Text

Proposed Tech Specs Re Reactor Protection Sys.Affidavit Encl
	ML18053A290
Person / Time
Site:	Palisades
Issue date:	03/25/1988
From:	; CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:	;
Shared Package
ML18053A288	List: ML18053A287; ML18053A289; ML18053A290;
References
	NUDOCS 8804130049
	Download: ML18053A290 (177)
	v • d • e

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS - APPENDIX A SECTION DESCRIPTION PAGE NO 1.0 DEFINITIONS 1-1 1.1 REACTOR OPERATING CONDITIONS 1-1 1.2 PROTECTIVE SYSTEMS 1-3 1.3 INSTRUMENTATION SURVEILLANCE 1-3 1.4 MISCELLANEOUS DEFINITIONS 1-4 I .

2.0 SAFETY LIMITS AND LIMITING SAFETY SYSTEM *SETTINGS 2-1 2.1 SAFETY LIMITS - REACTOR CORE 2-1 2.2 SAFETY'LIMITS - PRIMARY COOLANT SYSTEM PRESSURE 2-3 2.3 LIMITING SAFETY SYSTEM SETTINGS - REACTOR PROTECTIVE SYSTEM 2-4 Table 2.3.1 Reactor Protective System Trip Setting Limits 2-5 I

3.0 LIMITING CONDITIONS FOR OPERATION 3-1 3.0 APPLICABILITY 3-1 3.1 PRIMARY COOLANT SYSTEM 3-lb 3.1.1 Operable Components 3-lb Figure 3-0 Reactor Inlet Temperature vs Operating Pressure 3-3a 3.1.2 Heatup and Cooldown Rates 3-4 Figure 3-1 Pressure - Temperature Limits for Heatup 3-9 Figure 3-2 Pressure - Temperature Limits for Cooldown 3-10 Figure 3-3 Pressure - Temperature Limits for Hydro Test 3-11 3.1.3 Minimum Conditions for Criticality 3-12 3.1.4 Maximum Primary Coolant Radioactivity 3-17 3.1.5 Primary Coolant System Leakage Limits 3-20 3.1.6 Maximum Primary Coolant Oxygen and Halogens Concentrations 3-23 3.1. 7 Primary and Secondary Safety Valves 3-25 3.1.8 Overpressure Protection Systems 3-25a 3.2 CHEMICAL AND VOLUME CONTROL SYSTEM 3-26 3.3 EMERGENCY CORE COOLING SYSTEM 3-29 3.4 CONTAINMENT COOLING 3-34 3.5 .STEAM AND FEEDWATER SYSTEMS 3-38 3.6 CONTAINMENT SYSTEM 3-40 3.7 ELECTRICAL SYSTEMS 3-41 3.8 REFUELING OPERATIONS 3-46 3.9 EFFLUENT RELEASE (DELETED) 3-50 i

Amendment No. *ii, jt, j7, ~j, t~~'

TSP1287-0253-NL04

(---~- 8804130049-s::::ccrzs----°'. -

~ PDR ADOCK 05000255 '

P , DC:D

ATTACHMENT Consumers Power Company Palisades Plant Docket 50-255 TECHNICAL SPECIFICATIONS PAGE CHANGES REACTOR PROTECTION SYSTEM March 25, 1988 47 Pages TSP1287-0253-NL04

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS - APPENDIX A

SECTION 3.0 3.10 DESCRIPTION LIMITING CONDITIONS FOR OPERATION (Continued)

CONTROL ROD AND POWER DISTRIBUTION LIMITS PAGE NO 3-58 3.10.1 Shutdown Margin Requirements 3-58 3.10.2 (Deleted) 3-58 I 3.10.3 Part-Length Control Rods 3-58 3.10.4 Misaligned or Inoperable Control Rod or Part-Length Rod 3-60 3.10.S Regulating Group Insertion Limits 3-60 3.10.6 Shutdown Rod Limits 3-61 3.10. 7 Low Power Physics Testing 3-61 3.10.8 Center Control Rod Misalignment 3-61 Figure 3-6 Control Rod Insertion Limits 3-62 3.11 POWER DISTRIBUTiON INSTRUMENTATION 3-65 3.11.1 Incore Detectors 3-65 3.11.2 Excore Power Distribution Monitoring System 3-66a Figure 3.11-1 Axial Variation Bounding Condition 3-66d 3.12 MODERATOR TEMPERATURE COEFFICIENT OF REACTIVITY 3-67 3.13 CONTAINMENT BUILDING AND FUEL STORAGE BUILDING CRANES 3-69 3.14 CONTROL ROOM VENTILATION 3-70 3.15 REACTOR PRIMARY SHIELD COOLING SYSTEM 3-70a 3.16 ENGINEERED SAFETY FEATURES SYSTEM INITIATION INSTRUMENTATION SETTINGS 3-71 Table 3.16.1 Engineered Safety Features System Initiation Instrument Setting Limits 3-75 3.17 INSTRUMENTATION AND CONTROL SYSTEMS 3-76 Table 3.17.1 Instrumentation Operating Requirements for Reactor Protective System 3-78 Table 3.17.2 Instrumentation Operating Requirements for Engineered Safety Feature Systems 3-79 Table 3.17.3 Instrument Operating Conditions for Isolation Functions 3-80 Table 3.17.4 Instrumentation Operating Requirements for Other Safety Feature Functions 3-81 3.18 (Deleted) 3-82 I I

3.19 IODINE REMOVAL SYSTEM 3-84 3.20 SHOCK SUPPRESSORS (SNUBBERS) 3-88 I

I 3.21 MOVEMENT OF SHIELDED SHIPPING CASK IN FUEL HANDLING AREAS 3-92 3.22 FIRE PROTECTION SYSTEM 3-96 3.22.1 Fire Detection Instrumentation 3-96 Table 3.22.1 Fire Detection Instrumentation - Minimum Instruments Operable 3-97 ii Amendment No. $7, $$, ~~' ~1, ~$, 1~~' It~,

TSP1287-0253-NL04

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS - APPENDIX A SECTION DESCRIPTION PAGE NO

4. 0 SURVEILLANCE REQUIREMENTS (Continued)

Table 4.11-3 Detection Capabilities for Environmental Sample Analysis 4-57 4.11.1 Bases for Monitoring Program 4-59a 4.11.3 Bases for Land Use Census 4-59a 4.11.5 Bases for Interlaboratory Comparison Program 4-59a 4.12 AUGMENTED INSERVICE INSPECTION PROGRAM FOR HIGH ENERGY LINES OUTSIDE OF CONTAINMENT 4-60 Fig. 4.12 A Augmented Inservice Inspection Program - Main Steam Welds 4-63 Fig. 4.12 B Augmented Inservice Inspection Program - Feedwater Line Welds 4-64 4.13 REACTOR INTERNALS VIBRATION MONITORING (DELETED) 4-65 4.14 AUGMENTED INSERVICE INSPECTION PROGRAM FOR -

STEAM GENERATORS 4-68 Table 4.14.1 Operating Allowances 4-68d Table 4.14. 2 Maximum Allowable Degradation 4-69 4.15 PRIMARY SYSTEM FLOW MEASUREMENT 4-70 4.16 INSERVICE INSPECTION PROGRAM FOR SHOCK SUPPRESSORS (SNUBBERS) 4-71 4.17 FIRE PROTECTION SYSTEM 4-75 4.17.1 Fire Detection Instrumentation 4-75 4.17.2 Fire Suppression Water System 4-76 4.17.3 Fire Sprinkler System 4-78 4.17.4 Fire Hose Stations 4-79 4.17.5 Penetration Fire Barriers 4-80 4.18 POWER DISTRIBUTION INSTRUMENTATION 4-81 4.18.1 Incore Detectors 4-81 4.18.2 Excore Monitoring System 4-82 4.19 POWER DISTRIBUTION LIMITS 4-83 4.19.1 Linear Heat Rate 4-83 4.19.2 Radial Peaking Factors 4-84 4.20 Moderator Temperature Coefficient (MTC) 4-85 I 4.21 (Intentionally Left Blank) 4-86 4.22 (Intentionally Left Blank) 4-87 4.23 (Intentionally Left Blank) 4-88 (Intentionally Left Blank) 4-89 4.24 RADIOLOGICAL EFFLUENT RELEASES 4-90 4.24.1 Radiological Liquid Effluent Monitoring Instrumentation 4-90 4.24.2 Radiological Gaseous Effluent Monitoring Instrumentation 4-90 4.24.3 Liquid Effluent Concentration 4-90 4.24.4 Liquid Effluent Dose 4-90 4.24.5 Gaseous Effluent Dose 4-90 v

Amendment No. i7, ~~' ~i~ ~7, ~~' ~$, t~~'

TSP1287-0253-NL04

1.1 REACTOR OPERATING CONDITIONS (Cont'd)

Axial Offset or Axial Shape Index I The difference between the power in the lower half of the core and the upper half of the core divided by the sum of the powers in the lower half and upper half of the core.

Narrow Water Gap Fuel Rod A fuel rod adjacent to the narrow interfuel assembly water gap (a gap not containing a control rod).

Narrow Water Gap Fuel Rod Peaking Factor -~r The maximum product of the ratio of individual fuel assembly power to core average fuel assembly power times the highest narrow water gap fuel rod local peaking factor integrated over the total core height including tilt. .

1-2a TSP1287-0253-NL04

2.0 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS 2.1 SAFETY LIMITS - REACTOR CORE Applicability This specification applies when the reactor is in hot standby I condition and power operation condition. I Objective To maintain the integrity of the fuel cladding and prevent the release of significant amounts of fission products to the primary coolant.

Specifications The MDNBR of the reactor core shall be maintained greater than or equal I to 1.11. I I

Basis To maintain the integrity of the fuel cladding and prevent fission product release, it is necessary to prevent overheating of the cladding under normal operating conditions. This is accomplished by operating within the nucleate boiling regime of heat transfer, wherein the he.at transfer coefficient is large enough so that the. clad surface temperature is only slightly greater than the coolant temperature. The upper boundary of the nucleate boiling regime is termed "departure from nucleate boiling" (DNB). At this point, there is a sharp reduction of the heat transfer coefficient, which would result in high-cladding temperatures and the possibility of cladding failure. Although DNB is not an observable parameter during reactor operation, the observable parameters of thermal power, primary coolant flow, temperature and pressure, can be related to DNB through the use of the XNB DNB /

Correlation."(l) The XNB DNB Correlation has been developed to predict I DNB and the location of DNB for axially uniform and nonuniform heat flux distributions. The local DNB ratio (DNBR), defined as the ratio of the heat flux that would cause DNB at a particular core location to the actual heat flux, is indicative of the margin to DNB. The minimum value of the DNBR, during steady-state operation, normal operational transients, and anticipated transients is limited to 1.17. A DNBR of I 1.17 corresponds to a 95% probability at a 95% confidence level that I

TSP1287-0253-NL04 2-1 Amendment No

2.1 SAFETY LIMITS - REACTOR CORE (Contd)

DNB will not occur which is considered an appropriate margin to DNB for I all operating conditions. (l)

I I

The reactor protective system is designed to prevent any anticipated combination of transient conditions for .primary coolant system temperature, pressure and thermal power level that would result in a DNBR of less than 1.17( 3 ) The XNB DNB correlation has been shown to be /

applicable to the Palisades Plant in Reference 2. I I

References I I

(1) XN-NF-621(P)(A), Rev 1 /

(2) XN-NF-709 I (3) Updated FSAR, Section 14.1. I

TSP1287-0253-NL04 2-2 Amendment No

2.2 SAFETY LIMITS - PRIMARY COOLANT SYSTEM PRESSURE Applicability Applies to the limit on primary coolant system pressure.

Objective To maintain the integrity of the primary coolant system and to prevent the release of significant amounts of fission product activity to the primary coolant.

Specification The primary coolant system pressure shall not exceed 2750 psia when there are fuel assemblies in the reactor vessel.

Basis The primary coolant system(l) serves a~ a barrier to prevent radionuclides in the primary coolant from reaching the atmosphere. In the event of a fuel cladding failure, the primary coolant system is the foremost barrier against the release of fission products. Establishing a system pressure limit helps to assure the continued integrity of both the primary coolant system and the fuel cladding. The maximum

transient pressure allowable in the primary coolant system pressure vessel under the ASME Code,Section III, is 110% of design pressure.

The maximum transient pressure allowable in the primary coolant system piping, valves and fittings under ASA Section B31.1 is 120% of design pressure. Thus, the safety limit of 2750 psia (110% of the 2500 psia design pressure) has been established. ( 2 ) The settings and capacity of the secondary coolant system.saf~ty valves (985-1025 psig)( 3 ), the reactor high-pressure trip (~2400 psia) and the primary safety valves (2500-2580 psia)( 4 ) have been established to assure never reaching the primary coolant system pressure safety limit. The initial hydrostatic test was conducted at 3125 psia (125% of design pressure) to verify the integrity of the primary coolant system. Additional assurance that the nucl.ear steam supply system (NSSS) pressure does not exceed the safety limit is provided by setting the secondary coolant system steam dump and I bypass valves at 900 psia.

References (1) Updated FSAR, Section 4. I (2) Updated FSAR, Section 4.3. I (3) Updated FSAR, Table 4-5 I (4) Updated FSAR, Table 4-10 I

TSP1287-0253-NL04 2-3 Amendment No t$,

2.3 LIMITING SAFETY SYSTEM SETTINGS - REACTOR PROTECTIVE SYSTEM Applicability This specification applies to reactor trip settings and bypasses for instrument channels.

Objective To provide for automatic protective action in the event that the principal process variables approach a safety limit.

Specification The reactor protective system trip setting limits and the permissible bypasses for the instrument channels shall be as stated in Table 2.3.1.

The TM/LP trip system monitors core power, reactor coolant maximun I inlet temperature, (T. ), core coolant system pressure and axial shape in I

index. The low pressure trip limit (P var

) is calculated using the I following equation. I p 1563.7(QA)(QR 1) + 12.3(Tin) - 6503.4 I var where:

0.412(Q) + 0.588 Q 2 1.0 Q core power I Q Q > 1.0 rated power I QA -0.691(ASI) + 1.058 -0.653 < ASI < -0.156 I

-0.521(ASI) + 1.085 -0.156 < ASI < +o.162 I 0.226(ASI) + 0.964 +0.162 < ASI < +0.544 I The calculated limit (P ) is then compared to a fixed low pressure I var trip limit (Pi).

mn The auctioneered highest of these signals becomes I the trip limit (Ptrip). P i is compared to the measured reactor tr p I coolant pressure (P) and a trip signal is generated when P is less I than or equal to P i

A pre-trip alarm is also generated when P tr p I is less than or equal to the pre-trip setting Ptrip + bP. I 2-4 Amendment No TSP1287-0253-NL04

TABLE 2.3.1 I I

Reactor Protective System Trip Setting Limits I I

I Four Primary Coolant Three Primary Coot~~t I Pumps Operating Pumps Operating I I

1. Varia~!' High ~10% above core power, ~10% above core power I Power with a minimum setpoint with a minimum setpoint I of ~30% of rated power of ~15% rated power I and a maximum of ~106.5% and a maximum of ~49% I of rated power of rated power I I

2. Primary ~95% of Primary Coolant ~60% of Primary Cool- I Coolant Flow( 2 ) Flow With Four Pumps ant Flow With Four I 1 Operating Pumps Operating I I

3. High Pressure ~2255 Psia ~2255 *Psia I Pressurizer I I

4. Thermal ~~r§tn/Low p, trip

~ Applicable Limits Replaced by Variable I Pressure ' High Power Trip and : . I 1750 Psia Minimum Low- I Pressure Setting I I

5. Steam Generator Not Lower Than the Cen- Not Lower Than the Cen- I Low Water Level ter Line of Feed-Water ter Line of Feed-Water I Ring Which Is Located Ring Which Is Located I : I 6'-0" Below Normal 6'-0" Below Normal I Water Level Water Level I I

6. Steam Generat2) ~500 Psia ~500 Psia I Low Pressure I I

7. Containment High ~3.70 Psig ~3.70 Psig I Pressure I I

(1) The VHPT can be 30% of rated power for power levels ~ 20% of rated I power. _ I 4

(2) May be bypassed below 10 % of rated power provided auto bypass removal circuitry is operable. For low power physics tests, thermal margin/low pressure, primary coolant flow arid low steam generator pressure trips may I be bypassed until their react points are reached (approximately 1750 psia and 5Qq psia, respectively), provided automatic bypass removal circuitry at 10 % rated power is operable.

(3) Minimum trip setting shall be 1750 psia. I (4) Operation with three pumps for a maximum of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is permitted to I provide a limited time for repair/pump restart, to provide for an orderly I shutdown or to provide for the conduct of reactor internals noise I monitoring test measurements. I 2-5 Amendment No ~~'

TSP1287-0253-NL04

2.3 LIMITING SAFETY SYSTEM SETTINGS - REACTOR PROTECTIVE SYSTEM (Contd)

Basis The reactor protective system consists of four instrument channels to monitor selected plant conditions which will cause a reactor trip if any of these conditions deviate from a preselected operating range to the degree that a safety limit may be reached.

1. Variable High Power - The variable high power trip (VHPT) is I incorporated in the reactor protection system to provide a reactor I trip for transients exhibiting a core power increase starting from I any initial power level (such as the boron dilution transient). I The VHPT system provides a trip setpoint no more than a I predetermined amount above the indicated core power. Operator I action is required to increase the setpoint as core power is I increased; the setpoint is automatically decreased as core power I decreases. Provisions have been made to select different set points I for three pump and four pump operations. I During normal plant operation with all primary coolant pumps operating, reactor trip is initiated when the reactor power level reaches 106.5% of indicated rated power. Adding to this the possible variation in trip point due to calibration and instrument errors, the maximum actual steady state power at which a trip would be actuated is 112%, which was used for the purpose of safety analysis.Cl)

I I

I

2. Primary Coolant System Low Flow - A reactor trip is provided to I protect the core against ~NB should the coolant flow suddenly decrease significantly. 3 Flow in each of the four coolant loops /

is determined from a measurement of pressure drop from inlet to outlet of the steam generators. The total flow through the reactor core is measured by summing the loop pressure drops across the steam generators and correlating this pressure sum with the pump calibration flow curves. The percent of normal core flow is shown in t~e following table: I 4 Pumps 100.0%

3 Pumps 74.7%

I During four-pump operation, the low-flow trip setting of 95%

insures that the reactor cannot operate when the flow rate is less tht~)93% of the nominal value considering instrument errors. .

I 2-6 Amendment No '/)1.,

TSP1287-0253-NL04

2.3 LIMITING SAFETY SYSTEM SETTINGS - REACTOR PROTECTIVE SYSTEM (Contd)

Basis (Contd)

Provisions are made in the reactor protective system to permit I operation of the reactor at reduced power if oµe coolant pump is I taken out of service. These low-flow and high-flux settings have I been derived in consideration of instrument errors and response I times of equipment involved to assure that thermal margin and flow I stability wtst be maintained during normal operation and anticipated I transients. For reactor operation with one coolant pump I inoperative, the low-flow trip points and the overpower trip points I must be manually changed to the specified values for the selected I pump condition by means of set point selector switches. The trip I points are shown in Table 2.3.1. I

3. High Pressurizer Pressure - A reactor trip for high pressurizer I pressure is provided in conjunction with the primary and secondary safety valves to prevent primary system overpressure (Specifica~ion 3.1.7). In the event of loss of load without reactor trip, the temperature and pressure of the primary coolant system would increase due to the reduction in the heat removed from the coolant via the steam generators. This setting is consistent with the I trip point assumed in the accident analysis. (ll) 2-7 Amendment No it, TSP1287-0253-NL04

2.3 LIMITING SAFETY SYSTEM SETTINGS - REACTOR PROTECTIVE SYSTEM (Continued)

Basis 4.

(Continued)

Thermal Margin/Low-Pressure Trip The TM/LP trip set points are derived from the 4-pump operation core thermal limits through application of appropriate allowances I

/

I for measurement uncertainties and processing errors. I A pressure allowance of 165 psi is assumed to I account for: instrument drift in both power and inlet temperatures; I calorimetric power measurement; inlet temperature measurement; and I primary system pressure measurement. Uncertainties accounted for I that* are not a part of the 165 psi term include allowances for: I assembly power tilt; fuel pellet manufacturing tolerances; core I flow measurement uncertainty and core bypass flow; inlet temperature I measurement time delays; and ASI measurement. Each of these I allowances and uncertainties are included in the development of I the TM/LP trip set point used in the accident analysis. I For three-pump operation, continued power operation is limited to I for a maximum of.12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . During this mode of operation, the I high power level trip in conjunction with the TM/LP trip (minimum /

set point = 1750 psia) and the secondary system safety valves /

~set ~t a~proxt~'tely 1000 psia) assure that adequate DNB margin I is maintained. I I

I I

I

5. Low Steam Generator Water Level - The low steam generator water level reactor trip protects against the loss of feed-water flow accidents and assures that the design pressure of the primary coolant system will not be exceeded. The specified set point assures that there will be sufficient water inventory in the steam generator at the time of trip to allow a safe and orderly /

plant shutdown and to prevent steam generator dryout assuming /

minimum auxiliary feedwater capacity. (g) . /

The setting listed in Table 2.3.1 assures that the heat transfer surface (tubes) is covered with water when the reactor is critical.

2-8 Amendment No it, it, TSP1287-0253-NL04

2.3 LIMITING SAFETY SYSTEM SETTINGS - REACTOR PROTECTIVE SYSTEM (Contd)

Basis (Contd)

6. Low Steam Generator Pressure - A reactor trip on low steam generator secondary pressure is provided to protect against an excessive rate of heat extraction from the steam generators and subsequent cooldown of the primary coolant. The setting of 500 psia is sufficiently below the rated load operating point of 739 psia so as not to interfere with normal operation, but still high enough to provide the required protection in the event of excessively high steam flow. This setting was used in the accident analysis. ( 8 ) .

7. Containment High Pressure - A reactor trip on containment high pressure is provided to assure that the reactor is shut down before I the intrb,tion of the safety injection system and containment /

spray. I

8. Low Power Physics Testing - For low power physics tests, certain tests will require the reactor to be critical at low temperature_ .

(> 260°F) and low pressure. (> 415 psia) . For these certain tests only, the thermal margin/low-pressure, primary coolant flow and low I steam generator pressure trips may be bypassed in order that reactor power can be increased for improved data acquisition. Special operating precautions will be in effect during these tests in accordance with approved written testing procedures. At reactor

. -1 power levels below 10 % of rated power, the thermal margin/low-pressure trip and low flow trip are not required to prevent fuel I rod thermal limits from being exceeded. The low steam generator pressure trip is not *required because the low steam generator pressure will not allow a severe reactor cooldown, should a steam line break occur during these tests.

References (1) ANF-87-150(P), Volume 2, Table 15.0.7-1 I (2) deleted I (3) Updated FSAR, Section 7.2.3.3. I (4) ANF-87-150(P), Volume 2, Section 15.3 I (5) XN-NF-86-91(P) I (6) deleted I (7) deleted I (8) XN-NF-77-18, Section 3.8 I (9) ANF-87-150(P), Volume 2, Section 15.2.7 I (10) Updated FSAR, Section 7.2.3.9. I (11) ANF-87-lSO(P), Volume 2, Section 15.2.1 I (12) ANF-87-lSO(P), Volume 2, Section 15.0.7.2 I I

I I

(next page is 2-13) 2-9 Amendment No it, TSP1287-0253-NL04 I _

3.1 PRIMARY COOLANT SYSTEM Applicability Applies to the operable status of the primary coolant system.

Objective To specify certain conditions of the primary coolant system which must be met to assure safe reactor operation.

Specifications 3.1.1 Operable Components

a. At least one primary coolant pump or one shutdown cooling pump with a flow rate greater than or equal to 1500 gpm shall be in /

operation whenever a change is being made in the boron I concentration of the primary coolant and the plant is I operating in cold shutdown or above, except during an emergency /

loss of coolant flow situation. Under these circumstances, the /

boron concentration may be increased with no primary coolant /

pumps or shutdown cooling pumps running. /

b. Four primary coolant pumps shall be in operation whenever the /

reactor is operated continually above hot shutdown.* I I

Before removing a pump from service, thermal power shall be /

reduced as specified in Table 2.3.1 and appropriate corrective I action implemented. With one pump out of service, return the I pump to service within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (return to four-pump operation) I or be in hot shutdown (or below) within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Start-up I (above hot shutdown) with less than four pumps is not permitted I and power operation with less than three pumps is not permitted. /

I

c. The measured four primarg coolant pumps operating reactor vessel I flow shall be 124.3 x 10 lb/hr or greater, when corrected to /

532°F. I I

I I

d. Both steam generators shall be capable of performing their heat transfer function whenever the average temperature of the primary coolant is above 325°F.

e. Maxim~ primary system pressure differentials shall not exceed the fo_llowing:

(1) Maximum steam generator operating differential of 1380 psi. I, 3-lb Amendment No it, ~

TSP1287-0253-NL04

3.1 PRIMARY COOLANT SYSTEM (Continued) 3.1.1 Operable Components (Continued)

(2) Hydrostatic tests shall be conducted in accordance with applicable paragraphs of Section XI ASME Boiler & Pressure Vessel Code (1974). Such tests shall be conducted with sufficient pressure on the secondary side of the steam generators to restrict primary to secondary pressure differential to a maximum of 1380 psi. Maximum hydrostatic test pressure shall not exceed 1.1 Po plus 50 psi where Po is nominal operating pressure.

(3) Primary side leak tests shall be conducted at normal operating pressure. The temperature shall be consistent with applicable fracture toughnes$ criteria for ferritic materials and shall be selected such that the differential pressure across the steam generator tubes is not greater than 1380 psi.

(4) Maximum secondary hydrostatic test pressure shall not exceed 1250 psia. A minimum temperature of 100°F is required. Only ten cycles are permitted.

(5) Maximum secondary leak test pressure shall not exceed 1000 psia. A minimum temperature of 100°F is required.

(6) In performing the tests identified in 3.1.1.e(4) and 3.1.1.e(5), above, the secondary pressure shall not exceed the primary pressure by more than 350 psi.

f. Nominal primary system operation pressure shall not exceed 2100 psia.

g. The reactor inlet temperature (indicated) shall not exceed the value given by the following equation at steady state power operation: /

T. 1 t ~ 543.3 + .0575(P-2060) + 0.00005(P-2060)~;+.2 + 1.173(W-120) - I in e .. 0102(W-120)**2 I Where: T. 1 t =reactor inlet temperature in F 0 in e P = nominal operating pressure in psia 6

W = total recirculating mass flow in 10 lb/h corrected to the operating temperature conditions.

When the ASI exceeds the limits specified in Figure 3.0, within I 15 minutes, initiate corrective actions to restore the ASI to I

.the acceptable region. Restore the AS! to acceptable values I within one hour or be at less than 70% of rated power within I two hours. I If the measured primary coolant system flow rate is greater I than 130 M lbm/hr, the maximum inlet temperature shall be I less than or equal to the Tinlet LCO at 130 M lbm/hr . I 3-lc Amendment No ,t, ~

TSP1287-0253-NL04

3.1 PRIMARY COOLANT SYSTEM (Cont'd) 3.1.1 0perable Components (Cont'd)

h. A reactor coolant pump shall not be started with one or more of the PCS cold leg temperatures ~ 250°F unless 1) the pressurizer water volume is less than 700 cubic feet or 2) the secondary water temperature of each steam generator is less than 70°F above each of the PCS cold leg temperatures.

i. The PCS shall not be heated or maintained above 325°F unless a minimum of 375 kW of pressurizer heater capacity is available from both buses.ID and lE. Should heater capacity from either bus lD and lE fall below 375 kW, either restore the inoperable heaters to provide at least 375 kW of heater capacity from both buses lD and lE within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in hot shutdown within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Basis When primary coolant boron concentration is being changed, the process must be uniform throughout the primary coolant system volwpe to prevent stratification of primary coolant at lower boron concentration which could result in a reactivity insertion.

Sufficient mixing of1the primary coolant is assured if one shutdown cooling or one primary coolant pump is in operation. (l) The shutdown cooling pump will circulate the primary system volume in less than 60 minutes when operated at rated capacity. By imposing a I minimum shutdown cooling pump flow rate of 1500 gpm, sufficient time I is provided for the operatof 6yo terminate the boron dilut~on under I asymmetric flow conditions. The pressurizer volume is relatively I inactive, therefore will tend to have a boron concentration higher than rest of the primary coolant system during a dilution operation.

Administrative procedures will provide for use of pressurizer sprays to maintain a nominal spread between the boron concentration in the 2

pressurizer and the primary system during the addition of boron. ( )

The FSAR safety analysis was performed assuming four primary coolant I pumps were operating for accidents that occur during reactor I operation. Therefore, reactor startup above hot shutdown is not I permitted unless all four primary coolant pumps are operating. I Operation with less than four primary coolant pumps is permitted for I a limited time to allow the restart of a stopped pump or for reactor I internals vibration monitoring and testing. I Both steam generators are required to be operable whenever the

_ temperature of the primary coolant is greater than the design temperature of the shutdown cooling system to assure a redundant heat removal system for the reactor.

