ML20149L734

Notifies of Util SPDS Mod,Per 870904 Request & Forwards Proposed Resolution of NRC Requirements Re Spds.Nrc Approval of Mod by 880601 Requested

ML20149L734
Person / Time
Site:	Mcguire, Catawba, McGuire, 05000000
Issue date:	02/18/1988
From:	Tucker H DUKE POWER CO.
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
References
NUDOCS 8802240417
Download: ML20149L734 (13)

Text

o .

Dune Pownn GoxPm P.O. DoX 33180 CitAHLOTTE, N.o. 28242 II AL II. TUCKER reteruoxz vere reestoeiet (704) 373-4&fl1 stupas rooorcvios February 18, 1988 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, D. C. 20555

Subject:

Catawba Nuclear Station Docket Nos. 50-413 and 50-414 McGuiro Nuclear Station Docket Nos. 50-369 and 50-370 Safety paramotor Display System

Dear Sir:

In March 1984, Duke submitted the descriptions of the McGuire and Catawba Safety Paramoter Display Systems (SPDS). Since that date there have been numerous letters and meetings concerning the acceptability of the Duke proposed design of the SPDS. This process included appeal of Staff positions under the backfitting provisions of 10 CFR 50.109. The purpose of this letter is to propose a final i resolution of this long running issue.

The McGuiro/ Catawba SPDS was developed by Duke and is a software application programmed on an already existing computer system (operator aid computer). The SPDS design consists of a display containing six critical safety function (CSF) boxes that uso color and pattern coding to convoy the status of the function.

The status tree displays are based on the Westinghouse Owners Group Emergency Responso Guidelines (ERO'u).

In May 1980, the NRC 1: sJ NUREG-0660, NRC Action Plan Developed as a Result of tho THI-2 Accident. Item I.D.2 required licensoos to "Design and install safety parameter display consolo". . itor documents, such as NUREG-0696, -0737 and -0835 woro increasingly prescript've in the requirements for an SPDS. Supplement 1 to NUREG-0737 (Generic Lotter 82-33) was issued on December 17, 1982. As noted in Darroll Eisenhut's transmittal letter and in tho text, it was intended that Supploment 1 to NUREG-0737 be used as guidance and not to be used as requirements.

On March 28 and 29, 1984 respectively, Duke submitted the doscriptions of the Catawba and McGuiro SPDS's. The Staff requested additional information in a lotter dated September 14, 1984. The SPDS was implemented on both McGuire units in November, 1984 as required by a Confirmatory Order dated June 15, 1984. The SPDS was implenented on Catawba Unit 1 prior to April 1, 1985 as required by License Condition 12(b) of Facility Operating License NPF-35.

On May 14 and 15, 1985 the NRC Staff and its Consultants conducted an onsito design verification / validation audit of tho SPDS. Results of the audit were transmitted on September 10, and October 31, 1985 for Catawba Unit 2 and on November 7, 1985 for McGuire. Catawba Unit 1 was not addressed. Safety Evaluation reports were issued for the SPDS on McGuiro (February 28, 1986) and

/ gdf il Catawba (SSER 5 dated February,1986) . g 8802240417 000218 PDR ADOCK 05000369 P PDR

fl. S. Nuclear Regulatory Commission February 18, 1988 Page 2 On March 25, 1986 Duke identified the Staff positions taken in the respective SER's as plant specific backfits pursuant to 10 CFR 50.109 and NRC Manual Chapter 0514. It was Duke's contention that positions taken by the Staff were inconsistent with previously applicable regulatory Staff positions and such positions were not timely as defined in NRC Manual Chapter 0514.

On June 13, 1986 the Staff rejected Duke's backfitting claim noting three reasons that Duke should have been en notice as to the Staff's requirements for SPDS.

These were 1) NRC/NUTAC meeting; 2) Draft of a Staff position subsequently issued as SRP Section 18.2; and 3) SER's issued on other plants. On March 26, 1987, Duke appealed the Staff's denial asserting that none of the three examples cited by the Staff constituted valid regulatory staff positions in accordance with Manual Chapter 0514, Section 053.

