ML17271A200

NEI 96-07, Appendix D with Hsi Edits from Sep 19-21, 2017 Meeting

ML17271A200
Person / Time
Site:	Nuclear Energy Institute
Issue date:	05/16/2017
From:	Nuclear Energy Institute
To:	Division of Policy and Rulemaking
References
DPR Log 2990, NEI 96-07
Download: ML17271A200 (13)

Text

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 i Example 4-4. Digital Modification that Satisfies Dependability,

. causing NO ADVERSE IMPACT on a UFSAR:.described Design Function An analog recorder is to be replaced with a new microprocessor-based recorder. The recorder is used for various purposes including Post Accident

Monitoring, which is a UFSAR-described design function.

' Dependability Assessment: An engineering evaluation performed as part of

, the technical ass~~sment supporting the digital modification concluded that

. the new recorder will be highly dependable (based on a quality development

, process, testability, and successful operating history) and therefore, the risk of failure of the recorder due to software is considered very low.

The change will have NO ADVERSE IMPACT on any design function due to

• the dependability assessment.

451 ,... -.. **. ---*.-*** . ----~ . - -**- , ---*- **--- -- ------------- *1 452 4.2.1.2 ~~_ree._ni11g o(_(jh!lng(l_s to P,r()ce_dl;lr~s as p_escr!J?.~d i_n_ the {JF'~..:\Ri - Comment [A42]:.Comments on-HSI Screening Guidance were previm.~sly' provided in:

453 SCOPE (1) ML17068A092 Comment Nos. 18-26 (2) ML17170A089 Comment Nos. A17-A27 454 If the digital modification does not include or affect a Human-Svstem 455 Interface (e.g .. the replacement of a stand-alone analog relav with a digital 456 relav that has no features involving personnel interaction and does not feed 457 signals into any other analog or digital device). then this section does not 458 *apply and may be excluded from the Screen assessment.

459 In NEI 96-07. Section 3.11 defines procedures as follows:

460 "... Procedures include UFSAR descriptions of how actions related to 461 system operation are to be performed and controls over the performance 462 of design functions. This includes UFSAR descriptions of operator 463 action sequencing or response times. certain descriptions ... of SSC 464 operation and operating modes. operational... controls. and similar 465 information."

466 Although UFSARs do not typically describe the details of a specific Human-467 System Interface. UFSARs will describe anv design functions associated with 468 the HSI.

469 Because the human-svstem interface (HSI) involves svstem/component 470 operation, this portion of a digital modification is assessed in this Screen 4 71 consideration. The focus of the Screen assessment is on potential adverse 4 72. effects due to modifications of the interface between the human user and the 4 73 technical device.

D-22

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 474 rr-**here

-**** are

-- -.3 ."bas1c HSI**-* elements"

• • ----.~-- -*-- -* - -------- --- --* ---------*---.

(

Reference:

NUREG-0700):

475

• 476 to monitor and control the pl'antJ 477 * 'controls: the devices through whi~h:-j)e1*$c;-;;_;;-6i_ ill"t;1:act with.-th.e-H:sf 478 'and the plant.!

479

• luser-interfaC"e- interil~tioil~ii""cf;;;a~aii~ei;f:th.e niean~liv ;h:ich 480 personnel provide inputs to an interface, receive information from itJ 481 'and manage the tasks associated with access and control of 482 information:! __________ ~ ___________________________________ ~ * - Comment [DA4l]: Ciarlfication: Thnk of , '

"these elements as a way to' define the entirety,

• 483 Operators must be able to accurately perceive, comprehend and respond to "of what comprises and.HSI. Some modifications may not fall neatly into one 484 svstem information via the HSI to successfullv complete their tasks. category, but if it falls Within any or all of 485 Specifically, nuclear power plant personnel perform "four generic primarv .these categories, it is HSI related.

486 tasks" (

Reference:

~NUREG/CR 6947):

• 487 (1) monitoring and detection (extracting information from the 488 environment and recognizing when something changes),

489 (2) situation assessment (evaluation of conditions).

490 (3) response planning (deciding upon actions* to resolve the situation) and 491 (4) response implementation (performing an action).

