ML20155J505

Rev 1 to Functional Design Requirements for Control Element Assembly Calculator

ML20155J505
Person / Time
Site:	Palo Verde, Arkansas Nuclear, Waterford, San Onofre, 05000000
Issue date:	05/31/1986
From:	ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY
To:
Shared Package
ML19298E013	List: LD-86-024, Forwards Proprietary & Nonproprietary Rev 0 to CEN-330,Rev 01 to CEN-304 & Rev 01 to CEN-305 Re Improvement Program. Proprietary Repts Withheld (Ref 10CFR2.790).Affidavit for Withholding Repts Encl.Fee Paid ML20155J491 ML20155J505 ML20155J523
References
CEN-304-NP, CEN-304-NP-R01, CEN-304-NP-R1, NUDOCS 8605230285
Download: ML20155J505 (50)

Text

FUNCTIONAL DESIGN REQUIREMENTS FOR A CONTROL ELEMENT ASSEMBLY CALCULATOR CEN-304-NP REVISION 01-NP Nuclear Power Systems COMBUSTION ENGINEERING, INC.

Windsor, Connecticut May , 1986 h

..____,.-~~.---ye ~~7 A

4 i i

- OL f

!' FUNCTIONAL DESIGN REQUIREMENTS i ,

f FOR A i

• i CONTROL ELEMENT ASSEMBLY CALCULATOR t..

i CEN-304-NP i

! REVISION 01-NP 4

k i

! i 4

Nuclear Power Systems COMBUSTION ENGINEERING, INC.  ;

Windsor, Connecticut Q

i  ;

i t

i j May , 1986

)

i 1

i i

e i

i i

lo I

m v- . w -a, m w -v-rs ._ . -_ ,.

O

.\ j ABSTRACT This document provides a description of the CEA Calculator (CEAC) and CEA Penalty Factor Algorithm functional design to be implemented in the Core Protection Calculator (CPC) System of the Reactor Protection System. The scope of this functional description includes detailed specification of the CEAC Penalty Factor Algorithm, which is a component of the CPC/CEAC software.

Two CEACs are provided in the Core Protection Calculator System. Each CEAC receives all of the CEA positions and calculates two penalty factors based on the severity of CEA deviation within a subgroup. These two penalty factors are transmitted to the CPCs to be included in the DNBR and LPD calculations. Detailed algorithm descriptions are provided.

The algorithm equations are written'in symbolic algebra. All variables are defined, and units are specified where applicable. In addition, the 16-bit output buffer, which transmits the penalty factors to the A CPCs, is defined.

b Revision 01 incorporates all the changes described (and approved) ln Reference 1.4.10.

l CEAC Functional Design Requirements CEN-304 Revision 01 Page III  !

O TABLE OF CONTENTS

,d Section No. Title Page No.

ABSTRACT III TABLE OF CONTENTS IV LIST OF FIGURES, TABLES AND APPENDICES VI LIST OF ACRONYMS AND DEFINITIONS VII

1.0 INTRODUCTION

1-1 1.1 PURPOSE 1-1 1.2 SCOPE 1-1 1.3 APPLICABILITY 1-2 1.4 REQUIRED REFERENCES 1-2 2.0 CEAC DESIGN BASIS 2-1 2.1 SPECIFIED FUEL DESIGN LIMITS 2-1

/O 2.2 ANTICIPATED OPERATIONAL OCCURRENCES (A00's) 2-1 O

3.0 FUNCTIONAL DESIGN AND COMPUTER DESIGN REOUIREMENTS 3-1 3.1 CEA CALCULATOR PENALTY FACTOR ALGORITHM FUNCTIONAL REQUIREMENT 3-1 3.1.1 Requirements for Accommodation of Defined Single CEA-Related A00's 3-1 3.1.2 Inputs and Outputs 3-2 3.2 PROGRAM STRUCTURE 3-4 3.3 PROGRAM TIMING AND INPUT SAMPLING RATES 3-6 3.4 PROGRAM INTERFACES 3-7 3.4.1 CEAC Failure Flag 3-9 3.4.2 Case 2 Deviation Flag 3-10 3.4.3 Reactor Power Cutback Flag 3-10 3.4.4 Scaling Flag 3-11 3.4.5 CEAC Off-line Storage and Reloading 3-11 O

.)

CEAC Functional Design Requirements CEN-304 Revision 01 Page IV

TABLE OF CONTENTS (Cont'd.)

V Section No. Title Page No.

