ML20081D383

Simulator Four Yr Test Rept for 950312

ML20081D383
Person / Time
Site:	Sequoyah
Issue date:	03/12/1995
From:	TENNESSEE VALLEY AUTHORITY
To:
Shared Package
ML20081D380	List: ML20081D377 ML20081D383
References
NUDOCS 9503200223
Download: ML20081D383 (16)

Text

- s .+=-m . ~ , _w . a e , n .aw.. . . , - ..n,., - . , ~ . . - . . ;.. , -.._ - .-, ---- ..-- --.. .. -. - -- - . .._

} .e -' - 4_

1 e

y b _

..i SEQUOYAH NUCLEAR PLANT SIMULATOR FOUR YEAR TEST REPORT MARCH 12,1995 a

l 9503200223 950313 PDR i

P ADOCK 05000327 PDR f

l

. Sequoyah Nuclear Plant Simulator Four Year Test Report Table of Contents 12P_iG Ei!fa I. Introduction 1 II. General Discussion 1 III. Description of Test Completed 1 A. Steady State Test i B. Drift Test 1 C. Transient Test 2 D. Procedures Test 2 E. Malfunction Test 2 F. Real Time Test 2 G. Simulator Fidelity 3 IV. Uncorrected Test Performance Deficiencies and Correction Schedule A. Steady State Test 3 B. Transient Test 3 C. Procedures Test 4 D. Malfunction Test 4 V. Description of Test Differences 4 VI. Simulator Test Schedule 4 Appendices Appendix A, Table 1 Critical Parameters Appendix A, Table 2 Non-Critical Parameters Appendix B Transient Test List Appendix C Procedure List and Test Schedule -(,

Appendix D Malfunction List and Test Schedule Appendix E Simulator Four Year Test Schedule Appendix F Simulator Exceptions Appendix G Simulator Limitations l

l l

}

i

Sequoyah Nuclear Plant Simulator Four Year Test Report I. Introduction Tids test report is required by 10CFR55.45(b)(5)(ii), to submit to the NRC every four years on the anniversary of the initial certification report any uncorrected performance test failures and to submit a schedule for the correction of such performance failures, if any. The four year date for certification is March 12,1995.

Initial Simulator test schedules were given in the certification submitted in March 1991 to the NRC. All test were completed as required by the ANSI 3.5-1985 and were performed each year as outlined in the initial proposed schedule. This report outlines the test methods and the unresohed test deficiencies for each.  ;

11. General Discussion Since the initial certification submittal, the SQN Simulator has been used nearly continuously for various training needs at Sequoyah. The simulator has been maintained based on ANSI-3.5 as well as additional selfimposed requirements. Modifications and tuning adjustments are routinely made as more plant data is available to maintain simulation models as close to the referenced plant as practical. The capacity to add plant modifications and enhance models was recently increased by changing computers.

In the winter of 1994/1995, the original Gould 32/97 computer which ran the computer modeling for the simulator was replaced with a smaller, more etlicient, and cost effective computer called a Mercury VA-2. The new computer utilizes the same models as the original computer, with only minor changes needed to make them run on the new platform. A full set of performance certification runs were pedormed on the new computer and were included as part of the four year certification test. The instructor station was also improved by making this interface much faster, j III. Description of Test Completed The following is a summary of the test completed on the SQN simulator over the past four years.

Test results are maintained in the Sequoyah Simulator Services Section near the plant simulator.

They will be maintained there per the requirements of 10CFR55.45(b)(5)(iii).

A. Steady State Test The steady state tests were performed on the simulator at three power levels each year. Plant critical and non-critical parameters (Appendix A) were compared to the simulator values at each.

The simulator value was obtained, compared with plant reference data, and error calculated automatically for both critical and non-critical parameters. The error was calculated based on i 2% of span for critical and .110% of span for non-critical parameters for each indhidual ,

instmment. Any parameter failing this test had a Problem Report written to correct the simulation calculation of the failed parameter. Plant data was collected for each of the mentioned power levels during plant startups for test purposes. Any uncorrected test deficiencies are listed in the Uncorrected Test Performance Deficiencies and Correction Schedule, section IV of this report.

