ML20211E918

Submits Data Re Availability of Computers to Demonstrate Compliance w/NUREG-0737,Item II.F.2 Concerning Reactor Coolant Inventory Trending Sys & in-core Thermocouple Display,Per NRC 870121 Disagreement W/Util

ML20211E918
Person / Time
Site:	Three Mile Island
Issue date:	02/18/1987
From:	Hukill H GENERAL PUBLIC UTILITIES CORP.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
RTR-NUREG-0737, RTR-NUREG-737, TASK-2.F.2, TASK-TM 5211-87-2037, NUDOCS 8702240440
Download: ML20211E918 (8)

Text

_ _ _ _ _ _ _ _ _ _ -

GPU Nuclear Corporation

, NQQIgf Post Office Box 48o Route 441 South Middletown, Pennsylvania 17057-0191 717 944 7621 TELEX 84 2386 Writer's Direct Dial Number:

February 18 1987 5211-87-2037 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

Dear Sir:

Three Mile Nuclear Station Unit 1 (THI-1)

Operating License No. DPR-50 Docket No. 50-289 NUREG 0737 Item II.F.2 Reactor Coolant Inventory Trending System and Incore Thermocouple Display By letter dated January 21, 1987, the NRC Staff identified disagreement with positions expressed in GPUN letter 5211-86-2184, dated January 5,1987, with respect to Reactor Coolant Inventory Trending System (RCITS) Display and the Incore Thermocouple Display.

GPUN recently has compiled data with respect to the availability of the TMI-1 computers. As discussed with members of the NRC Staff in a telephone conversation on January 31, 1987, we believe this new information demonstrates THI-1 compliance with the specific requirements of NUREG 0737 Item II.F.2, based on considerations separate from those expressed in the January 21, 1987 letter.

RCITS Display Clarification Item 7 of NUREG 0737 II.F.2 specifies that all instrumentation in the final ICC system must be evaluated for conformance to Appendix A(B),

" Design and Qualification Criteria for Accident Monitoring Instrumentation",

as clarified by item 8 that follows. Item 8 specifies that if a conputer is provided to process liquid level signals for display, the single failure criterion of item 2, Appendix A(B) need not apply to the channel beyond the isolation device if it is designed to provide 99% availability with respect to functional capability for liquid level display.

For the Reactor Vessel and Hot Legs level indications, signals enter a separate section of the Bailey 855 multiplexer and are displayed through the Bailey or Mod Comp computers. The Bailey 855 multiplexer interface is a connon component as shown in Figure 1 and the conputers function as display devices. 0702240440 870210 PDR ADOCK 05000209 P PDR GPU Nuclear Corporation is a subsidiary of the General Public Utilities Corporation h uji

5211-87-2037 February 18, 1987 As discussed in the January 31 telephone conversation a design availability

. was not specified at the time the computer system was specified and built.

However, the manufacturer, Bailey, provided a System Description which specifies the following:

"The ' organization of the complete 855 Process Computer System has been established to meet certain specific-objectives of on-line process applications... Hardware reliability and maintainability, as well as program integrity, are necessary to meet the requirements for high system availability. The Bailey 855 Conputer System is so organized, from both a hardware and a sof tware standpoint, to take fullest advantage of the conputer speed and perfornance capability in the most flexible and

. reliable nenner."

Actual operating experience demonstrates high systein availability. Based on a review of conputer maintenance records, there were only 8.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in 1986 when both the Bailey and Mod Comp systems were 4noperative at the same time. The discussion of conputer. availability for 19M provided as Attachment 1 demonstrates that the reactor vessel water level display availability was greater than 99.9% during 1986. We feel the 1986 data is representative.

Both systems showed a trend of inproved ava!1 ability during the second half of 1986. We believe this is due to correction of a nunber of syster problems during 1986 and leads us to conclude that system perfornance will be as good or better in the future.

