ML20151G346

From kanterella
Jump to navigation Jump to search

Forwards Proprietary & Nonproprietary Suppl 7,Rev 0 to WCAP-10170, Westinghouse SPDS Design & Verification... Process for Beaver Valley Unit 1 Nuclear Station
ML20151G346
Person / Time
Site: Beaver Valley
Issue date: 07/18/1988
From: Sieber J
DUQUESNE LIGHT CO.
To:
NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
Shared Package
ML19292J151 List:
References
RTR-NUREG-0737, RTR-NUREG-737 TAC-51221, NUDOCS 8807280304
Download: ML20151G346 (12)


Text

'

.- */

O Beaw Power Staton Shopogport. PA 15077@04

[

UOL,% ~"

July 18, 1988 U. S. Nuclear Regulatory Commission Attn: Document Control' Desk Washington, DC 20555

Reference:

Beaver Valley Power Station, Unit No. 1 Docket No. 50-334, License No. DPR-66 Request for Plant Specific Information on SPDS (TAC 51221)

Gentlemen:

By a letter dated April 8, 1987, the NRC requested that DLC submit a plant specific safety analysis report and implementation plan in accordance with the requirements of supplement 1 to NUREG-0737. Attached is the requested document prepared for your review in accordance with the plan sul.nitted to the NRC by DLC letter dated March 2, 1988.

As this submittal contains information proprietary to Westinghouse Electric Corporation, it is supported by an affidavit signed by Westinghouse, the owner of the information. The affidavit sets forth the basis on which the information may be withheld from public disclosure by the Commission and addresses with specificity the considerations listed in paragraph (b)(4) of Section 2.790 of the commission's regulations.

i Accordingly, it is respectfully requested that the information  :

which is proprietary to Westinghouse be withheld from public disclosure in accordance with 10 CFR Section 2.790 of the Commission's regulations. Correspondence with respect to the proprietary aspects of the Application for Withholding or the supporting Westinghouse affidavit should reference CAW-88-059 and i should be addressed to R. A. Wiesemann, Manager Regulatory and ,

Legislative Affairs, Westinghouse Electric Corporation, P. O. Box <

355, Pittsburgh, Iennsylvania 15230.

If you have any questions or comments regarding this submittal, please contact me or members of my staff.

Sincerely yours, CW.PM , , op . .

00.3 L? 0 NC f$ I e $40 n-  ;

$ SIC l g$$ J. D. Sieber Ill0WCAf*iC00(^h10 Men h to WCA8. (0 Vi':e Pre 11 dent '

Nuclear Group cc: Mr. J. Beall, Sr. Resident Inspector .

Mr. W. T. Russell, NRC Region I Admir + .

Mr. P. Tam, Project Manager Director, Safety Evaluation & Contruf .i 8807280304 sso7tg gDR ADOCK 05000334 PDC d  ;

M Bhaver Vallcy Power Station, Unit No. 1 Dockot No. 50-334, License No. DPR-66 Page 2 bcc: W. S. Lacey J. O. Crockett N. R. Tonet W. R. Hunter R. F. Balcerek R. J. Swiderski T. P. Noonan R. D. Hecht J. V. Vassello G. S. Sovick G. L. Beatty K. D. Grada P. A. Cadena D. Schmitt R. E. Martin J. Matsko V. Palmicro E. Humer M. W. Rencheck R. J. Druga T. G. Zyra A. Lerczak F. D. Schuster T. W. Burns J. G. Proven

!. . R . Freeland R, Cavaliere l

t l

Safety Analysis Report For Beaver Valley Unit 1 Safety Parameter Display System (SPDS)

Supplement 1 to NUREG 0737 requires that each licensee prepare a written Safety Analysis Report (SAR) which describes the basis upon which the parameters were selected for display on the SPDS. This submittal provides that basis and further documents DLC's evaluation of the SPDS to the requirements of Supplement 1 to NUREG 0737.

