ML18052B180
| ML18052B180 | |
| Person / Time | |
|---|---|
| Site: | Palisades  |
| Issue date: | 06/29/1987 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML18052B179 | List: |
| References | |
| NUDOCS 8707080306 | |
| Download: ML18052B180 (26) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 SAFETY EVALUATION BY THE OFFICE OF ~UCLEAR REACTOR REGULATION RELATED TO THE SAFETY PARAMETER DISPLAY SYSTEM CONSUMERS POWER COMPANY
1.0 INTRODUCTION
PALISADES PLANT DOCKET NO. 50-255 All. holders of operating licenses (licensees) issued by the Nuclear Regulatory Commission (the Commission or NRC) and applicants for *an operating license must provide a Safety Parameter Display System (SPDS) in the control room of their plant.
The Commission~appro~ed requirements for the SPOS are defi.ned_Jn Suppleme_n_t 1 to NVREG-0737 (Reference 1).
The purpose of the. SPDS is to provide a concise display of critical plant variables to control room operators to aid them in rapidly and reliably determining the safety status of the plant.
NUREG-0737, Supplement 1, requires licensees and applicants to prepare a.written safety anQlysis describing the basis on which the selected parameters are sufficient to assess the safety status of each identified function for a wide range of events, which include symptoms of severe accidents:. Licensees and appli-cants shall also prepare an Implementation Plan for the SPOS, which con-tains schedules for design, development, installation, and full operation of the SPDS as well as a design Verification and Validation Plan.
The Safety Analysis and the Implementation Plan are to be submitted to the NRC for staff review.
The results from the staff 1 s review are to be
\\
issued in a:safety Evaluation
(~-8-7_0_7_0_8_0_3_0_6~8-7_0_6_2_9__.._~~.~1 PDR ADOCK 05000255 I
Prompt implementation of the SPDS in operating reactors is a design goal of prime importance.
The review of human factors design of the SPDS for operating reactors called for in NUREG-0737, Supplement 1, is designed to avoid delays resultjng from the time required for NRC staff review.
The NRC staff will not review operating reactor SPDS designs for compliance with the requirements of Supplement 1 of NUREG-0737 prior to implementa-tion unless a pre-implementation review has been specifically requested by licensees.
The licensee's Safety Analysis and SPDS Implementation Plan wi 11 be reviewed by the. NRC staff only to deter:-mi ne if a serious safety
- question is posed or if the analysis is seriously inadequate.
The NRC staff rev~~w to ac~omplish this will be dire~t~d at (1) confirming_the adequacy of the parameters selected to be displayed to detect critical
~saf~ty ~l!!lctions_, (2) conffr~in~ ~hat means are provided to assur~ that the data.displayed are valid, (3) co'nfirming that the licensee has com-mitted to a human factors program to ensure that the displayed*informa-tion can be readily perceived and comprehended so as not to mislead.the operatorJ and (4) confirming that the SPDS will be suit~bly isolated from electrical and electronic interference with equipment and sensors that are.
used in safety systems.
If based on this review, the staff identifies serious safety questions or seri_ous ly inadequate analysis, the Di rector of Nuclear Reactor Regul at i o.n may require or direct the licensee to cease imp 1 ementat ion.
2.0
SUMMARY
The staff reviewed the Consumers Power Company's SPDS Safety Analysis for the Palisades Plant.
Based on the results of the review, we conclude that
.1_1i..* no serious safety questions are posed by the proposed SPDS, and therefore, implementation of the SPDS may continue.
The licensee evaluated the design ~nd function of the SPDS against the criteria of 10 CFR 50.59.
Based on the results of the evaluation, tpe
- licensee determined that the SPDS does not involve an unreviewed safety question.
This conclusion agrees with the results from other licensees and is acceptable to the staff.
3.0 EVALUATION
3.1 Background
The Consumers Power Company, submitted to-the NRC Safety Analys.es (References 2 and 3) on the SPDS. *The staff reviewed the analyses and because of insufficient information, was unable to complete the review.
Requests for additional information (References 4 and 5) were forwarded to the licensee and the licensee 1 s*res~onses (Refer-ences 3, 6 and 9) were.evaluated by the staff.
