ML18079A480

Korea Hydro-Nuclear Power Co., Ltd (Design Control Document) Rev.2 - Tier2 Chapter18-Human Factors Engineering

ML18079A480
Person / Time
Site:	05200046
Issue date:	03/08/2018
From:	Kim H Korea Hydro & Nuclear Power Co, Ltd
To:	Office of New Reactors
Ward W
References
KOREAHYDRONUC, KOREAHYDRONUC.SUBMISSION.8, APR1400.DCD.NS, APR1400.DCD.NS.3
Download: ML18079A480 (96)

Text

APR1400 DESIGN CONTROL DOCUMENT TIER 2 CHAPTER 18 HUMAN FACTORS ENGINEERING APR1400-K-X-FS-14002-NP REVISION 2 FEBRUARY 2018

2018 KOREA ELECTRIC POWER CORPORATION KOREA HYDRO & NUCLEAR POWER CO., LTD All Rights Reserved This document was prepared for the design certification application to the U.S. Nuclear Regulatory Commission and contains technological information that constitutes intellectual property of Korea Hydro & Nuclear Power Co., Ltd.

Copying, using, or distributing the information in this document in whole or in part is permitted only to the U.S. Nuclear Regulatory Commission and its contractors for the purpose of reviewing design certification application materials. Other uses are strictly prohibited without the written permission of Korea Electric Power Corporation and Korea Hydro & Nuclear Power Co., Ltd.

Rev. 2

APR1400 DCD TIER 2 CHAPTER 18 - HUMAN FACTORS ENGINEERING TABLE OF CONTENTS NUMBER TITLE PAGE CHAPTER 18 - HUMAN FACTORS ENGINEERING ..................................... 18.1-1 18.1 Human Factors Engineering Program Management ..................................... 18.1-1 18.1.1 General Human Factors Engineering Program Goals and Scope.......... 18.1-1 18.1.1.1 Assumptions and Constraints Identification ......................... 18.1-2 18.1.1.2 Applicable Plant Facilities .................................................... 18.1-3 18.1.1.3 Applicable HSIs, Procedures, and Training ......................... 18.1-4 18.1.1.4 Applicable Plant Personnel ................................................... 18.1-4 18.1.2 HFE Design Team and Organization .................................................... 18.1-5 18.1.2.1 Responsibility ....................................................................... 18.1-5 18.1.2.2 Organizational Placement and Authority ............................. 18.1-6 18.1.2.3 HFE Design Team Composition........................................... 18.1-8 18.1.2.4 HFE Design Team Staffing .................................................. 18.1-8 18.1.3 HFE Design Process and Procedures .................................................... 18.1-9 18.1.3.1 General Process and Procedures ........................................... 18.1-9 18.1.3.2 Process Management Tools .................................................. 18.1-9 18.1.3.3 Integration of the HFE Design with Other Plant Design Activities ............................................................................... 18.1-9 18.1.3.4 HFE Program Milestones ................................................... 18.1-10 18.1.3.5 HFE Documentation ........................................................... 18.1-10 18.1.3.6 Subcontractor HFE Efforts ................................................. 18.1-11 18.1.4 Tracking of HFE Issues ....................................................................... 18.1-11 18.1.5 Technical Program .............................................................................. 18.1-11 18.1.6 Combined License Information ........................................................... 18.1-12 18.1.7 References ........................................................................................... 18.1-12 18.2 Operating Experience Review .......................................................................... 18.2-1 18.2.1 Objectives and Scope ............................................................................ 18.2-1 18.2.2 Methodology ......................................................................................... 18.2-1 i Rev. 2

