RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION

Transcription

1 / 4 KEPCO/KHNP RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION APR1400 Design Certification Korea Electric Power Corporation / Korea Hydro & Nuclear Power Co., LTD Docket No RAI No.: SRP Section: 07 Instrumentation and Controls Overview of Review Process Application Section: Section 7.0 Date of RAI Issue: 01/04/2016 Question No Provide an explanation on the software safety classification of the core operating limit supervisory system (COLSS) and standalone non-safety I&C systems. General Design Criteria 13 states, in part, that appropriate controls shall be provided to maintain plant process variables and systems within prescribed operating ranges. NUREG- 0800, Section 7.7, III.1, 7th bullet, states, in part, the software for the control systems should be developed in a structured way similar to that of safety system software. Table A-1, "Assignment of Software for the I&C Systems to Classes," of Technical Report APR1400-Z-J- NR P, Rev. 0, Software Program Manual, lists the safety classification of software used in various I&C systems. The software package, COLSS (described in Technical Report APR1400-F-C-NR P, "Functional Design Requirements for a Core Operating Limit Supervisory System," Rev. 0), is not listed on this table for software components that are part of the information processing system (). COLSS is designed to assist operators in instituting technical specification requirements upon entering limiting conditions of operation (LCOs) for the following reactor core aspects: Departure from nucleate boiling (DNBR) margin, linear heat rate margin, azimuthal tilt and axial shape index. COLSS performs numerous computations to monitor these core attributes to help the operators maintain steady state operations and initiate alarms when necessary. COLSS is listed under APR1400 FSAR Tier 2, Section d, "Application programs." Application programs (i.e. nuclear application programs) are classified as [ withheld ] safety class. However, other application programs in Section 7.7, such as the computer-based procedure system (CPS), is listed in Table A-1 of the SPM as being [ withheld ] software. Given the COLSS significance to plant operations, it is not clear why this software is not described in the SPM, and subsequently not clear that COLSS software will be developed in a structured process to provide reliable operation.

2 / 4 KEPCO/KHNP 1. Describe the software development processes used to develop COLSS and provide the basis for the software safety classification of the COLSS, based upon the criteria established in the SPM. 2. How does the applicant intend to verify the design functionality of COLSS (e.g. indications and alarms) to provide its intended functions per Technical Report APR1400-F-C-NR P, Rev. 0? 3. Does COLSS initiate any control system actions beyond providing indications and alarms in the main control room? 4. COLSS is not mentioned in Chapter 18, Human Factors Engineering, of the APR1400 FSAR Tier 2. The applicant states in FSAR Tier 2, Section d, COLSS provides distinct operational advantages. Provide an explanation for how COLSS has been evaluated through human factors engineering practices to ensure design claims about its benefit to operators. 5. Provide a summary of the interface and/or interactions between COLSS and the core protection calculator system (CPCS). The relationship between these two systems is not clear based on design information in Technical Report APR1400-F-C-NR P, Rev Technical Report APR1400-F-C-NR P, Rev. 0, Section 1.2, "Scope," states that COLSS is implemented within the plant monitoring system. Define what the applicant considers is the plant monitoring system as this term does not appear to exist within Chapter 7 of the APR1400 FSAR Tier 2 or other technical reports related to Chapter Describe how operators would be able to determine if COLSS has failed such that an LCO would need to be entered. Response 1. The core operating limit supervisory system (COLSS) is a member of the nuclear application programs (NAPS) which are assigned to the important-to-availability (ITA) class, as described in Table A-1 of the Software Program Manual (SPM) technical report (TeR) APR1400-Z-J-NR-14003, Rev. 0. The COLSS is developed in accordance with the software development processes described in the SPM TeR. Table 4-3 of the SPM TeR provides software tasks and responsibilities to be performed for all software classes including the ITA class. The NAPS, including the COLSS, is assigned to the ITA class according to the programs functionality and importance to safety. The ITA class is assigned to software that is relied upon to maintain operation of plant systems and equipment that are critical to operate the plant, as described in Section 2.1 of the SPM TeR. The COLSS is monitoring software which assists the operator in monitoring the technical specification requirements for the reactor core operating limits. It is not protection software, and it is not required to take any action during a transient. Also, the COLSS does not have any functions that meet the definition of safetycritical or important-to-safety (ITS) class software, in accordance with Section 2.1 of the SPM TeR. V&V methodologies are also applied for ITA class software to increase software reliability and availability during the software development processes.