492 To determine potential adverse impacts of HSI modifications on design 493 functions, a two-step analysis must be performed. Step one is assessing if 494 and in what way hew the modification impacts (i.e., positively, negatively or 495 no impact) the operators' abilities to perform each of the four primary types of 496 tasks described above. If the:re a:re negatwe impacts; stepStep two of the 497 analvsis consists of determining if and how the impacts, identified in step 498 one, affects the pertinent UFSAR-described design functi6n(s) (i.e., adversely 499 or not adversely). E1ramples of Examples of nH:egative impacts on operator 500 performance of tasks that may result in adverse effects on a design function 501 include but are not limited to:

502

• increased possibilitv of mis-opei:ation, 503

• increased difficulty in evaluating conditions.

504

• increased difficulty in performing an action.

505

• increased time to respond, 506

• creation of new potential failure modes.

• 507 508 Table 1 contains examples of modifications to HSI elements that showd be 509 addl'essed in the :response to this Se:reen eonside:ration.

510 511 [INSERT TABLE 1 FROM HSI COMMENTS FILE HERE.]

512 513 In NEI 96 07, Section a.11 defines pmeed1bres as follows:

514 D-23

NEI 96-07, Appendix D Nlj:I Proposed Modifications: May 16, 2017 515 ".. .Proced"tbres incl"tbde UFSAR descriptions of how actions related*

516 to S)'stem operation are to /:Je perfonned and controls over the 517 perforRianee &f design functions. This includes UFSAR 518 deseriptimis &f operator action seq"thenein,g or response 'times, 519 certain descriptions ... &f SSC operation and operating modes, r*

520 operational ... controls, and similar i1ifonnation."

521

• Because the loluman System lnterfaee involves S'{Stem/com13onent 013eration, 013erator 522 actions, res13onse times, etc., this 13ortion of a eligital moelification is assesseel in tl'lis Screen 523 consieleration.

524 If the digital modifieation does not inelude m* affeet a Human System 525 Inte1-faee (e.g., the replaeement of a stand alone analog relay with a digital 526 i*elay that has no featm*es involying personnel interaetion and does not feed 527 signals into any oth01* analog or digital de'.'ice), then this seetion does not 528 apply and may be mrebded from the Sereen assessment.

529 The foeus of the Sereen assessment is on potential adve1*se effects due to 530 modifications of the in.tm'faee between the human us01* and the technical 531 device [e.g., equipment manipulations, actions taken, options ar;ailable, 532 decision making, manipulation sequenees 01* operato1* i*esponse times 533 (including the impact of e1*ro1*s of a eognitive nature iH which the information 534 being provided is unelear m* iHeon*eet)], nfil the V.'ritteE: p:rneedUl'e 535 modificatioHs that may accompaHy a physical design modificatioE: (which m*e 536 add1*essed iH the guidanee provided in NEI 96 07, Seetion 4.2.1.2).

537 PHYSICAL INTERFACE WITH THE HUl\1fAN SYSTEM I:NTERF.t',CE 538 In the determination of potential adverse impaets, the following aspeets 539 should be addressed in the 1*esponse to this Sernen eonsideration:

540 (a) Physical Intometion with the Human System Intm*faee (HSI) 541 (b) Numbm*/Type of Parametel'S 542 (e) Information P1*esentation 543 (d) Op01*ato1* Response Time 544 Physical Interaction with the HHman System Interface 545 l', typical physical iHternctioE: modificatioH might involve the. use of a touch 546 sci:*een in place of push buttons, switches m* knobs, including sensm*y based 547 aspects sueh as auditory or taetile feodbaek.

• D-24

NEI 96-07 .. Appendi:x D NEI Proposed Modifications: May 16, 2017

. . . h "e

• andue adverse

~fAt~ed{;scribed fu~e:o:~d~essed 548 . ggr aspeets of a1g d. ital. mod1fieat10n_a otential impacts to the 549 To determine design in the Sc1*een ..

550 impact phys1ea on UF "'.

