ML20141N605

SPDS Progress Review,Lasalle,Units 1 & 2

ML20141N605
Person / Time
Site:	LaSalle
Issue date:	01/14/1986
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML20141N604	List: ML20141N603 ML20141N605
References
NUDOCS 8603170385
Download: ML20141N605 (57)

Text

.

i l

r W

~

SPDS PROGRESS REVIEW LASALLE UNITS 1 AND 2 i

January 14, 1986 Prepared for U.S. Nuclear Regulatory Comission I Washington, D.C. 20555 Science Applications htemationalCorporation Post omce son 1303,1710 Goodridee ortve, me Leon, wrslais ami 02, (70s) s21-43co 8603170385 860303 PDR ADOCK 05000373 P

PDR

e y

TABLE OF CONTENTS Section Eggg

. SUP91ARY..............................

I 1.

System Objectives (Initiation Phase).............

3 2.

System Design (Development Phase) 5 3.

Implementation 11 4.

Training 12 5.

Operation 13 6.

Maintenance 14 Attachment A - Critical Safety Function Parameters

- 15

- Attachment B - Human Factors Engineering Assessment........

17 Attachment C - Commonwealth Edison Co. Dresden, Quad Cities,

,LaSalle Safety Parameter Display System Functional Specification.............

25 Attachment D - SPDS Display System Operating System Procedure...

53 4

-e n+

,---we

~-n--,..-e,eev~+,

e-n.-o,.g,--+--...,m--...m..,-..,en.

ee.,,,

,e. -,,.,.,-_-.,r,---e,mm---__

ve-.-

SPDS Progress Review LaSalle 1 and 2 Supt 4.ARY An NRC team visited the LaSalle site on July 22, 23 and 24, 1985, to The team included a member of the NRC's Human observe the installed SPDS.. and contractors from Science Applications Factors Engineering Branch International Corporation (SAIC) and Comex Corporation.

The team reviewed the design, installation, testing, and operation of the LaSalle SPDS. This i

was one of six visits to representative nuclear power plants with operating SPDSs undertaken to ascertain the status of SPDS implementation and to obtain information regarding the general need for post-implementation audits of operating SPDSs.

On December 31, 1982, the LaSalle SPDS was declared operational to meet a Commonwealth Edison Company (Ceco) licensing commitment.

As presently installed, the system is unacceptable in that it does not provide a means of rapid and reliable assessment of plant status in emergencies.

The SPDS is operational in the control room but operators expressed unanimous opposition to the system.

Reasons for the poor operator acceptance centered on the following factors; (1) the system is highly unreliable; (2) the system was designed and installed with very little operator involvement; (3) the infor-mation displayed by the system is frequently incorrect and could mislead the operators; (4) the display is barely readable because of its location; and (5) the operating procedures caution against use of the system in an emer-gency.

During the three day site visit, the review team found numerous specific problems with the system.

Even though the SPDS was installed in t is control room and declared operational, it failed to provide valid, accurate, or reliable information. The system frequently displayed invalid off-normal conditions because of calibration and software errors.

During the frequent times when the process computer was not in service, the SPDS displays remained activated, thus providing information which was not current and potentially misleading.

One display was ob:erved to show an erroneous Anticipated Transient Without Scram (ATWS) indication, an erroneous high suppression pool level and an erroneous radiation release to the atmosphere.

System Verification and Validation (V&V) is not scheduled until 1986 when all Ceco systems are to be reviewed after-the-fact.

The training procram has been inadequate (about one hour in total) and is not always included in requalification training.

The system has not been integrated into reactor operations and frequently provides information which is inconsistent with other control room instrumentation.

The parameters selected for display were found acceptable in the NRC's Safety Evaluation Report.

The parameters are functionally

grouped, 1

demarcated, and color coordinated and are continuously displayed on a one-page display format.

The LaSalle operater.s readily use other computer-

. generated displays such as system mimics.

However, because of the negative features noted above, the. eperators do not use +he SPDS.

A significant commitment on the part of the utility would be needed to improve the system to the point that it could become an effective operator aid.

i e

2

SPDS PROGRESS REVIEW LaSALLE 1 AND 2 July 22-24, 1985 1.

SYSTEM OBJECTIVES (Initiation Phase) 1.1 Plant conditions for which the SPDS is intended to be used.

The licensee did not indicate specific operating conditions under which the LaSalle SPDS is to be used; however, the installation appears to be most useful when an off-normal condition occurs during normal power operations.

In point of fact, the licensee seems to go out of his way to make sure the SPDS is not used.

The following quotations are taken from the control room instructions to the plant operators (see Attachment D):

" CAUTION This document / drawing is for administrative reference only.

It shall not be used for maintenance, operation, design or ASME/ Tech spec related activities."

"D.

Precautient 1.

The SPDS display is not intended to provide sufft-cient indication to justify. direct operator action on reactor or auxiliary system controls.

The operator should refer to additional panel indications.nd alarms to confirm system status before taking action in response to an SPDS System Alarm."

1.2 Modes of plant operation in which SPDS is to be available for use.

The SPDS is intended to be maintained in an operable condition and displayed during all modes of plant operation.

1.3 Functional requirements 1.3.1 Critical Safety Functions.

The licensee has included coverage of all critical safety functions on one top-level display (page).

Because of this "one page" SPDS design, compromises have necessarily been made such as the use of wide-range scales only, with no provision for narrow range presentation on the SPDS.

See Attachment A for parameters displayed.

1.3.2 Intended users.

The licensee's procedures do not identify specific control room users for the SPDS prior to or during an emergency.

All licensed operators receive training in the SPDS, but it is general training covering its intended use and its design rather than its operational implementation.

Discussions with operators indicated that the user who would probably use it the most would be the Shift Control Room Engineer, or SCRE, (i.e.,

STA during emergte.cy conditions).

3 a

1.4 Relation to other NUREG-0737 Supplement 1 initiatives.

Was the E0P upgrade program integrated into the SPDS?

The SPDS was designed and built without any intent to integrate emergency actions as called out in LaSalle General Abnormal (i.e.,

E0Ps) with the SPDS.

It stands alone.

Was the SPDS integrated into the DCRDR7 Describe current status of DCRDR relative to SPDS status.

1 The DCRDR was in progress at the time of the SPDS visit. The SPDS will be treated as any other CRT during the DCRDR.

Are Reg. Guide 1.97 parameters used to feed SPDS?

Rea. Guide 1.97 LaSalle SPDS

1. Neutron Flux RX POWER

2. Control Rod Position ATWS feature of the RX POWER bar

3. RCS Pressure RX Pressure

4. Drywell Pressure DW PRESS

5. Primary Contain.nent PCIS Isolation Valve Position

6. Primary Containment CONTAIN RAD Radiation

7. Suppression Pool Water SUPP LVL Level

8. Effluent Radioactivity RAD RELEASE

9. Suppression Paol Water SUPP TMP Temperature

10. Drywell timosphere DW TMP Temperature

11. Primary System Safety SRV Relief Valves

12. Core Spray Flow CORE SPRAY The SPDS is fed from the plant 1rocess computer for the most part utilizing and manipulating parameters witch were already there.

Does emergency response structure necessitate SPDS in TSC or E0F7 The process computer (Honeywell) SPDS display is available in the TSC, and it can be called up from the Prime computer in the E0F.

Does the SPDS supply a portion of the ERF data acquisition system?

Yes, as described in the answer above.

4 1

1.5 Verification, Validation, and Testing Program Was a program plan developed?

Is it available for review?

There is a corporate V&V plan which is designed for application to all of the Ceco reactors. However, the plan is being applied after the fact and not in parallel with the design process.

The Dresden plant will be the first BWR to be validated under this system. Test cases are being developed by S. Levy and Associates--different personnel from those who developed the algorithms for the system design.

A two-person V&V group has been desig-nated in the Station Nuclear Engineering Department at the Corporate office.

They are supported by plant personnel who were not involved in the design of the SPDS.

Was the plan executed by the SPDS development group or by an independent party?

Identify the group and their working relationship to the development group.

The plan has not been executed. See above for the groups involved.

Did the plan include a process for review and analyses of the SPDS requirements?

The post installation and acceptance V&V plan attempts to follow a plan which is basically designed to be implemented during the design process.

This is described in an E.

Douglas Swartz (Ceco) 2g December 1g83 letter to

. Harold Denton (USNRC).

Inasmuch as the system is installed, it will be very costly to fix any requirements discrepancies which show up in the V&V.

2.

SYSTEli DESIGN (Development Phase) 2.1 Design Requirements 2.1.1 Events for which the SPDS can be used.

p The SPDS is primarily useful to note.reblems occurring during normal power operations. There is some utility dur!ng other plant operating condi-tions; however, there are no design features which will

" normalize" the display for off-power operational situations. For instance, during shutdown I

it is conunon to fill the pressure vessel beyond the high level alarm point.

The reactor level bar graph will be red during this condition and it pro-l vides a false indication of plant status for this operating mode.

2.1.2 Parameter selection Parameters displayed are listed in Attachment A.

The criteria for parameter selection is covered in the Ceco August 30, j

1984, letter to Harold Denton,

" Response to NRC Request for Information 5

l

_,-.mw m,m-

- mm

k s

r SPDS." The parameters described in Section 5.0 commencing on page 4 of that letter appear to cover the critical safety functions adequately.

As there is only one "page" in the SPDS, the problem becomes one of accommodating a

. great deal of information on one display, and this is where it suffers.

It was also noted that the LGAs are presently being rewritten to incor-porate the BWR Owners Group Rev. 3 which will incorporate the instrumenta-i tion to monitor secondary containment.

It is not planned to include these parameters in the SPDS and, in fact, there is no room for them.

