ML20084P592

Forwards Addl Info Re Safety Parameter Display Sys Safety Analysis & Implementation Plan,Per 840404 Request.Basis for Selection of Safety Functions Will Be Documented Per Suppl 1 to NUREG-0737

ML20084P592
Person / Time
Site:	Farley
Issue date:	05/11/1984
From:	Mcdonald R ALABAMA POWER CO.
To:	Varga S NRC
References
RTR-NUREG-0737, RTR-NUREG-737 NUDOCS 8405180274
Download: ML20084P592 (10)

Text

'

f Mailing Address AlJ.bama Power Comp:ny

.. , 600 North 18th Street Post Offica Box 2641 Birmingham, Alabama 35291 Telephone 205 783-6090 R. P. Mcdonald Senior Vice President.

exxamaxanaxen AlabamaPbwer Flintridge Building May 11, 1984 Docket Nos. 50-348 50-364 Director, Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D.C. 20555 Attention: Mr. S. A. Varga Joseph M. Farley Nuclear Plant - Units 1 and 2 Safety Parameter Display System (SPDS)

Safety Analysis and Implementation Plan

. Gentlemen:

By letter dated April 4,1984 the NRC Staff provided comments on the Alabama Power Company SPDS Safety Analysis and Implementation Plan and requested additional information related to the Farley Nuclear Plant SPDS.

This information is provided as an attachment to this letter.

If there are any questions, please advise.

Yours very tr

< /

Wg R. . Mcdonald RPH/JLO:ddr-D8 Attachment cc: Mr. L. B. Long Mr. J. P. O'Reilly Mr. E. A. Reeves Mr. W. H. Bradford 0\

8405180274 940511 '\,

PDR ADOCK 05000340 i F PDR

Attachment Additional SPDS Information Requested by MRC Staff NRC Request:

Provide information on the proposed method of data validation.

APCo Response:

A redundant sensor algorithm will be used to validate data input to the Farley SPDS. The purpose of this algorithm is to process redundant sensor inputs and, when possible, to return a group value for the valid sensor input signals for use in the critical safety function status tree displays.

Valid signals are selected by eliminating values which originate from known bad input points (i.e., identified by either automatic hardware checking or by operator input), values which are removed from scan and are not periodically updated, and those values which have previously failed sensor consistency checking. The remaining signals are examined for consistency within a predetermined tolerance. If no more than one of these signals fail to fall within a predetermined tolerance, the average value of those signals within the tolerance will be used to represent the group value. The sensor signal outside the tolerance will be given a data quality rating of " poor" and will not be considered in the group calculation until the value returns to within the predetermined tolerance. In the case where only a single sensor value is presented to the consistency checking routine, that sensor value will be used for the group value. If no sensor signals are propagated to the consistency check, or if more than one of the signals reaching that check do not pass the tolerance test, then no value will be assigned to the group value, and the group value will be given a data quality rating of

" bad".

NRC Request:

Provide a description of the human factors program and results; i .e., SPDS design characteristics that will be incorporated into the design so that displayed information can be readily perceived and comprehended, and is not misleading to SPDS users.

l APCo Response:

Human factors criteria will be incorporated into the design of the Farley SPDS with respect to the critical safety function status trees to ensure that a user can adequately understand the status of the critical safety functions and the priority of the emergency response procedures indicated on

Attachment Additional SPDS Information Requested by the NRC Staff Page 2 the status trees. Human factors concerns related to an operator's use of the status trees and their effect on plant operations will be considered in the SPDS design process.- These criteria and considerations will be reflected in the design basis and functional requirement documents that are

used as initial inputs to the SPDS hardware and software development, and will be incorporated into the design of the displays and controls for the system. In addition, human engineering principles on good display design

- and control layout will be incorporated into the design pro. cess. Proper application of human engineering principles enhances a user's comprehension of. the data presented by the SPDS in support of the critical safety function use.- A human factors review of the completed design will be performed to ensure that all the human factors concerns identified throughout the design are manifested in the final product.

