ML20245A419

Review of WPPSS Nuclear Project 2 SPDS, Technical Evaluation Rept

ML20245A419
Person / Time
Site:	Columbia
Issue date:	03/23/1987
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML17279A602	List: ML20245A419
References
CON-NRC-03-82-096, CON-NRC-3-82-96 SAIC-87-3029, NUDOCS 8703270512
Download: ML20245A419 (12)

Text

- _ __ ____ ____ __ _ ___ _

ATTACHMENT 1

$A!C 87/3029

\

( 3.

REVIEW 0F WASHINGTON PUBLIC POWER SUPPLY NUCLEAR PROJECT NO. 2 SAFETY PARAMETER DISPLAY SYSTEM TECHNICAL EVALUATION REPORT

( )

March 23, 1987 SA M Submitted ta l U.S. Nuclear Regulatory Comission Washington, D.C. 20555 Contract NRC 03 82 096 y .-

/

6 Lf ,

(h ]O 3 '].'] O $

Pat (Wfte Sox 13CO.1710 Goodndpe Oks, Meleen, Vmnio DIW, ()(11) CI4100

o TABLE OF' CONTENTS ' '

Section f.Lgt

! INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . 1 11

SUMMARY

............................ 3 111 EVALUATION . . . . . . . , . . . . . . . . . . . . . . . . . . . 3 A. SPDS Description ..................... 3

8. Parameter Selection . . . . . . . . . . . . . . . . . . . . 5 C. Display Data Validation . . . . . . . . . . . . . . . . . . 7 D. Human Factors Program . . . . . . . . . . . . . . . . . . . 8 IV CONCLUSION , . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Y

INFORMATION NEEDED FOR STAFF CONFIRMATORY REVIEW. . . . . . . . . 9 REFERENC'ES. . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 e

Wee

t .

REVIEW 0F WASHINGTON PUBLIC POWER SUPPLY NUCLEAR PROJECT No. 2  ;, .

SAFETY PARAMETER DISPLAY SYSTDI

- I.- INTRODUCTION All holders of operating Itcenses (licensees) issued by the Nuclear Regulatory Comission (NRC) and all applicants for operating licenses (0Ls)

- must install a Safety Parameter Display System (SPDS) in the control rooms '

of their plants. The SPDS requirement as defined in Supplement 1 to NUREG-  !

0737 (Reference 1) are: ,,

1. To provide a concise display of critical plant variables to control room operators. (para 4.1.a)

2. To be located convenient to control room operators. (para 4.1.b)

3. To continuously display plant safety status .information. (para 4.1.b) ,

4. To be reliable. (para 4.1.b)

, 5. To be suitably isolated from electrical or electronic interference withsafetysystems.(para 4.1.c)

6. To be designed incorporating accepted Human Factors Engineer 4ng principles. (para 4.1.3)

7. To display, as a minimum, information sufficient to determine '

plant safety status with respect to five safety functions. (para 4.1.f)

1. Reactivity control

11. Reactor core cooling and heat removal from the primary system 111. Reactor coolant system integrity 1

I

J i . ,

.'4 iv. Radioactivity control

v. ' Containment conditions e

8.. To implement procedures and operator . training addressing actions with and without $PDS. (para 4.1.c)

I The purpose of the SPDS is to provide a concise display of critical plant variables to control room operators to aid them in rapidly and reliably determining the safety status of the plant. Supplement I to NUREG- ,

0737 requires. licensees and applicants to prepare a written safety analysis describing why the selected parameters are sufficient to assess the safety ]

status of-each identified function for a wide range of events, including i symptoms of severe accidents. Licensees and applicants must also prepare an ,

implementation plan, which contains schedules for design, development, installation, and full operation of the SPDS as well as a design verifica.

tion and validation plan for the SPDS. The Safety Analysis Report and the implementation plan are to be submitted to the NRC for staff review. The results from the staff's review are to be published in a safety Evaluation

' Report (SER).