2.1.3 Basis for establishing display requirements.

The display format was generated by an in-house working group with

. human factors input based on a BWR Owners Group concept, and operational input from former plant operators.

S.

Levy and Associates constructed the i

algorithm from the requirements and made' recommendations as to format and text.

Some were implemented and some (mostly text prompts) were not.

Current operational personnel input was lacking in the process.

.This is probably a factor in the low regard which the operators have for the system.

All operators interviewed pay little or no attention to the SPDS.

2.1.4 Basis for logic used for CSFs.

The SPDS stands alone and was not designed with the idea of supporting the LGAs (EOPs).

It is a system designed to meet the NRC's requirements with minimal effort, as quickly as possible.

It was the result of an engineering study utilizing the proper technical and human factors disci-plines, but with the above design goal.

2.1.5 Description of SPDS logic The SPDS logic is described in the August 30 letter mentioned above.

2.2 Design Specifications - Software 2.2.1 Software Design, Programming, and V&V SPDS Desian Staae What was the process used to develop the system and subsystem specifications for the analysts and programmers?

Saul Levy, Inc. designed the algorithms used i,o s'.pport the SPDS func-tion requirements in the LaSalle operating environment.

This was done independently from the Commonwealth Edison SPDS team work.

The information is cor.tained in a single volume.

This report contained Parameter and algorithm descriptions; Algorithm cymbols; Input / output signal lists; Algorithms; and Message lists.

Reference:

S. Levy, Inc. Report, SLI-8123, Rev. 1, "LaSalle Units I and II 6

Safety Parameter Display System," August 1983.

This report was not docketed.

How were human factors considerations factored into the SPDS design process?

The licensee stated that the human factors considerations were primarily the responsibility of the Commonwealth Edison SPDS development group.

They used formal checklists which were derived from NUREG-0835, NUREG-0700 and other sources.

Human factors aspects of display design include:

o Functional grouping of the parameters within the display.

Reactor system parameters (RX LEVEL, RX PRESS, CORE SPRAY and SRV) are all grouped on the left.

Containment parameters (DW PRESS, DW TMP, SUPP LVL, SUPP TMP, PCIS, and CONTAIN RAD) are functionally grouped in the center of the display.

Reactivity control (TX POWER) and radioactivity control (RAD RELEASE) are located on the right of the display.

o The functionally grouped parameters were designed with functional demarcation.

o Color coding was' designed with consistency with the control rocm.

o Readability requirements for 14 foot readability, but the reada-bility of the installed system is a problem for the operators.

What was the process used to define the SPDS software specifications for the progranrners?

I The program and data base specifications were defined in the S.

Levy document referenced above.

Was a Verification / Validation and Test plan developed?

A corporate verification and validation plan is being developed and will be implemented in the fall of 1986.

The details of this plan were not available at the time of the audit.

Did the V/ VAT team generate design based test scenarios?

Yes, the LaSalle SPDS development team generated the test coder. to evaluate all algorithms.

I 7

1

Did the V/V&T process include the review and analysis of SPDS design?

Preliminary design integrity checks were perfomed in the field.

Pre-liminary design evaluation checks were performed during software checks.

SPDS Proarammina Staae Was sn SPDS Users Manual developed for the SPDS users (Plant operations staff such as shift supervisors and senior reactor operators)?

LaSalle procedurt, LOP-CX-102, Revision 0, SPDS Display System, Decem-ber 29, 1932, was developed to explain the function of and operator response to the safety parameter display system.

The procedure is accompanied by a

" CAUTION" that it is not to be used for operation.

This procedure is included as Attachment D to this report.

Operations Manual The Program Specifications document will be used to develop this manual for LaSalle in order to accommodate future maintenance and modification.

(See Attachment C.)

Was an Initial Software Test Case Specification developed by the V/V&T team during this stage?

The basic set of test cases were developed by the LaSalle SPDS develop-ment systems analysts.

Did the V/V1T team review and analyze the Users Manual?

This is done by the LaSalle SPDS development group's systems analysts.

Did the V/V&T team perform a review and analyze the project requirement?

This will be done in the generic Corporate verificat' ion and validation program which is planned for the fall of 1985.

i Program Maintenance Manual The Program Maintenance Manual is basically the Design Specification Document.

It contains input and output flow diagram modules.

In order to perform corrective or perfective maintenance, the LaSalle programmers have to complete a Program Control Change form.

8

7.

~

2.2.2 Software development quality control procedures?

There were no formalized software Q.A.

procedures in place.

The pro-grammer did his own test cases, and there were no peer reviews.

2.2.3 Software reliability The SPDS was ' internally programmed in assembly language and was installed in the Honeywell process computer.

There are two process computers, but technical support personnel have little respect for computer generated information as the computer (not a safety-related system) is frequently down.

2.2.4 Utility of displayed information Define location of each parameter for each CSF.

This information is adequately described in the August 30, 1984, letter mentioned above.

Display indicates departure from normal conditions?

Yes, but generally based on normal at-power operating conditions.

Degree of departure?

The bar graph displays indicate a degree of departure based on limit lines which are keyed to nomal operating points and tech spec limits.

Numerical values are shown above the bar graphs as are point-to-point trends.

The status Doxes indicate normal and off-nomal states only.

SPDS has capability to store and recall information?

l The process computer which feeds the SPDS does not have this capa-bility.

The process computer does " dump" to the Prime computer which does have this capability.

SPDS has capability to display trends?

l l

No, but the Prime computer does have this capability, and it is fre-quently used by the operators.

j Is command structure appropriate to the complexity of the soft-ware?.. 19 the sophistication of the user?

The display holds a great deal of information.

As it is a one-page SPDS, always displayed, it requires little operator manipulation. He must silence a computer alarm to stop the display from flashing in an alarm condition.

However, operators appear to have such a low regard for the i

9 j

system, that flashing '. alarms (in one case witnessed) are not even

. acknowledged.

Upon departure from normal conditions, does the SPDS direct the operator to the appropriate E0P7 If not, is this a significant deficiency?

There is no relationship between the E0Ps and the SPDS. Given that the SPDS is intended to be "just another annunciator," and that all actions are taken based on board instrumentation, it doesn't hurt anything. However, it points out the main deficiency in the SPDS system overall -- it was not conceived or intended to be-integrated with the existing plant instrumentation or with other post-TMI initiatives; therefore, it is ignored by the. operators.

2.2.5 Potential for misleading operators Two main problems for misleading operators exist.

The SPDS frequently displays invalid off-normal conditions because of programming bugs and inadequate calibration.

The computer is frequently down, and the displayed image remains on the screen when the computer is down.

It does display out-of-date information.

Trained operators always look at the clock. display first to see if it is moving.

If not, they know it is out of connission. A new operater might miss this subtlety.

Also, during the review the display i

was frequently indicating off-nnraal conditions because of input problems i

or actual off-normal conditions for power operations with the plant not at power.

Again, a new operator might initiate some unwarranted action based on the display.

The SPDS program does have a high priority of execution within the process computer hierarchy.

2.2.6 Software security There are administrative controls over unauthorized modifications.

2.3 Design Specifications - Hardware i

2.3.1 Design verification and validation Design verification and validation has not yet been performed.

l l

2.3.2 Human Factors Engineering Attachment B provides a human factors assessment of the SPDS displays.

I 10 u_.

f 2.3.3 Reliability The SPDS uses multiple inputs from the process computer which are examined for range.

Valid inputs are compared and/or combined to provide a value which is displayed.

There are two computers which are supplied from uninterruptible power. supplies, The sensors which supply signals to the process computer and the i

isolating devices are classified IE.

2.3.4 Electrical Isolation Validyne CM-249 isolator modulators are used to isolate safety-related signals from the process computer and therefore the SPDS.

These isolators were previously qualified and so no additional qualification needed to be done when the SPDS was back-fitted to the process computer data points.

3.

IMPLEMENTATION 3.1 Procurement Detailed software specifications for Dresden - a similar plant - were reviewed and found acceptaole.

3.2 Installation The SPDS was declared operational on December 31, 1982, to meet a Ceco commitment. However, the V&V on the system has yet to be accomplished.

The algorithm logic used to combine the selected parameters to monitor the critical safety functions on the single page SPDS was prepared by a consultant and then modified and installed by CECO.

The design goal of achieving an adequate SPDS on one page contributed to the complexity of software design, i

3.3 System Verification and Validation l

System verification and validation are yet to be accomplished.

They will be accomplished after the fact on all CECO reactors.

Validation of sensor values is accomplished under a normal plant maintenance and testing program.

To validate the end to end data loop to the SPDS, the value of a parameter as read by the computer and/or SPDS display was compared with the value as indicated on control panel instrumentation.

r 11 i

4.

TRAINING 4.1 Training recipients Training is provided to all licensed operators as a part of their licensing qualification and requalification program. All operators received instruction on the SPDS prior to initial licensing.

SPDS training is not always included in requalification training.

Whether or not it is included is determined by the extent of changes made in the system.

4.2 Training Program Structure The SPDS training is included in the portion of the program which also covers the process computer.

About an hour is devoted to the SPDS.

The training plan was reviewed for content.

It adequately describes the intent of the SPDS and the sources and logic used in its software design and parameter selection.

It also emphastres that the SPOS indications will not be used to manipulate controls on the plant -- control room normal instru-ments will be used to verify the SPOS indications.

The training plan and the plant operating procedures indicate that the integration of the SPDS into plant operating practices has not been accomplished.

It is treated as just another annunciator and receives no special attention during normal operation or during emergency events.

The utility provides the training, which is primarily in the classroom, supplemented by a required reading program to inform operators of minor changes.

The personnel who man the TSC and EDF received separate training on the SPDS covering its implementation at those locations.

At the present time there is no SPDS in the simulator, but one will be installed.