Human . factors consulting for the facets of the design process discussed herein will be provided by the Human Sciences Department of the Westinghouse

Research and Development Center. The human factors review of the Farley SPDS will be accomplished by the resolution of two sets of issues. The first set of issues involves ensuring that the needs of the operator as defined in the design basis and functional requirement documents are addressed in the SPDS design. These needs are the ones necessary for the operator to use the Westinghouse Owners Group (WOG) Critical Safety Function Status Trees. The second set of issues involves the human engineering

~

!' ~ adequacy of implementation techniques used to satisfy the above mentioned needs. Where applicable, criteria from NUREG-0835 will be used as a reference for good display' design. For aspects of the design where

~ NUREG-0835 does not apply or is incoiaplete, other sources of human engineering criteria will be consulted to obtain the basis for' design decisions. Based on the human factors review, a report discussing the

aspects of the design critical to human factors, how these aspects were

. implemented, and a human factors basis for such implementation will be written.

Additionally, Alabama Power Company will utilize the Human Factors Specialist contracted for the Control Room Design Review (CRDR)'to perform an independent human factors review of the SPDS design basis and functional requirements. This independent review will be based on the NUTAC for CRDR document " Human Engineering Principles for Control Room Design Review" and

, ' will enhance the.SPDS human factors program and facilitate the integration of the SPDS with the.CRDR.

Alabama Power Company will provide tha NRC Staff with a description of the human factors review results for the Farley SPDS design that will identify the criteria incorporated into the SPDS design to ensure that the displayed information is readily perceived, is easily comprehended and is not misleading to SPDS users. As stated in Alabama Power Company letter dated April 19,1984,' a supplement ~to the SPDS schedule will be provided in

. November 1984. This supplement will identify a submittal date for the human factors review results.

c- .

m .

r Attactment Additional SPDS Information Requested by the NRC Staff Page 3 NRC Request:  !

Provide information on the proposed method of isolation from safety systems ,

including:

a. For'each type of device used to accomplish electrical isolation at  :

Farley 1 and 2, describe the specific testing performed to '

demonstrate that the device is acceptable for its application (s).

'This description should include elementary diagrams where necessary '

to indicate the test configuration and how the maximum credible faults were applied to the devices. .

APCo Response: ,

With the exception of the inputs from the core exit thermocouple monitoring l system, all analog IE to non-IE signal isolation for the SPDS parameter -

inputs will be accomplished using Westinghouse 7300 series process cabinet isolators. Tests have been conducted on the Westinghouse 7300 Series Process Control System (PCS) to demonstrate the isolation of the system to credible faults and noise postulated to occur in non-IE systems deriving signals from the 7300 system. These tests were described in a report ,

entitled " Westinghouse 7300 Series Process Control System Noise Tests" '

subsequently issued as WCA3-8892-A. In a letter from R. L. Tedesco to C. +

Eiche1dinger dated April 20, 1977, the NRC accepted this report. ,

WCAP-8892-A is also referenced in section 7.2 of the Farley Nuclear Plant -

Units 1 and 2 FSAR. A description of the specific testing performed is provided below.

A. Pre-Tests A pre-test was performed to determine the input voltage normally  ;

required to trip each of six bistable comparators.

The pre-test information was recorded so that it could be used for comparison against the trip input voltages required when the system was subjected to the various fault conditions.

i t

B. Phase I Tests The 7300 PCS was subjected to a series of non-destructive tests. These tests were performed to demonstrate that a credible perturbation or fault in the control wiring (isolator output) would not degrade .

rotective action, nor be reflected back into the protection wiring p(isolator input). The Phase I tests performed were as follows:

I _ __. --

Attachment Additional SPDS Information Requested by the NRC Staff Page 4

1) Static Noise Test These tests were conducted to simulate the effects on instrumentation circuits due to capacitive coupling. Selected test voltages were 118 vac, 550 vac,120 ydc and 250 ydc. This provided margin over the maximum credible voltages (faults) which are expected to be 118 vac and 115 vde for the 7300 PCS. These voltages were applied to the disconnected output cables of selected isolators. The isolator output wiring was disconnected from the isolator terminals prior to the test but all other system wiring remained in place. For each fault applied, the pre-test procedure was repeated to determine the effects on the input voltage required to trip each bistable.

