ML18089A505

Forwards Safety Analysis & Implementation Plan for Safety Parameter Display Sys,Per Generic Ltr 82-33 Re Requirements for Emergency Response Capability

ML18089A505
Person / Time
Site:	Salem
Issue date:	01/30/1984
From:	Liden E Public Service Enterprise Group
To:	Varga S Office of Nuclear Reactor Regulation
Shared Package
ML18089A504	List: ML18089A503 ML18089A505
References
GL-82-33, NUDOCS 8402070374
Download: ML18089A505 (22)

Text

e.

Public Service Electric and Gas Company P.O. Box 236 Hancocks Bridge. New Jersey 08038 Nuclear Department January 30, 1984 Director of Nuclear Reactor Regulation

u. s. Nuclear Regulatory Commission 7920 Nor(olk Avenue Bethesda, MD 20014 Attention: Mr. Steven Varga, Chief Operating Reactors Branch 1 Division of Licensing

Dear Mr. Varga:

SAFETY PARA.METER DISPLAY SYSTEM SAFETY ANALYSIS AND IMPLEMENTATION PLAN REQUIREMENTS FOR EMERGENCY RESPONSE CAPABILITY SALEM GENERATING STATION NO. 1 AND 2 UNITS DOCKET NOS. 50-272 AND 50-311 PSE&G hereby submits its Safety Analysis and implementation plan for the Safety Parameter Displ~y System in accordance with the requirements of Generic Letter 82-33, Requirements for Emergency Response Capability.

Should you have any questions, please do not _hesitate tq contact us.

Sincerely, Manager - Nuclear Licensing and Regulation

~/1/

RSP: jab cc: Mr. Donald c. Fischer Licensing Project Manager Mr. James Linville Senior Resident Inspector 8402070374 84020i ~~

PDR ADOCK 05000272 .

F * *.* PDR . .

95 2

• Od .ac *'"' : * *5~

SAFETY ANALYSIS FOR SPDS PARAMETERS Functjonal Description The Safety Parameter Display System will serve as an aid to the control room personnel during abnormal and emergency conditions in determining the safety status of the plant. It will also function as an operator aid during normal operation by monitoring other parameters or graphic displays that are determined to be important to the operator for maintaining safe operation of the plant. The displays will serve to concentrate a set of plant parameters to aid in assessing plant safety status without surveying the entire control room. The primary display will provide an overview of plant conditions and the secondary displays will provide more detailed information on specific plant systems and equipment.

System Description

General The Safety Parameter Display System will be a redundant computer system with CRTs located in the TSC, EOF and Units 1 and 2 Control Room. This system is independent of the Plant Computer. The major components are as follows:

• three lE multiplexer cabinets per unit

• two NON-lE multiplexer cabinets per unit

• two data concentrators

• two SEL 32/8705. Central Processing Units

• two color CRT/keyboards per unit control room

• one line printer per unit

• four color CRT/keyboards for TSC

• one video copier for TSC

• two color CRT/keyboards for EOF

• one video copier for EOF The data concentrators and the two Central Processing Units will be shared by both Units. The CRT/keyboard assemblies and video copiers in the TSC and EOF will not be dedicated to any one unit. Attachment 1 gives a general layout of the above mentioned components and other peripheral equipment.

Data Acquisition Subsystem Each multiplexer in the subsystem functions as an independent unit utilizing a 16 bit microprocessor. Complete isolation of field inputs is maintained by use of fiber optic communication links to the rest of the system. Signal conditioning and buffers necessary to isolate the P-250 process computer is included.

DR2 1/4

Computer Subsystem The computer subsystem utilizes two SEL 32/8705 processors in a fully redundant configuration. Each CPU acquires and processes the data from all multiplexers and maintains its own data base. One CPU is designated as the primary unit and handles all display subsystem interfacing. This allows the other CPU to be utilized for development work while maintaining a hot standby condition for smooth fail-over. A full duplex RS-232 "watchdog" communication channel is provided so that the CPUs can monitor each other. All communication with equipment outside the computer environs is via fiber optic links or standard RS-232 modems.

Display Subsystem The display subsystem comprises high resolution color graphics CRTs, color video hard copy units and printers for data output. The IDT #2200 color graphics CRTs are used and full graphics editing capabilities are provided for building and modifying color displays.

