Summary

Foxboro I/A Series DCS

Invensys Operations
Management offers
for Feedwater Control Systems
premiere feedwater
THE COMPETITIVE ADVANTAGE
control systems Invensys Operations Management offers premiere feedwater control systems using
in Nuclear Power the Foxboro I/A Series Distributed Control System (DCS). Recent implementations
Generation using the have offered operation philosophy enhancements, improved startup and runtime
Foxboro I/A Series DCS. performance and significant reduction of unplanned unit trip outages.

These advanced control techniques allow for less operator required interaction, more
time of automatic control - including during start-up and shut-down when most unit
Business Value trips are caused - making the entire control system more capable of handling process
upset conditions along with normal operation.
Recent implementations
have offered BEFORE I/A SERIES AT THE
operation philosophy OMAHA PUBLIC POWER DISTRICT
enhancements, improved Before the I/A Series DCS was installed on the feedwater controls at the Omaha
startup and runtime Public Power District at Fort Calhoun Station, there were many operational
performance and
challenges. The controls were poorly tuned. Level perturbations were not uncommon
during changes in power, with poor low level control.
significant reduction
of unplanned unit trip John Steinke, Senior Nuclear Design Engineer at the facility states that Having split-
outages. range 3-Element control on the bypass feed water valve as well as the main valve
allowed for automated controls to handle the switchover from the bypass to the
main valve. This reduced operator direct manual interaction, and thereby reduced
operator challenges. We also rotate our Steam Generator Feedwater Pumps. The
split range 3-element controls greatly reduce the perturbations associated with
rotating those pumps. More precise tuning and control have maximized our units
capability factor (ability to produce electricity) while removing undue burden from
the Licensed Operators who are operating the system. To date, we have not tripped
based on the DCS or garnered extra down time.

There was a plant transient soon after the controls were installed in which the
Hotwell Makeup Valve failed to open. The operators, by that time, overcame their
instinct to place the feedwater system in manual, and instead let the controls take
action. The feedwater DCS response was called outstanding. It would have been
a much more stressful event for operations using the pre-DCS controls. There have
been multiple similar incidents after which Operations commented that the unit
would have tripped if the steam generator level control was not on the DCS.
Mr. Steinke also stated how the use of the DCS provided much more system and process information.
They are able to use this type of data to ascertain process characteristics (valve and pump non-
linearities). The system then had the tools to compensate for these characteristics and provide a better
response to control actions.

AFTER I/A SERIES AT TENNESSEE VALLEY AUTHORITY

Scott Gladney, an Electric Engineer at the Tennessee Valley Authoritys Sequoyah facility, attributes
smoother operations and the reduction of single points-of-failure to installation of the DCS and
feedwater controls.

Mr. Gladney states that We were able to eliminate over 40 single points-of-failure per unit using the
DCS feedwater controls. It also simplified the startup of our second feedwater pump. When starting
the second pump, speed balancing used to be an operator-intensive manual procedure. The I/A Series
block features allow for the controls to completely balance the pumps in automatic. Our swap over
from startup valve to main valve was greatly simplified. It used to be an operator manual swap that
took about an hour to perform. It is now an automatic event that occurs on they fly with no specific
interaction required. I have seen a valve transfer occur as they were tying a turbine online (and in single
element) with no significant level perturbations in the steam generators.

Mr. Gladney also stated how the controls were improved to have one set of tuning parameters, and
one set of inputs. If you have narrow range level, steam flow, and feedwater flow, thats all you need
to run single element or three element at any power level.

FEEDWATER CONTROL SYSTEM ENHANCEMENTS

The following are brief descriptions of some of the control enhancements delivered for various
feedwater control systems throughout the nuclear industry by the nuclear control system engineering
team of Invensys Operations Management.

Enhancement #1 Redundant Sensor Algorithms

Redundant Sensor Algorithms (RSAs) are utilized to eliminate single point of failure vulnerabilities
within the control application and improve reliability and robustness of the system and its ability to
automatically control the plant over its full power range for the entire fuel cycle. These allow the
system to suffer a partial or complete loss of one of the redundant input signals with minimal or no
upset to plant operation or loss of vital plant process information. The redundancy starts at the process
measurement transmitters. Multiple, mutually exclusive field devices are used to measure the same
plant process variable. These measurements are brought into the control system on separate I/O
devices (FBMs), further increasing the reliability of these signals. Care is taken to also ensure that the
transmitters are on separate process connections, otherwise they are still vulnerable to a single failure,
such as plugged piping or failure of the sensing line piping itself.

For all cases, when there is No Valid Input.

Control action is blocked

Failsafe action is imposed
Controls are transferred to MANUAL where applicable, holding the plant at a known state.

Additionally, each process measured parameter is evaluated for its specific, proper action to be taken
when No Valid Input exists.

