ML20093G838

Responds to 840817 Request for Addl Info Re Safety Parameter Display Sys

ML20093G838
Person / Time
Site:	Clinton
Issue date:	10/02/1984
From:	Spangenberg F ILLINOIS POWER CO.
To:	Schwencer A Office of Nuclear Reactor Regulation
References
L30-84(10-02)L, L30-84(10-2)L, U-0745, U-745, NUDOCS 8410160055
Download: ML20093G838 (23)

Text

,

o

, ' j? .

1, U-0745

. 1A.120

' L30-84 (10-02)L JLLINDIS POWER COMPANY IP ' CLINTON POWER STATION. P.O. BOX 678. CLINTON ILLINOIS 61727 October 2, 198/

Docket No. 50-461 Director of-Nuclear Reactor Regulation Attention: Mr. A. Schwencer, Chief Licensing Branch No. 2 Division of Licensing U. S. Nuclear Regulatory Commission Washington, D.C. 20555

Subject:

Clinton Power Station Unit 1 Request for Additional Information Concerning the Safety Parameter Display System for Clinton' Power Station

Dear.Mr. Schwencer:

Your letter of August 17, 1984 requested additional information on the Clinton Safety Parameter Display System (SPDS). Attached is the

-supplemental information requested. We believe that this information will be responsive to your specific concerns on this issue.

Please contact us if you have any questions concerning the attached

information.

Sincerely yours, e.A o 5 j F. A.  ; pang iberg Director - Nuclear Licensing and Configuration Nuclear Station Engineering DWW/Im Attachment cc: B. L. Siegel, NRC Clinton Licensing Project Manager I NRC Resident Office Regional Administrator, Region III, USNRC Illinois Department of Nuclear Safety i

I.

l 8410160055 841002 PDR ADOCK 05000461 F PDR 2P*j I t 1.

U-0745

. 1A.120 L30-84 (10-02)L bec W. C. Gerstner, B-13 D. P. Hall, V-275 H. E. Daniels, V-650 J. E. Loomis, V-650 J. G. Cook, T-31 J. H. Greene, T-31 H.'R. Victor, V-928 W. Connell, V-923 K. R. Graf, V-275 L. S. Brodsky, A-10 (3 copies)

J. S. Spencer, V-920 F. A. Spangenberg, V-928 R. E. Campbell, V-923 A. E. King, V-500 L. W. Osborne, V-900

. E. P. Rosol, V-500 D. K. Schopfer, V-270 J. R. Patten, V-922 R. K. Wyatt, V-914 H. M. Sroka, S&L (Atten: H. S. Taylor)

S. A. Zabel, Schiff,-Hardin & Waite

'J. R. Newman, Newman & Holtzinger ,

CPS Central Files, T-31

'E. W. Kant, V-928 R. Schaller, T-31 S. Foster, V-913 T. Riley, V-928 .

R. Hyndman, V-928 J. O'Brien, V-928 D. Wilson, V-920 P'

_. , . _ _ . - . . . _ _ -, , . - _ _. . , _ . , _ , ~ , . _ _ _ - _, ,,y ,

• ~

, . . l

. U-0745  !

1A.120 j L30-84 (10-02)L  ;

4 ATTACHMENT Response to Request'for Additional Information Concerning the Clinton 1 Safety Parameter Display System QUESTION 420.01a For each' type of device used'to accomplish electrical isolation,'

describe the specific testing performed to demonstrate that the device is ' acceptable for its application (s). This description should include

, _ elementary _ diagrams when necessary to indicate the test configuration

. and how the maximum credible faults were applied to the devices.

RESPONSE

The Safety Parameter Display System (SPDS) has IE isolators from three vendors - General. Electric Company (GE), Electromax,' and Technology for Energy Corporation (TEC). The isolators provided.by CE and Electromax-have been previously reviewed and approved in SSER 2 Section 7.2.3.4.

Thus, the remainder of the responses on the isolators. address the TEC isolators only.

The TEC 2200-2 Isolation System, containing TEC 980 Analog and TEC 981-Digital Isolators will be qualified to IEEE 323-1974 and IEEE 344-1975 as required by the procurement specification (S&L Specification K-2927).

The TEC 2200-2 Isolation System completely envelopes all of the Clinton worst case requirements identified by the procurement specification (K-2927). The qualification sequence and associated criteria are as follows:

i THERMAL AGING The scope of the thermal aging is to place the 2200 System components through accelerated thermal aging to a qualified life. The Arrhenius method was used to determine the aging duration that will simulate the qualified life. The post-production test will serve as the baseline function test. After the thermal aging, the functional test will be

repeated to verify the operability of the components.

The chamber temperature is maintained at an average of 86* C for the j 63.3 day duration of the test.

RADIATION i

Irradiation of the 2200 Isolation System was done to a dose of 1500 Rad (Gamma) TID at a dose rate of approximately 500 rad / hour. A complete post-radiation test to be compared with the baseline test will be run on each component of the 2200 System.