This safety evalua~
-tion is based upon the results from the _staff 1s review of the mater-ial identified.
3.2 Description The licensee 1 s SPDS is computer based and consists of the Critical Function Monitoring System (CFMS) manufactured by Combustion
. Engineering.
The CFMS is a multicolor CRT based interface providing multiple fixed format graphic displays.
These displays are arranged in a structured hierarchy for efficient operator access.
The top level displays consist of status indicators providing an overall status o*f pl ant safety functions and a 11 ow for qui ck acces.s to lower level displays, which provide more detailed information.
As of February 25, 1987, the licensee states that the CFMS is cur-:-
rently installed and functioning.
3.3 Parameter.Selection Sectioh.4.lf of Supplement 1 to NUREG~0737 states that:
The minimum informatior) to be provided shall be sufficient to provide information*to plant operators about:
(i)
Reactivity control
{ii) Reactor core cooling and heat removal from the primary system
- (iii) Reactor cool ant system i-ntegri.ty (iv) Radioactivity control (v)
Containment conditions
.. **~'
---.. ~-
- e. For review purposes, these five items have been designated as Critical Safety Functions (CSFs).
In the staff's evaluation of the parameters selected by the licen-see for display in the SPDS, we have consi-dered the Combustion Engineering Owners Group_,.."Combustion Engineering Emergency Proce-dure Guidelines," (EPGs) which was reviewed and approved by the staff for implementation (References 7 and 8) as a principal tech-nical sour~e of parameters important to operational safety.
The parameters selected by the.licensee are summarized in Table 1 (grouping was made*by licen~ee).
The l iCensee' s* SPDS is des 1 gr:ed to monitor the critical safety func-tions as defi.ned in the "Combustion Engineering Emergency Procedures *~
Guidelines" (CEN-152).
The nomenclature used for the critical func-t.ions in the EPG's developed by Combustion Engineering differs some-what from that of Supplement 1 to NUREG-0737.
The licen~ee corre-
" lated the nomenclature as follows:
Licensee's CSFs NUREG-0737, Supplement 1 CS~s
- 1. Reactivity Control
-.- -.Reactivity Control
- 2. Primary Coolant System Inventory Control
+
- Reactor Coolant System Integrity
(
~
- 3. Primary Coolant System Pressure Control
- 4. Core Heat Remova~
+
- 5. Primary Coolant System Heat Removal 6;
Containm~nt Atmosphere Control
+
- 7. Containment Isolation
- 8. Environmental Control _
- Reactor Core Cooling and Heat Removal From the Primary System
- Contatnment Conditions
- Radioactivfty Control With this correlation, the staff then proceeded to evaluate the basis of the process variables selected by the licensee for display in the SPDS.
Based on the staff's review of the licensee's support-
.ing -analyses, and.our observation that tl)e.selected variables appear to be consistent with Combustion Engfneering's EPGs, we find the proposed list of variables to be generally acceptable.
However, we noted that the hot leg temperature, cold leg temperature, steam generator pressure, and containment sump level were not among the
. "' variables within the licensee's list.
The first three variables are important in evaluating the Core Cooling and He~t Removal CSF.
The last variable, containment sump level, is important in evaluating the Reactor Coolant System Integrity CSF.
By letter dated August*29, 1986 (Reference 9), the licensee responded to the above staff concerns.
With regard to hot and cold leg tempera-t~re, the licensee response states:
Our M*ay 19, 1986 response on parameters monitored for each safety.
function did not explicitly state that hot and cold leg tempera-tures were monitored as part of the "Reactor Core Cooling and Heat Removal From the Primary System" critical safety function.
Our response did state* that subcoo 1 ed margin based on.. hot and co 1 d leg temperatures and core exit temperatures are monitored.
This. use of hot and cold leg temperatures was meant to indicate that hot and cold leg temperat~res were p~rameter~ included to as~ess the "Core Cooling.and Heat Removal" safety function.
These parameters are.. monitored for this tun*ctfon and are displayed on Page* 211.