3-ld Amendment No ~7, ~~,

TSP1287-0253-NL04

3.1 PRIMARY COOLANT SYSTEM (Contd)

Basis (Contd)

Calculations have been performed to demonstrate that a pressure differential of 1380 psi( 3 ) can be withstood by a. tube uniformily I thinned to 36% of its original nominal wall thickness (64% degradation), while maintaining:

(1) A factor of safety of three between the actual pressure differential and the pressure differential required to cause bursting.

(2) Stresses within the yield stress for Inconel 600 at operating temperature.

(3) Acceptable stresses during accident conditions.

I I

I Secondary side hydrostatic and leak testing requirements are consistent with ASME BPV Section XI (1971). The differential maintains stresses in the steam generator tube walls within code allowable stresses.

The minimum temperature of 100°F for pressurizing the steam generator secondary side is set by the NDTT of the mayway cover of+ 40°F.

The transient analyses were performed assuming a vessel flow at hot zero power (532°F) of 124.3 x 10 6 lb/hr minus 6% to account for flow /

measurement uncertainty and core flow bypass. A DNB analysis was I performed in a parametric fashion to determine the core inlet I temperature as a function of pressure and flow for which the I minimum DNBR is equal to 1.17. This analysis includes the /

following uncertainties and allowances: 2% of rated power for power I measurement; +/-0.06 for ASI measurement; +/-SO psi for pressurizer I pressure; +/-7°F for inlet temperature; and 3% measurement and 3% I bypass for core flow.* In addition, transient biases were included in I 4

the derivatio~ ~f the following equation for limiting reactor inlet I temperature: I I

T ~ 543.3 + .057S(P-2060) + O.OOOOS(P-2060)**2 + 1.173(W-120) - /

inlet

.0102(W-120)**2 I I

The limits of validity of this equation are: I 1800 < Pressure < 2200 Psia I ,

100.0-x 10 6 ~ Vessel Flow ~ 130 x 10 6 Lb/h I ASI as shown in Figure 3.0 I With measured primary coolant system flow rates > 130 M lbm/hr, I limiting the maximum allowed inlet temperature to the Tlnlet LCO I at 130 M lbm/hr increases the margin to DNB for higher PCS flow rates. I 3-2 Amendment No i~, 51, TSP1287-0253-NL04

3.1 PRIMARY COOLANT SYSTEM (Contd)

Basis (Contd)

The Axial Shape I~dex alarm channel is being used to monitor the AS! I to ensure that the assumed axial power profiles used in the I development of the inlet temperature LCO bound measured axial power I profiles. The signal representing core power (Q) is the auctioneered I higher of the neutron flux power and the Delta-T power. The measured I AS! calculated from the excore detector signals and adjusted for I shape annealing (Y ) and the core power constitute an ordered pair 1 I (Q,Y1 ). An alarm signal is activated before the ordered pair exceed I the ooundaries specified in Figure 3.0. . I The restrictions on starting a Reactor Coolant Pump with one or more PCS cold legs ~ 250°F are provided to prevent PCS pressure transients, caused by energy additions from the secondary system, which would exceed the limits of Appendix G to 10 CFR Part 50. The PCS will be protected against overpressure transients and will not exceed the limits of Appendix G by either (1) restricting the water volume in the pressurizer and thereby providing a volume for the _

primary coolant to expand into or (2) by restricting starting of the RCPs to when the secondary water temperature of each steam generator is less than 70°F above each of the PCS cold leg temperatures. (S)

References (1) Updated FSAR, Section 14.3.2 I (2) Updated FSAR, Section 4.3.7 I (3) Palisades 1983/1984 Steam Generator Evaluation and Repair Program I Report, Section 4, April 19, 1984 I (4) ANF-87-lSO(P), Volume 2, Section 15.0.7.1 /

(5) "Palisades Plant Overpressurization Analysis," June, 1977, and "Palisades Plant Primary Coolant System Overpressurization Subsystem Description," October, 1977 (6) ANF-87-lSO(P), Volume 2, Section 15.4.6.3.2 /

TSP1287-0253-NL04 3-3 Amendment No $t, jt,

FIGURE 3 - 0 ASI LCO FOR Tinlet FUNCTION 1.15 UNACCEPTABLE OPERATIONS 1.00 2 3 0::

w 0 0.85 0..

cw I-

<C BREAK POINTS w 0::

I w

Pl LL. 0.70 0 1 1. - .300, 0.7 2

0 i== 2. - .080, 1.0 u 0.55

<C ACCEPTABLE 0:: 3. + .484, 1.0 LL.

OPERATIONS 0.40

§'

CD i::l

@' 0.25 CD i::l c+ -0.4 -0.2 0 0.2 0.4 0.6

~

0 N

N AXIAL SHAPE INDEX

~

3.1 PRIMARY COOLANT SYSTEM (Contd) 3.1. 7 Primary and Secondary Safety Valves Specifications

a. The reactor shall not be made critical unless all three pressurizer safety valves are operable with their lift settings maintained between 2500 psia and 2580 psia (+/- 1%).

b. A minimum of one operable safety valve shall be installed on the pressurizer whenever the reactor head is on the vessel.

c. Whenever the reactor is in power operation, a minimum of 23 secondary system safety valves shall be operable with their lift settings between 985 psig (+/- 10 psig) and 1025 (+/- 1%) psig.

Basis The primary and secondary safety valves pass sufficient steam to limit the primary system pressure to 110 percent of design (2750 psia) following a complete loss of turbine generator (l) load without simultaneous reactor trip while operating at 2650 MWt. .

The reactor is assumed to trip on a "High Primary Coolant System Pressure" signal. To determine the maximum steam flow, the only other pressure relieving system assumed operational is the secondary system safety valves. Conservative values for all system parameters, delay times and core moderator coefficient are assumed.

Overpressure protection is provided to the portions of the primary coolant system which are at the highest pressure considering pump head, flow pressure drops and elevation heads.

If no residual heat were removed by any of the means available, the amount of steam which could be generated at safety valve lift

. pressure would be less than half of one valve's capacity. One valve, therefore, provides adequate defense against overpres-surization when the reactor is subcritical.

The total relief capacity of the 24 secondary system safety valves is 6

11.7 x 10 lb/h. This is based on a steam flow equivalent to an NSSS power level of 2650 MWt at the nominal 1000 psia valve lift pressure.

At the power rating of 2530 MWt, a relief capacity of less than 11.2 x 10 6 lb/h is required to prevent overpressurization of the secondary system of loss pf load conditions, and 23 valves provide relieving capability of 11.2 x 10 6 lb/h. (l, 2 )

The AS.ME Boiler and Pressure Vessel Code,Section III, 1971 edition, Paragraph NC-7614.2(a) allows the specified tolerances in the lift pressures of safety valves.

References (1) Updated FSAR, Section 4.3.9.4. I (2) ANF-87-150(P), Volume 2, Section 15.2.1 I 3-25 Amendment No ii, ii TSP1287-0253-NL04

3.5 STEAM AND FEEDWATER SYSTEMS (Cont'd)

BASIS The Steam and Power Conversion System is designed to receive steam from the NSSS and convert the steam thermal energy into electrical energy. A closed regenerative cycle condenses the steam from the main turbine and returns the condensate as heated feedwater to the steam generators. Normally, the capability to supply feedwater to the steam generators is provided by operation of the turbine-driven main feedwater pumps.

A reactor shutdown from power requires removal of core decay heat.

Immediate decay heat removal requirements are normally satisfied by the steam bypass to the condenser, or by steam discharge to the atmosphtie yia the main steam safety valves or power operated relief 2

valves. ' If the main feedwater pumps are not operating, any one auxiliary feedwater pump can supply sufficient feedwater for removal of decay heat from the Plant. The Plant is provided with two motor driven auxiliary f eedwater pumps (P-8A, P-8C) and one turbine driven auxiliary feedwater pump (P-8B). The Auxiliary Feedwater System is designed so that an automatic start signal is generated to the auxiliary feedwater pumps upon low secondary side steam generatoF level. Upon low secondary side steam generator level, auxiliary feedwater pump P-8A would be the first auxiliary feedwater pump to receive an automatic start signal. If pump P-8A failed to start or establish flow within a specified period of time, auxiliary feedwa*ter pump P-8C would receive an automatic start signal. If both pump P-8A and pump P-8C failed to start or establish flow within each pump's specified period of time, auxiliary feedwater pump P-8B would receive an automatic start signal. All three auxiliary feedwater pumps normally take suction from the condensate storage tank. The minimum amount of water in the condensate storage tank and primary coolant system makeup tanks combined is the amount

) needed for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months of auxiliary feedwater pump operation. If the outage is more than 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , Lake Michigan water can be used, by utilizing a fire pump to supply water to the auxiliary feedwater pumps P-8A and P-8B, or by utilizing a service water pump to supply water to auxiliary feedwater pump P-8C. -

Three fire pumps are provided, one motor driven and two diesel driven, each capable of delivering 1500 gpm at 125 psig. Three service water pumps are provided, all of which are motor driven, each capable of delivering 8000 gpm at 60 psig.

REFERENCES (1) Updated FSAR, Section 10.2.1 I (2) ANF-87-150(P), Volume 2, Section 15.2.7 I I

3-39 Amendment No ~t, ~~'

TSP1287-0253-NL04

3.10 CONTROL ROD AND POWER DISTRIBUTION LIMITS Applicability Applies to operation of control rods and hot channel factors during operation.

Objective To specify limits of control rod movement to assure an acceptable power distribution during power operation, limit worth of individual rods to values analyzed for accident conditions, maintain adequate shutdown margin after a reactor trip and to specify acceptable power limits for power tilt conditions.

Specifications 3.10.1 Shutdown Margin Requirements

a. With four primary coolant pumps in operation at hot shutdown and above, the shutdown margin shall be 2%.

b. With less than four primary coolant pumps in operation at hot shutdown and above, boration shall be immediately initiated to increase and maintain the shutdown margin at~ 3.75%.

c. At less than the hot shutdown condition, boron concentration shall be greater than cold shutdown boron concentration for I normal cooldowns and heatups, i.e., non-emergency conditions. I

d. If a control rod cannot be tripped, shutdown margin shall be increased by boration as necessary to compensate for the worth of the withdrawn inoperable rod.

e. The drop time of each control rod shall be no greater than 2.5 seconds from the beginning of rod motion to 90% insertion.

3.10.2 (Deleted) I 3.10.3 Part-Length Control Rods The part-length control rods will be completely withdrawn from the core (except for control rod exercises and physics tests) *

TSP12~7-0253-NL04 3-58 Amendment No $7, 70,

3.10 CONTROL ROD AND POWER DISTRIBUTION LIMITS (Contd) 3.10.6 Shutdown Rod Limits

a. All shutdown rods shall be withdrawn before any regulating rods are withdrawn.

b. The shutdown rods shall not be withdrawn until normal water level is established in the pressurizer.

c. The shutdown rods shall not be inserted below their exercise

,limit until all regulating rods are inserted.

3.10.7 Low Power Physics Testing Sections 3.10.1.a, 3.10.1.b, 3.10.3, 3.10.4.b, 3.10.5 and 3.10.6 I.

may be deviated from during low power physics testing and CRDM exercises if necessary to perform a test but only for the time necessary to perform the test.

3.10.8 Center Control Rod Misalignment The requirements of Specifications 3.10.4.1, 3.10.4.a, and 3.10.5 may be suspended* during the performance of physics tests to determine the isothermal temperature coefficient and power coefficient provided that only the center control, rod is misaligned and the limits of Specification 3.23 are maintained.

Basis Sufficient control rods shall be withdrawn at all times to assure that the reactivity decrease from a reactor trip provides adequate shutdown margin. The available worth of withdrawn rods must include the reactivity defect of power.and the failure of the withdrawn rod of highest worth to insert. The requirement for a shutdown margin of 2.0% in reactivity with 4-pump operation and of 3.75% in reactivity with less than 4-pump operation is consistent with the assumptions used in the analysis of accident conditions (including steam line break) as reported in Reference 1 and 2 and additional I analysis. Requiring the boron concentration to be at cold shutdown I boron concentration at less than hot shutdown assures adequate I shutdown margin exists to ensure a return to power does not occur I if an unanticipated cooldown accident occurs. This requirement I applies to normal operating situations and not during emergency I conditions where it is necessary to perform operations I to mitigate the consequences of an accident. The change in insertion I limit with reactor power shown on Figure 3-6 insures that the shutdown margin requirements for 4-pump operation is met at all power levels. The 2.5-second drop time specified forcZ~e control rod~ is the drop time used in the transient analysis.

I I

The insertion of part-length rods into the core, except for rod

.exercises or physics tests, is not permitted since it has been demonstrated on other CE plants that design power distribution envelopes can, under some circumstances, be violated by using part-length rods. Further information may justify their use.

Part-length rod insertion is permitted for physics tests, since resulting power distributions are closely monitored under test conditions. Part-length rod insertion for rod exercises (approximately 6 inches) is permitted since this amount of insertion has an insignificant effect on power distribution.

3-61 Amendment No $1, ~S, TSP1287-0253-NL04

r:::IE THREE ~ OPE~TION eo

~.,,

.... IO

~ ~

~. 40 ---............ - MAXMJM llOwEif LEVEL a:

"' 30 ~-

~ ~ ~

20

~

(J c

LLI 1&

10

"'~ ~

0 0 20 40 eo IO 190 0 20 40

.... ., I I I MOt.-

I

©*I 0 20 <<>_,..@60 IO 100 CONTM>l M>D WtlTION I PERCENT

--fl)Ulll ~ -OPEfltATION 100 90

.. IO I --............

~

70 0

fl)

N I&. 60 ~

~

0 tJ2. so a:

r:"'

2 a:

e (J

40.

30 20

' "" ~

~

c(

LLI a:

10

~ .....

0 20 40

~4 60 IO 100 0 20 @

GROUP 2

'40 I I I I I I

40~ <!!° 0 20 80 100 CONTROL ROD .ltSERTION I PERCENT CONTROL ROD INSERTION LIMITS t MUSADES TECHNICAL IPECtFICATION

,, FfOUR£ 3-6 Amendment No ti

3.10 CONTROL ROD AND POWER DISTRIBUTION LIMITS (Contd)

Basis (Contd)

For a control rod misaligned up to 8 inches from the remainder of the banks, hot channel factors will be well within design limits.

If a control rod is misaligned by more than 8 inches, the maximum reactor power will be reduced so that hot channel factors, shutdown margin and ejected rod worth limits are met. If in-core detectors are not available to measure power distribution and rod misalignments >8 inches exist, then reactor power must not exceed 75% of rated power to insure that hot channel conditions are met.

Continued operation with that rod fully inserted will only be permitted if the hot channel factors, shutdown margin and ejected rod worth limits are satisfied.

In the event a withdrawn control rod cannot be tripped, shutdown margin.requirements will be maintained by increasing the boron concentration by an amount equivalent in reactivity to that control rod. The deviations permitted by Specification 3.10.7 are required in order that the control rod worth values used in the reactor physics calculations, the plant safety analysis, and the Technical Specifications can be verified. These deviations will only be in effect for the time period required for the test being performed.

The testing interval during which these deviations will be in effect will be kept to a minimum and special operating precautions will be in effect during these deviations in accordance with approved written testing procedures.

Violation of the power dependent insertion limits, when it is necessary to rapidly reduce power to avoid or minimize a situation harmful to plant personnel or equipment, is acceptable due to the brief period of time that such a violation would be expected to exist, and due to the fact that it is unlikely that core operating limits such as thermal margin and shutdown margin would be violated as a result of the rapid rod insertion; Core thermal margin will actually increase as a result of the rapid rod insertion. In addition, the required shutdown margin will most likely not be violated as a result of the rapid rod insertion because present power dependent insertion limits result in shutdown margin in excess of that required by the safety analysis. I References (1) XN-NF-77-18 I (2) ANF-87-lSO(P), Volume 2 I 3-63 Amendment No i7, ~~'

POWER DISTRIBUTION INSTRUMENTATION 3.11.2 EXCORE POWER DISTRIBUTION MONITORING SYSTEM LIMITING CONDITION FOR OPERATION The excore monitoring system shall be operable with:

a. The target Axial Offset (AO) and the Excore Monitoring Allowable Power Level (APL) determined within the previous 31 days using the incore detectors, and the measured AO not deviated from the target AO by more than 0.05 in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. The AO measured by the excore detectors calibrated with the AO measured by the incore detectors.

c. The quadrant tilt measured by the excore detectors calibrated with the quadrant tilt measured by the incore detectors.

APPLICABILITY:

(1) Items a., b. and c. above are applicable when the excore detectors are used for monitoring LHR.

(2) Item c. above is applicable when the excore detectors are used for monitoring quadrant tilt.

(3) Item b., above is applicable for each channel of the TM/LP trip and I the Axial Shape Index (ASI) alarm. I ACTION 1:

With the excore monitoring system inoperable, do not use the system for monitoring LHR.

ACTION 2:

If the measured quadrant tilt has not been calibrated with the incores, do not use the system for monitoring quadrant tilt.

ACTION 3: /

When the measured AO uncertainty is greater than specified in Specification I 4.18.2, the TM/LP trip function and the ASI alarm setpoints shall be I conservatively adjusted within twelve (12) hours or that channel shall be I declared inoperable. The operability requirements for TM/LP and ASI are I given in Table 3.17.1 and 3.17.4, respectively. I Basis The excore power distribution monitoring system consists of Power Range Detector Channels 5 through 8.

The operability of the excore monitoring system ensures that the

assumptions employed in the PDC-II analysis(l) for determining AO limits that ensure operation within allowable LHR limits are valid.

TSP1287-0253-NL04 3-66a Amendment No $~, ~~,

POWER DISTRIBUTION INSTRUMENTATION

3.11.2 EXCORE POWER DISTRIBUTION MONITORING SYSTEM LIMITING CONDITION FOR OPERATION Basis (Contd)

Surveillance requirements ensure that the instruments are calibrated to agree with the incore measurements and that the target AO is based on the current operating conditions. Updating the Excore Monitoring APL ensures that the core LHR limits are protected within the +/- 0.05 band on AO. The APL considers LOCA based LHR limits, and factors are I included to account for changes in radial power shape and LHR limits over the calibration interval.

The APL is determined-from the following:

LHR(Z)TS APL - [ ] x Rated Power

- LHR(Z)Max x V(Z) x Ep(Z) x 1.02 Min Where:

(1) LHR(Z) S is the limiting LHR vs Core Height (from Section 3.23.1),

(2) LHR(ZIDJ) is the measured peak LHR including uncertainties vs ax Core eight, (3) V(Z) is the function (shown in Figure 3.11-1);

(4) E (Z) is a factor to account for the reduction of allowed LHR iR the peak rod with increased exposure (Figure 3.23.2) such that:

For fuel rod burnups less than 27.0 GWd/MT - E

. p

= 1.0 For fuel rod burnups greater than 27.0 GWd/MT but less than 33.0 GWd/MT - E = 1.0 + 0.0064 x LHR p

For fuel rod burnups greater than 33.0 GWd/MT - E p

= 1.0 +

0.0012 x LHR Where LHR is the measured fuel rod average LHR in kW/ft, 3-66b Amendment No '~' ~~,

TSP1287-0253-NL04

3.12 MODERATOR TEMPERATURE COEFFICIENT OF REACTIVITY Applicability l

Applies to the moderator temperature coefficient of reactivity for the core.

Objective To specify a limit for the positive moderator coefficient.

Specifications The moderator temperature coefficient (MTC) shall be less I

~ -4 I positive than +0.5 x 10 ~p/°F at ~ 2% of rated power.

Bases The limitations on moderator temperature coefficient (MTC) I are provided to ensure that the assumptions used in the safety I analysis (l) remain valid. I Reference (l)ANF-87-150(P), Volume 2, Section 15.0.5 I 3-67 Amendment No TSP1287-0253-NL04

3.17 INSTRUMENTATION AND CONTROL SYSTEMS (Contd)

If the bypass is not effected, the out-of-service channel (Power Removed) assumes a tripped condition (except high rate-of-change power, variable .high power and high pressurizer pressure), (l) which I results in a one-out-of-three channel logic. If, in the 2 of 4 logic system of either the reactor p*rotective system or the engineered safeguards system, one channel is bypassed and a second channel manually placed in a tripped condition, the resulting logic is 1 of 2. At rated power, the minimum operable variable high power I level channels is 3 in order to provide adequate flux tilt detection.

If only 2 channels are operable, the reactor power level is reduced to 70% rated power which protects the reactor from possibly exceeding design peaking factors due to undetected flux tilts. I The engineered safeguards system provides a 2 out of 4 logic on the signal used to actuate the equipment connected to each of the 2 emergency diesel generator units.

Two start-up channels are available any time reactivity changes are deliberately being introduced into the reactor and the neutron power is not visible on the log-range nuclear instrumentation or above

-4 10 % of rated power. This ensures that redundant start-up instrumentation is available to operators to monitor effects of reactivity changes when neutron power levels are only visible on the start-up channels. In the event only one start-up range channel is available and the neutron power level is sufficiently high that it is being monitored by both channels of log-range instrumentation, a startup can be performed in accordance with footnote (d) of Table 3 .17. 4.

The Zero Power Mode Bypass can be used to bypass the low flow, I 2

steam generator low pressure, and TM/LP trips( ) for all four /

Reactor Protective system channels to perform control rod testing /

or to perform low power physics testing below normal operating /

temperatures. The requirement to maintain cold shutdown boron /

concentration when in the bypass condition provides additional /

assurance that an accidental criticality will not occur. To allow /

low power physics testing at reduced temperature and pressure, the /

requirement for cold shutdown boron concentration is not required /

and the allowed power is increased to 10

-1 *

%. I References (1) Updated FSAR, Section 7.2.7. I (2) Updated FSAR, Section 7.2.5.2 I 3-77 Amendment No TSP1287-0253-NL04

Table 3 .17 .1 Instrumentation Operating Requirements for Reactor Protective System Minimum Minimum Permissible Operable Degree of Bypass No Functional Unit Channels Redundanc~ Conditions 1 Manual (Trip 2 *None *None Buttons) 2 (b, d) l(d) 2 Variable High None I Power Level I

-4 (e) 3 Log Range 2 1 Below 10 % or Channels Above<l1% Rated Power Except as-Noted in (c) 2 (b, f) -4 (e) 4 Thermal Margin/ 1 Below 10 %(a) of I Low-Pressurizer Rated Power and I Pressure greater than cold i shutdown boron con- I centration. I 5 High-Pressurizer 2(b) 1 None Pressure 2(b) -4 (e) 6 Low Flow Loop 1 Below 10 % of Rated Power(a) and I greater than cold I shutdown boron con- I centration. I 7 Loss of Load 1 None None 8 Low Steam Gen- z1stgym 1/Steam None erator Water Gen *Generator Level

-4 (e) 9 Low Steam Gen- 2/stsrm . 1/Steam Below 10 % of erator Pressure Gen Generator Rated Power(a) and I greater than cold I shutdown boron con- I centration. I 10 High.Containment 2(b) 1 None Pressure (a) Bypass automatically removed.

(b) One of the inoperable channels must be in the tripped condition.

(c) Two channels required if TM/LP, low steam generator or low-flow channels are bypassed. I If only two channels are operable~ load shall be reduced to_IO% or less of rated power

I For low power physics testing, 10 4 % may be increased to 10 %"and cold shutdown (d) e) I boron concentration is 'not required. I (f) AO operability requirements are given in Specification 3.11.2. I

3-78 Amendment No TSP1287-0253-NL04

Table 3.17.4 (Cont'd)

Minimum Minimum Permissible

No 8.

Functional Unit Pressurizer Water Level (LI-0102)

Operable Channels 2

Degree of Redundancy 1

Bypass Conditions Not required in Cold or Refuel-ing Shutdown

9. Pressurizer Code 1 per None Not Required Safety Relief Valves Valve below 325°F Position Indication (Acoustic Monitor or Temperature Indicati~n)

10. Power Operated Relief 1 per None Not required when Valves (Acoustic Valve PORV isolation valve Monitor or Temperature is closed and its Indication) indication system is operable

11. PORV Isolation Valves 1 per None Not required when Position Indication Valve reactor is depressurized and vented through a vent ~1.3 sq.in.

12. Subcooling Margin 1 None Not required

13.

Monitor Auxiliary Feed Flow Rate Indication, 1 per flow(h)

Control Valve None below 515°F Not required below 325°F

14. Auxiliary Feedwater' 2 per stet1R 1 Not required Actuation System generator e) below 325°F Sensor Channels

15. Auxiliary Feedwater 1 Not required Actuation System below 325°F Actuation Channels

16. Excore Detector None Not Required Below 25% I Deviation Alarms of Rated Power I

17. Axial Shape Index 1 Not Required Below 25% I Alarm of Rated Power I (e) Auxiliary Feedwater System Actuation System Sensor Channels contain pump auto initiation circuitry. If two sensor channels for one steam generator are inoperable, one of the steam generator low level bistable modules in one of the inoperable channels must be in the tripped condition *

3-Bla Amendment No f7, f~, ~~.

TSP1287-0253-NL04

Table 3.17.4 (Cont'd)

(f) With one Auxiliary Feedwater Actuation System Actuation Channel inoperable, in lieu of the requirement of 3.17.2, provide a second licensed operator in the control room within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . . With both inoperable, in lieu of following the requirements of 3.17.2, start and maintain in operation the'turbine driven auxiliary feed pump.

(g) Calculate the Quadrant Power Tilt using the excore readings at I least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months when the excore detectors deviation alarms I are inoperable, or at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months using symmetric incore I detectors when the difference between the excore and the incore I measured Quadrant Power Tilt exceeds 2%. I (h) With two flow rate indicators inoperable for a given control valve, the control valve shall be considered inoperable and the requirements of 3.5.2(e) apply.

(i) AO operability requirements are given in Specification 3.11.2

I (next page is 3-84)

3-Blb Amendment No ~~' ~8, TSP1287-0253-NL04

POWER DISTRIBUTION LIMITS 3.23.1 LINEAR HEAT RATE (LHR)

LIMITING CONDITION FOR OPERATION ACTION 3:

If the incore alarm system is inoperable and the excore monitoring system is not being used to monitor LHR, operation at less than or I equal to 85% of rated power may continue provided that incore readings are recorded manually. Readings shall be taken on a minimum of 10 individual detectors per quadrant (to include 50% of the total number of detectors in a 10-hour period) within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and at least every 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thereafter. If readings indicate a local power level equal to or greater than the alarm setpoints, the action specified in ACTION 1 above shall be taken.

Ba's is The limitation of LHR ensures that, in the event of a LOCA, the peak temperature of the cladding will not exceed 2200°F.0)( 3 ) l I

I Either of the two core power distribution monitoring systems (the incore alarm system or the excore monitoring system) provides adequate monitoring of the core power distribution and is capable of verifying that the LHR does not exceed its* limits. The incore alarm system performs this function by continuousty monitoring the local power at many points throughout the core and comparing the measurements to predetermined setpoints above which the limit on LHR could be exceeded. The excore monitoring system performs this function by providing comparison of the measured core AO with predetermined AO limits based on incore measurements. An Excore Monitoring Allowable Power Level (APL), which may be less than rated power, is applied when using the excore monitoring system to ensure that the AO limits adequately restrict the LHR to less than the limiting values*( 4 )

If the incore alarm system and the excore monitoring system are both inoperable, power will be reduced to provide margin between the actual peak LHR and the LHR limits and the incore readings will be manually collected at the terminal blocks in the control room utilizing a suitable signal detector. If this is not feasible with the manpower available, the reactor power will be reduced to a point below which it is* improbable that the LHR limits could be exceeded.

3-104 Amendment No ~J, Jt,

POWER DISTRIBUTION LIMITS 3.23.1 LINEAR HEAT RATE (LHR)

LIMITING CONDITION FOR OPERATION Basis (Contd)

The time interval of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the minimum of 10 detectors per quadrant are sufficient to maintain adequate surveillance of the core power distribution to detect significant changes until the monitoring systems are returned to service.

To ensure that the design margin of safety is maintained, the determination of both the incore alarm setpoints and the APL takes into account a measurement uncertainty factor of 1.10, an engineering uncertainty factor of 1.03, a thermal power measurement uncertainty factor of 1.02 and allowance for quadrant tilt.

References (1) XN-NF-77-24 (2) deleted I (3) XN-NF-78-16 (4) XN-NF-80-47 I 3-105 Amendment No ~~.

TSP1287-0253-NL04

FIGURE 3.23-1 ALLOWABLE LHR AS A FUNCTION OF PEAK POWER LOCATION 1.1

-::c a::

...J

1! 1.0 UNACCEPTABLE

> 1 OPERATION

1!

x ct ACCEPTABLE

~ 0.9 LL OPERATION 0

w z

I 0 f-'

0 t== 0.8 CD u ct BREAK POINTS

-a::

LL a::

c 0.7 1. 0.6, 1.0

...J w

...J 2 . 1.0, .67 ca ct 3: 0.6 0

...J

§" ...J

(])

s ct

(])

sc+ 0.25

!z!

0 0.2 0.4 0.6 0.8 1.0 0 '

"('!;>

~ LOCATION OF AXIAL POWER PEAK (FRACTION OF ACTIVE FUEL HEIGHT)

POWER DISTRIBUTION LIMITS 3.23.2 RADIAL PEAKING FACTORS LIMITING CONDITION FOR OPERATION The radial peaking factors~' r FT,r ~and~

r r shall be less than or equal to the value in Table 3.23-2 times the following quantity. I The quantity is [1.0 + 0.3 (1 - P)] for P ~ .5 and the quantity is I 1.15 for P < .5. P is the core thermal power in fraction of rated I power.