SEISMIC l 'There will be two complete tests performed on the equipment. Each seismic test will involve five successful OBEs followed by one successful SSE. The equipment will be tested in such a manner as to demonstrate its ability;to perform its intended function, and sufficient i

1

. . _ _ - - . , _ . _ _ _ . _ . . . . _ ~ ,_ . , .. -, _ ,

7

• U-0745 4

• 1A.120

' L30-84 (10-02)L monitoring _ equipment will be used to evaluate performance before,-

~during and'following the test. All testing will be per IEEE 344-1975.

- EMI Susceptibility The purpose of this test is to establish that the equipment can operate

Ln an electric field within the frequency range specified. No malfunction, undesired response, degradation of performance, or

~

permanent damage to the equipment shall occur when the equipment is operated'in the electric field with the intensities specified. The testing procedure will be Mil-Std-462 method RS03. The test levels shall be 10 volts per meter from 20 MHz to 50 MHz and_15 volts per meter 4 over the.100 MHz - 500 MHz' range. The range from 20 MHz to 50 MHz was covered in increments of 10 MHz. The range from 100 MHZ to 500 MHZ was covered in 100.MHZ increments. Spot checks were made over the 500MHz to 1000 MHz range.

QUESTION 420.01b

~

Data to verify-the maximum credible faults applied during the test were the maximum voltage / current to which the device could be exposed, and define how the maximum voltage / current was determined.

RESPONSE

As a qualification criteria, the maximum creditable fault or worst case Design Basis Accident was established as 2000 Vdc applied across the non-1E outputs.of the analog and digital isolators during the SSE tests.

The 1E input-side of the isolators was monitored to see that no breakdown in isolation had occurred. The maximum creditable fault current applied is that current resulting from the 2000 Vdc.

QUESTION 420.01c Data to verify that the maximum credible fault was applied to the output

of the device in the transverse mode (between signal and return) and other faults were considered (i.e., open and short circuits).

RESPONSE

The worst-case Design Basis Accident (DBA) postulated for the TEC isolators was verified when 2000 Vdc was applied between the non-1E and IE outputs during the SSE test. The 1E input-side of the isolators were monitored to see that no breakdown had occurred. The TEC Model 159 i

. power supply and Model 981 digital isolators were functionally tested for high_and low output during the second SSE.

The isolators are designed such that an open or short circuit will not compromise the isolation integrity.

QUESTION 420.01d Define the pass / fail acceptance criteria for each type of device.

RESPONSE

2  ;

. U-0745 1A.120 L30-84 (10-02)L The two criteria used to determine the performance and acceptability of

the system were the variation between the pre-test data and the

. post-test data, end also the ability to maintain the acceptable range.

. j Acceptable ranges of performance for the system devices were ,

predetermined and documented in the form of baseline data collected before the test. program was started.. The post-production " Quality.

Control Test Procedure" (QCTP) data formed the baseline data.for the

. thermal aging._ The post-thermal aging functional test data then determined the baseline data for the pre-irradiation test.. The

. post-irradiation functional test was not.a complete QCTP, but rather a spot-check to determine if the systen was still operative prior to the seismic test.

As was predicted, the effect.of radiation on the system was negligible.

A combination of the post-thermal.and post-irradiation functional test data formed the baseline data'for the seismic test. program.

A Honeywell absolute pressure transmitter was placed in operation as the analog input to analog isolators, and the 1E inputs were recorded by a.

strip chart recorder.- During the seismic event, 2000 Vdc was applied continuously to the outputs of the isolators; no transients were recorded on the 1E input line, nor was there any damage to the input or recording electronics. See Attachment 1 for a diagram of the test setup.

QUESTION 420.01e Provide a cannitment that the isolation devices comply with the environmental qualifications (10 CFR 50.49) and the seismic qualifications which were the basis for plant licensing.

RESPONSE

The TEC isolation devices will be installed in a mild environmental zone

adjacent to the Main Control Room. Therefore, 10CFR50.49 does not apply to these devices. The following is a comparison of the TEC 1 qualification requirements for the 2200 Isolation System and the Clinton operating condition for the zone where the equipment will be located

TEC Qualification- Clinton Operating Conditions Temperature: 15 - 40' C 18 - 40' C Humidity: 25 - 85% 5 - 60%- .

Pressure: 14.5 to 14.7 psia 14.5 - 14.7 psia Vibration: None None

Radiation

1500 Rads (gamma) TID 1000 Rads (gamma) TID j The procurement specification requires the isolators to be qualified to l the Clinton seismic curves. The seismic qualification tests for Clinton l 3

-. _ _ _. _ __ , __ _ _-,.____ ~ , . _ _

, U-0745 1A.120 L30-84 (10-02)L are not yet complete. However, the TEC isolators will be' qualified to the Clinton seismic criteria. The fact that the " dry'.' end of the '

humidity-is not covered by TEC's qualification requirements is not-considered significant because the equipment will be located in an air conditioned area.

QUESTION 420.01f-Provide a_ description;on the measures taken to protect the safety systems from electrical interference (i.e., Electrostatic Coupling, EMI,

' Common Mode and Crosstalk)'that may be generated by the SPDS.

