ML20106H174

Forwards Response to NRC 841023 Request for Addl Info Re Spds. Remote I/O Hardware Acceptance Test Procedure for NUS Corp/Bg&E Calvert Cliffs Data Acquisition Sys at Computer Products,Inc Encl

ML20106H174
Person / Time
Site:	Calvert Cliffs
Issue date:	02/04/1985
From:	Lundvall A BALTIMORE GAS & ELECTRIC CO.
To:	John Miller Office of Nuclear Reactor Regulation
Shared Package
ML20106H178	List: ML20106H174 ML20106H190
References
NUDOCS 8502150203
Download: ML20106H174 (12)

Text

- - -

i BALTIM O RE GAS AND ELECTRIC CHARLES CENTER.P.O. BOX 1475 BALTIMORE, MARYLAND 21203 ARTHUR E. LUNDVALL. JR.

vice PREstDENT SUPPLY Director of Nuclear Reactor Regulation Attention: Mr. 3. R. Miller, Chief Operating Reactors Branch #3 Division of Licensing U.S. Nuclear Regulatory Commission Washington, D.C. 20555

Subject:

Calvert Cliffs Nuclear Power Plant Units Nos.1 & 2; Dockets Nos. 50-317 and 50-318 Safety Parameter Display System (SPDS)

Gentlemen:

Your letter dated October 23, 1984, requested additional information.

concerning the Calvert Cliffs SPDS. Our response to your request is provided in the enclosure to this letter. This new information is being incorporated into the SPDS safety analysis (submitted for staff review on June 6,1984), a copy of which will be submitted for your record-keeping purposes af ter it has been finalized.

. If you should have any further questions on this subject, please do not hesitate -

to con' tact us.

Very truly yo s, AEL/BSM/vf Enclosure cc: D.' A. Brune, Esq.

G. F. Trowbridge, Esq.

Mr. D. H. Jaffe, NRC Mr. T. Foley, NRC 8502150203 850204 T

\

PDR ADOCK 05000317 4 F PDR f i-

s

.~ , .

a i Enclosure January 4,1985 RESPONSE TO NRC 10/23/84 REQUEST FOR ADDITIONAL INFORMATION CONCERNING THE CALVERT CLIFFS 1 & 2 SAFETY PARAMETER DISPLAY SYSTEM f

Questian 1. Isolation Devices

a. For each type of device used to accomplish electrical isolation, describe the specific testing performed to demonstrate that the device is

,; - acceptable for its application (s). This description should include elementary diagrams when necessary to indicate the test configuration and how the maximum credible faults were applied to the devices.

, b. Data to verify that the maximum credible faults applied during the test were the maximum voltage / current to which the device could be s'-

g exposed, and define how the maximum voltage / current was determined.

s q.

c. Data to verify that the maximum credible fault was applied to the output of the device in the transverse mode (between signal and return) and other faults were considered (i.e, open and short circuits). ,

..d. Define the pass / fail acceptance criteria for each type of device.

• t

-e. Provide a commitment that the isolation devices comply lwith the environmental qualifications (10 - CFR ' . 50.49) and - with seismic

. qualifications that were the basis for plant licensing.

f. Provide l.'a- description of the measures taken to protect the -'safetyL system' s from. electrical interference (i.e., Electrostatic Coupling, EMI, Common Mode and Crosstalk) that may be generated by the SPDS. _

%ft . Response a.: The Data -. Acquisition . System j (DAS). .. providesi electrical 1 isolation - I between the non-safety related SPDS and the plant's safety-related 1

- instrumentation; systems. : ~ The DAS Isidesigned such .that a l fault k -associated with 'any input or output will not affect any other input or output. A block. diagram of one channel of the DAS is provided as

. Attachment 1. The devices 'within the dotted box comprise the remote'

~

I/O cabinets.'. The' inputs are instrument' loops andlthefoutput is a high

> speed serial link via fiber-optic- cable. : The? inputs; are isolated ;with~.

various modules selected for- the specific signal type. A(copy ~of.the .