DLC's purchase of the BV-1 SPDS in May 1980 pre-dated the NRC design verification audit of the generic Westinghouse SPDS performed in October 1982. This audit was based upon activities on the genaric Westinghouse SPDS after 1980. This audit was performed in parallel with the design / implementation activities of the BVPS-1 SPDS. The WCAP used as the basis for the generic Westinghouse SPDS design (WCAP-10170) and appendices (A through E) document the Westinghouse SPDS design and verification process with regard to the BVPS-1 SPDS system. However, because of the parallel activities associated with the generic Westinghouse SPDS and BVPS-1 SPDS, certain of the activities associated with the generic Westinghouse SPDS do not apply to BVPS-1 SPDS. The activities that do not directly apply to BVPS-1 SPDS (differ from the generic Westinghcuse SPDS design), are; the combination of the Factory and Site Acceptance tests, the non-independence of software verifiers and the NRC Verification and Validation process.

Supplement 7 to WCAP-10170 is appended hereto and depicts the design and verification processes applicable to BVPS-1 SPDS. The document provides an overview of the design process used for BVPS-1 SPDS and delineates, witn an asterisk (*) in the margin, the differences between the BVPS-1 SPDS design activities from those described in the generic Westinghouse SPDS WCAP.

Referring to Supplement 7 to WCAP-10170 figure 1 (page 8) illustrates the ERF Design Process and Table 1 (pages 9 & 10) identify the BV-1 SPDS documentation associated with each step of the design process.

A summary description of each process step is provided in section 2.5 of Supplement 7 to WCAP-10170.

An assessment of the SPDS design implementation as it supports the functional guidelines of Supplement 1 to NUREG-0737 must be done in context with the overall philosophy of operation and use of the SPDS in the BV-1 :ontrol room. The following discussion of the BV-1 SPDS philosophy of operation and use is provided to supplement and clarify DLC's application to the functional guidelines.

- - _ _ - - - - - - - - - - - - - - - - - J

2" S2fcty An21yaic R: port for' B'e2 Var VollGy Unit 1 Snfcty Param3tcr Dicplcy Syst;m (SPDS)

SPDS Philosophy of Operation and Use The Safety Parameter Display System (SPDS) provides personnel in the Technical Support Center (TSC), and Emergency Operating Facility (EOF) with immediate access to critical plant indications. Additionally, the SPDS provides the same concise display of critical plant variables to the control room operators, Shift Technical Advisors (STAS), and plant personnel to aid them in rapidly and reliably verifying the safety status of the plant. The SPDS, by virtue of its installation in the TSC and EOF, reduces the number of staff personnel in the control room, thereby reducing the potential for confusion in the centrol room during a plant transient or emergency condition. The principal purpose and function of the SPDS is to aid the control room personnel during an abnormal or emergency condition in determining the plant safety, status and to assess whether the abnormal condition (s) warrant corrective actions by the operators to avoid a degraded core condition. The licensed operators, STAS, and selected plant personnel are trained on SPDS operations, cognizant of the available SPDS information, and abic to interpret the information provided by the SPDS to understand the plant safety status.

The primary sources of indication for the operation of the plant are the control room indications, including post accident monitoring indication, and plant equipment. The control room indication provides the Operators with the necessary information for safe reactor operations of the plant under normal, transient, and accident conditions. The SPDS is used as an aid to enhance the control room indications. If the SPDS is not available, the control room operators are trained to mitigate the transient or emergency condition by using their control room indications and the Emergency Operating Procedures (EOPS). The control room operators are trained to respond to the transient or accident condition (s) with and without the SPDS.

The EOPs are written to mitigate the consequences of various accidents. The operation of the plant is maintained and controlled using the EOPs until the plant conditions are stabilized. With this EOP philosophy in mind, the SPDS philosophy and SPDS procedure guideline are written as an aid a..d an enhancement to the Emergency Operating Procedures during abnormal, transient, or accident conditions. The SPDS is also used during normal plant evolutions as an aid to the control room staff, but the SPDS and the SPDS procedure guidelines are not considered primary information for the operation of the plant during accident conditions.

