ML20236G894

Forwards Evaluations of Preliminary Test Results of SPDS Isolation Devices,Including Isolators 4,5,8,9 & 10

ML20236G894
Person / Time
Site:	Rancho Seco
Issue date:	07/24/1987
From:	Andognini G SACRAMENTO MUNICIPAL UTILITY DISTRICT
To:	Miraglia F Office of Nuclear Reactor Regulation
Shared Package
ML20236G897	List: ML20236G894 ML20236G900 ML20236G904
References
GCA-87-341, TAC-56525, NUDOCS 8708040414
Download: ML20236G894 (11)

Text

_ _ _ _ _ - _ _ . _.

g'3SMU=

~ SACRAMENTO MUNICIPAL UTILITY DISTRICT O P, O. Box 15830. Sacramento CA 95852-1830,(916) 452-3211 AN ELECTRIC SYSTEM SERVING THE HEART OF CALIFORNIA

'JUI. 2 4 1987 GCA 87-341 U. S. Nuclear Regulatory Commission Attn: Frank J. Miraglia, Jr.

Associate Director for Projects Philips Builsiing 7920 Norfolk Avenue Bethesda, MD 20014 DOCKET NO. 50-312 RANCHO SECO NUCLEAR GENERATING STATION LICENSE NO. DPR-54 REQUEST FOR INFORMATION ON SPDS ISOLATION DEVICES

Reference:

Letter from J.E. Hard to F.J. Miraglia, dated April 17, 1987

Dear Mr. Miraglia:

Attached is an evaluation of the preliminary test results of the Safety Parameter Display System (SPDS) isolation devices. The attachment and its associated enclosures provide a discussion of each isolator for which credit is taken in the SPDS. The specific isolators addressed herein are numbers 4, 5, 8, 9 and 10 as shown on the block diagram provided the NRC in the District's April 17, 1987, submittal (referenced).

If there are any questions, please contact John Atwell of my staff.

Sincertly, An n Chief. Executive Officer, Nuclear Attachment cc: G. Kalman, NRC, Bethesda (2)

A. D'Angelo, NRC, Rancho Seco [

QB040414g7o7p4 t \

p ADOCK 05000312 PDR g HANCHO SECO NUCLEAR GENERATING STATION O 1444o Twin Cities Road, Hera:d, CA 95638-9799;(209) 333 2935 L_____________

ATTACHMENT ISOLATOR TESTING DISCUSSION Discussions will be provided in this attachment for isolators #4 (Anatec Multiplexer Digital Input Printed Circuit Board Optical Isolator), #5

( Anatec Multiplexer Analog Input Printed Circuit Board Transformer Coupled Isolator), #8 (Anatec Bus Isolator), #9 (Anatec Central Control Unit interface with IDADS Transformer coupled with 1/16 amp fuses) and

1. 10 (Anatec Central Control Unit to Select Unit interface Optical Isolator). All of these isolators have been tested by Eigen Engineering using the test criteria previously discussed with the NRC and described in-the enclosures.

1. ISOLATOR TESTING

a. Tests for Isolators #4 and #5:

These isolators were tested in the forward direction to show isolation of the multiplexer from the non-1E signal inputs. The test results for 'solator #4 are summarized in paragraph 2.6 of Enclosure #1. The results show that the optical isolator is not damaged by either the 120 Vrms (340 Vp-p) or the 140 Vdc maximum credible voltage (MCV) application at the input terminals of the printed circuit board.

The test also indicated that the higher than normal voltage input only causes the light emitting diode to operate normally with the only effect being an erroneous signal being transmitted to the multipl3xer backplane and eventually to the data buses. The effect of such an erroneous signal would be a single piece of bad data to the IDADS and/or the SPDS computer (s). Since the inputs to these non-1E nultiplexers are not Class lE, the erroneous information would be undesirable but would not present a safety problem.

The test results for isolator #5 are summarized in paragraph 2.5 of Enclosure #1. The results show that the input differential impedence of the analog printed circuit board is high enough (40,000 ohms for the test board) to cause the voltage across the primary of the transformer isolator, due to MCV applied at the input, to be reduced sufficiently to insure that failure of the primary coil does not occur. As a result, the output of the printed circuit board would present a full range digital signal i to the multiplexer backplane and eventually to the data buses.