Ltest procedure for these isolation modules is provided as

Attachment:

2 q(Remote I/O Equipment Hardware Acceptance Test Procedure for NUS - 3

- Corp./Baltimorey-Gasr and { Electric ; Company, Calvert Cliffs ~ Data'. _

1 Acquisition System, dated February 2,1984).~

~

i 4- " "

g -

s ;- ,

4 , , .1 n .

yl , f a

, .--.g,  : -q " ' ,1 r

y f '~,

e -

,w ae er * '- " ~

Enclosure 1 February 4,1985 i

b._ Maximum design withstand voltage is 600V sustained and 1250V surge per IEEE Std. 472. . Calvert Cliffs electrical circuit and raceway design criteria insures separation between circuits such that input. cables are

' not routed with cables for circuits above 500V rating.

,(

c. Output is via fiber-optic link.

d. Mooules were tested to ensure no change of output data and no change in functionality due- to the surge test. The test procedure and acceptance critiera are described in Attachment 2 (for example,_ see sections 9.6,10.7, and 10.13 for the optically isolated digital input module test process).

e. The isolation devices: comply with Calvert Cliffs seismic and environmental qualification program requirements.

1,.

f. ' The design standards' applied to the DAS isolation devices will ensure

' adequate electrical;-separation between the SPDS and safety-related sytems commensurate with original plant electrical design criteria.

g Questian 2. > Human Factors Pronram n

Provide a description of the display system, with emphasis on its human factored design, and the methods and results of a human factors program to ensure that the displayed information can be readily perceived 3 and comprehended so as not to mislead the operator. Color photographs or -

? reproductions of display pages and interface devices may be helpful:In supporting the discussion.

Response

The CCNPP ' SPDS will assist' control room personnel in F - evaluating ;the ' safety status of the plant 'during _ normal and abnormal

- operating conditions. Human factors engineering has been incorporated .

into ' . its design using' NUREG-0700 'and ~ NUREG-0835 as guideline documents.

' The SPDS is a software-based system being implemented as part of the new - plant computer which . includes ~one 19-inchL plant computer

~

monitor per unit mounted on the control boards (see Attachment 3), one 13-

~1nch SPDS touch screen monitor per unit mounted on the shift supervisor's

~

^

console, and _ a 13-inch desk-mounted SPDS monitor in the Technical Support Center. A third plant computer monitor (13-inch) will be located between the Unit I and Unit 2 SPDS. monitors on the shiftisupervisor's :

console.

The ;SPDS will provide aseveral displays organized under the -

following Critical Safety Function (CSF) headings:

L

~ 1. ' Reactivity c2, RCS Pressure and Inventory -

J3.' Core /RCS Heat Removal

4. - Containment Environment-

. '5. Containment Isolation 2-s

)

l

.y t

r Enclosura 1 February 4,1985

6. Radioactivity Control

7. Vital Auxiliaries Under each CSF heading, parameters are displayed which support the CSF in a manner consistent with the new function-oriented emergency operating procedures currently under development. These displays make extensive use of color and coding techniques. Displays are selected by the operator through keyboard action, the CRT cursor, or the touch screen poke points.

Display Formats Parameter data presented to the operator is grouped under CSF headings in a readily usable format. The following displays are available:

Plant Operating Summary

- Alarm / Indication

- Point Status Reactivity

-- Core Element Assembly (CEA) Matrix Display

- Alarm / Indication

- Point Status RCS Pressure and Inventory

- RCS P&ID

- RCS Press-Temp Plot

- Alarm / Indication

- Point Status Core /RCS Heat Removal (two pages)

- Alarm / Indication

- Point Status Containment Environment

- Alarm / Indication

- Point Status -

Containment Isolation

- Alarm / Indication

- Point Status Radioactivity Control

- Alarm / Indication

- Point Status .