Isolation of Class lE Signals At the output of the multiplexer cabinets, the corrununication link to the computer will be by fiber optic cables which will perform an isolation function. All class lE signals will be isolated prior to entering the multiplexer cabinets. These isolators will be qualified based on their function.

Availability The Host processor/display system will be designed to achieve an availability of 99.0% under the following conditions:

• All of the ERF on-line functions are executing without degradation and the following minimum complement of hardware is operational.

1. One of the two CPUs with all of its main memory and its prograrruner's I/O device, and with sufficient hardware in the CPU interfaces to communicate with all of the field multiplexers communication circuits at the specified scan rates.

2. One of the two auxiliary memories.

3. One printer in either unit control room.

4. One of the two unit CRTs in the control room, one of the two unit CRTs in the TSC and one of the two CRTs in the EOF excluding the moderns and phone lines .

• Each multiplexer will be designed to achieve the availability under the following conditions:

1. The multiplexer is considered available unless:

DR2 2/4

a. Any function is lost for all points of a single type, or

b. More than one input card of the same type fails, or

c. One input card of each type fails.

Human Factors The Safety Parameter Display System display will be designed to incorporate accepted Human Factor Principles. The following Human Factors Principles references will be used:

• NUREG 0700, Section 6 *

• NUREG 0835, Section 6 *

• "Human Engineering Principles for Control Room Design Review", Section 3.7, published by the Nuclear Utility Task Action Committee.

Parameter Selection PSE&G has selected a total of sixty-one parameters to be displayed on the SPDS using the parameters listed in Regulatory Guide 1.97 as a guideline. These parameters are listed in Attachment 2.

The basis of this safety analysis is the Critical Safety Function Status Trees. The Critical Safety Functions were identified and Status Trees developed by PSE&G based on the Westinghouse Emergency Response Guidelines, Revision 1. The Status Trees and the procedures associated with them are contained within the Emergency Operating Procedure Set, which was also developed based on the Westinghouse Owners Group Emergency Response Guidelines. For any transient or accident condition, the Emergency Operating Procedures will direct the operator to monitor the Status Trees. Operator training also addresses the use of the Status Trees during transient or accident conditions. The following is a list of the six Critical Safety Functions for Salem Generating Station:

1. Shutdown Margin

2. Core Cooling

3. Heat Sink

4. Thermal Shock

5. Containment Environment

6. Coolant Inventory is "The Critical Safety Function Status Trees Bas is Document", and Attachment 4 is "The Emergency Operating Procedure EOP-CFST-1 and Status Trees". These documents are in draft form. They will be made final when the Emergency Operating Procedures are implemented.

DR2 3/4

The "Critical Safety Function Status Trees Basis Document" basically lists the Critical Safety Functions and describes the use and organization of the Status Trees. It also explains how the Status Trees are used in evaluating the Critical Safety Functions. The "Emergency Operating Procedure EOP-CFST-1 and Status Trees" document shows graphically the Status Tree for each Critical Safety Function and explains the significance of the colors used.

Of the total parameters that were selected for the Safety Parameter Display System, fifteen are utilized in satisfying the Critical Safety Functions. The parameters are as follows:

1. Neutron Flux

2. RCS Cold Leg Water Temperature

3. RCS Pressure

4. Core Exit Temperature

5. Reactor Vessel Level

6. Degrees of Subcooling

7. Containment Sump Water Level

8. Containment Pressure

9. Containment Area Radiation

10. Reactor Coolant Pump Status

11. Pressurizer Level

12. Steam Generator Level

13. Steam Generator Pressure

14. Auxiliary Feedwater Flow

15. RCS Loop Average Temperature.

The other forty-six parameters will be included in the SPDS data base because they have been determined to be important in aiding the operator in determining the status of the plant. Most of these parameters will be used in developing graphic displays which will be used as an operator aid.

DR2 4/4

Attachment 1

()lJ':.> !AP v....11T ~TlJ)

- - -- - - - - - - -. - - - - - - -r-- - -- - --- - -- _,.

f 61U CONTROL ROOM UNIT~ I CONTROL ROOM UNIT o 2 SPARE I RMS COLOR COLOR COLOR COLOll CRT/ CRT/ CRT/ CATI - *so KEY* KEY* KEY* KEY*

BOARD BOARD BOARD BOARD MAJ( 1)1<:.Tl'\oJC:..E.