For example, if the maximum credible voltage was applied to an input from a pressure transmitter with a range of 0 to 400 psig, the computer would read a value of 400 psig. The test report l l

also states that the printed circuit board was not damaged and 1 remained functional after the test.

NRC005(E3.2) _. __ . _ _ _J

L ISOLATOR TESTING DTSCUSSION (CONTINUED)

b. Test for Isolator #8:

The test results for isolator #8 are summarized in paragraph 2.1

, of Enclosure #1. Isolator #8 is the bus isolator that protects the data bus from failures internal to a multiplexer or protects the multiplexer from failures on the data bus. This isolator was tested in both directions using two maximum credible l

voltages (120 VAC and 140 Vde). It should be understood that each multiplexer communicates with both data buses and, therefore, both channels of the data acquisition system. Thus, each channel of the SPDS and IDADS has input data from all plant sensors which provide input to the Anatec multiplexer system.

If one data bus (or channel) of the data acquisition system is damaged or fails, the remaining channel has good data from all plant sensors assuring no loss of train A or B sensor data. For the situations where a multiplexer inputs data to the Class 1E data bus, the data has to pass through at least one #8 bus isolator. In most cases, prior to being input to the final Class 1E data bus, multiplexer input data must pass through two

1. 8 bus isolators.

' Prior to the tests on the #8 bus isolators it was believed that very low current fuses could be substituted for the jumpers that select the attenuation for each isolator thus improving isolation. During the tests,1/8 ampere fuses were inserted in the jumper positions for circuits A and D (17db and 47 db attenuation circuits respectively). For all maximum credible voltage tests, the current through the fuses was so low (3 ma maximum) that none of the fuses were ever blown. Based on this result the District does not consider the addition of fuses to be necessary to provide adequate isolation.

In performing the maximum credible voltage tests two resistance values were chosen to provide load impedance that would simulate the primary of a transformer at the end of the data bus at the Central Control Unit and at the multiplexer. All data bus terminations are transformer coupled. These values of resistors were chosen to be 100 ohms and 20 ohms. Both of these values would represent a worst case condition since the primaries of the transformers would be a lower impedence value to 60 hertz than to the normal approximate 8 megahertz data frequency. At 140 Vdc the transformer would be a very low resistance value, probably 2 or 3 ohms.

The results of this test show that very low levels of voltage, i at 60 hertz, were seen at the load side of the #S bus isolator.

The maximum voltage across the 100 ohm load was 0.238 volts peak to peak which would not be enough to cause a problem either at 4 the CCU or at any multiplexer. The 0.238 volt value was with l the fuses in the A jumper positions which would be in the low NRC005(E3.2) .

. .. _ _ . . .. - _ _ _ _ _ _ a

ISOLATOR TESTING DISCUSSION (CONTINUED) attenuation circuit. The low attenuation circuit provides 17 db attenuation at 8 megahertz but it should be evident that at 60 hertz the attenuation has greatly increased (i.e., to approximately 63 db). The following calculation verifies the change in attenuation:

V input 340 P-P Attenuation in db = 20 log ------- = 20 log -----

Y output 0.238 P-P

= 20 log 1428.57 = 20(3.1549)

= 63.098 db The data bus is designed to operate with a transmitter power from 2 to 8 watts of RF power. The Rancho Seco system operates at 2 watts. The power allowed through the bus isolator (ignoring cable attentution of I db/100 f t) under normal conditions at the 8 MHZ frequency is on the order of:

Pout = Pin / anti-log 17/10

= 2 watts / anti-log (1.7)

= 2/50.12 = 0.0399 watts.

The power allowed through the bus isolator during the test was approximately:

P = Vrms2; where Vrms = Vp-p = .238 R 2 V"Y 2.828

= 0.084V therefore P = 0.0842 = 0.00007W 100 This low power level could not damage either the multiplexer (if originating at the bus) or the bus (if originating at the multiplexer) since normal operating power is much higher. In addition to bus isolator attenuation, the receiver inputs have 2200 pf capacitors rated at 500 V in each leg of the coupling transformer (installed as blocking capacitors). Each capacitor  !

represents approximately 1.2 M ohm additional impedance to the 60 l hertz frequency.

To assure that a longer exposure of the bus isolator to the MCV would not have a detrimental effect, the test applied the 120 Vac for a continuous 20 minute period without any damage occurring to the bus isolator.