RESPONSE

The TEC 2200_ Isolation System uses differential inputs, high impedence amplifier inputs, steel cabinet shielding and shielded IE output cables to eliminate common mode electrostatic coupling and crosstalk problems.

QUESTION 620.01a The applicant has proposed an SPDS that provides information regarding four critical safety functions (CSF) on one cathode ray tube (CRT) while providing information regarding radioactivity control (the fifth CSF) on a separate CRT approximately eight feet away. The following questions address the feasibility of such an approach.

a. The applicant argues that no cateing is necessary on the primary SPDS to alert the opera';or to changes _in status on the ARM /PRM because the ARM /PRM has an audible alarm.

} 1. Provide evidence that the ARM /PRM audible alarm is indeed audible to the operator under degraded conditions, i.e.,

when annunciator alarms are sounding, etc.

2. Describe the conditions under which an ARM /PRM audible alarm will sound, and the characteristico of the alarm (s), i.e. , durat. ion, frequency, and intensity.

RESPONSE

The SPDS SS display is the primary system display with the other

, displays and the ARM /PRM systems providing secondary information for its i support. Illinois Power has addressed the lack of cueing for the ARM /PRM on the SPDS SS display and made the following change:

The ARM /PRM systems High Radiation summary alarm has been added to i the SPDS SS display. Any High Radiation alarm in the ARM /PRM system will now be audibly alarmed at the ARM /PRM console and also l displayed on the SPDS SS display. The control room operators use l the ARM /PRM console and its various displays to determine the area l of the alarn. and details of the condition. j The audible alarm on the ARM /PRM is a Mallory Sonalert Model SC628, it l provides a minimum of 80 db and will be tested during start-up to insure '

it is audible to the operator under all control room conditions and distinguishable from other control room alarms.

4 i l

,,- n

. U-0745' 1A.120 L30-84 (10-02)L -

The audible alarm sounds,at any' change-ofLstatus on any channel in'the

. system. It also sounds when,the system-is first started (or restarted) and when a high radiation; condition occurs. The audiblefalarm will

.' sound until the HIGH ALARM light switch is' depressed, thus' acknowledging

the condition. The alarm is aLeontinuous audible beep of approximately

.1-second duration, at a frequency of 2900 hz and intensity of.80 db.

'For the " alert / trend" alarm. the audible alarm is a short beep.-

-QUESTION 620.0lb l The applicant argues that although the ARM /PRM is approximately eight feet from the primary SPDS. display and is not easily recd from that

-distance, the ARM /PRM sufficiently provides an overview of radioactivity control stacus because it provides an easily. recognizable pattern (a schematic of the plant) which is overlaid with distinctive color changes when changes in radiation monitoring status occur.

1. Provide an explanation why the inconsistent use of color code

, meanings will not mislead the operator; that is, since yellow denotes " normal" on the primary SPDS display but denotes " abnormal" or " trending high" on the ARM /PRM, there seems to be a' risk of the operator misinterpreting.a yellow data point as being " normal" on the ARM /PRM portion of the SPDS when'it is actually trending high.

i 1

2. Provide discussion / analysis explaining why control of the ARM /PRM displays from the primary SPDS area is unnecessary.. The discussion should address the situation in which the ARM /PRM has been switched to a lower level display rather than the " status grid display" and has been left in that condition.

3. Provide a diagram of the control room showing the primary SPDS

] display location, the ARM /PRM location, the distance netween the two locations, and the viewing angle.

'1.

RESPONSE

IPC has added a " Rad Control" (Critical Safety Function - CSF) alarm to the primary SPDS display which is fed from the ARM /PRM system's High Radiation Summary Alarm (see the Attachment #2 format for the revised Primary SPDS display). With the inclusion of this alarm, the primary

SPDS display is now a stand-alone high level indication of plant CSFs.

Therefore, the primary SPDS will provide a complete and unambiguous

,. indication to the plant operator (s). The potential for confusion j between the color uses on Nuclenet and the ARM /PRM systems is removed.

With the inclusion of the " Rad Control" CSF alarm on thre primary SPDS, i the ARM /PRM " Status Grid" display becomes a secondary S?DS support

, display. :However, the question of operator misinterpretation of a 4

" yellow" data point as being " normal" on the status grid when the associated radiation monitor is actually in an alert / trending high condition is addressed in the format for the status grid display itself.

[ The format of the status grid display includes a " summary alarm table".

Anytime a radiation monitor enters an alert / trend (yellow) or a high ,

radiation level (red) condition, the associated radiation monitor number j 5

. s U-0745

- 1A.120

. L30-84 (10-02)L

, (and the appropriate corresponding color) also apoears'in'the " summary alarm table". Thus, the operator cannot confuse a " yellow" data point as being " normal".

All of the lower level displays of the ARM /PRM'aystem, with the exception of the group displays, have a two minute timed reset ..

associated wich them. If they are called up and left.in that condition.