3 / 4 KEPCO/KHNP 2. The COLSS software is implemented in the information processing system () in accordance with the COLSS functional design requirements (FDR) by the system design group. The design functionality and correctness of the implemented COLSS software is to be verified by comparing the COLSS results (e.g. flow, power, axil shape index, azimuthal tilt, DNBR POL and LHR POL) to the design values which are provided by the functional design group. The operator should confirm that the differences between the COLSS results and the design values are within the acceptable limits. This verification process is performed using the 46 test cases, which consist of 43 test cases for static testing and 3 test cases for tilt algorithm testing. These test cases verify the following COLSS algorithms. Sensor input process related to the range check or cross check Skip logic of power calculation when the related input signal is BAD validity Verification of DNBR Power Operating Limit (POL) algorithm according to the POL calculation option Alarms decision on the LCO exceeds of Axial Shape Index (ASI) Plant power selection algorithm Applying the planar radial peaking factor according to the CEA insertion Penalty factor decision according to the CEA deviation Density compensation constant calculation according to the RCS inlet temperature and pressure Power distribution and azimuthal tilt calculation according to the validity of incore detector signal Selection of axial power distribution synthesis method Azimuthal tilt alarm according to the plant power 3. COLSS does not initiate any control system actions. It only serves to monitor reactor core conditions and provides indication and alarm functions to aid the operator in maintaining core conditions within the LCOs of the Technical Specifications. 4. Information provided by the COLSS has been implemented and evaluated based on the Human Factors Engineering Guideline (HFEG), as described in TeR, APR1400-E-I-NR , "Style Guide". Information grouping, display format, display elements, and display coding which are described in the HFEG were evaluated based on human factors engineering practices. 5. There is no direct interface or interactions between COLSS and CPCS. And also, the instruments to measure plant parameters used as the input of COLSS and CPCS are totally different between COLSS and CPCS. Thus, COLSS and CPCS are independent from each other. COLSS is an on-line monitoring system and CPCS is an on-line protection system. The designs of COLSS and CPCS are integrated with the plant Technical Specifications (in which operating limits and Limiting conditions for Operation are specified) to assure that all safety requirements are satisfied. COLSS, CPCS, and the Technical Specifications thus complement each other. CPCS provides automatic action to place the plant in a safe condition should a violation of the DNBR limit or the LHR limit occur. The Technical Specifications set forth the allowable

4 / 4 KEPCO/KHNP regions, modes of operation, and surveillance and operability requirements for plant systems, components, and parameters. COLSS assists the operational personnel in enforcing the Technical Specifications requirements. CPCS is used to monitor plant conditions when COLSS is out of service using limits defined in Technical Specifications. 6. The plant monitoring system (PMS), which is described in technical report APR1400-F-C- NR P, Rev. 0, Section 1.2, is a typographical error. The word PMS is to be revised to (Information Processing System) in technical report APR1400-F-C-NR P, as indicated in the attachment associated with this response. 7. If COLSS fails, also referred to as COLSS out of service (COOS) condition, the operators are to monitor the LCOs by using CPCS. The LCOs for COOS condition are described in Technical Specifications, Sections 3.2.1, 3.2.3, 3.2.4, and Impact on DCD There is no impact on DCD. Impact on PRA There is no impact on PRA. Impact on Technical Specifications There is no impact on Technical Specifications. Impact on Technical/Topical/Environmental Reports Technical report APR1400-F-C-NR NP, Rev. 0, Functional Design Requirements for a COLSS for APR1400 will be revised, as indicated in the attachment associated with this response.

5 RAI Question Attachment (1/4) Functional Functional Design Requirements for a COLSS for APR1400 APR1400-F-C-NR NP, Rev.0 ACRONYMS AND ABBREVIATIONS ASI axial shape index AOO anticipated operational occurrence CEA control element assembly COLSS core operating limit supervisory system CPC core protection calculator CRT cathode ray tube DNB DNBR departure from nucleate boiling DNB Ratio Information Processing System DTL Detailed Report FDR functional design requirements LCO limiting conditions for operation LHR linear heat rate (kw/ft) PCS plant computer system PMS plant monitoring system POL power operating limit PPS plant protection system TST test report KEPCO & KHNP viii