APPLICABILITY: Power operation above 25% of rated power. I ACTION:

1. For P < 50% of rated with any radial peaking factor I exceeding its limit, be in at least hot shutdown within 6 I hours. I

2. For P ~ 50% of rated with any radial peaking factor -I exceeding its limit, reduce thermal power within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months I to less than the lowest value of: I

[l - 3.33 (Fr - 1 )] x Rated Power I FL Where Fr is the measured value of either~' r ~or~

r FT, r r and FL I is the corresponding limit from Table 3.23-2.

Basis The limitations on rA, r

FT~-~

r r and~r are provided to ensure that assumptions used in the analysis for establishing DNB margin, LHR and the thermal margin/low-pressure and variable high-power I trip set points remain valid during operation. Data from the incore detectors are used for determining the measured radial peaking factors. The periodic surveillance requirements for determining the measured radial peaking factors provide assurance that they remain within prescribed limits. Determining the measured radial peaking factors after each fuel loading prior to exceeding 50% of rated power provides additional assurance that the core is properly loaded.

3-111 Amendment No -~J, TSP1287-0253-NL04

POWER DISTRIBUTION LIMITS 3.23.3 QUADRANT POWER TILT - T LIMITING CONDITION FOR OPERATION The quadrant power tilt (T q ) shall not exceed 5%.

APPLICABILITY: Power operation above 25% of rated power. I ACTION:

1. With quadrant power tilt determined to exceed 5% but less than or equal /

to 10%.

I

a. Correct the quadrant power tilt within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after I exceeding the limit, or I

b. Determine within the next 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and, at least once every 8 I hours thereafter, that the radial peaking factors are within I the limits of Section 3.23.2, or I

c. Reduce power, at the normal shutdown rate, to less than 85% I of rated power and determine that the radial peaking factors I are within the limits of Section 3.23.2. At reduced power, I determine at least once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months that the radial I peaking factors,are within the limits of Section 3.23.2 . I

2. With quadrant power tilt determined to exceed 10%:

a.

b.

Correct the quadrant power tilt within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after exceeding the limit, or Reduce-power to less than 50% of rated power within the next I

I I

I 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ~nd determine that the radial peaking factors are I within the limits of Section 3.23.2. At reduced power, I determine at least once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months that the radial peaking I factors are within the limits of Section 3.23.2. I

3. With the quadrant power t1lt determined to exceed 15%, be in at least hot standby within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Basis Limitations on quadrant power tilt are provided to ensure that design safety margins are maintained. Quadrant power tilt is determined from excore detector readings which are calibrated using incore detector measurements. (l) Calibration factors are determined from incore measurements by performing a two-dimensional, full-core surface fit of deviations between measured and theoretical incore readings and integrating the fitting function over each core quadrant. Values of LHR and radial peaking factors are increased by the value of quadrant tilt.

3-112 Amendment No ~~

TSP1287-0253-NL04

b. The PCS vent(s) shall be verified to be open at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the vent(s) is being used for overpressure protection except when the vent pathway is provided with a valve which is locked, sealed, or otherwise secured in the open position, then verify these valves open at least once per 31 days.

Basis Failures such as blown instrument fuses, defective indicators, and faulted amplifiers which result in "upscale" or "downscale" indication can be easily recognized by simple observation of the functioning of an instrument or system. Furthermore, such failures are, in many cases, revealed by alarm or annunciator action and a check supplements this type of built-in surveillance.

Based on experience in operation of both conventional and nuclear plant systems when the plant is in operation, a checking frequency of once-per-shift is deemed adequate for reactor and steam system instrumentation. Calibrations are performed to insure the presentation and acquisition of accurate information.

The power range safety channels and aT power channels are calibrated /

daily against a heat balance standard to account for errors induced by changing rod patterns and core physics parameters.

Other channels are subject only to the "drift" errors induced within the instrumentation itself and, consequently, can tolerate longer intervals between calibration. Process system instrumentation errors induced by drift can be expected to remain within acceptable tolerances if recalibration is performed at each refueling shutdown interval.

Substantial calibration shifts within a channel (essentially a channel failure) will be revealed during routine checking and testing procedures. Thus, minimum calibration frequencies of one-per-day for the power range safety channels, and once each refueling shutdown for the process system channels, are considered adequate.

The minimum testing frequency for those instrument channels connected to the reactor protective system is based on an estimated average unsafe failure rate of 1.14 x 10-S failure/hour per channel. This estimation is based on limited operating experience at conventional and nuclear plants. An*"unsafe failure" is defined as one which negates channel operability and which, due to its nature, is revealed only when the channel is tested or attempts to respond to a bona fide signal.

4-2 Amendment No JS, Jt TSP1287-0253-NL04

TABLE 4.1.1 Minimum Frequencies for Checks, Calibrations and Testing of Reactor Protective System(S)

Surveillance Channel Description Function Frequency Surveillance Method

1. Power Range Safety Channels a. Check s a. Comparison of four-power channel readings.

b. Check(3) D b. Channel adjustment to agree with heat balance calculation. Repeat whenever flux-l1T power comparators alarms.

c. Test M(2) c. Internal test signal. I

d. Calibrate (6) R d. Channel alignment through measurement/adjustment I of internal test points.

2. Wide-Range Logarithmic a. Check s a. Comparison of both wide-range readings.

Neutron Monitors b. Test p b. Internal test signal.

3. Reactor Coolant Flow a. Check s a. Comparison of four separate total flow indications.

b. Calibrate R b. Known differential pressure applied to sensors. I

c. Test M(2) c. Bistable trip tester.(1)(4)

4. Thermal Margin/Low a. Check: s a. Check:

Pressurizer Pressure (1) Temperature (1) Comparison of four separate calculated Input trip pressure set point indications.

(2) Pressure (2) Comparison of four pressurizer pressure Input indications. Same as S(a) below.)

b. Calibrate R b. Calibrate:

(1) Temperature (1) Known resistance substituted for RTD coinci-

-Input dent with known pressure and power input. I (2) Pressure (2) Part of S(b) below.

Input

c. Test M(2) c. Bistable trip tester.(l) I

s. High-Pressurizer Pressure a. Check s a. Comparison of four separate pressure indications.

b. Calibrate R b. Known pressure applied to sensors. I c.* Test M(2) c. Bistable trip tester.(l) 4-3 Amendment No tt, $~, ~~

TSP1287-0253-NL04

TABLE 4.1.1 Minimum Frequencies for Checks, Calibrations and Testing of Reactor Protective System(5) (Contd)

Surveillance Channel Description Function Frequency Surveillance Method 6." Steam Generator Level a. Check s a. Comparison of four level indications per generator.

b. Calibrate R b. Known differential pressure applied to senaors.

c. Test H(2) c. Bistable trip tester.(l)

7. Stea11 Generator Pressure a. Check s a. Comparisons of four pressure indications per generator.

b. Calibrate R b. Known pressure applied to sensors. I

c. Test H(2) c. Bistable trip teater.(l)

8. Contain11ent Pressure a. Calibrate R a. Known pressure applied to sensors.

b. Test H(2) b. Simulate pressure switch action.

9. Loss of Load a. Test p a. Manually trip turbine auto stop oil relays.

10. Manual Trips a. Test p a. Manually test both circuits.

11. Reactor Protection System a. Test M(2) a. Internal test circuits.

Logic Units

12. Axial Shape Index (ASI) a. Test R a. Known power inputs applied to Thermal I Margin Calculator. I I

13. AT Power a. Check s a. Same as l(a). I t>. Check (3) D b. Same as l(b). I

c. Test R c. Known temperature imputs applied to I

.Thermal

, Margin Calculator

I 4-4. Amendment No ii, ~. II TSP1287~0253-NL04

TABLE 4 .1.1 Minimum Frequencies for Checks, Callbratlons and Testing of Reactor Protective System(5) (Contd)

Survell lance Channel Descrlptlon Function Surveillance Method

14. Thermal Hargln Calculator a. Check Q a. Verify constants. I NOO'ES: (l)The bistable trip tester injects a signal into the bistable and provides a preclslon readout of the trip set point.

(2)All monthly tests will be done on only one of four channels at a time to prevent reactor trlp.

(l)Adjust the nuclear power or Irr power until readout agrees with heat balance calculations when above 15% of rated I power. I (4)Trip setting for operating pUllJl comblnatlon only. Settings for other than operating pUllp comblnatlons must be tested during routine monthly testing perfonned when shut down and wlthln four hours after resuming operation with a different pUllp collblnation lf the setting for that comblnatlon has not been tested wlthln the previous 110nth.

(S)It ls not necessary to perfo~ the speclfled testing during prolonged periods ln the refueling shutdown condltlon If this occurs, Olllitted testing will be perforaed prior to returning the plant to service.

(6)Also includes testing variable high power function ln the Ther11al Margin Calculator. I FREQ!JENCY NOTATION Notation Frequency s At least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

D At least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

w At least once per 7 days.

H At least once per 31 days.

Q At .least once per 92 days.

SA At least once per 6 months.

R At least once per 18 lllOnths.

p Prior to each start-up l f not done previous week.

NA Not applicable.

4-5 Amendment No i~.

TSP1287-6253-NL04

TABLE 4.1.l Hin:llllum Frequencies for Checks, Calibrations and Testing of Miscellaneous Instrumentation and Controls Surveillance Channel Description ~~~-Fu~n_c_t_i_o_n~~~- Frequency Surveillance Method

1. Start-Up Range Neutron a. Check s a. Comparison of both channel count rate indications when Monitors in service.

b. Test p b. Internal test signals.

2. Primary Rod Position a. Check s a. Comparison of output data with secondary RPIS Indication Syste11 b. Cleek H b. Check of power dependent insertion lillits monitoring system.

c. Calibrate R c. Physically measured rod drive position used to verify I syste11 accuracy. Cleek rod position interlocks.

l. Secondary Rod Position a. Cleek s a. Comparison of output data with primary RPIS.

Indication Syste11 b. Cleek H b. Same as 2(b) above.

c. Calibrate R c. Same as 2(c) above, including out-of-sequence alarm I function.

4. Area Monitors a. Cleek D a. Normal readings observed and internal test signals used Note: Process Monitor to verify instru11ent operation.

Surveillance Requirements b. Calibrate R b. Exposure to known external radiation source.

are located in Tables c. Test M c. Detector exposed to re11<>te operated radiation check 4.24-1 and 4.24-2 source.

s. Emergency Plan Radiation a. Calibrate A a. Exposure to known radiation source.

Instnmenta b. Test M b. Battery check.

6. Environaental Monitors a. Check M a. Operational check.

b. Calibrate A b. Verify airflow indicator.

7. Pressurizer Level a. Check s a. Comparison of six independent level readings.

Instruments b. Calibrate R b. Known differential pressure applied to sensor.

c. Test H c. Signal to .,meter re lay adjusted with test device.

4-10 Amendment No ti. 1*. ***

TSP1287-0253-NJ.04.

- TABLE 4.1.3 Minimum Frequencies for Checks, Calibrations and Testing of Miscellaneous Instrumentation and Controls (Continued)

Surveillance Channel Description Function Frequency Surveillance Method

8. Control Rod Drive System a. Test R a. Verify proper ope!ation of all manual I Interlocks rod drive control system interlocks, using simulated signals where necessary.

b. Test p b. Same as B(a) above, if not done within three months.

9. Flux-AT Power Comparator a. Calibrate R a. Use simulated signals. I

b. Test M b. Use simulated signals. I

10. Calorimetric Instrumentation a. Calibrate R a. Known differential pressure applied to I feedwater flow sensors.

11. Containment Build+ng a. Test R a. Expose sensor to high humidity Humidity Detectors atmosphere.

12. Interlocks - Isolation Valves a. Calibrate R a. Known pressure applied to sensor.

on shutdown Cooling Line

13. Service Water Break Detector a. Test R a. Known differential pressure applied to in Containment Sensors.

I I

4-11 Amendment No ii, i0, ii, is, ~~. ~i.

TSP1287-0253-NL04

4.15 Primary System Flow Measurement Applicability

Applies to the measurement of primary system flow rate with four primary coolant pumps in operation.

Objective To provide assurance that the primary system flow rate is equal to or above the flow rate required in 3.1.1.c.

Specification After each refueling outage, or after plugging 10 or more steam generator tubes, a primary system flow measurement shall be made with four primary coolant pumps in operation. This measurement I shall be made within the first 31 days of rated power operation. I Basis This surveillance program assures that the reactor coolant flow is consistent with that assumed as the basis for Specification 3.1.lc .

4-70 Amendment No U, TSP1287-0253-NL04

POWER DISTRIBUTION INSTRUMENTATION 4.18.2 EXCORE MONITORING SYSTEM SURVEILLANCE REQUIREMENTS 4.18.2.1 At least every 31 days of power operation:

a. A target AO and excore monitoring allowable power level shall be determined using excore and incore detector readings at steady state near equilibrium conditions.

b. Individual excore channel measured AO shall be compared to the I total core AO' measured by the incores. If the difference is I greater than 0.02, the excore monitoring system shall be recalibrated.

c. The excore measured Quadrant Power Tilt shall be compared to the

incore measured Quadrant Power Tilt. If the difference is greater than 2%, the excore monitoring system shall be recalibrated .

TSP1287-0253-NL04 4-82 Amendment No ~B,

4.19 POWER DISTRIBUTION LIMITS 4.19.1 LINEAR HEAT RATES SURVEILLANCE REQUIREMENTS 4.19.1.1 When using the incore alarm system to monitor IJIR, prior to operation above 50% of rated power and every 7 days of power operation thereafter, incore alarms shall be set based on a measured power distribution.

4.19.1.2 When using the excore monitoring system to monitor IJIR:

a. Prior to use, verify that the measured AO has not deviated from the target AO by more than 0.05 in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for I each operable channel using the previous 24 hourly recorded I values. I

b. Once per day, verify that the measured Quadrant Power Tilt is less than or equal to 3%.

c. Once per hour, verify that the power is less than or equal to the APL and not more than 10% of rated power greater than the power level used in determining the APL.

d. Continuously verify that the measured AO is within 0.05 of the I established target AO for at least 3 of the 4, 2 of the 3 or I 2 of the 2 operable channels, whichever is the applicable case. I 4-83 Amendment No ~~'

TSP1287-0253-NL04

4.20 MODERATOR TEMPERATURE COEFFICIENT (MTC) I SURVEILLANCE REQUIREMENTS I 4.20.1 The MTC shall be determined to be within its limits by I confirmatory measurements prior to initial operation I above 2% of rated thermal power, after each refueling." I (next page is 4-90)

TSP1287-0253-NL04 4-85 Amendment No

ATTACHMENT Consumers Power Company Palisades Plant Docket 50-255 AFFIDAVIT AND GAMMA METRICS REPORTS OC1287-0051A-NL02-NL04

AFFIDAVIT STATE OF CALIFORNIA ss.

COUNTY OF SAN DIEGO I, Clinton L. Lingren, being duly sworn, hereby say and depose:

1. I am Vice President, Reactor Instrumentation, of GAMMA-METRICS, a California corporation ("GM") and as such, I am authorized to execute this Affidavit.

2. I was a founder of GM in 1980 and have been continuously employed by GM as a Vice President since then. As such, I am familiar with GM's research and development activities with respect to reactivity control systems, as well as its

documentation and documentation control practices and policies which govern the protection of GM's trade secrets and the control of related information.

3. I am familiar with the documents listed on Exhibit A.

attached hereto (the "Documents") . All of the information contained in those Documents has been classified by GM as proprietary in accordance with GM's policies established for the protection of its trade secrets.

4. The Documents contain information of a proprietary and confidential nature and are of the type customarily held in confidence by GM and not made available to the public .

Page One of Three

5. I have engaged in research and development activities with a variety of employers for more than 20 years. Based on that experience, I state that other companies similarly situated would regard information of the kind contained in the Documents to be proprietary and confidential.

6. GM has held the Documents in confidence and has released them only (i) as necessary to comply with applicable law, and (ii) under confidential disclosure agreements. GM follows a variety of customary procedures for the safeguarding of its proprietary information, including the information set forth in the Documents.

7. GM is making the Documents available to the United States Nuclear Regulatory Commission in confidence, with the request, hereby made, that the information contained in the Documents will not be disclosed or divulged for the reasons set forth herein, which are intended to be responsive to 10 C.F.R. 2.790(b)(l).

8. The information contained in the Documents is not available in public sources.

9. GM has expended substantial amounts to create the information set forth in the Documents. That information is vital to GM's competitive advantages and would be extremely helpful to GM's competitors if it were known by them.

Page Two of Three

10. GM believes the information in the Documents is proprietary because it reveals the details of the implementation of the functions performed by the thermal margin monitor and includes information used by GM in its business which affords GM an opportunity to obtain a competitive advantage over its competitors who do not or may not know or use the information contained in the Documents.

11. The disclosure to a competitor of the proprietary information contained in the Documents would permit the competitor to reduce its research and development expenditures and thereby unfairly improve its competitive position by giving it extremely valuable insights into GM's proprietary information, resulting in substantial and irremediable harm to GM's competitive position.

The statements herein made are truthful and complete to the best of my knowledge, information and belief.

~/L' Clinton L. Lingren~

Sworn to and subscribed before me this 4th day of March, 1988.

~~y OFFICIAL SEAL JEANNEE L. CHRIST NOTARY PUBLIC - CALIFORNIA SAN DIEGO COUNTY My Comm Expire* Jon 6, 1989 1..

~ayPublic

~~ate of California Page Three of Three

EXHIBIT A List of Documents HARDWARE SPECIFICATION DOCUMENT NO. 056 SOFTWARE REQUIREMENTS SPECIFICATION DOCUMENT NO. 055 SOFTWARE DESIGN DESCRIPTION DOCUMENT NO. 089 INSTRUCTION MANUAL DOCUMENT NO. 070, VOLUMES I, II, III & IV TMM SOFTWARE QUALITY ASSURANCE AND DEVELOPMENT PLAN DOCUMENT NO. 068 RCS-50 TMC QUALIFICATION TEST PLAN DOCUMENT NO. 066 VERIFICATION PLAN DOCUMENT NO. 067 HARDWARE-SOFTWARE INTEGRATION PLAN DOCUMENT NO. 073 VALIDATION PLAN DOCUMENT NO. 088

Document Nu~ber Revision: 3.0 056 Date: July 21, 1986 General Purpose Class lE Qualified Microcomputer Hardvare Specification THERMAL MARGIN MONITOR for

CONSUMERS POWER COMPANY Palisades This document contain information proprietary to GAMMA-METRICS and is intended solely for the operation and maintenance of GAMMA-METRICS equipment and is not to be used othervise or reproduced vithout the vritten consent of GAMMA-METRICS

GAMMA-METRICS 5550 Oberlin Drive San Diego, CA 92121 Telephone 619/450-9811

Confidential- Hardvare Specification - Palisades - Rev .. 3. 0

Revision Record Revision A R. Cram May 17, 1985 Initial release.

Revision B R. Cram June 4, 1985 Revised and corrected several items. Added options clarification. Added section 14.0.

Revision C ~ Cram August 6, 1985 Revised and corrected several items based on meeting vith Bill Staley. Added document number. Added section 15.0. Changed isolation specifications from 200 v to 600 v. Added IEEE-603 reference document. Changed consumer paver company draving numbers. Added storage time specification. Added NUREG-0700 CRT requirements. Added DBE and SSE requirements. Changed analog I/O capabilities increasing output channels to 3 and inputs to 7.

Changed line voltage from 120 to 117 vac .

Revision D R. Cram August: 27, 1985 Line voltage change not picked up change for line voltage to 117 vac.

Revision E R. Cram Sept. 11, 1985 in Rev. c. Included Corrected misspellings.

Revision F R. Cram Sept. 24, 1985 Corrected number of key positions. Changed keyboard to key pad.

Revision G R. Cram Oct. 15, 1985 Corrections per document review form.

Revision 3.0 J. Hiller July 21, 1986 Official release vith'changes. Added sections 13.0 and 14.0.

Proprietary-Information The information contained in this document is proprietary to Gamma-Metrics. This document may not be duplicated nor may the information contained in this document be distributed to any third party vithout the vritten consent of Gamma-Metrics.

Confidential- HerdYere Specification - Palisades - Rev. 3.0

Table of Contents .

1. 0 Scope ................................. *............. 4 2.0 Reference Documents ...........................*.... 4

3. 0 General Description .......... *.* .................... 5

4. 0 Environmental specifications ...............*...**.. 5

4. 1 Temperature specifications ....*.....**....**....*.. 5 4.2 Shock and vibration specifications *.....**........* 6 4.3 Humidity specification ..**.*............**..*****.. 6 4.4 Radiation specification *****.....*..*...........*.. 6 5.0 Packaging and handling requirements .*.*..**..**.*.. 7

6. 0 1/0 capabilities ................. .- ......*..... ** .... 7

6. 1 Industrial l/O capabilities .**....**...**. * ....*... B

6. 2 Analog 1/0 capabilities .............*...**..**..... 9

7. 0 Screen output ............*. * ....*..**.....*..**.*.. 10 B. 0 Keypad input ..............*.......*..*...*....*..... 11 9.0 Keylock capabilities **..*................*.*.**.*.. 11 10.0 Peripheral equipment options *..........**.**.***.* 11 11.0 Line paver requirements ..*..*..*..**...*...*.**..* 12 12.0 Battery retention requirements **.***.*.**...*.**** 12 13.0 Initialization Requirements *..*.*****....*..***.*. 12

)

14.0 Interrupt Features **.*.**..*.....**..*...*.. ~ *.*.* 12 APPENDICES Appendix A ...*.....**....**.*.**.*.*..***...**...***.* 13

Confidential- Hsrdvsre Specification - Palisades - Rev. 3. 0

1. 0 Scope1 This implementation docu111ent of a covers general a description purpose of medium the hardvare performance microcomputer to be qualified for class lE installations in nuclear paver generating stations. It covers all environmental requirements, packaging and handling require111ents, I/O capabilities and a general description of the system and design goals.

2.0 Reference docu~ents:

The folloving documents are invoked in the design of the eyste111. In the event of a conflict betveen reference documents and this document, this specification shall be considered the governing document.

1) Consumers Paver Company document J-54

2) Consumers Paver Company sketch 8-JL-130 Sh. 1

3) Application Criteria for Programmable Digital Computer Systems in Safety Systems of Nuclear Paver Generating Stations - ANSI/IEEE - AHS-7-4.3.2-1982

4) Qualifying Class lE Equipment for Nuclear Paver Generating Stations - IEEE-323-1974

5) Recommended Practices for Seismic Cualification of Class lE EquipMent for Nuclear Paver Generating Stations IEEE-344-1975

6) Standard Criteria for Safety Systems for Nuclear Paver Generating Stations - IEEE-603-1980.

7) NUREG-0700 Section 6.7.2 - Guidelines for Control Roa* Design - CRT Displays.

Confidential- Hardvare Specification - Palisades - Rev. 3.~

3.0 General description:

used The in general class lE purpose ~icrocomputer installations in is to be designed Huclear Paver to Generating be Stations. It is to be designed to vithstand all of the rigors associated vith paver plant environment as vell as exposure to radiation. The syste~ is to be capable of handling extremes in temperature, humidity and vibration as vell as being designed to have a high reliability. The system is to be easily expandable or can be reduced over the current configuration to a minimum cost solution to simple problems. This vill be accomplished by the use of a standard bus architecture. The graphics display and keypad input provide for ease of operator use and dual keylocks provide a high degree of operational security .

The unit vill be designed to mount in a standard 1gw panel an occupy 8-3/4* or less of vertical rack space and is rack 15-4.0 Environaental Specifications:

The general purpose microcomputer shall be designed to meet all of the environmental specifications herein over the specified life of the unit of 40 years.

4.1 Te*perature Specifications:

The system vill be capable of being operated over temperature extremes ranging froa +5 degrees celsius to +55 .degrees celsius

vith no degradation Additionally temperatures the unit in perfor~ance vill be (41 deg F capable of to being ranging fro* -25 deg celsius to +60 degrees 131 deg stored F>.

celsius at

Confidential- Hardvare Specification - Palisades - Rev. 3.0

in a nonoperational status for periods of up to 5 years degradation of the unit C-13 deg F to 140 deg Fl.

vithout 4.2 Shock and Vibration Specifications!

The unit shall be seismically qualified to operate with no degradation in performance to the curves shown in appendix A.

These curves were selected on the basis that they envelope any known seismic requirement. The unit shall be tested to these requirements so that durability and adequacy of the design is demonstrated. Additionally the unit shall be designed ta be capable of withstanding normal air, sea and land transportation vithout damage when properly packed. _ The unit vill withstand 5 operating base events (QBE> and 1 safe shutdown event <SSE> per the requirements of IEEE-344-1975. Margins specified in section 3.1.5 of IEEE-323-1974 will be employed where applicable.

4.3 Huaidity Specification:

The unit shall be capable of operation without degradation in performance over a relative humidity range of SX to 95X noncondensing.

4.4 Radiation Tolerance Specification:

The unit shall be designed ta be able to operate without a critical failure after being exposed to Gamma radiation to a total integrated dose of 10,000 rads~ A critical failure is fully defined in the test plan. Briefly, a critical failure is a failure that causes the device to be unable to perfor~ the de-6

Confidential- Hardvare Specification - Palisades - Rev. 3.0 fined calculation process, read the necessary inputs or produce the required outputs.

The co~puter shall have the following dimensions not including back panel, side panel or front panel devices such as connectors, switches, terminal blocks and mounting rails.

Depth 15.375 inches Width 19 inch, rack mountable Height 8.75 inches The microcomputer shall be capable of being shipped using normal commercial air, sea or land carrier vith proper packing.

The unit vill not require any special handling or packing provisions above vhat is normally used for commercial packing purposes.

Connections to the microcomputer shall be via terminal blocks located on the rear of the chassis capable of accepting vire gauge sizes between AWG 14 to AWG 22.

6.0 Input/Output <IIO> Capabilities:

The following paragraphs specify the 110 capabilities of the machine. Note that additional I/O can be added by increasing the number of Isolators installed in the unit and adding Bore cards to the standard bus around which the system is built.

7

Confidential- Hardvare Specification - Palisades - Rev. 3.0 6.1 Industrial I/O Capabilities:

There vill *be a total of B digital industrial inputs or outputs available in the stock package vith a cap~bility of being expanded up to 24 inputs or outputs. These lines may be configured as either inputs or outputs hovever they must be specified as either input or output in blocks of 4 lines.

Examples are B inputs and 16 outputs, 20 inputs and 4 outputs, 12 inputs and 12 outputs, etc. All industrial I/O are completely isolated fro* the chassis, from other I/O lines and from the computer paver supplies.

6.1.1 Industrial output line specificat~ons:

All industrial output lines vill be solid state DC syitches having an isolation voltage rating of 600 vac RHS minimum to any computer parts, chassis and paver supplies, a current rating of 2.0 amps DC at 20 deg C., 1.5 amps DC at 45 deg C and a maximum voltage drop of 1.6 vdc at 3 amps. The off state leakage current shall be less than 2 ma and the off state blocking voltage shall be greater than 40 Vdc. As an option output lines may be confi-gured to have solid state AC switches, a current rating of 2.0 amps AC RKS at 20 deg C., and an off state blocking voltage of 200 vac.

6.1.2 Industrial input line specifications:

All industrial input lines vill be solid state DC input Modules capable of handling AC or DC line inputs. The _input voltage range shall be 10 to 30 vdc or 15 to 30 vac vith a maximu*

input curreht at maximum line of 23 ma. The input to output A.

Confidential- Hardvare Specification - Palisades - Rev. 3.0 isolation shall be greater than 500 vac RMS vith a maximu~

leakage current of less than 2 ma.

The microcomputer vill have an option of sensing contact closures externally. In the event an external contact closure is used, the isolation rating is decreased to 500 vac RMS or 1000 vdc. The external contact must be capable of handling 40 ma of current and have an off state blocking voltage of greater than 20 vdc.

5.2 Analog I/O Capabilities:

There vill be provisions for a total of 15 analog I/O channels .. Any number of those up to 18 may be analog input vith 12 bit resoluticm and any number can be analog output up to 8 channels also vith 12 bit resolution. The standard configuration vill provide for 3 analog output channels and 7 analog input channels. Any variation from this standard may be provided at additional cost. Data rate capabilities vill be such that the analog I/O channels can be accessed at least 100 times per second.

6.2.1 Analog input specifications:

The input impedance of the analog voltage inputs shall be 1 meg ohm resistive +/- 2X. The inputs can be operated vith an input of 0 to 10 vdc, -10 to +10 vdc, 0-5 vdc, 4 to 20 made, 0-20 ma de or special customer requirements. - However, 0 to 10 vdc is to be the standard configuration. If voltage input is used, the offset shall be less than 5 mv de or 0.075X of full scale whichever is greater. If current input is used, the offset shall be less than 0.15 *adc or 0.075X whichever is greater. Line

Confidential- Hardvare Specification - Palisades - Rev. 3.0 isolation voltage shall be at least 600 vac RMS or 1000 vdc.

Linearity shall be better than 0.025X and gain and offset temperature drift shall be less than 100 PPM per degree C. of full scale.