. l interaet1on n 1 "'th the IISI shouL e 551 Consideration of a digital modifieation's impaet due to the physieal 552 interaetion with the IISI involves an mmmination of the aetual physieal 553 interface and how it could impact the perfo1*mance and/01* satisfoetion of

. 554 UFSAR deseribed design funetions. Fm* mrample, if a new malfunetion is 555 m*eated as a result of the physieal interaetion, then the IISI portion of the 556 digital modification would be adverse. Such a IlO'N malfunction may be 557 crnated by the interfaee requiring the human user to choose whieh of multiple 558 eomponents is to be contrnlled, e1*eating the possibility of selecting the \Vrong 559 component (which could not occlil' with an analog system that did not need 560 the human use1* to "make a selection").

561 Charactm*istics of IISI changes that could lead to potential adverne effects '*

562 may include, but are not limited to:

563

• Changes from manual to automatic initiation (01* vice versa) of 564 functions, 565 h as replacm .GRTg aninedgewise ..

. . . . p roeess data aeqms1tioi_i . i* a(sue multipurpose w h'ich 566

• Changes ill the *::a numm*ic analog.mete1* wit a .. es operator intmac id1spla': o . t"on to display),

567 access "Af>IO&'ttto:rrothe data i*eqmr 568 t' . 1 faillll'e modes . hips ill the

. 01 interaction

. of 569 es that creat e n W" " poten/ ia m intel'l'elatwns * . nem

" Chang . m4h the system (e.g., n?" di . plant respoase, o1 "

~pe~*a 570 opm*atm:s .d t 1. actwas an 01 . )

"tm*dependencies of o lant status info1*mation.,

571 ways the op01*at01* ass1m1lates p ill 572

• Inm*eased possibilitY. 0 f llllS function, . operatwn . rnlated to pe1~rmillg

• f . a design 573 574

• Increased difficulty for an operat01* to perform a design fuactioa, 01*

575

• Increased complexity m* duration in diagnosing 01* i*esponding to an 576 accident [e.g., Tiffie Cl'itical Operation 1\ctions (TCO,ALs) identified in 577 the UFSlLR].

If theitmn

~:onable ~o 578 then may .chbe angesre do note k*h"b' JAt eharacte1*istics such .

579 controlling" a d e?nclude that the "moth :s ;hose hst?d abO\'O, 580 OSl.,n functwn lS not ad"ers 1

• e~ a ~eted. f£ o o performillg 01*

58~

• Examples 4-5 through 4 7 illustrnte the application of the Physical 582 Interactimi aspect illustrates how to apply the assessment tn*ocess to ONLY 583 the "controls" element of an RSI.is process to an rnHSI modification i Example, ;J.:q~ Pkysieal {nteriuit~enA~sessment: 6(*if~aificati0n with.

• D-25

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 i NO ADVERSE IMPACT on a UFSAR-Described Design Function

' Description of the Proposed .Aetivity Iavslviag the Csatrsl i ElemeatModification:

Currently, a knob is rotated clock-wise to mm*ease a esntrsl functisn open a i flow control valve in 1% increments and counter clock-wise _to dem*ease ~he -

[ esnti:*sl funetisnclose a flow control valve in 1% increments. This knob will be

replaced with a touch screen that has two separate arrows, each in its own

function block

_ Using the tou~h screen, touching the "up" arrow will increase i the eontrsl functisn open the flow control valve in 1% increments and

touching the "down" arrow will dec:l:'Oase the central functisnclose the flow i control valve in 1% increments.

I .

' Identification and Assessment of the Four Generic Primary Tasks Potentially

,.-  : Impactedinvslved:

! (1) monitoring and detection (extracting information from the environment

and recognizing when something changes) - NOT INVOLVED

(2) situation assessment (evaluation of conditions) - NOT INVOLVED i response planning (deciding upon-actions to resolve the situation) - NOT (3)

, INVOLVED

(4)ocesponse implementation (performing an action) - ~{NVOLVEDl __ ,__ ~ Comment [DA44]

Response" j , , , ~ ' .,, ,

implementation is the only task that would lie

' pertinent here as it changes the

• Desiga FHaetisa Ideatifieatisn

The UFSAR deseribed desigH: fuactisn states the Bf!eratsr caF.i "merease G:I'l:d

deerease the control functisns Hsing manHal esatrsls lseated in the Main

! Cantrel Reem.'.' ThHs, this UFS1A..R deseriritio:R imrilicitly ideatifies the SSC i (i.e., the ~ob) and the desigH:-function of the SSC (i.e., its ability to allow the

orierator to manHally adjast the eoat*l'Ol funetioa).