?

3

, .. .~. - . - _ . . - . . - - . .-

' 5

- Enclosura 1 3 Fe.bruary 4,1985

~

]

. A CSF window matrix is located at the top of each display page -

with the highest priority CSF toward the left. These CSF boxes change '

color depending on alarm status. Vertical bar graphs are typically located below the CSF matrix for parameter display. The lower portion of the screen is used to display system status information. The display information directly supports its associated CSF. Information is repeated if necessary to minimize requirements for operator memory.

' Attachments 4 and 5 provide the Radioactivity Control and the Radioactivity Control Alarm / Indication display formats.

Display Format Hierachy Page one -of _ each CSF -is accessed by keyboard action using fixed function keys,_ the CRT cursor or by preselected CRT poke points on E the two touch screen displays in the control roorr. Once in a CSF, the user e can page down or up, within a CSF, using the " PAG FWD" OR " PAG BWD"-

' keys or CRT poke points.

An ~ alarm / indication box located -at : the bottom right hand corner is used to access a lower list of_ alarm descriptors' for use in that CSF. ' The intent of this poke point is to allow quick access to the' alarm >

p descriptors while avoiding screen clutter of the first page listing.

-- Color and Coding Techniques The:following color coding scheme is employed on the.CCNPP SPDS:

, Green a) For CSF Matrix: . No decrease in CSF margin; no failure = y of a safety system detected, b) For Individual Parameters: Parameter within its normal-range.

Yellow a) For CSF Matrix: CSF margin decreased.

b) For ' Individual Parameters: Normal range limits .

exceeded.

Red a) For CSF Matrix: Failure of a safety system; the CSF -

margin is substantially decreased. -

b) For Individual' Parameters:

Normal ~ range . limits -

substantially exceeded.

,  ; White . Bus energized (Electrical Busses Diagram).

Magenta _ For CSF only: -One or more logic gates- in an ' alarm-algorithm for that CSF.are invalid due to missing data or -

n failed sensor.

l Background information.

Cyan _

t v

1 Y - J _"

t. c g -

1

'a _

Y-

.f'[j 3;

,, , ' i _; j, , . . . . 4 .A - . . - - -b - . * ~- - - = - - ~ - - < - - - - ~ "

y  ; . .

f 9' -

-Enclosura 1 February 4,1985

e. -

Color intensity (normal vs low) is used to separate dynamic p?, from static information. Border lines, format lines to separate parameter bars, and titles for parameters are displayed in low intensity cyan. The vertical bar graphs, digital values and system status are displayed in low intensity green and normal intensity yellow and red. Low intensity green,

'an exception for using normal intensity for dynamic information, provides

^ greater contrast between the yellow and red. Bar graphs, digital values and system status information change color depending on parameter status.

In order to attract the viewer's attention, the CSFs at the top of the display format are in color and reverse video. If one of the alarm algorithms supporting a particular CSF has missing or invalid data, a small magenta square appears in the far right hand corner of the CSF box. This is visible to the viewer and is also noticeable on black and white hard copy. Sensor validity also makes use of the reverse video technique.  ;

, Location and Readability 1

The principal users of the SPDS will be the Shift Supervisor and the Shift Technical Advisor (STA). The Shift Supervisor will be seated directly in front of the 13-inch monitors at a viewing distance of approximately 20 inches. The SPDS displays are not complex in format and

. occupy less than 30% of the total screen. Alphanumeric characters are

' displayed using a 5x7 dot matrix.

Audible Alarm sThe CCNPP SPDS will alarm the plant annunciator system when

.c ' ~ sensing a " RED" or " YELLOW" CSF alarm condition. This alarm, as. with-P. all control _ board alarms, will be acknowledged _ and reset at the control c

board. The Shift Technical- Advisor will'be able to cut out the CSF alarm

.by; ;SPDS, keyboardf action; = therebyJallowing; additional CSF alarms to -

q. -

+

annunciate the control board. If the cut-out pushbutton is not depressed,. '

the control board annunciator window will remain.in alarm until the SPDS

' no longer senses'the alarm condition. -

g . - , i o <

The purpose of this audible control board alarm is'to bring a degraded CSF condition to the attention of the STA.