6.2.2 Analog Output Specifications:

The analog outputs may take the form of 0 to 10 vdc, 4 to 20 made, 10 to 50 made, or 0 to 20 made, but comes standard as 0 to 10 YDC. The maximum current that can be dravn from the analog output channels is 10 ma de vhen voltage outputs are used. The output isolation voltage is 600 vac RMS or 1000 vdc minimum. The channel linearity is .05X.of full scale or bett~r. Temperature coefficient of gain and offset is less then 50 PPM per degree C of full scale range. The offset error shall be less then .075Y. of full scale,range and gain error shall be less then .10X of full scale range.

7.0 Screen output:

In addition to the analog and industrial outputs. available to the user, an integrated screen vill be used to output data to the user. The screen vill have a graphics capability end a minimum resolution of 300 lines horizontal and vertical.

The displays and screens vill be designed to be in conformance vith NUREG-0700 sections 6.7.2.1 through 6.7.2.8 inclusive, to the greatest extent possible. Sections specific to the customer's installation are excluded. No measurements of screen or character luminance or contrast vill be made by Ga*ma-Metrics.

. 10

Conf id en tie 1- Hard.,, ere Specif ice t ion -. Pel isedes - Rev. 3. 0 The screen output is not considered a safety related function of the computer.

8.0 Keypad input:

In addition to the analog and industrial inputs available to the user, an alphanumeric keypad vill be an integral part of the design and may be used to communicate with the microcomputer.

The keypad vill be environmentally sealed against *dust, dirt and noncorrosive chemicals. The keypad will be detachable so that security may be increased. Additionally, 4 front panel mounted sof~ keys vill be included in t~e design to be used by ope~ators to call up screens and provide for operation of the system.

9.0 Keylock capabilities:

Two keylocks will be installed on the front panel of the unit vith one lock having three positions and the second lock having two positions. Each position will form a digital input to the system for a total of 5 digital inputs. The microcomputer vill periodically scan the position of those keys to determine if a secure access to the machine is to be granted.

10.0 Peripheral equipment options:

Optionally, three outputs vill be available to drive printers -or other peripheral equipment that may be connected t6 the system. There vill be provisions for tvo RS-232C serial interface ports available on the system and one Centronics compatible port for driving a parallel printer.*

Confidential- Hardvare Specification - Palisades - Rev. 3.0 11.0 Line paver requireaents:

The device shall be designed to operate from 117 Vac single phase paver source. ttinimum line frequency is 55 Hz and maximum line frequency is 55 Hz. Line voltage may vary */- 10X vithout detrimentally affecting the operation of the unit. Kaximum current consumption shall be less then 2 amps AC RKS and total paver consumption shall be less than 240 vatts at a nominal line voltage of 117 Yac.

12.0 Battery Retention Requirements:

The computer vill have provisions for battery back-up of all volatile random access memory <RAMl so that critical function may be restored immediately after a paver failure vithout operator intervention. The retention time of the RAK vill be a minimum of 1 year under all environmental extremes specified herein.

13.0 Initialization Requirements Prior ta powering the chaesis, the cover must be removed and a jumper installed ta enable the battery backed up RAH. When the unit must be powered of~ for extended periods of time, this jumper should be disconnected to prevent discharging the pattery. The unit is designed to be self initializing on powering on the chassis.

14.0 Interrupt Features Hardware interrupt capability is obtained by the use of a momentary svitch on the rear of the chassis, vhich causes a reset of the computer vhen depressed.

I?

.J Confidential- Hardvare Specification - Palisades - Rev. 3.~

Appendix A Seismic Test Envelopes

l-

- - -*-~**- - --.......--.--*......-

SSE = DBE x 2 I

lil!tiI.!I I!l l~ ~f:!i!iltl11! l i!l l!il lili!l !l l!~ Iti rn rn1Ill1111111 i: J~lJ :-, ,Tr l~,f J1 1

i' . I 1'., 1[:

.. f. -~ 1HE HARGJN FOR OUrilIFICATIOH .1--.+-+-i-1--+ tttttttitttttttttttttitttttttttttHtttttttr.-ltttrr j '-~l*. I .l lJ r.-u _I f'.\S. OEFJNED IN IEEE 323-1CJ7-i IS '. =*

. l If l

1* I Nor iNcLuoEo . 1 1 , . w ri. 1 : *

--~111-- fl I

,\

11 O"- '1 _0 i

_j

t.J.LI. --tT'f'jliLl lf1tl~~flj~~ll~111111jl~~l~1-1 ~l* _ f 11 ., . * *- - -- -

I

- * *tl~H-:=:::.:::

. m _,__,_ -- j

-L- - -

---~ :t 1It

, .Jn

, .Jfl!i+H lW.u.~'

lfi1 ..lllWIWl<I~=

-0 z

I 1- '-

I .

- I l

I 1

1 * ,..

[!

-~

11 I I I I 11 1111 - - -

l"'nnm

. I 1111.

J> I ' I I...._, ....

0 1 I

I-

'If

~

lf) l>

1-

<I:

er w

3.~ l-.U1J -* ll * ~Jijl l 1 l ~ I tl 1-~ -: ~ -: -

D ID I . . . I ' l ~ II

_J rn Ooc u

(/) -0 :0 x fTl ..__. .......

u

ON r-n n DO])~ }?

~ Z :::0 -I

,___.~_

v*

c Z

Clr J>

-<-u OJ o

r.

t

. . 1'1

~

o .. - - . I I F-li;!1 .8~1,l ! 'I

I l ---.. ---

11 .: ~ :~- - - - II - 1 -:. _ ~ "::---- .I ~ l I :1~

I, H ! __- _: ~ _: - 1~ *~ ~ ~ =~ - ~ ,~ ~. L l***

c OJ ::rJ ,__,

Drnr--u J

'i

-o q

t.0 r*-t-. - , ,1 !1 1 i I - --~- - ")

1

,,i,

'11' j! H

~ ~;

i -_:~{: . - t 'l ~rm',. I !~:1 (f) (f) 0 D

,__. --0 ._. z *i: : ~*

(f)OZPI . !l(JllllllillilHIllll!U 1-1-111111.'11J.!1UKlliWlillllUill1~ 11111 tll tllilllillUUilli till~ti l -~ ~~~~ jJ 1\ t id~ :l z C)f ...

n rn tn

0

U Dmrnn J::

-u .0 ~.I t *

0 r* N IU! U TAll..*V ,._.

~ (f) * '.I ~

.( .,,

'1)

I-urn Ci OrnN t*I C OUl 0 D~ ,' (.j 7' IJ lSl rrl J> .

\1 .. FREQUENCY (Hz) r

. ~

---~----- --- -*-- ***-* *---- .. *-----*

SSE = 08t x 2

-*-*-~- ~

1-~~1- - :=

jTl!'

1*1T 1n1nn.I' I *JI 11Tll~l1Jl11~1!*1~1 -Jr;*

['Il If*ri-;*1i*;:~1;i: i;;*l*\1ni \ff 111* r111*1:1:::::;:p--!: .. ,i i;, - .

IiiI *1 1*'l-l 1 I*:: 1!j.llJ1\ ii\* :;;::11\q'.I i I i . i ',i*:**1ti1

i Ii :;1:i\:l1':1;1:i!

-~ * - . '\

I 1*1*

I I ., . *1 f-1" 1 11*1: 1<1ij Ill'11 111I\ 11*1Ji IiiI* 111.1,.1o1i11.

' I I *111 I *1 1* 11* ,;1 I' I 1111I!: . ' : .. ,,,

' * '*I .'*:"I"! .1:, ....

... i,1.I

---~_ I L~ .. 1111i;.il ...!:\.\ . 11 11. 111: :*;:11\::::; I : . : :: :; ! : '. ! *:.}:. l".* ,*~:*:.1:

-f-f- j I I ' ... : ; ... : . I ... : . *i l II \ 11*1H**q! 1

I 11

11 11:.,1:1 1 1

1

.: .. 1 , ! 1 1 . *.,*.: .*

il:;;!

1*

,_ -*-f- ll ti 1 I 1.l l1:

11 1 \. 1 ;::~:!11 I

-j- I NOTE1 1\i\ ,.,, 1 l .... 1.: : ... ,1 ,:.:.,il.;11;1, MARG[N F~EOUlFlE.D FOR OUALIFlCATION 1 1

- THE AS DEFINED fN IEEE 323-1974 111 /ij:*l;i!'

1 I 11"' .'\ll!,

... 1 \*11*

I 1j " 111 "1:;' I I / I1:' 1:I ' :;,:

I I I 1 * " . I. I'"*... .. '

I !l ::":; *1;;::::l'.:: :1*': \:.:;;;'.:'.::::: 1 11 . . \ ..... ,,,_

.. ,,. :; .. ,.;:i, 1*:1**:**1** .. 1 !"\*i1r~

I'.

1 I' ii i!:'i*11' * : " ". ! . ' " "*I \ I I . . i .. : I\' \ 11' "" 't1 IS NOT INCLUDED 1!II 'I' "d',:* I I I I i 1

1 i\ :" 11 ' :!. ;' 1'.'! j!'\ ::*

l1,illl11,1 I I I I 11 ... , "'* ..... ,, ...... ,..,. "' 1111~1""1 1 -*-~~*-*-l=l= 1'1 'fl /jl';I 11*11l'i11'jl" !*1*1*1*:.1*\*;:11 I . : I . I ** '.

- I 1 1 il:ji1!11 Jl*J *::! 1i11.:'.1.. Jn.11 I I I.' I* I : . : >* ..... 11k1;::ii1,:,

1 -H->---~-l- I~ 1111~1111111 I "I I 1!:I!1 :ji:~*li JI 1

- 1

1 1 * , I \ , ,*

l-1 I *. J 1 *l*'.:'1"1 i* I 'i;*11ll1'i'\:i\j11;:

I

1 .I I * . 11 , 1

11:11

I , 1

'.' .. *>::'i**1'1*';j 1 , , * * * , '* * * * ** . r *.

\.:.;i1*1 'IJ'\;iiJ Ir * * '/* lp J 11 i11 1l,li:j rr'I I 1 1 H tJH ~ r I' I 11 1;--r-1~~r--rr,~1 111 1111 111' !1;L *!:1;* :--*-:-j-*-!.*-!* *1* **1,.:* : !*!1'1:,*, 1 111:;F ..*i'- j)j I . I r-r I* 'r'' *:II', *,I :* jti 1;1.,1., :1: I . I~ 1 It* . . . , ii'! . . 1,.1.

j .. , , 1it**1 :1f~, .:1,;i1ll !*I 1.. ,)1,,*;11!".I'"' :*.l;11~l*1I!

1-i.---1-.__ -

111 I . :111 */I!

1-1*1 1 **

11 *I':"** ., .... .,*;**1*: 11 j1\I.

'*;!I, .* '*th 1**11 !11: 1 *1l1 1ii'" 1;1 ,, 1................ 1 ! 1 l

jl I 1 ' ' . I I 111

---*-~~~ 11\ 't\'I --11-'1 1-1-1 U***.- ..

I' 1i--:1'*Hll :1:i"I' 11 I 11: 1l

1*1 1j*1!i"" 1... !q*:": ..... .,J :11111., *II 1*1*1:"'

1 I I' 11 .. ;* ..

- :!1lln*1"'*

-~_tt.. l-Jllrl~11 jlj!~'*I

!i!

,___ . I I - - -1*l - 1 1" )'I 'I' II 1111 I"11II' 1'1'"""

J * '*

11 ... '*"1*1'"""'*\'*1: !*Ii .... ,... fHl11 1

.=::::::::'-,__ 1-

. -- 1 I iJ -1 l

111*11 ti l 1 djll I i1 I j1l'11.llj1l1fiii

It11 1*1

1!- ,rl\JJl1*!: I. 1I'1111 1ij;::, 1'-I iI j iI 11:\\;Iii:.:

1*1 *1111": *-r I I **11*1*11 11 """! ,,

llJi!'.;:1:1:1\ 1 1'111' 1

I 1*111*. l1:l ij'..

1 l1: :;;[:1'

2 - j 1-l-*r11 , . .1t rl'* 1<!~* ;1 111'1 ;"pjnj :!::1*i.*1i*i;i:, ..;;::*:', 1!1 .,:'. :.,1*H11l:i' 1*** **: tt J.

t rt+ H~11I1lll I. '\I"'jlf1':!1,;H,P-*1

-t ' 11* ,, I .q .* ,.*1.... I 111***;111:::;:11,;;:;111.1

!1 .. 1,. 1.,.,.1.,, " ..,.111,1111*11' L __ * ".

I\

I . . . . ----- - I, I:":

11

-0 CJl 1 .. lj1;*1;n I

. * -"1* L-4.... '

l . 11r 111 ,i1 'II/' 111; !:1:1;,,, 1 I 1' : ! i :.q;i:1,, 11"'il : : :i\.'1" I:):* 'H ii.

~

111- t Iii IiI jI j

-~

...... I ff .

1--1t1+1* 1 ~r, j'Ill 1 \*11 11-l--~- L1,l1j lq!,1111111:1/t1111'll1i!~ li11111111:1:::;11:,,liii::' :l'*'li*':i:1:!1*1*lh~.~

I ---

I .. - - -

I I I I

- 1 I

11:11,11111'1 I' I*, .. Jj'1'.!.I I ,

I ',I 11*l*:*lj*.1il11111 1 *;IIi :H*11:lil'fi1

. 11.. 1I 1..:* 11,*:"'

1I t'*'l"l ,, ... :. *:*"1"1**!',~*j 1' I" I* I'!' 11 *1 (j)

D 1-I 15 -~

I 11

.. 1 . + - * -- ... -

- ~: 11 *1. 1 **111 I . I I 1

l I 1* 111i!li:1l1-:r* '"lI" 1-I' '11.1 '*1'i

_jl l~~r*: - +--.L.- - : i 11 "i1i'111 *:*1 11:11" l r;....I\ ~ *:i*.i***1 I 1 l**1*.' '"'j 1'" 1*1ril~

'r.t' I~

~t* .:I~

0

!'Tl 0 < c

.,,,,., D ~

i- , - -~

- -- *-.- - - ----- j11'IH I I *

, - I '

1111 111 l\ilj

_L._ I

r

' -

I '.

'!1 *1* [L_1...r ....* ~ !'I21.: O?~MP!tH.J 11ll*1*1 IN..:11;:1.11 I 'I. ' ' * '

! 11 I1I! ill

I

"~#:,

i:1 111t

~.;e~LlJ-i1 ~l i i I 1 *j 1 u 1 1 ~.~1 -~1: 111 1~

- -- - I I I l'lr\l.I !***Jl/'1111**1*1*1! !1' ,, ** 1111.Li

(/) t *-* *- I .

li1~'11 I - - i1 :;.i*; I'::*:; 111 :]1 ,,11 I ilJ1;1iui~1 rn::o~

l u 1 1 1il1._1.1111t1 1l*'L_.1. 1: !ii!.!t ...i*

~~Sn it1111111n11 ::* j1 _

CJ. -i..-k *-. . - 111 , I H 1,l.1 11,1.i: Iii!\~- _ . r.Hl,,5% I 1:*1*10(\MF *11111 **1'" u~c,\,I ;..11ljli::1!fiiH 1

1111 I' h To

jo~~ l~,**IH l,..<- -

~ J, 1f i,111 !\- :.~ :*1l'l1f~~

I "

---1--- I 1J 1!:1 I ;;i h t

II Ill "' I I 1l 11ill1l;,l;;i1l;,1: 11 I "**:*I\:

~-1 I I I I l+H+t I/

In .

I1II I I I 11111 *II 111 II1 t "'""1 . _J_ 1:1 i,,.jl :: .. <--- *-j-**1 ;tl*-t\111i** .,;.\,.,, .:!11 z~-<-'. lll~~.1 :.~l!!1' ~!, i1ii:1.!l*;*::1~:~1~: :i 1l: ::1 ..... ~;

1 1 1 I t !*1. . 1 C1 ::0 -l1

1 1-1)"1,

1. ltJJ* ii!:l. ir. !mm1i1j11 *1.111 11 Wit; 1 1,,, .,,. .., ,, , ,_.,c._.. kwt .t:t irt1. h IJ.11,. 1 1 11!J.

1'11'1, 1, .. ,

.. H!1 !Ill, H\ :'n11* , . 1 11. ,I , , 1,1*111 I 1: 1

1. 'ti; ,, 1,,,, I':11I'~.:1"I!:1.. )\mt il,\1l1. 11 .1J

!. \IJI. \ 1: 111!n"" : ,

r-.... .... , , .. .1,,,. 1* .. *

UJ~~~

DU).._.

I~

I 1-l- _,_ . . . ..

I I I I-I-

L

. ~

I*

1 111 .. i.--i-<- _l~-.1.H !11 :, . 11*!11

~

--~:

- - -. .- - -1

.. t*

. ~ -.*1111'1li11~11

!!! H .I i I' I 111 Il *I*11 I' . 1 *111,i'ij. I : 1 1*i 1 1:~:!J~ 1 1 *1* 11 1

... :j 1r1i~ .111111

. I 1*111:,!'1' ii :!! ;11 1*. I.

'I . : ,. 1I1,.:

1 (J')'"l:Jr-u

-oOD ll>z~~ i l

.ati : : " .: l JI r II : I 'I I n' l 111 I i!ljiliTjTr i i l i!