! Identifieation aad Assessment of Modification Impacts on the Four Generic Primary Tasks INVOLVED:

i

, As part of the technical evaluation supporting the proposed ,

aetivitymodification,*a Human Factors Evalµation (HFE) was performed.

Tasks L2 and 3 are not involved therefore they do not have negative impacts. Task 4 is involved, but the HFE determined that the change from knob to touch screen was not going to have a negative impact on the operator because--;;-;there was no change to the ability of the operator to perform the response implementation*task-. The HFE eonelHded that no new failares OF malfonetions have beea iatFsdHeed as a Fesl:ilt of the refllaeemeat fpo~- a knob to a toHeh sei*een.

D-26

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017

!Possibility of mis opeFation NO IMPACT difficulty in w;aluating conditions 1'Yfi diffieulty in peFfoFming an aetion NO IMPfiCT time to respond N/.,.'\

new potential foiluFe modes NO IMPAC] _______________ _ - Comment [DA45]: These are only some of the possible negative impacts , thus, listing Identification of the Relevant Design Function(s): them here makes it appear that these are the ONLY outcomes that should be considered, Again, we do not want to get in a situation The UFSAR design function states the operator can "incl'ease and decrease where we are tiying to list all the possibilities.

the control functions open and close the flow control valve using manual controls located in the Main Control Room." Thus, this UFSAR description implicitly identifies the SSC (i.e .. the knob) and the design function of the SSC (i.e., its ability to allow the operator to manually adjust the ~

functionposition of the flow control valve).

Assessment of Impact(s) on Design Function Impaet(s)

Using the results from the HFE and examining enly-the physieal internetion aspeet "contrnls" element of an HSI (e.g., ignoring the impaet on operator response time 01* the numbeF and!oF sequence of steps necessary to aceess the new digital eontrolsthe other thi*ee HSI elements), the replacement of the "knob" with a "touch screen" is not adverse since it does not impact the ability of the operator to "incl'Oase a~unctions open and close the flow control valve using manual controls located in the Main Control Room," maintaining satisfaction of the UFSAR-described design function.

584 Using the same proposed activity provided in Example 4-5, Example 4-6 585 illustrates how a variation in the UFSAR description would cause an adverse 586 impact.

Example 4-6. Physical Interaction with an ADVERSE IMPACT on a UFSAR-Described Design Function The UFSAR states not only that the operator can "increase and decrease the control functions using manual controls located in the Main Control Room,"

but also that "the control mechanism provides tactile feedback to the operator as the mechanism is rotated through each setting increment."

Since a touch screen cannot provide (or duplicate) the "tactile feedback" of a mechanical device, replacing the "knob" with a "touch screen" is adverse because it adversely impacts the ability of the operator to obtain tactile feedback from the device.

D-27

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 587 Using the same proposed activity provided in Example 4-5 and the same 588 UFSAR descriptions from Example 4-6, Example 4-7 illustrates how a 589 variation in the proposed activity would also cause an adverse impact.

Example 4-7. Physical Interaction with an ADVERSE IMPACT on a UFSAR-Described Design Function In addition to the touch screen control "arrows" themselves, a sound feature and associated components will be added to the digital design that will emit a clearly audible and distinct "tone" each time 'the control setting passes through the same setting increment that the tactile feature provided with the mechanical device.

Although the operator will now receive auditory "feedback" during the operation of the digital device, the means by which this feedback is provided

• has been altered. Since the means of controlling the design function has changed, new malfunctions can be postulated (e.g., high ambient sound levels that prevent the operator from hearing the feedback). Therefore, the modification of the feedback feature (i.e., from tactile to auditory) has an adverse impact on the ability of the design function to be performed.

590 591 Number and/oF Type of PaFametei*s Displayed By and/oF 1\vailable 592 FFom the Human System InteFfaec 593 One advantage of a digital system is the amount of information that can be 594 monitored, stored and p1*esented to the aser. Hov,rever, the possibility C](ists 595 that the amount of such information may lead to an efJer aln-mdancc that is 596 not neeessa1*ily beneficial in all eases.

597 To detm*mine if the HSI aspects of a digital modification have an adverne 598 effect on UFSli:R described design functions, potential impacts due to the 599 number and/01* type of parameters displayed by and/or available from the 600 HSI shoald be add1*essed in the Semen.