The licensee's training representative during the review stated that all SPDS users were trained in the system prior to its being declared operational.

However, when training records were requested it was pointed out that records which would indicate that an individual did in fact receive the training do not exist.

As the SPOS training is part of the licensing training, the only record maintained is the record of satisfactory licensing examination completion.

Company policy makes each trainee responsible for his own course attendance - the bottom line is that he pass the exam.

If he can do that, they don't care whether or not he attends class.

4.3 Training Program Content As previously stated, the training program on the SP05 is devoted to an explanation of the intended use of the system as an annunciator to give a quick look at plant conditions, and describes the functions presented and the parameters and logic which governs their presentation on the display.-

12

The training program does not cover the integration of the SPDS into the various modes of p ant operation or into the LGAs (E0Ps).

The licensee explained that the SPDS may or may not be covered on the SRO/R0 license examinations.

Of those operators interviewed, none had had any questions on their examinations.

However, they did remember questions on their weekly quizzes covering the SPDS.

The SPDS may or. may not be included in annual requalification training depending on the extent of changes in the system since the original training was done.

Major changes would be included in the formal classroom requali-fication training, but minor changes are handled through a required reading training program.

5.

OPERATION The reviewers saw no evidence that the SPDS is used by the operators.

During interviews, all operators expressed a significant disdain for the system.

Some of this scorn is based on the fact that the process computer is frequently down.

Some may be based on the fact that current operators were not involved heavily during the design and implementation of the system, and some may be because of management's decision to implement a system which met the NRC requirement as quickly and inexpensively

• as possible -- without any consideration of its integration into the plant operational or emergency procedures.

The reviewers noted that operators failed to silence alarm conditions appearing erroneously on the display during normal operation of the plant.

One channel of APRMs gave a false ATWS indication on the reactor power display bar graph.

As the cause was known, the operators tended to ignore it.

A similar situation was noted on the Rad Release alarm block.

The latter is caused by the inability to change the alarm set point in the computer.

The licensee intends to fix this item by taking the signal from the plant panel instrumentation.

The operator interviews consisted of interviews with a shift engineer and senior control room operator. The main comments from the interviews are listed below.

The SPDS provides the operators with an instantaneous reading of parameter status.

The operators indicated that it would be more valuable to display parameter trend rather than instantaneous values.

The display remains frozen on the screen when computer goes out of-commission.

The operators indicated that this could mislead an

operator, so they always check the time clock which will be stopped if the computer is down.

13

The shift engineer was penalized because he did not document the fact that SPDS was out of commission during a reactor trip.

The NRC resident inspector informed him that even though the SPDS is not safety grade, its status during an emergency must be reported to the NRC as a tech spec violation.

This causes the shift engineer to look upon the SPDS as a device which can only " bite" him rather than aid him.

The SPDS is unreliable.

The operators have a negative attitude toward the SPDS.

But, that is not to say that they resist computer generated information.

They do like and use other computer generated information such as system status diagrams.

6.

MAINTENANCE 6.1 Software Maintenance There is a formal procedure to control software modifications (LTP-1800-18, Rev. O dated August 1984).

6.2 Hardware Maintenance There are procedures for calibration of sensors and for surveillance.

There is no SPDS service manual as the system is basically a software system and functions in conjunction with the process computer. Maintenance appears to be based on the "fix it when it breaks" concept rather than on a preven-tative maintenance program.

6.3 Configuration Control The licensee utilizes a change control system which has many checks and balances and utilizes human factors personnel in the approval process.

Documentation of changes and approvals seems adequate.

14

NDN*

O:

i l

t' ATTACHMENT A CRITICAL SAFETY FUNCTION PARAMETERS 15 L~

ATTACHMENT A - Critical Safety Function Parameters CRITICAL SAFETY FUNCTION

1. Reactivity Control APRMs (6).

SRMs (,4)

2. Reactor Core Cooling Primary Heat Removal Reactor Water Level (Upset Range / Wide Range / Wide Range / Fuel Zone Range)

Core Spray

3. Reactor Coolant System Integrity Reactor Pressure (Wide Range / Marrow Range)

Drywell Pressure (Wide Range / Marrow Range)

Co9tainment Activity Safety Relief Valve (SRV) Position Primary Containment Isolation System (PC15) I and 2 Valve Positions

4. Radioactivity Control Off Gas - Pretreatment Monitor SBGT Radiation (Low P.ange/Mid Range /High Range)

SGBT Flow Main Chimney Radiation Main Chimney Flow Liquid Radwaste - Discharge Monitor Plant Service Water - Discharge Monitor RHR Loop "A" Discharge Monitor RHR Loop "B" - Discharge Monitor

5. Containment Conditions Drywell Pressure (Wide Range / Narrow Range)

Drywell Temperature Suppression Pool Level (Wide Range / Narrow Range)

Suppression Pool Temperature Primary Containment Isolation System (PCIS) 1 and 2 Valve Position 16

~-

S y.

{

)

)

)

i 1

l ATTACHMENT B HUMAN FACTORS ENGINEERING ASSESSMENT i

L i

f I

l

)

)

e L

l.

)

)

(

)

17

ATTACHMENT B HUMAN FACTORS ENGINEERING ASSESSMENT Evaluation plan to assess human factors principles in VDU designs.

Adaptedfrom"HumanEngineeringGuidelinesfortheEvaluationandAssessment of Video Display Units W.E. Gilmore, May, 1985.

Score: OK or NO Visual Displays a.

Evaluate the display for image quality and legibility (by visual observation; adjust brightness control) 1.

Flicker OK 2.

Contrast Ratio OK except for red 3.

Brightness OK 4.

Resolution / Sharpness NO 5.

Phospher Persistence 6.

Glare Control OK 7.

Screen Resolution OK Comments:

b.

Screen structure and content 1.

Cursor Design 2.

Text (Prose) Characteristics (text content evaluated later) a.

Concrete OK b.

Organized, grouped OK c.

Easy to comprehend OK d.

Avoids double negatives OK e.

consistent format OK 3.

Labeling a.

Concise b.

Familiar OK c.

Visibility / legibility Visibility - OK Legibility - N0 d.

Capital vs. lower case Capital e.

Size graduation Depends on parameter f.

Distinct from data g.

Consistency OK 4.

Messages a.

Factual 0K b.

Short and meaningful OK c.

Simple sentences N/A 18

r 3

L l

d.

Stated in the affirmative e.

Useful/ understandable Understandable 5.

Abbreviations 6.

Error statements a.

Entry error is flagged OK - error signal in cyan (blue) b.

Statement is specific c.

Brief and informative OK d.

Neutral / polite wording OK e.

Minimize disruption OK f.

System response time 5 sec 7.

Alphanumerics a.

Code is consistent / standard OK b.

Meaningful and short OK 8.

DataDisplay(obtainasamplepageofdisplayeddata) a.

Data presented to reduce search time OK i

b.

Directly useful for task OK

• c.

Consistent / standard OK d.

Does not rely on user memory OK e.

Info limited to user needs NO - rate i

of change f.

Info perceptually organized OK 9.

Data Entry a.

Devoted function keys or simple comand N/A b.

Distinctive prompts Coments:

i l

C.

Alphanumeric Characters 1.

Font or style Caps 2.

Character size and proportion OK 3.

Character case OK 4.

Emitter size, shape, spacing 0K Comments:

D.

Screen Organization and Layout 1.

Screen Size (Inspect from normal viewing distance) i 19" diagonal 19

a.

'Information is discriminative and legible.

N0 for letters /YES for bars and blocks 2.

Grouping Data is functionally or meaningfully grouped.

OK a.

b.

Grouped data is consistently p aced.

OK 3.

Display Density a.

Info density is reduced.

OK 4.

Display Partitioning a.

Techniques applied to organize screen elements.

OK -

grouped by white demarcation 5.

Frame Specs / Info Location N/A 6.

Interframe Considerations N/A E.

Visual Coding Dimensions (Identify all coding dimensions),

1.

Color Yellow - numbers for bars White - actual parameter number Blue - outlines and out of spec Red - out of spec Green - normal 2.

Geometric / Shape Coding Geometric 3.

Pictorial Coding 4

Magnitude Coding 5.

Visual Number Coding l

6.

Inclination Coding (Collectrelevantdimensionsforevaluationagainstguidelines.)

t use of Color -

o Identify all uses and contexts of color (meanings)

(Text, background, symbols, lines,etc.)

o Is color used as a redundant means to attract attention?

(Ex: redundant to blinking)

Blue o

Identify which colors displayed simultaneously Red on Red and which are adjacent to one another.

Red on Green o

Does display have a control to adjust brightness?

YES Does it affect color contrast?

YES i

o What colors used for fine detailed text?

l (On what background?)

e Does use of color exhibit cognitive fidelity with user expectations?

Look at other uses or contexts of color in control room (and particularly displayed information.)

o Do any colors appear blurred?

l 1

20 r

V

o Is any information difficult to read or perceive because of color?

F.

Enhancement Coding Dimensions 1.

Brightness 1

2.

Blink Coding 3.

Image Reversal 4.

Auditory Coding 5.

Voice Coding 6.

Audio-Visual Warning and Signal Devices a.

Visible Alarms Supplement Audible Ones for high noise conditions.

No b.

Visible indication is within 60 degrees of direct line of sight.

OK c.

Dimensions applied to visible indication for attention getting and to distinguish priorities.

OK d.

Dimensions combined for high attention-getting value.

OK e.

Visible dimensions sensed from long-viewing distance.

OK f.

Absence of visual indication denotes normal.

OK (Collect relevant dimension and applications for later evaluation against gulhlines.)

G.

Dynamic Display Characteristics (Observe screen in a dynamic mode to assure that dynamic features can be detected and that dynamic features do not legibility of critical informa-l tion.