FAQ..;. ..ieo;.r ;;..,a o:

• '..* e10 '-;,

MUX MUXI CPU"'A"'

DATA SEL; CONCENTAATO~ L - - - - - ' - - - J I I

MUX N ... _.... A. 32.'8105 RS.232*

Tf\P To s /(} -5"0 AS f'ollc>W 'S.

/

LINE LINE $1U TO 8.~ u 3o.,... 4-0 PAINTER PAINTER I ;i _ _

JO

PLOTIER PLOITER f3.)U "TO *. 5 I\)

I I

SWITCH I

I I

L - - - - - - - - ~ - - - - -- - _!_ - - - - - - - - - - .J I

I So I*

r-----.-,---------------------

I f>I U ><. TECHNICAL SUPPORT CHITER I

o:

YUX I

. OATA I 0

C0NCENTRATOA r-------'1 CPU "B SPARE A set'. I MUX ~ *... a. I ' e

• • .. :1218705 AS*2J2 . I COLOR COLOR CRT.' CRT/

KEY* KEY*

ERF ~Com* Ero Aiutoq'~25

• pul"' BOARD BOARD EOR BASE 360 l>")iUI ,

"° l~nm.rp, AMS SPARE I . *: . I I .. .. . I COLOR EOF COLOR I I . I CRT/

KEY*

CRT/

KEY*

i 1Jore:: All CAe.t..i;.$ &i..ow1" BOARD rtl :~

BIU BOARD SPARE 9 IN C.Ol"TieOL itoo"\. \)t-J1T~

\

I I

LINE PRINTER -w .. : .

II I

I LOCAL AREA NETl<OAK A A I

f , ..2. AN b Tec.h

~W~~ Al?.t:O-SJppoR.,,t-12.':> -~

---

*-------------- - - -- _J UN Less o'fi-t~wrse..,

I I r - - - - - -E~E-;;Ge11cY o*"Fs;-rE-FAc7L;T; -

'5 F' ec.' *"I e.cl.. .

- - - - - - - \

I I I  :. I COLOR . I """"' i'MfJ ~ CAGLE...

I . . I ***..

• CRT/ I

/S 7!;° JZ.. c.,oA-,/.

KEY*

L----~--~*...:... _ _l BOARD I 13.Tc.J To 8~\J' B~l.I To di.

SPOS DEVELOPMENT ST ATll~fJ. * *

. . :: I c-Ae.r.es All..e <;,pe-CJ',.ll_, Je,.

VIDEO I

• poRTABLE PORTABLE I TWl-.J C..OA>toAI... <:.A.r.IL.1': 5 CAT'S COP I EA Po:2.e *><1NAr7 NOTE: IDT*2200 CRT'1 Jn i~prilled In lhe COLOR Control AQom1, tsc,:inJ Edi= cnr/

KEY*

MA)l IHUM. CAGLE Le>-' c;.-l-h BOARD $pec.."1r-1c.,1>t101'.I I

L ________ _ FD~

PSE&G Emergency Response Fdciliries..

11 /22/83.

ATTACHMENT 2 SALEM GENERATING STATION UNITS 1 AND 2 SAFETY PARAMETER DISPLAY SYSTEM PARAMETERS

1. Neutron Flux - Source, Power, and Intermediate Ranges, Start-up Rate.

2. Rod Control Positions

3. RCS Soluble Boron Concentration

4. RCS Cold Leg Water Temperature

5. RCS Hot Leg Water Temperature

6. RCS Pressure

7. Core Exit Temperature

8. Coolant Level in Reactor

9. Degrees of Subcooling (calculated)

10. Containment Sump Water Level

11. Containment Pressure (Wide and Narrow Range)

12. Containment Isolation Valve Position (excluding check valves)

13. Containment Area Radiation

14. Noble Gas Effluent Radioactivity from Condenser Air Removal System.

15. Containment Hydrogen Concentration

16. Containment Effluent Radioactivity (Plant Vent)

17. Radiation Exposure Rate (Fuel Storage Room, Charging Pump Room, Fuel Handling Building, and Mechanical Penetration Area)