Prompt implementation of the SPDS in operating reactors is a design goal of prime importance. The staff review of $PDS documentation for operating reactors called for in NUREG 0737 Supplement 1 is designed to avoid causing delays in the implementation of $PDS. The NRC staff will not ]

review operating reactor $PDS designs for compliance with the requirements i of Supplement 1 to NUREG 0737 prior to implementation unless a pre-implementation review has been specifically requested by a licensee. The licensee's safety Analysis and SPDS Implementation Plan will be reviewed by the NRC staff only to determine if a serious safety question is posed or the analysis is seriously inadequate. The NRC staff review to accomplish this will be directed atconfirming(a)thatthe parameters selected to be displayed to detect critical safety functions are adequate, (b) that means are provided to assure that the data displayed are valid, (c) that the licensee has committed to a human factors program to ensure that the displayed information can be readily perceived and comprehended stras not to mislead the operator, and (d) that the SPDS will be suitably isolated to

( prevent electrical and electronic interference by or with equipment and sensors used in safety systems. If, based on this review, the staff 2

[

l

~',

identifies a serious safety question or a seriously inadequate analysis, the Direc. tor of the Office of Inspection and Enforcement or the Director of the  ;

office of Nuclear Reactor Regulation may require or direct the licensee to i cease implementation.

II.

SUMMARY

1

$ctence Applications International Corporation (SAIC) has reviewed the WNP 2 SPDS safety analysis, the SPDS printouts, and the photographs of the l

SPDS, and has concluded that no serious safety concerns exist. However,it will be necessary for the licensee to supply additional information )

regarding SPDS operations, reliability, and parameter selection before a l

l judgment can be made as to whether or not the SPDS seets the requirements of '

Supplement I to NUREG 0737. The information needed to conduct the confirmatory review is defined in Section V.

111. EVALUATIDN on July 1,1983 (Reference 2) the Washington Public Power Supply System (WPPSS) submitted a Safety Analysis Report (SAR) regarding the SPDS for the WNP 2, in response to Supplement 1 to NUREG 0737. WP?SS also provided NAC '

with printouts of actual WNP 2 SPDS display pages. This technical evaluation report discusses SAIC's review of the SAR, the SPDS printouts, and the photographs of the SPDS taken durir.g a previous NRC onsite visit.

A. SPDS Description

~

~

At ,WNP 2, the system utilized to provide concise plant data ls Ihe Plant DataInformationSystem(PDIS)andisusedsynonymouslywithSPDS in the following discussions. The primary impetus for developing the PDIS, following the THI incident, was to provide operators access to improved, concise data for use in responding to accident conditions. The additional j requirements of a Technical Support Center (15C), an Emergency Operations Facility (EOF), and a newly hired degreed engineer added to the operating staff, the Shift Technical Adviser (STA), increased the need for a concise yet comprehensive data information gathering and display tool. The primary purpose of the PDIS is to help the operating crew in the control room to 3

l I

monitor the status of the critical safety functions that constitute the j

basisoftheWNP.!EmergencyOperatingProcedures(E0Ps).

. )

The function of the PDIS is to provide comprehensive, co41se, plant l

data to (in order of priority):

1. the reactor operators

2. the shift technical advisor

3. the technical support center personnel, and

4. the emergency offsite facility personnel.

The graphic portion of the POIS displays critical safety parameter values in three levels of detail, utilizing both bar and trend graphs. (The relationship between the Critical Safety Functions (CSFs) and the displayed parameters is summarized in Table 1.) The three displayed levels (1, 2, and 3), correspond to increasingly detailed plant parameter status information, I allowing initial overall evaluation based on the critical safety function {

and follow up action based on specific parameters of interest. The levels (

I displayed are as follows:

Level 1: Cor.tains overview of parameters representing the 5 CSFs in j bar chart format.

