ML20141B492

Forwards Response to 860311 Request for Addl Info Re Spds. Portions Relate to SER Outstanding Issue 19 Concerning Crdr. Resolution Requested in Next Sser

ML20141B492
Person / Time
Site:	Seabrook
Issue date:	04/02/1986
From:	Devincentis J PUBLIC SERVICE CO. OF NEW HAMPSHIRE
To:	Noonan V Office of Nuclear Reactor Regulation
References
SBN-987, NUDOCS 8604070047
Download: ML20141B492 (11)

Text

--

'A a .

M SEABROOK STATION Engineering Office Pub 5c Service of New Hampshke April 2, 1986 New Hampshire Yankee Divlelen SBN-987 T.F. B7.1.2 United States Nuclear Regulatory CcTaission Wautington, DC 20555 Attention: Mr. Vincent S. Noonan, Project Director PWR Project Directorate No. 5

References:

(a) Construction Pernits CPPR-135 and CPPR-136, Docket Nes. 50-443 and 50-444 (b) PSNH Letter SBN-920, dated January 6,1986, "NUREG 0737 Task I.D. 2, Plant Safety Parameter Display Console," J. DeVincentis to V. S. Noonan (c) USNRC Letter, dated March 11, 1986, " Request for Additional Information Concerning The Safety Parameter Display System for Seabrook Station," V. Nerses to R.J. Harrison

Subject:

Request For Additional Information Concarning Safety Parancter Display Systen for Seabrook Station

Dear Sir:

Enclosed please find, as Attachment 1, responses to questions raised in Reference (c).

Since portions of the enclosed are related to Outstanding Issue 19, Control Room Design Review, we request its resolution be reflected in the next supplement to the Seabrook Station SER.

Very truly yours, 4 4 John DeVincentis, Director Engineering and Licensing cc: ASLB Service List G604070047 060402 PDR ADDCKOS0gj3 5

6

\\

P.O Box 300

• Soobrook.NH O3674 . Torophone[603)474 9521

.. : a .- . . . ..

s Cicne Curran Patcr J. Michew3, Mayor Harnon & Weiss City Hall 20001 S. Street, W.W. Newburyport, MA 01950 ruite 430 Washington, D.C. 20009 Calvin A. Canney City Manager Sherwin E. Turk, Esq. City Hall Office of the Executive Legal Director 126 Daniel Street U.S. Nuclear Regulatory Commission Portamouth, NH 03801 Washington, DC 20555 Stephen E. Merrill Robert A. Backus, Esquire Attorney General 115 Lowell Street Dana Bisbee, Esquire P.O. Box 516 Assistant Attorney General Manchester, NH 03105 Office of the Attorney General 25 Capitol Street Philip Ahrens, Esquire Concord, NH 03301-6397 Assistant Attorney General Department of The Attorney General Mr. J. P. Nadeau Statehouse Station #6 Selectmen's Office Augusta ME 04333 10 Central Road Rye, NH 03870 Mrs. Sandra Cavutis Designated Representative cf Mr. Angie Machicos the Town of Kensington Chairman of the Board of Selectmen RFD 1 Town of Newbury East Kingston, NH 03827 Newbury, MA .01950 Jo Ann Shotwell, Esquire Mr. William S. Lord Assistant Attorney General Board of Selectmen Environmental Protection Bureau Town Hall - Friend Street Department of the Attorney General Amesbury, MA 01913 One Ashburton Place, 19th Floor Boston, MA 02108 Senator Gordon J. Humphrey 1 Pillsbury Street Senator Gordon J. Humphrey Concord, NH 03301 U.S. Senate (ATTN: Herb Boynton)

Washington, DC 20510 j (ATTN: Tom Burack) H. Joseph Flynn Office of General Counsel Diana P. Randall Federal Emergency Management Agency 70 Collins Street 500 C Street, SW Seabrook, NH 03874 Washington, DC 20472 Richard A. Hampe, Esq. Matthew T. Brock, Esq.

l Hampa and McNicholas Shaines, Madrigan & McEachern 35 Pleasant Street 25 Maplewood Avenue Concord, NH 03301 P.O. Box 360 Portsmouth, NH 03801 Donald E. Chick Town Manager Gary W. Holmes, Esq.