-the status grid display will return'onto the scree. after the two minutes have expired. The group displays are used to monitor trends or

-evolutions in chosen. areas, and thus in these conditions a timed reset e is not desireable. In the unlikely event the ARM /PRM is.left with a h

group display present on the screen and an alarming condition develops, the. ARM /PRM audible alarm would sound and the " Rad Control" CSF alarm

. light on the primary SPDS display would illuminate " red". An operator would then need to go.to the ARM /PRM panel to clear the. alarm, at which time he could bring the status grid display back up onto the screen.

With these provisions, adequate control of the ARM /PRM system.iu +

maintained.

Figure 13.5-1 of the CPS FSAR (Attachment #3) has been marked to show

, the primary SPDS location and the ARM /PRM location. Attachments #4, 5.

and 6 show the viewing angles and distances between the displays and the 1

-operators.

F It should be noted that the final location of the ARM /PRM panel is just i

to the left of Panel P678, "The Standby Information Panel". This was

{ always to be the permanently installed location for this panel. The t

ARM /PRM panel was noted as being on the right-hand side of P678 in previous submittals. This location was only temporary. Due to restrictions associated with Fire Protection cable routing, the ARM /PRM panel cannot be installed on the right-hand side of P678. However, it 4

should be noted that, as indicated by the ?.ttached sketches, the ARM /PRM 4

panel is more readily visible to the operator from his normal work station (directly in front of the NUCLENET console) if this panel is 1

located to the left of P678. From a human factors standpoint, this location is considered most acceptable, since the operator is not required to rotate his head away from the primary SPDS display in order i to view the ARM /PRM panel.

QUESTION 620.02 The color codes proposed for the Clinton SPDS (with the exception of the ARM /PRM portion) are inconsistent with sterotypical color meanings:

i green = go, normal; yellow = caution, abnormal; red = warning, danger.

a. Explain why the color coding of the SPDS cannot or should not be changed to be consistent with the population, convention and the ARM /PRM portion of the SPDS.

b. Explain why inconsistencies within the SPDS cannot or should i

not be resolved, i.e., presently, within the proposed SPDS yellow means either normal or abnormal, and normal conditions are denoted by the colors green, yellow and blue.

6

~ -- - .~. - -

, - O.

U-0745' t

1A.120

' L30-84 (10-02)L

RESPONSE

The color coding scheme for.the CPS SPDS coincides with that utilized

~

for the entire PGCC/Nuclenet_ control room design.- This scheme was developed by General Electric for_use in advanced control rooms.

.Throughout the Nuclenet design, colors are us2d according to the following convention / scheme:

Red: alarm. status (digital values and graphs), equipment energized, open valves Green: equipment not energized, closed valves, scale marks for bar graphs.

Magenta: alarm status (digital valves and graphs)

Cyan: fixed background and fixed labels.

Yellow: digital and bar graphs not in alarm condition (normal).

White: invalid data.

4 These colors and conventions provide high contrast and are most readable by the operctor(s).

For the ARM /PRM system the following color code convention / scheme is used to indicate changes in radiation monitor status:

)'

Light Blue: communications failure i Red: high radiation level alarm.

1 Yellow: alert / trend alarm.

Dark .

Blue: monitor not initialized.

I White: calibration / check source, maintenance, flush, local control.

Green: normal conditione.

J The plant operators have received a significant amount of training on a i simulator which utilizes color coding in an identical fashion to that of ,

the CPS control room displays. They have also operated from the CPS l control room, during preoperational testing, using displays with this convention. The.use of the color schemes presented has not been a source of confusion for the operators. To change these schemes now could introduce such confusion.

With the inclusion of the " Rad Control" CSF alarm on the primary SPDS,

as discussed in the response'to Question 620.01(b), there is no need to

, 7

_ .- . . _ _ _ . . . _ - -- _--_ . . - _ . m.

, U- 0745 1A.120 L30-84 (10-02)L change'these color: codes, since the primary SPDS display is a complete

'and unambiguous status indication.

QUESTION 620.03

a. Provide an estimate of the density of the SPDS overview display

'with the " AIDS" function activated.

b. Describe the method used'to estimate'or measure display density.

c. Identify character size in inches or millimeters and in pixels.

NOTE: Provide for both SPDS and ARM /PRM if they are different.

' RESPONSE The display density with the_" AIDS" function activiated is approximately 19.6%. This meets the guidance of NUREG-0835, Section 4.5.3.

The method used to measure the display density is the ratio of active pixels to the total pixels.

-For the Display Control Systems (DCS)/SPDS each display is formed by a matrix of 72 character positions on each of 48 display lines, to produce a total of 3456 standard size character positions.

Each character position on the display consists of a matrix of 7 vertical scan lines by 7 horizontal bit positions. This meets the criteria of NUREG-0835, section 4.5.3 and NUREG-0700, Section 6.7.2.2.

Alphanumeric characters are displayed within the character position on a 5 by 5 matrix while graphic characters are displayed in the full 7 by 7 j character position pixel matrix.

, For purposes of the above display density calculation, an average of 16 i active pixels per character was used.