In an effort to help resolve this issue, the Staff and their consultants visited the McGuire site on June 29 to July 1, 1987 and reviewed the design and implementation of tho McGuire/ Catawba SPDS with specific emphasis on the items in dispute. In a September 4, 1987 letter from James H. Sniezek, the Staff transmitted its findings from the site visit and conclusions regarding reconsideration of Duke's backfit appeal. This letter included fivo pages of Staff conclusions regarding the McGuire/ Catawba SPDS as well as a Technical Evaluation Report from the Staff's contractor, SAIC. Most notable is the fact that, in a 48 page response to Duke's backfit appeal, only two lines (in the transmittal letter) addressed the backfit claim. No attempt was made to address the specific points of Duko's March 26, 1987 appeal letter, specifically:

(1) The February 1986 SER's were not timely within the meaning of the manual chaptor, and (2) positions taken by the Staf f in the February,1986 SER's go beyond the guidance provided in Generic Letter 82-33 and SRP 18.2.

Furthernore, Mr. Sniezek's lotter made no attempt to defend previous Staf f positions taken in Mr. Denton's June 13, 1986 denial of Duke's backfit claim.

Although Duke continues to feel that the Staff failed to moet their obligation under Manual Chaptor 0514, uoction 044 in not specifically addressing the morits of Duke's backfit claim and that the NRC's technical and human factors arguments for adding the additionr1 parameters are not valid, further appeals of this issuo appear f ruitless and . waste of resources. Thorofore, Duke has chosen to modify tho McGuire/ Catawba s71 *s requested by the Staff in Enclosure 1 to Mr.

Sniczek's September 4, 1987 letter. As discussed further in Attachment 1 the additional paramotors and the backup displays will be added to the SpDS. The proposed changes are more extensive than the minimum NRC requirements in an effort to provido a more useful tool for the operators. Staff approval of these proposed changes is requested by June 1, 1988. Modifications to the respective unit's SPDS will be made during the following refueling outages:

McGuire 1 - EOC-5 McGuiro 2 - EOC-6 Catawba 1 - EOC-3 Catawba 2 - EOC-2

U. S. Nuclear Regulatory Commission February 18, 1988 Page 3 Dynamic validation of these changes as well as the major portion of the original SPDS will follow modifications to the Catawba simulator.

Since the requested review is in response to the Staff's original SER's on the McGuire and Catawba SPDS, no additional fees are required pursuant to 10 CFR Part 170.

Very truly youra, e- -Kar  %

Hal B. Tucker ROS/1408/sbn Attachment xc: Dr. J. Nelson Grace, Regional Administrator U. S. Nuclear Regulatory Commission l Region II l 101 Marietta Street, NW, Suite 2900 Atlanta, Georgia 30323 Dr. K. N. Jabbour Office of Nuclear Reactor Regulation j U. S. Nuclear Regulatory Commission Washingcon, D. C. 20555 Mr. Darl Hood Offico of Nuclear Reactor Regulations U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Mr. P. K. Van Doorn NRC Resident Inspector Catawba Nuclear Station Mr. W. T. Orders hRC Resident Inspector McGuire Nuclear Station Mr. J. H. Sniezok, Duputy EDO U. S. Nuclear Regulatory Commisalon Washington, D. C. 20555 Mr. Victor Stollo, Jr.

Executive Director for Operations U. S. Nuclear Regulatory Commission Washington, D. C. 20555

Attachmerit 1 PROPOSED RESOLITTION OF NRC REQUIRBGDirS RIX1ARDING THE SAFErY PARAMETER DISPLAY

~

SYSTEM (SPDS) AT McGUIRE, UNITS 1 AND 2 AND CATAWBA, UNITS 1 AND 2 Requirement:

The staff has required the addition of RHR flow (or an equivalent) to ensure that the heat removal function is sufficiently represented on the SPDS. The staff noted that RHR flow, RHR heat exchanger inlet and outlet temperatures, and RHR pump discharge pressure are available on the OAC computer. Other parameters may be available. The staff will consider any parameter or combination of parameters sufficient to establiash functionality of the heat removal function that Duke proposes.

