ML20137E810
| ML20137E810 | |
| Person / Time | |
|---|---|
| Site: | Byron, Braidwood, 05000000 |
| Issue date: | 08/20/1985 |
| From: | Ainger K COMMONWEALTH EDISON CO. |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| References | |
| RTR-NUREG-0737, RTR-NUREG-737 0516K, 0520K, 516K, 520K, NUDOCS 8508260079 | |
| Download: ML20137E810 (14) | |
Text
-
f' Commonwe:lth Edison s
/ one First Nabonal Plaza, Chicago lihnois i
C } Address Reply to. Post Office Box 767
\\
Chicago. Illinois 60690 August 20, 1985 Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555
Subject:
Byron Station Units 1 and 2 Braidwood Station Units 1 and 2 Safety Parameter Display System NRC Docket Nos. 50-454, 50-455, 50-456 and 50-457 Reference (a): November 9, 1984 letter from B. J.
Youngblood to D. L. Farrar Oear Mr. Denton:
Reference (a) requested additional information regarding the Safety Parameter Display System (SPDS) for Byron /Braidwood stations. The requested information concerned isolation devices, human factors engineering, and procedures and systems review.
Enclosed are the responses to questions 420.01, 620.01 through 620.C), and 640.01 through 640.03. This information will be incorporated into the FSAR in the next amendment.
Please direct any questions regarding this matter to this office.
One signed original and fifteen copies of this letter and enclosure are provided for NRC review.
Very truly yours, N.
K. A. Ainger Nuclear Licensing Administrator 1m Enclosure cc: Byron Resident Inspector i
Braidwood Resident Inspector g'/A
%h0 go 00 4
0520K F
j
420.01
_ ISOLATION DEVICES Provide the following:
a.
For each type of device used to accomplish electrical isolation, describe the specific testing performed to demonstrate that the device is acceptable for its application (s). This description should include elementary diagrams when necessary to indicate the test configuration and how the maximum credible faults were applied to the devices.
b.
Data to verify that the maximum credible faults applied during the test were the maximum voltage / current to which the device could be exposed, and define how the maximum voltage / current was determined, c.
Data to verify that the maximum credible fault was applied to the output of the device in the transverse mode (between signal and return) and other faults were considered (i.e., open and short circuits).
d.
Define the pass / fail acceptance criteria for each type of device.
e.
Provide a commitment that the isolation devices comply with the environmental qualifications (10 CFR 50.49) and with seismic qualifications that were the basis for plant licensing.
f.
Provide a description of the measures taken to protect the safety systems from electrical interference (i.e., Electrostatic Coupling, EMI, Common Mode and Crosstalk) that may be generated.
Response
Westinghouse (7300 Process Equipment)
The Westinghouse 7300 process equipment isolation devices have been previously reviewed and approved by the NRC.
Inis review is documented in a letter dated April 20, 1977 from R. L. Tedesco to C. Eicheldinger. Testing of Westinghouse 7300 system electrical isolation devices is documented in Westinghouse WCAP-8892A.
Cumbustion Engineering (HJTC/CET Monitoring System)
The isolation device between the safety-related Heated Junction Thermocouple / Core Exit Thermocouple Monitoring System and the non-safety related SPDS is the fiber optic (glass) cable as shown in the diagram below:
Safety Related Non-Sa fety Related HJiC/CET Fiber Optic Cable EPOS Monitoring System Processing m
. The fiber optic cable is used to transmit data from the safety related system to the non-safety related system. Data transmission is accomplished by non-electrical light pulses. Since this data link is a non-electrical fiber optic cable, no electrical connections exist between the HJTC/CET Monitoring System and the SPDS. Because there are no electrical connections between the safety related and non-safety related systems, specific testing of the effect of postulated electrical faults is not required.
The isolation devices have been seismically and environmentally qualified as Class 1E components of the HJTC/CET Monitoring System.
The qualification methodology and results are documented in Combustion Engineering Report 2382-ICE-3310, Rev. O " Qualification Summary Report for the Heated Junction Thermocouple / Core Exit Thermocouple Monitor System for Commonwealth Edison Company Byron Station Units 1 and 2" dated January 31, 1984. Since this equipment is located in a mild environment, the requirements of 10 CFR 50.49 do not apply.
The inherent characteristics of data transmission by fiber optic cables (non-electrical) are such as to preclude any electrical interference.
Thus, specific measures to protect the HJTC/CET Monitoring System from electrical interference are not required.
General Atomics (Class 1E RM-80 Isolation)
For Class 1E RM-80's, RT-AR011 and RT-AR012, isolation is provided on the power isolation board. The isolation is maintained by running RM-11 communication wiring in a separate conduit from the RM-80 to its junction box.. Inside the junction box, greater than six inches of physical separation is maintained between the terminal board used for communication wiring and the terminal boards used for all other wiring.