SPDS Nuclenet Displays ARM /PRM Displays Graphic (7 x 7) 19 inch display (6 x 8) 19 inch display Height 5.0 mm 5.3 mm l Width 4.6 mm 4.1 mm Alphanumeric (5 x 5) (5 x 7)

Height 3.8 mm 4.6 mm j Width 3.3 mm 3.4 mm j For the ARM /PRM the screen format is 80 characters per line, 48 lines per page. The characters are a 5 x 7 dot matrix within a 6 x 8 dot pattern. This meets the criteria of NUREG-0835, Section 4.5.3 and NUREG-0700, Section 6.7.2.2.

QUESTION 620.04 8

_- ~- - - .

. . U-0745-1A.1201 L30-84 (10-02)L ~

. The applicant stated on page 13 of. its February .10.1984 submittal that .

"The (data) update rate will be selected _ based upon: human factors considerations."

1 Provide further detail concerning this statement, e.g., selection ~

criteria used.

RESPONSE -

The-primary SPDS display is updated at a minimum rate of every two.

seconds. This meets the functional criteria of NUREG-0835, Section p 4.4.2.2. 'The primary SPDS display'provides the overall safety' status of the plant. As such, the minimum two-second update rate was chosen to l~

present. current data as specified by NUREG-0835. Secondary, or:

supporting, displays such as the ARM /PRM system's status-grid display and the Nuclenet emergency operating procedure displays, provide.the status of individual systems and historical / trend informatidn.. A'five second minimum update rate for these displays is sufficient to inform the operator of the system status. There is no corresponding NUREG-0835

, ' criteria for such " support" displays. Five seconds was chosen so as not to affect the response time for the primary SPDS Critical Safety-Function monitoring (i.e. not require significant computer processing i

time).

. QUESTION 620.05a Insufficient information was provided to evaluate the adequacy of the simulated input used in validation testing. Specifically, the

, identification of the transient and accident sequence test case used for

{ performance tests of the SPDS should be provided and justified. If a 4

specific parameter is not testable in a fully simulated transient

sequence, the source of the validation data should be identified.

RESPONSE

4 The SPDS is an integral part of the GE supplied Nuclenet system using those features originally designed into the Nuclenet system. In lieu of the transient / accident sequence testing euggested above, IP will test i the SPDS as an integral part of the Nucienet system expanding the test procedures to encompass the additional hardware, display background,

j. alarming features, and calculated variables.

1 QUESTION 620.05b Provide a summary. description of the validation testing planned for the total, integrated system, that is the simultaneous testing of the l hardware, software, personnel, procedures / manuals, and training.

2- RESPONSE 1

i The integrated software testing, to be performed by General Electric /Honeywell, will include the followirg:

1) System Initialize and Testing & Reconfiguration Units -

9

-ws. - . . - . - - - + m ---w,, v-- hem ---

,m---w-->e,,,- , y--- ,ww.=---t-ver-,,,--%i.4 -t--+ wee w--q--r--'F-r-w-T- yw -W w-*r-*

T .;

. U-0745-1A.120.

L30-84 (10-02)L Verify.that the_ cold, manual, and common memory. failure restart functions operate correctly.

2) ' Executive Program Operating System -

Verify that data acquisition processor (all-core) and display control processor (core-bulk) operating systems have been packaged correctly.

^

3) Analog Data Acquisition -

Verify that the analog data acquisition and display function

{ operates correctly and within specified response criteria.

1 4) Digital Data Acquisition -

Same as for analog data noted in Item 3 above.

5) Operator Display Interface -

Verify the correct operator interface. capabilities with the DCS/SPDS data available at the DCS console. .

6) Display Format and Conventions -

i Verify the data translation and transformation functions work correctly.

3 7) System Restart -

Verify that DCS/SPDS software will perform adequately while encountering analog / digital data processing and hardware failures over an extended period of time.

l The verification and validation (V&V) field testing, to be performed as part of the SPDS startup and pre-operational testing program, shall

. ensure that the following are met:

(a) The as-built SPDS meets the design functional requirements; (b) The SPDS performs to establish acceptance criteria; and (c) The SPDS is maintainable.

The following examples relate to the types of testing that will be performed as part of the V&V program:

1

1) SPDS cperability tests

2) Accuracy of card input conversions and isolators

3) Each input is correctly connected and the signal range is consistent with the required design l u4) _ Parameter validation checks i

10

-. - . - ,~ . _ - - . .

c. -

,c l

. U-0745 1A.120-

L30-84 (10-02)L ' 1

5) Display. parameter setpoints and' alarm features 6)' Check color coding

17) Equipment-field installation verification-4

8) . System response to operator requests and sensor input changes.

6 Operators attend approximately two hours of classroom. training on'the functional design' of the SPDS. This training was'part of'the Emergency

. Operating Procedures operator training program. After the SPDS is ,

installed and testing is complete, operators will be trained on the operacion of the SPDS. The training wil1 include, as.a minimum,.how to l

' validate display . informatio:1, .how to~ identify a. faulted computer point,

'and how to call up SPDS on a backup CRT.