601 Considei:*ation of a digital modification's impact dae to the number and/m*

602 type of parameters displayed by and/el' available from the HSI involves an 603 mmmination of the actual numbm* and/or type of parametern displayed by 604 and/ol' available from the HSI and how they coald impact the perfm*mance 605 and/or satisfaction of UFSAR dese1*ibed design functions. Potential causes fo1*

606 an adverne impact on a UFSAR described design function could include a 607 l'ed~~etion in the number of pawmetern monitored (whieh coald make the 608 diagnosis of a prnblem Ol' detern1ination of the prnper action morn challenging 609 or time consuming for the opemtm*), the absence of a prnviously available 610 paramete1* (i.e., a type of pm*ametm*), a differnnee in how the loss m* failm*e of D-28

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 611 pm*ametern occ::rn (e.g .. as the i*esult of combining pm*an1etern), 01* an 612 inernase in the amount of infornrntion that is p1*ovided sueh that the amo::nt 613 of available infonnation has a deti*imental impact on the opemtor's ability to 614 discern a pm*ticulm* plant condition 01* to pm*fonn a specific task.

615 EJmmple 4 8 illustrates the application of the l'lumbcr and/er Type ef 616 Parameters aspect.

Example 4-8. Number and Type of Parameters with NO ADVERSE IMPACT on a UFSAR-Described Design Function Currently, all controls and indications for a single safety-related pump are analog. There are two redundant channels of indications, either of which can be used to monitor pump performance, but only one control device. For direct monitoring of pump performance, redundant motor electrical current indicators exist. For indirect monitoring of pump performance, redundant discharge pressure and fiow rate indicators exist. Furthermore, at the destination of the pump's flow, redundant temperature indicators exist to allow indirect monitoring of pump performance to validate proper pump operation by determination of an increasing temperature trend (i.e.,

indicating insufficient flow) or a stable/decreasing temperature trend (i.e.,

• indicating sufficient flow). All of these features are described in the UFSAR.

The UFSAR also states that the operator will "examine pump performance and utilize the information from at least one of the redundant plant channels to verify performance" and "the information necessary to perform this task is one parameter directly associated with the pump (motor electrical current) and three parameters indirectly associated with pump performance (discharge pressure, flow rate, and response of redundant temperature indications)."

A digital system will replace all of the analog controls and indicators. Two monitoring stations will be provided, either of which can be used to monitor the pump. Each monitoring station will display the information from one of the two redundant channels. The new digital system does not contain features to automatically control the pump, but does contain the ability to monitor each of the performance indications and inform/alert the operator of the need to take action. Therefore, all pump manipulations will still be manually controlled.

Since the new digital system presents the same number (one) and type (motor electrical current) of pump parameters to directly ascertain pump performance and the same number (three) and type (discharge pressure, flow rate and redundant temperature) of system parameters to indirectly ascertain pump performance, there is no adverse impact on the UFSAR-D-29

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017

• described design function to perform direct monitoring of pump performance and no adverse impact on the UFSAR-described design function to perform

• indirect monitoring of pump performance.

617 618 Information Presentation on the Human System lnterfaee 619 620 A typical change in data prnsentation might result from the i*eplacement of 621 an edgewise analog mete1* with a nume1*ic display m* a multipurpose CRT.

622 To cletennine if the HSI aspects of a digital modification have an adv01*se 623 effect on UFSl'iR desc1*ibed design functions, potential impacts due to how 624 the infm*mation is p1*esented should be addressed in the Screen.

625 Considerntion of a digital modification's impact due to hovi' the infm*mation is 626 presented involves an examination of how the actual infm*mation 627 presentation method could impact the p01*fo1*mance and!m* satisfaction of 628 UFSAR described design functions. To determine possible impacts, the 629 UFSi\R should be reviewed to identify descriptions 1*egarding how 630 infonnation is presented, organized (e.g., how the info1*mation is physically 631 prnsented) 01* accessed, and if that presentation, organization or access 632 relates to the pm*formance and/or satisfaction of a UFSL\R described design 633 function.