NRC005(E3.2) _ __ . _ _ _ _ . _-____ ___ - _ _ -

J ISOLATOR TESTING DISCUSSION I (CONTINUED) j i

l

c. Test for Isolator #9:

The transformer coupled isolator (#9) between the Anatec Central ,

Control Unit and the Interim Data Acquisition and Display System l was tested with two encapsulated 1/16A fuses in the transformer j legs (one fuse in each leg). The results of the tests are ^

summarized in paragraphs 2.3 and 2.4 of Enclosure #1. The tests show that the protective fuses properly protect the Class lE circuit from the application of the MCV. Although the attached test results do not describe the short or open tests, these tests were performed previously ( Attachment #4 of Reference #1) and found not to cause any damage to the transformer or receiver / driver. The tests in Enclosure #1 were primarily made to prove proper fuse operation with encapsulated fuses. The fuses were encapsulated with General Electric RTV 162 silicone rubber adhesive sealant. The final report will show that the encapsulation material will not deteriorate, it adheres to the printed circuit board and is not easily removed.

d. Test for Isolator #10:

The test results for isolator #10 are summarized in paragraph 2.2 of Enslosure #1. This test result shows that the MCV fault burns up the light emitting diode but does not cause any short of the MCV across the isolation module. Special attention was given to the +5Vdc power source to assure that no damage or readable change l could be seen.

e. Multiplexer #1:

l In the case of multiplexer #1 (H4CDAR1),where the class 1 data bus is located, concentrated effort nas been applied to design and install properly separated and isolated data buses. The two buses )

are routed on opposite sides of a 30" seismically qualified cabinet. In addition to separation, each bus isolator in multiplexer #1 will be covered so that no bus terminations and/or circuit board components can be subjected to maximum credible voltage faults internal to the multiplexer cabinet (Attachment 3, Ref. 2). The A-C power cables that are routed inside the cabinet are separated from the date buses by no less than 6" as required by Reg. Guide 1.75 and/or IEEE-384 Due to the separation of the '

two data buses and the protective covers on each bus isolator j there is no credible single failure that can cause the loss of either or both data buses as a result of being physically located in the seismically qualified H4CDAR1 cabinet. The data buses and their individual bus isolators are independent of multiplexer #1 operation since they are passive devices and do not require power from the multiplexer's power supply.

NRC005(E3.2) - . .. _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _

1SOLATOR TESTING DISCUSSION (CONTINUED) 1 The only communication between the data buses and multiplexer #1 are the data signals that are transmitted and received through bus isolators BI #1 and BI #12 located on opposite walls of the cabinet. This pathway is the only multiplexer input in the entire system that has only one bus isolator between the multiplexer and the class 1 data bus. The attenuation selected for these particular bus isolators is 47 db.

Based on the above, the District considers the design of multiplexer #1 to be acceptable. The cabling from the multiplexer to the bus isolator is routed internally to the H4CDAR1 cabinet and not in any conduits or cable trays external to the cabinet thus precludina potential interactions. Also, care was taken in the routing .o insure separation as required. Since the two bus isolators in Multiplexer #1 are feeding identical data to both buses, if a failure occured internal to the multiplexer affecting one of the cables to either bus isolator, it would not cause a loss of data to SPDS. Class 1 data buses are separated by approximately 30 inches. In addition, no single f ailure can cause a failure of both data buses and since the data on each bus is identical, no data is lost to SPDS. As a result of the foregoing evaluation. SMUD intends to continue to power the H4CDAR1 cabinet with non-1E power rather than upgrade it to 1E power as described in the District's previous submittal.

f. CSU/CCU Interface:

The following is a discussion and analysis of the interface between the two channelized Central Control Units and the CCU Select Switch (CSU).

Enclosure #2 is intended to clarify previous information provided during the NRC audit meeting held at Rancho Seco (September-October 1986). These sketches have been re-arranged and drawn to show the duplication of control signals that has been designed into the Anatec Data Acquisition System. Each sheet consist of figures that are separated into three sections representing CCU #1, CCU #2 and the CSU.

In both CCUs, the interface with the CSU is accomplished by the CCU Select Interf ace printed circuit board. Internal to the CSU, the interf ace is accomplished by the CCU Select Unit printed circuit boards.

The CSU contains two printed circuit boards each of which communicates with both CCUs (Select Interface printed circuit board) by way of separate input connectors. As shown in enclosure

1. 2, the various cir Jits that originate in the CCUs, and interface with the CSU, have duplicate signals that go to separate printed circuit boards in the CSU. The printed circuit boards in the CCUs have two (2) ceparate sections with independent +5VDC regulators to provide power to the duplicate circuitry.