Resolution:

A new alarm is being added below the existing SPDS status lights on the operator aid computer alarm video. This additional SPDS logic will alert the operators to low RHR flow conditions. The light will be green when expected RHR conditions are present and yellow when an indication of low RHR flow exists.

The software currently being developed to drive the alarm will evaluate low RHR flow conditions during normal and emergency system alignments. Accordingly, the software will monitor RHR flow to the reactor coolant system cold legs ard hot legs: RHX pump discharge pressures and various RHP system valve alignments.

Back up displays to the alarm will provide analog values for selected RER i parameters.

l 3

t

Attachment 1 Page 2 of 10 Requirement:

As a minimum, Duke should add representative parameters, such as stack monitor and steam generator (or steamline) radiation (both of which are available on the OAC), or equivalent alternate parameters, to provide adequate representation of radioactivity control as specified in NUREG-0737, Supplement 1.

Resolution:

A new alarm is being added below the existing SPDS status lights on the Operator Aid Computer alarm video screen. This alarm will alert the operators to an increase in detected radioactivity for various radiation monitors. The radiation detectors to be monitored by the new SPDS logic include the following:

Unit Vent (stack monitor)

Main Steam Line Condenser Air Ejector Exhaust Steam Generator Water Sample Containment Backup displays will provide analog values of radiation levels detected by the monitors.

l

Attachment 1 Page 3 of 10 Requirement:

The "containment" function of the McGuire and Catawba SPDS is provided with the following parameter inputs:

Containment Pressure Hydrogen Concentration Containment Sump Level Containment Radiation However, Duke has not provided containment isolation status as an input to the "containment" function on its SPDS. The staff believes that without this information the SPDS user could not assess one of the most important containment conditions that affect pir.nt safety status - potential release paths from

' containment. Therefore, the staff maintains that this information should be added to sufficiently represent containment conditions.

Resolution:

The existing SPDS logic for tae "containment" Critical Safety Function is being If a modified to include Phase A and Phase B, containment isolation status.

containment isolation failure exists: that is, a valve does not close upon receipt of a safety signal, the "containment" CSF block will change to yellow.

Attachment 1 Page 4 of 10 t

Requirement:

Bacause the McGuire/ Catawba SPDS incorporates so many parameters in its design, it was impossible to provide all of the actual values in a concise and continuous display. Duke, therefore, decided to summarize the safety status of the plant by using the SPDS variables as logical inputs to six "critical safety  ;

function status blocks."

The staff accepts this approach in principle, provided that the actual values of the underlying parameters are rapidly accessible, so that the requirement for continuous display is minimally impacted. However, even as redefined in the recent site visit, the McGuire/Catauba SPDS, does not provide the operator with rapid access to the SPDS variables that are summ.rized in the CSF status blocks.

The staff's position remains that the McGuiro/ Catawba SPDS should provide the actual values of those SPDS parameters which provide input to the critical I

safety function status blocks.

Resolution:

Backup displays are being generated for each of the six CSF blocks as well as for the two new alarms being added for low RIIR flow and radioactivity status, i 1

Attachment 1 Page 5 of 10 In addition to the requirements above, the audit team identified a number of HEDs that remain on the SPDS. These are listed below. Duke has evaluated each of these issues and presents its position following each item.

ITEM 1:

Moving from one display level to another requires as many as seven or eight key strokes by the user. Although none of the operators or STAS interviewed had difficulty carrying out these series of key strokes, under stressful situations, especially with inexperienced operators, the process for accessing displays could result in a delay in receiving critical plant safety status information.

Response

The man-machine interface used by the operators to call up the supporting displays is the same as those normally used to call up system graphics, display menus, and other OAC programs. This man-machine interface is thoroughly familiar to the operators through their normal operation of the plant. To modify the Supporting Displays to allow display by pushing a single button would require extensive softwkre changes and the designation of at least one of the graphic pushbuttons as the SPDS Supporting Displays. Additionally, there would be no way to "turn-the page" of the Supporting Displays because the graphics I allow only a single page of output. This would prevent tha single button f transistion among secondary and tertiary displays for a specific critical safety function that nos exists.