1.

Display (animated) motion OK 2.

Digital counters N/A 3.

Rate of change is perceivable i

YES 4.

Graphic displays are updated at a rate consis-tent with operator data handling capabilities H.

Information Formats

($hort of a task analysis, assess the formats capability to meet operatorinformationrequirements.)

1.

Format provides concise information needs OK 2.

Info is limited to isusediate needs and direct to actions OK 3.

Info is directly usable OK 4.

Graphic display techniques are limited in variety OK 21

5.

Info is displayed to appropriate limits and precision required for actions / decisions 6.

Redundancy is avoided unless needed for reliability OK 7.

Operator and maintainer info is not combined on a a single display N/A 8.

Failure of disp ay is clear NO 9.

Demand and actual status is differentiated N/A 10.

Format is most natural or expected OK 11.

Format is effective for environment and viewing conditions 12.

Formats exhibit " good" H.F. standards:

a.

Legible N0 b.

Uncluttered OK c.

Consistent OK d.

Labeled OK e.

Visible N0 f.

Conspicuous NO g.

Interpretable OK 13.

All parts represent the whole (as in multiple dimensional formats) and are parameters legible and discriminable 14.

Do formats that attempt to provide pattern recognition cues actually aid detection of abnormal events?

YES Comments:

11. Controls A.

Keyboard Layout and Dimensions N/A 1.

Keystroke feedback 2.

Key actuation forco 3.

Key rollover 4.

Key travel 5.

Key color / labeling characteristics 6.

Key dimension / spacing 7.

Keyboard slope 8.

Keyboard thickness 9.

Special function keys 10.

Auxiliary numeric key set 11.

Alternate input device Cassents:

22

I D

111. Control / Display Integration N/A A.

User Dialogue 1.

Dialogue design suited to task.

2.

Menu design a.

Compatible with control action b.

fact 11tates accuracy / speed c.

Menu hierarchically organized 3.

Comand language (N/A) 4.

Query language (WA) 5.

Natural language Commnts:

B.

System Feedback to User Actions (QuestionoperatorsandobserveVDU) 1.

Display Update Rate a.

Time lag between component and display value b.

Parameter values and realtime time c.

Update time 3 s or less 2.

Response Time a.

Values appropriate for task or 2 4 s max 3.

System Status Indication a.

Adequacy of indicator 4.

Routine Status Information a.

Error messages, prompts OK,

b.

Alarm setting basis given i.e., variables covered and critical values OK c.

System gives up to date account OK 5.

Performance Job Aids a.

User finds system easy to use and helpful for the task (Assessthesefeaturesfortheireffectivenessin closing the loop" between the operator machine inter-face) 23 i

IV. Workplace Layout A.

Anthropometric Aspects of the VDU Workplace 1.

Keyboard dimensions N/A 2.

Screen height and viewing angle Too high 3.

Viewing distance Poor readability 4

Screenorientation(ttit)

Not enough 5.

Chair characteristics N/A 6.

Hard copy printer N/A 7.

Health and safety factors N/A Connents:

I l

i i

l l

24 L

g.

_7 i

b l

i g

i l

I r

I i

t I

I L

I i

i ATTAc etNT C t

t i

Co W0 WEALTH EDISON CO.

DRE10(N. QUAD CITits. LasALLE SAFETY PARAMETER DISPLAY SYSTEM l

i F MCTIMAL SPECIFICATION r

r i

i I

i

?

I I

a T

t.

I i

P I

I i

i I

i I

i f

Il I

i

~.

Y.... _ _ _

4 r

1 P

I COMMONWEALTH EDIS0N CO.

DRt50tN. QUA0 CIT!!$. LASALLE 5ArtTV PARAMETER 0!$ PLAY SY5ftM FUNCTIONAL SPECIFICATION i

p i

L f

i i

t l

Rev. 1 2 16 83 I

f l'

26 i

4 w

I l

l

,1.

PURPOSE f

The purpose of the Safety Parameter Display System ($p05) is to satisfy the intent of NRC criteria contained in the NUREG-0585, huREG-0660, and NUREG-0696.

t f

2.

OBJECTIVE F

Provide.one or more displays in the control room which will aid i

l operating personnel to assess the safety status of the plant.

/

3.0

' DEFINITIONS The reaning of the words and terms, in content of their use in this l

specification, shall be in accordance with the following c

definitions.

(

" 3.1

$afe State of the Plant:

A SWR nuclear plant is defined to be in a

[

F-Saft state when the core is adequately cooled when reactivity is contro11ee; when the integrity of reactor cool' ant system and 1

L.

containment is maintained; and when in-plant and effluent (to l

f environment) radiation levels are within specified limits.

3.2 Safety Parameter:

Tne safety parameter is defined to be the H

quantitative / qualitative or binary measure of accompitshment or maintenance of the safety f unctions id'entified in paragraph 3.1.

[

3.3

$afety Parameter Display $ystem:

The SPOS is defined to be a display system which will aid rporating personnel to assess the

[

safety status of tte plant.

F 3.4 Verificationt The verification is defined to be a procedure to L

ootain incFHsed assurance that the indicated value epresents the true value of a process variable.

3.5 Validation

The validation is defined to be confirmation of the Tnpul signal to se within the range of the sensor / instrument.

[

3.'6 Primary Variable:

The primary variables are defined to be the monitores var 14 Dies that provide the most direct indication needed r

to assess the status /value of the safety parameter.

L 3.7 Isolation Valve Grovost Isolation valves to be monitored belong to l

leo groups.

Talves in Group 1 are en process lines that U

communicate directly with the reactor vessel and penetrate the i

primary containment.

Valves in Group 2 are en process lines that g

do not directly communicate with the reactor vessel but penetrate the primary containment and communicate with the primary containment free space.

1 m

21 i

L

4.0 APPLICABLE DOCUMENTS a.

NUREG-0660 e.

NUREG-0585, pubitshed October 1979 j

c.

NRC $P05 Functional Specification Draft of July 8, 1980 (Part

{

of NUREG-0696) 5.0 CRITERIA l

5.1 The Safety Parameter Display (SPD) shall be located in the control l

room and shall attract the attention of the operating personnel when there exists a trend or condition towards degradation in the

}

safety parameters of the plant.

3 l

5.2 The Safety Parameter Olsplay (SPD) shall be located such that it is

[

accessible and visible to operating personnel and be distinguishable from other displays.

\\

l 5.3 The SPD shall not inhibit physical or visual access to operator I

interfaces with normal and operating systems located in the control room.

l 5.4 The SPD shall be designed for continuous operation.

r l

5.5 ine SPD3 shall be capable of functioning properly in the l

environment present during normal and abnormal conditions.

l 5.6 The SPDS need not be designed to function during or after an i

Operating Basis Earthquake (OBE) event.

5.7 The SPDS shall be of proven high quality and reliability.

5.8 Range and accuracy of instrumentation shall be consistent with l

intended use.

n 5.g Means shall be available to validate the parameters associated with l

the SPDS.

Provision shall be made to alert operating personnel to any unsuccessful validation.

5.10 Any interface between the SPDS and the safety systems shall be through isolation means.

)

5.11 Design provisions shall be included in the interfaces between the i

SPDS and the non-safety systems to ensure the integrity of the SPDS.

l 5.12 Class it que11fication of the SPD5 is not required.

5.13 The SP05 need not satisfy the single failure criterion.

[

l 5.14 No operating personnel other than normal control room operating t

staff are required for SPOS operation.

i i

f 28 l

o 5.15 The SPDS shall be designed and arranged to ensure operability and maintainability, in addition, the SPD design shall consider the following Human Engineering criteria:

a.

Grouping by function and systems.

b.

Presentation of information in directly usable form (minimal mental cocputing, transposition and interpolatien).

c.

Minimization of reflection and glare.

d.

Consistent use of color, shape, size and location coding.

e.

Orientation of information displays with respect to operators line of sight.

6.0 DESCRIPTION

AND REQURIEMENTS

6.1 Scooe

The SPDS Shall present the value or status of the primary vartaoles (see Paragraph 6.1.1) of the following safety parameters:

t a.

Core cooling o.

Reactivity c.

Reactor coolant system integrity d.

Centainment integrity

-i e.

Radioactivity release to the environment.

The SPDS constitutes the display of the primary variables associated with the above safety parameters.

Additional variables currently displayed or available in the present control room design should be used by the operator for additional variable verification.

6.1.1 $PD$ Safety Parameters and Associated Primary hariables carameter Primary Variables l

Core cooling Reactor water level

.I Core spray operation Reactivity SRM log count rate l

APRM 5 power Reactor coolant system Reactor pressure, drywell pressure.

'l integrity Containment activity.

RPV isolation,*

Safety relief valve position I

29 l

Containment integrity Drywell pressure Containment isolation valve position

• Suppression pool temperature Suppression pool level, Drywell temperature Radioactivity release Radiation level at planned plant to environment release points **.

6.2 Parameter

Description:

This paragraph provides the following information regarding each safety parameter:

Identification of the primary varisoles which are used by the a.

SPDS to provide the measure of the safety parameter.

In certain cases a brief analysis is included to demonstrate that the identified process variable (s) provides an appropriate measure of the safety parameter.

References 1 and 2 provide additional explanation justifying parameter selection.

b.

Identification of existing instrumentation associated with the primary varaibles.

This Information will enable the system designers to utilize as much existing instrumentation as practicable.

c.

Identification of the existence of know error (s) in measured process variables and the plant conditions in which such error (s) may exist.

The identification of these errors is provided for operator awareness to ensure verification of inoications with other, diverse instruments.

d.

Signal Verification / Validation.

This information indicates the method used by the SPDS to validate the status /value of the parameter.