QUESTION 620.06a Identify which safety parameters.(if any) are validated by comparing redundant data points in real time. -

,. ' RESPONSE The following parameter is validated by redundant comparison:

.. Drywell (DW) Pressure (Narrow Range)

. The technique used for redundant channel validation of data is: One of-I the variables is picked as the baes number and is displayed as well as compared to the remaining values i.e.

/DWp-DWi/ 4 K *DWp for all 1.

i

/DWp-DWi/ less than or equal to K *DWp where: DWp = the selected value DWi = the next measured value

• = multiply K' = the scaling factor (will be determined when the source

tranducer and channel accuracy have been measured) when the value of /DWp-DWi/) K

• DWp the displayed value is turned white but continues to display the value of DWp.

f QUESTION 620.06b Provide a description of the method (s) used to validate calculated parameters.

RESPONSE

Data. validation consists of three different techniques;

.11

U-0745 1A.120 L30-84 (10-02)L

1) The Data Acquisition Processor (DAP) portion of the system performs a reasonableness test on each channel as it is digitized. This is the validation test for single parsneter I: channels. All data classified as invalid turns the display white and displays'the last valid value. .There are several conditions.on a point's status which causes the value to be displayed in white:

, a) If the point is a real point (i.e., associated with a plant sensor) its value will be displayed in white if it fails the reasonable limit check.

b) If a point is a psuedo point (i.e., its value depends on a real point) its value will be displayed in white if any of its source points are: deleted from processing, failed the reasonable limit check, out of scan, undefined, or has a substituted value.

c) If a point value has been substituted regardless of being a real or psuedo point, its value will be displayed in white. The color white is used to display " low confidence" data. . Low confidence data means the sensor is no longer active for one of the above reasons. The last valid value is displayed because the data is nn longer being updated but the point is still on display.

The white color will. flag operators as to the uncertainty of the data and alert them to regard the point values accordingly.

2) The techniqua used for redundant channel validation of data is given in the response to question 620.06a.

3) The following parameters are validated by the averaging algorithm:

Average Power Range Monitor (APRM)

Source Range Monitor (SRM)

Reactor Water (Rx) Level Wide Range Suppression Pool Temperature i

X = 1/N Xi average value

']{1 n=

f

/X-Xi/ (s K*X if /X-Xi/> K

• X the display is turned white and the value is updated with average value. The value of K is determined as in the preceeding example.

QUESTION 620.06c Provide the' design rationale for indicating non-valid values by presenting the last good value displayed in white. The discussion should focus on why the proposed method is most meaningful and least misleading to the operator.

I 12

ac -

n-

, :U-0745-

'lA.120 L30-84 (10-02)L

- RESPONSE When?a signal-is determined to be invalid, the last valid value.is . . ,

substituted'and displayed in white to indicate a. low confidence. This

. . , . method of fdentifying invalid data.is most meaningful and least misleading to.the operator because-it is consistent with the~ display coding used on all other Nucienet displays throughout.the control room.-

lThrough everyday normal' operation'the operators are very' familiar with

'this display format. See-response to Question 620.06b.

QUESTION 620.06d Compare and contrast the data validation methods used within the ARM /PRM with the. data validation methods used in the balance of'the SPDS.-

Including a comparison of.the display methods used to identify a) valid data, b) unvalidated' data, and c) invalid data.

RESPONSE

The validity of the ARM /PRM data is directly affected by the operational status of the-instrument when the data was acquired. This status is always presented in the history file with the data. .The status condition is given priority according to its importance to the operator.

Status conditions are given below in order of highest priority to lowest priority, a) Not initialized (white status light & print out) b) Check source (white status light & print out) c) Calibrate (white status light & print out) d) Maintenance (white status light & print out) e) Flush (white status light & print out) f) Standby (white status light & print out) g) External fail (yellow status light & print out) h) Low fail (yellow status light & print out) " Reasonableness Checks":

Digital channel: A low count rate failure is determined when the 10-minute history file updates. A lack of counts for 10 minutes defines a failure. The failure clears when counts are again present.

Analog input channel: For an analog input channel (4-20ma current loop), a low fail exists when the input value decreases below the nominal value of 4 ma. The display value will then be 25 percent less than the value input as the-MIN scale value in the channel parameter file.

1) High fail-(yellow status light & print out) " Reasonableness i Checks":

Digital channel: Count rates in excess of 1.2 X 10E6 at the detector.

'=

Analog input channel: A high fail exists when the input value j increases above the nominal value of 20ma. The display value will be 25 percent-greater than the value input as the MAX scale value in the channel parameter file, l j) Alarm disable (light & printout) k) High rad level' alarm or flow out of limits (red light & print out)

-1) Alert ' radiation level alarm (yellow light & print out) m) Trend alarm (yellow light & print out)

L l ~

13

_ _ _ _ . _ _ _ . . _ . __ _ ~ _ _ _ _ __

g .a ,

z.. 'U-0745 1A.120 z L30-84 (10-02)L n); Normal (green light & print out) r The ARM /PRM is also equipped with'a polling method that will poll one '

. field microcomputer and,.in turn, all connected field units'. A poll I

-requests the field unit to respond with.any data or status change it may1 )

have computed or with a "no' data" message. .This provides a method of

' determining if the field unit:is still operational..

