ML20138J062

Forwards Response to 850910 Request for Addl Info Re SPDS, Including SPDS Operator Training Program Outline for Man-In-The-Loop Validation & SPDS Man-In-The-Loop Validation Scenarios

ML20138J062
Person / Time
Site:	Millstone
Issue date:	10/16/1985
From:	Opeka J, Sears C NORTHEAST NUCLEAR ENERGY CO., NORTHEAST UTILITIES
To:	Youngblood B Office of Nuclear Reactor Regulation
Shared Package
ML20138J066	List: A05244, Forwards Response to 850910 Request for Addl Info Re SPDS, Including SPDS Operator Training Program Outline for Man-In-The-Loop Validation & SPDS Man-In-The-Loop Validation Scenarios ML20138J062 ML20138J092 ML20138J098
References
RTR-NUREG-0737 A02959, A05244, NUDOCS 8510290235
Download: ML20138J062 (11)

Text

m. -

a Lj N UTILITIES o.nor.i 0,vice. . seio n sir..i. a.riin. conn.ciicut sY em aa'ma **

res$s P.O. BOX 270 HARTFORD. CONNECTICUT 06141-0270 L L j [ ^"

,, [ ' Z ",", (203) 665-5000 October 16,1985 Docket No. 50-423 A02959 A05244 Director of Nuclear Reactor Regulation Mr. B. 3. Youngblood, Chief Licensing Branch No. I Division of Licensing U. S. Nuclear Regulatory Commission Washington, D. C. 20555

Reference:

(1) B. 3. Youngblood letter to 3. F. Opeka, dated September 10, 1985.

Dear Mr. Youngblood:

Millstone Nuclear Power Station, Unit No. 3 Supplement I to NUREG-0737 Safety Parameter Display System in Reference (1), the NRC Staff summarized the results of its audit of the Millstone Unit No. 3 Safety Parameter Display System (SPDS). A request for additional information required as a result of this audit was also included. The purpose of this submittal is to provide the requested information, which can be found in Attachments No.1,2 and 3.

We understand that a subsequent audit report is forthcoming. We emphasize that insufficient time will be available to respond to any newly identified items to support preparation of the next Supplement to the Safety Evaluation Report. We trust that all requests for additionalinformation are contained in Reference (1).

We also wish to emphasize that the functional specification for the Millstone Unit No. 3 SPDS, which is an attachment in Reference (1), is an internal document only and is not to be treated as a licensing commitment. This document was only provided to the NRC Staff during the SPDS audit for informational purposes.

Attachment No. 3 contains the scenarios for man-in-the-loop testing. Only a limited distributiori of Attachment No. 3 is planned within our organization.

Likewise, we recommend that you consider a limited distribution of Attachment No. 3 within the NRC Staff and also withholding Attachment No. 3 from public disclosure until completion of the man-in-the-loop testing.

8510290235 851016 goa aoocx omga qi s

s 5 l

We trust that this submittal adequately responds to the portion of Reference (1) related to the Millstone Unit No. 3 SPDS.

Very truly yours, NORTHEAST NUCi. EAR ENERGY COMPANY et. al.

BY NORTHEAST NUCLEAR ENERGY COMPANY Their Agent bi iO

3. F. Opeka '

Senior Vice President By: C. F. Sears Vice President STATE OF CONNECTICUT)

) ss. Berlin COUNTY OF HARTFORD )

Then personally appeared before me C. F. Sears, who being duly sworn, did state that he is Vice President of Northeast Nuclear Energy Company, an Applicant herein, that he is authorized to execute and file the foregoing information in the name and on behalf of the Applicants herein and that the statements contained in said information are true and correct to the best of his knowledge and belief.

bs 11f M A-Notary Public - C My Commissica Expkes March 31,1063

., .. . . .~ . .

. i

, : - C 4: .

..-y< 1

.a . a _

Docket No. 50-423 _,

t:

Attachment No.1 Millstone Nuclear Power Station, Unit No.' 3 Response to Request for AdditionalInformation I

v I

r k

, r i .

r l

5 October,1985 L

l, '

l' '.

~

, - ,- ...,,,-,..a..,.-.,. . . - . _ ~ . . . . . . . . . . . - . _ . . - . . . - . . . - - _ - - - - . - . - - . . - . . . - . - . . . . - . .