SLfGty An0ly010 R2 port for Benv0r VcllGy Unit 1 o S2fsty P2rameter Display System (SPDS)

The primary operators of e 1. re the STAS. The STAS have the available use of the Sirs  ;< . tor the plant safety status at several terminals. SPE: Crals are located in the Unit 1 Control Room, Technical Supperr Center and at the Emergency Operating Facility (EOF). In addition to the STAS, all licensed operators and selected plant personnel are trained to be able to operate, understand, and interpret the information from these SPDS terminals. SPDS users are capable of interpreting the color coding and status flags associated with the SPDS parameters. The SPDS users are trained to the level where the users are cognizant on how to use the SPDS terminals as an available reference tool to enhance existing indications. The SPDS is and will be considered an enhancament to operation of the plant and a secondary source of plant safety status information. The SPDS will provide diagrostic information during normal and accident conditions. A tlained SPDS operator, at the various locations, can aid the controi room staff by monitoring plant status changes for the plant transient or emergency conditions and provide plant safety status information to personnel outside the control room.

The SPDS operator has the ability to call up the Top Level, Map Menu, Trends, or history displays by dedicated SPDS pushbuttons.

In addition to the dedicated display pushbuttons, the SPDS can call up a display by locating the cursor in any display predefined poke field area and executing the Display Page pushbutton. This action will display on the SPDS terminal screen the associated screen display related to the poke field area.

All displays except history trends can be called upon by sequential paging, display poke fields, or entry of a specific screen page number. History trend displays can only be replayed following a reactor trip.

The SPDS screen displays are divided into six distinct categories. The initial group consists of the SPDS Map and its associated Menu screens. The Menu screens identify the first, second, third and fourth level displays. By visual observations of the SPDS menu screens, the fourth level displays can be associated with the third level displays. The fourth level displays are tabular listings of all the analog sensor inputs used in the third level displays. The last SPDS display group available is the individual sensor input computer points called the Point Detail Displays. These point detail displays are all the computer points used by the higher level displays in the SPDS.

r S foty An0lyaia R: port for B'c;v r Vollcy Unit 1 S2fcty Parametcr Dicploy Syatcm (SPDS)

There are 29 SPDS displays installed in SPDS display levels one, two and three. Level one (also known as Top Level) contains two abstract iconic displays. These two displays represent plant conditions referenced to the optimum operating points and operating limits. The two screens have eight spokes directed outward from the center of the screen. Each spoke represents a normalized plant parameter to provide an octagonal geometric shape. The symmetric octagonal diagram occurs when the active parameters are at or near the optimum operating level. As the plant parameters deviate from the optimum operating limits, the octagonal shape will distort informing the SPDS operator of the parameter deviation.

Top level display 1TL1 Narrow Range Display (NAR RNG) is structured for normal plant operation without a reactor trip condition. Top level display 1TL2 Wide Range Display (WID RNG) is used to show plant operations from full power to plant shutdown after a reactor trip. If the Narrow Range display is on the screen prior to a reactor trip, the Wide Range display will automatically be substituted for the narrow range display after initiation of the reactor trip. Both Top Level displays 1TL1 and 1TL2 are useful to display plant parameter conditions before and soon after a reactor trip. However, the iconic displays in the third and fourth Level provide more useful detail information to analyze / diagnose a plant transient or emergency conditions.

Therefore, after a reactor trip, normal operations of the SPDS would be in the third and fourth levels. Additional information can be acquired using the point detail displays if more specific information is required for the computer point in the SPOS.

In addition to the normal iconic display, Level Two contains the history trend graphs and history iconics. The history trend graphs and history iconics can ba called upon using the dedicated SPDS history pushbutton. The Iconic trends (both iconic replay and values and references vs. time) are available at all times and are not trip dependent. The Iconic histories (both iconic replat and values and references vs. time) are available after a trip. The history iconics and trend graphs provide a recorded history replay before and after the reactor trip breakers are opened of 30 minutes at 1 minuto intervals and 5 minutes at 10 second intervals. The SPDS stores the data on memory disks for the respective trend graphs or iconic history.

The SPDS procedure guideline is a reference procedure for the SPDS operator. The procedure will be written in three parts.

The first section is a reference section of the SPDS terminal operational controls, parameter color codings and parameter status flags for the SPDS operator. The second section is a grouping of SPDS parameters that are helpful in analyzing hnd diagnosing plant conditions which may be U7ed with the EOP procedural steps. A table is provided 11 ting all the SPDS parameter groupings in the second section for quick reference to operate the SPDS following the EOPs. The last section of the SPDS procedure guideline provides information that is not available in the first two sections that may be useful to the SPDS operator.