6.2.1 Core Cooling:

The 8WR normally operates under saturated conditions with approximately 705 void fraction at the core exit and with saturated steam in the upper region of the reactor pressure vessel (RPV).

Since the 8WR fluid is essentially saturated, it is not necessary to measure the transition from a subcooled to a saturated condition.

Therefore, the primary method to assess adequate core cooling in SWR's is to use a direct measurement of reactor water level.

Analyses and measurements have confirmed that natural circulation capability is an inherent SWR feature.

There are no traps which might block the natural circulation.

Steam and noncondensibles all rise to the top during normal operation and during accident conditions.

As long as there is adequate water level, there is Includes the valves in isolation Groups I and !!.

CD ]Ccludes off-gas pretreatment radiation, ventilation system release rates, and liquid effluent releases.

30

r e

(

assurance of adequate core cooling.

The reactor vessel water level is therefore, the primary indication of the adequacy of j

core cooling in the BWR; conversely, an inadequate or decreasing water level is the indication of approach to inadequate core i

cooling.

For conditions when water level cannot be maintained or determined, core cooling is provided by operation of the core spray system.

Measurement of design flow of either core spray subsystem is sufficient to verify adequate core cooling.

6.2.1.1 Instrumentation:

Instrumentation of reactor water level generally consists of numerous indications of reactor water level to the reactor operator and are in full view, either on the reactor control console or nearby panels.

These indications are comprised of the following:

a.

Wide range level indicator b.

Wide range level recorders c.

Narrow range level indicators d.

harrow range recorder e.

Fuel zone level indicator f.

Fuel zone level recorder g.

Shutdown range level indicators l

The $PDS displays utiltre 9 water level instruments at LaSalle and 7 water level instruments at Dresden and Quad Cities to develop a full range, composite water level signal (see References I and 2).

The signals are compared and/or combined to provide the most accurate single value of water level available.

In extreme circumstances when water level cannot be determined by level instrumentation, core cooling is verified by measurement of design core spray flow.

The SPDS displays use direct measurement of core spray flows taken from tne core spray flow sensors (one low pressure (LP) and one high pressure (HP) at LaSalle and two LP's at Dresden and Quad Cities) as described in References I and 2.

6,2.1.2 Error Identification No plant condition related errors are expected in the measurement of core spray flow rates.

f 31 l

6.2.1.2.1 Water Level Calibration Errors at High Drywell Temperatures:

~

a.

Yarways.

Possibility of instrument reading higher than l

actual water level, b.

Cold Reference Leg.

Same general potential consequences as for Yarway instruments.

6.2.1.2.2 Water Level Errors Due to Flashing During Rapid Depressurization:

a.

Yarways.

Erratic behavior below 250 psia.

b.

Cold Reference Leg.

Possible erratic behavior below 118 psia.

6.2.1.2.3 Water Level Errors Due to Long-Term Boiling After Depress:rization (Botn Instrument Types):

Possible large errors developing slowly (time scale of hours) if drywell temperature remains above RPV saturation temperature (possible only for a small and intermediate steam break without filling RPV to the elevation of the break, or for loss of drywell coolers with depressurization at such a rate that drywell temperature exceeds RPV saturation temperature).

6.2.1.3 Signal Verification / Validation:

References 1 and 2 identify the means of verification which will provide the most accurate value of reactor water level.

Basically, verification is performed by cross correlation of readings from two or more sensors.

The trend displays indicate the rise / fall of water level.

The core spray flow rates are verified by comparison of measured flow with calculated flow from pump head curves using measured pump discharge pressures (see References 1 and 2).

6.2.2 Reactivity

The neutron instruments shall be the primary variables for determining this parameter.

In.the event of a scram, the SRM's are inserted to monitor subcriticality.

6.2.2.1 Instrumentation:

The SPDS displays will use the 4 SRM channels and the sin APRM channels to display reactor power (see l

References 1 and 2) 6.2.2.2 Error Identification:

The plant condition re' lated SRM and APRM instrumentation errors are negligible.

6.2.2.3 Signal Verification / Validation:

Comparison of redundant channel readings will be used to verify the SRM and APRM values.

The readings will be selected or combined to provide the most accurate t +1ue available as described in References 1 and 2.

32 L

A 4

6.2.3 Reactor Coolant System Integrity: ~ This parameter can be assessed

.by, monitoring the following variables:

a.

Reactor Pressure b.

Drywell Pressure c.

Containment Activity d.

RPV Isolation e.

SRV positions 6.2.3.1 Instrumentation:

Generally, all primary variables are indicated and/or recorded in the control room, and utilized by the SPDS displays as indicated in References 1 and 2.

6'.2.3.1.1 Four reactor pressure signals are transmitted from separate pressure transmitters and used by the SPDS for reactor pressure indication-as described in References 1 and-2.

6.2.3.1.2 The drywell pressure varies slightly during reactor operation and is monitored by three pressure sensors.

The pressure l

fluctuates slightly as a result of barometric pressure changes and out-leakage.

A pressure rise above'the normally indicated values will indicate a possible leak within the drywell.

Pressure exceeding the preset values will be annunciated in the main control room and safety action will be automatically initiated.

The SPDS utilizes the pressure inputs as described in References 1 and 2 to display drywell pressure.

6.2.3.1.3 Containment activity may be used to determine reactor coolant system integrity by measuring radioactive release to the drywell.

See Section 6.2.2 for additional description.

6.2.3.1.4 The reactor isolation is verified by positjon indication of RPV isolation valves and safety relief valves.

Most of the isolation valve indicator lights are located on the ECCS bench board or containment status panel in the control room.

The SRV position is determined by accoustic sensors installed at the SRV discharge lines (Dresden/ Quad Cities) or by valve position limit switches installed on valve movement mechanisms (LaSalle).

References 1 and 2 describe the use of these inputs by the SPDS display.

6.2.3.2 i;rror Identification:

These process variables are not subject so large errors.

Instrument accuracy is expected to deteriorate under adverse environmental conditions.

33

m 1

I i 6.2.3.3 Signal' Verification / Validation:

These variables are verified as described in References 1 and Z.

In some cases. redundant signals are combined to provide the most accurate value for the

. variable.

Verification of isolation function is by determination of either of two redundant valves as being closed.

6.2.4 Containment Intenrity:

This parameter can be assessed by measuring tne fo'lowong process variables:

a.

Drywell pressure b.

Containment Isolation (containment isolation valve position) c.

Suppression pool temperature d.

Suppression pool level e.

Drywell temperature 6.2.4.1 Instrumentation:

Generally, all primary variables are indicated and/or recorded in the control room.

The SPDS display of these variables is described in detail in References 1 and 2. and briefly below.

6.2.4.1.1 The display of drywell pressure was discussed in Section 6.2.4.1.2.

6.2.4.1.2 Containment isolation is determined by position indication of Group I and II containment isolation valves.

Digital inputs from valve position limit switches will be monitored by the

.SPDS to assess successful isolation.

,6.2.4.1.3 Suppression pool temperature is measured by thermocouples/RTD(s) distributed around the pool.

The sensor inputs will be processed by the SPDS to determine the bulk Pool temperature.

i 6.2.4.1.4 The suppression pool water level will be monitored by three independent water level instruments, one narrow range and two wide range.

6.2.4.1.5 The drywell temperatures are monitored by thermocouples/ RID's located in the drywell air space.

Two local sensors at Dresden and Quad Cities, and four average temperature indications at LaSalle will be used by the SPDS to indicate drywell average temperature.

'6.2.4.2 Error Identification:

No plant condition related error is expected to be present in the following measurements.

4 a.

Drywe11 pressure i

I 34

b.

Containment isolation (containment isolation valve position) c.

Suppression pool temperature d.

Suppression pool level e.

Drywell temperature 6.2.4.3 Signal verification / Validation:

Comparison of signals will be used for verification of the following primary variables as described in References 1 and 2:

a.

Drywell pressure b.

Suppression pool temperature c.

Suppression pool level d.

Drywell temperature For groups 1-and 2 there are two isolation valves in series for each process line.

Position indication is provided for both valves.

Isolation is verified if one of the two valves is closed.

6.2.5 Radioactivity Release to the Environment:

This parameter can be assessed by monitoring the radioactivity at planned plant release points identified below.

Further detail on the selection end description of these variables is provided in References I and 2.

a.

Main plant chimney b.

Liquid Radweste c.

Service Water Discharge

• d.

RHR discharge

• e.

Reactor Building Vent Exhaust (D/QC) f.

SBGT Exhaust (LaSalle) g.

Off Gas Pretreatment a

I 6.2.5.1 Instrumentation:

I 6.2.5.1.1 The main plant chimney effluent activity shall be measured by ingtrumentation covering three ranges f rom 10-7 uti/cc to 103 uCi/cc.

The measured activity will be mathematically combined with a measured flow rate to produce a release rate.

oCombined at Dresden/ Quad Cities i

I 35 l

l m

4 1

F 6.2.5.1.2 The effluent paths from liquid radwaste, service water *, and RHR discharge

• shall be monitored using existing radiation detectors.

Increased levels of radioactivity in these effluent paths will be identified to the operator when preselected limits are exceeded.

6.2.5.1.3 The reactor building vent exhaust (D/QC) and the S8GT exhaust (LSCS) effluents shall be monitored the same as the main chimney identified above in 6.2.6.1.1.

6.2.5.1.4 The off gas pretreatment radiaton shall be measured using existing log radiation monitors (only one at LaSalle).

t 6.2.5.2 Error Identification:

High area background radiation, plateout, e

I or deposition could cause erroneously high readings and should be accounted for.

g 6.2.5.3 Signal verification / Validation:

Comparison of signals from overlapping ranges will be used by the SPDS to verify the Main Plant Chimney, Reactor Building Vent Exhaust, and SBGT Exhaust signals as described in References 1 and 2.