@ (

Response to Request for AdditionalInformation Item No.1:

'In . order to complete its review, the staff needs the following items for confirmatory review,

a. Integrated Test Results (in summary form)

b. Man-in-the Loop Test Results

c. Training Plan and Schedule _

d.' . List of scenarios used in Man-in-the-Loop Testing

e. Results of the 100 Hour Test

f. Commitment to a formal procedure for assuring that the SPDS and the plant Emergency Operating Procedures are consistent with each other.

Response

a. An Integrated Acceptance Test (IAT) was developed to test the integrated Millstone Unit No. 3 Plant Process Computer /SPDS and to assure that the Plant Process Computer /SPDS operates as designed.

The IAT was started on August 4,1985 and completed on September 14, 1985. During this test period, the IAT was interrupted so that the Plant Process Computer could be used to support Engineered Safety Features (ESP) Testing.

A total of ~ninety-nine (99) deficiencies were written against the Plant Process Computer System during the IAT. Fourteen (14) of these were either "use-as-is", voided, or corrected and closed. A total of eighty-five (85) deficiencies remain open as of September 26,1985, only thirty-one (31) of which affect the operability of the SPDS. All thirty-one (31) deficiencies are scheduled to be corrected and closed by fuelload.

The functional areas tested are described below:

I. - Initial Conditions The initial conditions test demonstrated that the system can be completely recreated from the source code. This test also provided the initial system state for subsequent tests.

The source code and the current database were added to a pair of disc packs which contain the standard MODCOMP operating system.

A set of procedures was executed which generated the libraries and load modules from the source code.

~

The initial conditions test acceptance was based on the ability to recreate the system completely, to cold start the system, and to provide a functional system.

j cy 4 II. Point Type Testing

~The point type testing verified the Millstone Unit No. 3 Plant Process

' Computer processing and display of a representative set of analog, digital, and pulse inputs. Test inputs were used to generate field

. point transitions which were monitored using operator- interface displays and printer reports. Digital outputs were tested by lighting the associated annunciators.

~

' Analog inputs were tested for voltage, engineering units conversion,

. and alarm processing. The test signals for analog points were varied to check deadband filtering and update rates. - Digital input signals were tested for state change, _ alarm, and sequence of events processing. Pulse inputs were tested for the ability to increment, decrement,' and set accumulations.

III. Man-Machine Interface Functional Testing

!The man-machine interface consists of a data base editor, a display builder and a plant operator interface. Each section was tested.

The' display builder was tested by building a representative set of

, display types'that the display builder is capable of producing. Each type of point (analog input, digital input, etc.) was built into the displays in each format (bar chart, repeat point, special symbol, etc.)

available. All options of the display builder were exercised. Test points were used for all points within the displays. The displays were called up using the plant operator interface. Using the test equipment, the values of the -test points were changed and the displays were examined to insure correctness.

The plant _ operator interface was tested . by exacising a L representative set of functions available. Functions (video t:end, l edit a group, reroute alarm CRT, etc.) were tested by performing the function and verifying that the-correct result was displayed to the

!, operator.

IV. Application Program Testing At the time the IAT was performed, there were a set of application programs that had passed their tests. These programs were running on the system during the IAT in their normal mode of execution. A

, test similar .to the individual acceptance test for four (4) of the

[~ application programs was run. The test case -data for - these L application programs was . used and the results met the same -

acceptance criteria as the individual application program tests. The application programs which require failover were terted under

' failover conditions.

g .-

+

I

,L(

'N' . .

.V. . Safety Parameter Display System (SPDS) Testing

~ SPDS testing demonstrated the SPDS functions in. an integrated environment.. All .SPDS features had been tested prior to the i

' execution of the integrated test under the Verification and Validation

.(V&V) plan. . The integrated test called up SPDS primary. and 1 secondary displays.

2 A set of field inputs which are used in a Critical Safety Function

-(CSF) calculation was connected to test equipment.- The test verified q that the selected SPDS CSF-primary and secondary displays correctly '

. reflect the test -input signals. The SPDS historical archiving and

- ' quality tag features were also tested for the test points. I SPDS displays were stimulated with pre-processed external data. The SPDS-required security features were demonstrated.

- VI. ; Communication Testing The Plant Process Computer has communication interfaces to various other systems. The ability to receive, process, and display the data for each system was demonstrated.