iirgfir n

~~~8 J - . l . .l .- I. ! 1_LJ

-~~--*

I*' 1illJ' I

. 1J[j ,,1!

II l:.1.,_J U~JU Jl\, '111t11l* \!1 *!!1,11i1* 1

'I J ... :l" .. L..1..-*

1

, I ., J !' I

. . . I I:

.3 .4 .5 ..G .7 ..8.'l 2.0 ~.l:'.l ~

..2 i..a tU &.Jt 7.0...ll'Uld

1*

~4()1 .:*1 r'1~~...

J

.. ._ l Fkt.uut..NCY (H.d

~

)

i-4

.* :~ .

GAMMA-METRICS SOFTWARE.

REQUIREMENTS SPECIF/CATION CONSUMERS PO\'/ER COMPANY THERMAL MA.RGIN MONITOR

t

~ .

DOCUMENT#" 055 JULY 9, 1986 Re vision 3.0

TAB LE 0 t- C0 I~ TENT S F'.'.lgt:

1.0 5COPE ............................ : ................................................................. 4 2.0 APPLICABLE OOCUMENT5 .............................................................. 4 3.0 OVERVIEW ....................................................................................... 5

3. 1 FUNCTIONAL REQUIREMENT5 ................................................... 5

3. 1. 1 6 T PO\'/ER FUt,lC:TICH'L. .......................................................... 5

3. 1. 1. 1 6 T F'O\l/EF: E><TERNAL ANALOG HWUT5 .......................... 7

3. 1. 1.2 1:1. T PO'dER OPERATOF: AD1..IU5T AE:LE PARAM5 ................ 7

3. 1. 1.3 Tc ALARt'1 FUr**lCTION ....... :............................................. B

3. 1. 1.3. 1 Tc ALARl1 DIGIT AL OUTF'UT .................................. B

3. 1. 1.3.2 Tc ALARl1 AD1..IU5T ABLE PARAMETER5 ................... 9

3. 1.2 F'O\.'~'EF: DErt:iIT')) PF:ETF:IP /TRIP FUNCTION.......................... 9

3. 1.2. 1 POWER DEt~51T\' PF:ETRIF'/TRIF' F'IECEWI5E FUNCTN5 .... 10

3. 1.2.2 F'O'w'ER DEN5ITY ANALOG INPUT5 .................................. 14

3. 1.2.3 P0\111ER DEN5IT\) DIGIT AL OLJTPUT5 ............................... 14

3. 1.2.4 POV1EF: DEf'l5IT\) AD._IU5TAE:LE F'AF:Al1ETER5 ................. 14

3. 1.3 Tl1/LP (PTRIP) FUNCTION ...................................................... 15

3. 1.3. 1 PTRIF' PIECE\111I5E FLH~CTION5 ........................................ 16

3. 1.3.2 PT RIP ANALOG OUTF'UT ................................................. 1B

3. 1.3.3 PTRIF' E><TEFir'lAL ANALOG INF'UT5 ................................. 1B

3. 1.3.4 PTRIP EXTERNAL DIGIT AL INPUT5 ................................. 1B

3. 1.3.5 PTRIP OPERATOR AD1..IU5T ABLE PARAt'*1ETER5 ................ 19

3. 1.4 t1ETER RELAY ANALOG OUTPUT ............................................. 20

3. 1.5 VARIABLE HIGH POWER TRIP ALARf'1 (VHPT) .......................... 20

3. 1.5. 1 VHPT ALARr1 ANALOG INPUT5 ....................................... 22

3. 1.5.2 VHPT ALARl1 DIGIT AL OUTPUT5 .................................... 22

3. 1.5.3 VHPT ALARM ANALOG OUTPUT5 .................................... 22

3. 1.5.4 VHPT ALARl1 DIGIT AL INPUT5 ....................................... 23

- 3. 1.5.5 VHPT ADJU5TABLE PARAl1ETER5 .................................. 23

3. 1.6 HI5TORICAL TRENDWG .......................................................... 23 Tho?rma 1 Mar*gin C,i lcul,ilot*

TABLE OF CONTENTS

( crn*~T I r'~UED)

3. 1.7 or~-LINE 5'15TEr1 TE::;Trnc; .................................................... 24

3. 1.7. 1 PO\'Y ER LIP rn IT I AL TE 5T ................................................. 2 4

3. 1. 7. 2 OPERATOR lf'HTIA TEO 5ELF-TE5T .................................. 24

3. 1. 7 .2. 1 Ar1JALOG I/O TEST ................................................. 25

3. 1. 7 .2.2 DIGIT AL I/O TE::ff ................................................. 25

3. 1.7. 2. 3 f( E\/ F' AD TE 5T ........................................................ 2 5 3.2 NON-FUNCTIONAL REQUIREMENTS ............................................... 26 3.2.1 INTERFACE CON5TF:AINT5 ..................................................... 26 3.2.1. 1 H*1J1CJF'ERATOF:5 ........................................................... 26 3.2.1.2 Tt1M HARDY./ ARE ............................................................ 27 3.2. 1.2. 1 TMt1 Etv18EDDED Cot1PUTER ..................................... 27 3.2. 1.2.2 FRor'ff PAr~EL CRT DISPLAY ................................... 27 3.2. 1.2.3 KE\1 PAD ................................................................. 27 3.2. 1.2.4 ~~E'y' 5V/ITCHE5 ...................................................... 28 3.2. 1.2.5 5ELECTION KEYS ................................................... 26 3.2. 1.3 Tt1t1 ::;OFT\'11AF:E ............. :............................................... 29

3. 2. 2 F'EF:FOF111ANC:E C:0~~5TFIAINT ::;., .............................................. 29 3.2.2. 1 THROUGHPUT RATE5 ..................................................... 29 3.2.2.2 5\'5TEl1 F'O\.\*'EF: C'-/CLif~G BEHA\/IOF: ............................. 30 3.2.2.3 F:EPEAT ABILIT\' ............................................................ 30 3.2.3 OF'ERATrnG CON5TF:AINT5 .................................................... 31 3.2.3. 1 KE\'F'AD DATA ENTRY .................................................... 31 3.2.3.2 OPERATOR SKILL LEVEL CON5IDERATIOr~5 .................... 31 3.2.3.3 EF:GONOt1IC FACTOR5 .................................................... 31 3.2.4 LIFE-CYCLE CON5TRAINT5 .................................................... 32 3.2.4. 1 MAINTAINABILITY ......................................................... 32 3.2.4.2 RESOURCE AVAILABILITY ............................................. 32 3.2.4.3 VALIDATION AND VER IF I CATION (V&V) ......................... 33 3.2.4.4 F'ROGRAtvlt1ING 5TANDAF:D5 .......................................... 33 APPEr~orx A - OPERATOR ADJUSTABLE PARAMETER5 ............................... 34 APPENDIX B - ANALOG AND DIGH AL I/0 .................................................. 36

/

1.0 5COPE Tt1e purpose of tt1is docurnent is tc1 pro11ide a sofbvare. speciiication of

the GAr'1MA-r'1ETRIC5 Tt1ennal r*1argi n r1oni tor (Tt1tv1). Tt1us each re qui n~d function of the TrH*1 is described in detail, along wiU-1 inputs and outputs. In a1j1jition to tt1e functional n:quirernents, any associated non-functional n::quirTrnu1ts are discusssd. Among the non-functional requirernents ar-e. pe:r-fm-r-nance constr-aints and life-C!:JCle constraints.

This document does not describe any of the Tt*H1 displays or di:Jgnostic message:;. H12:ss itt:tr1s v*till tie e:xplaine1j in an Operating Manual, vv*t1icr1 2.0 APPLICABLE DOCUMENTS Tf-,?

I I._:. fr"1lnl\';,,.,n I ,_I 1 rlQr'\jrr1G*r'._<"

I _1 ; ' I : : d u . .._. - . . . I I I.. :_, ur1ri::*-* r-ofr,t-rt-1~

1_. r:.. l

J tJ-J

- ;n l I ._h1'r*

l i *=* C*'"i'-*c;f1'cr;.1*rr'

-* l-' r:... * \ Q 1_ J I

n:-: f ert:nct: do cwr1 i:::n ts se:rv in *-q to c U:ir-i i q or supp 1e.rnen t this ~; pe.cif i cation.

~

1\ 1-*_.o,".-"

_.1 ,.:.ur*.1c:.1 ::. F' u- ..*1*1'.i:..r

..-.*-.- -, 1-*

~ornp,jn~ r I docurnt.n r*_ ._I-._1=.....

r. /1 6-._!L -130, ~;tie.et 1.

3) Arnu-ica National 5tandard AQ.Qlication Critsria for Prograrnrn::t1Le:

Digital Con1~1uter 5!:JSterns in 5afety 5ystsr-ns of Nuclear- Povvt:r Ge:ne:rating Stations - AN51/IEEE AN5- 7-4.3.2-1982.

4) GAMl1A-t'1ETRIC3 docun*1ent #Q56 -THERMAL ~1ARGIN t*10NITOR HARD\111ARE 5PECIFICATION.

5) .C3Ar1HA-t1ETRIC5 document #Q6B - TMt1 50FT\"/ ARE QUALIT\'

A55URANC:E PLAN .

Sc*ft'w* at*o? R,;quir.-mo?nts Sp.;cification

3.0 OVERVIEW The GAt1t1A-t1ETRIC5 Thermal Mar-gin t1onitor is a self-contained, microprocessor tiased, 19" r-ack-rnounted product \"lhicr1 is tzirgeted to r-eplace the e:.:isting .0.T zind Tt1/LP (Ther-rnal t1argin/Low Pressure) czilculators 2t the F'aliszides ~*luclezir F'lant. The s~stern hardware.

S'Ni tct*1es, and four rnrnu se. l i:::c ti on svv* i tchi:::s. The front pane 1 l zi~out wi 11 be 1jesigne.d ior- t.ase of use.

The Tf1t1 e:m:isdded computer program wi 11 pro vi di::: those functions de:::cribed in Consume.rs Pmver Co dravv*ing ,..JL-130. The TMM's prirnziry function is to repe.::ited11~ calculate LT Povve.r, ~

Pov,:e.: Densit\.l pretr-ip/ti-ip,

~

Ti'1/LF' Ptrip and tt-1e. Vari::::ble High Po\vt:r-Tr-ip. The n::sul ts of these

":.-.,..1.-*~*-*(1 --*11""':-.11f--.

U J 1 r,:! I U '.j U l' l ;...1 --~ t.. ~ *

3. 1 FUNCTIONAL REQUIREMENTS This section describes each oi the functions prcvidsd in the Tt1r-1 and the infcr-rnation flo"N \Vi thin an1j t;e:tvv*esn each of U-1t. funct1cns.

3. 1. 1 .0. T P0 'd ER FUNCTION Tt~e l. T Power is a function of the highest cold leg ternpe:ratur-e, the a'.;erage. hot leg temperature, and a temperature differentiator. The cold leg ternper-atur-es and average hot leg te.rnpe.ratun~ are r-ead ti~ the Tt*1H as e>(ternal analog inputs .

Pagt> 5 Thl?rrna 1 Margin c~ lculator

d

.£\T Power= Kcx.6.T+Ko.6.T 2 +KiT cilT+"C-(a.6.T+T c)+BIA5 dt The. rangi:: of the. cal cul ate.d LJ. T Pm*vi::r is 0 to 125% Povve.r.

Hie tirr1e: dtTi'*/ative in tt1e. at1C1'v'e icir-rnula \'\1 ill tie estimati:::d as follmvs:

sin-ipl~ subtracting tt*1e. pn::'l.iious 'v'alue oi (a* Delta T +TC) frnrn the C°f

._. r* 1-1 I**1 *"'

-* -* ,_ *J iI !~-,I ud.~" *-e e-=- ~ ::i ~1r*:::**-*I~*1t1 '-*c.* it'* rir--1 e-* *-1

-* '.,:! I -* _. *-* l ' I c;e-1-nn u-1 *

'I

.._. T'n..,t . "*- ,. ., ,. , r." - n~*--P: r-",..,

.;.c:.. t_1l1-**-- r: 11 nd "ra.\*1hi" I,.,,

.:*C:.*-- ! \'U 111 <"> c

- r-_..._. '*";

fl I 11 b'C.-0 c-rn n 0 t 'n,..,c..Url

.,_, - I t--11

._.::; pur*_!_~ 1* nn::i I

The i"ilti:::r- im-rnu1a is:

DIFF = GArn

RAV~_DIFF + ( 1 - GAIN)* OL[l_DIFF GAIN = reciprocal of time constant DIFF = estirnate:d rate of change: of (a* Di:::lta T +TC)

RAV~'-DIFF =ct1ange in (a* Delta T +TC) during one. second OLD_OIFF =previous value of DIFF, one second ago Note tt1zit the operator can set the tirne. constant to st::con1j in c:irijer to cause DIFF to equa 1 Fl-A'w' _DIFF. -:

The T t1 t1 embedded comp u t er program w i 11 ca l cul a t e the power equa ti on automatically, every second. The result, .6.T Power, is displayed on the front panel monitor and is al so used 1n the n1/LP Trip rune ti on. Tt1e various terms used in this equation come from both external analog inputs and internal oper-ator adjustable parameters.

3. 1. 1. 1 6 T PO\A/ER D<TERNAL ANALOG rnF'UT5 Thn::e analog input pan:imeters are used to arrive at tr1e Tc and .6.T equation parameters: Tc 1 , T c 2 , and TH AVE. TC 1 and T c 2 are both cold of 5 15 - 6 l ::1.; F. Tc i s equi val en t to the ma:><: i rn um ( 1ar ger number) of TC 1 and T,-.,~,. T w AVE is an averaqe or "active loop" hot leq ternper-ature with a LL IL - -

n,. r-r< . . ..,..,.

'-I_. (.,\ l~t.- 01* 1-C:'v'

.... c***~-r-,-,,-*nr1nd1*r~q

- -*1 i:...:*!-- - I J 1__ tn- t,.,r...I**r*or-::.t-1Jr-o*~

C.* li-1*-* (J *- ._.,:.

1"'f c,J 1c0 - f_I 1:::::oF

_, ._1 .. hi.Tis squi'v'alsnt tc1 the difference betv*isen TH AVE and Tc*

In surr1rnary, TC = f1A>-'.(T C1,T C2) anij 6. T =(T HAVE :- Tc)*

3. 1.1.2 6 T F'O\.vER OPERATOR AD._IU5T AE:LE PARAMETERS 5ome of the par-ameters used in the .6T Power equation are obta.ined frorn the internal parameter table. All pan:imeters in this table are stored in tiattery tiacked-up volatile: mernor-y so that they can be adjusted by the Operator, yet they will not be lost upon a po 1Ner failure. The volatile:

memor-y will be backed up for a n1inirnurn of 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months should t11ere be a

power failure. Seven parnrnete:r-s are used in this equation:

Softw*.;,r*.,. R>?quirem>?nts Spo?cification

PARAt1ETER ADJU5T ABLE RANC:3E K$ 1x10- 6 to 5x1o- 3

KO' Ke<

a

-r

-1x10- 5 to 1x10-5 3x1o- 2 to 1x10-3 O to 10.0 o to 1.0 8IA5 -0. 1O to o. 1o TH1E Cot'~5TAfH 1 to 30

3. 1. 1.3 TC ALARM FUNCTION An additional operation is pe:rfrn-rned on ttie czilculated TC 'v'alue. If at any time Tc> T cMAX or Tc< T cMIN, a 1jigital output T CC (contact closur-e) is to re:set (close) the: contact. That is, if Tc falls belovv T cJ1H*I, Tc must r *.--~. 0 I .:i G *'

C'C>'

'-l /Q

~r.,-,,,..,t.:.

G !..* -* ll tht:"

T MT~.I I c: I "

I ..

,,,,,,,,,.., .. ,.., r-*"*~-1:::-,t

\' u I u t- l '-

(c*lr,.-.*"-~ '"he,

~* ..:* . l l . t 1_. ..:* t.) 1. t I C.*

,-*r.n'"""....

1_. L* I l u L* :_ *

'=rr-*1***-111

._: I I I 11 I qI ! .'.::' '

t I r*,ln rln,..,-~t,...,.-

1- "-**~t.1 u1.u1 1*nto--**"'n'";n....,

._.t *.i ..... i 1.1u11 l.";:; n"'C""""'r11 ... u r,.,.c,..,+-

c.. t...:i.:iu ::i t,..., c:.._.t.l ._.h lt _.

0 al arm condition.

3. 1. 1.3.1 Tc ALARt1 DIGIT AL OUTPUT A single digital output (contact c1osure) is prnvi ded for use with this function. This contact T CC is normall~ closed and will open upon a trip condition .

Softw an* R.;quirem.;nts: Sp.;cification Page 8

3. 1. 1.3.2 TC ALARf'1 AD'""IU5T ABLE PARA11ETER5 The parametus used in this function \*vhich can be adjusted are as

follows:

PARAt1ETER AD._llJ5T ABLE RAf1lGE T cf1AX 515 to 700°F T ct1IN O to 1:ioo°F

3. 1.2 F'OldER DEN5IT\' F'F:ETFIIP /TRIF' FUNCTION Tr1 e purpose of the: Po v*1 ex Dens i t y Tri p fun ct i on i s to ac ti vat e a set of contact closur-e:s (di1~ital outputs) tiassd upon cornpar-ing con:: A::<ial st1ape index (A51) an1j tt1e. a11D'Yvsd A~H vvhich i~; a function of Con?. Power-. Tt*1s A2il is dsrived from the deviation of line,3r- po*Ner li:::vels in tr1e upper- and povter 1e'v'e1 and is a rr1ezisure of the pm*ver 1ji s tri tiu ti on be t\Al em the upper-

Jnd lov*tET portions of the core. A larg_g_ A5I magnitude: corrssponds to si gni f i c:Jn t fl u~< d2: *.; i at i on ti i::: t vv-e e: n the upper and 1o vv* 2:r- po rt i on s 1J f t t1 i:::

core in eact1 quadrnnt. Hence, this function pro'li1jes a ti-ip if tr1e A51 is too gre::Jt ior- tr1e curTent po**..ve:r- 1evel.

This function is ca 1cul ated once t:'./t::ry 100 mi 11 i si:::conds. The mathe:rnatica1 function is cornprise1j of piecevv*ise linear functions, a C(]lculated LPD (Loczil Power Density) blocking function (defined zis Q2),

anzi log inputs, and Operator adjustable parameters. This function wi 11 open/close zi PRETRIP or TRIP set of contact closures as follows:

Open TRIP contact if Y ~ Yp or- if Y::; \'N P.agi? 9 Tho?rrn.al M.argin C.akuldtor

Opsn PRETRIP contact if Ypp:::: '-!or',(:::; Yr.,lP

\.Yhert::

L-IJ Y =ASIF(--)

L+U YF' = LPDFP ( QR 2 )

~,r 1 r r R )

YN = L *L-rn ~ '~! 2

\'pp = \'p - b YNp=YN+b QR 2 = ~PF ( Q2 )

Q = ~IA>< ( *f , l. T Power )

( 0, if Q ~ 14.5% Power I

Q2 = '

l MA>< ( t , .6.T Po"IVE'.:r ), if Q ;:: 1:~% F'mi.i*sr Q2 h2s c 0.5% dt:adband in tr1zit Q rnust drop from 15% 311 the \'\1 3y to t

14.5% Power to change fr:xn t"1AX ( 1 1 2.T PovvTr) to 0. :3irnilarly, Q 1

must rise from 14.5.% an the *way to 15:?6 ?ovof?:r to change from Oto

~1A:~( d\

I.

ii. T Po V*f t:r).

ASIF, L.PDFP, LF'DFn, LPF are piecewise linear functions described belmv. Land U ar-e: line::ir- PD'Ner analog inputs descr-ibed in :::2c:tion

3. 1.2.:2.

3. 1.2. 1 PO'w'ER DENSIT'*/ PF:ETRir' /TFIIP F'IEC::El'l'I5E FU~~CTICN5 Tt1ere are four functions used to calculate the Povy*er Density Pn:tr-ip/lfip function. These functions are: piece:\*Vise linear since seve:r-al connected line segments make up each function.

The LPDFP and LPDFn are actually the positive and negative "sides" of the Local Power Density Function. This function consists of four- connected segments, two above and two below the X-axis. Thus the LPDF P Sofl*war*e Requin*m.:onls Sp.:ocificalion Page \ 0

f unc t i o nc1 \' c 1ue i s ti 21 ::: ed upo n t he po s i t i \1 e po r-t i o n o f t he f unc t i o n 21 nd U-1 e LF'DFn functional value is based upon the negati'v'e portion of the function grapr1. H1is is depicted as follows:

LOCAL POWER DEN5ITY FUNCTION

'y' p

(X1pd,'r'3pd) yPF' Note: 1~2~,d must be 1ess th::ir1 or* equal to :~3pd Hie PRETRIP region is the shaded area 8nd the TRIP region is an1=1vrhere outside the graph.

The line segrnent endpoints ( Xipd, 'y'ipd) ar-e: included in the: internal pan3rneter table and are OpE.Tator adjustable as described in section 3.1.2.4.

The third piecewise function is the Loca Peaking Function (LPF). The 1.0

"Q " value: on the graph is e:quiv~lent to 100% power. This function 2

Softwarl? Ro?qui1*em1?nts Spe¢ification Pago? 11 Ther*ma l M;,rgin Ca lcl.Jlate>r

cci ns i s t s o f f o ur- cci nnec t e. d 1i ne: s t: gnw n t '. : depi c t e: d as f ci 11 Cl w ~: :

LOCA PEAKING FUNCTION 1.0 0

The line sr::.gmrnt endpoints ( Xi 1P, \)ilp) are included in the internal pzirarneter- table and are Oper-ator- adjustatile: as specified in section

3. 1.2.4.

The Axial 5haQe Index Function (A5IF) is a piecewise function consisting of tt1ree connected line segments:

Pago? 12 H1o?rmal Margin Ca\...':1.Jlalor

A5I FUNCTION

y The resulting \l value is called the: "Axial Offset", and is compan~d \*vi th the positive and negative outputs of the Local Power Density Function.

The Axial 5hape Index Function is determined by the four points (Xi 38 ,Yia 5 ). These points are included in the internal parameter table and are Oper-ator- adjustable as described in section 3.1.2.4 .

Software Requirernt-nts: Specification Page 13 Therrna l Margin w\...-,ul.ator

Tt1n:e analog input par-an1eter-s are used in the Power Density Pn:trip/Trip

function: LI, L, and range of o to

t. U and Lare linear power readings and t1a*.,.ie. a DC 10\/ corresponding to a power range of is calibrated nuclear Qov.,1 er, and r1as a DC range of Oto 1OV corresponding o to 125% power. t to a power- r-;3nge of Oto 125% power. Tt1e analog inputs U and Lan: used L-U in the calcul(ltion of "subch(lnnel deviation"*YE: = (--) and are used in L+U the calculation of Y as defined in section 3. 1.2. The input variable tis used in the "Local Power Densit~ Block" Function. For power levels be.low 15% calibr-ated nuclear power, Local F'ower- density trips are inhibited.

3. 1.2.3 PO\">'EF: DEN5IT\1 DIGIT AL OUTPUTS Tvvo digital outputs (contact closLwes) zn-e provided for use with tt1is function. These are: tt"1e: TF:IP and PRETRIP contacts de:scr-it1ed in section 3.1.2.

3. 1.2.4 F'Ov1/ER DEN~iITY OF'ERATOR AD ...JU5T ABLE F'ARA~1ETEF:5 Tt1 e t: n1j po i nt s us ed t o rn ake up t t1 e pi ece: wi se l i nea r- f unct i o ns, th e poi nts detenr1ining U-1e Linear Function, and U1e PRETRIP factor bare stor-ed in the internal parameter table and can be adjusted by tt"ie Operator. The follov11ing is a list of U1e Operator- adjustatile parameters used in the Powe:r Drnsi t~ pr-etri p/tri p function:

PARAMETER AD ...JU5T ABLE RANGE WHERE U5ED x 1pd - O to O Local Power Density Fune.

X2pd* X3pd O to 2~0 Local Power- Density Fune.

y 1pd -1.0toO Locf'.ll Power De:n~:ity Fune.

Y2pd 0 to 0 Loe a1 F'ower- Density Fune.

Y3pd O to 1.0 LOCCll F'OWff De:nsi ty Fune.

b o to 1.0 Local Power- Density Fune.

xl 1p o too Loe a Peaking Fune ti on X21 P' ><31 P' X41 p o to 1.2 Loe a Peaking Fune ti on Y 1lp' )2lp' Y3lP' Y41p O to 1.2 Loe a Peaking Function X 1as' >< 2 as' ><3as 1 X 4 as -1.0 to 1.0 A5I Fune ti on Y 1as' Y2 zis* Y3 as' Y 4 zis -1.0 to 1.0 A5I Function

3. 1.3 Tt1/LP (PTRIP) FUNCTION TtlE~ pur-pose of tt1e Thennal t1ar-gin/Lov'i Pr-essun~ function is to provide an ana 1og output pressur-e si gna 1 PTF:IP' derived f rorn an equation using ternpeniture, power, and some Operator adjustZible pZ:Jrarneter-s used in piecewise linear functions. This ana 1og output has a DC range of 1O to 50rna and corresponds to a pre:ssLwe tietween 1500 and 2500 P5IA. PTRIP is descrit1e:d rnathenrnticallw as follows:

PT RIP = MAX ( PVAR ' PMIN ' p A5GT )

PVAR = J..QDNB + ,_BT CAL + o QDNB =QR 1

QA TCAL = Tc+KcB Tc= MAX (Tc 1 , T c 2 ). Also used in the ti T Power Function B =Computed fiT Power with a range of Oto 1.25 equivZJlent to O to 125% Power.

QA = AF (Y)

Y ="Axial Offset" obtained from the A5I Function ZJnd is used in

. _the Local Power Density Trip function.

QR 1 = PPF ( Q 1)

Software Requin*ments Specification Page 15 Thermal M.ffgin Calculator

(+, if ti T Pci\"ler 81 cick contact i ::: Q~:en o1 - I l MAX ( ~, fiT Power), if fiT Po\*'y-er- Block contact is closed

PPF and AF are pi ece'yvi se 1i near functions descr-i bed in sec ti on 3.1.3. 1. A,.!), o, F'MIN' and Kc are Operator adjustable constants descrit1ed in section 3.1.3.5. PAoGT is a pressure analog input described in sec ti on 3. 1.3.3.

3. 1.3. 1 PTRIP PIECE\.YI5E FUNCTION5 Tt1ere are two pie:cevv'ise linear functions used in the F'TRIP calculations-namel~ the Axial Function (AF) and U-1e F'ower Peaking Function (PPF).

The Axial Function consists of two line segn1ents, \*Vhich meet at a ver-tex:

AXIAL FUNCTION y

0.5

Software Requirements_ Specification Page 16

The two 1i nes are determined b~ three points- one of which is the vertex

(X2af' 1). All thr-ee points are included in the internal parnrneter- table and are Oper-ator adjustable as specified in section 3.1.3.5.

The Power Peaking Function 1.0 "Q 1" axis va_lue corr-esponds to 100%

power. This function consists of four connected segments:

_POWER PEAKING FUNCTION 1.0 0

1.0 The line segment endpoints (Xi PP, Yi PP) are included in the internal pararne_ter table and are Operator adjustable as described in section 3.1.3.5.

Software Requirements: Specification Page 17 Thl?rmal Margin Cak.'lJl<itor

3. 1.3.2 PTRIF' ANALOG OUTPUT

A single JnZJlog output "PrRrP" is prn'v'ided b~ this function. The PTRIP analog output t1as a DC r-zrnge of 1Oto 50 mA 'Nhich corTesponds to a pressure range of 1500 to 2500 P5IA.

3. 1.3.3 PTRIP EXTERNAL ANALOG INPUT5 The calibr*ated nuclear- power- input tis used by tt1is function. tis ttH~

same signal de.scribed in sec ti on 3. 1.2.2. wt*ii ch t1as a DC range. of O to 1OV corresponding to a power range of 0 to 125% pmver. This function i niji rectl y uses Tc 1, T c2 , and T HAVE as used by the .6. T Power- Function, wt1i cr1 is 1jescri tied in section 3. 1. 1. 1.

In additioni PA5 GT is used in the t1AX select portion. PA5 GT has a DC range of 0 to 10 V corn:spondi ng to a pressure range of 1500 to 2500 P~ilA.

3. 1.3.4 PT RIP E><TERt~AL DIGIT AL INF'UT5 One external digital input (contact closure.) is sensed for this function, namely tl1e .6.T Power Block. Tt1is contact can be either- open or closed and is controlled by existing plant equipment. The .LT F'mver Block contact is closed at;.::: 1o- 4 % power .

Page 18

3. 1.3.5 PTRIP OPERA TOR ADJUST ABLE PARAllETER5 The endpoints used to make up the piecewise linear functions and the various rnu1tip1iers used in this function are stored in Hie internal parameter table. and can by modified by tt1e Operator. Tt*1e follm*'Ying is a list of the Operntor- adjustable par-ameters used in the PTRIP function:

PARAl1ETER ADJU5T ABLE RANGE V1HERE U5ED x1pp o to O Power Peaking Fune.

X2PP' X3PP' X4pp O to 1.2 Power Peaking Fune.

YlPP' Y2PP'Y3PP' Y4pp o to 1.2 Power Peaking Fune.

-0.5 to 0.5 Axial Function

X'/~af X 1af -1.0toO Axial Function X3Zlf O to 1.0 Axial Function

'y?

~af

1.0 to 1.0 Axial Function 1.0 to 2.0 Axial Function Y 1af' Y3 af

Kc f:*

A

'6 o to 0.1 1O to 30 1ooo to 3000

-13000 to -4000 Tt1/LP PT RIP Fune ti on Tt1/LP PT RIP Function TM/LP PT RIP Fune ti on TM/LP PT Fi IP Fune ti on PMIN 1500 to 2000 Tt1/LP PT RIP Function 5ee Appendix A for the complete. Internal P:::ir-arneter-Tatile .

Svftwan* Ro?quiro?ments Specification Thermal Mar*gin C.alcJJl.ator

3. 1.4 r-1ETER F:ELA 'y' ANALOG OUTPUT An oddi ti ona 1 parameter "1)-B" is ca 1cu1 ated ever1=J 100 mi 11 i seconds and is

provided as a TMM analog output, at the rear Df the de'v'ice. "~"is calitir-ated nucle:ar QDWe:r and Bis tt1e calcu1atc:d ll.T Power.

DC range of O to 10.0 V corresponding to a pmver de vi ati on span of "4-B" t*1as a

-10.0% to + 10.0%.

3. 1.5 VARIABLE HIGH POV/ER TRIP ALARt1 (VHPT)

A Dynamic al arm monitoring system is provided \Yhi ch gives trip signals based upon "Q", \"lhict1 is the maximum of LiT Povver or Nuclear Power (see figure below). Tr1e al arm rnoni tor cal cul atj ons are performed every 1

100 rni 11 i secDnds. Q is me: asured against the tvm set points QPTR and QTR* QPTR is the Q Pr-etriQ. alarn1 level whict1 is set to a per-centage "Q%PTR" above the current Q value. QTR is tr1e Q Trig_ alarm level v*lt1ich is set to a percentage "Q%TR" above Q. QF'TR is bet"vveen Q and QTR (e.g. Q ~

parameters .

Softwan Requir-o?mo?nts: Specification Pag1c> 20

VARIABLE HIGH POWER TRIP ALARM

125%

100 CTR

(

O%TR I

CIPTR BO%

0 60%

Q (L~rge-r of 40%

Nui:: l~.;s~* o~*

Ttrt-t'rMl Pu'w't>t')

QC!'

rc*PTR- ---- \ Mdr1uo* t' Extt-rri.:, l S~ l~*C*irrt

Rgt't 20%

°rR t11N 0

Tlt1E The VHPT Alarm provides two contact closures for use by Plant equiprnent. The first contact, "Opcc," is opened (tripped) vv*hen Q rises above the Pretrip setpoint QPTR* The second contact, "QTCc," is opened (tripped) when Q rises abm1e the Tr-ip ~:etpoint QTR* Tt1ese contacts will be reset (closed) when Q falls below tl1e cor-responding Trip or Pretrip deadbar:id. These deadbands are set to 0.5% below the current QTR and

QPTP, values. -The contact closures wi 11 open/close wi tl1out Operator Software Requir*em.:>nts Sp.:>cification Page 21 Th..rmal Margin Cak:i.Jla\or

As the pm*vu 1n,.e1 "Q" is drnpping, botr1 the QPTR and QTR limits \'Y'i11 be

updated, and 'Ni 11 tr-a ck Q using tt1e corn~spondi ng Q%PTR and Q%TR vzi 1ues.

As Q is rising, the QTR and QPTR \/alues will rer*nain fi:><;ed at their current levels until either the Operator presses the 5ETPOINT RE5ET pad on the Tt1t1 front pzinel or an E><TERNAL 5ETPOINT RE5ET is received. If QTR re.aches QT Rt1AX, thrn QF'T F: \*Vi 11 not ri si:: any f urthEr. The External reset 11 i s prn vi de. d f m rn exi s t i ng P1ant equi prn en t and i s a di gi ta l i nput " t o t Ii e Tt"H1. The. setpoint cannot tie reset at all \0ihen tt1e alarm is in the TRIP condition. In ad di ti on, the Operator rnust wait at least ten seconds be tween sut1~:eque:nt al anr1 resets. Tt*1e T~1M \¥i 11 dea ct i va te tr1e reset capability for- ten seconds following an Oper-ator Tr-111 reset.

3. 1.5. 1 VHF'T ALAF:t1 ANALOf3 INF'UT5 A !3 i ngl e anal o g i nput 11 q) i s used i n the dynarn i c al ar-m sys tern. Thi s i s 11 calitir-cited nuclear QO\ly'ff and t*1as a DC range of Cl to 10\/ corresponding to a pov*ieT range of O to 125% power-.

3. 1.5.2 \iHF'T ALARM DIGIT AL OUTPUT5 Tvv*o digital outputs (contact closun::s) Opcc and QTCC are provided.

These are used to signal other equi prnent of tr1e al arm con di ti on.

3. 1.5.3 VHPT ALARt'-1 ANALOG OUTPUT5 A signal proportional to QTR is output to tr1e 'v'HPT setpoint analoq Softw ar>? Rtoquin?mtonts Sptocification Page 22

output.

3. 1.5.4 VHPT ALARM DIGIT AL INPUT5 A single digital input is used as tt1e External 5etpoint Reset. This input will be connected to a rnornen t ary push but ton S\*Vi tch, ex tern al to the n1r1.

3. 1.5.5 VHPT AD'-IU5T ABLE PARAMETER5 The following is a list of the Operator adjustable parameters used by the VHPT Alarm:

PARAf1ETER AD ..JU5T ABLE RANGE Q%TR o to 20% above Q Q%PTR o to 20% at1ove Q QTRt1IN O to 50% Power QTRt1AX o to 125% Povver

3. 1.6 HISTORICAL TF:ENDING Tr1e Tt1t1 performs a sn1en day historical trending of ten pararm:ters.

Specifically those pan:irr1eters tr-acked an~ 1) Axial Offset, 2) Diff Output,

3) QDNB' 4) QA, 5) QR 1' 6) QR2, 7) TC* B) T HAVE, 9) PTRIP> and 10) PvAR*

The system will archive: each parameter once: per hour-. This hourly data is saved for the most recent 24 t1ours. The data for r1ours divisible by rour is saved for the: most recent 7 days.

In summary, the: archive maintains a FIFO queue of the: latest 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of data (once per hour) as well as a FIFO queue of the last 7 days of data (once per four hours).

Software Requirements: Specification

Tr1e Tr*1M wi11 continua11y track a11 ten pararneter-s inte.rna1ly, tiut on1y four par-ameter tab1es can be disp1ayed on a sing1e screen. The Opffator can dynamica1ly select which four he wi'.::he.s to di'.::p1ay .. All H1e entr-ies in each table wi11 be time and date stamped for clarity.

3. 1.7 ON-LINE 5y'5TEt1 TESTING The GAMMA-t1ETF:ICS Tt*1M soft1ivare provides for three types of system testing. A test is perfrnTned automatically t1y tt1e TMM upon initial powerup or- system reset. The second test feature allows tl1e Operator to initiate s~stem test functions with the Tt1M in an off-line state. In addition, ROM and RAM testing is carried on as a background task during not-rnal mode operation.

3.1.7.1 PO\*\IERUP INITIAL TEST A self-test is performed t1y tr1e system automatically upon pDv,,.*er up Dr sqstem r-eset (via the r-ear pzmel reset tiutton). T1*1is self-test consists of a volatile sy'.::tnn rnemor-y test zis \*vell as a checksum test of the system PROt1s. The self-test Y*rill not taf:~e longer than ninety seconds. If any prntilerns ar-e encDunteredJ the TMM will attempt to \*vrite a diagnostic message on tt1e display and tr1en wi 11 "tr-i p" to a f ai 1-saf e con di ti on, as described in section 3.2.2.2. If no problerr1s are found, the TMM will function nor-rna ll y and no er-ror messages wi 11 be wr-itten to tl1e display.

3. 1.7.2 OPERATOR INITIATED 5ELF-TE5T The Operator can i ni ti ate various TMM self tests by switching Keyl ock# 1 into tt"1e TE5T position. 'w'hen tt1e TMM is put into self test mode, all primary functions are disabled. In tt1is mode tt1e Operator can select Softv.;n* Requin-m.-rals Sp.-cific.-ition Page 24

a;*non g c ff;::: nu of U*. ~;ts 1j i ::: p1u ~ ed on th t: '.:: cr-e: e: n. T t*1 es e t e: '.::ts inc 1ude. 1) An analog 1/0 ;:est, 2) A digital J/O test, and 3) A ke~pad test. Results of eact1 tc;st are. displayed on n1e TMM screen.

3. 1. 7 .2. 1 ANALOG 1/0 TE5T Tlw analog I/O test is used to 'v'ETify the operation of all tt*1e analog inputs and outputs 'v'v'hict1 are accessible from the r-ear panel. This test \ly'ill set U-1e "4)-8" analog output to 7.5 VDC and the PTRIP output to 25rnA. The display will also indicate as DC voltages, tt*1e n:'.adings of T Cl' T c2, THAVE, U, L, and q) analog inputs.

3. 1.7.2.2 DIGIT AL I/O TE5T The digital I I 0 test \*Vi 11 verify the operation of a11 the digital inputs and outputs accessible frorn the H1M rear panel. The Oper-ator c3n select any digital output and se:t its state to open or closed. Re:quir-ed digital outputs are LPD/PF!ETFIIP, LPD/TFIIP, Orce* Qp((' an1j T cc* Tr1e TM~1 \*Vill al:.:;o display the cutTent state of the 'v'HPT Alarm 5etpoint Reset and L::.T Power- 81 ock di gi ta l inputs as open or closed.

3. 1. 7.2.3 KEYPAD TE5T Tr1e keypad test allows the Operator to verify the functionality of the ki::ypad. In this test tt1e Oper-ator- connects the keyp3d to U1e TMl1 and presses the 'v'arious keys. If the keypad is functional, then the corresp_onding numbers and ct1aracters will be displayed on the screen.

Tho?rn1a 1 Margin C<i J....-ul<ilor

3.2 NON-FUNCTIONAL REQUIREHENT5 Non-Functional requireme.nts discuss the *~arious constr*aints placed on U1e s~stem b~ either- Consurners Power Company or GAMt1A-t'1ETRIC5. This specification \*vill cover Interface, Performance, Operating, and Life-Cycle Constr-aints.

3.2.1 INTERFACE CON5TRAINT5 The interface constrZlints define: tl1e: \111 ay the Tt1t1 and its e:nvironme.nt interact. The: Tt1M environment consists of the Operator-s, the: Tt1M

hzir-dware and tt"1e TMtvl software.

3.2. 1. 1 Tt'-111 OPERATOR5 The Tl1t1 needs no 0Qerator inter-vention to per-form its norma1 operating functions. These functions are:

1) LlT Power calcu1ation

2) Tc Alarm Function

3) Po*wer Densi tq F'retr-i p/Tri p Function

4) TM/LP PTRIP Function

5) t1eter F:elay "~-8" output

6) \i'HPT Pn~tr--i p/Tr-i p function The Operator may view the various displays at wi11, but needs a key to rnodif y any of the internal constants. The Operator interacts with the Tt1r1 hardvvare by viewing Hie display, switching between displays, and by adjusting parameters using tr1e keypad .

Soft'W'<ore Requirements: Specific;.lion Page 26 Thet*ma 1 Margin Ca \cl.Jl;ilor