Core exit temperatures were noted as~being parameters required to
'-*-monitor core heat.removal in Section L_l.4 of our May 19, 1986
- submittal.
The staff recommends that these displayed parameters, hot and cold leg temperature, be retained in the display.
The licensee also addressed the staff's concern on the need to display containment sump level and provided the following data:
Containment sump level is not <;t dir~t "!~asure of primary coolant system (PCS) integrity.
Sump level can increase as a result of steam line breaks inside of containment which do not affect PCS integrity.
Further, sump levels will remain constant for steam
...,,., generator tube ruptures which do violate PCS integrity.
Parameters selected for monitoring thl\\!. critical safety functions.
are those required to be controlled. within appropriate. *1 imits in order to assure that critical safety functions are being main-tained.
The operator has no control over the containment sump level.
- Furthermore, *the licensee_ states that containment sump level is.
considered in the CEN-152 Emergency Procedure Gu*; deli nes *as* a
~
diqgnostic parameter.
Sump level is used in conjunction with other parameters to determine the typ~ event in progress to a 11 ow selecting the optimal recovery guideline..Further, sump level is used to confirm that the safety injection pumps
~c;tve adequate NPSH following the automa~ic switchover of the suction of these pumps
- to the co~tainment sump.
The* ltcensee considers containment sump level an important para-meter, and as such, it is included in the CFMs and it is displayed on eRT Pages 244 and 321.
The staff...con*i de rs contai nmeqt sump level a key indicator to identify a LOCA-type breach of reactor coolant system integrity, particula\\lY for smaller leaks during which reactor coo.l ant system pressure may not be changing.
The staff recommends that this parameter be retained within the display system for use in those events wherein sump level is an important indicator of reactor coolant system integrity.
.. V"I Although not identified in the licensee 1 s safety analysis, the staff 1 s review of the display formats notes that steam generator.
pressure is a displayed parameter.
The staff cons-i de rs steam
.generator pressure a key indicator of the viability and integrity of the secondary system.
It is important* to maintain the integrity of the secondary system as it serves as an intermediate heat sink for the reactor within the heat engine cycle.
The staff recom~ends
.that this parameter be retained within the display system as a~
aid in evaluating the core cooling and heat removal function.
The staff al so expressed concerns with display update rates for
- the parameters* di_sp l ayed.
Consumers Power Company 1 s May 19, 1986
-submitt~l provided.information on the one second update rate utilized by the *spos for displaying trends of plant parameters.
Thjs resprinse did. not explicitly state that this update rate is acceptable for monitoring expected neutron flux oscillations.
Consumers Power Company' has revi"ewed th~e Pali ~ades Pl ant Fina 1 Safety Analysis and determined that no neutron flux oscillations, which might be indicative of a severe accid~nt, are distussed in
- this a~alysis. Further, no mechanism for rapid oscillations of reactivity has been identified which couldresult in rapid neutron 0 flux oscillations.
Changes in neutNn fl.ux which.approximate step changes, such as following a reactor trip, have been identifi~d, however, the one second update is sufficient for an operator to
. ~learly resolve ~he time such a step change in power occurs.
........ Based on this data, the staff concludes that the one second update rate is sufficient to provide operators the information necessary to trend neutron flux.
Not all of the variables selected by the licensee are currently displayed within the SPDS.
Reactor vessel level and core exit coolant temperatures are unavailable at this time:
Instrumenta~
tion to measure these variables will be added to the plant during the 1988 refueling outage.
The display of th~se p*rocess variables within the SPDS will be available after this.refueling outage.
We r
request that the 1-icensee info'rm the staff upon completion of this effort and inform the staff of any significant sl~ppage in the co~eletion of* the task.
Based upon.our review of the safety analysis and of the di.splay formats, we confirm*that the. parameters selected for display are adequate to monitor tJie critical safety functions.
Also, we recommend that the display of hot leg* temperature, cold leg temperature, steam generator pressure, and containment sump level be retained within the system for the reasons discussed above.
3.4 Display Data Validation The staff evaluated the licensee's design to determine that means are provided in the display system to assure that the data displayed are valid.
The licensee's May 19, 1986 submittal provided a de-scription of the parameters monitored by the SPOS for each critical safety function.