APR1400 DCD TIER 2 18.2.2.1 OER Process ......................................................................... 18.2-1 18.2.2.2 Predecessor Plants and Systems ........................................... 18.2-4 18.2.2.3 Sources of Operating Experience ......................................... 18.2-4 18.2.2.4 Issues Identified by Plant Personnel ..................................... 18.2-5 18.2.2.5 Important Human Actions .................................................... 18.2-6 18.2.2.6 Issue Tracking and Review................................................... 18.2-7 18.2.3 Results ................................................................................................... 18.2-7 18.2.4 Combined License Information ............................................................. 18.2-7 18.2.5 References ............................................................................................. 18.2-7 18.3 Functional Requirements Analysis and Function Allocation ........................ 18.3-1 18.3.1 Objectives and Scope ............................................................................ 18.3-1 18.3.1.1 Functional Requirements Analysis ....................................... 18.3-1 18.3.1.2 Function Allocation .............................................................. 18.3-1 18.3.2 Methodology ......................................................................................... 18.3-2 18.3.2.1 Methodology for Functional Requirements Analysis ........... 18.3-2 18.3.2.2 Methodology for Function Allocation .................................. 18.3-3 18.3.2.3 FRA/FA Implementation ...................................................... 18.3-5 18.3.3 Results ................................................................................................... 18.3-6 18.3.4 Combined License Information ............................................................. 18.3-7 18.3.5 References ............................................................................................. 18.3-7 18.4 Task Analysis...................................................................................................... 18.4-1 18.4.1 Objectives and Scope ............................................................................ 18.4-1 18.4.2 Methodology ......................................................................................... 18.4-5 18.4.2.1 Basic Task Analysis.............................................................. 18.4-5 18.4.2.2 Task Timing Analysis ........................................................... 18.4-6 18.4.2.3 Results Documentation ......................................................... 18.4-6 18.4.3 Results ................................................................................................... 18.4-7 18.4.4 Combined License Information ............................................................. 18.4-7 18.4.5 References ............................................................................................. 18.4-7 18.5 Staffing and Qualifications ............................................................................... 18.5-1 18.5.1 Objectives and Scope ............................................................................ 18.5-1 ii Rev. 2

APR1400 DCD TIER 2 18.5.2 Methodology ......................................................................................... 18.5-2 18.5.2.1 Staffing and Qualifications Assumption............................... 18.5-3 18.5.2.2 Staffing and Qualifications Analysis .................................... 18.5-3 18.5.3 Results ................................................................................................... 18.5-5 18.5.4 Combined License Information ............................................................. 18.5-6 18.5.5 References ............................................................................................. 18.5-6 18.6 Treatment of Important Human Actions ........................................................ 18.6-1 18.6.1 Objectives and Scope ............................................................................ 18.6-1 18.6.2 TIHA Methodology ............................................................................... 18.6-1 18.6.3 Results ................................................................................................... 18.6-3 18.6.4 Combined License Information ............................................................. 18.6-3 18.6.5 References ............................................................................................. 18.6-3 18.7 Human-System Interface Design ...................................................................... 18.7-1 18.7.1 Objectives and Scope ............................................................................ 18.7-1 18.7.2 Methodology ......................................................................................... 18.7-2 18.7.2.1 HSI Design Input .................................................................. 18.7-2 18.7.2.2 Concept of Operations .......................................................... 18.7-5 18.7.2.3 Functional Requirements Specification ................................ 18.7-5 18.7.2.4 HSI Concept Design ............................................................. 18.7-6 18.7.2.5 HSI Detailed Design and Integration.................................... 18.7-7 18.7.2.6 HSI Tests and Evaluations .................................................. 18.7-12 18.7.3 Results ................................................................................................. 18.7-12 18.7.4 Combined License Information ........................................................... 18.7-12 18.7.5 References ........................................................................................... 18.7-13 18.8 Procedure Development .................................................................................... 18.8-1 18.8.1 Objective and Scope .............................................................................. 18.8-1 18.8.2 Methodology ......................................................................................... 18.8-1 18.8.3 Results ................................................................................................... 18.8-1 18.8.4 Combined License Information ............................................................. 18.8-1 18.8.5 References ............................................................................................. 18.8-1 18.9 Training Program Development....................................................................... 18.9-1 iii Rev. 2