Level 2: Contains detailed specific safety parameters for each of the

5 CSFs in bar and trend chart format. Some parameters are also displayed in mimic format.

1

• Level 3: Contains Emergency Operating Procedures graphs and aids s's contained in the E0Ps. .

The interrelationships of the PDIS with E0Ps as well as with operator training, Reg. Guide 1.97, and the Detailed Control Room Design Review (DCRDR), were factored into the PDIS design.

4 l

l 1

i

. i

8. Parameter Selection I

Section 4.1.f of Supplement I to WRIG 0737 states that: '

• l The minimum information to be provided shall be sufficient to provide information to plant operators about:

a. Reactivity Control- d

b. Reactor core cooling and heat. removal from the primary system

c. Reactor coolant system integrity

d. Radioactivity control

e. Containment conditions For review purposes, these five items have been designated Critical l

SafetyFunctions(CSFs).

l The WNP 2 SPDS is based on the Graphic Otsplay System (GDS) developed by the BWR Owners' Group Control Room Improvement Comittee. WP-2 SPDS

. parameters were selected based on the 8WR 6eneric Procedure Guidelines (EPGs) and the GDS display format. SAIC confirmed that the selected l parameters are consistent with the presently approved SWR EPGs (Reference 3). The parameters and their relationships to the WREG 0737 Supplement 1 Critical Safety Functions are suonarized in Table 1.

The parameters selected for the reactivity control function supply information on reactivity control for the power range (from 125 percent power to O percent power and the source range. (Reactor period. it calculated using the output of the source range monitors.) In conjunction with the control rod full-in position indication, the WNP 2 SPDS displays adequate parameters to effectively monitor reactivit) control.

l BWR core cooling is directly related to the water level in the reactor ,

core. The WNP 2 SPDS includes reactor water level as the primary indication of core cooling capability.

The parameters monitored by th'e WNP 2 SPDS coolant system ~ integrity include RPV pressure, which will yield a direct indication of the primary system integrity. Also provided are several parameters that are of use in 5

l

1. ._ j ' ,

Table 1. WP 2 SPDS Parameters Safety Function Paramet'er .  ;

3. Reactivity Control APRM Scram signal 5' Rod Position Period  ;

SLC Flow Rate-SLC Tank Level

2. Core Cooling and Heat Reactor Vessel Level Removal- ECCS Status (HPCS, ADS, LPCS, (LPCI A, LPCI 8, LPCI C) .

3. Reactor Coolant System Reactor Pressure' Vessel Pressure l Integrity Drywell Pressure  !

Equipment Drain Sump Flow Floor Drain Sump Flow MSIV Position j SRV Position j iotal Sump Flow (24. hrs) j

4. Radioactivity Control Elevated Release Activity Post LOCA Cont. Act.

SGT Flow Area Radiation Alarms , ,

5. Containment Conditions Drywell Pressure Drywell Temperature Supp. Pool Temp.

Supp. Pool Level Containment Isolation Complete l

l 6 l i 1

i~ .

determining- where ' a breach of integrity has occurred, SRV closure (position), and drywell pressure, or in indicating a leak due to . abnormal conditions outside the primary system, drywell pressure, agd drain sump flows. . Although some of these indications are not provided on the primary SPDS displays, these parameters are sufficient for this critical safety function. The two radioactivity control parameters indicate abnormal radia-tion levels in the containment and in the primary release path during an accident situation (theelevatedrelease duct). Additionally, level 2 {

displays include area radiation alarms and standby gas treatment system flow that should help to isolate ali area in which release occurs. However, containment hydrogen is not included on the containment integrity display. l The WNP 2 SPDS contains the five critical safety functions required by . ,, j Supplement I to NUREG 0737. The parameters selected by WPPSS for each of these functions were based on the parameters used in the Emergency Operating Procedures. Based on the information presented in this review, the selected parameters constitute an acceptable set of parameters to monitor four of the five critical safety functions of the WNP 2 SPDS. However, the licensee should justify omitting containment hydrogen from the containment integrity display.

