ML20012C283

Suppl 3 to Qualified Display Processing Sys (Qdps) Verification & Validation Process, Final Rept

ML20012C283
Person / Time
Site:	South Texas
Issue date:	12/31/1989
From:	HOUSTON LIGHTING & POWER CO.
To:
Shared Package
ML20012C282	List: ML20012C281 ML20012C283 ML20012C284
References
NUDOCS 9003200441
Download: ML20012C283 (11)

Text

__ . _ _ _ _ _ _ _ _ _.. _ _ _ _ _ __ _ - _ __ -.

1 Attachment I ST-HL AE-3303 Pay f of L l

1 SUPPLEMENT 3 TO THE QUALIFIED DISPLAY PROCESSING SYSTEM (QDPS)

VERIFICATION AND VALIDATION PROCESS l FINAL REPORT i

FOR THE l SOUTH TEXAS PROJECT UNITS 1 AND 2 i

i i

DECEMBER 1989  !

l i

l '

THC/QDPS0390.LTR

$8g 2gggg3 gg,gg g ,

P PDC

.'.- .- ATTACHMENT 1 ST HL AE-3313 PAGE 3 0F ll j.

. . l l

TABLE OF CONTENTS  !

l l

1.

SUMMARY

j 1

II. BACKGROUND III.

SUMMARY

OF VERIFICATION ACTIVITIES IV.

SUMMARY

OF VALIDATION ACTIVITIES I

)

1 V. REFERENCES J

l i

I l

3 t

M92C/ GEL /1:082289 i

6 .... .-- , . . - . - , . . - . - - -

• - ..--.--- y

ATTACHMENT.2 k, .

ST HL AE M3

SUMMARY

j PAGE 7 . OF ll ._

An upgrade has been made to the Qualified Display Processing System (QOPS) at the South Texas Project. The areas that have been upgraded include the following: - -

a. Modified TAS algorithm

b. Modified SGE CS algorithm

c. Calculated variable storage following power interruption

d. On line parameter update capability

e. Reference Junction Box RSA algorithm

f. SI TERM /REINIT display page modification Since the candidate hardware was no longer available for testing at the manufacturing facility, a test jig was utilized to conduct the Verification and Validation testing for the subject upgrades. The process defined in the Revised Verification and Validation Plan (Reference 4) was utilized for r.onducting the system verification and validation testing.

The system upgrades defined in Section II only required modifications to 38 existing software units and the addition of 13 new software units. A total of 38 verification clarification reports were written, resolved and closed. No verification trouble reports were generated.

Approximately 190 validation tests were conducted on the modified system. No validation clarification reports were generated; however,one validation trouble report was issued. The trouble report was resolved by modifying the applicable software unit.

The modified software was then reverified and validated, thereby resolving the opened trouble report, o492C/ GEL /2:062289

- - . , - , ,,r----,y-we- - ---

ATTACHMENTA I L .

!!. BACKGRDUND ST HL AE 1313 i

- , PAGE_N op _ y l

)

Since the Qualified Display Processing System (QDPS) was j installed at the South Texas Project, two upgrades have been  !

made to the system firmware. A description of the detail.s of j these two upgrades are provided in Supplements I and 2 to th'e l

QDPS Verification and Validation Program Final Report  ;

i (References 3 and 5). An additional upgrade is currently being  !

I made to the QDPS firmware. A brief description of current l modifications is provided below:

a. Temperature Averaging System (TAS) algcrithm. The QDPS TAS subsystem exhibited an anomaly on February 5, 1988 during  ;

, system cooldown. The anomaly that was observed in the TAS algorithm was the calculated hot leg temperature exhibiting erratic behavior as the plant was cooling down through 5300F, At that time, a step increase was observed in the

~

T havg value and remained at that value until the individual hot leg temperature values returned within the ,

sensor deviation limit E. The problem was identified to be  ;

associated with the manner in which the quality code algorithm for the hot leg temperature channels was calculated. An evaluation indicated that the existing algorithm resulted in the use of an abnormally large bias i value causing an erroneous Thavg value until the l individual RTD values were within the allowable sensor deviation limit of 20 0F. To preclude a reoccurrence of j

,- the incident observed on February 5, interim corrective actions were implemented until a permanent fix was installed. These interim steps resulted in the suspension of the automatic calculation of hot leg temperature biases.

The plant personnel were responsible for periodically administrative 1y calculating the hot leg temperature biases and manually entering the bias values into the TAS algorithm. The NRC was informed of the anomaly that occurred in the TAS firmware via reference 6.