APR1400 DCD TIER 2 18.9.1 Objective and Scope .............................................................................. 18.9-1 18.9.2 Methodology ......................................................................................... 18.9-1 18.9.3 Results ................................................................................................... 18.9-1 18.9.4 Combined License Information ............................................................. 18.9-1 18.9.5 References ............................................................................................. 18.9-1 18.10 Human Factors Verification and Validation ................................................. 18.10-1 18.10.1 Objectives and Scope .......................................................................... 18.10-1 18.10.2 Methodology ....................................................................................... 18.10-2 18.10.2.1 Sampling of Operational Conditions .................................. 18.10-2 18.10.2.2 Design Verification............................................................. 18.10-5 18.10.2.3 Human Engineering Discrepancy Resolution..................... 18.10-9 18.10.3 Documentation .................................................................................... 18.10-9 18.10.4 Combined License Information ......................................................... 18.10-11 18.10.5 References ......................................................................................... 18.10-11 18.11 Design Implementation.................................................................................... 18.11-1 18.11.1 Objectives and Scope .......................................................................... 18.11-1 18.11.2 Methodology ....................................................................................... 18.11-1 18.11.3 Results ................................................................................................. 18.11-3 18.11.4 Combined License Information ........................................................... 18.11-3 18.11.5 References ........................................................................................... 18.11-3 18.12 Human Performance Monitoring ................................................................... 18.12-1 18.12.1 Combined License Information ........................................................... 18.12-1 iv Rev. 2

APR1400 DCD TIER 2 LIST OF TABLES NUMBER TITLE PAGE Table 18.2-1 Example of OER Issue and Resolution for the APR1400 .................. 18.2-9 Table 18.5-1 Staffing and Qualification Assumptions for the APR1400 MCR ................................................................................................... 18.5-8 v Rev. 2

APR1400 DCD TIER 2 LIST OF FIGURES NUMBER TITLE PAGE Figure 18.1-1 APR1400 HFE Design Team Organization ...................................... 18.1-14 Figure 18.1-2 Work flow for HFE Design Team .................................................... 18.1-15 Figure 18.1-3 HFE Design Process ......................................................................... 18.1-16 Figure 18.1-4 Issue Tracking System ...................................................................... 18.1-17 Figure 18.2-1 Selection Process of OER Issues ...................................................... 18.2-10 vi Rev. 2

APR1400 DCD TIER 2 ACRONYM AND ABBREVIATION LIST ANSI American National Standards Institute APR1400 Advanced Power Reactor 1400 APWR advanced pressurized water reactor ATWS anticipated transients without scram BISI bypassed and inoperable status indication BOP balance of plant BTP Branch Technical Position CAP corrective actions program CBP computer-based procedure CCF common cause failure CCS component control system CEO chief executive officer CFM critical function monitoring CFR Code of Federal Regulations COL combined license CSF critical safety function D3 diversity and defense-in-depth D3CA diversity and defense-in-depth coping analysis DI design implementation DIHA deterministic important human actions EO electric operator EOF emergency operations facility EOP emergency operating procedure EPRI Electric Power Research Institute ESF engineered safety features FDT functional definition table FPD flat panel display FRA/FA functional requirements analysis and function allocation GDC general design criteria vii Rev. 2

APR1400 DCD TIER 2 HA human action HD human-system interface design HDTM HFE design team meeting HED human engineering discrepancy HF human factors HFE human factors engineering HFEPP human factors engineering program plan HRA human reliability analysis HSI human-system interface I&C instrumentation and control ICR information and control requirement IEEE Institute of Electrical and Electronics Engineers IHA important human action INPO Institute of Nuclear Plant Operations IP implementation plan IPS information processing system ISV integrated system validation ITS issue tracking system KHNP Korea Hydro & Nuclear Power Co., Ltd.

LCS local control station LDP large display panel MCR main control room NASA National Aeronautics and Space Administration NLO non-licensed operator NRC United States Nuclear Regulatory Commission NSAC Nuclear Safety Analysis Center NSSS nuclear steam supply system OECD Organization for Economic Co-operation and Development OER operating experience review P&ID piping and instrumentation diagram viii Rev. 2

APR1400 DCD TIER 2 PBP paper based procedures PRA probabilistic risk assessment PVNGS Palo Verde nuclear generating station PWR pressurized water reactor QIAS qualified indication and alarm system QIAS-N qualified indication and alarm system - non-safety ReSR results summary report RG Regulatory Guide RIHA risk important human action RO reactor operator RSR remote shutdown room RT reactor trip SDCV spatially dedicated, continuously visible SER safety evaluation report SKN Shin-Kori nuclear power plant SME subject matter expert SPDS safety parameter display system SPM success path monitoring S&Q staffing and qualifications SRM Staff Requirements Memorandum SRO senior reactor operator SS shift supervisor SSC structures, systems and components SDCV spatially dedicated continuously visible STA shift technical advisor TA task analysis TAA transient and accident analysis TeR technical report TIHA treatment of important human actions TMI Three Mile Island ix Rev. 2