C. Display Data Validation A review of the Safety Analysis Report (SAR) provided by the licensee

,. indicated that a signal validation process has been established for the SPDS system at WNP 2. This process uses redundant signals whenever available to validate the data displayed on the SPDS system using a realtime comparison technique. If a signal cannot be validated, the SPDS operator will-be informed of the signal status by the words INVALID SIGNAL appearing on the l SPDS displays. Based on this information, the licensee seems to have l provided a means to assure that the displayed datta are valid.  !

However, the licensee did not provide any information on the verifica-tion and validation.(V1V) process for the SPDS hardware and software in the SAR. As a result, no evaluation of the V&V process can be performed at this time. In addition, the licensee' did not provide information regarding SPDS availability. It is reconnended that detailed information on the V&V process be submitted for NRC review before a definite conclusion is drawn. l 7

This information can be provided dering an audit er a meeting with the Itcensee.

k D. Human Factors Program WNP 2 has comitted to a Human Factors Progras in the development of the SPDS as described in the SAR. The licensee corrected human engineering discrepancies defined in the prototype evaluations performed by the utility and by the NRC. The black and white copies of trendgraph formats for process variables are uncluttered, well labeled, and easily read. The CRTs are located convenient to the operators. In addition, a touchpad interface is included for use by operators. This interface has a touch point for each display, and if any parameter on that display is in an alara condition, the touchpoint will blink slowly for a pellow condition, and quickly for a red alarm condition.

The Licensee evaluated the SPDS against humas factors criteria by Sandia National Laboratories and addressed all recommendations for a

improvements by either implementing the recomended change or providing justification for leaving it as originally designed. Also, the system is continually improved by changes suggested by the users as they become more familiar with the system. WNP 2 has implemented a human factors program {

both for development of the system and for future endifications made as a l result of user suggestions.

IV. CONCLU$10NS SAIC's conclusions are presented in terms of the eight Supplement l to NUREG 0737 SPDS requirements. .

1. The WNP 2 SPDS presents a concise display of critical plant variables to control room operators.

2. The two SPDS displays are conveniently located on the control panels.

l

3. Salt did not have the information to make a judgment as to whether or not the SPDS is continuously displayed.

L 8

l

g _

m, p

9 l

[

'~

c n >

s . J+

,1

4. SAIC could ;not make afjudgment on the reliability of the( 5PN.l The M

licensee should provide NRC with a description elltM $Pdk design m N verification and validation' program, along with, operaMng history 1 1" information. ' '

'd; 3; I+' ,

5. SAIC is not responsible for evaluation of the suitability of electrica'li isolation.- -,

q

, 3,a e, f

}^' f. /

~

5. The SPDS has incorporated accepted human factors principles.) 1

.3 J

7. Except for containment hydrNen concentration, th'e paramebk selected L for theSPOSprovidetheminimuminformationneededt$NteNiineplant safety status with respect to the five critical safety functions. In

.: a Mition, the five critical safety function blocks are expl) didy incorporated into the SPDS.

I q-

8. SAIC - could not made a judgment regarding implementation of procacNres andoperatortra'iningwithorwithoutltheSPDS.

, +

The WNP 2 ;SPDS meets several of, the requirements of Supplemeni 1 su f HUREG 0737. However, in order to verify that all Supplement I to NOREG 0737 1 requirements have been met. WPPSS should provide NRC kith the information .,s requested in Section V.

't 'c" V. INFORMATION,NEEDED FOR STAFF CONF 1MATORY REVIEW ',

(

). Description of the method for assuring that thtf3 iis ! continuously

. displayed. ,

e

2. Description cf the design verification and validation program. '

3. Documentation of system availability. I

( ')

4. Justification for not including containment hydrogen concentration as a

~~

containment conditions critical safety function parameter.L ,, ,

45 I ,-

t i

5. Description of procedures and training for operations with and without  ;

the SPDS.