As shown on Figure 1, the input nultiplexer is common to both the Bailey and Mod Comp systems, and it is for this component alone that demonstrated availability is an issue, per Clarification item (8). The multiplexer had some relays fail during the year which resulted in some of the greater than 1500 points being inoperative; however, the RCITS level inputs were operable during the entire year. Based on the fact that the RCITS level inputs through

, the multipler experienced no failures through 1986, it is apparent that this

! is a highly available device. With no failure data, a statistical evaluation (and associated level of confidence determination) is not appropriate. Four separate water level signals are input to the input multiplexer (i.e.,-Hot leg

Level A and B, and Reactor Yessel Head Level A and B).

, In summary, although a percentage was not specified, the TMI-1 conputer system

! was designed to have high system availability. System performance during 1986 exceeded the 99% availability specified in the Clarification statements for

NUREG 0737 item II.F.2.

l Incore Thermocouple Display As shown in Figure 2 and as discussed in previous submittals, the Incore i Thermocouple System is conprised of a primary system and a backup system, as l

required by NUREG 0737 item II.F.2. There are a total of 52 incore .

l thermocouplos. From these 52,16 thermocouples (4 per quadrant) are branched l

l k

5211-87-2037 February 18, 1987 to the backup display system. Upon exit from the containment building electrical penetration asserrblies, the 16 thermocouples are fed to the selection switches. From the selection switches, any thermocouple circuit can be routed to the Backup Incore Thermocouple System Instrumentation, where the signal is conditioned and anplified by power from a Class lE source. Signal s from these 16 thermocouples also are fed back to the primary display system via the input multiplexer, and are available on an individual basis for readout as part of the primary display system.

As part of our evaluation of the availability of the TMI-l conputer system discussed above and in Attachment 1, we found that the incore thermocouple relay modules were operable during the entire year; thus, the availability of the computer system to display 52 thermocouple readouts, including the 16 which are also available for display by the backup system, was greater than 99.9% in 1986.

The TMI-l Technical Specifications provide requirements regarding operability and surveillance of the backup incore thermocouple display; namely, a display of four thermocouples per core quadrant and a minimum of two thermocouples operable per quadrant; calibration is required at each refueling period and a monthly check of capability to display four incore thermocouples pe* core quadrant also is required.

Item (3) of Attachment 1 to item II.F.2 specifies that a " backup display (or displays) should be provided with the capability for selective reading of a -

mininum of 16 operable thermocouples, 4 from each quadrant." Item (5) specifies that the " instrumentation must be evaluated for confornance to Appendix B, as modified by the provisions of items 6 through 9 which follow".

Item (8) specifies that the " primary and backup display channels should be designed to provide 99% availability for each channel with respect to functional capability to display a minimum of four thermocouples per core quadra nt. The availability shall be addressed in technical specifications".

The functional capability to display a minimum of four thermocouples per core quadrant is ensured by the TMI-1 Technical Specifications, as discussed above.

Finally, Appendix B to NUREG 0737 specifies that no single fatiure within either the accident monitoring instrumentation, its auxiliary supporting features or its power sources concurrent with the failures that are a condition or result of a specific accident should prevent the operator from being presented the information necessary for him to determine the safety status of the plant and to bring the plant to a safe condition and maintain it in a safe condition following that accident. This requirenent is satisfied by the fact that 52 incore thermocouples are available for computer readout, of which 16 also are hardwired to a digital backup incore readout display which is powered from a lE power supply.

5211-87-2037 February 18, 1987 The Bailey / Mod Comp system is being replaced by a Gould/SEL 3297 System with CPI multiplexers. The system has redundant processors with automatic failover capability. The multiplexer cabinets are being wired to plant sensors in 6R, the computers will be delivered in February 1987, and the system is scheduled to be functional by 8R. The Process Computer System Description (SDD 602I) defines as a design goal for the new computer system an availability of 99.5%.