The input / output circuits on the power isolation board are of the same design and use the same components that are used in the communication isolation device active circuits. These circuits were successfully tested on the communication isolation device as part of the fault voltage withstand capability tests referenceo in Sorrento Electronics letter 2215-263 dated January 23, 1985.
The following discussion provides detail of the isolation circuitry. Each RM-80 utilizes two optically-isolated half-duplex 30 mA current loops. One of the loops is termed active because the RM-80 supplies the loop current. The other is termed passive because the adjacent RM-80 (or RM-11) supplim the loop current.
. Figure 1 presents a schematic of the communications-isolation circuitry. RM-80 #1 is the active monitor which supplies loop current.
Transformer T1 provides the step down and isolation of loop current and has a secondary breakdown voltage rating of 1500 VRMS. Any extraneous voltages less than 1500 VRMS accidently applied to the communications cabling will not be coupled back to other components in the hM-80 and cannot adversely affect the operation of the RM-80.
The RM-80 communication current loops are designed to survive, without damage, voltage surges of 2500 V P-P at 1.5MHz. The surge voltage characteristics are described in detail in ANSI-C37.90a (1974). The design concept of the protection circuitry is to create low impedance bypass circuits that cause the surge power to dissipate in its source impedance. A common mode voltage applied at points A and B would be blocked from the elements of the opto-isolators and shorted to the loop current / station power ground. A positive common mode voltage would be blocked from the emitter of Q1 by diode CR1. Tne voltage level would be limited to +24V by VRl.
A high positive voltage at point B would attempt to drive excess current through the LED of opto-isolator #4. A current of 100mA through resistor R2 will cause transistor Q3 to turn on and shunt any additional current to ground. A negative common mode voltage would be shunted directly to power grcund by diodes CR2, CR3, and CR4 -(IN4001 diodes).
IN4001 diodes can withstand 30 amps of non-repetitive current and 1 amp of steady state current. Differential voltages applied between points A and B, or A or 8 to ground, would also be blocked and shorted to ground.
0516K
1 4
O.
e,,~ s i
,_e__,
a
?-
i 3
a%s.e
,i
,_g_s, 1
i i
i
- o. -
__f.a
,. =,
t__;
sS S
.4 %
.i_-
s..n l
- i. t,'
- n s
=_
2 Oa
.s "5
s.
o=
We
~3 e-s s
a.
7
- s
-2
- i
=
- 6. --g a
1 E
.iLI e)
I s
J qa, 91 2
{:f-g
.C u.
II
/.
T ;.__d
-+-4 G
11 ju
'q
< s<1,
...I i n>j i
r!,
i
~
t__;
c
- 4 J1 i I.
- 2..
I.
a
- .7 3W
{
g l
IO 1
E h
I Eo l
oi; 4
22
- S c
2 l
I i
e' e.
i A
I
~
e 620.01 DATA VALIDATION Describe the method used to validate data displayed in the S3DS.
Also describe how invalid data is defined to the operator.
Response
There are four steps in data validation: quality setting, quality checking, quality carrying and deviation checking among redundant points.
Quality and the alarm conditions determine the status of point. The primary method of displaying status is with a color change.
The specifics change with the format of the information being displayed.
The first step in establishing the status is accomplished in the scanning subsystem of the Proteus operating system. Each input is assigned two bits of quality, representing four states (GOOD, SUSPECT, POOR or BAD).
For example, if a point is out of sensor limits, it will be marked bad. If while converting an input to an engineering value the number becomes too large or small for the hardware to handle, it will be marked poor.
If the value is manually entered, it will be marked suspect.
The second step is a quality check of the inputs to the SPDS algorithms.
In those cases where redundant inputs are available, poor and bad values are removed from the calculations. If all points of one parameter are removed, the parameter is set to an alarm limit and marked bad.
The third step logically combines the quality of the inputs used in the calculation. A suspect quality combined with a good quality yields a bad quality. In arithmetic operations, this carrying of quality occurs automatically. The resulting quality is actually contained in the value.
If the calculation is not arithmetic, the algorithm duplicates this logic.
The fourth step is a maximum deviation check on redundant points.
Each point outside of a specified range (generally 5 percent) is rejected.
Points are rejected one at a time and a new average calculated.
If only one point remains, the average is set to one of the alarm limits and marked bad.
Four formats of information are on the SPDS displays:
analog values, digital tic marks, dynamic text and the distorted octagon (iconic).
Bad or poor quality values used.in drawing the iconic distort the octagon to an alarm limit. Tne octagon will always be yellow. Tic marks can be displayed in three different colors: the default is cyan, high alarm is red and low alarm is magenta. Numeric displays are raore versatile. Because a value can be in two conflicting states / colors (poor quality / cyan and low alarm / magenta) a priority has been established to resolve the possible conflicts which essentially displays the information in the lowest existing quality state.