3.5 OPERATOR INTERFACE 3-12 3.5.1 Alarms and Annunciators 3-12 3.5.2 Displays and Indicators 3-12 3.5.3 Operator Input 3-16 3.6 INITIALIZATION 3-16 3.7 TESTING REQUIREMENTS 3-18 4.0 ALGORITHM OESCRIPTION 4-1 4.1 PENALTY FACTOR ALGORITHM 4-2 4.1.1 Algorithm Input 4-2 4.1.1.1 Determination of Reactor Power Cutback (RPC) 4-8 4.1.2 Determination of Deviation 4-14 4.1.3 Determination of Penalty Factors 4-25 q 4.1.4 Packing of Penalty Factors for Transmittal to CPCs 4-35 4.1.5 CEAC Initialization 4-38 4.1.6 CEAC Constants 4-40 O

CEAC Functional Design Requirements CEN-304 Revision 01 Page V

'I 1

d LIST OF TABLES

{(} ,

I Table No. Title Page No.

j 3-1 CEAC OUTPUT SIGNALS 3-5 i 3-2 EXAMPLE OF FAILED SENSOR ARRAYS -

i 3-15 t.

l 3-3 A00RESSABLE CONSTANTS 3-17 l 4-1 ASSIGNMENT OF CEDMs TO SU8 GROUPS 4-3 I 4-2 ASSIGNMENTS OF SUBGROUPS TO CONTROL GROUPS 4-4 l

i i

i i

l i

~

LIST OF FIGURES

(}

Figure No. Title Page No.

3-1 CEA CALCULATOR INPUT INTERFACE DIAGRAM ,

3-3 4-1 PENALTY FACTOR COMPONENTS 4-31 i

4

}

LIST OF APPENDICES l- s i Appendix i Title Page No.

3 7

A REVISED SECTIONS AND TABLES FOR USE A1 - A6 WITH SYSTEM 80 PLANTS t

e

!O 1

). CEAC Functional Design Requirements CEN-304 Revision 01 Page VI

I

1.0 INTRODUCTION

(V) 1.~ PURPOSE The purpose of this document is to provide a description of the latest approved Control Element Assembly Calculator (CEAC) and CEA Penalty Factor Algorithm functional design. This document incorporates all the approved modifications made to CEN-147-(S)

(Reference 1.4.1) as documented in References 1.4.2 thru 1.4.4 and as approved in References 1.4.5 thru 1.4.9. Revision 01 incorporates all the changes described (and approved) in Reference 1.4.10. This document is for NRC ir. formation only as it contains information that has already been reviewed and approved by the NRC Staff. This document will serve as the base reference for future modifications and is intended to be updated as future modifications are ar oved and implemented.

()

V 1.2 SCOPE This Functional Design Requirements document provides the following:

1. A description of the CEA Penalty Factor Algorithm to be implemented in the Core Protection Calculator System of the Reactor Protection System,

2. A description of the algorithms to initiate alarms for CEA sensor failure and CEA deviation,

3. A description of a diagnostic failed sensor data stack, 4 The requirements on CEAC/CPC interfaces, system interfaces, and system initialization.

The Functional Design Requirements described in this document when implemented with appropriate data base and addressable constants (O';

meet the design bases for CEAC given in Section 2.0.

CEAC Functional Design Requirements CEN-304 Revision 01 Page 1-1

I Where significant differences exist between System 80 and pre-system 80 plants (e.g. alarms, annunciators, displays, indicator and the assignment of CEAC's and subgroups), the document provides the pre-system 80 information with corresponding system 80 information contained in Appendix A. /

1.3 APPL ICABILITY -

) '

s This document is a generic descripticn of the CEAC functional design requirements, applicable to all C-E plants gus'ing the digital CPC system. It is intended to be init'ially im'plemented ac SONGS-2 and'3 for cycle 3 and ANO-2 during cycle 5. Initial implementation or reference for WSES-3'end PVNGS-1, 2 and 3 is planned for cycle 2.

1.4 REQUIRED REFERENCES 1.4.1 Functi,onal Design Specification for a Control Element Assembly Calculator, CEN-148-('S)-P, January 1981.

1.4.2 CPC/CEAC Software Modifications for Waterford 3, CEN-197(C)-P, .

{

March, 1982. J 1.4.3 CPC/CEAC Software Modifications for System" 50. LO-82-038, March 1982. S 1.4.4 CPC/CEAC Software Modification for San Onofre' Nu[ lear Generating Station Units No. 2 and 3, CEN-281(S)-P, July 1984 1.4.5 Safety Evaluation Report related to operation of San Onofre Nuclear l Generating Station, Unit 2 and 3, Dockpt Nos. 50-361 and 50-362, '

Southern California Edison Cortvws, January* 199). __.

. y .--

1.4.6 Safety Evaluation Report Related to the, Opdration of Waterford Steam

~

, * ; Electric Station Unit No. 3, Docket No. S0-382 Louisiana Power and Light Company ( July 1981. $; .

.N : ' .

CEACFunctionalDesignRequirementsCEN-30f,- Re,yisien 01 Page 1-2 3

! _ __ 1 .

l

ICE-142(80Q4)/Ir9.1

'~'s 1.4.7 Safety Evaluation Report Related to the Operation of Palo Verde Nuclear Generating Station, Units 1, 2 and 3, Docket Nos.