B. Drin Test The drin test was performed each year for the past four years. The simulator was reset to 100%

power and data was collected for an hour for each of the critical parameters at a rate of two I

h w

samples per second. Plots were made with this data and checked for stability. A parameter would fail the test if it drifted beyond 12*4 of the ia_it.' value any time during the hour test. There were no test deficiencies found for simulator drift testing during this report period.

C. Transient Test The required ANS! 3.5 transient tests, listed in Appendix B, were performed in each of the past four years. Test results were compared to the initial cenification transients for comparison. Data was collected for each of the required parameters at a rate of two samples per second. These results were then plotted and compared with the previous year responses and the initial cenification transients. Problems identified were documented by the initiation of a Simulator Problem Report. Simulation model changes as a result of repaired simulator problems and plant modifications implemented on the simulator were taken into account for each transient run to ensure proper plant behavior. Problems were then resolved via the Problem Report process. There were no uncorrected test deficiencies from transient testing in this report period.

D. Procedures Test in each of the previous four years,25% of the procedure tests were performed. The 25% ,

represents the approximate amount of actual work time to perform the test. The following is a summary of the test performed:

Year 1 Plant start up procedures (General Operating Instructions)

Year 2 Plan shutdown procedures (General Operating Instructions)

Year 3 Emergency Operating Instructions (E's, FR's, ECA's)

Year 4 Abnormal Operating Instructions and Emergency Abnormal Procedures The tests used the latest revision of the actual SQN Unit I plant controlled procedures.

Supporting plant instructions were also used during plant stanup and shutdown such as System Operating Instructions. Problems encountered during the procedures test were documented on a Problem Report. See the Uncorrected Test Performance Deficiencies and Correction Schedule of this report in section IV.

E. Malfunction Test Approximately 25% of the certified malfunctions wre tested each year. The number ranged from 10 to 16 er b.c . The malfunction was inserted and checked against the Malfunction Cause and Effects. t , ertified malfunctions are malfunctions required by ANSI-3.5-1985. See Appendix D for SQt, simulator's certified malfunctions. Each malfunction tested was checked by verifying that an appropriate IC existed, simulator could be operated to a steady state condition, operators could take the same actions in the plant, the variable rate effects, and whether or not the malfunction could be removed from the simulation. Problems found in either the Malfunction Cause and Effects or the simulation of the malfunction were documented on a Problem Report.

There were no uncorrected test deficiencies from malfunction testing during this test period.

F. Real Time Test Real time tests were performed manually and is continually being performed automatically. Each transient test was checked by using a stop watch and comparing it with the computer clock for a manual check. However, the simulator uses a real time executive which continually monitors the execution of all simulation models. If a portion of a calculation does not finish in real time, the 2

l  !

L ..

l simulator will automatically halt. The real time test feature of the simulator runs condnuously.

l During the transient test, no real time failures occurred.

G. Simulator Fidelity l

As modifications are being initiated in the plant, the design changes are reviewed by the simulator staff for simulator impact and those that do are incorporated into the simulator. The ,

ANSI requirement that changes be detected within one year of the plant change and another year to modify the simulator has been fully met for changes that impact training. As an additional safety net, plant control room photographs are made of all simulated panels at the end of each .

refueling outage and compared with the simulator. Differences are then reconciled based on  !

training impact. The photographs help to capture any additional changes made to the plant that were not detected through the design change review process.

l Major differences in hardware and sonware fidelity that will remain and are not planned to be i corrected are tracked as Exception Reports. The initial certification identified eleven Exceptions.

During the past four years, three exceptions were closed and three additional ones initiated. See Appendix F for the current list of Simulator Exceptions.

The Sequoyah Simulator imposes four limits of simulation. Since the exact response of the plant would be unknown beyond these limits, the simulation is stopped automatically and the simulator y is " frozen". This protects the students from negative training. The limits are listed in Appendix G.

IV. Uncorrected Test Performance Deficiencies and Correction Schedule i

i The following is a summary of the uncorrected performance test deficiencies encountered during simulator certification testing over the last four years.

A. Steady State Test Deficiencies:

PR-1675 SQN U-l S/G steam flow, feedwater flow, and steam pressures were outside the acceptance criteria between 0.1 to 3% on different steam generators at various power levels on the simulator. This is scheduled to be resolved by 3/1/96.