9 /

i

} '.

'? k

'. a.

O REFERENCES f

e ,

, 3 .

Requirements for Energency Response

1. Supplement I to NUREG 0737, Capability (Generic Letter 82 33). December 17, 1982. ., -

t-(y , 2. Letter, G.D. Bouchey, WPPSS, to A. Schwencer, NRC, July 1,1983, with WNP 2 SPDS Safety Analysis Report.

"p!l n

3. Safety Evaluation of ' Emergency Procedure Guidelines, Revision 't,'

NEDO 24934, June 1982 (SER dated February 4,1983),

p'A + l i

/> l

,3,,

(- i I p,

)i .

; p's v

\<

, fr

' ' r, ' >

n-  :

<< : s e

7r' ,

if;/ ',I ,*

s. j /-

i k^

\

.e a-I

.[it # j l

e.

'{

/6 i

,( i i

__m___.__ _ _ _ _ _ _ - _ _ _ _ . _ _ _ _ _ . - _ . - _ _ _ . _ _ _ _ _ _ _ - _ _ _ . _

,. n .,

j

/ "

f

, i _

' T': g

' ' ' ^' ' WM ;

&x +.

ff(lj: , l g ;p ,

t-Vh g'gy j [ ' ' iap i: s.~~

4 h S '

m ,

o. .

tm , ,

l,lql g , I ~N f .

3 , v . ATTACHMENT ~2 ,

w, , _

4 .- -

.. 1 s 4  :

, JO' 'j

, ., e ,

Safety' Evaluation of Nashington Nuclear Plant, Unit No'. 2 *

. f 1 (f;j s q'

.. >jj ; g 1 SsfN.ty p ,

rameter Display System i< t l

, if' / x h

s 1

~

y+ '

(j p. >>9IsolationDevices- y .

m

,3fv-

suc  !

h. b

, -s , , <

j -t a 1

~BACKGR0bND;. '

I. iQ .

g r a j

~

In' order to satisfy the NRC requirements cWcerning the Safety Parameter- 1

'DisplaySystdj(SPDS),WashingtonPeblicPowerSupplySystemsubmitted-aa p Safety Analyrls Report by letter dated . July.1, -1983.' This report -

s. .

1provided

. . . , ' 2:

a" description and a safety analysis ,x o of the SPDS'at the ,

1p j

Taihirdton nuclear Plant, Unit No. 2]MP-2).. This' report did not..

~7 e 3 address the requirement that the SPDS must be isolated from equipment 'I hand sensors tnt;are'used in safety systems to' prevent electricalcand electronic intti'fercoce. On. August 10, 1984, a request for. additional .

r informationwhich1hedded'specificquestionsontheseisola,t,orswasd j

'L' .

a sent to theilicenseen The requested information was $aceived by letter 4

, , . i dated Oc,tober,,9; 1984. . The staff held a telephone conference.wiqh the applic.fitonFebruary 28, 1985, which resulted in a December 20J1985 submittal by the licen,see This last submittal forwarded the requested test results on the-is,olation devices.

Our evaluation addresses the qualification and documentation of the isolators as acceptable interface devices between the Class IE sa.fethrelatedinstrumentationsystemsandtheSPDS. ---

l ,

[ '

A

> . t I

y

(

i- . <

4*

)

• a

= _ _ _ _ _ _ _ _ _ _ _ _

ky it :

h[q q

~

~~

w

+_. . ,

u o

g 4' -)

R- ,

h.e .p

.g .

.II. DISCUSSION AND EVAL.UATION-The SPDS~at WNP-2 isLsynonymous with.what the plant refers to as thei .

1 g '

W; Plant =DataInformationSystem(PDIS)._TheSPDSrequirementswere. j formulated ^during the~ construction phase of WNP-2 and the Emergency

, . . OperatingProcedures-(EOPs)weredevelopedduringthisperiod. The-SPDS.