0516X L
620.02 UNREVIEWED SAFETY QUESTIONS Provide conclusions regarding unreviewed safety questions or changes to technical specifications.
Response
Since the parameters displayed on the SPDS iconic displays are the same parameters evaluated in the FSAR, no additional unreviewed safety issues should result. During the performance of the Byron /Braidwood Detailed Control Room Design Review (DCRDR), in accordance with our schedule for implementation of NUREG-0737, Supplement 1, unreviewed safety questions will be addressed again.
The Technical Specifications address limiting conditions for operation of equipment whose satisfactory operation, when called upon, is required for safe operation of the plant. The Byron /Braidwood SPDS does not function in this capacity and therefore is not addressed in the Technical Specifications.
0516K
620.03 IMPLEMENTATION PLAN Provide a schedule for operator training, procedures and user's manuals for the implementation of the SPDS.
Response
The initial operator training for the Byron SPDS was completed as of March 31, 1985 in accordance with our schedule for the Unit 1 SPDS to be operational. A description of ano schedule for completing the remaining activities related to full implementation of the SPDS are described in a letter from Cordell Reed to H. R. Denton dated April 14, 1983. This schedule was amended in a December 6, 1983 letter from Cordell Reed to H. R. Denton.
0516K
640.01 PROCEDURES AND SYSTEMS REVIEW The Byron /Braidwood FSAR, Section,E.17, Amendment 43, identifies seven plant functions considered in the selection of the Byron /Braidwood SPDS variables, and states that these are based upon NUREG-0696. In addition, the NRC Staff uses Section 4.l(f) of the more recent NUREG-0737, Supplement 1, to identify Critical Safety Functions for SPDS.
a.
Since the Critical Safety Functions specified in NUREG-0737, Supplement 1, (and NUREG-0696) do not correlate well with the
. plant function identified in Byron /Braidwood FSAR, Section E.17, particularly in the areas of Radioactivity Control and RCS Integrity, show how the variables proposed for the Byron /Braidwood SPDS satisfy the monitoring requirements for each of the five Critical Safety Functions specified in t NUREG-0737, Supplement 1.
b.
Identify variables,'whether primary SPDS variables, secondary SPDS variables, or non-PDS variables, which are readily available from the SPDS console.
c.
The functions of certain variables seem to be omitted from the P DS'as described in the Byron /Braidwood FSAR. Variables whose SPDS function seems to have been overlooked in the Byron /Braidwood SPDS are:
- 1) Neutron Flux (Source,. intermediate, and power ranges),
-(Peactivity Control) Range uncertain
- 2) Hot Leg Temperature (Heat Removal)
- 3) Steam Pressure (Heat Removal)
- 4) RHR Flow (Heat' Removal)
- 5) Cold Leg Temperature (Heat Removal, RCS Integrity)
- 6) Steamline (or Steam Generator) Radiation (Radioactivity Control)
- 7) Containment Isolation (Containment Conditions)
- 8) Containment Hydrogen Concentration (Containment Conditions)
Discuss how the SPDS functions of these variables are provided for by the variables of the Byron /Braidwood PDS.
Response
Some of the information concerning the SPDS in Appendix E.17 of the
-Byron /Braidwood FSAR has been revised in Amendment 46 dated February, 1985.
a.
The following is a comparison of the Byron /Braidwood SPDS functions to NUREG-0696, NUREG-0737, Supplement 1, and the Westinghouse ERG
-Critical Safety Functions.
. NUREG-0696 Westinghouse Byron /Braidwood Byron /Braidwood NUREG-0737 ERG Critical Critical Safety SPDS Parameters Supp. 1 Safety Function Furiction Mcnitored
- 1. Reactivity-Sub-criticality Reactivity Control
- A. SUR Control B. Power Mismatch C. Core Exit Temp.
D. Tave L
- 2. Reactor Core Core. Cooling
-Reactor Core
- A. Core Exit Temp.
Cooling &
Cooling
- B. Subcooling Heat Rem.
C. NR S/G Level D. WR S/G Level.
3.
Heat Sink Secondary System
- A. NR S/G Level Status B. WR S/G Level C. Power Mismatch-D. Tave
+*A. Tave
flow E. Containment Floor Drain Sump Level
- 5. Containment' Containment A. Containment s
Conditions.
Integrity Pressure B. Containment Pressure
- 6. Radioactivity Containment Containment
- A. Containment Control Conditions Activity Level Rad Levels l-
- B. Containment Floor Drain Sump Level 7.
Inventory RCS Inventory
- A. Przr. Level B. RVLIS C.. Net Chg./Ltdn.
Flow s
D. Containment Floor Drain-
[
Sump Level
- Indicate primary indication utilized in Westinghouse ERG's.
l
+Tave indication-utilized as opposed to Tc-ll 0516K s
O
. b.