APR1400 DCD TIER 2 TO turbine operator TSC technical support center TTA task timing analysis V&V verification and validation VDU visual display unit WANO World Association of Nuclear Operators x Rev. 2

APR1400 DCD TIER 2 CHAPTER 18 - HUMAN FACTORS ENGINEERING 18.1 Human Factors Engineering Program Management 18.1.1 General Human Factors Engineering Program Goals and Scope The goal of the APR1400 human factors engineering (HFE) program is to provide reasonable assurance that the HFE design is properly developed and effectively implemented in the APR1400 design.

The HFE program objectives for the nuclear power plant design are that it is human-centered, incorporates HFE principles and methods, and is developed according to a systematic approach.

In accordance with the applicable review criteria of the HFE elements of NUREG-0711 (Reference 1), the Human Factors Engineering Program Plan (HFEPP) (Reference 2),

provides reasonable assurance that the human-system interface (HSI) design effectively supports the operator and minimizes the potential for consequential operator errors.

The HFE program will be in effect from the start of the HFE design cycle through completion of initial plant startup test program.

Human-centered Design Goals Subsection 2.4.1(1) of NUREG-0711 identifies four generic human-centered design goals, which are the general design objectives for the HSI expressed in terms of human performance. Stated as generalities, the goals are objectively defined and serve as criteria for design, test, and evaluation activities.

The design goals in NUREG-0711 are as follows:

a. Personnel tasks can be accomplished within time and performance criteria.

b. The HSIs, procedures, staffing and qualifications, training and management, and organizational arrangement support personnel situational awareness.

c. The design will support personnel in maintaining vigilance over plant operations and provide acceptable workload levels to minimize periods of operator underload and overload.

18.1-1 Rev. 2

APR1400 DCD TIER 2

d. The HSIs will minimize personnel error and support error detection and recovery capability.

To accomplish the above goals, the HFE program management element of the HFE design process, as set forth in the HFEPP program element, includes the following:

a. HFE program goals and scope

b. HFE design team and organization

c. HFE process and procedures

d. HFE issues tracking

e. HFE technical program

f. HFE design team member qualifications for use by each of the HFE program elements 18.1.1.1 Assumptions and Constraints Identification A fundamental assumption of the APR1400 HFE design is that it is possible to operate the plant during postulated plant operating modes (modes 1 through 6) for normal, abnormal, and emergency conditions, with the following personnel in the main control room (MCR):

one reactor operator (RO) with a reactor operator license, one turbine operator (TO) with a reactor operator license, one electric operator (EO) with a reactor operator license, one shift supervisor (SS) with a senior reactor operator (SRO) license, and one shift technical advisor (STA) with a senior reactor operator license.

The MCR staffing meets the regulatory requirements of 10 CFR 50.54(m)(2)(i)

(Reference 3). The HSI will be designed to meet the requirements of 10 CFR Part 50, Appendix A (Reference 4), and to accommodate the MCR staffing described above. The layout of the MCR will be based on the limited need for access to the MCR by other plant personnel while facilitating the effective interfacing of MCR staff with the field equipment operators and maintenance staff.

The MCR environment will be designed using HFE principles to provide a comfortable, professional atmosphere for the operators that enhances their effectiveness. Attention will 18.1-2 Rev. 2

APR1400 DCD TIER 2 also be given to colors and lighting levels that will enhance operator alertness and minimize operator fatigue.

The MCR HSI will be designed on the basic HSI conceptual design as described in the HFEPP. The APR1400 design will include an advanced control room with fully computerized HSI resources containing redundant compact operator consoles, a large display panel, computer-based procedures, soft control, and a safety console with a minimum number of fixed-position displays and controls, which are described in Section 18.7.

The schedule, milestones, and duration of the APR1400 HFE program will be described in Subsection 4.4.1 of the HFEPP.