_4_

c SCfcty Analyaio R2 port for 8env;r Vallcy Unit 1 SOfQty Parametcr Dicploy Syatim (SPDS)

The procedure guideline allows the SPDS operator to manipulate the SPDS to gather information as required to diagnose or analyze plant safety status conditions. The procedure guideline provides instructions for the SPDS operator to call up any SPDS screen displays available in the SPDS. The guideline allows the operator to follow plant conditions as specified by the EOP procedural steps and determine plant performance by viewing plant safety status as the EOP steps are accomplished.

When the SPDS is used with the EOP procedure, the EOP procedure is the driving force in controlling the SPDS. The SPDS operator will normally use the SPDS to follow plant conditions identified in the EOP steps. In addition, the SPDS operator may observe other plant status to determine the changes influenced by the EOP procedural steps. Operating the SPDS as described will provide plant personnel with information to determine plant conditions to aid the operating staff in determining the conditions the EOPs were entered.

To ensure the procedure guideline and SPDS philosophy objectives are accomplished, a procedure validation and verification program has been incorporated into the SPDS philosophy. The procedure validation and verification program ensures the procedure guideline and SPDS philosophy are impleme?ted correctly and fulfills the requirements for which they were developed. The procedure validation and verification are the last phase in the development process before the SPDS philosophy and procedure guideline are approved and recommended for use in the plant.

DLC has assessed the SPDS design to functional guidelines of Supplement 1 to NUREG 0737. The following discussions address these considerations.

1. The SPDS should provide a concise display of critical plant variables.

The top level displays (narrow and wide range iconics) present the critical plant variables utilizing distortion of an octagonal pattern and color coding to illustrate critical / abnormal plant conditions. These displays provide a top level assessment of plant conditions. Second level graphic displays provide the overall plant status, third level displays provide a graphic representation of plant systems and the fourth level displays provide alphanumeric format displays of sensor data. The display methodology is identical to the generic design reviewed and accepted by the NRC and has also been endorsed in Supplement 7 to WCAP-10170.

[

5-

S2fCty AnalyJia R: port for BcCvCr Vallcy Unit 1 SOfoty ParametOr Dicplcy Sy0tcm (SPDS)

2. The SPDS shall be located convenient to the control room operators.

Two SPDS terminals are located in the BV-1 control room. One terminal is located on the operators console and the other is located on the center section of the vertical control board with the control keyboard located on the center island console near the control board. The displays are convenient to the SPDS operators when the use is considered in the context of the overall SPDS philosophy of operation and use. All STAS, licensed operators and selected control room personnel will be trained to operate, interpret and understand the information displayed on the SPDS terminals. The STA is the primary user of the SPDS in the control room (as indicated in the philosophy) and the application of a team concept in the control room to mitigate transients illustrates the usefulness to the STA of the terminal at the operator console. The operators have a clear view of the SPDS CRT located on the conter section of the vertical control board. To clarify the use of the SPDS, the primary source of indication for the operators is the control room indicators and the operators are trained to mitigate transient or emergency conditions using these indicators in conjunction with the Emergency Operating Procedures (EOPs).

3. The SPDS shall continuously display information from which the safety status of the plant can be assessed.

The top level iconic displays (terminate and mitigate mode) provide a conciso display of the critical plant parameters. The lower level displays provide more useful detailed information to analyze and diagnose a plant transient or emergency condition.

Discussions with plant operators indicate that the overall plant status display (level 2) and the reactor coolant system flow diagram display (level 3) have proven to be a very useful display on the SPDS CRT located on the vertical board.

The SPDS produces 29 displays that provide control room personnel with graphic representations of plant system conditions during normal and emergency plant operations. These displays provide the SPDS user with optional means of obtaining information necessary to assess the plant safety status. Any one of these 29 displays will be administratively maintained on the SPDS screen in the control room while the SPDS is in service.