2) Magnetic Noise Test e

These tests were conducted by disconnecting the selected isolator output cables from the isolator output terminals, connecting a 100 ohm load across the output terminals, and connecting a 118 vac power source across the 100 ohm load. This resulted in a current in excess of one ampere between the isolator output terminals. In each case the pre-test procedure was repeated to determine the effects on the input voltage required to trip each bistable.

3) Cross Talk Noise Test With all instrumentation in place and the isolator output wiring disconnected from the isolator output tenninals, a relay with a 120 ydc coil was connected to the isolator output wiring and randomly switched on and off. During this operation, the pre-test procedure was repeated to determine the effects on the input voltage required to trip each bistable. This test was repeated using a relay with a 118 vac coil instead of a 120 ydc coil.

4) 5 KV Antenna Test With all instrumentation in place, an antenna from a 5 KV source was strapped adjacent to a selected isolator output cable for a distance of 40 feet. This antenna was also in close proximity to the protection (isolator input) wiring since the control (isolator output) wiring and protection wiring are bundled together for about 20 feet. The pre-test procedure was repeated to determine the effects on the input voltage required to trip each bistable. This test was repeated with the antenna strapped adjacent to the control wiring only.

i t

Attac M nt Additional SPDS Information Requested by the NRC Staff Page 5-5). Random Noise Test '

I This' test was performed using the same procedure described for the 5 KV test except that the 5 KV source was replaced with a random noise source. The random noise was created by an R-C network

- producing a ringing-type noise.

'6) MIL-N-19900B Test ll

' With all instrumentation in place, a 40-foot antenna was placed in  !

contact with the control (isolator output) cable of a selected isol ator. As specified in MIL-N-19900B, two noise sources were i used to energize this antenna. During each operation the pre-test I procedure was repeated to detennine the effects on the input j voltage required to trip each bistable. j i

7) Miscellaneous Tests A series of tests were performed using spare conductors in the  !

control prefabricated cables. A test fault of 580 vac was used, l first with 580 vac constantly applied and then with 580 vac randomly switched on and off. The pre-test procedure was repeated ,

during.each fault mode to determine the effects on the input i voltage required to trip each bistable. l t

~

C. -Phase II Tests .

Th'e 7300 PCS.was also subjected to a series of tests which resulted in i destruction of selected devices. These tests were performed to demonstrate that the fault is not propagated through the isolator and  ;

also that perturbations from the fault were not picked up on the ~

protection wiring -(isolator input) so as to degrade protective action. [

. i The-Phase II tests were performed on selected devices in the following i manner. . . With all instrument wiring in place, the. fault was applied to  :

is the output of the isolator or other device that was subject to the  !

l Ltest. .The test voltages (faults) applied varied from 118 vac to 580 l

[

- vac and from 125 vdc to 250 ydc. During the time each fault was L applied to the selected device, the pre-test procedure was repeated to .

L determine the effects on the input voltage required to trip each bistable.

h

-. i h

l i t

r b I

s  ;

~

~

--e - , . , ---nrr-+

. -w- -

-e -.--e.v.c , ---,w- , - , , , ,e - , . s- ,,a - --n, -

nv- -,,v., - , ee- w

Attachment Additional SPDS Information Requested by the NRC Staff Page 6 The devices selected for these Phase II tests were as follows:

- comparator with triac output,

- comparator with relay output,

- power supply with isolated output, >

- voltage to current isolator,

- voltage to voltage isolator,

- cabinet power supply failure detection circuit, and .

- computer input pad.

The core exit thermocouple monitoring system will be modified to provide a *

-qualified isolator for each thermocouple loop as described in Alabama Power Company's R.G.1.97 Compliance Reports. The Unit 2 Compliance Report was  :

submitted to the NRC on March 30, 1984 and the Unit 1 Compliance Report is -

scheduled for submittal in June 1984. The SPDS will be connected to the output of these isolators. The NRC Staff information requirements  !

pertaining to isolation from safety systems will be addressed during the engineering design effort for the core exit thermocouple monitoring system  ;

and whenever analog parameters are added to the SPDS which do not utilize Westinghouse 7300 process cabinet isolators.  !