Of the parameters described, approximately 80%
are provided with redundant inputs.
Validation of these inputs is performed by a combination of input range checks and valid1ty checks of the redundant inputs.
All analog inputs to the SPOS.are checked for out of range condi-tions prior to display.
Inputs found to be out of range are indi-cated on the out-of-range display page and indicated on operational displays by question marks 11 ????
11 -in the value field.
An input quality flag is also carried by the signal and utilized in safety function algorithms whic~ require the input.
For parameters having redundant.inputs, 'the safety f1.inct ion algorithms determine the best
=-*.
estimate value to be uti.Jized by ~valuating the quality flag of each input.
If there are no good quality inputs for a particular para-meter, the color of the top level display matrix box and alarm leg name associated with that parameter are changed to yellow to indi-cate to the operator that the input data is questionable.
For some parameters, consistency checks against other input para-meters a re performed. to further: vaJ l,Pate.. the input.
For examp 1 e, the source range nuclear instruments are turned off automatically when the wide range nuclear instruments exceed a certain value.
To prevent this from indicating an invalid source range signal,
.. *f-i
~
.. *- the source range validity check determines if the wide range nuclear instruments are on scale above a certain value prior to tagging the source range instruments as invalid.
A similar check is performed for the wide range nuclear instruments which can go off scale low when neutron level is in the source range.
For this case, the status of the source range instruments is determined, prior to flagging the wide range nuclear instrumentation i.nvalid.
Parameters utilized in the critical safety function algorithms which do not have redundant inputs include the following:*
a.. ***Shutdown cooling flow
- b.
Shutdown* cooling heat-exchanger inlet temperature
- -~
- c.
Condenser off-gas radiation
- d.
Steam line radiation (one monitor/steam generator)
- e.
Containment temperature Of* these items, a through d haye anJy ory.e. transmitter ava.il able in the plant and thus redundancy is not provided in the computer.
Items c and d taken together provide for redundancy in determining secondary steam radiation.
Item e, containment temperature, is
. -"'f"
- redundant in its usage with containment pressure.
Items a and b, which monitor shutdown cooling, are backed up by other parameters such as Subcooled margin which would also indicate inadequate shut-down cooling.
Thus, the combination of redundant inputs and functional redundancy provided for parameters having only a single input are adequate to provi~e the operator with valid safety.function data.
Based upon our review of the licensee's information on data valida-
- tion, the staff confirms that a suitable method is being used to validate data.
3.5 Human Factors Program
~-.. "'-
The staff evaluated the licensee's safety analysis for a commitment to a Human Factors Program to.ensure that the displayed informati6n can be readily perceived and comprehended so ai nbt to mislead the
- operator.
Our review found a structured display hie*rarchy consist-ing of three levels:
Level 1 - Overall Status Level 2 - Function Status Level 3 - Subfunction Status
- ~-*-
- Level 1 provides the operator with a concise display of the status of the critical safety functions.
This display consists of a 3 x 3 matrix of alarm windows providing the status of the functions.
The first seven of these functions are those safety functions identified in the 11Combustion Engineering Emergency Operating Pro-cedure-Guidelines (CEN-152), which represent an integration of emergency response resources and aids.
Level 2 displays are gener-ally mimic diagrams of major plant systems showing values of important parameters and the status of major components.
Level 3 displays are generally mimics, which.provide additional.information on subsystems of maj~r systems.
Associated with each critical function alarm window*. in Level 1 is a sector number.
This sector number is us.ed by opera~ors in accessing Level 2'di.splays.
Additional sector numbers are located in the Level 2 displays and are utilized by operators to access Level 3 displays.
To move from display to display within the hierarchy, a keyboard is provided the user.
There are three methods of getting to any particular page.
The first method uses a PAGE function key, which.
provides direct access to any disp.Jv.v i~. the system.
The second method utilizes the SECTOR key in association with the sector num-ber within the display.
The third method utilizes the FORWARD and BACK key, which allows for multi-page display capability and for lateral movement through the display hierarchy.
- e. The heart of the Critical Function Monitor/SPDS is the top level critical function display.