I Town of Exeter Holmes & Ells 10 Front Street 47 Winnacunnet Road Exeter, NH 03833 Hampton, NH 03841

, Brentwood Board of Selectmen Ed Thomas RfD Dalton Road FEMA Region I l

Brentwood, NH 03833 John W. McCormack PO & Courthouse Boston, MA 02109 L J

ATTACHMENT 1 SBN-987 REQUEST FOR ADDITIONAL INFORMATION CONCERNING THE SEABROOK STATION SAFETY PARAMETER DISPLAY SYSTEM Q. Isolation Devices Provide the following:

a. For the type of device used to accomplish electrical isolation, describe the specific testing performed to demonstrate that the device is acceptable for its application (s). This description should include elementary diagrams when necessary to indicato the test configuration and how the maximum credible faults were applied to the devices,

b. Data to verify that the maximum credible faults applied during the test were the maximum voltage / current to which the device could be exposed, and define how the maximum voltage / current was determined.

c. Data to verify that the maximum credible fault was applied to the output of the device in the transverse mode (between signal and return) and other faults were considered (i.e., open and short circuits).

d. Define the pass / fall acceptance criteria for each type of device.

e. Provide a commitment that the isolation devices comply with the environmental qualifications (10CFR50.49) and with the seismic qualifications which were the basis for plant licensing.

f. Provide a description of the measures taken to protect the safety systems from electrical interference (i.e., electrostatic coupling, EMI, common mode, and crosstalk) that may be generated by the SPDS.

g. Provide information to verify that the Class IE isolation is powered from a Class lE source.

Response (a - g)

The Safety Parameter Display System (SPDS) at Seabrook Station utilizes the main plant computer to accept information from plant instrumentation and to provide for the display of critical functions, etc., to the plant operator. As such, the SPDS is a subset of the main plant computer.

l All inputs to the main plant computer from safety-related instrumentation which will be used in the SPDS are provided through qualified isolators.

The qualification of these devices is discussed in the answer to RAI 420.12, Letter Number SBN-945, dated February 14, 1986.

The Balance of Plant (BOP) instrumentation uses the same type of Westinghouse 7300 Series equipment as is supplied by the Westinghouse Nuclear Steam Supplier. This equipment is identical to that provided by Westinghouse to SNUPPS, the qualification of which was previously accepted by the NRC. In addition to the inputs to the main plant

computer through the 7300 Series equipment, two other systems provide input through qualified isolators; the Radiation Data Management System (RDMS) and the Reactor Vessel Level Instrumentation System (RVLIS).

The RDMS System isolation devices are discussed on Pages 13 to 17 of the February 14, 1986 submittal, SBN-945.

The design of the P.VLIS System, including both input and output circuits, satisfies the separation criteria for instrumentation as defined in IEE 384-1974, " Criteria for Independence of Class IE Equipment and Circuits." Information concerning the reactor vessel level is sent from the RVLIS System over a data link to the main plant computer. This data link function is available to provide serial digital information to the computer. The electrical interface is RS-422.

The isolator circuit in the RVLIS monitor output feeding the plant computer is a Westinghouse manufactured data link isolator board, Part Number 2343D63G02. Westinghouse has scheduled a series of tests to cover isolation, which are due to be completed in July of 1986. These tests are a superset of the testing performed on the Westinghouse 7300 Series equipment which was documented in WCAP-8892 "7300 Series Process Control System Noise Tests."

While this testing is not complete, Westinghouse believes the isolation capabilities to be sufficient. The circuitry in this isolator board is identical to that used in an earlier Westinghouse product, the thermocouple / core cooling monitor, except for the de power supply used.

The isolator circuitry for the thermocouple / core cooling monitor was tested successfully and the test results issued in WCAP-10621,

" Westinghouse Thermocouple / Core Cooling Monitor System Isolation Tests."

The one de power supply used in Seabrook's circuit is a high quality de to de convertor rated at 1,000 volts de isolation continuous and 3,000 volts de for five seconds. This value exceeds any fault value used in the testing as documented in WCAP-8892.

Q. Human Factors Engineering

a. Human Factors Program Provide a description of the display system, its human factored design, and the methods used and results from a Human Factors Program to ensure that the displayed information can be readily perceived and comprehended so as not to mislead the operator.

i

Response

The description and organization were provided in Chapter 5.0, Subsection 5.1, of the SPDS document.