In'the SPDS, allidata-is subject to some form-of reasonableness check _or

' data validation. .For the analog data, reasonable sensor values are a L part of the Process Monitoring System:(PMS)/DCS data base. These are

~ used during each update to' insure the displayed engineering values are-

. computed from " reasonable sensor _ values". For digital _ data, each

" digital card group" is checked, and a status bit is carried into a-dataL

~

base status buffer where it is checked during each display cycle.

. QUESTION 620.0T

-Provide conclusions regarding unreviewed safety questions or changes to technical specifications.

- RESPONSE i

Technical ~ specifications for the Clinton SPDS-are not_ required since this system is not designed to Class 1E or seismic Class I criteria, is not required to mitigate the consequences of an accident, and does not

! affect'the actuation / trip of required safety-related systems. The operability'of the CPS SPDS will be assured through the normal plant surveillance / maintenance of the related PMS/DCS and ARM /PRM computer

. systems.

The SPDS monitors those parameters that have been determined, by detailed evaluation, as meeting NRC requirements for monitoring Critical i

Safety Functions _(CSFs). The Verfication & Validation team's review of-

. this parameter set confirms.this adequacy by an evaluation of operator information needs during a wide spectrum of postulated accident sequences (including beyond Design Basis Accidents). This review assures'there are no "unreviewed safety questions" from the standpoint

of operator data requirements.

, Finally, as indicated by the response to_ Question 420.01, the analog / digital electrical isolation devices utilized by the SPDS' provide 4

the-required safety system protection from faults in the non-safety grade _PMS/DCS (SPDS)-computer system.. The adequacy of these isolation devices fully supports IP's position that there are no "unreviewed safety questions, and that technical specifications are not needed for the.Clinton SPDS.

QUESTION 620.08 Provide a schedule for full implementations of the SPDS including hardware, software, operator training, procedures and user manuals.

RESPONSE

14

1 l

. U-0745 ,

1A.120 '

L30-84 (10-02)L The Clinton SPDS implementation schedule includes the following key milestones:

1. The SPDS software design and development will be completed.in February 1985.

2.- The SPDS hardware will be completed in June, 1985, which corrcsponds to the completion of the SPDS startup and pre-operational phase testing.

3. SPDS operator training consists of classroom training and hands-on training. The classroom training was completed in July 1984, and the hands-on training is scheduled to be completed in July 1985.

4. The SPDS verification and validation program will be completed in July 1985.

5. The SPDS procedures will be part of the NUCLENET documentation.

1 l

15

i

$l .

H.V. ON/0FF

!c  : 120V AC "e  : --

1 I 24V 24V 24v s2 I*I I*I n!GH/ LOW

_7

< - 7- _ - - - ._ E

_ - 3

, ,! ! ' f 'li i l l

> I l :ii ' u I  !!I i t i

• ~ " ""

2Kv 2Kv 2Kv 2Kr PI - ~

,  ! l I t RI I*

I NON lt

! It OUTPUIs i

' INPUTS ,

110 i[C I(C Ilt 1EC . itt 9 ale 9u C 156C 159 b 1594 . 981

' i s.n s.n. s.n. s.n. s.n. s.n.

8

)OnSEI5MIC TAstr =

02019 12021 03042 "

02012 3-1 01018 , 01013 1.

I s inruis "0" IE OUTPUTS 1

I CH 2 CH 3 CH 4 CH $

l i

=

i i

Diagram of Online Monitorin'g of Isolators 3

i ATTACHMENT #2 1

.........l........ 2........ 3........ 4........

1 5........ 6........ 7..

2 POWER RX CORE 1 RCS CNMT RAD 3 2 4 CONTROL COOLING 3 5 INTEGRITY CONDITION _

. CONTROL 4 6 ARPM ,

5 7 ':in ':" :" '"3' ! ' : lll I! l l l l l 7. 1 6

8 xxx xxx- 7. 7 9 SRM 8 10  :::- ll;;;;;;;;;; .; CPS

' " " " " ' PERIOD 9 11 x.xEx -xxx SEC 10 12 11 RX LEVEL (WR) t. .::::';;;I;;!. .; INCH 13 12 14 ""'""S -xxx

-xxx INCH 13 15 RX SIEAM FLOW 14 3u,,uu 16  ;

xx.x xx x 15 17 ,;;;:: l;;;;;; i i MLB/HR 16 RX FEED FLOW in"""i MLB/HR 18 i ;;;;!!! :'. ';i xx.x xx.x 17 19 TOT CORE FLOW ""'"*" MLB/HR MLB/HR 18 20 xx.x xx.x 19 21 20 22 RX PRESSURE (i!R) l l ; ; ; ; ; ; ; ; :; ; ; ; ; ; ; ' ; ; PSIG to i u un 21 23 xxxx xxxx PSIG 22 24 DW FLOOR DRAIN i+r - - 23 25 GPM 26 SUMP FLOW $' s's' C ''''''' 'xx.x xx.x GPM 24 25 27 26 28 DW PRESSURE (GR) i' ' ' ' ' ' ' '

id 'n'a f, ' '

