ML20072P923
| ML20072P923 | |
| Person / Time | |
|---|---|
| Site: | Clinton  |
| Issue date: | 03/28/1983 |
| From: | Wuller G ILLINOIS POWER CO. |
| To: | Schwencer A Office of Nuclear Reactor Regulation |
| References | |
| 6-626, L30-83(03-28)L, L30-83(3-28)L, U-0626, U-626, NUDOCS 8304040419 | |
| Download: ML20072P923 (9) | |
Text
l U- 0626 THirinia Power h E
L30-83(03-28)L 500 SOUTH 27TH STREET, P. O. BOX 511, DECATUR. ILLINOIS 62525-1805 i
Docket No. 50-461 March 28, 1983 Director of Nuclear Reactor' Regulation Attention:
Mr. A Schwencer, Chief Licensing Branch No. 2 Division of Licensing U.S. Nuclear Regulatory Commission Washington, D.C.
20555
Dear Mr. Schwencer:
Reference:
NRC Meeting Summary dated 3/9/83, H.. Abelson and R. Kendall - Clinton Unit 1 Nuclear System Protection System (NSPS) Self Test Capability (January 11 and 12, 1983)
Subj ect :
Clinton Power Station Unit 1 Self Test System The referenced meeting provided the NRC with information concerning the Clinton Power Station (CPS) Self Test System (STS) for the Nuclear System Protection System (NSPS).
During the meeting several additional items arose (Attachment 4 of referenced summary).
The information requested is given in the attachment to this letter.
We believe that the attached provides the information for NRC Staff acceptance of the Clinton NSPS/STS design.
Sincerely, G. E. Wuller Supervisor - Licensing Nuclear Station Engineering JPO/GEW/lt Attachment-cc:
H. Abelson, NRC Clinton Proj ect Manager R. A. Kendall, ICSB, NRC C. E. Rossi, ICSB,-NRC H. H. Livermore, NRC Resident Inspector Illinois Department of Nuclear Safety r3040r.0419 830328 PDR ADOCK 05000461 A
Attachment to U- 0626
~
3/28/83 Responses for Information Requested During the January 11-12, 1983 Meeting on the Self Test System at Clinton Power Station Item 1 Confirmation that the STS was installed and operational prior to the qualification testing of the NSPS cabinets (including seismic testing) and functioned properly following completion of these tests.
Response 1-The self-test system is comprised of highly reliable, commercially proven components.
Solid state logic elements and other components were purchased MIL grade to insure maximum reliability.
All boards were fully tested before being installed in the self-test system.
During NSPS panel qualification tests, the self-test system was exercised before and after the seismic tests and performed satisfactorily.
Item 2 Confirmation that interdivisional isolation between the STSs is provided by fully qualified one inch quartz optical isolation devices similar to those used throughout the NSP3.
Response 2 The isolation for self-test system signals between different safety divisions is the standard isolator housing which conducts light pulses across a 1-inch fire barrier through a quartz rod.
This housing was qualified as a part of the panel qualification tests and in addition, is undergoing special electrical tests to insure that any conceivable electrical failure on one side of the barrier cannot propagate to the other side.
Two general types of isolator cards are used to transmit and receive STS signals:
the standard logic level (12V) isolators which are also used for functional logic signals, and a high speed pair used for STS communication.
Qualification of the standard isolators was performed as a part of the NSPS qualification program and is addressed in the General Electric Company report DRF #H13-00190.
Qualification of the high speed isolators was performed to IEEE 323-1971, since they are not used in a~ safety design base application.
y 3
The' isolation between-STS and functional logic is'a resistor capacitor network-as described in11 tem #2, and pulse transfcrmers in the. analog trip modules - (ATM).and ' Load Driver modules.
These components are considered a part of.the functionalEcircuitry and iare-treated as such forJ gualification' purposes.
Item 3.
A description of how.the~ functional inputs (from the sensors) to the NSPS are blocked while the tests are being performad by the STS.
A~ detailed discussion (beyond_that of p7.2-22 of FSAR-Amendment 9) of why the functional inputs cannot-be blocked for longer that 1 msec should also be provided.
~ Response 3 With reference to the attached figure:
A positive test pulse will
- pass 'through C1 and IG causing the output of U4 to go low, the low going: pulse will pass through C2 and R4, bringing the enabling input:of,Ul-low while momentarily blocking the functional input.
.Meanwhile, the positive. pulse which-passes through R2 will enable U2 to pass'the test data bit from the test pattern register to the alternate input of the "OR" gate U3.
Timing within the STS system ensures that this test pulse does not exceed 1 ms in duration.
A separate timing circuit in each self-test, which is hard wired and runs from a different crystal clock from the normal self-test timing Jelements, is used to check ~the self-test timing.
Differences are reported as self-test-internalitest failures, and the self-test routine does not proceed.