Test case data transmitted from the remote systems and received by.

- the Plant Process' Computer was used when available. If test case;

~

data were not available, the systems were tested by a comparison of. -

the data transmitted with the data received. The redundant communication paths were tested for failover.

VII.- Stress Testing -

The test requirements for the SPDS timing test (i.e., stress test) were revised to include a worst-case input load on the Plant Process Computer. The timing test was run at Millstone Unit No. 3 on September 20,1985.and the results achieved were satisfactory for 7

. operation of the SPOS.

The worst case input 'oad on the Plant Process Computer was selected to approximate the first ten (10) minutes of a loss of coolant ,

accident coincident with-a loss of off-site power. Test software l varied 600 analog inputs and 192 digital inputs. In addition, step

- changes were applied to selected live SPDS inputs which were used in

-the measurement of delay times for' information shown in SPDS '

[- displays. Information delay' times which were measured included:

[  : sensor data, quality tags, calculated variables on CSF status tree displays, CSF status tree paths, CSF status boxes, display callup and screen update. Delay times were measured by timers which were started when the live inputs changed state and stopped when the- i measured parameters changed state on che SPDS displays. Each measurement was repeated a sufficient number of times to produce a p valid average.

s : 0 . . ,;

t;-

Display callup averaged less than 1 1/2 seconds and display update rate averaged less than three (3) seconds. The average of delay times

. for sensor data was less than five (5) seconds. The average of delay times for calculated values and quality tags was less than eight (8) seconds. The average of delay. times for CSF status trees and CSF status boxes was less than eleven (11) seconds. ,

Vill. ' Failure Testing The failure test demonstrated the redundant design for the major {

system components. The test consisted of failing and restoring a representative set of devices one at a time.

The test included the halting and rebooting of a satellite, Host A, and Host B. Additionally, a disc drive and a memory plus unit (external bulk memory) were powered down and up.

IX. Restoration The system was placed back into service by copying all the software on the two test. disc packs onto two operating disc packs. The test packs along with a tape copy of memory plus was stored with the test results. The system then began operating using the' operating disc packs.

X. SPDS 100 Hour Test A- 100 hour0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> continuous run with 99 percent design availability during which the system is running as expected in normal operation was successfully performed. Availability is defined as the capability to monitor and display all CSFs, and supporting SPDS displays, on at least one colorgraphic terminal.

.b.- The man-in-the-loop test is currently scheduled to be conducted subsequent

' to the completion of hot functional testing. The results of this test will be submitted in summary fashion three (3) weeks af ter completion of the test.

c. A " Millstone Three Computer Systems" training manual, which includes a detailed description of the Millstone Unit No. 3 SPDS, has been developed and distributed to all Millstone Unit No. 3 operators. The SPDS section of this training manual is a self-taught lesson plan. Upon completion.of this

-lesson. plan, personnel would possess sufficient knowledge to operate and interpret the SPDS portion of the plant process computer. The objectives of the lesson plan are to enable personnel to be capable of:

~ 1) Describing the purpose of the SPDS and recognizing the need for its existence. ,

L

r-

, c: /

2)- Identifying the six Critical Safety and Radioactive Release Functions

.that the SPDS monitors.

3) Distinguishing between the Class IE Inadequate Core Cooling panel and the SPDS Inadequate Core Cooling functions.

4) Describing the locations of the CRT's and keyboards associated with the SPDS.

5) Classifying the availability of the SPDS in relation to plant operational modes.

6) Identifying the different types of common formats the SPDS provides.

7) Describing the data storage capability of the SPDS.

8) Identifying the priorities associated with SPDS utilization.

9) Describing the Millstone Unit No. 3 control room equipment associated with the SPDS.

10) Recognizing the need and design provisions for signal validation in the SPDS.

11) Using the keyboard to call up the various Critical Safety Function (CSF) displays and/or the radioactive release display.

12) Recognizing the response times associated with different types of queries for the SPDS.

13) Describing the ability of the SPDS to store pre / post event data.

14) Identifying the variables that are associated with each SPDS screen display.

15) Iaterpreting all SPDS screen displays associated with the Critical Safety and Radioactive Release Functions.

16) Identifying the trend functions available through SPDS and implementing them.