(PDIS)is'directlyrelatedto-theE0P's. g B

4 The PDIS hardware is.part of the Prime C750 computer system and.is.  !

QA primarily for post-accident-use as an aid in making' an assessment of the plant's status. :It will also provide information to the plant operators during.all modes of reactor operation.. The PDIS. receives its signals fromtheTransientDataAcquisitionSystem(TDAS)whichreceivesand h processes:the plant data. The' plant data are hardwired from the control

,, f room and remote locations to the TDAS via remote modules :(multiplexer).

W'k f:.)

A iThe' remote modules-provide for the electrical isolations, signal

. conditioning, A-D conversion, and multiplexing of the input data. The

,. ~ output signal from the remote modules is transmitted through fiber-optic I' cables to the TDAS.< The fiber-optic cables are inherently isolation q, devices, however, WNP-2's primary isolation is. achieved by Analog 4 Devices Model 289 isolation amplifiers mounted in the remote modules.

These isolation devices are qualified according to the requirements of Regulatory Guide 1.89, IEEE 323-71 and IEEE 344-75.

+

j The Analog Devices Model 289 isolation amplifiers were tested with the k, . maximum credible fault (MCF) voltage / current in the transverse mode as M., reported by the applicant's submittal of December 20, 1985. The MCF voltage / current was determined to be 120 VAC at 15 amps. The acceptance

, i i

.)

e 3

I' L -

criteria' stated that the measured interference on the Class IE side of the isolator should be less than 50 my peak-to-peak for no more than 10 msec during the application of the MCF to the non-Class 1E side and that the Class IE signal function not be inhibited. The acceptance criteria also. stated that the Class 1E signal maintains its initial value after the MCF has been removed.

The Class IE input side of the isolator was monitored by a visicorder operated at 40 in/sec and also at 80 in/sec.

The visicorder traces showed that upon the application of the MCF, the Class IE input circuit was subjected to voltage spikes between 70 my p-p and 400 my p-p for a duration of not longer than 250 microseconds. The voltage spikes on the input exceeded the acceptance criteria voltage of j 50 my and the pulse duration was very much shorter than the acceptance criteria of 10 msec. However, the Class 1E input signal was not affected (other than the pulse) and the isolator performed its intended function by not allowing the MCF to propagate to the Class IE side of the isolator.

III. CONCLUSION Based on the staff's review of information submitted by the applicant )

with respect to the Analog Devices Model 289 isolation amplifiers, the

. staff concludes that these devices are qualified isolators and are acceptable for interfacing the Class IE safety systems with the SPDS.

The staff concludes that these devices meet the Connission's requirements in NUREG-0737, Supplement 1. - - -

l l

,m I , Af1 1

l[c Enclosure 2 Input'to SALP'for Washington Nuclear Plant'2 ,

Hum'an Factors Assessment Branch of the Division of Licensee Performance'and

~ Quality Evaluation input to the: Systematic As'sessment'of Licensee Performance

..  :(SALP)forWashing'tonPublicPowerSupplySystem's(theSupply. System's)

Washington' Nuclear Plant 2 (WNP 2) 'is 'provided for your~ use. The SALP relates only to activities associated with the WNP-2 Safety Parameter Display

, System and covers the period.from July 1,-1983 to date.. I HFAB/DLPQE SALP ratings for'WNP-2 are:

1.- . Management involvement and control in assuring quality  ;

Interaction with the Supply System during the subject SALP' period indicated. prior planning and~ general understanding of policies related to the SPDS..

. Rating: ' Category'2

'2. Approach to resolving technical issues from a safety standpoint-The Supply System has demonstrated a general understanding of issues related to the SPDS implementation.

1 Rating: Category 2

3. Responsiveness to NRC initiatives The Supply System is implementing the SPDS on a schedule negotiated with the staff.

Rating: Category 2 l

l Other SALP areas are not applicable.

- _ _ _ _ _ _ _ _ - - _ _ _ ---