0492C/6EL/3:082289 l

w _. - .-c__--, .i.,.-,

. l

. ATTACHMENTl )

. ST HL AE3313 4

'F- PAGE < OF .J/_ . i

\

. A brief description of the TAS algorithm modifications is )

provided below:

The three hot leg narrow range temperature signals per loop which are input to the QDPS first undergo a sensor quality {

check, which determines if the input signals are included in  !

the calculations. An out of range check is then performed t on the input signals with any signal that is off scale low set at the off-scale low limit. Hot leg temperature estimates are then calculated for each input signal  !

(Tj).

h The three hot leg temperature estimates per loop are then processed to determine a group value (Thavg)and assigned a quality. code of good, poor or bad. l l

A current bias value is then calculated based upon the actual temperature input signals. The stored bias values are updated with the filtered current bias value if the l following conditions are satisfied: (a) the group average  ;

l- temperature value has a quality code of good; (b) the plant f powerisaboveapresetvalue;and(c)thecurrent '

calculated biases are within a predetermined range. The stored bias values are then used to calculate the three hot leg temperature estimates during the next computational cycle. .

i l b. Steam Generator Water Level Compensation System (SGWLCS) algorithm l The SGWLCS algorithm is currently configured such that if both strap on RTDs associated with a reference leg fail, the output signal defaults to the compensated level signal l (frozen output) prior to the failure of the second RTD on that reference leg. In addition, an alarm and message'is ,

activated that instructs the operator to place the channel in a tripped condition.

i 0492C/ GEL /4:082289

. 3 i

l. -

.. ATTACHMENT 2 .

ST HL AE-2343  !

PAGE.A 0F _ n -

i 1 s This firmware modification upgrades the SGWLCS algorithm  ;

such that if both strap on RTDs fail in any reference leg,  !

the output signal will revert to the continuously calculated I uncompensated level signal. This modification will minimize  !

the possibility of introducing perturbations into the plant control systems following the failure of both RTDs in any i steam generator level channel. An alarm and message will l continue to be activated following the loss of both strap on l RTDs in a channel that instructs the operator to place the  ;

channel in a tripped condition. '

c. The hot leg temperature bias values calculated within the TAS algorithm will be stored in NVRAM such that, if power is [

interrupted to the TAS hardware or the processor is reset, I the latest calculated biases will be maintained and utilized following restoration of power to the cabinet.

d. The TAS and SGWLCS firmware is being modified such that the '

system input parameters (e.g., gains, time constant, limits, ,

setpoints, etc.) can be modified without taking the cabinets ,

off line. This feature is referred to as the on line parameter update (OLPU) capability.

This modification will minimize the potential for spurious .

L reactor trips when changing the TAS or SGWLCS input

• parameters by not requiring those channels be taken off-line l l (partial trip condition) when updating parameters.

In addition, the firmware is being modified such that, when entering input parameters via the Man-Machine Interface L terminal, the operator is given a decision point to confirm whether the existing stored input parameter is to be changed. If not, the existing parameter is maintained. If the input parameter is being changed, the operator must enter the desired value.

N 0492C/ GEL /5:082289

I ATfACHMENT.i ST HL AE.7573

.'. .. PAGE 7 0F #

e. Reference Junction Box Redundant Sensor Algorithm (RSA)

During validation testing of the Plant Safety Monitoring System (PSMS) at the Beaver Valley Unit 2 site, an anonialy was discovered in the thermocouple reference junction box RSA algorithm. The problem was associated with the manner in which RTDs with a bad quality code were addressed. If all three reference junction box RTDs fail to values that are within the RSA delta value of each other, the reference junction box RTD group value is calculated to have a value corresponding to the average temperature of the three bad RTD inputs and is assigned a quality code of bad.

The reference junction box algorithm is being modified such that only RTD sensor inputs with a quality code of good are utilized in the RSA algorithm. In addition, if all three RTD inputs are determined to be poor or bad, the group value defaults to 1200F and a quality code of bad is assigned to the group value.

Implementation of these firmware modifications will ensure that the problem that was identified during validation testing on the PSMS at the Beaver Valley Unit 2 site will not occur on the Seuth Texas Project PSMS.

f. S1 TERM /REINIT Display Following a modification to the South Texas Project PSMS subsystem as described in Supplement 2 to the QDPS Verification and Validation Program Final Report (Reference 5),a design problem resulting from the firmware modification was not discovered during system testing. The item identified at the site was the RCS pressure trend hist'ory line did not meet the top of the bar graph which represents the instantaneous variable value of RCS PRESS on the SI '

TERM /REINIT display page. The trend history line indicated an erroneous high value of 200 to 300 psig.