NRC005(E3.2)

ISOLATOR TESTING DISCUSSION (CONTINUED)

The +5VDC regulators have a common source of +8.5VDC from the CCU backplane. This +8.5VDC is an output of the class 1 power supply. Additional tests were performed to determine the effect of a maximum credible voltage fault on the cables routed between the CSU and the CCUs. These tests were conducted at 120VAC even though care has been taken to route cables inside the class 1 cabinet to insure proper separation (at least 6") between A-C power cables and signal cables. The results are included in Enclosure #3. The circuits tested are those shown in Enclosure #2 without optical isolation. It should be noted that signal destinat ans are optically isolated whether the origin is in the CSU or the CCU. Also, the circuits have optical isolation devices in either the CCU or the CSU for all loops. This isolation should preclude a MCV fault from damaging both the CCU and the CSU.

The tests performed show that if 120VAC is applied across two conductors of a cable going to CCU #1 (pins J1-29 and J1-28 of the SELECT Al circuit) the transistor, 47,160 and 750 ohm resistors will burn open. As a result of these 1/4 watt resistors burning open the +8.5 VDC source or the inverter chip did not suffer any damage and were functional after the test. The +5.0 VDC power source for the inverter chip also was undamaged. In all cases, the resistors in the logic circuits are 1/4 watt and when connected directly to a 120 VAC power source are of low enough resistance that they burn up usually within a 5 to 10 ms time period. These results have been documented and will be forwarded as soon as available, Enclosure #3 includes preliminary results.

Loss of any single sigtal loop will only affect one channel of operation. That is, for worst case failure only one CCU would be lost and the other would continue to function, providing signal information to the remaining channel of SPDS.

The duplication of signal loons, in most cases, will prevent a failure of the CCU or CSU, ha for this analysis, it is assumed that one channel is caused to fail. Tests on the actual equipment have been performed to simulate a loss of input / output signals from/to the CCUs and the CSU. During normal operation with the CSU in the "AUT0" mode of operation, one cable connection at a time was disconnected with the resulting loss of all signals associated with that cable. For example, cables connected to J5 and J7 have nine (9) signal loops connected between the CCUs and tne CSU. The cables connected to J4 and J6 have duplications of these nine (9) signal loops plus the control signal from the key-lock switch that selects modes of operation. The results of the cable removal tests are tabulated as follows:

J4 Connector Removed - CCU #2 is selected continuously while selector switch is in "AUT0" mode

- CCU #2 can be selected manually

- CCU #1 can not be selected manually

ISOLATOR TESTING DISCUSSION (CONTINUED)

J4 Connector Replaced - CCUs #1 & #2 selected alternatively after pushing RESET pushbutton J5 Connector Removed -

Same result as J4 Connector removed J5 Connector Replaced -

CCUs #1 & #2 selected alternatively after RESET J6 Connector Removed -

CCU #1 is selected continuously while Selector Switch is in "AUT0" mode CCU #1 can be selected manually

- CCU #2 can not be selected manually J6 Connector Replaced -

CCUs #1 & #2 selected alternatively after RESET J7 Connector Removed -

Same Result as J6 Connector removed J7 Connector Replaced -

CCUs #1 & #2 selected alternatively after RESET These tests show that if the CSU is operating in the "AUT0" mode, a loss of a critical input / output signal (or signals) on a particular cable would always allow opposite CCU to operate properly.

As stated above, the selector switch on the CSU is a key switch and it would be locked in the "AUT0" mode except for maintenance purposes. Maintenance would only be performed on an emergency basis or during scheduled maintenance outages.

If a channel of the SPDS fails as described above, the operator would be informed that the display was not updating for the affected channel and thereby would monitor plant operation by using the other display that would still be functioning properly.

The remaining CCU would still be displaying all of the SPDS parameters.

The above test verifies proper operation of at least one CCU for all open circuit faults.

An analysis of circuit diagrams in Enclosure #2 will show that a MCV fault on the circuits shown on figures 1, 2, 5, 6, 7, 8 & 10 of 10 would not cause f ailure of both CCUs since there are no paths from one CCU to the other. Circuits shown on figures 3, 4 and 9 of 10 do have paths that connect between both CCUs. These circuits have been tested in the plant and operation of at least one CCU was maintained as in the cable removal tests.