18.1.1.2 Applicable Plant Facilities The HFE program addresses the following facilities:

a. MCR

b. Remote shutdown room (RSR)

c. Technical support center (TSC)

d. Emergency operations facilities (EOFs) (communication and information requirements only)

e. Local control stations (LCSs) associated with important human actions (IHAs)

The HFE program elements will be applied in a graded approach with all elements being fully applied to the MCR and RSR. Any limitations for the applicability of the HFE program elements to the TSC is as described in each HFE implementation plan.

The communications and information requirements of the EOF will be designed in accordance with the APR1400 HFE program. The APR1400 HFE team determines what EOF information must be transmitted from the plant to the EOF, in accordance with regulatory requirements and guidance, and based on the task analysis process described in Section 18.4. The EOF itself, including the detailed design of EOF displays and corresponding verification and validation (V&V), training and procedures, is outside the scope of the APR1400 HFE Implementation Plans.

18.1-3 Rev. 2

APR1400 DCD TIER 2 The EOF facility is designed in accordance with NUREG-0696 (Reference 9) and NUREG-0700 (Reference 8). The EOF design process specifies the complete EOF facility design, including the method of incorporating the communications and information requirements established by the APR1400 HFE program.

As a minimum, the HSI displays at the EOF include the following:

a. Radiological, meteorological, and plant-system data essential to determining offsite protective measures, assessing environmental conditions, coordinating radiological monitoring and recommending the implementation of offsite emergency plans.

b. Data sufficient to assess the actual and potential onsite and offsite environmental consequences of an emergency, and information on the general condition of the plant.

c. Sensor data of the variables in NRC RG 1.97 (Reference 11), the meteorological variables in NRC RG 1.23 (Reference 12) and in NUREG-0654, Rev. 1, Appendix 2 (Reference 10).

18.1.1.3 Applicable HSIs, Procedures, and Training The HSIs are developed in accordance with the HFEPP. The HFE program addresses the design of HSIs. The HFE program provides input to the procedures and training programs; however, they are developed in accordance with Chapter 13. The HFE program includes the HSIs required for operations, accident management, maintenance, test, inspections, and surveillance tasks that operational personnel perform or supervise.

18.1.1.4 Applicable Plant Personnel Plant personnel addressed by the HFEPP include licensed control room operators as defined in 10 CFR Part 55 (Reference 5), non-licensed operators (NLOs), the SS, and the STA.

This includes training needs for instrumentation and control (I&C) technicians, maintenance personnel, radiological protection technicians, chemistry technicians, and engineering support personnel. Additionally, other personnel who perform tasks identified to be directly related to plant safety are included in the HFE program.

18.1-4 Rev. 2

APR1400 DCD TIER 2 18.1.2 HFE Design Team and Organization 18.1.2.1 Responsibility The multidisciplinary HFE design team includes the architectural engineering group, operations group, and nuclear steam supply system (NSSS) group as shown in Figure 18.1-1.

Section 4.3 of the HFEPP describes the organizational responsibilities for the HFE design team activities.

The HFE design team is responsible for the following activities with respect to the HFE program scope:

a. Developing the HFE plans and procedures

b. Ensuring that all HFE activities comply with the HFE implementation plans (IPs)

c. Ensuring that the HFE program is integrated within the plant design

d. Overseeing and reviewing the HFE design, analysis, development, test, and evaluation activities

e. Initiating, recommending, identifying solutions, and approving design changes for problems identified during the implementation of the HFE activities

f. Verifying that the implementation of the HSI design and design changes are based on the HFE design team recommendations

g. Applying the HFE programs IPs

h. Conducting the human factors (HF) V&Vprogram

i. Identifying human engineering discrepancies (HEDs) from each of the HFE program elements, entering the HEDs into the issue tracking system (ITS) and tracking the resolution of HEDs

j. Closing or approving the closure of HEDs

k. Scheduling activities and milestones

l. Assigning resources 18.1-5 Rev. 2

APR1400 DCD TIER 2

m. Designing the HSI

n. Keeping the Style Guide (Reference 6) current 18.1.2.2 Organizational Placement and Authority The organization of the HFE design team is shown in Figure 18.1-1.

The HFE design team has the authority to provide reasonable assurance that the HFE program is fully implemented in accordance with the HFEPP and that the HSI design complies with the human-centered design goals as stated in Subsection 18.1.1. The HFE design team has the authority to approve the HSI design decisions, as such; the HFE design team has equal authority to the other design groups. The work flow of the HFE design team is shown in Figure 18.1-2.