Questian 3. ; Data Validation Describe the. methods used to validate -data-~ displayed by the1 p ,'

~ .

. ' ' SPDS. Also describe how invalid data is defined to the operator. Please be -

3 specific and avoid phrases such as "to the extent possible." '

n

- s

>~$

Validation techniques'used for the'SPDS alarm al'gorithms and .

parameter ' indications :are dependent upon ;the ' number L of sensor; Inputs -

available' and the type of alarm.or indication" algorithm ' employed. _ Alarm g , algorithm validatior. 'is-IndicatedJby coding techniques'used on the .CSF:

- matrix windows ~ and by _ Inverse video 1of the ' invalid line item Lon the ~

-~ ALARM / INDICATION page.1 Invalid parameter . indication is indicated byl

• _ reverse video of the digital readouts below the vertical bar graph . displays

e +

^

,(

_ J'-

N 0  %

_ -. ... . . .- . . - . . ..-_.s.. . ._ - - __ . _ _ - -

r Enclosure 1 February 4,1985 and by inverse video of the invalid line item on the ALARM / INDICATION page.

Alarm Validation Alarm algorithms make extensive use of sensor channel redundancy for validation. Alarm algorithms which have four redundant sensor inputs use a two-of-four logic to generate an alarm condition. If one or two signals from any of the four channels is invalid or missing, the logic changes to two-of-three or two-of-two, respectively, and a small magenta color box appears next to the associated CSF. If greater than two sensors are invalid or missing, the CSF window will change to a magenta color and the alarm descriptor on the ALARM / INDICATION page will be displayed in reverse _ video indicating an invalid alarm algorithm.

Alarm algorithms which have two redundant sensor inputs use a two-of-two logic for generating an alarm condition. If one signalis invalid or missing, the logic changes.to one-of-one and a small magenta square will appear next to the associated CSF. If both sensors are invalid or missing the CSF will change to a magenta color and the alarm descriptor on the ALARM / INDICATION page will be displayed in reverse video indicating an invalid alarm algorithm.

Alarm algorithms without redundant sensor inputs will alarm when the sensor exceeds its setpoint. If the signalis invalid or missing, the

^ CSF will change to a magenta color and the alarm descriptor 'on the-ALARM / INDICATION page will be displayed in reverse video indicating an invalid alarm algorithm.

Parameter Indication Parameter indications which have two or more redundant channels will average the two channels in closest agreement for display information. An instrument loop uncertainty is used to evaluate the validity of the indication. This loop uncertainty is based upon worst case accuracy of components within the loop. - If the two closest channels deviate from each other by more than the calculated loop uncertainty, the indication will be flagged invalid.' Indications which have only one sensor input are not validated. Invalid parameter information is -indicated by -

reverse video of the digital readouts below the vertical bar graph displays and by reverse video of the invalid line item on the ALARM / INDICATION page.

Question 4. Parameter Selection Provide- further discussion about the rationale of the Calvert Cliffs parameter set .in relationship to the - Cri.tical Safety Functions.

Discussion should include, or refer to, detailed analysis concerning parameter representativeness and responsiveness, and may -include L a discussion of parameters' relationships to Emergency Procedures.