The third-level of timing control of theLtest pulse is in the time constants of Cl-R2 and C2-R3 which will return the functional input to its normal state within a
.few ms,;even with the failure of_the other two timing controls.
-Item 4
~
The exact portion of the NSPS circuitry which will be response time tested by the STS should be defined.
A statement that the STS
~does not test the actual; response time of the NSPS circuitry, but will demonstrate.that the response time is less than a specific value (1 msec) should be provided.
Also, the applicant should indicate
'that the various tests performed by the STS overlap sufficiently such that-there remains no untested portion of NSPS circuitry.
Response 4 The Self Test System will test the response time of the NSPS functional logic from the' input of the analog trip modules to the output of the actuated device load driver.
The response time of this functional logic will be shown to be less than or equal to 1 ms each time that a test pattern is injected.
l.11 other control logic and logic not included in the above test will be tested by conventional response time testing means.
The total response time from the sensing element to the actuated device will be the sum of the individual response times plus 1 ms for the solid state logic.
Item 5 A list of each control room annunciator point associated with the STS, what actuates each of these, and confirmation that these annunciator points cannot be cleared until the detected fault has been removed.
Response 5 The 'STS Failure' annunciator, window 3H on the principle plant console (P680),-will be activated at any time that the Self Test System detects a failure in either itself or in the functional logic.
If the failure is in the functional logic, an additional annunciator window on P680 will be lighted which identifies the
-system (RPS, NSSSS, ADS, RHR, LPCS or RCIC) and the division or train in which the functional logic failure has been detected.
The annunciator will clear only after the Self Test System is reinitialized following replacement of the failed component.
Refer also to the response to Item 6 for some further detail.
Item 6 A brief discussion of how the STS performs a test on itself prior to starting the NSPS test sequence.
Response 6 The sequence of the self-testing of the STS is as follows:
When a self-test controller (STC) becomes master, it first tests itself before testing the safety circuitry.
It does this in two phases:
(a) A self-check phase which tests central processing unit (CPU) function, read-only memory (ROM), RAM and hardware counter / timer circuits; and (b) a self-test phase which tests the universal I/O ports and all other STC interface circuitry..
1
'If a problem is encountered-during self-check, the CPU is halted and no further test activity is undertaken by that division.
However, during this period, a timer in the division that has just previously served as master is timing out.
If the new master does not successfully pass self-check, the retiring master will log that fact in its error log and will activate the STC fault annunciator.
Thus, during this critical phase of the test of the tester, another STC is monitoring the process; in particular, an STC which has just validated its operability by having successfully tested its own division.
If a problem is_ encountered during self-test, card type and card location (bay, file, slot) is reported in-the division error log and an STC faulted annunciator is activated.
Item'?
Confirmation that a structured methodology program for development and testing of the STS such as V&V has been followed and that documentation of this program is available for audit by the staff.
Response 7 The software for the Nuclear System Protection System Self Test System was verified in accordance with General Electric Company's procedure EOP 42-6.00, " Independent Design Verification".
Independent Design Verification is the process of substantiating a design, whether hardware or software, to provide controlled, independent, documented confirmation that the design meets its requirements.
The Design Record File is available for audit upon request.
Item 8 A discussion of the role of the plant computer in the STS design and confirmation that successful STS operation does not in any way depend on the plant computer.
Response 8 The PMS BOP processor is used as an aid to the maintenance staff in more quickly identifying the locating the failure detected by the STS.
A diagnostic terminal is orovided on the PMS BOP processor which 'nables the technician to acquire the fault location informa-tion trom the Self Test System controllers.
The PMS BOP processor is not necessary to the proper functioning of the Self Test System.
The PMS is required to initialize the Self Test System following the detection and correction of a failure.
Item 9 A description of each STS test (including the portion of circuitry being tested) and how it is accomplished (e.g., current ramp versus current step when testing bi-stable operability /setpoints).
. Response 9 During plant operation, CPS-Draft-Technical Specifications require that the RPS and NS4 systems be operable per section 3.3.1 and 3.3.2.
To be operable, all required surveillance testing must be completed within the specified time frames as per section 4.0.3.
Surveillanca requirements for RPS are specified in section 4.3.1.1 through 4.3.1.3 and for NS4 are specified in 4.3.2.1 through 4.3.2.3.
These require-ments include:
a)
Channel Check b)
Channel Functional Test c)
Channel Calibration d)
Logic System Functional Test e)
Response Time Testing Channel Checks are typically performed on 12 and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> intervals.
Channel Checks generally are interdivisional comparisons made to assess channel behavior.. No active' testing is performed on a channel by the Channel Check.
The Self Test System can be used in its monitor / compare function to display all channels of the selected parameter side-by-side.
The channel check can be preformed without STS but would not permit side-by-side comparison because displays in up to four different cabinets would be used.
The Channel Functional Tests are typically performed on a monthly interval or prior to startup.