6 RAI Question Attachment (2/4) Functional Functional Design Requirements for a COLSS for APR1400 APR1400-F-C-NR NP, Rev.0 1. INTRODUCTION 1.1. Purpose The purpose of this document is to provide a description of the functional design requirements of a Core Operating Limit Supervisory System (COLSS). When implemented with the appropriate data base and addressable constants the Functional Design Requirements described in this document meet the design bases for COLSS given in Section Scope Information Processing System () The COLSS is an application program implemented into the Plant Monitoring System (PMS) that aids the operator in maintaining plant operation within selected Limiting Conditions for Operation (LCOs). This document describes the functional design requirements for: 1. LCO monitoring and supporting algorithms to be implemented in the COLSS application software, 2. Data acquisition, COLSS program scheduling, and interface functions performed by the PMS executive software to assure proper COLSS operation, and 3. Process inputs and process outputs required for COLSS Monitoring. Figure 1-1 shows a functional block diagram of COLSS algorithms. Values of COLSS constants are not included in this document. These values will be contained in plant and/or cycle specific database documents Applicability This document is a generic description of COLSS Functional Design Requirements (FDR). It is currently applicable to Advanced Power Reactor 1400 (APR1400) Revision History This document is prepared based on Ref References KNF-S34ICD-05005, Functional Design Requirements for a Core Operating Limit Supervisory System for Shinkori Nuclear Power Plant Units 3&4, Rev. 1, KNF, May KEPCO & KHNP 1

7 RAI Question Attachment (3/4) Functional Functional Design Requirements for a COLSS for APR1400 APR1400-F-C-NR NP, Rev.0 3. SYSTEM REQUIREMENTS The system elements and structure required to perform the COLSS monitoring functions are described in this section. The process inputs, and processing of input signals required to drive the process models in the monitoring programs, are described in Section 3.l. The output signals, alarms and messages produced by the COLSS monitoring function are described in Section 3.2. The cathode ray tube (CRT) display reports, detailed print reports, and test execution reports are described in Section 3.3. The structure of COLSS algorithms, including the sequence and frequency of executions, and conditions which require skipping of an algorithm, is described in Section COLSS Data Acquisition Procedures The process input signals required by COLSS are listed in Table 3-1. The origin of these signals is shown in Figures 3-1 and 3-2. Table 3-1 includes the COLSS symbol, description, units, and scan rate of the COLSS process inputs. All COLSS procedures described in this document are performed in engineering units. All process inputs must be converted to engineering units prior to use by any of the procedures described herein. All process inputs except in-core detector signals and control element assembly (CEA) positions are examined to determine their validity for use in the COLSS monitoring procedures. The limits for this validity testing in COLSS may differ from those in the PMS input processing section. The remaining COLSS process inputs are validity checked in COLSS using the sensor validity procedure described in Section of this specification. The validity procedure selects specific process inputs for use as the process variable signals used by the monitoring procedures described in Section 4.0 of this specification. The conversion of in-core detector signal to engineering units and the compensation process itself are performed outside of COLSS in the Incore Processing section of the Plant Computer System (PCS). COLSS expects this processing to include detector background and detector sensitivity correction, compensation for rhodium detector dynamics and quality tagging. An algorithm for performing the dynamic compensation process is described in Section CEA validity checking and deviation determination is performed outside of COLSS in the Data Acquisition section. The process variables used by COLSS include the height of the lowest CEA in each group and the group deviation, which is the difference in height between the highest and lowest CEAs in each group. The process variables set by the sensor validity procedure are biased for channel offset or other minor errors. This biasing process is described in Section of this specification NSSS Instrumentation and Description of COLSS Inputs Figure 3-1 shows a diagram of the COLSS sensor locations indicating the major system components and relative locations of sensors that provide input signals to COLSS. Table 3-1 provides the COLSS input designations. The following list of variable names describes the COLSS inputs and associated notation. KEPCO & KHNP 7

8 RAI Question Attachment (4/4) Functional Functional Design Requirements for a COLSS for APR1400 APR1400-F-C-NR NP, Rev.0 TS The BUP(I,J) values are saved on a permanent file to facilitate updating the fuel burnups following a computer outage. This updating is performed in the PMS. Files of the most recent BUP and the nextmost-recent BUP, together with their associated Effective Full Power Hours (determined in the PMS by time integration of COLSS Plant Power), are used to linearly extrapolate to current burnup, given the operator-entered value of the current EFPH Constants a. Flux to power conversion C(I,K) - Rod position correction constants, I = , K = K1(I)-K3(I) - Flux to power conversion constants, I = NGROUP - Number of CEA regulating groups HLEVEL - Length of incore detector level b. Ten second power integration DT - Interval between ten second calculations in days c. Daily burnup factor calculation K4(I)-K8(I) - Burnup adjustment correlation constants, I = d. Block execution K09 - Number of good incore detectors required for block execution Calculation Sequence See Figure K-1. KEPCO & KHNP 105