Redundant Sensor Algorithms have been used for feedwater controls for measurements such as Steam
Generator Level, Steam Generator Feedwater Flow, Steam Generator Steam Flow, Feedwater Pressure
and Steam Pressure.
Enhancement #1.1
Dual Transmitter Input Algorithm
Two independent measurements of the same process
variable are monitored from separate field devices. When
both transmitters are functioning properly, the Average of
the two is used as the resultant controlling signal.

Upon excessive deviation between the two measurements,

or the failure of either one, control actions are prevented
(blocked), and an operator alarm generated. In the event
of a deviation, the operator may then select one of the
two based on other plant corroborating data as the more
correct signal by bypassing the offender. Automatic control
can resume and maintenance can be performed on the bypassed signal without loss of runtime.

Dual Transmitter Algorithms have been used for feedwater controls such as Feedwater Pump
recirculation flows.

Enhancement #1.2 Dual Transmitter

Input Algorithm with Arbiter (Voter)
Two independent measurements of the
same process variable are monitored
from separate field devices. When both
transmitters are functioning properly,
the Average of the two is used as the
resultant controlling signal.

Upon excessive deviation between

the two measurements, or the failure
of either one, the control system
automatically selects the signal that is
closer to the arbiter, and an operator
alarm is generated. Automatic control
continues, uninterrupted. Maintenance
can be performed on the offending
signal without loss of runtime.

Dual Transmitter Algorithms have been used for feedwater controls such as Steam Generator
Feedwater Flow and Steam Generator Steam Flow.

Enhancemen #1.3
Triple Transmitter Input Algorithm
Three independent measurements of the same process
variable are monitored from separate field devices. When
all are functioning properly, the Median of the three is used
as the resultant controlling signal. Upon the failure of one
signal, the control system automatically continues to select the
Median value and automatic control continues, uninterrupted.
Maintenance can be performed on the offending signal without
loss of runtime. If one signal deviates significantly without
failure, it is excluded from control by the Median selector.
Variations of the triple input algorithm include:

Using the Average of the three inputs When all are functioning properly, the Average of the three is
used as the resultant controlling signal. Upon the failure of one signal, the control system automatically
reverts to the Average of the remaining two inputs and automatic control continues, uninterrupted.
Maintenance can be performed on the offending signal without loss of runtime.

Using the Median of the three inputs When all are functioning properly, the Median of the three is
used as the resultant controlling signal. Upon the failure of one signal, the control system automatically
reverts to the Average of the remaining two inputs and automatic control continues, uninterrupted.
Maintenance can be performed on the offending signal without loss of runtime.

Triple Transmitter Algorithms have been used for feedwater controls such as Steam Generator Main Steam
Pressure, Steam Generator Feedwater Header Pressure and Steam Generator Level.

Enhancement #2 Redundant Valve Outputs

Redundant Valve Outputs are utilized to eliminate
single point of failure vulnerabilities within
the control application and improve reliability
and robustness of the system and its ability to
automatically control the plant over its full power
range for the entire fuel cycle. The I/A Series
Fieldbus Modules include the FBM218, which is
capable of providing redundant, channel isolated
outputs to field devices. If a failure is detected in
one of the Fieldbus Modules, its output is driven
to 0 mA and the corresponding channel in the
tracking module automatically continues supplying
the proper current to the output current loop.

Redundant Valve Outputs have been used for feedwater controls such as the Start-Up Bypass Feedwater
Valve and the Main Feedwater Valve controls.

Enhancement #3 Fully Integrated Single Element/Three Element Control Philosophy

Traditionally, the feedwater control system operated in Single Element control at low power using only the Start-
up Bypass valve to maintain Steam Generator Level. Above ~25% power, a Three Element system was employed
using only the Main Feedwater Regulating (MFWR) valve. Steam generator level is more robustly controlled
using the three elements of steam flow, feedwater flow, and steam generator level. As reactor power increased
from 20% to 25%, operators would perform a manual transfer from the Single Element Start-up Bypass valve to
the Three Element MFWR valve. Similarly, as reactor power would decrease from 25 to 20%, operators manually
transferred from the Three Element MFWR valve back to the Single Element Start-up Bypass valve. These manual
transitions require intense operator involvement, and have been the cause of many unplanned unit trips.

The enhanced design utilizes split ranging of the Start-up Bypass valve and the MFWR valve such that they
sequence as if there is only one full range valve. Advanced control techniques are utilized to enable the control
system to control the transfer from Single Element to Three Element control during the times when reactor
power is increasing, and from Three Element to Single Element control during times when reactor power is
decreasing. This allows the control system to be in Three Element control while still on the Start-up Bypass valve,
improving the dynamic response of the control at a much lower power level than was attainable with the prior
design. The system closes the Start-up Bypass valve when appropriate and automatically transfers control from
the Start-up Bypass valve to the MFWR valve without any operator intervention. For power shutdown, the system
automatically transfers control from the MFWR valve back onto the Start-up Bypass valve. Both of these transfers
occur without operator intervention. The automated transfers alleviate the operator from the time consuming
and manually intensive transfers required in the older methodology.
The Three Element controller automatically reverts to Single Element control upon the loss of all Steam
Flow or all Feedwater Flow signals, allowing Steam Generator level to be maintained under automatic
control while maintenance can be performed on the offending flow signals.