The Byron /Braidwood SPDS is an output from the plant process
. computer. Any information contained within the process computer data base is available for display at the operator's console on some type
- of output device (i.e. CRT display or typer).
Present CRT displays include the wide and narrow range iconic displays for SPDS, the Incore Thermocouple Display, Pressure /
Temperature curves for heatup and cooldown, and 30-minute trend displays of SPDS parameters. Although these displays are non-SPDS, their availability is equivalent to the SPDS displays. Long term-goals for computer generated displays include the development of a heirarchy of displays. This effort will be a product of the DCRDR.
c.
Response to specific parameters.
1.
Neutron Flux - On the Narrow Range Display, neutron flux is displayed in percent on the power mismatch spoke. Nuclear power is compared to turbine power to prov~ide the operator indication of reactivity balance in Mode 1.
Power mismatch in conjunction with Tave provide the operator with indication of primary and secondary power balance. Power mismatch is the initial input to the rod control system to initiate rod motion to affect Tave-On the Wide Range Display, startup~ rate is displayed. During startup, the change in flux level is more indicative of reactivity balance than the absolute value of the flux. The startup rate is displayed in the same format (decades per minute) whether indication is generated by source range or intermediate range instrumentation.
Additionally, flux is recorded on the main control board as-well as indicated on the NIS panel and main control board. The upper and lower detector currents are individually recorded on the main control board. Alarms associated with flux deviation and axial offset alert the operator of impending trends. We believe the manner in which neutron flux is displayed on the iconic provides the operator with'the data necessary to ascertain the core reactivity status.
- 2. -Hot Leg Temperature - On the main control board, hot leg and cold leg temperatures are indicated on strip chart recorders for trending of long term events. The immediate indication provided and incore thermocouple temeratures.
to operators are Tave T ve is available when reactor coolant pumps are running, and a
core exit thermocouple temperatures are available for all modes of operation. These temperatures combined with subcooling indication provide the operator with sufficient indication to rapidly determine heat removal capabilities.
_4-3.
Steam Pressure - In Mode 1, heat removal by the secondary system is verified by monitoring steam generator narrow range level.
Steam generator water level is provided as a positive indicator to the operator for heat removal capability.. Steam pressure was-not used because of the potential for rendering misleading information on heat removal capabilities. Narrow range steam generator level in conjunction with main steam line and air ejector radiation levels provide indication of steam break events. Likewise, wide range steam generator level in conjunction with. radiation levels and containment pressure provide indication of steam breaks being inside or outside containment.
4.
RHR Flow - Heat removal capability is verified by using the main control board indication as a back up to the SPDS. Core exit temperatures and RCS pressure provide primary indication to the operator.
In the RHR mode, these indications can direct the operator to the main control board to verify proper RHR operation. Our intent was to keep the SPDS parameters to a minimum and use the SPDS indication to direct operators to areas of the main control board where control system manipulations can be made to' affect parameters monitored, and thereby maintain the critical safety functions.
5.
Cold Leg Temperature - See Item #2.
6.
Steam Line Radiation is monitored on both the wide and narrow range displays.
7.
Containment Isolation is not. monitored by the P DS. This function is verified by visual inspection of the main control board containment isolation status panel by the operator prior to blocking automatic safety injection actuation. Displaying this function on the SPDS display would not provide any additional significant information.
8.
Containment Hydrogen Concentration - This parameter would not provide useful information during normal (Mode 1) operation.
Hydrogen generation does not become a concern until greater than i
twenty four hours after an accident. Hydrogen concentration is displayed on the main control board and at the local panel.
The fact that the control room operator cannot affect the i
concentration from the control room was considered in determining the usefulness of hydrogen concentration on PDS displays.
0516K
640.02 Describe how the Byron /Braidwood Emergency Recovery Guidelines were considered in generating the set of variables for the Byron /Braidwood SPDS.
Response
Refer to the response to Question 640.01a. This table contains a comparison of the Westinghouse ERG Critical Safety Functions and the Critical Safety Functions monitored by the Byron /Braidwood SPDS.
0516K
f l
.640.03 I
l Describe the program for validation of the Byron /Braidwood SPDS L
variables.
In this discussion describe how the plant simulator, and/or control room walkthroughs, of transients and' accidents will be used to demonstrate useability of the SPDS, covering instrument setpoints for systems actuations and operator actions, i
Response
The Byron /Braidwood SPDS validation and verification program will be conducted as described in Commonwealth Edison's response to NUREG-0737, Supplement 1 (refer to the response Q620.03).
l The Byron /Braidwood simulator will be provided with SPDS software l
that is compatible with the computer for the simulator after the remaining
~
activities associated with full implementation of the SPDS are completed in l
accordanc'e with our implementation schedule for NUREG-0737, Supplement 1.
-0516K l
i a
-