Comparison of recundant off gas monitors at Dresden and Quad Cities will be used for signal verification.

6.3 REQUIREMENTS 6.3.1 Instrumentation Requirements 6.3.1.1 References 1 and 2 define the following for each primary variable:

a.

Sensor (s) b.

Range c.

Validation / verification techniques 6.3.1.2 The SPDS power supplies shall match the SPDS equipment in quality and reliability.

The power supply failures or fluctuations shall not cause the loss of data already recorded for trend displays.

The SPDS load shall not degrade the capability or reliability of any safety related power source.

6.3.2 Control Room Display Requirements Display formats must include pattern and coding techniques to 6.3.2.1 assist operator's memor,y recall for detection and recognition of unsafe conditions.

6.3.2.2 The SPDS shall display pertinent information during steady state and transient condition.

6.3.2.3 Capability shall exist to present magnitude and trends as necessary to allow ra'pid assessment of the current plant status.

cCo:bined at Dresden/ Quad Cities 36

' 6.3.2.4 Displayed variables shall be sufficient to indicate the status of.the plant and shall be responsive to transient and accident sequences.

6.3.2.5 A' summary-display format consisting of the plant parameters f rom which~the overall safety status of the plan may be depicted shall be provided.

6.3.2.6 The-SPDS may consist of several secondary _ display formats in addition to the; summary display.

These formats-shall be capable of random (operator selected) selection.

6~.3.2.7. Operator interaction capability may be provided.

~6.3.2.8_

For all modes, a single primary display format consisting of principal process variable and where applicable their trends shall be routinely displayed from which the plant safety status may be inferred.

6.3.2.9 The SPDS may include other functions which aid operating personnel in evaluating plant status.

6.4 Normal Value/ Status of Primary Variables:

Tne normal, marginal and upset value(s)/ status of tne primary variables is a function of' plant mode of operation, plant design and plant technical specifications.

The SPDS Functional Description shall identify each primary variable's normal and upset value for all modes of plant operation.

6.4.1 The limits' identified in Paragraph 6.4 shall be consistent, where practical, with existing plant alarm / trip points.

6. 4..'

The limits shall be used to alert the operator to degrading condtions affecting the safety status of the plant.

6.4.3 The SPDS displays shall include the display of the primary variable; status /value and the normal and upset values.

}

7.0 References 1.

5. Levy, Inc. Report, SLI-8123, Rev. I "LaSalle Units I and II Safety Parameter Display System".

2.

S. Levy,~Inc. Report, SLI-8202, Rev. O " Quad Cities Units I and II Safety Parameter Display System".

k

'1856L*

37

.s

,-.---~-------.r,---.,_.-----._,,_N.,%.,h_--~....mt,...._..m..,

_.Y i

s 1

e l

~

I i

COMMONWEALTH EDISON CO.

LASALLE COUNTY STATION SAFETY PARAMETER DISPLAY SYSTEM FUNCTIONAL DESCRIPTION.

i Rev. 1 38 2/15/83 R

3 i

1 Purpose I

1.0 Ine purpose of the Safety Parameter display System (SPDS) is to provide to the reactor operator in a single location the value/ status of primary variables which i

directly indicate the status of the safety parameters indicating the accomplishment or maintenance of plant safety functions. Plant safety functions are core cooling, reactivity control, reactor coolant system integrity,

' 6 containment integrity, and radioactive effluents.

The SPDS functions as an indicator only and it is intended that all SPDS readings be confirmed by the operator using existing control room instrumentation.

L 2.0 DEFINITIONS The meaning of the words and terms, in context of their use in this specification, shall be in accordance with the following definitions.

2.1 Safety Parameter:

The safety parameter is defined to be the quantitative / qualitative or binary i

measure of accomplishment or maintenance of the safety functions identified in Paragraph 1.0.

2.2 Verification

Tne verification is defined to be a procedure to obtain increased assurance that the indicated value represents the true value of a process variable.

2.3 Validation

Tne validation is defined to be confirmation of the input signal to be within the range of the sensor / instrument.

2.4 Primary Variable:

Tne primary variables are defined to be the monitored variables that provide the most direct indication needed to assess the status /value of the safety parameter.

3,0 Description 3.1 Primary Display The basic primary display format is shown in Figure 1.

The display consists of three main sections.

3.1.1 Heading

This section contains the display title, the station and unit being displayed, and the time of day.

39 s

I

)I '

3.1.2 Bar Graphs:

l reactor water level, This section contains bar graphs for seven variables:

i reactor pressure, drywell pressure, drywell temperature, suppression pool Associated with level, suppression pool temperature, and reactor power.

each bar graph is the variable name (below the graph), digital display of variable value, and digital display of rate of change and direction The bar (increasing / decreasing) of the variable (both above the graph).

Primary system variables, graphs are separated into three groups:

containment variables, and rear. tor power.

3.1.3 Status Boxes:

This section contains five boxes riisplaying the status of five variables / parameters: core spray systea operation, safety relief valve positions, primary containment isolation, containment radiation, and radioactive release to the environment.

.2 Secondary Displays L

No secondary displays exist at tnis time.

.3 Colors 3.3.1 primary Display Colors Tne following colors and associated functions are used on the SPDS primary i.

color graphic display:

l Cyan - Borders Engineering Units j

Digital values (invalid inputs)

Bar Graphs (invalid inputs)

Status Boxes (invalid inputs)

Scale Value Lines l

Heading White - Rate of change value Digital Value (nomal)

Time of Day Green - Bar Graphs (nomal) )

Status Boxes (nomal l

Nomal Values and Value Lines l

Yellow -Scale Values and Lines Words in lower portion of status boxes.

Bar Graph Titles Red

- Alam Value Lines Bar Graphs (alam)

Status Boxes (off nomal)

Digital Valve (alarm) 40 r - rr_r__

3 4.0 Primary Display General Operation 4.1 Bar Graphs, Digital Values, Trends (Rate / Direction of change)

Tne seven bar graphs and digital values are composed points generated from multiple inputs. The inputs are sampled at five second intervals. The inputs are first validated by comparing the electronic input signal with the instrument range.

Invalid (out of range) inputs may be used to verify the accuracy of valid inputs but are not displayed.

Valid inputs are compared and/or combined to l

provide a verified, accurate value for the variable. This value is displayed as a digital value (top of bar graph) and as the relative height of the bar.

This verified value is also compared with the previous value and a direction and l

rate of change calculated and converted to units / minute and displayed and updated every five seconds.

l If no valid inputs are available or a valid input is contradicted by other inputs, then tne displayed variable is considered to be unverified and invalid. The SPDS I

will notify the operator of this condition.

Each bar graph is typically provided with a green bogey (expected value) line l

based on normal 100% power conditions and two red alarm lines (high and low) located at the alam limits.

Insividual bar graph configurations are discussed later.

4.1.1 Digital Value Displays The following changes are provided by the SPD5 for the composed / Calculated a

variable digital value displays:

Nomal: Validated composed / calculated value within alam limits displayed in WHITE.

Al am:

Validated composed /calcualted value above/below alarm limits displayed in FLASHING RED.

Acknowledged Alam:

Validated cot. posed / calculated value above/below alarm limits 5

displayed in RED after alarm condition is acknowledged by the operator.

Invalid inputs: Value displayed as CYAN ASTERISKS.

4.1.2 Trend value displays Tne following changes are provided by the SPDS for the composed / calculated variable trend value displays:

Normal: Calculated Trend Value and direction displayed in WHITE.

Al a m, Acknowledged Alam:

No change from normal conditions; no alarm conditions exist for trend values.

41

. Invalid Inputs: Trend value displayed as CYAN ASTERISKS.

-4.1.3 Bar Graph Height and Color Changes Tne height of the bar graph is. proportional to the composed / calculated value of the variable and is accompanied by the following color change;:

Normal: Bar is displayed GREEN for values within the alarm limits.

Alarm:

Bar is displayed FLASHING RED for values above/below alarm limits.

Acknowleged Al arm:

Bar is displyed RED for values above/below alarm limits af ter slarm is acknowledged by operater.

Invalid Inputs: Bar is displayed FULL SCALE CYAN.

4.2 Status Boxes Tne five status boxes indicate the norrsl/ alarm condition of functions, components, or variables relating to the safety parameters.

The input variables are validated and verified where possible as outlined in section 3.1.

Tne inputs are then compared against pre-determined values or conditions to ascertain the normal or alarm status of the function, component, or varialbe being displayed.

Abnormal or alarm conditions will cause the upper portion and outline of the box to change color from green to red. Loss of valid inputs will cause the color to l

change to cyan. Wording in the bottom of the box will change according to the status of the monitored function, component, or variables.

5.0 Safety Parameters and Associated Displays 5.1 Core Cooling The adequacy of core cooling is assessed by measuring reactor water level and operation of the core spray systems (Reference 1).

Verification of reactor water level to be above 2/3 core height is sufficient to ensure adequate core cooling.

If water level indication is lost or level cannot be determined, verification of design flow rates in either the low pressure or high pressure core spray system is sufficient to ensure adequate core cooling.

5.1.1 Reactor Water Level Reactor water level is indicated using the RX LEVEL bar graph with associated value and trend digital displays.

The values displayed are a composite of the following water level inputs:

42 I

u - --

- Upset Range (1 input)

O to 180' inches I:

Narrow Range (2 inputs) 0 to 60 inches Wide Rnage (4 inputs)

-150 to 60 inches Fuel Zone Range (2 inputs)

-311 to -111 inche's

{

The input signals are processed as shown in the block digram of Figure 2.

The selection / combination of signals to be displayed is based on the

.[.

following selection priority; considering the availability of.

valid / verified input values:

Narrow Range

.r 1..