I 0492C/ML/6:062289 l s-e~==e mosom e- v e -e * = * -

• c- w - 4 = . ,-a.w'..

' ~ ~ ~

I Al TACHMENT f I i

. ST HL AE.nu  ;

~'.

. .. L PAGE R _ 0F _ // I Implementation of these firmware modifications corrects the l design problem by ensuring that the RCS pressure trend l history line meets the top of bar graph on the SI j TERM /REINIT display page. .

,, I l

Since the candidate hardware is no longer available for testing at the manufacturing facility, a test jig was constructed upon which to conduct the verification and validation tests for the above discussed l upgrades. Performance of the verification and validation testing is l discussed in the Revised QDPS Verification and Validation Plan in j reference 4. All verification and validation testing was performed j per the guidelines established in the revised V&V plan.  !

l Items a, b, c, e and f were incorporated into the QDPS on Unit 1 '

during the recently completed first refueling outage. Item d will be installed at a later scheduled outage. All upgrades will be installed in Unit 2 at a later scheduled outage. ]

l l

1 l

l l'

i l

l li il 0492C/ GEL /7:082289

~ '

- _ _ - . . __ _ _ . _ _ _ _ ZT_ Z _~ETi~Z~ ~' ~~' ' ~~ ~~~~ l~' ~ ' ~"T' . -

ATTACHMENT 1 i ST HL AE 1393

SUMMARY

OF VERIFICATION AND VAllDATION ACTIVIT![ g PAGE_4 0F _ // - i l

1 The system modifications discussed in Section !! necessitated I

that several software units be modified and/or added. The l numbers associated with each of the modifications are as* .. j j follows:

l l

l Function Software Units Clarification Trouble i Modified Added Renorts Renorts TAS/SGWLCS' 9 1 23 0 RJB/SI TERM 3 0 1 0 I OLPU 26 12 14 0

. )

)

l t

Also listed in the table above is the number of verification and )

l trouble reports generated. Several clarification reports were issued by the verification team and subsequently closed out following rework by the design team, No verificatioh trouble l reports were generated during the verification testing.

I i

l l

i e

0492C/ GEL /8:082289

ATTACHMENT 2.

.

, ST.HL AE 3213 PAGE_!n - 0F _ ll IV.

SUMMARY

OF VALIDATION ACTIVITIES To demonstrate that the modifications made to the system met the system functional requirements, several validation tests gr,e conducted on a test jig since the QDPS hardware is installed at the plant. The acceptability of performing the validation testing on a test jig is discussed in Section 6.3 of reference 4.

The number of tests conducted and the test results are summarized below:

O Function Number Clarification Trouble of Tests Renorts Reoorti

, TAS/SGWLCS 100 0 0 RJB/S! TERM 15 0 1 OLPU 75 0 0 No validation clarification reports were issued during the validation testing. One trouble report was issued while testing the Reference Junction Box Redundant Sensor Algorithm (RSA).

The code functioned properly with respect to its specific application to the Reference Junction Box RSA. However, under

. postulated alternate applications, logical errors were identified in the RSA algorithm. Therefore, the coding was modified to resolve the potential logical errors, thereby resolving the validation trouble report.

0492C/ GEL /9:082289 i

• i

ATTACHN ENT2 l- -. ST HL-AE 33?3 IV. References PAGE u 0F >>

l. ST-HL-AE-1344, QDPS Verification and Validatior Plan from M. R. Wisenburg to George W. Knighton dated September 24, 1985.

2. ST HL AE-1859, Submittal of the QDPS Verification and Validation Progrcm Final Report and Response to the QDPS V&V [

SER Open Item, from Mr. R. Wisenburg to Vincent S. Noonan, dated December 23, 1986.

i

3. ST-HL AE-1988, Submittal of Supplement 1 to the QDPS i

Verification and Validation Program Final Report from M. R. Wisenburg to NRC dated March 19, 1987.

4. ST HL-AE-2645, Revised QDPS Verification and Validation Plan from M. A. McBurnett to NRC dated April 29, 1988. -

9

5. ST-HL-AE 2916, Submittal of Supplement 2 to the QDPS Verification and Validation Program Final Report from M. A. McBurnett to NRC dated January 30, 1989.

6. ST-HL-AE-2547, Software Problem in the Qualified Display Processing System, from Houston Lighting & Power to NRC dated March 7, 1988. '

0492C/ GEL /10:082289

. _ . -