If all Steam Generator Level signals are lost, the Three Element/Single Element control system will
transfer to MANUAL,
mitigating the degree
of level perturbations.

The following is a brief

description other solutions
provided for the nuclear
industry outside of the
feedwater control realm.

Enhancement #4 Control
Element Assembly Position
Indication Logic
Control Element Assembly
(CEA) Position Indication
is used to support reactor
engineering and rod position
operational functions. CEA has
five functions. They are:

Switch position monitoring

CEA position monitoring
and indication
Limit checking and alarming
Sequence checking and
alarming
Power Dependent Insertion
Limit calculations and
alarming.

Enhancement #5 Incore Flux Monitoring

Incore Flux Monitoring function senses millivolt analog signals derived from Rhodium Incore and
Background flux detectors. The detectors produce a microampere signal that is converted to
the sensed millivolt signal across a precision shunt resistor. The signal values are recorded and
instantaneous signals are made available for view. The alarm limit checking of the detector signals
provides the plant operational function of Linear Heat Rate Monitoring. The application also
includes automatic depletion calculation and correction to the flux signals based on a selectable 12 or
24-hour correction cycle. Information generated from the Incore Flux Monitoring function is used to
support reactor engineering functions.

Enhancement #6 Calorimetric Monitoring

Calorimetric Monitoring senses process driven analog and discrete signals. Calculations are performed and
information presented to the operations, engineering, and maintenance staffs. The information presentation
is through small flat panel display devices showing spatially dedicated information, operator and engineer-
ing workstation displays, printed reports, and on-demand historical trends. Both raw Unit information as well
as calculation and redundant sensor algorithm results are available for real-time and historical presentation.
The calorimetric calculation provides the % Power basis for plant operation to ensure plant operation is
within the licensed limits.
 For analog inputs not including redundant sensors, additional FBMs can be included to provide
continuous monitoring of the same signal through the additional module. This design provides for
continuity of operation for selected critical signals in the face of a signal channel failure or during the
replacement of a failed module. In the unlikely event that a channel Analog to Digital converter fails and
emits a constant output, a deviation alarm can be generated when the two channels diverge.

Enhancement #7 Sequence of Events Recording

Sequence of Events Recording (SOER) senses change of state of designated field contacts and records
that time. Information generated from the SOER function is used to support the engineering functions of
post-trip review and transient analysis.

The current time is determined from the master timekeeper station that can be synchronized to GPS
satellite signals. The master timekeeper synchronizes stations within the I/A Series system using Network
Time Protocol (NTP). All control processors are thus synchronized in time, although their operation is
asynchronous. The control processor hosting the SOER function synchronizes its contact input FBMs with
a 1 msec resolution.

Enhancement #8 Atmospheric Steam Dump Control

The atmospheric steam dump control system provides for automatic operation of the steam dump
valves following large turbine load reductions and reactor trips. A validated pressure value is obtained
using the desired Redundant Signal algorithm such as the three input median selector. The validated
Pressure for each Steam Generator is compared to the setpoint for that Steam Generators Relief Valve
controller and a signal is sent to the valve. The outputs to these signals can also be redundant to provide
an additional measure of reliability.

Enhancement #9 Steam Bypass to Condenser Control

The Steam Bypass Valves are used for the warming and initial loading of the main turbine. During normal
plant operation, these valves are closed. In the event of a turbine trip, the Steam Bypass to Condenser
Controls bypass steam around the turbine to the condenser, maintaining steam pressure at a stable
value as the reactor is powered down and controls the rate of change of TAVG.

CONCLUSION
Invensys Operations Management is a world leader in feedwater control system implementation using
both the Foxboro I/A Series DCS and the Triconex Tricon TMR PLC for safety-related applications.
Using our unique technologies, Invensys has helped to improve startup times and runtime performance
while reducing unplanned unit trip outages. And while operators are more informed, less interaction is
required because the control system manages normal operations and transient or abnormal incidents.
With recent enhancements, Invensys Operations Management offers the proven best feedwater control
systems for Nuclear power generation.

Invensys Operations Management 5601 Granite Parkway III, #1000, Plano, TX 75024 Tel: (469) 365-6400 Fax: (469) 365-6401 iom.invensys.com

Invensys, the Invensys logo, ArchestrA, Avantis, Eurotherm, Foxboro, IMServ, InFusion, SimSci-Esscor, Skelta, Triconex, and Wonderware are trademarks of Invensys plc, its subsidiaries or affiliates.
All other brands and product names may be the trademarks or service marks of their representative owners.

2011 Invensys Systems, Inc. All rights reserved. No part of the material protected by this copyright may be reproduced or utilized in any form or by any means, electronic or mechanical, including
photocopying, recording, broadcasting, or by any information storage and retrieval system, without permission in writing from Invensys Systems, Inc.

Rel. 04/11 PN I-NC-0109