STN-50-528, STN 50-529, and STN 50-530, Arizona Public Service Company, October 1984 1.4.8 Safety Evaluation Related to Amendment No. 32 to NPF-10 and Amendment No. 21 to NPF-15 for San Onofre Nuclear Generating Station, Units 2 and 3, Docket Nos. 50-361 and 50-362, Southern California Edison Company, March 1985, 1.4.9 Safety Evaluation Related to Amendment No. 66 of Facility Operatng License No. NPF-6, Arkansas Power & Light Company, Arkansas Nuclear One Unit 2, Docket No. 50-368, May 1985.

1.4.10 CPC/CEAC Software Modifications for the CPC Improvement Program, CEN-308-P-A, April 1986.

t O

CEAC Functional Design Requirements CEN-304 Revision 01 Page 1-3

CEAC DESIGN BASIS (O) 2.0 The function of the CEAC is to scan all CEA positions and, based on any single-CEA deviation detected within a CEA subgroup, to calculate the appropriate single CEA position-related penalty factors necessary to ensure that the CPCs calculate conservative approximations to the actual core peak Local Power Density (LPD) and Departure from Nucleate Boiling Ratio (DNBR) during single CEA-related Anticipated Operational Occurrences (A00s), which require CPCS protection. The CEAC must also be capable of detecting

a. reactor power cutback event.

2.1 SPECIFIED FUEL DESIGN LIMITS The fuel design limits used to define the low DNBR and LPD trip settings'in the CPC to ensure the following Specified Acceptable Fuel Design Limits (SAFDLs) are not exceeded are:

V)

a. The DN8R in the limiting coolant channel in the core shall not be less than the ratio where there is at lesst a 95%

probability, with 95% confidence, that DN8 is avoided.

b. The peak LPD in the limiting fuel pin in the core shall not be greater than that value corresponding to the minimum temperature which would initiate centerline fuel melting.

2.2 ANTICIPATED OPERATIONAL OCCURRENCES (A00s)

Anticipated operational occurrences are defined in Appendix A of 10CFR50 (General Design Criteria for Nuclear Power Plants) as:

"...those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit..."

()

9 -

CEAC Functional Design Requirements CEN-304 Revision 01 Page 2-1 l

r 4

O The A00s which can be accommodated by the CPCS using the CEAC-generated penalty factors are the insertion or withdrawal of a single full-length or part-length CEA including:

A. Uncontrolled insertion or withdrawal of a single CEA;

8. A single dropped full or part-length CEA; C. A single CEA sticking, with the remainder of the CEAs in that subgroup moving; -

D. A statically misaligned full or part-length CEA.

O O

CEAC Functional Design Requirements CEN-304 Revision 01 Page 2-2

3.0 FUNCTIONAL DESIGN AND COMPUTER DESIGN REOUIREMENTS 3.1 CEA CALCULATOR PENALTY FACTOR ALGORITPM FUNCTIONAL REQUIREMENT CEA insertion or withdrawal is expected to occur according to the sequence prescribed in the plant Techr.! cal Specifications. The CPC/CEAC system, however, must account for the increased radial peaking factor that would result from CEA motion not in accordance with the prescribed sequence. CPC determines radial peaking factors based on the prescribed sequence and corrects for misoperations involving subgroups and groups (out of sequence insertion, subgroup deviations from their group, and excessive insertion of PLCEAs).

However, CPC cannot detect deviations of single CEAs from their subgroup since any CPC will only see one member of a subgroup.

The CEA calculator (CEAC) provides ad,justment to radial peaking factors for those misoperations that are not detectable by the CPCs.

O Specifically, the CEAC compares the positions of the four (or five)

O CEAs in each subgroup to decide if a significant deviation is present. Should such a deviation be detected, the CEAC determines, and serds to the CPC, two penalty factor multipliers; one each for the DNBR and LPD calculations. The penalty factors accommodate changes in the core axial and radial power distributions that are not directly perceived.by CPC and are selected to assure that CPC obtains conservative estimates of the peak local power density and minimum DNBR for individual CEA-related A00s that require a CPCS trip.

To satisfy these requirements, the following specific functional requirement, as a minimum, must be satisfied.

3.1.1 Reouirements for Accommodation of Defined Sinale CEA-Related A00s The CEA deviation Penalty Factors generated by the CEAC for use in G the CPC trip functions must be designed to accommodate the individual CEA-related A00s described in Section 2.2. The bases for this requirement are:

CEAC Functional Design Requirements CEN-304 Revision 01-P Page 3-1

1. Criteria 25 and 29 of 10CFR50 Appendix A, " General Design  !

(V] Criteria for Nuclear Power Plants."

2. Regulatory Guide 1.70.

3.1.2 Inputs and Outputs The CEACs shall each receive analog core axial CEA position measurement signals which originate from one of two Reed Switch Position Transmitters (RSPTs) associated with each CEA. Each CEA position is measured by two redundant independent RSPTS which transmit analog signals to two redundant independent CEACs (refer to Figure 3-1 for ANO-2). The resolution requirements on the CEAC measurement of CEA position shall be such that (excluding process signal error) CEA position shall be determined to within 0.5%.