17) Manipulating apparatus necessary to restart the system.

18) Recognizing how the CSF status boxes respond to a change in SPDS status.-

, gg

- (,-

19) Recognizing the color coding associated with the SPDS displays and examining the differences between these colors and those used in the other process computer functions.

20) Describing the differences between pre / post event files and archival files.

21) . Describing the access security associated with the SPDS.

22) Describing the. adverse containment " Latching" process and explain how it impacts the SPDS displays.

. 23) Recognizing _how various system failures affect the SPDS displays and CRT monitors.

In addition .to the above training for ~all operators, four (4) Supervising Control Operators will be trained prior to their participation in the man-in-the-loop testing. The training program for man-in-the-loop testing is described in Attachment No. 2. This training program involves

approximately a half day of training on the SPDS prototype located in Berlin, CT in addition to the man-in-the-loop testing. We believe that these four (4) Supervising Control Operators (SCOs) will be adequately .

- trained to utilize the SPDS.

'We also plan to train by fuel load a sufficient number of Senior Reactor Operators (SRO) to allow at least one (1) .SRO per shift to have been formally trained on the SPDS. This additional training will be similar to the training program for the four (4) SCOs participating in man-in-the-loop testing. Additional formal training for all operators who will utilize the SPDS will be completed prior to the issuance of the full power operating license.

- d. The list and a brief description of the' scenarios to be used for man-in-the-loop. testing can be found in Attachment No. 3.

l- e. See our response to item No.1.a above.

f. Either an existing procedure will be modified or a new procedure will be

developed by fuel load to assure that the SPDS and the Emergency

. Operating Procedures.are maintained consistent with each other.

l

> Item No. 2:

Both the desigo program and the V&V program appear to be well planned and executed. .The single exception was the lack of a test procedure for testing worst-case computer loading and possible effects on the operation and response time of the SPDS.

i i

l l

c g-

Response

The test procedure for the SPDS timing test (i.e., stress test) was revised to include a worst-case input load on the plant process computer. A summary of

, .the timing test is included in Item No.1.a.

Item No.~ 3:

The SPDS interface devices and display formats were simple and easy to use and understand. The staff's audit discovered otily one area of concern - the system

. is vulnerable to disruption from'outside the control room because of a simulation capability that._can be initiated from the programmer's console. - As presently designed, personnel at the programmer's-console could conceivably put all five control room consoles into a simulation mode without the knowledge and consent

. of -the control room operators. In addition, the simulation mode displays were -

not distinctively identified. The simulation mode is necessary for the man-in-

' the-loop testing that is yet to be done. However, the staff feels that the method of identifying simulated data should be improved (red, flashing identifier) and access to the simulation mode should be strictly controlled,' e.g., by password, administrative control, and keylocking scenario tapes. In addition, the staff suggested that once the. need for the simulation capability no longer exists, it should be deleted from the system.

Response

The ability to externally stimulate the SPDS will not exist subsequent to aie completion of man-in-the-loop testing, which is scheduled to be conducted prior to fuel load.' Once the Millstone Unit No. 3 simulator includes the SPDS, we plan to use the simulator for any necessary stimulation of the SPDS programs. If r> necessary in the interim to externally stimulate the SPDS in the control room, adequate ' procedures and controls will be implemented to address the NRC Staff's concerns.

i

- Item No. In p

The staff and NU personnel discussed parameter selection and the acceptability

- of using non-SPDS information to supplement the current Millstone 3 parameter set. The only conclusion drawn was that further discussion was necessary and that a representative of the Procedures and Systems Review Branch needs to

' provide further input before a decision can be made.

t- . Response:

! Several discussions have taken place since the SPDS audit to resolve this item.

As a result of a September 18, 1985 phone call, it is our understanding that the

+ _ . - , , . - , -, . _ , , , . , , . ..--.__,<._..--,.,,m-,_,,, , _ . . , , , , , , , ,- , . , - - , , - = , , _,

p

C .,

l

! NRC Staff is currently reviewing our May 24, 1985 letter (I) to determine if the technical justifications already provided to the NRC Staff for not including the additional parameters on our SPDS are adequate. As such, we are awaiting further NRC Staff actino in this area.

3 A

l

-(1) 3. F. Opeka letter to B. 3. Youngblood, dated May 24,1985.

t i

i I

, -