Channel Functional Tests generally will trip an associated Analog Trip Module or digital input device (i.e. position switches for Turbine Stop Valves...etc) and verify alarms and indications.
For RPS and NS4, this testing will not check 2/4 logic actuations, but will only test the " head end" logics up to (but not including) the 2/4 logics.
Thus a very small portion of RPS and NS4 logics are tested by the Channel Functional Test..,
Conventional testing procedures will be used to perform these tests.
The Self Test will determine that the analog trip module portion of the channel is operable.
Channel Calibration Tests are typically performed on an 18 month interval.
This test generally calibrates transmitters, pressure switches and Analog Trip Modules.
The Channel Calibration is not intended to be a functional test of RPS and NS4 logic since it's intent is to calibrate " head end" instrumentation.
The Self Test System will be used to augment conventional calibra-tion procedures.
It will be used to determine the trip setpoints of the analog trip modules using ramping current.
Logic System Functional Tests are typically performed on an 18 month interval.
These tests go beyond the Channel Checks, Channel Functional Tests and Channel Calibrations in that the Logic System Functional Test checks all components of a logic circuit.
Using the Self Test System, the solidstate functional logic will be tested automatically and continuously by inspecting test patterns of short duration and comparing the logic output with predefined results.
Intra and inter divisional logic paths which activate safety related devices are tested.
Control paths which do not interface with automatic actuation logic are not tested by the Self Test System and must be functionally checked by conventional means.
Response Time Tests are typically performed on an 18 month interval.
These tests require measuring the time interval from when the monitored parameter exceeds its trip setpoint at the channel sensor until de-energization of the Scram Pilot Valve Solenoids (for RPS) or isolation valves travel to their required position (for NS4).
These tests generally are performed in discrete sections (i.e. sensor tests and logic tests are performed independently).
The Self Test System will test the response time of the automatic functional logic by determining whether the correct output of the logic was received in less than 1 ms following injection of the test pattern.
Itpm 10 A discussion of how latching (seal in) circuits within the NSPS are tested by the STS.
Response 10 The Self Test System will not detect failures in the seal-in or latching circuits.
These circuits will be tested by conventional
>Pl testing methods. prior to the installation of thfs/e boards containing latching or seal-in circuits which ca'n not be checked out by manual tripping and resetting of the channel.
This testing approach is considered acceptable because the latching and scal-in circuits do not have off board connections which must be tested after the board is installed.
Item 11 STS test signals are capacitively coupled to the NSPS circuitry to block the NSPS functional inputs and to strobe test data through the NSPS circuits.
A discussion of the effect on NSPS and STS performance given the ft.ilure of either and both of these capacitors and the potential for a large number of undetected capacitor failures over a period of time for adversely affecting the NSPS or STS should be provided.
An indication of whether test plans exist or are being developed to test these capacitors should be provided.
Response 11 With reference to the figure attached to Response No. 3, failure of either Cl or C2 in the open mode will prevent a normal test sequence from being completed for that card, and the STS will report a card fault.
Failure of either capacitor in the shorted mode will not interfere with a normal STS sequence or the functional
- circuitry and is therefore not reported.
These capacitors provide a third level of timing control as discussed in Item 3, are checked in the card tests before installation, and could be checked during planned outages. L
1 e
e*9 y._
ya e
2 e
Il d gi E
k I E
r ig 3
s%
- h.
A B
aCm H
s-
. "Ey.; m.
- .e
..,,-l,.-
f:
- ,j*
- lfJ, 7
e c
n
- w g-s s,.
- y s?'-
g j., ' '
23
'g, b2 u
sd s2 O e4..
O y o.
'a-
..a
. ;.8 :,.
d
~
di:siids...-.sh J.> o e
e l
4
~e*
. Nheffh*D="_.. y.
y
.g' W4=[d.I s?g
- e'
~
C af,,;,p
,4 v ;g.ed, p,.
m,.,
j
-*e%
"/
4e g
- e..
l
~.
[
b
., l.
e 1**m,,
gs,l
.r-
'4h 3
e,y,g'.-,
~
~
l
- ,, f..
'E,'.
p
.. g;;;,:,;.k v.y y -9
. yerp
.,.b5; sg.c;;
7 i.,
g 9 4.- :
. r.. I N ~ 'a~.-*,.
~.
lf '.b. :
3 h-e
=.*
t 'g.
4, I
s e
~
"* ta',
\\'
--....n.
w 1
.s.
c, m ~-
y p, ;.
D h <-
Ea2 C
~
H-O 1
M T
A__ -
i g
9 VX01 yn 9*
g g-I,,,
$-gh g
N
{
f. ^
VA 01 e
w e
Mir
>e H<
t
~
l
.J SSWfH-y to E*
yg
- y
' ~ -
g e
8 A
l m
s 12 h
. I h,$.
i
\\
.