The HFE design team has the authority to:

a. Ensure that its areas of responsibility are completed as per the HFE program IPs

b. Identify problems in the HFE plans and design

c. Identify when plant design changes are required

d. Control the level of HFE assessment, testing, and analysis

e. Perform acceptance test and approve HFE before installation

f. Apply HFE products until the disposition of HEDs, including nonconformances, deficiencies, or unsatisfactory conditions, is resolved The individual responsibilities of HFE design team personnel are described below.

a. Project manager The project manager, reporting to the Deputy Director General of the Advanced Reactor Development Laboratory, is responsible for meeting the design control objectives. The project manager manages the overall project scope, schedule, cost, and quality. The project manager resolves conflicts in the plant-level design that are identified by the HFE design team leader and cannot be resolved within 18.1-6 Rev. 2

APR1400 DCD TIER 2 the HSI design. The project manager has the responsibility and authority to make final decisions when it comes to the plant-level design.

b. Quality assurance organization The quality assurance group is responsible to oversee the application of the quality assurance plan, independently verify that the process and procedures have been implemented, and ensure that the HSI design meets quality standards. The quality assurance organization reports to the General Manager of the Quality Assurance Team and has project responsibilities to the project manager.

c. HFE design team leader (technical project manager)

HFE design team leader, reporting to the project manager, performs technical project management for the HFE design process and has overall responsibility for the HSI design. The HFE design team leader manages the HFE schedule and makes design decisions related to the HFE design issues. The HFE design team leader has the authority for directing the HFE design and resolving conflicts between the HFE team and other design teams. The HFE design team leader is responsible to ensure that the HFE design program elements communicate results and coordinate with each other, and that the HFE program is integrated with other design efforts. The HFE design team leader uses the HED process, HFE design team meetings (HDTMs), and regularly scheduled integrated design reviews to integrate the HSI design activities with other plant design efforts. The HFE design team leader keeps the project manager informed of the status of unresolved issues, conflicts in the HFE design, and other design issues as appropriate. The HFE design team leader has the authority to approve the HSI design.

d. HFE coordinator The HFE coordinator, located in the architect engineering group, coordinates with designers in the operating group and the NSSS design group for the resolution of HEDs and HDTM action items. The HFE coordinator interacts with the organizations in the HFE design team to ensure that their activities are effectively integrated with overall HFE design activities. The HFE coordinator has no supervisory responsibilities.

e. Architect engineering group 18.1-7 Rev. 2

APR1400 DCD TIER 2 The architect engineering group is responsible for the work related to the balance of plant (BOP). The architect engineering group engineering disciplines include:

BOP system engineers, architect engineers, computer system engineers, reliability/availability engineers, BOP I&C engineers, system safety engineers, and HF engineers.

f. Operating group The operating group is responsible for plant operations. The operating group contains plant procedure developers, plant operations experts, personnel training experts, and maintainability/inspectability engineers.

g. NSSS design group The NSSS design group is responsible for the work related to NSSS. The NSSS design group has four subgroups with the following disciplines: NSSS engineering, NSSS I&C engineering, nuclear engineering, and system safety engineering.

h. HF engineer HF engineers are responsible for applying the HFE program element IPs, reviewing the HSI design and design documents, and providing comments on the design based on their individual field of expertise. HF engineers participate in design review meetings related to the HSI.

18.1.2.3 HFE Design Team Composition The HFE design team is a multidisciplinary team that includes staff from the following engineering disciplines: electrical, mechanical, nuclear, architectural, operations, computer systems, and probabilistic risk assessment (PRA). Figure 18.1-1 shows the composition of the HFE design team.

18.1.2.4 HFE Design Team Staffing The minimum qualifications and job descriptions of the members of the HFE design team, including the documentation of the qualifications and job descriptions, meet the requirements of Section 5 of the HFEPP.

18.1-8 Rev. 2

APR1400 DCD TIER 2 18.1.3 HFE Design Process and Procedures 18.1.3.1 General Process and Procedures The HFE design team executes its responsibilities according to the following:

a. The HFE management and design decision processes are described in Section 4.4 of the HFEPP. HFE activities are assigned to the cognizant engineering group, and each group assigns the activities to individual members.

b. The HFE design processes are described in Section 4.4.2 and HSI design change processes are described in Section 4.4.2.1 of the HFEPP.