Wide Range i

L 2.

3.

Fuel Zone Range 4.

Upset Range

"~

The following values are indicated on the bar graph:

[

Bogey:

35 inches (green line)

High Alam:

54.5 inches (red line) b Low Alam:

12.5 inenes (redline) p L

L 5.1.2 Core Spray Operation Core spray system operation is indicated using the CORE SPRAY ON (OFF) e g

status box to alert the operator to off-nomal operation. Tne inputs 4

consist of high and low pressure systems flows and pump discharge pressures.

The measured flows are verified by comparison with pump design r

f flow / pressure characteristics using the discharge pressure inputs. Core I

spray demanG is detemined from reactor level and drywell pressure values.

If a demand signal is present and neither the high nor the low pressure system are operating at or above design flow conditions (3500 gpm for HPCS

,f i

and 6350 gpm for LPCS) the status box will indicate an alarm condition. At i

greater than 1000 gpm on either system the wording in the lower portion of i

r the box will change to ON from 0FF. Figure 3 is a, block diagram of input t

processing.

j

'5.2 Ree:tivity Control I

' Reactivity control is assessed by the measurement of reactor power level I

(Reference 1).

The reactor power level is indicated using the RX P0elER bar graph and associated digital value and trend displays.

Inputs to the reactor power measurement are the six APRM's and four SRM's.

If the APRM's are reading onscale

-in run or startup, they are used to detemine power level; in shutdown and refuel when the APRM's are downscale the SRM's are used with preference given to SRM's which are inserted. Following a scram demand signal, an SRM reading above 105 or APRM's on scale could indicate a f ailure to scram. Figure 4 provides a block diagris of signal processing.

The following values are indicated on the bar graph:

Bogey:

1005 power -(green line)

High Alam:

1105 power (red line) y Low' Alam:

None provided 43

r-

-.. ~

............ -. ~...

_ 5.3 Rea: tor Coolant System Integrity Maintenance of reactor coolant system integrity is assessed by the measurement of reactor pressure, drywell pressure, containment activity, safety / relief valve (SRV) positions, and isolation of PCIS valves in groups 1 and 2 (Reference 1).

Rapid RPV depressurization, high drywell pressures, high containment activity, open SRV's, and open isolation paths all indicate actual or potential breaches of the reactor coolant system integrity.

In addition, excessively high reactor pessure would cause SRV's to open and could potentially threaten the reactor coolant system physical boundary.

5.3.1 Reactor Pressure Reactor pressure is indicated using the RX PRESS bar graph and associated digital value and trend displays. Tne four reactor pressure input signals are as follows:

Narrow Range (2) 850 - 1050 psig Wide Range (2) 0 - 1500 psig Valid signals are compared against each other and preferentially selected for display in the order listed above, if verified. Because of the increasing span in the ranges, this provides for the most accurate value.

If only the last 2 wide range inputs can be verified, they are averaged.

If none of the valid signals can be verified, the highest of the valid readings is selected (greatest potential threat to RCS integrity).

Tne basic signal processing of Figure 5 is used for this display.

ihe following values are indicated on the bar graph:

Bogey:

1000 psig (green line)

High Alarm: 1043 psig (red line)

Low Alarm: None Provided 5.3.2 Drywell pressure Drywell pressure is indicated using the DW PRESS bar graph and associated digital value and trend displays. The three drywell pressure input signals are as follows:

Narrow range (2)

-5 to +5 psig Wide range (1)

O to 135 psig Valid signals are compared for verification.

If agreement is verified, the signals are averaged. Peference is given to the narrow range readings due to greater accurancy associated with the narrow spane.

If signal agreement cannot be verified, the valid narrow range signal is selected, or the highest of disagreeing positive signals or the lowest of disagreeing

' negative signals.

The basic signal processing of Figure 5 applies to the drywell pressure signals. The following values are indicated on the bar graph:

44

~........y.--...._..-~....

_ Bogey:

O psig (green line)

[

High Alam:

1.69 psig (red line)

Low Alam:

- 0.5 psig (red line)

(

5.3.3 Containment Activity Containment activity is monitored using the CONTAIN RAD NORM (HIGH) status

[

box to alert the operator to an obnomal operating condition. Two containment activity signals are used as inputs, each with a range of 1 R/nr to 100 R/hr.

Valid signals are compared and averaged if in agreement or the highest signal selected if in disagreement.

The basic I

signal processing of Figure 5 is used, except no value is displayed and only color changes are provided.

The high alam limit is 200 R/nr which is the GSEP Alert Emergency Action Level (EAL).

[

5.3.4 Safety Relief Valve (SRV) Positions l

The position of the SRV's is monitored using the SRV CLOSED (OPEN) status box to alert the operator to an abnomal operating condition.

Inputs to this indicator are the SRV position limit switches, reactor pressure from the SPDS, reactor level from the SPDS, drywell pressure from the SPDS, and f

low pressure ECCS pump discharge pressures. Tne demand for SRV pressure l

relief is detemined from the reactor pressure value and the demand for ADS actuation is detemined from the water level, drywell pressure, and low pressure ECCS pumps discharge pressure values.

The valve position is then l

compared to the demand to determine any off-normal states, i.e. valves open with no signal present or valves closed when a signal is present. The signal processing of Figure 6 is used to determine the color and wording for this status box.

6 5.3.5 PCIS 1 and 2 Valve Positions Reactor and containment isolation (groups 1 and 2 only ) is monitored using the PCIS status box to alert the operator of a failure to isolate.

Inputs l

to this indicator are the PCIS groups 1 and 2 valve position limit switches and group 1 and 21 solation logic contacts.

Valve positions are compared with the isolation demand signal and failure of all valves in any isolation path to close with an isolation signal present initiates an alam state.

Figure 6 provides the input processing used for this indicator.

5.4 Containment Integrity Maintenace of containment integrity is assessed by the measurement of drywell e

pressure, drywell temperature, suppression pool level, suppression pool l

temperature, and containment isolation valve (groups 1 and 2) positions (Reference 1). Excessive drywell pressure, drywell temperature, and suppression pool temperature, and high or low suppression pool level indicate conditions which may l

violate contairunent design bases and potentially degrade containment integrity.

Open isolation paths would indicate a breach of the containment boundary.

l 5.4.1 Drywell Pessure See Section 5.3.2 l

45

.I l 5.4.2 Drywell Temperature Drywell temperature is indicated using the DW TMP bar graph and associated digital value.and trend displays. Three drywell average temperature inputs are used for this' indication. The three signals are validated and then compared to verify accuracy.

If signal agreement is verified, the signals are averaged.

If no agreement is found between valid signals, the highest valid signal is selected for display. The basic signal processing of Figure 5 is used for this indicator. The following values are indicated on t

the bar graph.

t Bogey:

1250F (green line)

-High Alam: 1750F (red line)

Low Alam: 700F (red line) l t

' 5. 4'. 3 Suppression Pool Level Suppression pool level is indicated using the SUPP LVL bar graph and

[

associated digital value and trend displays. The three inputs to tnis indicator are as follow:

Narrow Range:

-14 to + 14 inches r

, Wide Range (2): -18 to + 14 feet Valid signals are compared for verification. Selection of the narrow range signal is preferred because of its accuracy. Wide range signals are averaged if in agreement, and where no agreement is found, the valid input with the greatest absolute valve (greatest deviation from 0) is selected.

The basic signal processing of Figure 5 is used for this indication. The

. following values are indicated on the bar graph:

1 Bogey:

0" (green line)

High Alam: +3"(redline)

Low Alam:

-4.5" (red line)-

5.4.4 Suppression Pool Temperature

[

Suppression Pool Temperature is monitored using the SUPP TMP bar graph and associated digital value and trend displays.

Fourteen local temperature sensors provide inputs for this indicator. All valid signals are averaged for this value, using the basic signal processing of Figure 5.

Tne following values are indicated an the bar graph:

850F (

l 1050F (green line)

Bogey:

High Alam:

red line) i Low Alam: None Provided 5.4.5 -PCIS 1 and 2 Valve positions see section 5.3.5 46

5.5 Radioactive Effluents B

Radioactive effluents are assessed by the measurement of radiation levels or o

release rates at the gaseous and liquid release points (Reference 1).

Excessive releases or radiation levels are indicated using the RAD RELEASE NORM (HIGH) status box.

Inputs to the radioactive release status box came from the offgas pretreatment log o

rad monitor; SBGT and main chimney rad monitors; SBGT and main chimney flow meters; and the liquid radwaste, service water discharge, and RHR loops A and B 9

discharge rad monitors.

a Although the offgas system at the monitor location does not provide a direct path a

to the environment, high radiation at this point would indicate degradation of a

a fission product barrier and the potential for a radioactive release.

Validation (signal within instrument range) is perfonned on all signals. The liquid pathway and offgas monitors are single instruments and no signal verification can be perfonned.

The same is true for the SBGT and main chimney flow sensors.

I I

Tne SBGT and main chimney radiation monitors consist of three instruments each with overlapping ranges.

If two of three signals agree, the one with the lowest range is chosen for greater accuracy. Where no agreement exists, the lowest range l

l reading is chosen. This signal is then combined with a measured flow rate to produce a release rate.

Tne sum of the SBGT and main chimney release rates is compared to the high alann limit.

The basic signal processing of Figure 5 is used f

for each effluent path.