3.2.1.2 HiH HARD'w'ARE The Tl111 hardware is contained in a 19" rack chassis and includes an embedded computer- system, a front panel display, a ke.ypad, two keylocks, four front panel selection keys, and a systerr1 r-eset button located on the rear panel.

For a detailed descr-iption of the Tl111 har-dware requirements, see the GAl111A-METRIC5 docutl1ent THERl1AL MARGIN 110NITOR HARDV*/ARE 5PECIFICATION.

3.2. 1.2. 1 TMM EMBEDDED C0~1PUTER Tr1e emtie:dded computer system is the "core" of tt"te TMl1. The conwuter must react quickly cind correctly to the various external and internal events. Tt1e computer is microprocessor based and ts dedicated to the execution of the Tl1M software programs .

3.2.1.2.2 FRONT PANEL CRT DI5PLA\}

The front panel screen is not only used to display the various items such as .0. T Pm*vt:r, VHPT Al ann, and tr1e adjustable constants, but al so to ver-ify tM operation of the unit by displaying test results. This display wi 11 augment tr1e TMM basic functions by pro vi ding rea 1-ti me visual feedback; however, the TMl1 can perform its basic functions witt1out :my CRT screen di sp 1ay.

3.2. 1.2.3 KEYPAD The removable keypad wi 11 be used for the entry or alteration of the

internal constants. The keypad vvill contain both numbers and characters Softw dre Requirements: Specificdtion P<ige 27

(alphanurner-ic) so tl1at various nur-neric parameters can be e.ntrr-ed in both standard and scientific notation. In addition, the keypad will contain

keys for "Enter" and "Clear." r~ote. U-1at the internal constants can only be changed if tt1e Operator has Keylock,,,,.. 1 in tl"1e "DATA t'10DIFY" position as described below.

3.2. 1.2.4 KEY 5WITCHE5 Two Ct1icago-Lock style, key switches will be available at the front panel.

Key switch# 1 is used to select between three ope.ration modes: TEST, NORMAL, and DAT A MODIFY. The key wi 11 be removable only in the NORMAL position. The NORMAL position is the standard position for the TMM - the Tr1r1 will per-form its functions and update its display without Oper-ator-intervention. The TE5T position is used for Operator initiated Tt1M self tests. nie DATA l10DIFY position allows the Operator to adjust any of the internal constants by using the keypad .

r~ey s\*vi tch#2 has two defined positions: 4 Pllt1P and 3 PUMP. The 4 PUt*lP is the standard position for normal operation of the TMt1. The 3 PUMP position causes the TM~1 to use. a se.~1e.rate. set of adj ustatil e constants.

Tr1e Operator can svvitct-1 between eitt1er position at any time; IK1wever, no action will be taken unless Keys"vvitch.t.tl is in the DATA MODIFY position.

3.2. 1.2.5 SELECTION KEY5 There ar-e four selection keys on U1e Tt*lt1 front panel. These keys are not directly labelled. in that their functions are defined by text on the TMM scn~en. The selection keys are located directly beneath the CRT display .

The corresponding text labels are placed at the bottom of the CRT display, Page 28 Therma 1 Margin Ca k:ulator

directly 2ltiove e.och key. The::;e ke.ys will be u::;e1j to switch tietwee.n displays, select me.nu options, reset alarm conditions, and to scroll tatiul ar data.

3.2.1.3 TMM*SOFT\A/ARE Tt1e Tt1t1 soft'v'*tan:: consists of the main program softv.;ar-e and the Operating 5ystem software. Both portions 'vYill be placed in firmware or non-volatile rnernor-y. All the softwar-e in tt1e T~1M is encoded as binar-y numbers as required by tt1e embedded cornputer system.

Tt1e rnai n program sof t\n,1 are causes the TMM to perf o~m all its functions.

Tt*1is softwar-e will tie developed bq GAt1t1A-METRIC5. This software is 3utornatically invoked (executed) by the TMl1 upon a system RE5ET or powerup.

Tt*1e Re:cil-Ti rne E:>-;ecuti ve software supports the rnzii n prngrnrn sof t\-van:: by pro vi ding zm inter-face to the systetn hardv11 are. The Executi \ie 5of t\-vare will be multitasking to allow for optimal use of the microprocessor re:source as wel1 as to provide: synct1rnnization of tt1e various tasks in tr1e sq stem software.

3.2.2 PERFORMANCE CON5TRAINT5 The Tt1M performance constraints include tr1roughput rates and operation of the H1M during a TMt1 har-dware failure.

3.2.2. 1 THROUGHPUT RATE5 The most cri ti ca 1 i terns are the norm a1 operating functions described in Software Requirements Spt-cification Page 29 Ther-rnal M.orgin Cakul.ator

sect i ci n 3.. 2. *1 . I . The De 1tz1 T F' mv er Jn d TC al d nrr fun ct i ci ns Z:I re r*e peZ:i t e1j once per- second. Tt1e 1Jtt1er- functions must be per-formed e\/er*y 100

milliseconds. Secondary to tt1is is the. updating of the various displays.

Any display wt1ict1 is prnviding dynamic infonr1ation YY"ill be. upd21ted every several seconds, although the actual calculations are per*forrne.d rnor*e fn::quently.

3.2.2.2 5y'5TEM POw'ER CYCLING BEHAVIOR Tt*1e RAt*1 rnernory, in whicl1 ti-re operntor- adjustatile parameters are stor-ed, has its m*vn batteries, and will be normally retain these values when povv*E:.r is off. V'it1en pm*ver is tTsLimed an integrity check of tt1is data will be per*fonned. If the data is not valid, it 1Nill tie replaced "Nitl"1 a 1jefault set of values stor-ed in nonvolatile memory.

When the computer systE:rn has no pD'\'ver, the digital outputs will be in a higt*1 n:.sist:::ince state and will tl1erefore be seen zis in U1e open circuit condition by external hard*vvare. 5irnilar-1y, U1e Ptr-ip analog output \*vill not gene:rate an!:! current. E>(ternal hardware may interpret this as a zero re: ading or an error condition.

3.2.2.3 REPEAT ABILITY The Tt1t1 r*eads external inputs (e.g. ternper-aturns, pr-essur-es) <:rnd uses a microcomputer to perform the various calculations based upon tr1e inputs.

If the inputs rernain unchanged, the TMM will pE::r-fonn tl1e successive calculations with .!_0.1 % repeatability, with the exception of "t-B" calculations which have ,!.0.5% re:peatabilit!:j .

Sofhr.;,r*i? Requiri?menl.s Specific<ition

3.2.3 OPERATrnG CON5TRAINT5 The Operating.Constraints include available Keyswitch data entry

techniques, Operator 5ki11 level considerations, and Front panel component spatial distr-itiution. For em*ironrnental specifications see GAMMA-METRICS document - THERMAL 11ARGIN MONITOR HARD\.1,I ARE 5PECIFICATIOr*~.

3. 2. 3. 1 KE 'r' PAD DAT A ENTRY The keypad supplied allovvs tt1e Operator to modify the internal system constants. Tt1e Operator gains security access to tt1ese parameters by using Keylock# 1. Any numerical data entered with tt1e keypad may be in standcir-d deci rna l or scientific no ta ti on form.

3.2.3.2 OPERATOR SKILL LEVEL CONSIDERATIONS The TMM display can be viewed by any appropriate plant personnel.

Pri vl e1jge.s to use the front panel switches :::in1j to alter any i nten1a l pararneters sr1ould be given only to those: who are quzilifie:d to use such nu cl ear instrumentation.

3.2.3.3 ERGOf*WMIC FACTOR5 All tr1e front panel controls will be laid out in functionally similar groups, so that the Operator need not focus on t'wo seperate areas of the panel when using the device. The primary display (.6.T Power and VHPT 5etpoint) will be viewable frnrn a distance of 20 feet. In addition, the various screen 1ayouts wi 11 be designed to minimize eye movement. The NUREG 0700 standard will be used as a guideline for CRT display design whenever feasable, as determined by GAMMA-METRIC5.

Softw .:we R"quir.,ments: Specification Page 31 Thermal Margin Calcul.1tor

3. 2. 4 LIFE -CYCLE C:Ot~~-H F:A I!H5 The 1ife-c~c1e constr-aints for the Tt-H1 inc1ude 5ystem t1aintainability,

and Resour-ce Availabi1ity. In addition, the Methodologica1 standards including Design Techniques, 5oftvvan~

Ve:rification, and Programrning Standards Quality Assur-ance, Validation and

\"i1 i11 be stated r1erein and fo11ov*ied for H1e dur-ation of this project.

3.2.4. 1 ~1AINT AINABILITY The software system wi11 be maintained by qualified GAt1MA-11ETRIC5 5oftware Engineers and Programmers. The software will be written in a microcomputer dialect of the F'A5CAL programming language. The pr-ogrnrnrner-s will use tt1e standar-d language featur-es **Nr1enever possible to enh3nce portability and rnai ntai nabi 1i ty. Program docurnentati on including sour-ce code cormnen_ts and pseudocode will be maintained by GAl111A-METRIC5 .

3.2.4.2 RE50URCE AVAILABILIT'./

A11 software wi 11 be designed, vv-ri tten, and rnai ntai ned by GAMMA-METRIC5 5_of tware Engi nu.Ts and Prograrnme:rs. 5oftware Validation will be per-forrned by qualified software professionals not involved in either the software design or development phases. These personnel may or may not work for GAMMA-METRIC5. For further information regarding Validation and Verification, see doc#

IEEE-AN5-7-4.3.2-1982.

Soflw are Requinm1ents Specification P.=ig~ 32 Thermal Margin Calculator

3. 2. 4 .3 vALi DAT IO r~ AND \/ER I FI cAT IO r~ (v&v)

V&V will be performed in accordance \.Y'ith si::ction 6 and 7 of document

number IEEE-AN5-7-4.3.2-19B2 and the Software Quality Assurance Plzin.

5of tware verif i ca ti on wi 11 tie penor-rned f rnm the Require men ts pt1ase to the Hardvv*are/5of bvare Integration Phase. Validation wi 11 be perf orrned on the cornpute.r systern as a w~1ole, in accordance witt1 a forrnal test plan. Ver-ification is performed by individuals who did not participate in th e sys tern des i gn. \I a1i dat i o n i s perf o rn1 ed by i ndi vi du a1s who di d not par-ti ci pate. in the design or imp 1ementati on.

3.2.4.4 PROGRAMMING 5T ANDARD5 GAr1t1A-t1ETRIC5 softvvare personnel will code most of U1e system using Intel PascalB6. To achieve higher speed and a better inter-face to the TMt1 hardware, cer-tain modules will be vvr-itte\l in assembly language. T~ese assembly language modules will be documented to include register usage and p::;eudocode for compl~x functions. For mor-e detailed progr-amrning st3ndZJrds, see the Tt1M 50FT\i..1ARE QUALITf' A55URANCE PLAN .

Software Requirements Specification Page 33 Ther*ma 1 Margin Calculator*

APPENDIX A OPERATOR ADJU5TABLE PARAMETER5 PARAr1ETER AD1..IU5T ABLE RAr'*IGE WHERE U5ED Kf> 1x10- 6 to 5x10- 3 Li T Power Cal cul ati on

KO' 5

-lxlo- to lxlo-5 LiT Power- Calcu1Cition

Kcx: 3><10- 2 to lxl0- 3 Li T Power Cal cul ati on

a o to 1o.o Li T Power Cal cul ati on *

't O to 1.0 Li T Power Calculation

BIA5 -0. 10 to 0. 10 LiT Power Calculation

Trtv!E CON5T ANT 1 to 30 LiT Power Calcul<:ition T ct1AX 515 to 700"F Tc Al arm Function T ct1IN 0 to 600°F Tc Al arm Function x1pd o to O Local Power Density Fune.

X2pd' X3pd o to 2.0 Local Power Density Fune.

Y1 pd - 1.0 to O Local Power Density Fune.

Y2pd 0 to 0 Loe a1 Pov*,ier Den~i ty Fune.

l}7

'._)pd O to 1.0 Local Power Density Fune.

b o to 1.0 Power Density Pretrip/Trip X1 lp Oto O a Loe Peaking Function X,-,Llp' Y:)

- ~.lp 1 YA

-!lp o to 1.2 Loczi Peaking Function y 1lP' Y21P' Y31P' '))4lp O to 1.2 Loe a Peaking Function v 1 )/,., -1.0 to 1.0 A5I Function

r. as' *\Las X3as' X4as -1.0 to 1.0 A5I Function

'y' 1as -1.0 to 1.0 A5I Function Y23S' Y3as,Y4as -1.0 to 1.0 A5I Function x1pp Oto O Po"vve:r Peaking Fune.

X2PP' X3PP' X4pp O to 1.2 Pm*ver- Peaking Fune.

Y1PP' Y2PP' Y3PP' Y4pp o to 1.2 Power Peaking Fune.

x1af -1.0 to 0 Axi a1 Function X2af -0.5 to 0.5 Axi a1 Fune ti on X3ar - O to 1.0 Axial Function y l af Y\if 1 1.0 to -1 o Axial Function Softw*;it*o? R.-quirer1writs Spt>cific;itiori P<Jgo? 34

r' 2 af 1.0 to 1.0 Axial Function Kc o to 0. 1 Tt1/LP PTRIP Function

p TM/LP PTRIP Function

1O to 30 A 1000 to 3000 Tt1/LP PT RIP Function

0 -13000 to -4000 TM/LP PT RIP Function

P111N 1500 to 2000 TM/LP PTRIP Function Q%TR 0 to 20% abovi:; Q VHPT A1arm Function Q%PTR O to 20% above Q VHPT A1arm Function QTRMIN O to 50% Power VHPT Alarm Function QTRMAX O to 125% Power \/HPT Alarm Function

These parameters can be entered outside their adjustable range after a

\l\arni ng message is issued by the Tt1M .

Softw;we R<?quiremerits Specific<itiori Page 35 Ther-mal Margin Cal..~l<itor

APPENDIX B ANALOG AND DIGIT AL I/O

- PARAMETER Tc1 TYPE ANALOG INPUT VOLT AGE 1 to 5'v'DC RAr~GE WHERE USED

.ti. T Power Cale.

Tc2 ANALOG INPUT 1 to 5VDC 6. T -Powe:r- Cale.

THAVE ANALOG INPUT 1 to 5VDC .ti. T Power Cal c.

L ANALOG INPUT 0 to 1OVDC High/Low Trip Fune.

u ANALOG INPUT 0 to 1OVDC Hi gh/Lm-v Trip Fune.

9 ANALOG INPUT 0 to 10\.IDC Hi qh/Lmv Trip Fune.

PA5GT ANALOG INPUT 0 to 1OVDC TM/LP PTRIP Fune.

f'TRIP ANALOG OUTPUT 10 to 50 mADC Tt1/LP F'TF:IP Fune.

ri)-8 ANALOG OUTPUT 0 to 1OVDC Meter Relay Output VHPT ~ie:tpoi nt ANALOG OUTPUT 0 to 1OVDC VHPT Alarm

6. T Power Block DIGIT AL INF'UT OVDC/5VDC THiLP F'rRIP Fune.

Ext 5etpt. Reset DIGIT AL INPUT OVDC/5VDC VHPT Alar-m Tee DIGIT AL OUTPUT OVDC I 5VDC Tc Alann Function LPD/PRETRIP DIGIT AL OUTPUT OVDC I 5VDC High/Low Trip Fune.

LPD/TRIP DIGIT AL OUTPldT OVDC I 5VDC High/Low Trip Fune.

So itw- <H"o? Requirern<>ri ts: Specification Page 3E. Th<>rma 1 Margin Ca J....'Ulator

1 DIGIT AL OUTPUT OVDC/5VDC VHPT Alarm

DIGIT AL OUTF'UT OVDC/5VDC VHPT Alarm Sofht <in R'quirt?nwnts Specification Page 37

SOFTWARE DESIGN DESCRIPTION THERMAL MARGIN MONITOR CONSUMERS POWER COMPANY Palisades DOCUMENT #089 This do~ument contains information proprietary to GAMMA-METRICS and is intended solely for the operation and me.intene.nce of GAMMA-METRICS equipment and is not to be used otherwise or reproduced without the written concent of GAMMA-METRICS

( 619) 450-9811

-:Revision No. 3 July 09, 1986

.T EQUIPMENT WARRENTY Unless otherwise agreed in writing between the parties, the following warranty terms and conditions apply.

(a) Warranty. GAMMA-METRICS warrants to the Buyer that the equip~ent is free from defects in design, material, and workmanship.

(b) Warranty period. GAMMA-METRICS warranty is in effect for one year after shipment to the Buyer. For items which, under normal industry practice, have a shorter warranty period, the applicable warranty period shall be such shorter period. Such items shall include, but not be limited to: light bulbs, fuses, gaskets, photo-multipliers, tubes, disposable items, and all components with a specified wear-cut period.

(c) Remedy. GAMMA-METRICS agrees to repair or replace at the place of manufacture, without charge, all defective parts in the equipment which is returned for inspection within the one year warranty per1oa, provided such inspection discloses that the defects are covered above in (a) and that the equipment has not:

(1) been altered or repaired other than with written authorization from GAMMA-METRICS and in accordance with its approved procedure; (2) been subjected to misuse, negligence or accident; (3) been damaged as a result of improper storage, handling, maintenance or installation; or (4) otherwise had its serial number or any part thereof altered, defaced or removed.

THIS WARR,11.NTY IS IN LIEU OF, AND BUYER W.ll.IVES, ALL OTHER ..JARRANTIES, 1

EXPRESSED OR IMPLIED, INCLUDING THOSE OF MERCHANTABILITY OR FITNESS FOR PURPOSE .

)

Section Description TABLE OF CONTENTS Page Revision Date

1. 0 SCOPE 1-1 2.0 APPLICABLE DOCUMENTS 2-1 3.0 SYSTE~ OVERVIEW 3-1 3.1 Global Variables and data structures 3-3 3.2 Integer Arithmetic and Scaling 3-4 3.3 Smoothing of Analog Input Noise 3-5 3.4 Error Handling 3-5 3.5 R.C. M and ROM 3-6 4.0 TASK DESCRIPTIONS 4-1 4.1 System Architecture 4-2 4.2 Neutron Calculations Task 4-5 4.3 Thermal Calculations Task 4-6 4.4 Operator Interface Task 4-7 4.5 Trend Storage Task 4-11 4.6 On-line Diagnostic Task 4-13 5.0 PROCEDURE/FUNCTION DESCRIPTIONS 5-1 5 .1 Startup code executing prior to any task execution 5-1 5.2 Neutron Task code 5-1 5.2.1 Local Power Density procedure 5-1

5. 2.'2 TM/LP Procedure ' 5-3 5.2.3 VHPT Procedure: 5-4 5.2.4 Reset VHPT Trip/Pretrip procedure 5-5 5.3 Thermal Task Code 5-6

5. 3. 1 TC Alarm procedure 5-6 5.3.2 Delta-T Power procedure 5-8 5.4 Operator Task Code 5-9 5.4.1 Command Interpreter procedure: 5-9 5.4.2 The "MORE" Key in Normal Mode 5-10 5.4.3 Command Table procedure: 5-14

5. 4. 4' Data Modify Procedure: 5-14 5.4.5 Character Handler procedure 5-15 5.4.6 Test Mode procedur~ 5-17 ii

TABLE OF CONTENTS continued Section Description *Page Revision Date 5.5 Utilities and Supporting Routines 5-19 5.5.l PLFunc - Piecewise Linear Function Evaluator 5-19 5.5.2 Graphics Status procedure 5-21 5.5.3 RAMTEST 5-22 5.5.4 ROMTEST 5-23 5.5.5 CRCHECK 5-24 6.0 DISPLAY DESCRIPTIONS 6-1 6 .1 PRIMARY DISPLAY 6-1 6.2 PRESSURES DISPLAY 6-2 6.3 AXIAL FUNCTION DISPLAY 6-2 6.4 POWER PEAKING DISPLAY 6-2 6.5 ALARMS DISPLAY 6-3 6.6 24 HOUR TREND DISPLAY 6-3

6. 7 . SEVEN DAY TREND DISPLAY 6-3 6.8 TREND PARAMETER SELECT DISPLAY 6-4 6.9 SYSTEM STATUS DISPLAY 6-4 6.10 POWER DENSITY DISPLAY 6-4 6.11 LOCA PEAKING DISPLAY 6-5 6.12 ASI DISPLAY 6-5 6.13 ADJUSTABLE PARAMETERS DISPLAY 6-6 6.14 MODIFY PARAMETERS DISPLAY 6-6 6.15 SET DATE AND TIME DISPLAY 6-7 6.16 MEMORY TEST DISPLAY 6-7 6.17 DIGITAL TEST DISPLAY 6-7 6.18 ANALOG TEST DISPLAY 6-8 6.19 KEYS TEST DISPLAY 6-8 APPENDIX A RUN TIME SUPPORT CONSIDERATIONS iii

1. 0 SCOPE The purpose of this document is to present a software design description (SOD) of the GAMMA-METRICS Thermal Margin Monitor (TMM) to the software development team. This document initially provides a system overview. and the* software implementation is discussed at a high level with the descrip-tion of the tasks to be used in the multitasking system. Descriptions of the important supporting procedures and functions are included, as well as descriptions of the data structures used. Finally, the system displays are described .

1-1

2.0 APPLICABLE DOCUMENTS These documents were used in preparation of this document:

1) Consumers Power Company document J-54.

2) Consumers Power Company document LOGIC FOR TM/LP TRIP drawing 8-JL-130 sheet 1.

3) AMMA-METRICS document #055 - THERMAL MARGIN MONITOR SOFTWARE REQUIREMENTS SPECIFICATION.

4) GAMMA-METRICS document #056 - THERMAL MARGIN MONITOR HARDWARE REQUIREMENTS SPECIFICATION.

5) GAMMA-METRICS document #073 - TMM Hfa.RDWARE/SOFTWARE INTEGRATION

REQUIREMENTS .

2-1

3.0 SYSTEM OVERVIEW

The GAMMA-METRICS processor based, Thermal Margin Monitor is a self-contained, 19" rack-mounted product which is targeted to replace the existing DeltaT and TM/LP (Thermal Margin/Low Pressure) calculators at micro-the Palisades Nuclear Power Plant. The system hardware features a data entry keypad, a video display, two security keyswitches, and four menu selection keys (softkeys or function keys). The front panel layout has been designed for ease of use.

The TMM embedded computer program provides those functions described in Consumers Power Co. drawing JL-130. The TMM's primary function is to

. repeatedly calculate DeltaT Power, Power Density pretrip/trip, TM/LP Ptrip and the Variable High Power Trip. The results of these calculations affect the TMM's graphic display as well as the digital and analog outputs.

The TMM will operate in three basic modes as indicated by the mode select key switch: 1) Normal, 2) Test, and 3) Data Modify. The standard mode of operation is Normal, in which the TMM performs all the safety functions listed in the TMM Software Requirements Specification (SRS). The operator can view the results of these functions on the CRT display and can change displays by pressing the function keys.

With the Mode Select keyswitch in the 11 Test" position, the TMM disables all safety functions and calculations. In this mode, the operator can run tests on the TMM hardware including the analog I/0, digital I/0, memory, and keys. The test results are displayed on the CRT.

The "Data Modify" mode is used to change the Operator Adjustable parameters

for either the 3 or 4 pump configuration.

3-1 The safety functions and cal-

culations are disabled in this mode. In addition, the operator can change the real-time clock time and date. In data modify mode, all numeric data is entered via the data entry keypad. This is the only mode in which the keypad is used by the operator. By switching the Pump Select Key from 3Pump to 4Pu~p, while in Data Modify mode, the operator may select the "pump configuration" which will subsequently be used in normal mode.

The TMM software used to perform these functions is multi-tasking and executes under the VRTX86 real-time executive. Five tasks will execute in real time to handle the calculations, front panel controls, graphics display, trend data capture, and real-time diagnostics.

For further details on the TMM requirements and functions refer to the Software Requirements Specification (SRS). Portions of that document are to be considered a part of this design, namely the mathematical formulas described therein. Many of those formulas constitute algorithm designs that are directly implementable in Pascal source code.

The software is mostly written in PASCAL86; .appropriate portions are io ASM86. (These are both products of INTEL Corporation.) Floating point math calculations are performed by INTEL 1 s software emulation of their 8087 processor. The software also includes the VRTX real-time executive, a product of Hunter & Ready, Inc.

3-2

3.1 Global Variables and data structures The calculation tasks produce many results which are needed by the operator and trend tasks (see below). The required communication will be accomplished by the use of global data which is accessible to all of the tasks. Only one task will be allowed to alter the contents of each global variable, but any task may read them.

Global Data:

The operator adjustable parameters The results of the calculation tasks Trend Archive tables and indices (see Trend Storage task)

VRTX "mailboxes" for intertask signaling State variables, which must persist between procedure calls The Parameter Table consists of two arrays, one for each pump configura-tion. Each of these is an array of records, one record for each parameter.

Each record consists of: a) the current value of the parameter, b) the minumum Value of the parameter, and c) the maximum value. The Parameter Table is separate from the working set of parameters. Those are individual variables; they are loaded from the Parameter Table. The Parameter Table is modified by the Modify Parameters procedure. (see data flow diagram)

The Name Table is an array of character strings, one string for each parameter. The strings will be loaded at cold start time with the names of the parameters. An asterisk character will be in position ten for those parameters that are allowed to be outside of the range specified by the minimum and maximum values in the Parameter Table .

3-3

3.2 Integer Arithmetic and Scaling

Integer arithmetic, faster even with 32-bit integers, than Intel's floating point math library, for the Neutron Task calculations.

is about one hundred times which is why it is In order to succeed with this approach used each integer variable must have a range of values which is small enough to not cause overflow in math operations, while large enough to have good resolution, or accuracy. This is achieved by the careful choice of a scale factor for every quantity that is represented by an integer variable. In each case we choose the scale factor so that the maximum value of the variable is about 32,000. This gives us very good resolution, while ensuring that the product of two such variables will still be within the 32-bit range. A pair of examples may be sufficient to illustrate this:

maximum power = 1.25. let MAXINT represent 1.25, then the scale factor equals 32,767 I 1.25 = 26213.6. (MAXINT = 32,767) maximum pressure = 2500. let MAXINT represent 2500, then the scale factor equals 32,767 I 2500 = 13.107.

Two convert a floating point value to a long integer we multiply by the scale factor, and then round the result. To convert a long integer to floating point we divide by the scale factor.

Where 16-bit integers are used, a unique scale factor must be chosen. For this project a factor of eight happens to be ideal for converting between long and short integer forms of the same value. This is because the 16-bit versions arise only where ADC or DAC data is involved . This data has a

maximum value of 4095, which is one eighth of MAXINT, 3-4 to a high degree of

accuracy. Hence, to produce the long integer form of Phi, which is a power quantity, we merely multiply the input value by 8.

With integer math, we cannot multiply by a decimal fraction, nor can we divide without serious loss of precision. Both of these problems are*

handled by the use of a function which we will name FracFinder. This function multiplies a ~iven number by a given numerator, and then divides by a given denominator. We can then multiply by fractions as long as we create an explicit numerator and denominator rather than using a decimal fraction. The same holds for division. In both cases the result may require a different scale factor than the original number in order to avoid truncation error while keeping the multiplication step from overflowing the 32-bit range.

3.3 Smoothing of Analog Input Noise In order to have more stable outputs in the presence of analog input noise, the low level routines which read the ADC inputs will actually use the ADC several times in rapid succession, and the return the average of the values read. The readings will be far enough apart so that their noise components are not correlated. The group of values that are averaged together must be within a time span of less than 100 milliseconds in order not to reduce the speed of response of the system.

3.4 Error Handling Detectable error conditions are handled by branching to a procedure that sends an "open" command to al-l the digital outputs, sets the PTrip analog output at its maximum voltage, sets the other analog outputs to zero, and 3-5

displays the message "ERROR xxx" where xxx is a number. No further processing takes place, as the processor will be in a halted state with interrupts disabled. The error numbers will be defined in the user's manual.

3. 5 RAM and ROM There are two physically distinct areas of RAM. The 64 K of battery backed-up RAM, at addresses 10000 through lFFFF, will be referred to as Application RAM. All global variables are in Application RAM. The 8 K from address 0 through lFFF will be called System RAM. This area contains the VRTX workspace, plus a 1 K stack for each task. Pascal variables defined within procedures and functions occupy space in the stack of the calling task; the space is released when the procedure or function completes execution.

Physical ROM addresses range from EOOOO through FFFFF for a total of 128 K~

VRTX occupies the first 6 K of this, followed by the TMM code. Execution begins at FFFFO, as required by the 8088 processor. The last two bytes of ROM contain a 16-bit value to be matched against a CRC value by the ROM test procedure. This valued must be computed and programmed into the ROM at address FFFFE. The computation is best handled by using an emulator to execute the ROM test procedure in order to determine what value is cal-culated.

3-6

I-----

13flTT£12(

RIJM 3 Pv1'1 p fhl.!AM

'1 Pv"1 ri Ri ~11v

~l'lTA SOvfi'..c,£ oR SINK DA-TA Pf<.oc£.ssoR

~RLCUi/177M T!rS:.. K.

TIZ1£ND A£CJ-IJV£ REv. Z N£,Ul(l0N

'7- EAL CA LCULftTIM/ 1/Mf:

A-SK C LOC,K TMM DAT A FLOW DIAGRAM

4.0 TASK DESCR1PTIONS The TMM software uses a multi-tasking architecture so that the calculation and monitoring function can be continuously performed while still allowing the operator to interact with the machine. This also enables memory testing to occur automatically during normal operation. The five tasks that comprise the TMM software are described below. These five tasks are supported by the VRTX real-time executive, which permits them to execute concurrently and asynchronously. (The concurrency is an illusion, of course, since there is only one processor, but it is the appropriate conceptual framework for understanding the operation of the software. The tasks should be thought of as separate programs that run at the same time.)

VRTX also provides priority-based scheduling, so that lower priority tasks do not execute unless higher priority tasks have satisfied all of their immediate processing needs.

The five tasks, in priority order, are:

1. The Neutron Calcu1ations Task (highest priority)

2. The Thermal Calculations Task

3. The Operator Interface Task

4. The Trend Storage Task

5. The On-line Diagnostics Task (lowest priority)

Shorter names, namely Neutron Task, Thermal Task, Operator Task, Trend Task, and Diagnostic Task will often be used below.

The Neutron Calculations task handles all of the calculations that proceed from -the measurements of neutron flux density. The Thermal Calculations task handles all of the calcuiations that proceed from temperature measure-4-1

men ts . All of the measurement, calulation, and output (not CRT output)

functions are divided between these two tasks.

other tasks are stored in RAM as global variables.

In order Computed values needed to achieve the 100 millisecond repetition rate for the by Neutron Task it is necessary to eliminate any use of floating point arithmetic from this task. 32-bit integers will be used instead, even though this creates difficulties involving scaling and fractions.

The Operator Interface task processes operator keystrokes and presents displays to the operator. It updates those same displays, copying data from global RAM as needed. It is the only task that reads the keyboard or writes to the display. (Except in the case of the ERROR display mentioned in section 3.1. Any task may execute the error handling procedure, after which there will be no further processing.)

The Trend Storage task stores data every hour so that it can be reviewed at a later time, by operator request. A structure called the Trend Archives, in global RAM, is the repository of this data. The dispiay of the trend data is part of the Operator Interface task.

The On-line Diagnostics task tests RAM and ROM memory.

4.1 System Architecture The TMM Data Flow Diagram, attached, will be used to explain System Archi-tecture, including startup issues .. This requires a brief explanation of some ~aming conventions. The operator adjustable parameters, stored as 32-bit floating point variables, and representing values in user units, all have "RPAR" as a suffix (short for Real PARameter). They are collectively 4-2

referred to as the "RPARS 11

Many of these wi 11 be converted to a 32-bi t integer form for internal computations. These have the suffix "IPAR" and are referred to as the "IPARS" (Integer PARameters). Computed results which are meant to used by other tasks are similarly referred to as the "RVALS" and "IVALS" (Real and Integer VALues).

The data flow diagram shows data objects as rectangles, and processing elements as circles or ovals. Arrows represent data being copied from the tail to the head. Neither the sequence nor the cause of the data flow is shown in the diagram.

Upon initial startup, with unused RAM, the procedure called ColdLoad copies the default values of the operator adjustable parameters, both the 3 pump and 4 pump sets, into Application RAM. There they remain unchanged unless the Data Modify -procedure is used to changed them*. After Col dLoad finishes, the Load_RPars procedure copies one set of parameters into the RPARS. The pump select keyswitch position determines which set. Next the Load IPars procedure scales and converts the RPARS into their corresponding I PARS.

If the system is restarted, with valid data in battery backup-up RAM, The ColdLoad procedure is not executed, but Load RPars and Load IPars will execute. The validity of RAM is determined by a CRC check of the 3 and 4 pump parameter sets. If the computed CRC word does not match a stored value, also in battery back-up RAM, then ColdLoad is executed. The stored CRC values is updated whenever the Data Modify procedure is exited.

