of Mississauga, Ontario, was installed at Penn State in the summer of 1991 in accordance with an NRC license amendment dated August 6, 1991. The manufacturer of the digital control console has discussed possible corrective actions with the licensee and with other customers who could experience the problem. The licensee has instituted administrative controls at Penn State that are designed to prevent a recurrence of this type of problem. These administrative controls include (1) a requirement that power to the control rod magnets be off when making software changes, (2) increased management review of proposed changes, and (3) the use of design change procedures to . IN 93-57 July 23, 1993 Page 3 of 3 control changes to the digital control console, providing additional assurance that the software changes will be installed correctly and tested. Discussion These problems, and the increasing number and wide variety of licensees and applications using digital technology, emphasize the importance of the design, testing, and change control of digital systems. An effective verification and validation (V&V) plan for software that performs a safety function can help ensure acceptable design and implementation. Some acceptable V&V plans are described in Regulatory Guide 1.152, "Criteria for Programmable Digital Computer Software in Safety-Related Systems at Nuclear Power Plants," and in American National Standards Institute (ANSI)/Institute of Electrical and Electronics Engineers (IEEE) Standard 1012-1986, "IEEE Standard for Software Verification and Validation Plans." Guidance for determining the design specifications that are to be verified and validated is available in ANSI/IEEE Standard 830-1984, "IEEE Guide to Software Requirements Specification." Another key element related to digital systems is the control of software configuration changes. Guidance for software configuration change control is available in ANSI/IEEE Standard 828-1983, "IEEE Standard for Software Configuration Management Plans." This information notice requires no specific action or written response. If you have any questions about the information in this notice, please contact one of the technical contacts listed below or the appropriate Office of Nuclear Reactor Regulation (NRR) project manager. ORIGINAL SIGNED BY Brian K. Grimes, Director Division of Operating Reactor Support Office of Nuclear Reactor Regulation Technical contacts: J. Stewart, NRR (301) 504-0824 W. Eresian, NRR (301) 504-1833 M. Mendonca, NRR (301) 504-1128 Attachment: List of Recently Issued NRC Information Notices .
Page Last Reviewed/Updated Thursday, March 29, 2012