If the value for any effluent path exceeds the alarm point or has no valid inputs, the status box color will change to RED or CYAN, l

re spectively. Tne following is a list of inputs for each effluent path:

Off Gas - Pretreatment monitor, I to Ix106 mR/hr SBGT Radiation - Low Range, 10-7 to 10-I uti/cq

- Mid Range,

1. 2x 10-4 tg 1.2x104 uCI/cc l

- High Range, 10-1 to 103 uti/cc SBGT Flow - flow element 1Ft-VG003 0-5000 CFM l

Main Cnimney Radiation-Same as SBGT Radiation.

l Main Chimney Flow - Flow element 0FT-VR019, 0-1.5x106 CFM Liquid Radwaste - Discharge Monitor,10 to 106 CPM l

Plant Service Water - Discharge Monitor,10 to 106 CPM l

RM Loop "A" - Discharge Monitor,10 to 106 CPM l

R$ Loop "B" - Discharge Monitor,10 to 106 CPM The high alann limits for the various paths are as follows, and are based on existing high alarm limits or GSEP Alert condition EAL's:

47

~..

Off Gas, Ix104 MR/hr(existing larm point) 5BGT plus Main Chimney,1.22x10 uti/sec(AlertEAL)

Liquid Radwaste,1.5 X 104 com (Alert EAL, 2x bkgd.)

Service Water, RHR "A",

and RHR "8", 400 cpm (Alert EAL) 6.0 Alams and Messages 6.1 Audible Alarms 6.1.1 Deviations from Normal Tne following changes from a normal status will activate the computer alarm horn:

Composed point or status box exceeding high/ low alarm point Composed point or status box has invalid inputs 6.1.2 Return to Normal The computer alarm chime will activate whenever a composed point or status box in tne alarm or invalid state returns to a normal condition.

l 6,2 Error Messages 6.2.1 Deviation from Normal Associated with the alarms identified in 6.1.1 above is an alarm message which appears in red print on the computer alarm typer.

The message identifies the alarm as being associated with the SPDS and identifies which composed point has exceeded its alarm limit or is out of range.

l 6.2.2 Return to Normal Following the return to normal of composed points or inputs, the computer alarm typer will print in black a message identifying the SPDS Foint and that it has returned to the normal state.

7.0 References

1. " Commonwealth Edison Co. Dresden. Quad Cities, LaSalle Safety Parameter Display System Function Specification", Rev. I dated 2-16-83.

0939a :dg o

48

.. a... s... <. s. +.w.. w w.~,.u. o...s.

.r..

e p.

1 I

l 44y ALL SELfCY

[$ v.(vg DSM6AV

[

i

<i.

me

,,,7

,,,3 1 % #6/4, AW t h *JT.S 7

l%PJT3 r

V' " ' I g

,g to vcaiP W i w a" m

T dt <,4 2

[ g,,g., s T,

NO No NO

[

if if 1r DIS PLA4 943Pb&V g,pj y B h 4-W ALw L FULL SAf,'

Amt T4EkD 7

uv a.aig gs '

S"E vaLVL C6Let tvaed O

j

. I F 1 c. U R E 2

REA4.TeR bJ ETC 8tl.

L.t v e t s s c N A L.

PK cs cE : ri4 C3 I

I

. I AhV CAbtwsA N

! Flow EL" peesua AwD 08%

M8 I

CatATSA IEUTI VIO y MEA 3.tge YES; sicuat E Q CettAT&4 g e g. g, y ywau a

va t.se ?

ruews I i pug,, z j r 4w I

I ggo iceo Ac.*Etll

. et s ic.w !

l c,,n g.i 1

No NO NO VES

.vt5 NC ir u

1r ir V

e 2

naa C.La I

I

.A u..s Dev ng vatib g,ggy weat.

FW Ob4 i

I i

1 i

gmm 3 c, ORE SPRAY S l (. N A L P 8t.o C E 5 s IM 4 I

a

%1 %

1 I

i ALL ADRMb

'[j[

O F F 5CA64 W5 m see t stica f VAM, SAR.

et FuuscA%

IN V ALI D A3 fEtif L5 M est it SCA&M gy YES Apgg No Yts m

A*6 Y s t4 asAL 6

r pg tsg est {

C 64 SCA.E I VAb8D s ars t h

Yts NO u

ltretu lP4 cut Otb rai A rt es's et l$ WIT'M 7

Sf J s.rta

',.s.r.. a

saa, 4 Pwn..

L s/u ea dun y

1' Awy

",jg*

OtSPLAy p

'g'g*g"

• C Act.

AP4MS N'

3 owsLALal catgg A stEAtas a

YSI NO U

DI5 HAY APs M Dibe AY AN

' '" E vf5 Cebet A PtM 7 #****

• 7 D'"

I

5t& nab 5

,160% ?

Ft A u n t.

4 REAcTe4 Fowt2.

StC W AL, P R o C E E s 864 4 50

........ ~ ~ s.

. ~.....

-t-E

$t6467 0*E&

Awy stGNAL ca VALvt I

7l AVf2 A4.E m

7 La t(10 gypgg l 5%WAt.S yt airisA.

giGwA4.5l ALAeq VAttD ?

vo o *4 i Di3 Pm L'M tu i M0 No VE6 L

<f.

v

' Dis Ps Ay bis *4AY c c,6o t OtSPsAY L YA*J,

goug C4,604 E

G h4,

[

' Fou.s s.Ast, G REK84 RID Asettous!

F I G U R E.

,f e a sic, sic 6 Au P t o te s s t*J 4 4

l l

PAE53*St cLosta y Lewtsv S CV $

I CobeR sev opgy 1*

stv* watt ;

4LD 0

YC5 v

ALL W0 Eb' *4 4 I

g,3 Leasc y 5 RV 'S OE W0 O t H ANb)~

CA CS(p {

COLE %

GW ND VES I

W 8 ED'N 4 weeDiu4 OPM CbesLD l

C 8 LA R-C C64 4

@ LD Gagg aJ l

l e,w.e a 5 8.v st4NAL Ptoc.E S.si4 4 51

.~a

~.-o w.-

_ ~. -

-. -a s

l

-3S-Auy GRoot l I

- Y 'S i s out..w

' 5 *"T* * **

vrs FATH E8 6 N AL

[ O P 81.4 ?

Peusc{

v 80 %

s Q L.o ft bN y3 m

, C. E s4 N NO

' Cout c.= = ~

au c

. G E 0 J P 2, croup 2

'8 5 AAvieg VE S m 150u7:6 64 c5 EATm SicN Ag.

f OPENI

}Pstt.sc.4r y g

1 FI C ve.C 7 PO5 rieNAL re,ocg g 5gg q 1

P E

i C9

F

,g

,,,g

• S& M *#M'#T** MOO

<p

.I I

ATTACHMENT D SPDS DISPLAY SYSTEM OPERATING SYSTEM PROCEDURE I

I l'

![

i p

b f

l l

I I

9 I

53

i

. - - =..._-

1 CAUTION THIS DOCU! DENT / DRAWING IS FOR ADt.i!N!STRATIVL REFERENCE ONLY.

l IT SHALL NOT Fr ("8ED FOR MAIN Lup-cs-ic2 TEN AWr. OU R

• N "

DE:iGN OR k= vision 2

,,;"8[ti!.",,.c r ;

,.,.(T IF,5 ueceiosr 29, 3 3.

l 1

SPJS DISPLav SYSTEM l

a.

Pupotig Tnis procecure explains tne function of anc cperator ressonse to tne 56tety Parameter Display Syster (SPO5p.

B*

f i f i l f 3 M.1 1.

None.

C.

25i51.;suun 1.

None.

D.

P A E t a uTEM 1.

The SPDS Cisplay is not in onoso to provice sufficier.t inoication to justif y cirect operatcr action cn reactor or auxiliary system controls.

Tne operator snoulo refer to accitiJnal panel inoICatiCns 400 alarms to confirm system status oefore taking action in respons to an SPOS Synter alare.

k.I.f E S T I M 5 ' d. J U l.9 S.1 E*

J 1.

The SPDS system is a program containeo in th's srocess computer oesigned to pvooloe a compJsite visual ir.cication of several vital plant o'pe r at i ng par ame te r s.

2.

Sar Graphs eno cigital reacouts oisplayao oy SPDS are normally coloreo green.

a cnange tc clue color i

t inoicates tnat tne requireo numoer of instrumentatecn cnannels are not o:d/401a.

Ano reo cars ano ci 9sts inoicate parareters in alare conoition.

F.

93,ggg 1.

A green cisplay inoicates cperationg conoitions are in the normal range.

no.ever, if parameter valves cisagree seriously witn other panel indication. tne Shift Supervisor ano Tecnnical Staff Corputer rous shoulo 04 notifieo of the cisagree.nant.

2.

A clue cisplay inoicates an insufficient numoer of operacle instrument channels for a giwan parameter.

The Shiit Superwiser ano Technical 5taff Compu.er 54 l

\\;

7-

. _. ~

f i

l L JP-C A s

• 2 Avvision 0 Lee,gmj,er

29. 15d; a -

Group snould be notified of this conoition.

Initiation of 6 hort Reaudst may 06 app l ic aol e.

3.

A flashing rec diswlay inoicates that a permaeter nas exceecec an alarm setpoint.

Tne opsrator snoulo:

a.

ACKNCaLEDGE sne alarm oy oeoressing tne ALA4m ACK'40eLEDGE outton on tne Gperator's console of tne process co.nputer.

Tne cioplay may take a few seconos to respond to acuno.leogenent oefore the oisplay mill assume a 5c1: 3 reu c ol or.

Alareeo parameters will automatically cnange nack to the green colcr when parameter inputs fall cacn to within normal ranges.

c.

CHECK pansi indications ano alarms for verification of SPJS alarm conoiticn.

c.

RE5e0NU to tne alarm Conoition using a'oprowea procecures, if tne al arm conoi t s on proves wel ic.

l (r.

$dCxum 1.

tv o n e.

H-ILLSIC *t 321UE.1 OIL 3.SifliiM.11 i

1.

f= o n E.

il o

e fl li 55 J