TVA Sequoyah and Watts Bar Nuclear Plants

1. TVA Sequoyah and Watts Bar Nuclear Plants Feedwater Control System Upgrades – Lessons Learned Scott Gladney Digital Upgrade Program Manager 1/23/13

2. Key Project Goals • Replace obsolete Foxboro H-Line components • Continued K1 Relay issues • Limited Replacement Controllers/Modules • Reduce single point vulnerabilities (~40/unit) • Multiple unit trips due to K1/Local Remote select switch issues • Original design relied on single power feeds for critical components • Ease Operator Burden • Improve automatic control capability at low power • Automate feedwater valve transfer (SQN) • Auto Balance feedpumps during second pump start • Reduce operator actions during instrument malfunctions

3. Project History - Sequoyah • 2001 - Project to replace NSSS and BOP controls is started • 2002 – Original project cancelled due toengineering budget and schedule issues • Fall 2007 – Feedwater Controls portion of the Project is restarted • 09/08 – Unit 1 Factory Acceptance Test • 11/08 - Unit 1 Installation delayed from R16 to R17 due to Procedures • 02/09 – Unit 2 Factory Acceptance Test • 11/09 - U2R16 - Unit 2 Feedwater Controls Installation • 11/10 – U1R17 - Unit 1 Feedwater Controls Installation

4. Project History – Watts Bar • Fall 2007 – Feedwater Controls and Boric Acid Blend Controls Replacement Project is started in conjunction with Sequoyah • 07/09 – Unit 1 Project Cancelled • 03/10 – U1R10, original scheduled installation • 10/10 – Unit 1 Project resurrected, up-scoped due to WBN2 • 01/12 – All DCS but FW removed from U1R11 Outage • 04/12 – Unit 1 Factory Acceptance Test • 11/12 – U1R11 - Unit 1 Feedwater Controls Installation • 04/14 – U1R12 - Scheduled remainder of DCS install (Major BOP/NSSS Control)

5. System Enhancements • Replaced selector switch driven Feed/Steam Flow channel selection with software average and failure detection • Removed ~40 single point failure vulnerabilities per unit such as hand stations, power supplies, inputs, etc. • All new system power comes from diverse sources • Redundant output cards used for critical control functions • Channel segregation used to protect inputs on hardware failure • Automated operator critical functions such as valve transfer (Sequoyah) and placing second main feed pump in service • Enabled full automatic control from startup to full power (2% to 100% power at Sequoyah).

6. System Acceptance Testing • Factory Acceptance Testing • Medium Fidelity Simulated Model • Failure Mode Testing • Network Broadcast Storm • Power failure (including transmitter input and power supply) • Component Failures • Parameter updates (block reset) • EMI/RFI Testing • Performed in-house at a TVA lab • Used to validate results from Foxboro and 3rd parties • No changes required due to this testing • Development system • Used for Engineering Code testing • Used for OPS procedure development • Used for Maintenance procedure development • Software Review • Complete review of software settings • Function testing to ensure analyzed timing still valid

7. Simulator Testing • Additional Validation Testing performed on simulator • Used to validate system response • Controller tuning developed separately based on existing analog tuning settings and empirical models • Used to test failure modes and system response • Eagle Rack Failure/Lockup • Transmitter/Instrument Failures • Loss of Power Supply(s) • Design Enhancement due to lessons learned • Previously unknown plant design issue on loss of Vital Instrument Power Board locking a turbine runback in

8. Implementation Issues • Simulator • U2 installed first, U1 referenced simulator • Malfunctions had to be recreated, new ones developed • Training • Generic training vs. specific training • Generic Training for everyone vs. Maintenance Experts • Procedures • FW Controls affected hundreds of procedures across Maintenance, Engineering and Operations • Understaffing of procedure writers delayed implementation one cycle at Sequoyah • Significant changes to Operations Abnormal Operating procedures and General Operating Procedures • Materials • Large modification with lots of parts suppliers, track to ensure all parts are ordered and on-site • Bench calibrate items like transmitters, valve positioners, etc before the outage • Quantity of piece parts required due to retrofitting in old cabinets

9. Implementation Issues (cont.) • Challenges • Remaining rack analog hardware in-service during rack modifications • Re-use of existing racks at Sequoyah • Extensive Control Board Modifications • Poorly documented or labeled internal cabinet wiring in original plant cabinets

10. System Testing • Outage Testing • Loop tests integrated with normal outage activities • Hardware calibration verification done pre-installation • Testing performed parallel to installation • Startup Testing • Intentional Process upsets to validate tuning • Main Feed Pump Output Step Change • Feedwater Flow Step Change • Steam Generator Level Setpoint Step Change • Monitoring of normal startup transients

11. Post Implementation Issues • All Problems are because of the DCS • The new controls will be initially blamed for plant problems till proven otherwise • Different characteristic response isn’t necessarily bad • New or enhanced monitoring capability • Legacy issues will come to the surface as “new” problems • Valve Setup • Measurement problems • Feedpump/Heater oscillations • Establish Performance Requirements beforehand • Specific Issues • Sequoyah Unit 2 Thermal Power Oscillation • Initially blamed on DFW modification • Sequoyah Unit 1 Reactor Trip • Missed PMT of Steam Dump Controller (relocated old analog controller) • Watts Bar Unit 1 Down Power • I/P transducer issues on Main Feedwater Reg Valves

12. Lessons Learned • Dedicated Team • A dedicated team for the project needs to be selected early and turnover kept as low as possible throughout the project • Includes Maintenance, Ops, Engineering, and Training. • Simulator testing invaluable • Great for proof of concept, training, experimental tuning, etc • Do NOT tune the plant system to the simulator and expect it to be perfect • Utilize new racks if possible • Create a highly integrated schedule (Mods, Maintenance, Testing, Ops) • Material Verification • Place hands on parts well prior to outage • Establish holding area for project parts

13. Future Plans • Complete moving the NSSS/BOP Critical Control Functions into DCS • Pressurizer Pressure and Level • CVCS Volume Control • Boric Acid Blending • Steam Dumps and Atmospheric Reliefs • Automatic Rod Control module • Upgrade Main Feed Pump turbine controls • Main Feed Reg Valve positioner upgrade

14. Any Questions?