The RSPT consists of a series of magnetically actuated reed switches

(~] sp. aced at intervals along the RSPT assembly and wired with precision V *esistors in a voltage divider network. The RSPT is affixed adjacent to the Control Element Drive Mechanism l'EDM) pressure housing and CEA extension shaft. A magnet attache s the CEA extension shaft actuates the adjacent reed switches, causing a voltage signal proportional to the CEA position to be transmitted for each CEA. The two RSPTs are isolated both electrically and physically from each other. The CEAC input signal derived from the RSPT output has a range of 5 to 10 volts corresponding to 0 to 150 inches of CEA travel, or 0% to 100% withdrawal.

The CEAC shall calculate the CEA deviation Penalty Factors based on CEA position sensor input data obtained from each of the RSPTs (refer to Figure 3-1 for typical 81 CEA Plant). The components of the CEA deviation Penalty Factors are determined from the following data:

(~3 1. Two static penalty factor components calculated as functions of U deviation magnitude within a subgroup; one each for DNBR and LPD.

CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-2

FIGURE 3-1 O_

l l

S-CEAC Functiona1 Desi9"

• CEM 30A RevisiO" Page 3~3

2. A dynamic xenon penalty factor component calculated as a function of elapsed time during which excess deviation exists in the subgroup.

3. Two correction constants for the Xenon component; one each for DNBR and LPD.

The output signals for each CEAC are listed in Table 3-1.

The two contact outputs must actuate operator alarms. The six '

digital-word outputs form the 16-bit output buffer which transmits the CEA penalty factors to the CPCs. The CEAC Failure Flag indicates that (1) the quantity of deviating CEAs per core quadrant or (2) the quantity of failed sensors exceeds limiting pre-set numbers. Actuation of the CEA Failure Flag is described in more detail in Section 3.4.1. The Scale Flag indicates the range of the penalty factors, and is described in more detail in Section 3.4.3.

O O 3.2 PROGRAM STRUCTURE TheCEACdesignbasesrequire5hatthecalculatorbecapableof detecting a reactor power cutback event, detecting CEA deviation, calculating the single CEA deviation penalty factors, and indicating by alarm and indicator flag CEA deviation, CEAC failure, and sensor out-of-range failures. In addition, the CEAC will provide diagnostic information on CEA sensor failures. Therefore, the CEAC Penalty Factor Algorithm has been designed:

1. To recognize the initiation of a reactor power cutback event.

2. To calculate the deviation (difference in position) amongst the CEAs in each subgroup.

3. To recognize excessive CEA deviation within a subgroup, and to identify each occurrence as a single CEA withdrawal, single CEA insertion, or multiple CEA deviations within a subgroup and communicate this recognition to the CPCs.

CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-4

/'s 4 To calculate and/or look up a penalty factor for LPD, and a penalty factor for DNBR based on the type of deviation event, the magnitude of the deviation, the CEA subgroup with the deviatien, the CEA configuration, and the elapsed time since the start of the deviation. The LPD and DN8R penalty factors shall be selected as the maximum of the LPD and DNBR penalty factors calculated for each subgroup. The maximum penalty factors minus one will be transmitted to the CPCs as part of the output of the CEAC.

5. To determine the status of the CEAC sensor fail alarm and the CEA deviation alarm.

6. To check some conditions under which CEAC (or upstream hardware) failure should be indicated to the CPCs.

7. To provide diagnostic information on,.CEA sensor failures, and p on the causes of a CEAC penalty factor.

V

8. To provide an indicator to the CPCs of the scale used in determining the penalty factors transmitted.

9. To support CEA CRT display software by calculating parameters used for the display.

3.3 PROGRAM TIMING AND INPUT SAMPLING RATES (See Appendix A for System 80 Plants)

The CEAC Penalty Factor Algorithm software is designed for the purpose of providing, for existing CEA configurations, an on-line real-time determination of the single CEA deviation DNBR and LPD penalty factors to be applied in the CPC determination of the hot pin heat flux distribution, the adjusted compensated core average power, and the local power density. The algorithm required for this

/7 purpose is time oriented, with a calculation scheduling rate and update period that is compatible with overall CEAC/CPC system CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-6

/~'T response requirements. The execution period is the maximum time in

's l seconds from the time CEA RSPT sensors are scanned to the time the CEAC calculated outputs are updated with new information from that input scan and calculation. The calculations shall be scheduled in such a manner that the update requirements are met.

There are two CEAC System update periods:

1. The Update Period This update period consists of a periodic fixed -

algorithm scheduling rate. The CEAC Penalty Factor Program outputs shall be updated every

2. The Update Period ()

This update consists of a fixed algorithm scheduling rate with

,- . The CEAC Penalty k,,) Factor Program calculated output to a CRT bar graph display showing individual CEA positions arranged in subgroups and groups shall be updated at least every _

The tolerance on the execution periods is .