- Response SPDS parameters were selected to provide the indications

~

6

n Enclosura 1 February 4,1985 required to verify that the safety functions described in CEN-152,

" Combustion Engineering Emergency Procedure Guidelines" are being fulfilled. The following paragraphs discuss how the parameters selected to support the CCNPP SPDS Critical Safety Functions differ from the CEN-152 Safety Function Status Check Bases. The CEN-152 Safety Function Status Check Bases are provided for ease of reference as Attachment 6 (Note: CEN-152 - does not list indications for radiation . control or maintenance of vital auxiliaries. Parameters selected for these displays are explained under discussion of the individual displays).

a. Reactivity Control All parameter indications recommended by CEN-152 are included. - Also included are Tcold, boron concentration, boric acid storage. tank level, charging pump flow, and ECCS flow. Tcold and boron concentration were added because they directly affect reactivity

control. ' Boric acid storage tank level, charging pump flow, and ECCS flow were added because they provide indication of boric acid addition.

b. RCS Pressure and Inventory Control CEN-152 considers these safety functions separately.

c However, the CCNPP emergency operating procedures deal with them"

- as a combined func ~ tion. All parameter indications listed in CEN-152 for RCS pressure control and RCS inventory are provided on the CCNPP 7g SPDS.: Also included are the following:

4 -

Parameter Basis

. Steam generator pressure Needed to differentiate between -

m r

. .LOCA and steam line break.

.: accident.-

.q.

Core exit '. thermocouples Provides : ' Indication ~of ' core

[ _ _

uncovery.-

, Charging' flow, ECCS flow, . . Provides mdication of available

. containment water level, RWT . inventory for RCS make up and level, VCT level, RAS. ~ verification of engineered safety

. feature functions . designed to, .

mitigate LOCA.

. Quench tank level, pressure 'and Provide for_ diagnosing accidents -

. temperature. ' Status off involving loss of RCS inventory pressurizer. relief yalves,:

= letdown isolation valves, component. . (possible leakage ' paths). -

. cooling head tank level, containment :

iradiation monitor, main steam; -

,.  : radiation monitor,' main vent <

%~ N = radiation monitor:

• t _ .

.'.y ~

p z y

, i ~

.7 '

Y LL h - -

3-. , ,

4

' Enclosura 1 -

February 4,1985

c. Containment Isolation For containment isolation CEN-152 recommends parameter indication for containment pressure, containment area radiation, and secondary system radioactivity. The SPDS utilizes containment area radiation, the main vent radiation monitor, and status of all remotely '

operated valves which could vent containment atmosphere directly to the environment. . Main vent radiation indication facilitates monitoring i of any leakage via the containment penetrations (this leakage would be

collected by the penetration room ventilation system which discharges into main vent).

Containment pressure indication is included with - the containment environment CSF. Steam plant radiation monitor is included with the RCS pressure and inventory control CSF.

- d. Radiction Control The. following parameters . were selected .because .they encompass all monitorable release paths to the environment:

Main Vent Radiation Monitor Condenser Off Gas Radiation Monitor

- Main Steam Effluent Radiation Monitor Liquid Waste Discharge Radiation Monitor Gaseous Waste Discharge. Radiation Monitor

- The Containment area radiation monitor was also included in

~

this- display to provide -information in ' diagnosing the source of unusual effluent levels in the event of a major release.

4

e. Vital Auxiliaries The .'following parameters were selected to ' provide:

, Indication of the condition of vital support systems which must operate to maintain safety functions.=~

~

~~

Parameter - Basis -

Header pressure for salt water, Provides the best available -

Eservice water and component a

' indication. that these systems-

-are -

cooling systems ' operating as required.:

Voltage Indication lights on ;  : These provide indication' that -

1s .- -

on vital 4KV,480V,125VDC, - engineered safety features

- and 120 VAC electrical, busses - Instrumentation and equipment-

'have~ the; electrical - power required for operation.

~'

- Instrument air pressure Instrument air pressure is not -

_ - necessary for. maintenance of:

plant safety functions but . a k .-

s

,( r i , , . - 8i

- ), l '

- y 5i t ,.%- y.,9,- g.y w 4- e.v e, r- w a qy w - % y-3 q -ema.- --

n -w ye er - y. i--yy- a-y-4. yw-, ,,v-gvie--n.pg wi e ~,v--+-4-* v wg9

. ..- . - . _ . .. n - . .