PR-2101 Simulator S/G WR levels were outside the acceptance criteria by less than 1%

at one power level. This planned to be corrected by 10/1/95 j B. Transient Testing Deficiencies:

l There are no uncorrected performance deficiencies for transient tests.

l l

l l

l l

3

C. Procedures Test Deficiencies:

PR-1370 Indications of superheated conditions in the reactor core following a LOCA.

were incorrect. This is scheduled for correction by 10/1/95.'

PR 1786 IIcat up of the RCS following a ATWS event does not appear to be severe enough. This is scheduled to be corrected by 4/1/96.

SDCR-5604 Install fire alarm on the simulator. This will be done by 4/1/96.

D. Malfunction Test Deficiencies ,

There were no uncorre:ted malfunction test deficiencies.

V. Description of Test Differences For the next four years all test will be performed in the same manner as the previous four. There will be minor changes made to the parameters collected. They are summarized below.

The critical and non-critical parameter list will be modified as shown in Appendix A. The only difference as compared to the initial certification is that Loop Delta Temperatures were moved from Non-critical to Critical parameter list. Containment pressure, calculated core power (from process computer), and Intermediate Range indications were added to the critical parameter list.

These changes were made after reevaluating the various parameters and determining that they more accurately fit the definition of a critical parameter. All of the other original parameters will be maintained.

1 VI. Simulator Test Schedule The next four year test schedule is shown in Appendix E. Anmaal Test Periods 1 through 4 are  ;

i for years 1996 through 1999 which comprise the next four year simulator certification cycle.

Appendix C lists the procedures to be tested for each year. Appendix D lists the malfunctions to be tested for each year. All Steady State, Drift, Transient, and Real Time Test will be performed each y .ar.

i i

4 l

l

'iW 6 ..  ;

(

~

-3 Appendix-A (Page 1 of'3)

CRITICAL PARAMETERS - '{

TABLE 1  ;

Instrument

. Number  : Parameter : Description

^

EI-57-16A -Unit Generator Gross MW ,

TR-68-2 BP01 .RC Tref  :

LR-68-339 Pressurizer l' Level l PI-68-340A Pressurizer 1 Pressure ]

f .FI-68-6A_ .RCL1 1 Flow.

I FI-68-29A RCL2 1 Flow

=FI-68-48A .RCL3 1 Flow-  ;

FI-68-71A RCL4 1 Flow LI-3-42 Stm Gen 1 Nar Rng Level ,

LI-3-55 Stm Gen 2 Nar Rng Level LI-3-97 Stm Gen 3 Nar Rng Level l LI-3-110 Stm Gen 4 Nar Rng Level j SC-CBDG-162 Centrol Bank D Rod Position i FI-3-35A Stm Gen 1 Feed Wtr In Flow 1l FI-3-48A Stm Gen 2 Feed Wtr In Flow li FI-3-90A Stm Gen 3 Feed Wtr In Flow FI-3-103A Stm Gen 4. Feed Wtr In Flow l FI-1-3 Stm Gen 1 Stm Out Flow ,

FI-1-10 Stm Gen 2 Stm'Out Flow I FI-1-21 Stm Gen 3 Stm Out Flow '!

i FI-1-28' Stm Gen 4 Stm Out Flow -t NI-41B Pwr Rng Channel 1 (Quad 4)  ;

NI-42B Pwr Rng Channel 2 (Quad 2) ]

NI-43B Pwr Rng Channel 3 (Quad 1)  ;

NI-44B Pwr Rng Channel 4 (Quad 3)  ;

RCS HL Loop 1 Wide Range Temperature I TI-68-1 TI-68-24 RCS HL Loop 2 Wide Range Temperature TI-68-43 RCS HL Loop 3 Wide Range Temperature TI-68-65 RCS HL Loop 4 Wide Range Temperature

. TI-68-18 RCS CL Loop 1 Wide Range Temperature TI-68-41 RCS CL Loop 2 Wide Range Temperature

{

TI-68-60 RCS CL. Loop 3 Wide nange Temperature TI-68-83 RCS CL Loop 4 Wide Range Temperature PI-62-92A Charging Pump Discharge Header Pressure f PI-1-2A Stm Gen 1 Stm Out 1 P PI-1-9A Stm Gen 2 Stm Out 1 P PI-1-20A Stm Gen 3 Stm Out'l P PI-1-27A Stm Gen 4 Stm Out 1 P PI-1-33 Stm Line Hdr P PI-3-34 Feedwater Htra 1 Outlet HdrP TI-68-2BPO2 RCL Highest T-Avg. (Auctioneered)