18. Radiation Exposure Rate (Electrical Penetration Area)

19. RHR System Flow

20. RHR Heat Exchanger Outlet Temperature DFl.l 1/03

ATTACHMENT 2 (Continued)

21. Accumulator Tank Level and Pressure

22. Accumulator Isolation Valve Position

23. Boric Acid Charging Flow

24. Flow in HPI System (Charging Pumps Discharge)

25. Flow in LPI System (Safety Inspection Pumps Discharge)

26. Refueling Water Storage Tank Level

27. Reactor Coolant Pump Status 28~ Primary System Safety Relief Valve Position

29. Pressurizer Level

30. Pressurizer Heater Status

31. Pressurizer Relief Tank Level

32. Pressurizer Relief Tank Temperature

33. Pressurizer Relief Tank Pressure

34. Steam Generator Level

35. Steam Generator Pressure

36. Main Steam Flow

37. Main Feedwater Flow

38. Auxiliary Feedwater Flow

39. Auxiliary Feedwater Storage Tank Level

40. Containment Spray Flow Additive Rate

41. Heat Removal by the Containment Fan Heat Removal System

42. Containment Atmosphere Temperature

43. Letdown Flow

44. Volume Control Tank Level

45. Component Cooling Water Temperature to ESF System DFl.l 2/03

l ATTACHMENT 2 (Continued)

46. Component Cooling Water Flow to ESF System

47. High Level Radioactive Liquid Tank Level

48. Radioactive Gas Hold Up Tank Pressure

49. Control Room Emergency Ventilation Damper Position

50. Auxiliary Building Emergency Damper Position

51. Fuel Handling Building Emergency Damper Position

52. Status of Stanby Power and Other Emergency Energy Sources Important to safety.

53. Control Air

54. Main Steam Radiation

55. Wind Direction

56. Wind Speed

57. Estimation of Atmospheric Stability

58. Steam Generator Blowdown Radiation

59. Condenser Availability (Condenser Vacuum and Circulator Amperes)

60. RCS heat up/cool down rate (Average Loop Temperature)

61. Main Steam Isolation Valve Position DFl.l 3/03

~ Attachment 3 CRITICAL SAFETY FUNCTION STATUS TREES (CFST)

BASIS DOCUMENT

1.0 INTRODUCTION

The Critical Safety Function Status Trees ares used to monitor specific plant conditions while the Emergency Operating Procedures are in use. The conditions that are monitored relate directly to the barriers to release of fission products to the environment. These barriers are the fuel matrix and cladding, RCS pressure boundary and Containment.

Protection and Control Systems, augmented by trained operator response to annunciator alarms and backed by Technical Specifications, serve to ensure that small departures from preferred operating conditions are rectified before any challenge to the Critical Safety Functions develops.

Failures in system components and the Protection System can create conditions which threaten the integrity of one or more barriers.

The Status Trees determine when these challenges are present and designate Functional Restoration Procedures to use to correct the condition.

2.0 ORGANIZATION The six Critical Safety Functions evaluated by the Status Trees are necessary to maintain the integrity of the three barriers to fission product release.

The first barrier is the fuel matrix and clad. Three conditions are necessary to maintain fuel integrity during accident conditions:

1. Maintenance of subcriticality to prevent power generation and excessive fuel temperatures.

2. Maintenance of adequate Reactor Coolant inventory to allow Core Cooling.

3. Maintenance of Core Cooling to remove core decay heat.

The second barrier is the RCS pressure boundary. Three conditions necessary to maintain RCS integrity are:

1. Maintenance of the secondary Heat Sink to provide heat removal from the RCS.

2. Prevention of Thermal Shock to the Reactor Vessel which could lead to vessel brittle £racture.

Salem Unit 1 Draft A Rev.

9 Attachment 3 CFST Basis

3. Control of Reactor Coolant inventory to prevent filling the pressurizer and loss of RCS pressure control.

The third barrier is the Containment. The Containment Environment (pressure) is controlled to prevent overpressurization of the Containment structure.

The six Status Trees relate to the above conditions as shown in the table below.

Critical Safety Function Status Tree Functional Restoration Subcriticality 3.1 Shutdown FRSM Margin Core Cooling 3.2 Core FRCC Cooling Secondary Heat Sink 3.3 Heat Sink FRHS Thermal Shock 3.4 Thermal FRTS Shock Containment 3.5 Containment FRCE Environment Reactor Coolant Inventory 3.6 Coolant FRCI Inventory Also shown is the Functional Restoration block used by each Status Tree to restore threatened Critical Safety Functions.