[ , k Enclosure 1 February 4,1985 J

u knowledge of insufficient air pressure could significantly change the strategy of dealing .

with a particular accident.

f.' Core and RCS Heat Removal CEN-152 considers these safety functions separately; however, the CCNPP emergency operating procedures deal with them as a combined function. All parameter indications recommended by CEN-152 for the core heat removal and RCS heat removal functions are included on the CCNPP SPDS with the following exceptions and additions

, Parameter Basis TH (n t provided) In lieu of T indication listed in

' CEN-152, Delta T (TH-T Is provided for both loops .(f)

H  !

was included in CEN-152 so that the operator could calculate .

Delta T. For: operator convenience the CCNPP SPDS

. displays Delta T directly).

. 1, '

AFW Flow (added) Provides verification that the 5

. - _ , AFW , . system ' is , acting : ,to maintain ~ or restore steam generator level.L

[RCS Flow (added)- - Provides information for evaluating RCS heat transfer.

' SG Pressure (added): Provides indication of excessive -

steam demand.

Pressurizer Pressure, Core Exit . Pt ovides indication of subcooling -

~3 ~ . - Thermocouple Temperature -

-when RCS forced or natural

. (added)~ circulation is not present. - .

- Reactor Vessel Level (added) -

Provides indication that reactor-1 vessel contains sufficient coolant .

. to : provide . adequate L .; heat transfer.1 y

. gr Containment Environment

H CEN-152 ; addresses -the containmentMtemperature 'and; 2 , , pressure control function' separately from the containment combustible

. gas control function. _ However, theT CCNPP _ emergency L. operating procedures ~ deal ;with ' them" as af single' combined 1 function. ' All

' indications. listed in CEN-152 for the subject 1 safety functions are -

provided ~on.the CCNPP SPDS with.the following additions:

m o

,'g 9 S y -

u r ---gn ., ,

Enclosuro 1. February 4,1985 Parameter Basis Containment spray flow, service Provides indication that water flow to containment coolers containment depressurization systems are operating.

Containment water level Provides indication' of water inventory available for containment spray system.

Containment. radiation . Provides indication of radiation levels inside containment as a relative indication of core de6radation.

Question 5. Unreviewed Safety Question Provide a summary of the findings of the Offsite Safety Review Committee meeting of June 21,1984.

Response

The OSSRC reviewed the SPDS safety analysis on September 21 and December 20,1984, and has concluded that the SPDS will not pose an undue risk to the public health and safety.

Question 6. Implementation Plan Provide- a tentative schedule for full implementation of the SPDS including hardware, software, operator training, procedures and users manuals.

Fesponse The CCNPP SPDS implementation schedule was established under an NRC Confirmatory Order dated June 14, 1984. That schedule-reflects training. full Withimplementation of SPDS, regard to the Unit 2 scheduleincluding p(rocedure October 1,1986), we development are and

' contemplating a change to the final implementation date to coincide with the Unit I schedule (October 1,1987).

10

ATTACHMENT 1 nest I c.mr

- wrwar.- cmervue.

e . . .

. . . . i i

orme. net C* M DATA ' OTHeAC.

~~~ ~ ~ - '

(~~ CON CGNTE.ATOR. l Dnm Sw7tx J __

concaNismtor.

De# .

NGM 59tCD SY876M - gggga g NM LlNK,

-~~~~~--

F'~~~~~ ~-~~~7 1

Ms6t-$ettO ,

AMrit/A44 i i _

I i

e l

.TAcot I I

' l

' i

' I I E ,

l $U656M ,

--. J l r l

, I i

e I l

• I l

' D 1

' Soss l

_ a sretan ,

' l

• MHrst SITC EqostNDDT' i L___________________;

DATA AcedwnoM SYSTEM (TyMK (MS) y

.h w

?

4