PDI-30-42 Containment Pressure Channel IV TI-68-2D RCS Loop 1 Delta T TI-68-25D _RCS Loop 2 Delta T TI-68-44D RCS Loop 3 Delta T TI 67 D RCS Loop 4 Delta T U1118 Reactor Thermal Power Calculated Intermediate Range j NI-35 i l

i I

Pm

. Appendix A (Page 2 of 3)

~

NON-CRITICAL PARAMETERS TABLE 2 Instrument Number Parameter Description PI-70-24 CCS HX A In Press FI-62-93 Chrg Edr Flow FI-62-82 Let Down Flow Indicator EI-57-96/1 125VDC Vital Battery Board I Voltage EI-57-96/2 125VDC Vital Battery Board II Voltage EI-57-96/3 125VDC Vital Battery Board III Voltage EI-57-96/4 125VDC Vital Battery Board IV Voltage EI-57-99 250VDC Battery Board Voltage EI-57-29 480V S/D BD 1Al-A Voltage EI-57-30 480V S/D BD 1A2-A Voltage EI-57-83 480V S/D BD 1B1-B Voltage EI-57-84 480V S/D BD 1B2-B Voltage EI-57-39 6.9 kV SD-BD LA-A Voltage EI-57-66 6.9 kV SD-BD 1B-B Voltage EI-57-18 500 kV Bus Voltage i LI-68-367 Reac Lvl Wide Range LI-68-368 Reac Lvl Narrow Range LI-68-369 Reae Lvl Plenum l I

FI-67-61 ERCW Supply Header A Flow FI-67-62 ERCW Supply Header B Flow TI-68-2E RCS Loop 1 T-Avg TI-68-25E RCS Loop 2 T-Avg TI-68-44E RCE Loop 3 T-Avg TI-68-67E RCS Loop 4 T-Avg TI-68-2A RCS Loop 1 Overpwr Delta-T i TI-68-25A RCS Loop 2 Overpwr Delta-T ,

TI-68-44A RCS Loop 3 Overpwr Delta-T j TI-68-67A RCS Loop 4 Overpwr Delta-T l TI-68-2B RCS Loop 1 Overtemp Delta-T l TI-68-25B RCS Loop 2 overtemp Delta-T ]

TI-68-44B RCS Loop 3 Overtemp Delta-T TI-68-67B RCS Loop 4 Overtemp Delta-T l LI-63-129 SIS Accum Tk 1 Level LI-63-109 SIS Accum Tk 2 Level LI-63-89 SIS Accum Tk 3 Level I

LI-63-82 SIS Accwm Tk 4 Level LI-63-50 SIS RWST Level Ind PI-63-108 SIS Accum Tk 2 Press PI-63-128 SIS Accum Tk 1 Press PI-63-88 SIS Accum Tk 3 Press PI-63-62 SIS Accum Tk 4 Press

, . - . . . 2 _ . . -

!' +

a

• i Appendix'A (Page 3 of 3)

~

NON-CRITICAL PARAMETERS TABLE 2 Instrument l Number Parameter Description LI-68-300- -RCS PRT Level , -1 LI-3-43 cm Gen #1 Wide Rng Lvl Ind LI-3-56 Sum Gen #2 Wide Rng.Lvl Ind J

LI-3-98 Stm Gen #3 Wide Rng Lvl Ind-LI-3-111 Stm Gen #4 Wide Rng Lvl Ind PI-68-301 RCS PRT Press .;

TI-68-309 RCS PRT Temp l}

EI-57-15 Generator Volts  ;

EI-57-8 Generator Megavar PI-3-1. EW Header Pressure l l

)

4

)

e 5

s a

i I

f a

f

?

I s

p; j

.]

APPENDIX B TRANSIENT TEST LIST ,

Transient No. Description 4

1. Manual Reactor Trip

2. SimultaneousTrip of allFW pumps Simultaneous Closure of all MSIVs  !

3.

i

4. Simultaneous trip of allRCPs S. Trip of any single RCP. ,

6. Main turbine trip at Max Power that does not result in reactor trip. (<P-9)

F

7. Maximum power ramp (100% to 75% then back up -

to 100%.