The data flow diagram only applies to normal mode . If the system is started with the mode key not in NORMAL, then only the operator task will 4-3

be active, until the key is moved to NORMAL. In normal mode the Neutron

Task executes about ten times per second, input ports, appropriate calc~lating output ports. Many each time reading of the IPARS are used in appropriate new values for various IVALS, and writing data to these calcu-lations, but they are not modified. Similarly, The Thermal Task executes once per second, reading input ports, and using some of the RPARS to performs its calculations. Results are written to some of the RVALS and IVALS, and data is output to certain ports.

The Trend Task is activated on the hour, it reads the ten designated IVALS and stores the values in the Trend Archives. It also reads the Real Time Clock, storing that data also to accomplish time & date stamping.

The operator task updates the current display every few seconds by reading the appropriate RVALS and IVALS, computing a character sequence, and sending that to the screen controller hardware. If the user presses a function key the operator task will respond as required, either drawing a different display, changing the function key label, or performing some procedure, such as a VHPT Reset.

The Diagnostic task operates independently, testing RAM and ROM. It wi 11 send data to the display screen if it detects an error; this will cause the machine to halt with an error message as des~ribed in section 3.4, error handling.

Details of all the tasks follow, described in prose and pseudocode.

Note: *when 11 Delay 11 is referred to below, it means the VRTX delay call which

allows lower priority tasks to execute until a specified number of 4-4 clock

ticks have occurred. The clock ticks are 15 ms apart .

4.2 Neutron Calculations Task The purpose of the Neutron Task is to read the neutron and pressure sensors ten times per second, calculate all quantities which might change as a result of these readings, and write to any outputs that depend on these calculations. This task does no floating point calculations. (i.e., it uses no Pascal REAL values)

Procedure:

calculate constants that depend on adjustable parameters initialize state variables initialize other variables as may be required Delay about one half second to assure that Thermal Task completes (This is so the BetaTCal term will be available) repeat indefinitely:

read analog inputs from three neutron monitors read analog input Pasgt from pressure sensor read the delta-T power block digital input scale these inputs to produce long integer representations compute Local Power Density Trip formulas output to trip & pre-trip digital outputs compute and output a value to meter relay compute TM/LP formulas output Ptrip value to analog output port read VHPT reset digital input, also check VHPT reset mailbox

perform res~t logic 4-5

maybe alter VHPT trip and pretrip setpoints

compute VHPT trip formulas output VHPT setpoint to analog output output to VHPT digital outputs Delay (just long enough to produce ten reps per second)

(End of Loop) 4.3 Thermal Calculations Task \

The purpose of the thermal task is to read the temperature sensors every second, compute those quantities that depend on the temperature readings, and out~ut to any relevant outputs. This task uses floating point math because the Delta-T Power calculation would be very difficult to do in integer form, and because there is enough time available at the one second rep rate. Two items are computed as REALS and then converted to integer form for use by the neutron task; these are Delta-T Power and the BetaTCal term of the TM/LP formulas.

The repetion rate of the Thermal task is controlled by the real time clock, which is initialized so as to produce a one second interrupt. This is a separate capability from that of its normal timekeeping function. The interrupt service routine then sends a message to the VRTX mailbox named AlmMail. The thermal calculations begin again whenever this message is received.

This task also handles the responsibility for restarting the Trend Storage task on the hour. This is accomplished by reading the hours register of

the real time clock and noting when it changes.

4-6 When this occu~s a VRTX

"resume" call is made to awaken the Trend Task .

Procedure: ~

calculate constants that depend on adjustable parameters initialize state variables initialize other variables as may be required repeat indefinitely:

wait for ~essage to be received by AlmMail mailbox read analog inputs from water temperature sensors compute Tc alarm conditions, if there is a change, then:

output to Tc alarm digital output compute an estimated rate-of-change of (A*DeltaT+Tc) compute Delta-T Power compute BetaTCal calculate long integer forms of those two variables re~d the hours register of the real time clock if the hour has changed, then:

11 11 awaken Trend storage task with VRTX resume ca 11 save the hour for the next comparison (End of Loop) 4.4 Operator Interface Task The Operator Interface task is responsible for updating the current display with the results produced by the calculation tasks. It also monitors the softkeys and keyswitches and takes appropriate action if it finds a change in their state . After doing any required activity it suspends itself for 1/5 ofa second with a 11 delay 11 call. Most of the time there is no required 4-7

activity, so the delay is merely repeated. This task is the only one that

writes on the display or pays attention to the operator's input.

Some floating character string point math is representations necessary, of real for scaling, variables.

and to - produce Interrupts are disabled during these periods, to prevent interruption by the higher priority Thermal Task, which also does floating point math. (The INTEL

floating point library is not re-entrant.)

This task is also responsible for starting the other four tasks. The TMMAIN procedure, which executes first at system reset,. leaves the other four tasks suspended when it hands control to VRTX. Since only the Operator t~sk is initialy active, VRTX gives it all the CPU time. If the mode s*.'litch is not in NORMAL mode, the other tasks tJill not 1

be started, hence Test or Data Modify can be used tJithout running any of 1 the other

software. The Operator task also handles the startup RAM and ROM tests and the Cold vs. Warm start logic.

The displays are actually drawn by the graphics display card (see hardware description). In order to draw a display on the screen the lower level routines of the Operator Task must send sequences of 8-bit codes to the graphics card. The graphics card does not process these codes as fast as the computer can generate them, hence status testing is necessary. The 11 graphics card sets a ready 11 bit when it can accept another byte; the software tests this bit and does not send the next byte until the card is ready. If the card is not ready a Delay of 1 clock tick is executed. This allows other tasks to execute for about 15 milliseconds before status is tested again .

4-8

Many of the display screens take several seconds to draw. In order provide for faster response to operator function key requests, the function to key port is polled whenever "not ready" status is found. If there is an operator request pending a global flag called NewOpReq will be set.

Higher level code can then check NewOpReq at various points and abort prematurely if it is set. This greatly reduces the response time to operator function key request. The screen is left in incomplete state, which is no problem if the operator understands the phenomenon. This only happens when a function key is pressed before the screen is drawn; in most cases the operator's request cause a new screen to be drawn anyway.

Procedure:

Initialize graphics hardware Test Rem & ROM if not pass, execute error procedure Initialize variables as req 1 d Calculate CRC for the operator adjustable parameters in RAM If not the same as the stored value, then:

display"COLD START IN PROGRESS" Load op. adj. params from ROM Set time and date to default values Calculate CRC word and store in RAM Initialize the trend archives Other cold start initialization

End if Other warm start initialization 11 (\

Poll Key Switches WHILE roode switch is not in NORMAL:

Poll Key Switches IF rncde = TestMode, then:

Perform Test Mode procedure IF mode= Data Modify, then:

perform Data Modify procedure end WHILE Load the active set of op. adj. params (RPARS)

(i.e., 3 pump or 4 pump, depending on pump switch)

Calculate long integer form of op. adj. params (IPARS) 11 11 Awaken the other four tasks with l/RTX resume calls

set current screen to primary screen, with first menu bar Repeat Indefinitely:

Poll Key Switches

[ MAIN LOOP OF OPERATOR TASK }

IF mode = TestMode, then:

Suspend background tasks Perform Test Mode procedure Resume background tasks end IF IF mode = Data Modify, then:

Suspend Background Tasks perform Data Modify procedure Calculate CRC word and store in RAM Load the active set of op. adj. params (RPARS)

(i.e., 3 pump or 4 pump, depending on pump switch)

Calculate long integer form of op; adj. params (IPARS)

Resume Background Tasks end IF

( Re~d the function key port. If there's a new keypress, act on it. }

(provide about one second of polling without update }

Repeat this loop up to about five times:

Poll the function key port if there is an operator request, then leave this loop.

else Delay about .2 second end 16op IF there is an operator request pending, then:

clear the NewOpReq flag.

Call the command interp procedure to act on the request.

IF there is not an operator request pending, then:

Call the update procedure to update the current screen.

END MAIN LOOP 4.5 Trend Storage Task This task awakens every hour on the hour to store the latest values of ten of the global variables. The values are stored in two data structures, one of which has a full day of hourly data, and the other has seven days of

data these taken every four hours.

data operator request.

structures, The Operator Interface task has access and will show their contents in response to to an 4-11

There is also a separate initialization procedure, called only on a cold start, which sets the indices to l, and sets all the hours to -1.- The -1 is a signal to the display procedure that this is an empty record.

Data Items: (these are all global data) two arrays of records, one for a day of data and one for a week.

The day array has 25 records.

The week array has 43 records.

Each record has the time and date of the data in that record, plus an array of ten values, the actual data.

An index variable for each array, to indicate current record.

variables to store the time of last trend storage (for both 7 day and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months trend archives)

procedure:

Repeat Indefinitely:

Read the real time clock for the time and date.

IF more than 30 minutes have elapsed since last hourly trend storage, then store the time, date, and the ten values.

Store this time of last hourly trend storage.

IF the hour is a multiple of four, AND its been more than two hours since the time of last 7 day trend storage, then:

Store the time, date, and ten values.

Advance the 7 day trend index. (circular fashion)

Store this time of last 7 day trend storage .

End IF Advance the hourly trend index. (circular fashion)

. 4-1?

End IF Suspend this task with the VRTX "suspend" call.

(The Thermal Task will resume it, on the hour.)

End loop 4.6 On-line Diagnostic Task Most of the code for this task is written in assembly language, both for speed of execution and for control over interrupts. RAM is tested for minimally correct operation by write-read-compare opera~ions on every word of RAM. The original contents of each word are restored. ROM is tested by computing a 16-bit CRC word over all but the last word of ROM and comparing it with a value stored in the last word .

procedure:

Repeat Indefinitely:

Test ROM, if not pass then execute error procedure Test System RAM, if not pass then execute error procedure Test Application RAM, if not pass then execute error proc.

End Loop .

5.0 PROCEDURE/FUNCTION DESCRIPTIONS 5.1 Startup code executing prior to any task execution Initial Startup procedure (TMMAIN)

Initialize Interupt Vectors.

Initialize floating point error handler.

Start i5 ms periodic interrupts.

Set alarm channel of real time clock for 1 second interrupt.

Other initialization.

Create the five tasks with the VRTX "create" call.

Suspend all but Operator Task.

Jump to \fRTX entry point.

End Startup procedure .

5.2 Neutron Task code 5.2.1 Local Power Density procedure (This procedure calculates the Power Density Pretrip/Trip function and the Meter Relay Analog Output function. For a complete description of the calculations of the Power Density Pretrip/Trip Function and the Meter Relay Analog Output Function, see the SRS.)

Read the three neutron flux sensor inputs, L, U, and Phi Scale Phi reading to produce long integer version of Phi.

Calculate scaled, long integer version of Ye from L and U.

(If L+U is less than .75 volt, set Ye to zero.)

Calculate Y using Ye as input to the ASI function.

5-1

Set Q, the power level, to the maximum of Phi and Delta-T Power.

(Delta-T Power is available from the Thermal Task.)

Compute Phi minus Delta-T Power.

Scale and limit the result for D~C output, write it to the DAC.

IF Q > 15% power then set Q2 equal to Q.

IF Q < 14.5% power then set Q2 to zero.

(no cha~ge in Q2 if Q is between 14.5 and 15 percent power)

Calculate QR2 using Q2 as input to the LOCA Peaking function.

Calculate Yp using QR2 as input to the LPD Positive function.

Calculate Yn using QR2 as input to the LPD Negative function.

Calculate Ypp and Ynn by adding/subtracting b to/from Yp and Yn .

IF Y exceeds Yp or is less than Yn, then:

Goen the LPD trip digital output.

set the status to TRIP.

ELSE Close the LPD trip digital output.

set the trip status to OK.

End IF-ELSE IF Y exceeds Ypp or is less than Ynn, then:

Open the LPD pre-trip digital output.

set the status to PRETRIP.

ELSE Close the LPD pre-trip digital output.

5-2

set the pre-trip status to OK .

End IF-ELSE END Local Power Density procedure 5.2.2 TM/LP PROCEDURE (This procedure calculates the Thermal Margin/Low Pressure Function and provides an analog output pressure signal PTrip. For a complete description of the calculations of the Thermal Margin/Low Pressure Function, see the SRS.)

Read PAsgt analog input.

Scale it to produce long integer version.

Read the Delta-T Power block digital input.

IF its open, then set Ql equal to neutron flux power, Phi .

ELSE set Ql to greater of Phi or Delta-T Power.

Calculate QRl using Ql as input to the Power Peaking function.

Calculate QA using Y as input to the Axial function.

(Y is calculated in the Local Power Density procedure.)

Calculate QDNB as a scaled product of QRl and QA.

Calculate Lambda*QDNB as a scaled product of Lambda and QONB.

Calculate PVAR as the sum of Lambda*QDNB, Gamma, and BetaTCal.

(BetaTCa~ is from the thermal task, Lambda and Gamma are operator adjustable parameters.)

Set PTrip to the maximum of PVAR, PMin, and Pasgt.

(PMin is an operator adjustable parameter.)

5-3

Scale Ptrip for output to the DAC, the write it to the DAC.

END TM/LP procedure 5.2.3 VHPT Procedure:

(This procedure changes the VHPT trip and pre-trip setpoints, outputs the trip setpoint to the VHPT analog output, and sets the VHPT trip and pre-trip digital outputs.)

IF VHPT Reset function key pressed OR VHPT Reset digital i.nput, then:

IF the VHPT Trip is not in tripped state, then:

Read the current system tick count.

Ir over ten seconds have elapsed since last VHPT reset, then:

Reset the VHPT trip and pretrip levels.

Save the current power level.

Save the tick count as time of last VHPT reset.

End IF End IF End IF IF power level has decreased since last VHPT reset, then Reset the VHPT trip and pretrip levels.

Save the current power level.

End IF convert and scale LONGINT value of VHPT setpoint to an INTEGER for output to the DAC, then write value to the DAC.

IF VHPT trip state is TRIPPED then

IF power level is less than setpoint - deadband, then:

5-4

Change trip state to OK.

End IF ELSE IF power level is greater than setpoint, then:

Change trip state to TRIPPED.

End IF End IF-ELSE IF VHPT pre-trip state is TRIPPED then IF power level less than pre-trip setpoint - deadband, then:

Change pre-trip state to OK.

End IF ELSE IF power level is greater than pre-trip setpoint, then:

Change pre-trip state to TRIPPED.

End IF End IF-ELSE Output VHPT trip state to QTCC digital output.

Output VHPT pre-trip state to QPCC digital output.

END VHPT Procedure 5.2.4 Reset VHPT Trip/Pretrip procedure (This procedure changes the value of the VHPT trip and pretrip setpoints.

The symbols are taken from the SRS, section 3.1.5.)

Qtr = Q + Q%tr

IF Qtr > QtrMAX THEN 5-5

Qtr = QtrMax

ELSE Qptr = QptrMax IF Qtr < QtrMin THEN Qtr = QtrMin Qptr = QptrMin ELSE Qptr = Q + Q%ptr End IF-ELSE End IF-ELSE End Reset VHPT Trip/Pretrip procedure 5.3 Thermal Task Code

5.3.l TC Alarm procedure (This procedure reads the temperature sensors and handles the calculations, all with integer math.

TC Alarm Then floating point values needed for Static BOOLEAN variables LoState and HiState Delta-T Power are computed.

are needed. LoState will be set when the temperature is too cold and HiState will be set when the temperature is too hot. They will be initialized to FALSE and thev TC alarm digital output will initially be closed.)

Read the temperature sensor analog inputs: TCl, TC2, and THAve.

Set TC to the larger of TCl and TC2.

IF LoState is TRUE, then:

5-6

IF TC now exceeds minimum temperature plus deadband, then Set LoState to FALSE .

ELSE End IF Close the TC Alarm digital output.

IF TC is below the minimum temp, then Set Lo State to TRUE.

Open the TC Al a rm digital output.

End IF End IF-ELSE IF HiState is TRUE, then:

IF TC is now below maximum temperature minus deadband, then Set HiState to FALSE.

Close the TC Alarm digital output .

ELSE End IF IF TC is above the maximum temp, then Set HiState to TRUE.

Open the TC Alarm digital output.

End IF End IF-ELSE (Preceding calculation were all in integer)

Compute floating point versions of TC and Delta-T for use in Delta-T Power calculation.

END TC Alarm procedure

5-7

5.3.2 Oeltc-T Power procedure

(This procedure performs the Delta-T Power calculation.

function of temperature, and the highest cold leg temperature, and a temperature differentiator.

\

the Delta-T Power is a average The cold leg hot leg temperature avercge hot leg temperature are available from the TC Alarm procedure.

For further information on the Delta-T Power Calculation, see the SRS.)

Calculate Z = A* Delta-T +TC Subtract previous value of Z to get change in last second, ZDOT.

Compute derivative estimate as GAIN

ZDOT + (1-GAIN)

OldDiff (where OldDiff is the previous value of the derivative estimate.)

Save current value of Z for use in one second.

Save derivative estimate as OldDiff for use in one second.

Compute Delta-T Power p~r formula in SRS.

Compute BetaTCal per formula in SRS. (see PVAR equation, TM/LP)

Scale Delta-T Power and BetaTCal and convert to long integer.

(These global variables will be used by the Neutron Task.)

END Delta-T Power procedure

5-8

5.4 Operctor Task Code 5.4.1 Corrmcnd Interpreter procedure:

IF the "MORE" key was pressed, then execute the More Key procedure to determine the next menu bar and draw it on the bottom line.

ELSE IF the key requests a procedure be performed, then do it.

IF there is no new request pending from the operator, then:

Use the Command Table to determine the next display screen and menu bar.

End IF-ELSE IF The display is being changed AND there is no new operator request, then:

Draw the new screen.

IF there is no new operator request *then:

Draw the menu bar on the bottom line.

ELSE IF The menu bar is being changed AND there is no new operator request, thep:

Draw the menu bar on the bottom line.

End IF-ELSE End Command Interpreter procedure.

5-9 I

l

5.4.2 The "MDRE" Key in Normal Mode

There are 16 different menu bars which can ippear on the bottom line of the display in Normal mode.

labels, provide labels These menu bars, also referred to as function key to indicate the action of the function keys.

Initially, the primary screen is displayed, and the menu bar is:

PRESSURE ALARMS STATUS MORE If the "MORE" key is pressed repeatedly, the following menu bars will appear:

PWR DENS PWR PEAK LOCA PEAK MORE AXIAL ASI ADJ PARAM MORE 24 HR TRND 7 DAY TRND TR SELECT MORE These four menu bars wi 11 repeat in the same sequence if the "MORE" key action is continued. If the PRESSURE key is selected from the first menu bar, the Pressures Screen will appear, and the menu bar will change to:

PRIMARY ALARMS STATUS MORE The ALARMS selection will obtain the Alarms Display and this menu bar:

PRIMARY STATUS VHPT RESET MORE 5-10

Here is the complete list of menu bars, along with a reference name for each:

PRESSURE ALARMS STATUS MORE (Pl)

P\.IR DENS PWR PEAK LOCA PEAK MORE (P2)

AXIAL ASI ADJ PARAM MORE (P3) 24 HR TRND 7 DAY TRND TR SELECT MORE (P4)

PRIMARY ALARMS STATUS MORE (lA)

PRIMARY STATUS VHPT RESET MORE (lB)

PRIMARY ALARMS PRESSURE MORE (lC)

PRIMARY PWR PEAK LOCA PEAK MORE (2A)

PRIMARY PWR DENS LOCA PEAK MORE (2B)

PRIMARY PWR DENS PWR PEAK MORE (2C)

PRIMARY ASI ADJ PARAMS MORE (3A)

PRIMARY AXIAL ADJ PARAMS MORE (3B)

PRIMARY PRIMARY PRIMARY AXIAL UP UP PAGE DOWN DOWN MORE MORE MORE (3C)

(4A)

(4B)

SELECT DISPLAY CLEAR MORE (4C)

Pl is the first menu bar of the primary display. P2, P3, and P4 rotate in sequence as the 11 MORE 11 key is repeated. 11 P11 is for Primary, and these four menu bars form the Primary sequence, or 11 PATH". The concept of PATH is introduced in order to create an algorithm for this sequencing. Pl - P2 -

P3 - P4 is PATH 0 .

5-11

If another key is pressed (not "MORE") then a new screen may be displayed.

This happens unless a function is selected, the functions being VHPT Reset, UP, DOWN, PAGE, SELECT, DISPLAY, and CLEAR. When a new screen is displayed, a new menu bar will also be written. When going to a new screen and menu bar from the primary screen, the following table indicates which menu bar 1s next:

function KEY SOFTKEY SOFTKEY 1 =A 2 =B 3 =c menu bar Pl lA lB lC P2 2A 28 2C P3 3A 3B 3C P4 4A 48 4C This action also changes the PATH, from PATH 0, to PATH 1,2,3 or 4. The PATH number is the same as the number in the menu bar name. For example, if we are looking at the primary screen, and the menu bar P3, and we press softkey 2, we will obtain the ASI function display, and menu bar 3B, which also puts us on PATH 3 .

5-12

The "MORE II key never changes the PATH; it moves the menu bar along the current path . The complete list of paths is :

PATH NO.

0 Sequence Pl - P2 - P3 - P4 1 lX - P2 - P3 - P4 2 Pl - 2X - P3 - P4 3 Pl - P2 - 3X - P4 4 Pl - P2 - P3 - 4X Where the X means either A, B, or C. Which letter the X represents is determined by the menu bar that was displayed when the new path was established. For instance, in the example above the new menu bar was 38, hence B will be used for X as long as we sequence around this path with the "MORE" key . A variable called AltMenu will be used in the software to

The MORE" key procedure will have logic 11 store this information.

representing the above table, and will make use of the state variables PATH and AltMenu in order to select the next menu bar. When a key other than "MORE" is hit the Command Interpreter procedure wi 11 either execute one of the directly selectable functions, or it will call the Command Table procedure to select the next display, menu bar, PATH, and AltMenu.

The above scheme lets us navigate fairly quickly among the available options, and with minimal demands on the user. If the user's desire is not seen on the menu bar he can usually find it simply by hitting the "MORE" key until he sees it. If that doesn't work he can select PRIMARY, which appears on almost all menu bars .

One deviation from the above scheme will be made to avoid an 5-13 inconvenient

situation: After the operator uses the TREND SELECT screen to choose

parameters screen procedure for display, it would be difficult to get to a trend in order to view the selected data.

so We will modify the that a different path is selected by the "MORE" key in More display key this situation. When the Path is 4 and the menu bar is 4C, then the "MORE" key will go to PATH 1 and menu bar P4 with Altmenu lA.

5. 4. 3 Carmi.and Table procedure:

(The command table procedure uses the current menu bar and the softkey that was pressed as inputs to a look-up table in order to return the new menu bar and display screen. It also changes two state variables that are used by the 11 MORE 11 key procedure; these are AltMenu and Path. This procedure I

wi 11 not be ca 11 ed when the soft key pressed is the "MORE" key. In order that the table be in ROM, the procedure consists entirely of CASE

statements, the branches of which are provides no direct way of constructing a table in ROM.)

assignment statements. Pascal 5.4.4 Data Modify Procedure:

WHILE mode = Data Modify DO Set variables to establish initial state.

Draw the initial screen display. (Modify Param Display)

Read the pump select switch.

Show the current pump selection.

Draw the first page of parameters.

WHILE NOT Full Ini t DO BEGIN Repeatedly poll the function keys and switches until an 5-14

operator action is detected:

Act according to the kind of event~

function Key 1: Draw next page of parameters. "

function Key 2: Perform Set Date and Time procedure.

Set Full Init flag to exit inner loop.

PumpSwitch: Show the current pump selection.

Re-draw the current page of parameters.

ModeSwitch: Set Full Init flag to exit *inner loop.

KeyPadChar: Perform character handler procedure.

(otherwise take no action)

End inner WHILE loop.

End outer WHILE loop.

End Data Modify procedure 5.4.5 Character Handler procedure Act depending on kind of character:

BACKARROW: Back-Space Delete procedure.

CLEAR:

Blank the two data entry fields. (item and value)*

Setup to accept an item.

Initialize appropriate variables.

PLUS, MINUS, PERIOD, EXPONENT:

IF the data entry mode is VALUE, then:

accept the character into the input buffer .

5-15

NUMERALS, 0 thru 9:

accept the character into the input buffer.

ENTER:

Action depends on data entry mode: (ITEM, VALUE, or Time-Date)

ITEM:

Verify that entry consists of one or two decimal digits.

IF SO, then:

Convert entry to integer.

IF that item not on current parameter page, then:

redraw parameter page.

Remove the cursor from the item entry field.

Change entry mode to VALUE.

Put cursor in VALUE field.

Initialize appropriate variables .

End IF SO VALUE:

IF entry string is a valid floating point number, then:

Store the new value in the Parameter Tables Clear the data entry fields.

Change entry mode to ITEM.

Redraw the parameter page to show the new value.

Initialize appropriate variables.

End IF Time-Date:

Perform AcceptTime Procedure which will convert data entry

string into (up to) three integers, and switch the time entry 5-16

roode between DATE and TIME.

End Character Handler procedure .

5.4.6 Test Mode procedure ALLOWS THE USER OF THE TMM TO RUN DIAGNOSTIC ROUTINES THAT WILL TEST THE SYSTEM RAM AND ROM, THE ANALOG INPUTS AND OUTPUTS, THE SOFT KEYS, PANEL SWITCHES AND KEYPAD, AND THE DIGITAL INPUTS AND OUTPUTS TESTMODE: DO THIS ROUTINE UNTIL THE MODE CHANGES FROM TESTMODE TO ANOTHER MODE WAIT FOR AN INPUT EVENT TO OCCUR FROM THE GET EVENT PROCEDURE WHICH WILL HAVE STORED IN A VARIABLE WHICH EVENT OCCURED.

TEST TO SEE IF A SOFT KEY HAS BEEN PRESSED AND IF IT HAS THEN SET THE PROPER FLAGS TO INDICATE THE PROPER DIAGNOSTIC FUNCTION TO BE PERFORMED, SUCH AS GOING TO ANALOG, DIGITAL, OR KEYS TEST.

TEST TO SEE IF KEYPAD HAS BEEN PRESSED; IF SO, SET KEYPAD FLAG.

TEST TO SEE IF THE PUMPSWITCH HAS BEEN CHANGED IN A NEW POSITION AND IF SO SET THE APPROPRIATE FLAG TEST THE FLAGS AS THEY WERE SET IN ABOVE AND CALL ON THE APPROPRIATE ROUTINES TO ACCOMPLISH THE DESIRE RESULT. THE ROUTINES WILL BE INVOLKED AS THE TABLE LISTED BELOW BASED UPON THE APPROPRIATE FLAGS.

NOTE: THE FIRST FIVE SOFT KEY EVENTS SIMPLY PRINT THE SOFT KEY

PRESSED WHEN FIRST ENTERING THE KEYS TEST. THEN THE TABLE BELOW 5-17

WILL APPLY FOR THE EVENT AND THE CURRENT TEST AS APPROPRIATE.

FLAG TABLE CURRENT TEST EVENT OCCURRED ACTION TAKEN

1. KEY PAD SOFT KEY 1 . INVOKE ANALOG TEST SOFT KEY 2 INVOKE DIGITAL TEST SOFT KEY 3 INVOKE MEMORY TEST PUMP SWITCH DISPLAY PUMP SWITCH #

KEY PAD DISPLAY KEY PRESSED

2. ANALOG SOFT KEY 1 INVOKE DIGITAL TEST

SOFT KEY 2 SOFT KEY 3 INVOKE MEMORY TEST INVOKE KEYPAD TEST SOFT KEY 4 REREAD ANALOG INPUTS

3. DIGITAL SOFT KEY 1 SELECT NEXT DIGITAL OUTPUT SOFT KEY 2 CHANGE CURRENT DIGITAL OUTPUT TO INVERSE VALUE SOFT KEY 3 INVOKE KEYPAD TEST

4. MEMORY SOFT KEY 1 INVOKE ANALOG TEST 5-18

SOFT KEY 2 INVOKE DIGITAL TEST SOFT KEY 3 INVOKE KEY TEST AFTER THE APPROPRIATE FLAG HAS CAUSED THE APPROPRIATE ACTION TO BE TO BE TAKEN, CONTROL IS RETURNED TO THE BEGINNING OF TESTMODE AND THE ROUTINE CONTINUES TO WAIT FOR AN EVENT TO OCCUR UNLESS THE MODE HAS CHANGED.

5.5 Utilities and Supporting Routines 5.5.1 PLFunc - Piecewise Linear Function Evaluator PLinit - Initialization of a P.L F. (needed to use PLFunc)

PLFunc receives an array POINTS, an integer N, and a value INVAL. POINTS describes a particular piecewise linear function, N is the number of

points, and INVAL is a value of the independent variable.

returns the value of the dependent variable.

The function PLinit is a procedure that is called when a new P.L.F. is defined, and again if any of its points are changed. (It will be called at startup and after Data Modify.)

The array POINTS is an array of records. Each record consists of a value X and value Y. These are the cartesian coordinates of a point. The order of the points corresponds to moving from left to right, or increasing values of X.

When INVAL is less than the first X value, we will assume that the first

line segment is extensible to the left.

5-19 Similarly, if INVAL is greater

than the Nth X value, we extend the last segment to the right.

In the description below, let X[i] and Y[i] refer to the coordinate values, with 0 <= i < N. Let SLOPE[i] refer to the slope of the segment - joining POINT[i] with POINT[i+l], for i < N-1.

Algorithms: There is an initialization and an execution algorithm. The initialization algorithm must be performed whenever the POINTS array is created, or changed. It consists of calculating, and storing, the slopes of the line segments. The PLinit procedure must perform this operation, storing the SLOPE array so that PLFunc can use it. The calculation is, for a 11 i from 0 through N-2:

SLOPE[i] = (Y[i+l] - Y[i]) I (X[i+l] - X[i])

PLFunc does the following:

if N < 2 it is an error condition. otherwise:

set i to 1 set LIMIT to N-1 WHILE (i not equal to LIMIT) and (INVAL > X[i])

DO increment End WHILE decrement i result = Y[i] + SLOPE[i] * (INVAL - X[i])

(done, return the result)

Modifications required for integer math: Instead of SLOPE[i] we use 5-20

NUMER[i] end DENOM[i] where NUMER[i] and DENOM[i] are both integers and NUMER[i] I OENOM[i] = SLOPE[i]. Pllnit stores the NUMER and DENOM arrays.

The result formula of PLFunc uses the FracFinder function on the (lNVAL X[i]) term, using NUMER[i] and DENOM[i] as the numerator and denominator.