1 l

NRC005(E3.2) I J

l 1

L_._____________.____.. _

ISOLATOR TESTfNG DISCUSSION (CONTINUED)

As a part of the SPDS upgrade, the CCU cabinet H4CDAL was re-arranged to provide required separation between channels. In doing this separation, cabling internal to the cabinet was routed to insure separation between power cables and signal cables in ,

each channelized portion of the cabinet. Channel B components; l consisting of CCU #1, Receiver / Transmitter #1, and power supply #1 { '

are located in the upper portion of the cabinet. Channel A components; consisting of CCU #2, Receiver / Transmitter #2, power supply #2, CCU Select Unit (CSU), and fans are located in the lower portion of the cabinet.

Separate sources of class 1E power are brought into circuit breakers on opposite sides of the cabinet (30" cabinet). Channel A comes from the bottom and channel B from the top of the j cabinet. There are four (4) cables routed f rom'the CSU. Two cables each are routed to separate CCU's. These cables are routed to each CCU in such a way as to maintain required separation between channels and also between signals and power. The cable connectors are mounted at the rear of the CSU. They are MS type connectors that provide a barrier between cable terminations where minimum separation is not maintained.

The possibility of a MCV fault of 120 VAC occurring anywhere in the cabinet is reduced to an absolute minimum by the following design characteristics:

The cabinet and all components are class 1 seismically qualified, which reduces the possibility of wires or components becoming loose or free.

Minimum physical separation is maintained where possible.

Where minimum separation distance is not possible, barriers are provided.

The low voltage digital components in each CCU are isolated from the 120 VAC source by the DC power supply providing low level ,

voltages to the approprite CCU. The D-C power supply is of a very i rugged design. These power supplies employ several convers'?n stages to provide the required D-C voltages. The A-C input 120 VAC 0 60 hz is applied through an EMI filter, a 10 A fuse, a silicon controlled rectifier (SCR) pulse-width modulator (PWM) pre-regulator and converted to +70 VDC. The output of the pre-regulator is chopped into the primary of the 50 khz transformer by the 50 khz PWM inverter. The multiple outputs of the 50 khz transformer are rectified, filtered and regulated for final output voltages. Sense inputs are provided for shutdown of PWM and 50 khz transformer upon overvoltages, thus effectively assuring power supply shutdown. Therefore, the possibility of the 120 VAC feeding through the power supply to the digital components is not credible. The power supplies are also used in the

. multiplexer cabinets and are auctioneered in those cabinets.

NRC005(E3.2)

ISOLATOR TESTING D8SCUSS80N (CONTINUED) l A single five volt power supply provides the logic voltage for the CSU. This is a power supply which has two amp fuse protection on the input line. It incorporates a foldback technique for overload protection, and overvoltage protection which crowbars the .

output on a rise of output voltage. The possibility of 120 VAC ,

propagating through the supply to the digital components in the  !

CSU is not credible.

Distribution of the 120 VAC inside the CSU enclosure to the fuse, power switch and fans is accomplished by terminating the 120 VAC on a terminal block mounted on the side of the enclosure. The power switch on the front panel is completely enclosed providing a barrier against any exposure. Termination to the fans is on the i side of the enclosure, remote f rom any other termination. The ,

fuse is located at the bottom rear of the enclosure, separated from other terminations. Terminations to the power supply are on a terminal block inside the confines of the supply.

Due to the care taken in the design and manufacture of the CSU, it is the District's position that the CSU will not cause a f ailure l of both CCU's and that the CSU can provide its necessary function without causing a failure of both channels of the SPDS.

2.

SUMMARY

In summary, the isolators tested have been shown to provide sufficient isolation to ensure the safe operation of the SPDS. The evaluations performed above provide a detailed analysis of the areas of concern describing that no single failure will cause a loss of the SPDS functionality. Thus, the District considers the design of the SPDS to be acceptable. Final test reports will be forwarded in August 1987.

i

3.

REFERENCE:

1. Letter from J.E. Ward to F.J. Miraglia, Dated January 12, 1987

2. Letter from J.E. Ward to F.J. Miraglia, dated April 17, 1987 I

i l

4 l

NRC005(E3.2) j 1

i

ENCLOSURE NO. 1 PRELIMINARY TEST RESULTS ISOLATOR N0'S 4, 5, 8, 9 AND 10

_ _ _ _ _ _