"... To design the control system that effectively matches the plant requires an understanding of the plant rivaling that of the plant's designers, operators, and manager. It is not surprising, then, that a control engineer may know more about the plant than perhaps any other individual associated with it.“ F. Greg Shinskey, "Energy Conservation Through Control" Academic Press, Inc DIGITAL FEEDWATER CONTROL PROJECTS FOR TENNESSEE VALLEY AUTHORITY

Major Topics Operational and Maintenance Challenges in Existing Nuclear Plants Cost vs. Benefits of Digital Systems Digital Feedwater Controls Implemented with TVA Post Upgrade Challenges 3

Operations Challenges Improving Reliability and Assurance of Continued Operations Reducing Single Points of Vulnerability (SPV) Replace Aging or Poorly Performing Equipment Reduction of Unplanned Downtime/Outages Reduction of Manual Operator Interaction Operations Acceptance 4

Maintenance Challenges Reduction of Equipment Cost Reduction of Equipment Maintenance Time Reduction of Surveillance Testing Replacement of Obsolete Analog and Digital Controls 5

6 Cost vs. Benefit Cost –Assumed Scope and Cost of the Upgrade –Spares –Re-Training Benefit Benefit –Staffing Impact –Spare Parts Cost –Testing Requirements –Consolidate Training –Risk Reduction –Additional Diagnostic Capabilities –Operational Flexibility –Plant Performance

Plant Performance Digital systems and Advanced Controls can provide tighter, more efficient control Improved Cycle Efficiency Reduced Fuel Expense for Same Generation Increased Operating Margin Reduced Instrument Uncertainties 7

Advanced Digital Controls for Feedwater Systems at TVA Single Points of Vulnerability Elimination Fault Tolerant Control Processing Redundant Control Networks Redundant Inputs and Outputs Redundant Sensor Algorithms Integrated 1E/3E Advanced Controls Philosophy 8

Redundant Sensor Algorithms Allow the system to suffer a partial or complete loss of one of the redundant input signals with minimal upset to plant operations Signals monitoring the same process variable are brought into digital controller on separate I/O devices (segregation of measurements) Signals are monitored for health and deviation tolerance from other values A faulted/suspect signal is bypassed, allowing for maintenance of the offending device, while operations continue If no valid signal is detected, control action is blocked, fail safes imposed, and controls transferred to manual 9

PWR – Redundant Signals Slide 10 FT LTLT LTLT LTLT

Dual Transmitter Input Algorithm 11 Upside Upon Failure of Signal, the bad signal can be bypassed and control may continue using healthy signal Optionally may block control actions Can optionally choose average, high or low select. Conditional Alarming Downside Deviation between signals requires operator interaction to select best signal

Dual Transmitter Input Algorithm with Arbiter (Voter) 12 Upside Same as Basic Dual Input Algorithm Uses Arbiter Signal as “tracking” value to automatically select healthy signal when one deviates Downside Limited applications, Arbiter signal not often available TVA Implementations Steam Flow Feedwater Flow

Triple Transmitter Input Algorithm 13 Upside Upon Failure of Signal, the bad signal can be bypassed and control may continue using healthy signal Optionally may block control actions if two or more signals fail Can optionally choose average, high or low select. Deviation of one signal is measured against the other two to automatically select healthy signal if one begins to deviate TVA Implementations Main Steam Pressure Feedwater Pressure Steam Generator Level

Segregation of Redundant Signals Slide 14

Control Scheme Operations Engineering/ Maintenance Fault-tolerant Network Digital Control System Overview Measure and Control

Original Bench Handstations Slide 16

New Bench Handstation Fully interactive with digitally resident, more robust control strategies Fully functional in absence of Workstation or Dual Network. Slide 17

New Feedwater Process Graphic Mimics Bench functionality Seamless Parallel Controls Reduces training by providing equivalent control with display integration Slide 18

Control & Measure Operations Engineering/ Maintenance Fault-tolerant Network Digital Control System Overview (with new Handstation) New Handstation Allows for continued operation in presence of multiple control system failures

Traditional Single Element / Three Element Control for Steam Generator Level Single element control (SG Level) at low power using only Start-Up Bypass valve to maintain level. Above ~25% power, three element control engaged using Steam Flow, Feedwater Flow, and Main Feedwater Regulatory Valve Operator intensive manual procedure to transfer from single element bypass valve to three element main valve as reactor moved up through 20-25% power Similar operator intensive manual procedure for reactor power decrease Many unplanned trips with manual procedures 20

Enhanced Single Element / Three Element Control for Steam Generator Level Startup Bypass FW Valve and Main FW Valve are split ranged such that they automatically sequence as if there is one full range valve. Three element control transfer can be enabled at a much lower level, improving dynamic performance Advanced controls automatically sequence single element to three element over this split range valve. No operator manual action is required, controls transfer over at a consistent reactor power, both increasing and decreasing Automatic transfer to single element upon loss of all Steam Flow or all Feedwater flow signals, allowing for SG level to be maintained while maintenance can be performed on the offending signals If Steam Generator Level signals are lost, the controls of the valves revert to manual 21

Enhanced Single Element / Three Element Control 22

Post Upgrade Operations Challenges Training New Failure Modes New Interaction 23

Maintenance Challenges New/Changing Calibration requirements, techniques Documentation 24

TVA Improvements: ~30 SPV removed per Unit Automated transfer from startup valves to main valves with improved effect on Steam Gen Level Failure of BOTH Steam Flows at 100% power, controls remained in AUTO (1E) Additional Data available on plant computer as a result of upgrade aided troubleshooting in multiple events Automated FW Pump balancing on startup of second pump Extensive simulator work allowed for minimal tuning during startup Summary