634 Examples of activities that have the potential to cause an adverne effect 635 include the following activities:

636

• Addition or i*cmoval of a dead band, or 637

• Replacement of instantaneoas i*eadings with time avcmged readings 638 (or vice verna).

639 If the HSI changes do not exhibit chamcte1*istics such as those listed above, 640 then it may be rnasonable to conclude t,hat the "method of pm*fol'ming or 641 cont1*011ing" a design function is not ad1101*sely affected.

642 Example 4 9 illustrntes the application of the Information Presentation 643 ~

Example 4-9. Information Presentation with an ADVERSE IMPACT on a UFSAR-Described Design Function

A digital modification consolidates system information onto two flat panel displays (one for each redundant channel/train). Also, due to the increased precision of the digital equipment, the increment of presentation on the HSI will be improved from 10 gpm to 1 gpm. Furthermore, the HSI will now D-30

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 present the information layout "by channel/train."

The UFSAR identifies the existing presentation method as consisting of "indicators with a 10 gpm increment" to satisfy safety analysis assumptions and the physical layout as being "by flow path" to allow the operator to

• determine system performance .

. The increase in the display increment is not adverse since the operator will continue to be able to distinguish the minimum increment of 10 gpm UFSAR-described design function.

The new display method (i.e., "by channel/train") adversely affects the ability of the operator to satisfy the design function to ascertain system performance

, "by flow path."

644 645 OpeFator Response Time 646 647 Typieally, an inm*ease in the operntor i*esponse time might i*esult from the 648 need fm* the opemtor to pm*fonn additional actions (e.g., due to the additional 649 steps necessary to call up or ret1*ieve the appropriate display and operate the 650 "'soft" eontrnl rnthm* than merely reading an indieatm* on the :Main Cont1*ol 651 Boa1*d).

652 To detm*mine if the HSI aspects of a digital modification have an advcrne 653 effect on UFSAR described design funetions, potential impacts on the 654 operntor response time should be addressed in the Sei*een.

655 Consideration of a digital modification's impact on the operator 1*esponse time 656 due to the modification of the numbe1* and,lor type of decisions made, and/or 657 the modification of the munbm* and/01* type of aetions taken, involves an 658 examination of the actual decisions made/actions taken and how they eoald 659 impact the performance and/or satisfaction of UFSAR described design 660 knctions. To detm*mine possible impacts, the UFSAR must be i*eviewed to 661 identify desc1*iptions i*elating to operntor response time requfrements and if 662 those timing req:1irnments ai*e i*elated to the performance and/m* sntisfaction 663 of a UFSl,R described design fanction.

664 Example 4 10 is the same as Example 4 9, but illustrntes the application of 665 the Operator Response Time aspect.

, Example 4-10. Operator Response Time with NO ADVERSE IMPACT on a UFSAR-Described Design Function

• A digital modification consolidates system information onto two flat panel D-31

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017

displays (one for each redundant channel/train). Also, due to the increased

• precision of the digital equipment, the' increment of presentation on the HSI

! will be improved'from 10 gpm'to 1 gpm. ~urthermore, tlie HSI will now

present the information lay.out "by channel/train."

1 The UFSAR identifies the existing presentation method as consisting of the physicarlayout as being "by flow path" to allow the operator to*determine.

, system performance. *

. Although the UFSAR identifies the existing presentation method as i consisting of a physical layout "by flow path" to allow the operator to

determine system performance and the new display method (i.e., "by

channel/train") will require additional steps by the operator to determine 1 system performance, requiring more time, there is no adverse impact on

satisfaction of the design function to ascertain system performance because l no resp~nse time requirements are applicable to tlie design function* of the i operator being able "to determine sy!ltem performance.

666 667 COMPREHENSIVE HUMAN-SYSTEM INTERFACE EXAMPLE 668 Although no additional guidance is provided in this section, Example 4-11 669 illustrates how each of the aspects identified above would be addressed.

Example 4-11. Digital Modification involving Extensive HSI 1

Considerations with NO ADVERSE IMPACTS on a UFSAR-Described 1Design Function.

'. Component controls for a redundant safety-related system are to be replaced

' with PLCs. The existing HSI for these components.is made up of redundant

hard-wired switches, indicator lights, and analog meters. The new system l consolidates the information and controls onto two flat panel displays (one

per redundant train), each with a.touch screen providing "soft" control

! capability. '

IThe existing.number and type. of parameters remains the same, which can be 1

displayed in a mau"ner similar to the existing presentations (e.g., by' train).