8. Maximum size reactor coolant system rupture combined with loss of all offsite power.

9. Maximum size un-isolable main steam line rupture.

10. Slow primary system depressurization to saturated condition using pressurizer relief or safety valve stuck open with no high head injection.

b 6

L i

L

. . . ~ _ . . .

.c l

-~

l

. . t

.- ' APPENDIX C .j t

r PROCEDURE LIST AND TEST SCHEDULE .

i i

Annual ~

Test j Penod Procedure Name.Tvoc. or Process

1. Plant start up from cold iron to 100% power using General Operating Instructions (GOls).  :

t I

Plant shutdown from 100% power using General Operating Instructions (GOIs). l 2.

l

3. Emergency instructions, including the Functional Restoration Guidelines, and the '

Emergency Contingency Actions.(E's, FRs, and ECA's) i

4. Abnormal Operating Instructions and Emergency Abnormal Procedures) (AOls and EAPs). -

Please note that a detailed list is not given since procedure numbers do change. The Schedule above shows which set of procedures will be performed during a particular test year.' l 5

i i

w f

C . .

l

. APPENDIX D (Page 1 of 2)

" MALFUNCTION LIST AND TEST SCHEDULE Baseline Data Source Malfunction Cause and Effects Annual ANS 3.5 Test Item Malf Section 3.1.2 Period No. Malfunction Definition Name Reference 1 1 VCT Level Transmitter Fails Hi CV09 3.1.2(18) 2 Steam Generator Tube Leak THOS 3.1.2(la) 3 Letdown Line Break Inside Auxiliary CV04 3.1. 2 (1b) i Building 4 LOCA Small Leak TH03 3.1.2 (Ic) 5 Pressurizer Safety Failure TH04 3.1.2(1d) 6 Stuck Rod RD13 3.1.2(12) ,

7 Loss of non-essential control air IA02 3.1. 2 (2 )

8 Total Loss of Offsite Power ED01 3.1.2(3) 9 Loss of 6.9kv Shutdown Board ED06 3.1.2(3) 10 Loss of 480v Shutdown ED08 3.1.2(3) ,

2 1 Loss of 250 vde Batt Bd ED15 3.1.2(3) 2 RCP Locked Rotor RC01 3.1. 2 ( 4 )

3 RCCA Misalignment RDOS 3.1.2(12) 4 RCW Pump Trip RWO2 3.1.2(6) 5 Loss of cooling to MFP oil coolers RWO7 3.1.2(6) 6 RHR Loop Suction Line Blockage RH04 3.1. 2 (7 )

7 Reactor Trip Signal Failure RP01 3.1.2(24) 8 Component Cooling Pipe Break Inside CC04 3.1. 2 ( 8 )

Containment 9 Condercate Booster Pump Trip CN02 3.1.2(9) 10 Main Steam Line Break Inside MS01 3.1.2(20)

Containment i 11 Loss of All Feedwater 3.1.2(10)

• Trip of Turbine MFWP FWOS

• Trip of AFVP FWO7 l l

i l

l I

l l

l 1

~

APPENDIX D-(Page 2 of 2)

MALFUNCTION LIST AND TEST SCHEDULE 4

Baseline Data Source ~ Malfunction Cause and Effects Annual --

ANS 3.5 Test' Item '

Malf . Section'3.1.2 Period No. Malfunction Definition ' Name Reference 3 1 LOCA Hot. Leg TH01 3.1.2 (1C) .

2l Main Turbine Hi Vibes- TUO2 3.1.2(15) 3 Main Generator Trip EG01 3.1.2(16) 4 Loss of 120 VAC Inverter ED10 3.1. 2 (3,11),

5 .T-avg. Control Signal Fails RX18 3.1.2(17) 6 .Pzr pressure Transmitter Fails Hi RXO7 3.1.1(18) 7 .RHR Pump Trip. RH01 3.1. 2 (7 )-

-8

~

False Auto Reactor Trip Signal RP05 3.1.2(19) 9 Main Steam Line Break Outside MS02 3.1.2(20)

Containment 10 Main Feedwater Line Break Inside EW23 3.1.2(20)

Containment 11 Dropped Rod RD07 3.1.2(12) 4 1 Loss of 125 VDC Vital Bus ED12 3.1. 2 (3) 2 PR Channel Output Signal Failure NIO7 3.1.2(21) 3 #1~Feedwater Heater Level Control HD12 3.1.2(22)