SLOPE is nowhere explicitly used.

5.5.2 Graphics Status procedure (This procedure is called by any routine that wants to send data to the graphics card, prior to so doing. It reads the Status Port to determine whether the ~raphics hardware is ready to accept data. It does not return to the caller until this is the case. If the graphics card is not ready, the VRTX call delay(l) is done, allowing other tasks to execute. It also empties the key pad of any pending characters, placing them i.n a RAM buffer. In addition it may set the NewOpReq flag; it does so if it detects

that the operator has just pushed a function key.)

Buffer any characters from numeric keypad.

Set retry limit.

Read the graphics status port.

WHILE status is NOT READY and retry limit not exceeded, DO:

VRTX Delay for one clock tick.

Poll the function keys, maybe set NewOpReq flag.

Increment the retry counter.

Read the graphics status port.

End WHILE IF the retry limit is exceeded, then jump to error procedure .

End Graphics Status procedure 5-21

5. 5. 3 RAMEST RAMTEST is an assembly language routine that is designed to be called from any pascal module as a function that will return a boolean value that indicates to the calling program whether the ramtest failed or succeeded.

In order to write a routine that is both thorough and fast in execution time, this routine makes extensive use of the internal registers of the 8088 microprocessor. In addition, this routine must reside in ROM in order to work properly as it does not relocate itself in order to check the adress space where it resides.

Function ramtest (lowoff:word;lowseg:word;upoff:word;upseg:word) boolean; move all but the lower four bits of the lower order offset

into the lower segment in order to get ready for a segment by segment test of the ram.

move all but the lower four bits of the upper offset as above if lower segment is greater then upper segment then indicate error by returning boolean false to the calling program call TESTRAM subroutine until both the lower offset = upper offset this is done to used both the lower segment and upper segment to control the TESTRAM as it does a segment by segment test Main: call TESTRAM to check another 16 bytes of data

5-22

increment the lower segment count if lower segment = upper segment then exit with a return value of true boolean to the calling program otherwise jump to MAIN and continue the ramtest TESTRAM: set counter with 16 for 16 byte ramtest move first byte and store a copy in an index register with a working copy in the ax register xor the byte with FFH and store this new value of in order to test in order to store the bitwise inverse of the initial value read the byte again and compare byte read with value written if the values are not the same than indicate an error, return a boolean false write the initial value that Jas stored in the index register to the byte location and read it back to insure that the value is the initial one decrement 16 byte counter and return to calling code otherwise jump to testram to continue the ramtest 5.5.4 ROMTEST ROMTEST is an assembly language routine that is callable from any pascal module as a function that will return a boolean value where false indicates 5-23

that the romtest failed. this routine is actually only a setup routine

that calls on the following routine cal1ed CRCHECK and passes address parameters that crcheck needs in order to complete ere of the The returned ere value from the routine crcheck is compared it against the ROM.

the value in ROM at FFFF:E.

5.5.5 CRCHECK CRCHECK is an assembly language routine that is designed to. be called from any pascal module as a function that will return a ere value that indicates to the calling program the value of the ere In order to write a routine that is both thorough and fast in execution time, this routine makes extensive use of the internal registers of the 8088 microprocessor.

move all but the lower four bits of the lower order offset

into the lower segment in order to get ready for a segment by segment ere of the rom.

move all but the lower four bits of the upper offset as above if lower segment is greater than upper segment then indicate error by returning boolean false to the calling program call crcl subroutine until both the lower offset = upper offset this is done to used both the lower segment and upper segment to control the erel as it does a segment by segment erel set the ere initially to zero.

5-24

Main: call crcl to continue the ere check on another 16 bytes of data

increment the lower segment count if 1ower segment upper segment then exit with a return value of the ere value in the form of a word to the calling program otherwise jump to MAIN and continue the ere CRCl: set counter for 16 byte count move next memory byte into ax register get polynomial X**l6 + X**l5 + X**2 + 1.

(This is just the 16-bit word 8003 hex) save byte in register ex generate the new ere by shifting the data byte and the ere left eight times ; after each shift the ere is XORed with the polynomial if the XOR of the data bit and the crc 1 s most significant bit is a 1.

decrement the byte counter and return to MAIN if counter = 0.

otherwise jump to crcl and continue the CRC.

5-25

6.0 DISPLAY DESCRIPTIONS This section describes the displays used in the operation of the TMM.

The operctor moves from display to display by using the four softkeys located beneath the display. The function key functions are labelled on the CRT above the keys. For example, to go to the AXIAL display from the current display, the operator simply presses the function key labelled 11 AXIAL." On most displays the rightmost key is labeled "MORE". By pressing this key, a new set of labels is displayed for the three other keys. Thus, if the desired display is not seen on the existing softkey labels, the operator can locate it by using the "MORE 11 key to display new labels.

Displays that present dynamically changing values will be updated every several seconds.

The following 13 displays are for Normal Mode:

6.1 PRIMARY DISPLAY The Primary Display presents the Delta-T Power and the VHPT Setpoint in large, easy to read numbers. Also, the time and date are presented as feedback that the TMM is operating. The softkeys at the bottom of the display are labeled with the available options for other displays. Both of the large numbers being presented have a range of 0 to 125, representing %

power. The active pump configuration is also shown, 3 Pump or 4 Pump .

6-1

6.2 PRESSURES DISPLAY The Pressures Display presents the Ptrip pressure as computed from the TM/Lp function. In addition, the Pmi.n (operator adjustable parameter),

Pvar (based on cold leg temperature and axial offset), and Pasgt (asymetrical steam generator trip analog input) are displayed. All pressures are displayed in units of PSIA.

6.3 AXIAL FUNCTION DISPLAY The Axial Function Display presents a graph of the piecewise axial function as determined from three points. Along with the graph are the numerical values for the three points and the current values for QA and Y. QA is the axial function result of Y. Y is the axial offset obtained from the ASI function.

6.4 POWER PEAKING DISPLAY The Power Peaking Display presents a graph of the piecewise power peaking function as determined from four points. Along with the graph are the numerical values for these points and the current values of QRl and Ql.

QRl is the power peaking functional result of Ql. Ql is equivalent to the maximum of Phi or Delta-T Power if the *Delta-T Power Block is closed, or Phi if the Delta-T Power Block is open .

6.5 ALARKS DISPLAY

The (VHPT)

Alarms and temperature alarms.

Display indicates the status of the variable high power level (Max of Phi or Delta-T) ranging from 0 to 125% power, power trip The VHPT information includes thi current the trip status as OK, Pretrip, or Trip, the VHPT trip setpoints (Qptr and Qtr), and the operator adjustable parameters for the percentage above powej that the trip setpoints should be set. The "VHPT RESET" function key is used to reset the VHPT setpoints after a trip. The external setpoint reset (external to the TMM) performs the same function.

The temperature information includes the current Tc value as obtained from the maximum of the cold leg temperatures Tel and Tc2, the temperature trip status as OK or Trip, and the minimum and maximum trip setpoints TcMIN and TcMAX (operator adjustable) .

6.6 -24 HOUR TREND DISPLAY The 24 Hour Trend Display shows the values of the selected trend parameters in tabular form. The UP and DOWN function keys are used to scroll through the trend data, ten lines at a time. No information is automatically updated on this display.

6.7 SEVEN DAY TREND DISPLAY The 7 Day Trend Display is identical to the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months trend display except that the data source is the trend 7 day archives, rather than the 24 hour archives.

6-3

6.8 TREND PARAMETER SELECT DISPLAY

The trend Trend Parameter Select Display allows the operator to parameters to display on the 24 Hour or 7 Day current displayed Trend parameters are presented along with a menu of select which Display.

all The the trend parameters available. Several function keys are used to choose which parameters to display. The SELECT function key moves a cursor through the selections thus allowing the operator to choose one. The DISPLAY key is used to add the SELECTed parameter to the current displayed list (if there is space on the screen). The CLEAR key is used to remove the last selected parameter from the current selection list.

6.9 SYSTEM STATUS DISPLAY The System Status Display provides the operator with a dynamic report on system operability. Specifically, these variables are: TCl, TC2, TC, THAve, L, U, Phi, Phi-B, PTrip, and Pasgt. Also shown are the states of the five digital outputs, Tee, LPD/trip, LPD/pretrip, Qtcc, and Qpcc. (see SRS - DOC #055) 6.10 POWER DENSITY DISPLAY The Power Density Display presents a graph of the two local power density (LPD) functions as determined by the five operator adjustable points. In addition, the trip status of the Power Density Pretrip/Trip function is displayed as OK, Pretrip, or Trip; the five point pairs are displayed numerically, as are the current Y and QR2 values. Y is the result of the ASI function and QR2 is the functional result of the Loca Peaking function .

Also shown are Yn and Yp, the outputs 6-4 of the LPD piecewise linear

functions .

6.11 LOCA PEAKING DISPLAY The Loca Peaking Display presents a graph of the piecewise linear Loca Peaking function as determined from the four operator adjustable points.

Along with the graph are the numerical values for these points and the current values of QR2 and Q2. QR2 is the Loca Peaking functional result of Q2. Q2 is equivalent to Q (the maximum of Phi or Delta-T power) if Q is greater than or equal to 15.0% power, or equal to 0 if the Q is less than or equal to 14.5% power. (see SRS - DOC #055 for more detailed definition of Q2) 6.12 ASI DISPLAY

The ASI Along with (Axial Shape Index) Display presents a graph of the the graph are displayed the numerical values for these piecewise linear ASI function as determined from the four operator adjustable points.

points and the current values of Y and Ye. Y is the ASI functional result of Ye.

Ye is the subchannel deviation computed from the U and L linear power readings .

6-5

6.13 ADJUSTABLE PARAMETERS DISPLAY

The able Adjustable Parameters Display allows the operator to view the parameters.

parameter list, The .PAGE ten at a time.

function key is used to scroll adjust-through Note that no parameters can be modified the here. If the operator needs to change these parameters, he must have the mode select keyswitch in the Data Modify position and use the Modify Parameters Display described below.

The following two displays are seen when the mode keyswitch is in the Data Modify position:

6.14 MODIFY PARAMETERS DISPLAY The Modify Parameters Display allows the operator to view and modify the

. operator adjustable parameters. The current parameters are displayed for the pump selected via the* keyswitch. The operator can scroll the parameters by pressing the PAGE key. New parameters are entered using the data entry keypad. First the parameter number is entered. The TMM wi 11 then wait 'for a new value to be entered by the operator. Once the new value has been entered, the TMM will wait for another parameter number.

Any valid parameter number may be entered; if a number is entered for a parameter not shown on the screeen, then the appropriate page of parameters wi 11 be di splaYed .

6-6

6.15 SET DATE AND TIME DISPLAY

The time stored in the TMM battery-backed up clock.

are dis~lcyed Set Dcte and Time Display allows the operator to change the date and The current date and time at the top of the screen and are updated once per second.

The DATE softkey is used to enter a new system date and the TIME softkey is used to set the system time. The date and time digits are entered using the data entry keypad.

The following four displays are used in conjunction with the mode keyswitch in the Test Mode:

6.16 MEMORY TEST DISPLAY The Memory Test Display allows the operator to perform ROM and RAM - tests.

The results of these tests are indicated on the display as either PASS or FAIL. The IN PROCESS message appears while the test is currently being performed.

6.17 DIGITAL TEST DISPLAY The Digital Test Display provides status on all the external digital inputs and outputs as being open or closed. The current values of the digital inputs are displayed; they are updated when the user pressed the READ INPUTS softkey. The operator can use the softkeys to change the state of the digital outputs. The SELECT key is used to choose which output to change. The OPEN/CLOSED key is used to toggle the state of the selected

6-7

item as open or closed. The displayed state of each digital output is

updated each ti me the opera tor changes it. :. .

6.18 ANALOG TEST DISPLAY The Analog Test Display provides the current values of all the TMM analog inputs and outputs. The analog inputs Tel, Tc2, THave, L, U, Phi, and Pasgt are displayed as 0 to 10 VOC. They are updated whenever the user presses the READ INPUTS function key. The analog outputs Phi-B, Ptrip, and VHPT Setpoint are preset to 7.50VDC, 30.0mA, and 5.00VDC respectively.

6.19 KEYS TEST DISPLAY The Keys Test Display allows the operator tb test the functionality of the pump select keyswitch, softkeys, and data entry keypad. The pump select 11 11 keyswitch switch position is displayed as 11 3Pump or 4Pump" and is updated if the - switch is moved. Upon each keypad keypress, the associated character is displayed in the keypad data area. The function keys will display 1, 2, 3, or 4.

6-8

APPENDIX A RUN TIME SUPPORT CONSIDERATIONS

run-time Support Libraries and their interfacing to the Thermal Margin Monitor opercting system.

I NT RO DUCT ION:

Some of the Intel software development tools, such as their Pascal compiler, require the addition of common compiler functions that are found in the various Run-Time Support Libraries provided by Intel. This feature provides a method to allow the software developer the ability to configure the application to eliminate or include various features as necessary.

There are two classes of libraries for the Intel Pascal compiler:

1. Those that support functions that use the 8087 Numeric Data Processor (NDP) or the 8087 NOP Emulator.

2. Those that deal with non-mathematical data processing.

In addition to the various functions that the Run-Time Support Libraries add to the basic Pascal compiler (and that it requires), there are a number of functions that these libraries will require from the actual operating system that the program(s) will run under in order to insure the proper operation of the program(s). The type of functions that the operating system is required to provide include Heap Memory Management, file I/0 such as floppy disks or hard disks systems provide, and other device I/0 such as printers and serial ports. Both the hardware and the software environment that defines the operating system and the requirements of the system application will determine the degree of implementation of the supporting 1

functions system.

provided to the Run-Time Support ~ibraries .by the operating The operating system chosen for the Thermal Margin Monitor is a combination of VRTX (a multi-tasking executive for the 8086/88) and various software routines written by the software development team at GAMMA-METRICS to provide those functions that the VRTX operating system and the various Run-Time Support Libraries require. These software routines include functions to initialize and to provide drivers for the various hardware devices such as the real time clock, counter timer circuit and parallel port. In addition, there are routines to support the run-time exception handling systems for both the compiled Pascal modules and for the 8087 support libraries. In the case of the 8087, the Thermal Margin Monitor will be using the Emulator 8087 NOP software package which contains the routines that fully emulates the 8087 NOP co-processor.

VRTX enables the software developer the ability to provide an integrated method of providing a multitasking environment with little support software overhead. However VRTX, as received from Hunter and Ready, does not directly support the ability to have its various software functions called from a higher language, such as Pascal, as a defined and recognized function or procedure within the specifications of that language. As received, VRTX is only usable through assembly language routines that pre-set various registers for their use by VRTX and translates the return values contained in predefined register upon return from VRTX. However, an assemble language module that can interface Intel Pascal routines with the VRTX operating system would provide the software support to allow the 2

control of the VRTX system from Pascal software modules. This interface will be written to allow all of the VRTX system calls to be available to the prografTliler directly from Pascal as a set of predefined procedures and functions will various input parameters and returned values where necessary and as defined in the VRTX User's Guide. The VRTX support manual, "Interfacing Vrtx to a language" will be used extensively to develop this software interface.

Since VRTX is a multitasking environment, any task that will be defined to run under VRTX and any support software to these tasks must be reentrant.

This is crucially important as far as the Run-Time Support Libraries are concerned since any of the tasks supported by VRTX may at any given time call any of the various routines in the support libraries as a natural course of the Pascal compiled routines that use these libraries. Since the

8087 Run-Time Support Libraries are not reentrant, the multitasking abilities of VRTX are disabled while any one task is using these support libraries. However, VRTX 1 s multitasking capabilities are fully utilized for a majority of the remaining program code of the Thermal Margin Monitor.

Because of this, all routines that are to be used in the Run-Time Support libraries and all routines that provide support to the individual tasks must be reentrant. The following sections will address the necessary steps in order to ensure that all aspects of the Run-Time Support Libraries, the VRTX operating system, and the hardware software support drivers are covered in the overall Thermal Margin Monitor software architecture in order to fulfill the necessary software requirements for this system.

In order to fulfill the necessary functions and global references needed by the support libraries which are to be supplied by the operating system, the 1

null library RTNULL.LIB is linked in with ~ll the object ~odules and after these modules to insure that any unsupported feature of the run-time system will have all external and global references resolved at link time.

RTNULL.LIB will insure that these references will be resolved, however, it will perform little if any actual tasks towards supporting the run-time system and will in most case simply put the processor in a halted state if any of the support procedure labels are called inadvertently. If the labels are resolved by either a library or object module that is linked ahead of RTNULL.LIB then that global reference will accepted by the linker as the legitimate label and that which resides in RTNULL.LIB will be ignored.

The interrupt handling system of the Thermal Margin Monitor provides interrupt handlers for interrupts caused by the run-time system by initializing the appropriate interrupts vectors with the handler addresses.

These handlers will take the appropriate action such as print an error number to the monitor 1 s screen or providing VRTX with its time base for its multitasking system. Upon start-up, a routine will initialize each group of 16 interrupts from interrupt 0 to 255 with a vector that will trap all interrupts that are not later handled by specific handlers. Then after this initialization, the interrupts directly supported by the Pascal run-time system ,the 8087 NDP run-time, and VRTX are handled by other interrupt handlers that will take care of the specific requirements of each interrupt and their respective vectors will over-write the previously placed default interrup~ handler routines. Interrupts such as interrupt 0, 4; 5, 16, and 17 which correspond to divide exception, overflow, range check, floating-point exception, and case range/ procedure stack overflow respectively are 4

interrupts thct indicate unrecoverable errors in the monitor software system and therefore will cause a system "hang up" after the appropriate error number has been written to the monitor's screen. The prevfously mention set of interrupts are the interrupts that will indicate to the operating system that a specific run-time exception ha~ occurred. All other run-time Pascal exceptions are handle by the compiled modules individually by their calling a supplied exception handler routine that is ca 11 ed PAS HAN.

PASHAN is the abbreviated name for Pascal handler and it is the global label for the Thermal Margin Monitor's main Pascal run-time exception handler. The previous paragraph covered the exceptions not included in this handler where the system uses interrupts to handle a few of the run-time exceptions. When the compiled Pascal modules (especially those compiled with the CHECK option, see page 10-10 of the Pascal-86 User's Guide 121539-005 hereafter mentioned as the Pascal user's guide) detect an exception they call a procedure named TQGETERH which is supplied, by an assembly language routine that will place in a pointer variable the address of the Pascal exception handler named PASHAN. After the routine has the address of PASHAN, it will call this exception handler with data parameters that will indicate such information as the exception code that corresponds to the exception as listed on pages 14-l_through 14-4 of the Pascal user's guide. The procedure PASHAN will translate the information provided to it by the calling program to an error number that has been defined by the monitor's operating system .

The the 8087 NOP exception handling routine works in a very similar method above Pascal exception handler except that the handler is invoked to by 5

code produced by the Emulator 8087 NOP. H1is software will copy the address that resides at location 040h , the interrupt 16 vector which is reserved for 8087 exceptions, to a location that is defined by the 8087 run-time support libraries with a jump instruction (OEAH) before the address. When an exception involving the Emulator 8087 occurs, the emulator code will jump _to the jump instruction that contains the address of the 8087 exception handler and then the exception handler will print the appropriate error code on the monitor's screen as it did in the Pascal exception handler. There is a slight modification to this system when code is written to reside in ROM. There currently is no code in the Intel run-time support libraries that will place the jump instruction (OEAH) before the exception handler address and this jump instruction will only be in the program code if both the code section and the data of the program are loaded into memory at the same time. In the ROM version, the only data that resides in the data section of the monitor's memory is that which the program loads into it. The above information was verified by Alfred Wong and Chung Lew of Intel's software development group (phone 408-987-7816) and they indicated that if the system will place the jump instruction in memory sometime during initialization, then the 8087 run-time support library will function properly. Listed below is the set of error codes that will be printed on the screen for the corresponding run-time exceptions involving the Emulator 8087 and the compiled Pascal code.

The following is a list of the error codes that will be displayed on the Thermal Margin Monitor:

1) UNINITIALIZED INTERRUPTS. before the tmm program is started, 6

t a routine calles resetl will be run that will group the 256 interrupts into 16 groups of 16 members and each group will have its own exception handler and will display a diff~rent code on the tmm screen.

group 0 - 80 group 1 - 81 group 2 - 82 etc group 15 - 95

2) PASCAL EXCEPTIONS. These exceptions will occur as a result of the Pascal run-time system. Pascal will report these as a four digit number starting with a 8000, for ex. 8000 for divide by zero as defined in the Pascal reference manual.

however, errorhang will display this information as an integer and therefore the screen would display the value -0 for a divide by zero.

7

divide by 0 -0 RUN- TIME PASCAL INTEGER ZERO DIVIDE: 8000 integer overflow -1 RUN- TIME PASCAL INTEGER OVERFLOW: 8001 heap exception - 1151 heap exception - 1152 heap exception - 1153 set exception - 1131 set exception - 1132 set exception - 1133 set exception - 1134 set exception - 1135 range exception -6 run-time exception 8006 range exception -17 run-time exception 8017

3) 8087 EXCEPTIONS- These exceptions occur as a.result of the 8087 emulator They can be cumulative in that a precision error can occur at the same time as an invalid operation error and errorhang would display the summation of the two error numbers as found below and the above errors would result in a number 33 being displayed.

Invalid operation - 1 Denormalized operand - 2 Zero divide - 4 Over fl ow - 8 Underflow - 16 Precision - 32

NOTE: The error numbers from 1 to 63 have been reserved for the 8087 8

because handler (error the cbove exceptions can occur in combinations and will display these all at once.

the For example if both a exception precision number 32) and an overflow exception (error number 8) occurred then the error n~~ber 40 would be display to indicate that both of these exceptions occurred simultaneously.

4) MACHINE LEVEL EXCEPTIONS. These exceptions occur due to the conditions described by each exceptions.

interrupt 0 - 96 divide by zero interrupt 1 - 97 single step interrupt 2 - 98 NMI (non-maskable interrupt) interrupt 4 - 99 interrupt on overflow

interrupt 5 - 75 interrupt 17 - 76 array out of range integer out of range The remaining support functions that the operating system is expected to provide the run-time support libraries are not implemented by the Thermal Margin Monitor because these various function are not used by the system.

There are no file I/0 support routines because the monitor does not have any file devices such as floppy disk or hard disk. In addition, the memory management system that supports the heap are not provided because the Pascal routines NEW and DISPOSE are not invoked in this software system.

The Intel Pascal compiler provides the ability for very extensive and powerful file I/0 routines and command line processing. These capabilities

enable very powerful operating systems such as MSDOS, Intel intellec III, and Intel IRMX which are based upon the 8086/88 to be fully used as regard 9

to their various characteristics. However, when applying the Intel Pascal software environment to a stand-alone target system with no file I/O devices and no direct human interface that allows for example the inputing to the operating program a command line or direct input, the need for and the implementation of these extensive routines do not exist. As seen in the 11 Run-Time support Manual for iAPX 86;88 Applications 11 from pages B-8 to B-47, there are a great number of these routines that ,except for the exception handling routines, deal with the type of routines that have been previously discussed. These routines that deal with file I/0, memory management (heap), and other routines that support interfacing to a complex operating system are not support directly but instead are linked with the code in RTNULL.LIB as discussed previously and if inadvertently called, will in almost every case cause the processor to halt. Therefore the Thermal Margin Monitor has been designed to provide only the minimum degree of support from the operating system to the run-time support libraries and only in the case of the Pascal exception handler support routine TQGETERH is the support libraries supported at all. The software was designed with no calls to any of the Pascal routines that wo~ld invoke the remaining routines that the operating system is expected to provide. The following is a list of those routines that the operating system does not support for the Run-Time Support Libraries.

10

t.. r: r ,.

1) TQ$FILE$DESCRIPTOR

2) TQ$DEVICE

3) TQ$INITIALIZE

4) TQ$GET$PRECON

5) TQ$EXIT

6) OPEN

7) CLOSE

8) READ

9) WRITE

10) SEEK ..

11) SKIP

12) END RECORD

13) REWIND ,. ..

~

14) BACKSPACE

15) END FILE

16) TQ$SETSERH

17) TQ$ALLOCATE

18) TQ$FREE

19) TQ$GET$SMALL$HEAP For further details on the above functions please read appendix B of the "Run-Time Support Manual for iAPX 86,88 Applications. This appendix will also indicate the action taken when these functions are invoked and the RTNULL.LIB is linked in place of routines usually provided for by the operating system.

In review, the operating system of the Thermal Margin Monitor which is composed of the multitasking VRTX system and support routines provided by 11

programmers at GAMMA-METRICS supports only the exception handling respon-sibilities of the requirements of the logical record system as defined by the "Run-Time Support Manual for iAPX 86,88 Applications" as specified in appendix B. These exception handlers -include those necessary for both the compiled Pascal code , the 8087 NOP, and the processor level exception interrupts. Figure B-1 of the run-time support manual shows a diagram*

which gives a graphic display of providing run-time support without an operating system. Page B-2 of the same manual shows a complete break down of what a standard interface called the "Logical Record Interface" should provide in order to fully implement the features of the Intel Pascal compiler. Of these various supporting software routines, only TQ$GET$ERH is provided. If in the future, added hardware devices are added that can support file I/0 or if management of the heap is needed due to the use of the procedures NEW and Dispose, then it will become necessary to provide an added amount of support from the operating system in the form of procedures that are listed on page B-2 of the run-time support manual.

12

ML18053A290

Text

Navigation menu

Search