3.4 PROGRAM INTERFACES Communications with the CPCs must be rapid and simple. In addition, the output to the CPCs must not change until after execution of the CEACs has been completed. This is accomplished by a 16-bit output buffer which transmits data to each CPC. This output buffer shall have a memory location, and the 16 bits shall be assigned in the following manner:

O

'\- /

CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-7

1 b.

l l

l I

s i

i J

i i

i i

j CEAC Functionel Design Requirements CEN-304 Revision 01 Page 3-8 a

b,ey CEAC Failure Flag A CEAC failure flag shall be transmitted to the CPCs as part of the 16-bit output buffer. This flag shall be set true when either or both of the following conditions occur:

O V

The CEAC Penalty Factor Program shall perform sensor out-of-range validity checks on the raw RSPT sensor input data and initiate a sensor-cut-of-range alarm when out of range conditions are detected.

Analog si';ials outside the acceptable operating range represent failure of the RSPT., If this check indicates sensor in-range, a is then performed. If either of these checks fail, the sensor fail flag is set.

In addition, the CEAC failure flag shall set for internal processor faults including fixed point divide faults, floating point arithmetic fault, memory parity errors, illegal machine instruction, or failure to meet the timing requirements of Section 3.3.

CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-9

3.4.2 Case 2 Deviation Flag l 6,

A Case 2 deviation (or large penalty factor) flag shall be trans-mitted to the CPCs as part of the 16-bit output buffer. This flag shall be set true when either or both of the following conditions occur:

The CEAC Penalty Factor Program shall check for indications of 4

'O 3.4.3 Reactor Power Cutback Flag A Reactor Power Cutback (RPC) Flag shall be transmitted to the CPCs as part of the 16-bit output buffer. This flag shall be set (IRPC=1) when the following conditions occur:

O CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-10

em '

(_ )

3.4.4 Scaling Flag After the DNBR and LPD penalty factors have been calculated, each penalty factor is prepared for packing into the 16-bit output buffer

/N

(~-)

3.4.5 CEAC Off-line Storage and Reloading To accommodate events where reloading of the CEAC Penalty Factor Algorithm program is required because of software and/or hardware failures, a means shall be provided to permit rapid reloading of the CEAC software from a suitable off-line mass storage device O

CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-11

I q (one per CEAC). The off-line storage device shall be utilized

(/ for nomal CEAC start-up loading but not during normal CEAC operation.

3.5 OPERATOR INTERFACE (See Appendix A for System 80 Plants)

The reactor operator shall be informed of the status of the CEACs by three mechanisms.

1. The calculators generate alarms to alert the operator to CEA sensor failure or excessive CEA deviation.

2. The CRT Video Monitor displays the position of the individual CEAs arranged into subgroups and control groups utilizing a bar graph representation, the floating point values of the two penalty factors, and a flag to indicate the cause of any alarms, t

3. The CPC/CEAC operator's module displays CEAC inputs, selected intermediate variables, and outputs.

3.5.1 Alarms and Annunciators A CEA deviation alarm (including Case 2 type deviations) and a failed sensor alarm shall be provided to the Plant Annunciator System (aur.ible and visual) and to the CPC/CEAC operator's module.

Removal of the alarm indication should be prohibited unless the condition causing the alarm no longer exists.

3.5.2 Disolavs and Indicators Both CEACs shall be linked to a single CRT Display Generator for the purposes of displaying individual CEA position information. The

~

connection between the data link and each individual CEAC shall be made via an appropriate isolation device (as defined in IEEE Std. 4 CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-12

279-1971). A manual selection switch shall be utilized to determine (V] which of the two CEACs the Display Generator will utilize in generating a CEA position display. The CEA Position Display (Figure 3-1) consists of a CRT Video Monitor and a Display Generator. O The CRT Video Monitor shall display the position of the individual CEAs arranged into subgroups by control groups utilizing a bar graph i representation. The CEAs and subgroups assigned to each control group shall be recorded above the bar graphs. The CRT shall provide an indication of CEA deviation which allows the deviating CEAs to be identified as well as the magnitude of the deviation.

Provisions shall also be made to allow the operator to obtain a digital position read out in units of inches from the bottom of the core by addressing the particular point I.D. of the CEA on the operator's module. Certain CEAC intermediate variables and outputs (including the LPD and DNBR penalty factors and the packed penalty f3 factor word to be transmitted to the CPCs) shall be available U through the operator's module.

Each CEAC shall provide diagnostic information to the operator via the operator's module or a teletype. The three types of diagnostic information to be provided are:

1. Failed sensor stack.

2. A " snapshot" or listing of CEA positions, penalty factors, and time of occurrence of the deviation.

3. A flag indicating the cause of any alarm.

Each CEAC performs sensor input out-of-range checks

~

O V

CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-13

O

. This information can be retrieved through the operator's module or a teletype. The failed sensor stack should be saved through auto-restarts.

A " snapshot" of CEA positions, penalty factors, and time of deviation occurrence is initiated by 1) a CEAC penalty factor greater than one, 2) the large PF flag, 3) a CEAC failure __

O,a .

This information can be retrieved through a teletype. The CEAC snapshot should be saved through auto-restarts.