The Seabrook Station operators versed in human factors engineering developed the high level display used in the SPDS. In addition, they developed the associated color bar which accompanies each safety function status tree. The major purpose of these elements is to offer the operator an immediate graphic review of the plant safety function following plant upset conditions. Additional review was given to this ergonomic element in the Detailed Control Room Design Review and in the Westinghouse Owners Group Emergency Guidelines Verification and Validation program.

The individual status trees were developed as part of the WOC guidelines. The human factors review of these status trees was a joint accomplishment by the Westinghouse Corporation and approximately 20 different utility people nationwide. The acceptance of these status trees as being human factor engineered is apparent with approval of SPDS at CP&L Sharon Harris Station, Texas Utilities Commanche Peak Station, and others which have used similar design.

The display system for the SPDS was then fully evaluated as a part of the Control Room Design Review (CRDR) Program. The methods used for the CRDR were first submitted for NRC review in our preliminary program plan, dated May 12, 1982. These methods were discussed at length with the NRC Human Factors Reviewers, revised, and finally accepted.

On January 12, 1984 in an NRC letter on the results of an In-Progress Audit of the Seabrook CRDR effort, Appendix A, Item AS.0, noted that the SPDS was not ready to be evaluated during the audit. On July 30, 1984, in PSNH Letter SBN-701, we responded as follows:

A static review of the SPDS has been done. No HEDs were found. An extensive validation and verification was performed of the whole Seabrook control board, including the SPDS. Observations of the use of the SPDS were made at the time. Video tapes of the process will be reviewed to complete the evaluation. Up to this time, no HEDs have been found in either the static or the dynamic review of the SPDS.

On October 12, 1984, a meeting was held between the NRC and PSNH to discuss items still open with respect to the CRDR effort. At that time, we informed you that we had completed our human factors review of the SPDS, and no HEDs had been found. As a result of this meeting, PSNH was requested to provide additional information on 19 items. SPDS was not one of the 19.

In July, 1986, the NRC issued SER Supplement No. 3 addressing the CRDR effort. The SER referenced the July 1984 PSNH letter and tho October 1984 meeting, among other references. It then listed open items remaining to be answered. Again, the human factor review of the SPDS was not among the open items. There have been various telephone calls since that SER discussing open items. The SPDS was again not discussed. We assume that the human factors review of the SPDS is complete and acceptable to the NRC.

Q. Data Validation

b. Describe method used to validate data displayed on the SPDS and how

" conservative substitute values" are calculated. Also describe how

" conservative substitute values" are made known to the operator.

L.

e Q. Verification and Validation Program

c. The SPDS Report describes the Validation Program for the Westinghouse Owner's Group (WOG) Emergency Response Guidelines (ERGS). It does not describe the Verification and Validation Program used in the development of the SPDS. This program needs to be described along with a description of results to date and the corrective actions taken to address identified design deficiencies.

Response (b and c)

I. Generic Introduction i II. Specific Items A. Unreliable Data Checking Associated with the MPCS Data Base:

1. Analog Data Base Values

2. Calculated Data Base Values

3. Digital Data Base Values

4. Flagging of Unreliable Data Displayed on the SPDS Screens B. SPDS Status Tree Response to Unreliable Data C. SPDS Values Used as Setpoints D. Testing of the SPDS Programming E. Selection of Input Points for SPDS F. Verification of Data From Field Device to IRTU I. General Introduction The purpose of this writeup is to provide additional information concerning the Safety Parameter Display System (SPDS) computer programming that is being performed on the Seabrook Unit 1 Main Plant Computer System (MPCS). Specific areas which will be addressed to allow the reader to understand the complete setup of the SPDS programming starting with the fleid data sensors up to the SPDS displays on the Main Control Board (MCB). This writeup also updates specific areas which have changed since the SPDS submittal (based on the simulator version of SPDS) was made to the NRC on January 6, 1986.

II. Specific Items A. Unreliable Data Checking Associated With the MPCS Data Base The SPDS Programs, which will perform the computer monitoring of the status trees, get their inputs from the MPCS data base. The MPCS data base has a structural reliability status built into the data base. The setup of the data reliability check is explained below.

.. +

1. Analot Data Base Values The majority of the SPDS data comes from the analog data base. The analog data base values censist of field input signals which are scaled by the MPCS such that the final analog value stored in the data base is in the appropriate engineering units (i.e., psig, gpm, etc.). Each analog value has an associated status word which is coded and contains the results of the following checks.