Si ncerely, H. D. H kill Vice President and Director, TMI-1 HDH/SK/pa(1914g) 0795A l

r ATTACHMENT I PAGE 1 of 2 TMI COMPUTER AVAILABILITY FOR 1986 Based on a review of computer maintenance records, there were only 8.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in 1986 when both systems were inoperative at the same time. During the end of June and in early July, there were problems for longer periods in the computers that prevented both systems from running concurrently; however, s during the time that the 855 was being repairad, the multiplexer was occasionally switched to the 855 when the Modtomp was not needed for operations. When required, the multiplexer was switched back to the ModComp for use by Operations. ,

The multiplexer had some relay nndules fail during the year, which resulted in some points being inoperative; however, the RCITS levels and incore thermocouples were operable during the entire year.

SIM4ARY OF COMPUTER AVAILABILITY ._ j Downtime Downtime Combi ned 12/31/85 - 12/31/86 Total Time ModComp Bailey Downtime i January 1986 768 1.2 2 .075 February 1986 672 1.0 0 .0 March 1986 744 1.0 72 .025 3 April 1986 720 .4 0 0  !

May 1986 744 1.5 0 0 June 1986 720 41.6 84 0*

July 1986 744 48.9 44 8.0 August 1986 744 .1 0 0 September 1986 720 .2 0 0 October 1986 744 10.6 0 0 November 1986 720 .1 0 0 December 1986 744 .1 0 0 8784 106.7 hr. 202 hr. 8.1 hr.

99.91%

combined availability

• During periods Bailey was failed, ModComp was available, although was not continuously run, so that MUX could be used to support Bailey repair.

.M

r-r i

o ,

ATTACHMENT I i

i . PAGE 2 of 2 Although both systems had similarly high availabilities, the types and times

'- of failures were.very different. During the first half of the year, the MocCong system was troubled by spurious syster halts and auto restarts quite frequently by an intermittent hardware problem which was corrected in July.

The Bailey 855 was characterized by far fewer failures (3) which took longer to repair. ,

System Comparison Total MEAN MEAN Time No. of Repair Time to Between Failures Time (hr) Repair (hr) Failures (hr) Availability ModComp 31 5 106.8 .34 27.9 98.8%

Bailey 3 202 67.3 2928 97.7%

($

Combined system availability calculated from the product of each system unavailability is 99.97 percent.

The availabilities calculated only include times that the system was unavailable due to unplanned outages. The normal weekly diagnostics and preventative maintenance periods were not included as unavailable periods since the system could be quickly restored for operator use. This is a standard approach for determining availability values. For the intended use of displaying long-term information during accidents, the number of ModComp failures could be reduced from 315 to 6 ff outages shorter than five minutes were excluded.

i5 P'd t

(

~

5. _ - _

4 n.nn..n e

i s = s la .

l ll '

l a =E

== . . s

!f+

d l5og 4 Hh b

ga -* gg 8 Et3 EW

= -

A .

A 5 G

M Eh 5 E5 d E -

YkYL Y k YL 5

g

, _ . _ _ =

i _, , -

.J ,

O  ?

b n

> d C d .*

g<

g 5  ! .

O 4

s.

~

. I E I*<>w e r  ?

l 1

,--------.._v_--__ ___--_

s I

containment  ? Input Signal Digital 8 si i

+

Condition

+ Display e

si '

,r . g a

• Innlation Devicco I Backup System '

I r 4 RTil'n I-- J ,.

Ir, T/c'n

. O i 4

Diesel Backed 1E Power a

56 T/c's e Il cur Disp M  :

4 RTD's e Comnuter gl Printer l 8 b ic i RTit e n 8 16 Input '

i TC, * ,

, 3 Multipl ex -

TCs ,

t, I

d e

e

. 355 m 8

-)

r l'r int er s

, Comouter , ,

l , A "

Digital ,

, Display ,

s Hon IE l'ower 8 s .

Bnttery Mackup 8 e

Primar y S yntem 8

i IticoltE Till.nti(>cotit'I.E SYSTEtt Figure 2 i

i