A CEAC fail indication is transmitted to the CPCs under the following conditions:

i

(

CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-14

"Q

3. Initialization and in-test mode,

4. CEAC hardware failure,

5. CEAC memory unprotected,

6. Watchdog timer timeout.

3.5.3 Operator Input The operator must have the capability to change a limited set of program constants, called addressable constants, via the input /

output device. Modification of addressable constants shall be permitted only when a manual interlock has been activated. In

(' addition means shall be provided to prevent modification of any

' I's V constants not designated " addressable". The required addressable constants are limited to ,one, constant for clearing the snapshot buffer (3.5.2), one constant for the Reactor Power Cutback maximum time limit and one constant for rewriting the entire CRT display on command. The required addressable constants are listed in Table 3-3.

3.6 INITIALIZATION The CEACs must be cap,able of initializing to steady state operation for any allowable plant operating condition. Initialization should be complete within of initial CEAC startup or of restart following a CEAC failure or in-test condition. Until initialization of a CEAC is complete, the CEAC failure flag shall be set.

(O CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-16

l Table 3-3 Addressable Constants

Symbol Definition Range BUFTRP Snapshot Buffer Control Flag TCBP Max'imum time that the RPC Flag Can Remain Set (Seconds)

TCOUNT CRT Display Rewrite  !

Control Flag b

0 i

i i

4 O

l l.

CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-17

,s, Durina initialization, the calculated penalty factors shall approach the steady state value from the conservative direction.

jnijialization shall be considered to be complete after at least

~

executions of the CEAC initialization program have occurred.

3.7 TESTING REQUIREMENTS The CEAC shall be designed to perform periodic testing of the CEAC Penait Factor Program upon operator cemand.

The bases for this requirement are:

1. iEEE Std. 338-1971, "IEEE Trial Use Criteria for the Periodic Testing of Nuclea'r Power Generating Station Protection Systems."

2. Criteria 21 and 27 of 10CFR50 Appendix A, " General Design c Criteria for Nuclear. Power Plants."

\,

3. Regulatory Guide 1.22, " Periodic Testing of Protection System Actuation Functions."

The testing of the system shall be accomplished by disabling the input interface and simulating new inputs from a periodic testing data base. Selected outputs will then be checked against a corresponding expected value data base, and differences will be identified. During the time the CEAC is performing the periodic test a digital code s, hall be generated and transmitted to the CPCs to identify that the CEAC unit is in-test.

O CEAC Functional Design Requirements CEN-304 Revision 01 Page 3-18

( 4.0 ALGORITHM DESCRIPTION This section includes a detailed description of the functions to be performed by the CEAC Program. For the program described below, the sequence of computations recuired is described in sufficient detail to allow the software designer to specify the coding of the protection program.

The penalty factor algorithm produces two penalty factors, one for DNBR and one for LPD. These penalty factors are found by taking the largest DNBR penalty factor and the largest LPD penalty factor calculated for any subgroup. The penalty factors on the subgroup level are formed by combining a static DNBR penalty factor component with a dynamic Xenon penalty factor component, and by combining a static LPD penalty factor component with a dynamic Xenon penalty factor component.

('} The static DNBR and static QD penalty facter components are V calculated as a function of TheconstantswhichdefinetEsdependencearelookedupasa function of the deviation type, subgroup containing the deviation,

. The dynmic Xenon penalty factor component is calculated as'a function of -

CEA position signals are read in and processed to screen out false signals, and the status of the sensor fail alarm is determined. _

O CEAC Functional Design Reovirements CEN-304 Revision 01 Page 4-1

I O

f 4.1 PENALTY FACTOR ALGORITHM 4.1.1 Alcorithm Input The inputs to the algorithm are a set of live CEA position signals received from the reed switch position transmitters. Each signal is j

processed to screen out false signals, i.e. each signal is checked, for out-of-range and i

O t

i.

a 1 .

i l

l O

CEAC Functional Design Requirements CEN-304 Revision 03 Page 4-2 l

TABLE 4-1 Typical Assignment of CEDMs to Subgroups Sub-Group No. CEDM No.

1 2,3,4,5 2 6,7,8,9 3 10, 11, 12, 13 4

14, 16, 18, 20 5 15, 17, 19, 21 i 6 22, 23, 24, 25 7 26, 27, 28, 29 8 30, 32, 34, 36 9 31, 33, 35, 37 10 38, 40, 42, 44 11 39, 41, 43, 45 12 46, 47, 48, 49 V 13 50, 52, 54, 56 14 51, 53, 55, 57 15 58, 59, 60, 61 16 62, 64, 66, 68 17 63, 65, 67, 69 18 70, 73, 76, 79 19 71, 74, 77, 80 20 72, 75, 78, 81

• XX *1

1. *CEDM No. 1 is to be capable of being assigned to any one of the 20 subgroups.

2

2. The assignment of CEDMs to subgroups as controlled by the CEDMCS is fixed for the life of the plant (except for CEDM #1)

O

• • This CEDM assignment will differ from plant to plant. Table 4-1 O presents typical CEDM assignments for 81 CEA plant.

CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-3

('~')

U TABL E 4-2 Typical Assignments of Subgroups to Control Groups ASSIGNMENT OF SUBGROUPS TO CONTROL GROUPS ** l CONTROL GROUPS * (Subgroup No.)

Regulating Group #6 12 Regulating Group #5 15 Regulating Group #4 3 Regulating Group #3 16, 17 Regulating Group #2 2, 19 Regulating Group #1 10, 11 Shutdown Group A 13, 14, 18, 20 Shutdown Group B 1,4,5,8,9 Part-Length Group P1 6 P2 7 Notes:

• For many, but not all, CE plants Regulating Control Group 56 is the first to be inserted in sequence and Group #1 is the last. Regulating Control Group #1 is the first to be withdrawn in sequence and Group 16 is the last.

• • This subgroup assignment will vary from plant to plant. Table 4-2 presents typical subgroup assignments for a CEA group structure similar to ANO-2.

O O

CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-4

4 i

l l

l t

k i

t i

I 1

f 4

i 4

CEAC Functional Design Recuirements CEN-304 Revision 01 Page a-5 4

'r.~,

- s - , - - , , . . , ,.n. . _ . _ _ ,,.,_ _,,,_,,_ _ , , _

a. . _ _ _ . _ _ . _ .

e l.

f i

!O

}

1 1

3 4

1 4

J ,

e 2

a l

}

f 4

e i

f I

l

l 1,

i  ;

,r LO t

1  !

i l

i i 1

I 4

I i

t, i

i I

i-CEAC Functional Design Requirements CEfi-304 Revision 01 Page 4-6

. - - , - - . - . . , - - - , - - - - . . - ~ . - . - . - . - . - , . - - - - - - . . - - - . . - _ . - - - . - - . . . . - - - . -

4

.l 1

l s

i t' s i

a i 1

1 1

f s

e i

\

i j s a

i r

l i

l l

l CEAC Functional Design Reoufrements CEN-304 Revision 01 Page 4-16  ;

. . _ _ . - , _ _ . _ . _ _ _ _ . _ , . _ _ _ _ . _ _ _ _ _ _ _ _ . _ . _ _ , - _ _ _ . . . _ . _ _ _ _ _ , . _ _ _ _ _ _ _ _ . . . _ _ _ . . . _ . _ _ _ _ __._,_..._ .___ __... _ __ _ _. s. _ _ . . _ _ _

}

O O -

t i

t i

l l

l lO l

[

i CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-17 l

t

,- .--.,,--__,...~..__.....-.._,,__,.--,,__..__---,.,-~~.-,_,.m_._, ___ . - , , . . . , . . . . - - - - _ - - - , _ _ _ . -

)

r ,:- - l r~y O * '

t . .

i p r+

r..  ::, i i .,

J r

(.

The,-LPD and DNBR penalty factors for each subgroup- are determined_ by ccmbining the static penalty factor component, the Xenon. penalty factor-component, and the appropriate Xenon correction

' constant. - _ _,

ry .

s i-

< O..

CEAC Funct.fenal Design. Requirements CEN-304 Revision 01 Page 4-33 u,

I, f P

O O

O CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-34

't i

O O

O CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-37

4 O

4 O

4.1.5 CEAC Initialization O

CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-38

)O O  !

l l

l i

l i

i O

i CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-39 f

4,

1

. 4.1.6 CEAC Constants The constants required for the CEAC are listed below. The following constants will be provided by the functional design group:

O-O CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-40

I-i i

e f

4 1

J J

d.

4 T

l l

l CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-41 l

APPENDIX A

{v~"}

PEVISED SECTIONS FOR USE WITH SYSTEM 80 PLANTS Appendix A contains those sections which would be changed for application to System 80 plants. Appendix A section numbers correspond to the main documant numbers, but are preceded with an "A". For application to System 80, the appendix sections supercede those with corresponding numbers in the main document. Sections which have generic applicability, therefore, are not contained in this appendix. The following is a list of Appendix A section numbers with their corresponding titles and page numbers.

Section No. Title Page No.

A3.3 Program Timing and Input Sampling Rates A2 A3.5 Operator Interface A3 V(~"g T

i O

CEAC Functional Design Requirements CEN-304 Revision 01 Page Al

.,~.,,,._...__-r -_m -

A3.3 PROGRAM TIMING AND INPUT SAMPLING RATES v

The CEAC Penalty Factor Algorithm software is designed for the purpose of providing, for existing CEA configurations, an on-line real-time determination of the single CEA deviation related DNBR and LPD penalty factors to be applied in the CPC determination of the hot pin heat flux distribution, the adjusted compensated core average power, and the local power density. The algorithm required for this purpose is time oriented, with a calculation scheduling rate and update period that is compatible with overall CEAC/CPC system response requirements. The execution period is the maximum time in seconds from the time CEA RSPT sensors are scanned to the time the CEAC calculated outputs are updated with new information frem that input scan and calculation. The calculations shall be l scheduled in such a manner that the update requirements are met. l There are two CEAC System update periods:

O V 1. The Update Period This update period consists of a periodic fixed algorithm scheduling rate. The CEAC Penalty Facter Program outputs shall be updated every .