S2fCty Annlysis R port for Bc; var Vallcy Unit 1 Safety Parameter Display System (SPDS) s

4. The SPDS should aid the operators in rapidly and reliably determining the safety status of the plant.

Validation testing of the SPDS system was performed as a combined factory / site acceptance test procedure which included hardware diagnostic testing, man-machine interface tests, (i.e.: data update and response time) input processing performanco, and SPDS algorithm and display coding verification.

Digital input indication was verified relative to device position by simulated testing and by exercising the actual field device.

Analog input verification tests were conducted to verify process loop integrity after tic-in of the computer. Testing was conducted to determine that the SPDS tie-in did not degrado existing Plant Variable Computer indication. SPDS analog input accuracy testing was conducted to verify the I/O cabinet input with the SPDS display and to verify proper indication scaling.

The SPDS display indication was also subjected to an accuracy verification with the corresponding control room indication.

Other miscellaneous SPDS testing included ARTEL fiber optic verification ERF-BVPS data multiplexor testing and Avanti repeator/ driver verification.

The test specification for the SPDS computer specification number 8700-DES-004, Revision 1 defined the engineering test requirements and acceptance criteris and is the basin for the test procedures. The specification requirements for the following parameters are: update rate (2 seconds), display refresh rate (60Hz), availability (greater than 99% in the control room), and response times (2 second background start and 10 second maximum to build a display).

The satisfactory performance of the test procedures and test results verified that the SPDS met the specification requirements. All open items which were identified during testing have been resolved and DLC considers the functional guidelines of Supplement 1 to NUREG 0737 to be satisfied.

The SPDS designed availability estimate is greater than 99%. An administrative procedure will be developed and implemented prior to start-up following the seventh BV-1 refueling outage to monitor the SPDS unavailability. Computer downtime will be tracked using a problem log which will be reviewed for trending purposes to reduce downtime and improve overall system availability.

The SPDS is designed such that the processing of any variable shall not increase the error of the displayed value by more than 1% of the span of that variable. The accuracy of the SPDS process combined with the accuracy of the analog indication yields an overall accuracy of the SPDS displayed variable of 2%.

~

Safcty Analisic Raport for B3avar Vclley Unit 1 Safety Parameter Display System (SPDS)

~

The SPOS displayed information will be periodically verified primarily by performing checks with other qualified indication.

A program to accomplish these verification checks will be implemented prior to start-up following the seventh refueling outage.

Data validity on the SPDS displays is illustrated by four quality attributes associated with each variable. The qualities are

,d, Manual, Poor and Bad. Manual data will indicate that the C ae has been manually entered into the data base rather than i . ..m a scanned sensor. Poor data will be used to indicate that one or more sensors of a redundant or diverse set of sensors are no longer Good. Bad data will be used to indicate that a sensor value iF either missing or detected by the system as resulting from failed input devices. Data quality will be retained as an attribute of any calculated variables and will be determined based on the quality of the individual inputs to that calculation.

The SPDS also utilizes the following color convention in conjuction with the qua ity codes: yellow is used to represent normal conditions, magents to represent suspect (bad, poor, or manually substituted) values and red to represent alarm conditions.

This color convention is the standard applied to the generic W SPDS; however, when the SPDS was evaluated during the BV-1 control room design review an inconsistent color 'oplication was identified and documented as a human engineering ) ,repancy. As a result, the SPDS color application will be ch. 7d and green will be substituted for yellow where yellow is t x1 to depict normal conditions and yellow will be substitutea for magenta where magenta is used to depict suspect conditions. This change will be subjected to the same design process as the delivered system and the change is scheduled to be implemented prior to start-up following the seventh BV-1 refueling outage.

Security is maintained on the SPDS through several means. The SPDS software can only be modified from the programmers console using a number of sequential steps. These steps involve unloading the operating disk, loading the source code disk, performing a system rebuild to include the modifications, and transferring the rebuilt system to the operating disk. The SPDS database can have approved online changes performed. These online changes are temporary since they are not part of the database master disk. Modification of the database master disk l requires an approved database change i. em and several steps similar to the above. Procedures for software and database modifications are covered in the operating manual and I&C manual.