3.0 CFST USE 3.1 Status Tree Scanning The Status Trees are used by an SRO licensed individual in the Control Room to monitor Critical Safety Functions while the Desk Operator and Control Operator respond to a unit trip or Safety Injection with the Emergency Operating Procedures.

Status Tree scanning begins when EOP-TRIP-1, "Reactor Trip or Safety Injection" is departed. EOP-TRIP-1 also directs Status Tree use if the SI cannot be terminated but the problem has not been diagnosed. The Status Trees are evaluated in order while the fault specific EOP is conducted. The Status Trees are scanned continuously until all Critical Safety Functions are satisfied. The Status Trees are then scanned periodically until the event is terminated.

Salem Unit 2 Draft A Rev.

Attachment 3 CFST Basis 3.2 Functional Restoration Priorities Priority of a Status Tree designated Functional _

Restoration is determined by the color of the condition and the order of the Status Trees. Red is the highest priority condition, followed by orange and yellow.

Green is used to signify that a Critical Safety Function is satisfied. The Status Trees are arranged in descending order of priority.

Color is considered first, then order. Thus a Red condition on Status Tree 3.1 would have priority over all other challenges to Critical Safety Functions.

Likewise an Orange condition on Status Tree 3.5 would have priority over a Yellow condition on any Status Tree.

3.3 Response to an Unsatisfied CSF When a CSF is evaluated as un~atisfied a Functional Restoration is identified. Performing the Function Restoration removes the challenge to the CSF.

A Red condition requires immediate suspension of the EOP in use. The current step is noted and the page marked

.for later reference. The Functional Restoration is initiated and continues until the challenge is removed.

The EOP in effect is then resumed unless an additional Red condition is present. Note that if a Red condition is identified while a Functional Restoration is in progress for a lower priority Red condition, the lower priority procedure is suspended and the higher priority Functional Restoration initiated.

When an Orange condition is encountered, note the associated Functional Restoration and continue tree evaluation. When the current pass through the Status Trees is complete, initiate the Orange related Functional Restorations in order of importance.

A Yellow condition is a slight challenge to a CSF and could lead to a serious challenge if not corrected.

Initiate Yellow condition Functional Restorations when practical.

4.0 REFERENCES

4.1 WOG Guideline F-0 "Critical Safety Function Status Trees" Rev HP-Basic.

END OF PROCEDURE FINAL PAGE Salem Unit 3 Draft A Rev.

Attachment' 4 EMERGENCY OPERATING PROCEDURE EOP-CFST-1 CRITICAL SAFETY FUNCTION STATUS TREES 1.0 ENTRY CONDITIONS 1.1 EOP-TRIP-1.

2.0 STATUS TREE USAGE 2.1 Initiate CRT tests 23 and 41 to facilitate monitoring CORE EXIT TC's. If PRODAC 250 not available, then direct Performance Department to perform Emergency Surveillance Procedure PD-14.3.010, "Extended Range Reading of Incore Thermocouples" and establish contact with operator monitoring CSFT.

2.2 START Status Tree evaluation after departing EOP-TRIP-1, "Reactor Trip or Safety Injection."

2.3 IF a Red is encountered, immediately go to the designated functional restoration procedure. The EOP in effect is resumed when the Function Restoration is completed unless otherwise directed.

2.4 IF an Orange is encountered, note the designated functional restoration procedure and continue status tree evaluation. When the current pass through the trees is complete, initiate the designated procedures in order of importance unless otherwise directed.

2.5 IF a Yellow is encountered, note the nature of the deficiency and continue status tree evaluation. When practical, initiate the designated procedures unless otherwise directed.

2.6 The Status Trees are arranged in descending order of importance. Consider the condition color and tnen the procedure order to determine the priority, among a group of Functional Restorations.

2.7 Red conditions require suspension of the procedure in effect. Orange and Yellow condition Functional Restorations take precedence over any conflicting procedure steps in the EOP in effect.

Salem Unit 1 1 DRAFT *c

~ Attachment 4 EOP-CFST-1 3.0 Critical Safety Function Status Trees 3.1 Shutdown Margin.