'''''' PSIG 27 29 x.x x,x pSIG 28 30 SUPPRESSION 29

;;, ;,  ;;lll: :;;; ;1 DEG F 31 POOL TEMP 30 isuuuu 32 xxx.x xx.x DEG F 31 33 CONTAINMENT 32 34 PRESSURE  ;-; ; ; ; ; ; - l l ll [ ! l j l l l l ; PSIG 33 35 i r , u o .i xx.x xx.x PSIG 34 36 35

37 1 36 2 3 4 5 6

38 CNMT ISOL IO IO 7 8 9 10 11 37 39 IO IO IO IO IO IO IO IO IO' 38

.40 39

51 40 ii2 RX WTR LVL 41

'13 -xx.x IN SUPP POOL LVL DW PRESS xx.xF 42

14 DW TEMP xx.x PSIG SUPP POOL TEMP xxx.xF 43

.+5 xxx.x F CNMT PRESS xx.xPSIG 44 16 SRV STATUS (OPEN/ CLOSED) CIGIT TE".P xxx.xF DW FL SUMP FLOU xx.x GPM 45

.' i7 SDV A/B LEVEL CNMT H2 CONC xx.x7. 46 18 xx/xx GAL SEC CNMT AP (FUEL / AUX) BLDG 47 ,

.........l........ 2........ 3........ 48 4........ 5........ 6........ 7..

SPDS SS DISPLAY (Revised)

. - ... _ . . .. ~ . _ . ._. . . . _ . _ . _ . . . ,

, , [

. E

+- ATrAOBEN'r #3 ~ f

}

AMENDMENT 29 {

1 -g g --1 -

i

,i - t .

- MARCH _ 1984.

.tst s

-l a 4 e

, t 1 ,

l t i  ! -

~ T. - I e l

e I ., , t . . __

1 a

- - ---___8 -_ _____' .

.I .

I I

I. l -

1 i -

m

• . . . E a g o n i u l' l

u l C I 1

i o >

1-u 1

I e I ~-

1 C .

v l 1 u u I < l -

u , -

l s- l

' oc 1 m I om e 4,

y z o g m i ~c o I

oo u

g u I ua i E CO l 2

.i l c% .a

. g o i n i o I :2 8

1

1. m 8

c' 1

g i *

~

1 g

I  :

I I e i I u

8 1 o i a i "O l 8  !

l CR.T*S U t -

' .S?DS

~

, g 1

l  :

. I u i I .- ,

I ,,qA , l 3

, -~~.----.--____.p,.._-_ , q

' ,' Asyll

- - ~ ~l o sPRFl c j t

1 > c 5 \

i I

. , CLINTON POWER STATION l

. d i . . '" ,,b .~!i, ;i/Iv$k a b s s i 21 I }' f(-liY l" [+

FIN AL S AFETY AN ALYSIS REPORT l 4

i, VA: .4 :J , . v ... )

,, FIGURE 13.5-1 J DIAGRAM OF "AT THE CONTROLS" AREA

. ,. A

- ,. , ,.-...m. . _ _ _ . . _ , . - - _ - - -..__...._._..._,--__-r,.,_,.-., - -

.y--.-,

.. - ~ _ - , - . . _ . , , . _ - ,

c. ,

ATTACINENT #4

. AWJPIE Screen to SPDS SS Display 4

a AR M/f RM DISPLAY Y ,s g\x v

\

SS DISPL.At \

+

,r 4

A.

TOP VIEW (y-X AXIS)

- ARM /PRF)

<. OtsfLAl' n--

i n 10' ll

ss '

l- .c - Ol5PLAr ,

! rs s l - x - - - - - - _ _ .t i c.w Le v d 1 _ -

Il0E VIE W ( X- 1 AKl$)

L

r -: , . .

og_ ATDONENE #5.

SPDS SS Display to Operator t

b

'E n

ARM /fRM Off9 LAY x

s-1

, ks '

DISM At i

'fl'.\ 15j A lft A'

TOP VI EW ('/-X AXIf)

-,7---

c

-Q-- 15 N

g'g

• s

\ % 41'- i gg N

OtS PL AY Q ///lA

- .b d ..

.sme vow v.i uls)

.4 .

I' ATTACINEN" #6 o.

ARM /PBM Display to Operator 4

l 1

n AR M/f RM 0 if FL A'( -

'/ < y e x e

DISPLAT

^

a l , ,, tit A

TOP VIEW ('/-X AXIJ)

A R t1/PR n

• ~ ^Y

,g---..

9,

((

Y,r/> 1 l .<--- Y L_-___-

4 y slDE VIEW ( X-1 AX I,5 )

.i .

4

.. , ---4-, .r ,,_..--,..-,.--,w, -~...-~._----,--,-,,r+ -