The sensor millivolt value is reasonable (means that the final value is within a predetermined range).

The value is in scan (if a problem with a specific analog point is encountered, the administrative controls at Seabrook are in place to allow the problem point to be taken "out of scan). What this does is flag the item to indicate that the associated point is unreliable.

The value is not data (if different MPCS components and such that updating of associated analog data base values will not occur, then the affected points will be flagged as unreliable.)

The value is a tested point (if a new value is defined for the NPCS data base, but it not yet tested or if testing of the associated filled sensor is in progress, then the point is flagged as unreliable).

When an analog point is called into a SPDS Program, the associated status word is also obtained. By using an MPCS routine called "RELIAB" the status work is checked and if any of the four items mentioned above indicate a problem, then the associated analog value is determined to be unreliable.

All analog data base points which are input into the SPDS Programs must be flagged as reliable (as determined by the MPCS routine "RELIAB") before they are used.

2. Calculated Data Base Values A small amount of the SPDS data comes from the calculated data base. The calculated data base contains values which have been derived from base values. The calculated values also carry a status word, although it is structured differently than the analog value status word. The calculated value status word is set by the program which does the determination of the calculated value. The calculated value status word is therefore a "go, no-go" check which can be interpreted by the MPCS routine "RELIAB". Any calculated values used by SPDS Programs must be flagged as reliable (as determined by MPCS routine "RELIAB") before they are used.

4 ..

+ -

3. Flatring of Unreliable Data Displayed on the SPDS Screens The SPDS data screens output selected analog or calculated values as part of the SPDS displays. If any of the displayed data has been determined unreliable, it will be:

o flagged with a yellow question mark whorever the data is displayed on the SPDS screens.

o a printout of the unreliable analog status is output to the analog alert logger.

B. SPDS Status Tree Response to Unreliable Data Once the input data checking (described in Section 2a) has been performed, the SPDS Program codes proceed on to perform the calculations necessary to evaluate the status trees. If a situation arises where a status tree block, required to be evaluated, does not have any reliable data, then the status tree evaluation cannot be completed by the MPCS. If this situation occurs, it will be indicated to the operator as follows:

The affected status tree will not blink. (In contrast, if a status tree is evaluated by the MPCS, then the final terminus of the tree would blink.)

The status tree color bar chart on the lower left of the screen on each individual status tree would go black for the affected status tree (s).

The above method of flagging unevaluated status trees has the following advantages:

Status tree evaluation will only be completed by the MPCS if the reliable data needed to evaluate the tree is available.

This eliminates the concern of having incorrect status tree evaluations being displayed to the operator.

Unaffected status trees will continue to be evaluated and displayed by the MPCS.

C. SPDS Values Used as Setpoints The critical safety function status trees are a subset of the Seabrook Emergency Operating Procedure (EOP) network. The plant-specific EOPs are based ca the Westinghouse Owner's Group Emergency Response Guidelines, "High Pressure Version," Revision

1. One very important part of the transition to plant-specific procedures requires the determination and implementation of various plant-specific setpoints and instrumentation inaccuracies. In order to assure that the plant-specific setpoints used in the EOPs accurately reflect the intent of the generic guidelines, the Seabrook plant implemented an Emergency Operating Procedure Setpoint Study which discusses and documents how Seabrook SOP setpoints are obtained. The SPDS setpoints are taken from the EOP Setpoint Study and are consistent with the generic guidelines as well as the Seabrook EOP setpoints.

D. Testing of SPDS Programming All of the SPDS Programs will be documented and tested according to the guidance provided by Procedure RN-0717. " Reactor Engineering Computer Program Documentation." An overview of the 1

RN-0717 requirements is presented below:

Each computer program will have an associated program description which will cover preselected items.

A pre-operational testing program must be performed and documented to verify that the programming is actually executing properly.

An operational testing program must be performed and documented to verify that the program and the computer system are functioning properly.

E. Selection of Input Points for SPDS 4

Details concerning which inputs are used in the SPDS Programs are presented in Section 3. However, the following general philosophy was used to determine input points.

All input points to SPDS Programs originate from safety-related instrumentation. It is important to note that the designation of equipment as accident monitoring instrumentation does not include all the safety-related equipment. For example, each steam generator narrow-range level has four narrow-range level channels of which only one channel is classified as an AMI instrument.