This display utilizes a set of alarm algorithms to monitor the status of the crit,ical safety functions and alert the operator when one or more of the functions are vio-lated.
The licensee states that the alarm algorithms are designed to apply during any mode of plant operation.
The staff has not reviewed.the alarm algorithms and setpoints, but we endorse the alarm concept as a means of obtaining the user~s attention upon the violation of a safety function.
In addition, the semantic effort and command syntax required of a user to evaluate the Critical Safety Functions ap"pear to be mini ma l.
Colors-are. use*d in the displays to classify information and assist the user in the search task.
Eight ~~lor~ are used.on a black background.
A standard for the use of color was defined and used in the,design.
The use of red/green to indicate equipment statui is consistentwith the use of red/gr-een utilized on the.main control panels.
The staff endorses*the consistent use of color within the display system and the control room.
By letter dated August 29, 1986, the licensee responded to staff.
queries on display clutter and human.tac~or guidelines used.in the development of the display.
The Critical Function Monitoring System (CFMS) methodology utilized at the Palisades Plant evolved from Combustion Engineering 1 s design efforts on the NUPLEX 80
+-:-.-:- - - -.- --.-
- e. advanced control center for nuclear power plants.
This effort, which commenced prior to requirements for an SPD~, developed human engineering principles to be used in designing color graphic dis-plays.
The guidelines for color coding and for shape coding of data and for information density are described in deta i1 within the letter.
Our review of the color coding guidelines found them to be consis-tent with the previous data submitted by the licensee.
The choice of symbols utilized for the video displays is based on an experimental analysis of a plant operator preferred symbology research project. *Many operators from different utilities contri-buted to this project.
~hape coding of the symbols is--u-sed in co'njunction with colbr coding as a redundant indication of component status.
By altering.
the configuration of a symbol, component operating status informa-tion is displayed.to the operator.
For example; a hollow red valve symbol is used to represent a~ open valv~. ~nd a filled-in green valve symbol is used to represent a closed valve.
The hollow and fille9-in shape coding allows proper interpr'etation of non-color hard copies of the displays.
Several of the hard copy displays submitted with the licensee's letter dated August 21, 1985 do appear somewhat cluttered.
These copies contained a grid surrounding the display, which is used for
- e. display development.
These grids are not included in displays presented to the operator thus reducing the apparent clutter.
Further, the black and white hard copies of the displays do not fully represent the screen as actually viewed by an operator.
Non-essential information, such as labels and other static items, is colored dark blue.
The poor contrast of dark blue on black reduces the impact of the noise while stil1 allowing the label to serve as information when. focused on.* However, because the copying process does not provide an effective demonstration of these contrast differ-ences, the CRT displays do not appear as *cl uttered to an operator as might be inferred 'from the hard copies.
Based on our limited review of display formats and our rev1ew of the display system;-the staff C:cinfirni's that human factors engineer-
---~ ing was an integral" *part of the licensee's design process.
3.6 Verification and Validation Program The staff evaluated the licensee's design for the use of a Verifi-cation and Validation Program in the development of the display system.
Consumers Power Company's response of May 19, 1986 noted that the Palisades CFMS was pro~ur~d.,Pri~T to the formal require-ments for verification and validation being issued by the NRC and, therefore, no formal validation and verification plan was used in the design of the Palisades CFMS.
However, Consumers Power Company
- e. noted that an experimental validation test program of the CFMS
. design philosophy had been conducted and committed to providing information on this program of man-in-the-loop validation testing.
An experimental validation of the Critical Function Monitoring System (CFMS) was carried out as part of the Halden Project as a joint effort among Combustion Engineering, the Technical Research Center of Finland (VTT) and Imatran Noima Oy (IVO).
The experi-ments took place at the PWR training simulator situated at the Loviisa Nuclear Power Plant in Finland.
The overall objective of the test program was to determine the impact of the CFMS on opera-tor performance and hence, on op~rational safety.
The experiment was designed to record and measure operator pe.rformance both with and without the use -Of the CFMs-;- to cissess the correspondence
~-*-between the expect~-d and actual effect;-~f operator use of the CFMS, 'to deve~op predic{ions about operator performance when using the CFMS, and to determine what problems might be expected from introducing the CFMS into an existing control room.