However, th~ information can be also pr~sented in different configurations

that did not previously exist (e.g., by path or by parameter type to allow for easier comparison of like paramete;rs), using s~veral selectable displays.

The flat panel display can also present any of several selectable pages depending on the activity being performed by the operator (e.g.,

starting/initiating the syste~, monitoring the system during operation, or D-32

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 changing the system line-up).

To operate a control, the operator must (via the touch screen) select the appropriate activity (e.g., starting/initiating the system, monitoring the system during operation, or changing the system line-up), select the desired page (e.g., train presentation, path presentation, or parameter comparison),

select the component to be controlled (e.g., pump or valve), select the control action (e.g., start/stop or open/close), and execute it.

The display remains on the last page selected, but each page contains a "menu" of each possible option to allow direct access to any page without having to return to the "main menu."

The two new HSis (one per redundant train) will provide better support of operator tasks and reduced risk of errors due to:

• Consolidation of needed information onto a single display (within the family of available displays) that provides a much more effective view of system operation when it is called into action.

• Elimination of the need for the operator to seek out meter readings or indications, saving time and minimizing errors.

• Integration of cautions and warnings within the displays to help detect and prevent potential errors in operation (e.g., warnings about incorrect system lineups during a test or maintenance activity).

The design was developed using a human factors engineering design, with a verification and validation process consistent with current industry and regulatory standards and guidelines. As part of the technical evaluation supporting the proposed activity, a Human Factors Evaluation (HFE) was performed. Based on the conclusions from the HFE, the design provides a more effective HSI that is less prone to human error than the existing design.

The UFSAR-described design functions applicable to this proposed activity include desm*iptions of how the existing controls, including the physical switches, indicator lights and meters, and how each of these SSCs is used during normal and abnormal (including accident) operating conditions. The UFSl\R identifies the current physical arrangement (i.e., two physically separate locations) ~ding-a-provides assurance that the design function is satisfied bv preventing the operator that prnvents the operntor from operating the "wrong" component. There are no UFSAR-described design functions related to the operator response times associated with using the existing controls.

The impacts on design functions are identified below:

D-33

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017

• Physical Interaction - NOT ADVERSE because the new HSI consists of two physically separate displays.

• Number and Type of Parameters - NOT ADVERSE because the same number and type of parameters exist with the new HSI.

• Information Presentation - NOT ADVERSE because all of, the existing features (e.g., individual controls, indicator lights and parameters displays that . mimic the analog meters) continue to exist with the new HSI.

Operator Response Time - NOT ADVERSE because no response time requirements were applicable to any of the design functions and there were no indirect adverse affects on any other design function.

670 671 4.2.1.3 Screening Changes to UFSAR Methods of Evaluation 672 By definition, a proposed activity involving a digital modification involves 673 SSCs and how SSCs are operated and controlled, not a method of evaluation 674 described in the UFSAR (see NEI 96-07, Section 3.10).

675 Methods of evaluation are analytical or numerical computer models used to 676 determine and/or justify conclusions in the UFSAR (e.g., accident analyses 677 that demonstrate the ability to safely shut down the reactor or prevent/limit 678 radiological releases). These models also use "software." However, the 679 software used in these models is separate and distinct from the software 680 installed in the facility. The response to this Screen consideration should 681 reflect this distinction.

682 A necessary revision or replacement of a method of evaluation (see NEI 96-683 07, Section 3.10) resulting from a digital modification is separate from the 684 digital modification itself and the guidance in NEI 96-07, Section 4.2.1.3 685 applies.

686 4.2.2 Is the Activity a Test or Experiment Not Described in the UFSAR?

687 By definition, a proposed activity involving a digital modification involves 688 SSCs and how SSCs are operated and controlled, not a test or experiment 689 (see NEI 96-07, Section 4.2.2). The response to this Screen consideration 690 should reflect this characterization.

691 - A necessary test or experiment (see NEI 96-07, Section 3.14) involving a 692 digital modification is separate from the digital modification itself and the 693 guidance in NEI 96-07, Section 4.2.2 applies.

D-34