3.2 Core Cooling.

3.3 Heat Sink.

3.4 Thermal Shock.

3.5 Containment Environment.

3.6 Coolant Inventory.

END OF PROCEDURE FINAL PAGE Salem Unit 1 2 DRAFT C

e Attachment 4 CRITICAL SAFETY FUNCTION STATUS TREES

[

• SHUTDOWN MARGIN I*

('.,() 'ID FRSM-1 C-0 TO FRSM-1 C-0 TO FRSM-2 POV\!$ RANGE N LESS THAN 5%

y INTERMEDIATE RANGE SUR N MORE NEGATIVE THAN -.2 DPM INTERMEDIA'IE y RANGE SUR N ZERO OR NEGATIVE CS?

SAT SOURCE RANGE N ENERGIZED y

GO TO FRSM-2 SOURCE RANGE N Si:JB. NEGATIVE OR ZERO y

CSF SAT

{L_3_:11~_co_RE_*_c_o_o_L_IN_G________~ltt GO TO FRCC-1 GO TO CORE EXIT N FRCC-1 Tes LESJ;? -

THAN 1200°F IS NARRCW N y_ RANGE GREATER THAN 40%

y CORE EXIT Tes LESS THAN 700° H

~ GO TO y " " " " FReC-2 AT LEAST N C-0 TO ONE RCP FRCC-2 RUNNIN3 y IS NARROW GE GREATER N

RCS

'IRAN 40 %

SUBCOOLING GREATER THAN y 10 F y

GO TO FRCC-3 00 TO FRCC-2 RVLIS

'WIDE RANGE N GREATER TP.AN 44% 4 RCP 30% 3 RCP 20% 2 RCP y -

13% 1 RCP

~C-OTO

~CC-3

-CSF SAT

3 - HEAT SINK le GO T0 RHS-1

'roTAL

~TER IN FI..av TO SGs GREATER

. THAN 2-2E04lbm I y NARRCW RANGE GO TO LEVEL GREATER IN FRHS-2 THAN io/. IN AT LEAST ONE PRESSURE LESS SG _I y THAN 1125_ PSI1 IN ALL SGs C-0 TO FRHS-4 i.\JARIDW RANGE I LEVEL LESS '.N T.:fAN 6 7% IN ALL SGs

.Y C-0 TO FRHS-3 PRESS LESS N THAN 1070 .

PSIG IN ALL SGs y

lL-3-~

___ __L__s_Ho_c_K________

TH_E_RMA ~l4t

[ 3 .CONTAINMENT ENVIORNMENTJ

• c~

PRESSURE LESS N

---i THAN 47 PSIG y

,.....__________ ...,..:-----------------------~~~

CONTAINMENT PRESSURE LESS N THAN 23.5 PSIG y

C-0 TO FRCE-2 CONI'AilMENT N SUMP LEVEL LESS THAN

.MAX* FLCX>D LEVEL y GO TO FRCE-3 CONTAINMENT N RADIATION LESS THAN R-44 ALARm y CSF SAT

L--3__

.6__c_o_o_L_A_N

__T__IN_VE

___N_T_o_R_Y__ ~__I~

GO TO.

FRCI-3 RVLIS N INDICATES UPPER HEAD

. FULL y C-0 TO FRCI-1 PRESSURIZER

.LEVEL LESS N THAN 92%*

C-0 TO y

FRCT-2 THAN 17%

y C-0 TO

5'RCI-3 RVLIS INDICATES N L-----i UPPER HEAD FULL y CSF SAT

SAFETY PARAMETER DISPLAY SYSTEM IMPLEMENTATION PLAN -

1. SCHEDULE

a. DESIGN PHASE 9/84

b. DEVELOPMENT PHASE 9/85

c. INSTALLATION PHASE 12/85

d. FIELD TE;STING, OPERATION AND ACCEPTANCE PHASE 5/86

e. FULLY OPERATIONAL 12/86

2. VERIFICATION AND VALIDATION PLAN Verification and validation will be conducted by the computer system vendor. The program will be developed using NSAC-39 "Verification and Validation for Safety Parameter Display Systems" as guidance and will address the traceability of requirements of hardware and software and provide independent review. The V & V activities will be performed by a team which is completely independent of the development effort.

DCl