Although there are differences between the experimental system tested at Loviisa and the Palisades CFMS, the differences are
. primarily in the CRT display fo.rmat.lnd ~-re attributable to differ-ences between plant designs and in the selection of specific plant process parameters monitored, not in the basic structure or design philosophy of the CFMS.
Thus, these differences do not invalidate
-I9-the:conclusions of the Loviisa test program when the test results are applied to the Palisades CFMS.
Therefore, based on the similar-ities of design and operating philosophy between the experimental CFMS tested at Loviisa and the Palisades CFMS, Consumers Power Company has concluded that the results of the Loviisa man-in-the-loop validation experiment are applicable to the Palisades CFMS.
The staff agrees with these conclusions.
However, the staff recommends that future modifications to the display system be verified and validated prior to their operational implementation.
3,7 Electrical and EleEtronic Isblation The licensee 1s sa*fety analysis report did not address the require-ment that the SPDS-must be isolated from equipment and sensors that
- ~--*-
are used in safety systems to. prevent el ectri cal and el e.ctroni c interference.
A request for additional information was forwarded to the licensee by letter dated May 9, I985.
The requested infor-matiori was received by letter dated August 21, I985.
The computer based SPDS, which is non-class-IE, uses ~ome of the plant 1 s class-IE signals as well as non-class-IE signals.
The class-IE signals are interfaced wit~the,_SPDS by means of multi-plexer cabinets, which are* also class-IE.
The non-class-IE signals are also interfaced with the SPDS by means of a multiplexer cabinet.
Three separate multiplexer cabinets are used.
One cabinet is pro-vided for left safety channel input signals, one for right safety
- channel input signals, and one for non-class-IE signals.
Signal
.... isolation is provided by use of fiber-optic communication links between safety and non-safety input multiplexer cabinets.
As the fiber-optic links are non-metallic, eiectrical faults in one multi-plexer cabinet cannot propagate to any other multiplexer cabinet.
Fiber-optic cables are totally dielectric:
With a dielectric con; stant four to seven tim~s higher than dry air, their isolation capability is four to seven times greater than that of dry air.
Thus, the maximum credible fault (MCF) voltage/current cannot pro-pagate from one end of the cable to the other end of the cable.
Anoj:.her characteristic of ~he_ fiber-optic cable is its non-suscepti-bility to the coupling of cross~ta*lk and electromagnetic inter-.
~-.*-
--~
ference (EMI).
Ground loop* problems inherent with cabling systems.
are also eliminated.
Based on our review of the licensee's information on the isolation.
devices used, we conclude that the fiber-optic cable used for interfacing the SPDS with safety-related systems is acceptable, and that the equipment meets the Commission's requirements of*'.
NUREG-0737, Supp 1 ement No. 1.
4.0 CONCLUSION
S The NRC staff reviewed Consumers Power Company's Palisades Safety Analysis to confirm the adequacy of the variables selected to be displayed to
- e. monitor critical safety functions, to confirm that means are provided to assure that the data displayed are valid, to confirm that the licensee has committed to i Human Factors Program, to ensure that the displayed i*nformation can be readily perceived and comprehended so as not to mislead the operator, and to confirm that the SPDS is suitably isolated.
Based on its review to date, the staff concludes that no serious safety questions are posed by the proposed SPDS and, therefore,
.the implementation of the SPDS may continue.
Furthermore, we recommend that the display of hot leg temperature, cold leg temperature, steam generator pressure, and containment sump level be retained within the system to aid in monitoring.the critical safety functions.
The conclusions that SPDS implementation may continue does not imply L
that the.SPDS meets o~ ~111 meet the requi~e~~~ts of Supplement 1 to
~*~"-
.such corifirmation can-be made only after a post~implemen-tati9n audit pr when sufficient information is available for the staff to make such a determination.
An appropriate implementation schedule ~ill be developed*by the Project Mana~er via discussions with the licensee.