Duke Power is satisfied that no changes are necessary or desirable to the present method of computer operation.

o .

Attachment 1 Page 6 of 10 ITEM 2:

Some of the colors used in the SPDS are not readily distinguishable. In particular, yellow and green are difficult to distinguish.

Duke Response This item was first identified by Duke Power as part of Duke's ongoing evaluation and maintenance of the SPDS. As indicated to the NRC SPDS Audit Team, the SPDS software will be modified so that the particular color of the CSF blocks will be spelled out in the block. For example, the green CSF block will have the word "green" spelled in it. The yellow CSF block will have the word "yellow" written in it and so forth, l

l l

l l

l

4 . ,

1 Attachment 1 Page 7 of 10 1

1 ITEH 3:

The color coding used to highlight the status tree paths is not consistent with that used by the CSF blocks. The CSF blocks change from GREEN to YELLOW, ORANGE or RED depending on the severity of the alarm. However, the status tree paths turn from GREEN to RED regardless of the severity of the alarm.

DUKE RESPONSE:

This itam was identified by Duke Power during early Human Factor assessments of the SPDS. A conscious decision was made to highlight the alarmed critical safety function status tree branches in red. This is consistent with other operator aid computer alarm conventions.

Additionally, when comparing the benefits of color coding the status tres paths against the associated programming costs and the inherent problems such as color distii.guishability and the inability to generate orange displays, the present path highlighting methods proved to be the optimum choice.

Attachment 1 Page 8 of 10 ITEM 4:

The status tree display is not automatically updated overy five seconds as are the CSF blocks. The status tree display reflects the alarm conditions present at the time of the operator request rather than the current alarm conditions.

The operator must manually update the status tree display by depressing ENTER and TAB, or reenter his request.

l l

l l

DUKE RESPONSE:

The current version of the SPDS Supporting Displays was developed so that the l

operators could review and evaluate any SPDS alarm when it occurred. If the l

i Supporting Displays are revised to update automatically, the operator reviewing a Supporting Display in which a CSF block is a color other than green may find the data cl.anging before having fully evaluated the source of the alarm.

l l

The present diagnostic aspects of the SPDS are considered more desirable than a system which may not be used until plant conditions have become relatively stable.

J e ,

4 Attachment 1 Page 9 of 10 a

ITEM 5:

' At the third level of the SPDS, the points that are the source of an alarm are 4

I not readily discernible'from all the points associated with the flow path of an alarm. These points could be easier to identify if they were highlighted in i

some manner.

'i i

DUKE RESPONSEt

{

j SPDS inputs associated with determining a critical safety function's degraded status may or may not be in an alarmed condition. To iuentify and highlight the 1

l specific SPDS parameters which are in alarm from those which merely contribute to satisfying the SPDS logic would require an algorithm more complex *'an the l

l existing SPDS. Duke Powur is developing additional SPDS backup displays which

}

will assist the opurator in identifying the source of SPDS alarms.

1 l

l l

i 1

l

)

, Attachment 1 Page 10 of 10 ITEM 6:

The OAC Alarm Video list that is displayed above the CSF blocks on the top level display is not considered part of the "formal" SPDS. However, if the licensee proposes to use any of this information to meet SPDS requirements, the following HEDs are applicables

a. The Alarm Video display does not provide any indication of existing alarms that cannot fit on the display page. The operator may not be aware of or may not remember existing alarms.

b. The Alarm Video display provides no means for bringing up and viewing alarms that do not fit on the display page. These alarms cannot be viewed until alarms already on the page have cleared.

c. Letter designation for the systems in alarm are provided below the CSF blocks at the bottom of the Alarm Video display. However, the audit team found inconsistencies between the system letter designations displayed on the OAC and a hard copy list of system letter designations.

DUKE RESPONSE:

The OAC alarm video list is not part of the SPDS. No efforts are currently planned to address these items. Additionally, Item c. is not applicable because the system letter designations at the bottom of the OAC alarm video are being deleted to accommodate the two new SPDS status 11vhts for RRR flow and radioactivity.

,