2. The Update Period This update consists of a fixed algorithm scheduling rate with

. The CEAC Penalty Factor Program c'alculated output to a CRT bar graph display showing individual CEA positions arranged in subgoups and groups shall be updated at least every .

The tolerance on the execution periods is ,

D CEAC Functional Design Requirements CEN-304 Revision 01 Page A2 i

A (one per CEAC). The off-line storage device shall be utilized for U normal CEAC start-up loading but not during normal CEAC operation.

A3.5 OPERATOR INTERFACE The reactor operator shall be informed of the status of the CEACs by three mechanisms:

1. The calculators generate alarms to alert the operator to CEA sensor failure or excessive CEA deviation.

2. The CRT Video Monitor displays the position of the individual CEAs arranged into subgroups and control groups utilizing a bar graph representation. If a CEA deviation exists, the group and subgroup having the deviation, the CEAs assigned to the subgroup with the deviation, and the position for each of these CEAs in inches from the bottom of the core will be displayed 3 below the bar graph representation. This display of CEA (V deviation information is ordered by decreasing penalty factor magnitude and is limited to the information associated with three CEA deviations. In addition CEA sensor failure information (CEA number and type of failure) shall be dis-played, if not preempted by CEA deviation information.

3. The CPC/CEAC operator's module provides CEAC inputs, selected intermediate variables, and outputs.

A3.5.1 Alarms and Annunciators A CEA deviation alarm (including Case 2 type deviations) and a failed sensor alarm shall be provided to the Plant Annunciato-System (audible and visual) and to the CPC/CEAC operator's module.

Removal of the alarm indication should be prohibited unless the condition causing the alarm no longer exists.

O b

CEAC Functional Design Requirements CEN-304 Revision 01 Page A3

A3.5.2 Displays and Indicators Both CEACs shall be linked to a single CRT Display Generator for the purposes of displaying individual CEA position information. The connection between the data link and each individual CEAC shall be made via an appropriate isolation device (as defined in IEEE Std. 279-1971). A manual selection switch shall be utilized to determine which of the two CEACs the Display Generator will utilize in generating a CEA position display. The CEA Position Display (Figure 3-1) consists of a C.RT Video Monitor and a Display Generator.

The CRT Video Monitor shall display the position of the individual CEAs arranged into subgroups by control groups utilizing a bar graph representation. If a CEA deviation exists, the CRT shall identify the CEA's assigned to the subgroup with-the deviation and shall indicate the position of these CEA's in inches from the bottom of the core below the bar craph representation. The CRT shall also r~T display failed sensor information. .

U Provisions shall also be made to allow the operator to obtain a digital position read out in units of inches from the bottom of the core by addressing the particular point I.D. of the CEA on the operator's module. Certain CEAC intermediate variables and outputs (including the LPD and DNBR penalty factors and the packed penalty factor word to be transmitted to the CPCs) shall be available through the operator's module.

Each CEAC shall provide diagnostic information to the operator via the operator's module or a teletype. The three types of diagnostic information to be provided are:

1. Failed sensor stack.

2. A " snapshot" or listing of CEA positions, penalty factors, and time of occurrence of the deviation.

(U"]

CEAC Functional Design Requirements CEN-304 Revision 01 Page A4

- - - - _ . _ - - _ . ~ - ._

c A CEAC fail indication is transmitted to the CPCs under the following conditions:

1. More than a pre-sat number of sensors are indicated failed,

2. More than a pre-set number of subgroups contain excessive deviation (excessive deviations are counted by core quadrant),

3. Initialization and in-test mode,

4. CEAC hardware failure,

5. CEAC memory unprotected,

6. Watchdog timer timeout.

O A3.5.3 Operator Input The operator must have the capability to change a limited set of program constants, called addressable constants, via the input /

output device. Modification of addressable constants shall be permitted only when a manual interlock has been activated. In addition means shall be provided to prevent modification of any constants not designated " addressable". The required addressable constants are limited to one constant for clearing the snapshot buffer (A3.5.2) and one constant for the Reactor Power Cutback maximum time limit. A method shall also be provided to permit rewriting the entire CRT display on command. The required addressable constants are listed in Table 3-3.

O CEAC Functional Design Requirements CEN-304 Revision 01 Page A6

O TABLE 4-1 Assignment of CEDMs to Subgroups for System 80 f

( THIS PAGE DELETED )

O O ,

J i

l i

i 2

i I

l t

i

! CEAC Func. Design Requirements CEN-304 Revision 00 Page A7

' TABLE 4-2 Assignments of Subgroups to Control Groups for System 80 First Fuel Cycle **

( THIS PAGE DELETED )

O 4

i s

1 O CEAC Func. Design Requirements CEN-304 Revision 00 Page A8 i:

i

O i

I O

i 4

J i

i l

t I

I i

l l

!O CEAC Functional Design Requirements CEN-304 Revision 01 Page 4-42

..