Fails Lo 4 Loss of Vacuum- CN09 3.1. 2 (5) 5 Charging Flow Control Problem,Pzr CV15 3.1.2(22) lvl Swing 6 Auto SI Initiation Signal Failure RP02 3.1.2(23) 7 Loss of Esseatial Control Air IA03 3.1. 2 (2 )

B Rods Fail to Move on Demand RD08 3.1.2(13) 9 Fuel Cladding Failure THR02 3.1.2(14) ,

10 Main reedwater Line Break outside FW20= 3.1.2(20) '

Containment 11 IR Channel Failure NIO4 3.1.2(21) .j 12 Charging Pumps Trip CV01 3.1.2(18) ll 13 Letdown Relief Valve Fails62-662 CV16 3.1.2(22) .l 14 Failure of Pressurizer PORV RC05 3.1. 2 (1D)  !

15 Loss of Emergency Generators EG02 3.1.2(3) f 16 Loss of Condenser Level Control CN23 3.1.2(5) 'j CN29.  !

.I i

I l

y* e- xa-w- ' , 'sm , m - * - - '&-=- =t

g. _-

l

. APPENDIX E ,

SIMULATOR FOUR YEAR TEST SCHEDULE - ,

Plaimed Start AnnualTest Period Test Name  !

'f 1 Simulator Steady State Test 12/1/95 i Normal / Abnormal Operating instructions (Plant Startup) . _9/1/95 j Simulator Transient / Realtime Test 10/1/95  ?

Simulator Malfunction Test '11/1/95 e i

2. Simulator Steady State Test 12/1/96 i Normal /Abnonnal Operating instructions (Plant Shutdown) 9/1/96 Simulator Transient Test /Real Time Test 10/1/96 Simulator Malfunction Test - 11/1/96 >

3 Simulator Steady StateTest 12/1/97 .;

Normal / Abnormal Operating instructions (Emergency) 9/1/97 .l Simulator Transient Test /Real Time Test 10/1/97 Simulator Malfunction Test 11/1/97 i 4 Simulator Steady State Test 12/1/98 l Normal / Abnormal Operating Instructions (Abnormal) .9/1/98 l Simulator Transient Test /Real Time Test 10/1/98 -:

Simulator Malfunction Test 11/1/98  ;

4 1

i f

)

.I k

I a

i

'I

)

i I

l l

anA APPENDIX F SIMULATOR EXCEPTIONS Exception Open Close Number Date Date Exception Description 1 3/1/91 No camera equipment is installed on the top of the main control room pancis at the plant.

2 3/4/91 The simulator has a high ceiling, mercury vapor lights, and cannot simulate the loss of AC powered lights nor is DC standby lighting available.

3 3/4/91 Electrical power distribution cabinet M-7 is not simulated. Remote functions are available for the functions of this cabinet.

4 3/4/91 Panel M-8 is not fully simulated. The rod coil lift disconnect switches are simulated, but the turbine supenisory power drawers are not.

5 3/4/91 7/9/92 Closed 6 3/4/91 Annunciator input panels in the plant, M-21 and 22 are not simulated on the simulator.

7 3/4/91 Control Room panel M-25 is not simulated.

8 3/4/91 Panel M-28A is closer to the horseshoe on the simulator.

9 3/4/91 Electrical Control Board for switchyards is partially simulated.

10 3/4/91 7/9/92 Closed 11 3/4/91 2/23/95 Closed l 1

12 7/21/92 Control Room panel M-31 is not fully simulated.

13 7/31/92 Plant process computer is not fully simulated.

14 11/10/94 Unit 2 procedures cannot be used on the simulator. The simulator is a Unit I simulator, used for training on both units.

APPENDIX G SIMULATOR LIMITATIONS The following simulator limitations have been imposed to prevent training from occurring when the simulator is -

operating beyond the planned scope of simulation.

1. Containment pressure exceeds the design limit.

2. Fuel clad temperature exceeds clad melt point.

3. Turbine extraction lines flooded.

4. Turbine shaft seized.

If any above limit is reached, the simulator will freeze and the instructor station will display a " SIMULATOR OUT OF BOUNDS" popup explaining the limit.