NRC Request:

b. Provide data to verify that the maximum credible faults applied during the test were the maximum voltage / current to which the device could be exposed, and define how the maximum voltage / current was determined.

APCo Response:

'The voltages and test models were selected to cover all expected credible ,

i voltages and noise conditions. The basis for the maximum voltage / current >

used is provide in WCAP-8892-A Section B, VI and Appendices A and B.

L Section A.11 and its references also provides additional background material L concerning the basis for the tests and NRC acceptance of the test methods.

NRC Request:

c. Provide data to verify that the maximum credible fault was applied to the output of the device in the transverse mode (between signal and return) and other faults were considered (i.e., open and short circuits) .

Attachment Additional SPDS Informtion Requested by the NRC Staff Page 7 APCo Response:

Data for the 7300 process control system tests to verify that the maximum credible fault was applied to the output of the device in the transverse mode (between signal and return) and that other faults were considered (i.e., open and short circuits) is provided in the Appendices G through DD-to WCAP-8892-A.

NRC Request:

d. Define the pass / fail acceptance criteria for each type of device.

APCo Response:

The acceptance criteria for all tests were as follows:

A. The fault should not prevent required protective action, and B. Spurious protective action caused by the fault should be acceptable.

The test report and data sheets verify that protective action was not

-degraded by any of the Phase I or Phase II faults.

NRC Request:

e. Provide a commitment that the measures taken to protect the safety systems from electrical interference (i.e., Electrostatic Coupling, EMI, Comon Mode and Crosstalk) that may be generated by the SPDS.

APCo Response:

The Phase I tests described above in response to item a. and in WCAP-8892-A address electrical interference that may be generated by the SPDS.

NRC Request l

Provide conclusions regarding unreviewed safety questions or changes to technical specifications.

o -

Attachment Additional SPDS Information Requested by the NRC Page 8 APCo Response Conclusions regarding unreviewed safety questions or changes to the technical specifications are not possible at this time. It is anticipated, however, that SPDS implementation will not result in an unreviewed safety question or involve a technical specification change. Prior to implementation of the SPDS system, a final determination will be made with respect to any unreviewed safety questions in accordance with current procedures. Alabama Power Company's Plant Operations Review Committee and Nuclear Operations Review Board will review the SPDS safety evaluations in accordance with Farley Nuclear Plant Technical Specifications. Alabama Power Company does not plan to request NRC pre-review of the SPDS design.

NRC Request Provide a proposed schedule for design, development, installation, and full I implementation, including hardware, software, training, procedures / operator manual s.  ;

APCo Response By letter dated April 6,1984 an updated implementation schedule was submitted to the NRC. As stated in Alabama Power Company letter dated April ,

19, 1984, a supplemental submittal will be provided in November 1984. ,

NRC Request The Safety Analysis should contain a listing of the critical safety functions, an identification of SPDS parameters used to satisfy each critical safety function, and a discussion of how each parameter satisfies the functional requirement.

APCo Response Alabama Power Company will provide additional information related to the SPDS Safety Analysis for Farley, Units 1 and 2. The submittal date for this Safety Analysis will be identified in the November 1984 supplement. This information will contain a listing of the Farley critical safety functions, an identification of SPDS parameters used to satisfy each function, and a discussion of how each parameter and setpoint satisfies its critical safety ,

functional requirement. The basis for the selection of the Farley critical safety functions and the relationships of these functions to the. functional criteria in.NUREG-0737, Supplemeat 1 will also be provided.

7.

Attachment Additional SPDS Information Requested by the NRC Staff Page 9 This information will be provided in two sections. The first section will describe the development of the Farley critical safety functions beginning with the plant barriers to radioactivity release. The second section will provide the basis for each status tree which corresponds to a critical safety function. A listing of parameters and a discussion of each decision point on its tree will be included.

Generic information on the critical safety functions and status trees can be found in the background documents for the Westinghouse Owners Group Emergency Response Guideline Program, Revision 1, which have been submitted to the NRC.

4 4

6 s#

i

- ~ , - ,, ---r , e - , - , g n,w. ---