However, the other three narrow-range level channels are still safety-related instrumentation. Therefore, when a determination of the "C" steam generator narrow-range level is required, that value will be obtained by:

1. Reading in the four "C" steam generator narrow-range levels.

2. Rejecting any unreliable data.

3. Averaging the remaining, redundant values to obtain the "C" steam generator narrow-range level which will be used by the SPDS programming. The use of safety-related, redundant, instrumentation (where available) is desirable since it makes the SPDS programming lecs susceptible to instrument failure j and unreliable data.

F. Verification of Data From Field Device to IRTU l

As part of the Startup Test Program (associated with the MPCS) data base inputs from the field sensor to the computer have been j verified using Ceneral Test Procedure GT-I-42. This testing i-

verified that the computer data base points are receiving a signal from the appropriate field sensor.

Q. Unreviewed Safety Questions

d. Provide conclusions regarding unreviewed safety questions or changes to Technical Specifications.

Response

Seabrook Station believes that no unreviewed safety questions remain nor do we need any changes to our Technical Specifications. The development of the SPDS is in tune with nationwide development and has been reviewed by several safety-oriented personnel teams. Specifically, at Seabrook Station, our Station Operation and Review Committee (SORC) has reviewed the SPDS on two occasions: prior to submitting the procedures generations package to the Commission in 1984, and upon approval of our emergency plan procedure set. A final review and approval will also be forthcoming upon the finalization of our emergency procedure set. This final review is scheduled for April of 1986.

Q. Implementation Plan

e. Provide a schedule for full implementation of the SPDS including hardwcre, software, operator training, procedures, and user manuals.

Response

The SPDS hardware is presently installed in the Station.

The SPDS critical safety functions are an integral part of the Seabrook Station's Emergency Procedures and Emergency Plan. The Procedures generation package has a users guide which is used to describe the SPDS critical safety functions and the Emergency Plan. Classification of Energency Procedure ER-1.1 also explains the use of the SPDS status trees in development of event classification.

Additionally, a program manual is under development for the computer system methods of exchanging information. This manual, along with the setpoint validation and the programming validation, will be combined and maintained. This manual will be completed prior to core load.

Operator training has already been provided and the operators have been licensed under this system. Any changes to the SPDS will be inserted into the Requalification Training Program. At Seabrook Station, requalification training is on a rotating schedule. One week of every six, the operators are in retraining. This schedule is described in our FSAR and guarantees the operator five weeks of retraining every year.

Therefore, any changes to the SPDS would be seen by all operators within a six-week period from the time it was introduced into the Requalification Program.

l

Q. Parameter Selection As a result of its review, the staff noted that the following variables are not proposed for the Seabrook SPDS:

1. RHR flow

2. Steam generator (or steam line) radiation

3. Stack monitor

4. Containment isolation

5. Containment hydrogen concentration

Response

1. RHR flow is a parameter which is useful, but not a " stand alone" selection. RHR flow cannot be used alone to determine that the heat removal function is being performed. We feel that the core cooling status tree on the SPDS is best used for making this determination.

We, therefore, do not feel it is necessary to add RHR flow to the SPDS.

2.& Steam Cenerator Radiation / Stack Monitor - Although we have a

3. radiation monitoring console in the Control Room, per your request, we will establish a radiation screen on the SPDS for monitoring during abnormal conditions. A description of the screen will be available for your review during your upcoming site audit.

Incorporation of the screen into the SPDS operating procedures and training will be completed before preceding up in power following the first refueling outage.

4. Containment Isolation - We agree that containment isolation is an important parameter for the operator during an accident condition.

Seabrook has status light indicators for every containment isolation valve. These lights are grouped in train-related matrixes on the main control board and energize bright on an indication signal. All valves have individual monitors. If the function fails to achieve its predetermined position, the lights will not illuminate. The status light indicators are visible from the SPDS console. We, therefore, do not feel it is necessary to add containment isolation to the SPDS.

5. Containment Hydrogen Concentration - This parameter is indicated on the main control board. It is a parameter which is reviewed in the emergency procedure set during accident conditions and is not likely to cause any need for action within the first few hours of any accident. In addition, the operators emergency support group would be in place any time hydrogen concentration would be a possible threat. Because hydrogen concentration is not an immediate concern, it is included in the emergency procedure set, and emergency support

! group would be in place to assist the operators any time it would be a concern, we feel inclusion of this parameter in the SPDS is i unnecessary.

l l

_9_

l l

i l