[

3 SOfsty Analycia Report-for 53cvar Valley Unit 1 Safcty Paramator Display System-(SPDS)

5. The SPDS shall be suitably isolated from electrical and electronic interference with equipment and sensors that are in use for safety systems.

In a letter dated April 9, 1986, the NRC requested additional information regarding the isolation devices utilized with the BV-1 Safety Paramci.er Display Systems. In a letter dated February 17, 1987, DLC submitted a response to this request for addjeional' information and to date no further information on the sub,- c has been requested.

6. The SPDS shall be designed to incorporate accepted human factors principles so that displayed information can be readily perceived and comprehended by the SPDS users.

Section 2.2.1(b) of Supplement 7 of WCAP-10170 describes the human factors engineering process performed on the SPDS design.

In addition, a human factors review of the SPDS was performed using the guidelines of Section 6.7, Process Computers, of NUREG-0700. The review has been conducted and the HEDs will be processed in accordance with the BVPS-1 Detailed Control Room Design RevinW (DCRDR) Program. The details of the SPDS human factors review will be provided in a DCRDR Supplemental Report which is currently scheduled to be issued on November 18, 1988.

A summary of ene results is provided below.

Total Number of 0700 Guidelines in Section 6.7 224 Number Complied With 124 Number Not Complied With 19 Number Remaining To Be Checked 7 Number Determined To Be Not Applicable 74 The more significant discrepancies address the abbreviations used in the screen text, no CRT displays of the files being processed and no storage of sequential files of operator entries, the use of color codes and the CRT location on the vertical board. All the items to be checked except one pertain to measurements of the screen luminance in the control room.

Additionally, the BVPS-2 SPDS Computer Survey results were reviewed in order to determine a consistent application of the NUREG-0700 criteria. Finally, 30 of the guidelines which were determined to be "not applicable" are included in the Printer, Alarm Messages, and Graphs & Tables Requirements Sections of Section 6.7 of NUREG 0700. These guidelines were determined to be "not applicable" because the SPDS utilizes a video copier and because the SPDS does not function as an alarm printer for the Annuniciator System.

Snfsty Annly3ic Rsport for B3nvar Valley Unit 1 Snfoty Param3 tor Display Systcm (SPDS)

7. The SPDS should display critical plant variables.

The parameters displayed on the SPDS are required to provide the operator with sufficient information regarding the following five critical safety functions identified in NUREG 0696 and in section 4.1.f of Supplement 1 to NUREG 0737.

I. Reactivity Control II. Reactor Core Cooling anu Heat Removal from the Primary System III. Reactor Coolant System Integrity IV. Radioactivity Control V. Containment Conditions Westinghouse and DLC selected those plant specific parameters necessary to evaluate the critical safety functions listed above.

The parameters used in the two top level iconic displays (terminate and mitigate mode) have been placed in these five safety functions and are listed in Tables C.1 & C.2 of Supplement 7 to WCAP-10170. Table C.3 maps the individual system displays into the five safety function categories and Table C.4 maps the individual plant parameters into the five safety function categories.

8. Procedures which describe the timely and correct safety status assessment when the SPDS is and is not available will be developed by tne licensee in parallel with the SPDS.

Furthermore, operators should be trained to respond to accident conditions both with and without the SPDS availcble.

The SPDS philosophy identifies the principle users of the SPDS to be the STAS. Additionally, all STAS, licensed operators and selected control room personnel are trained in the use of the SPDS. A procedure guideline is being developed as a reference for the SPDS operator to instruct the user on the use and effective manipulation of the system. With this procedure guideline, the SPDS aids plant operatians and emergency personnel in monitoring and assessing plant safety status, however, the

. guideline maintains that the primary sources of indication for the operation of the plant are control room and control board indication and plant equipment. If the SPDS is not available, the control room crew is already trained to mitigate the transient or emergency condition by using the control room indications, normal operating procedures and Emergency Operating Procedures. The SPDS philosophy and the procedure guideline verification and validation process are conducted to determine that the philosophy and guideline are correctly implemented to l demonstrate that the SPDS fulfills the purpose for which it is intended. SPDS training to this philosophy and procedure guideline will be completed prior to start-up following the seventh BV-1 refueling outage.

l

.