Licensees are required to inform the Commission, in writing, of any significant changes in the es-timated completion schedule identified i-n.the.staff's safety evaluation and when the action has actually been completed.
5.0 REFERENCES
- 1.
U.S. Nuclear Regulatory Commission, "Clarification of TM! Action Plan Requirements, Requirements For Emergency Response Capability,i 1
U.S. NRC Report NUREG-0737, Supplement 1, January 1983.
- 2.
Letter f.rom 8.D. Johnson, Consumers Power Company, to D.M. Crutchfield, NRC,
Subject:
Palisades Plant - Supplement 1 to NUREG-0737 - Safety Parameter Display System - Preliminary Safety Analysis Report and
.Implementation Schedule, Regulatory _Guide 1. 97, Variables Available at Emergency Respons*e Facilities,.dated October 31, 1984.
~*
Letter from D. J*. VandeWall e, Consumers Power Company, to Di rector, Nuclear Reactor Regulation, Sub}ect: Palisades Plant - Supplement l*
- -~-to NUREG-0737* -.. Safety Parameter Display System - Revi?ed Prelimin-.
ary Report, dated August 21, 1985.
- 4.
Letter from J.A. Zwolinski, NRC, to D.J. Vandewalle, *consumers Power Company,
Subject:
Request for Additional Information on Isol~tion.
Devices, dated May 9, 1985. *
- 5.
Letter from A.C.. Thadani, NRC, to K.. w. Ber;ry, Consumers Power Company,
Subject:
Palisades Plant-Safety Parameter Display System (SPDS)
NUREG-0737, Supplement 1, dated March 17, 1986.
i:
- e. 6.
Letter from K.W.' Berry, Consumers Power Company, to Director, Nuclear
- 7.
- 8.
Reactor Regulation,
Subject:
Response To_ Request For Additional Information - Palisades Plant Safety Parameter Display System, dated May 19, 1986.
Letter from D.G. Eisenhut, NRC, to R.W. Wells, (CEOG),
Subject:
Safety Evaluation of Emergency Procedure Guidelines, For CEN-152, Revision 1, dated July 29, 1983.
Letter from.J.A. Zwolinski, NRC, to R.W. Wells, (CEOG),
Subject:
Supplement 1 To Safety Evaluat_ion Report For. CEN-152, Combusti~n Engineering Emergency Procedure Guidelines, dated April 6, 1985.
- 9.
Letter from K. W. *Be-fry, Consume*r*s Power Company, to Di rector,
~-*-Nuclear Reactor Regulation, NRC, Subje.ct; s*afety Pa_rameter Display
~ystem, Clutter and Verification *and Validation, dated August 29, 1986.
. ii e.
TABLE 1 SAFETY FUNCTIONS AND VARIABLES PALISADES PLANT SAFETY FUNCTION REACTIVITY CONTROL PRIMARY COOLANT.SYSTEM INVENTORY CONTROL.
_.,___4_
- ~
PRIMARY COOLANT SYSTEM PRESSURE CONTROL
-**o-VARI AB Lt Startup Count Rate Wide.Range Power Pressurizer level
- Reactor Vessel Level Subcooled Margin*
f(T-hot, T-cold,.
core exit temp, pressurizer pressure)
Pressurizer Pressure I
_f Subcooled Margin f(T-hot, T-cold, core exit temp, pressurizer pressure)
CORE HEAT REMOVAL PRIMAR.Y COOLANT *svsTEM HEAT. REMOVAL CONTAINMENT ATMOSPHERE CONTROL Core T (T-hot - T-cold)
Subcooled Margin f(T-hot, T-cold, core exit temp, pressurizer pressure)
Core Exit Temperatures Steam Generator Level Feedwater Flow main auxiliary Shutdown Cooling.Flow Shutdown Heat Exchanger Inlet Temperature Containment Ptessure Containment Temperature Containment Hydrogen
- Concentration
e.
- CONTAINMENT ISOLATION ENVIRONMENTAL CONTROl
--~
Containment Pressure Containment Radiation Alarm, if one or more of the isolation valves is open when required to be closed Condenser Off Gas Radiation Stack Radiation Steam Line Radiation Containment Radiation