The design review process for HFE products is shown in Figure 18.1-3.

18.1.3.2 Process Management Tools Process management tools are provided to facilitate communication across design teams and to enhance consistency and efficiency. The review and comment system, the ITS for HEDs, and HFE design team meetings are three process management tools for the development of HFE designs.

The review and comment system is used by designers and reviewers to provide comments and opinions on the HSI design and design documents.

The ITS is used to track design issues as HEDs identified during the HFE design and HF V&V process and to communicate HFE issues between design groups.

The HFE design team meetings are regularly scheduled to allow coordination between design groups.

Results from the HFE program elements are maintained for reference by all design groups in the review and comment system.

18.1.3.3 Integration of the HFE Design with Other Plant Design Activities The integration of design activities is based on the inputs from other plant design activities to the HFE program and the outputs from the HFE program to other plant design activities.

The integration uses the process management tools identified in Subsection 18.1.3.2 and is the responsibility of the HFE design team leader. The HFE design team leader uses the 18.1-9 Rev. 2

APR1400 DCD TIER 2 review and comment system to identify design comments from other design groups that will impact the HSI design and to inform other design groups of HFE comments that will affect the plant design. The HFE design team leader tracks HEDs in the ITS to confirm that other design teams are accounting for the HEDs in their design.

18.1.3.4 HFE Program Milestones HFE milestones, which are described in Subsection 4.4.1 of the HFEPP, are identified so that an evaluation of the effectiveness of the HFE effort can be made at critical checkpoints and the relationship to the integrated plant sequence of events can be shown.

The schedule for HFE program tasks, showing the relationships between HFE elements and activities, products, and reviews, is included in the HFEPP.

18.1.3.5 HFE Documentation HFE documents consist of HFE program element IPs, results summary reports (ReSRs),

HFE design-related technical reports, and drawings.

HFE Program Element Implementation Plans and Results Summary Reports

a. HFEPP

b. Operating experience review (OER) IP and ReSR

c. Functional requirements analysis and functional allocation (FRA/FA) IP and ReSR

d. Task analysis (TA) IP and ReSR

e. Staffing and qualifications (S&Q) IP and ReSR

f. Treatment of important human actions (TIHA) IP and ReSR

g. HSI design (HD) IP and ReSR

h. Human factors verification and validation (V&V) IP and ReSR

i. Design implementation (DI) IP and ReSR The review and comment system maintains the preceding documents and makes them accessible to designers and reviewers.

18.1-10 Rev. 2

APR1400 DCD TIER 2 18.1.3.6 Subcontractor HFE Efforts Procurement specifications, if that contain HFE design requirements, are provided to the subcontractor with the Style Guide as a standard appendix form to enforce HFE practices are considered. The HFE guidelines cover design, fabrication, testing, and performance verification of annunciators, panel layout, visual displays, controls, displays, labeling and demarcation.

Subcontractor compliance with the HFE requirements and the Style Guide is reviewed and verified by the quality assurance program (Reference 7). Compliance with HFE requirements is verified by the review of relevant HF design engineering documents such as panel layout drawings and outline drawings.

18.1.4 Tracking of HFE Issues The ITS receives inputs from the OER and issues that are identified during the analysis, design development, and V&V. The HEDs are included in the ITS.

The HFE design team is responsible for issue logging, tracking, and resolution processes.

For each issue entered into the database, cognizant engineers are assigned to resolve the issues. The process for the HFE issue management is shown in Figure 18.1-4. Each of the HFE program IPs provides threshold criteria that determine when HEDs are entered into the system.

Once entered, HEDs are tracked until the potential for negative effects on human performance is reduced to an acceptable level.

The HFE design team establishes closure criteria for each issue.

18.1.5 Technical Program Implementation plans, analyses, and evaluations for the following HFE program elements are summarized in later section of this document and their relationships shown in Figure 18.1-3:

a. OER

b. FRA/FA

c. TA 18.1-11 Rev. 2

APR1400 DCD TIER 2

d. S&Q

e. TIHA

f. HD

g. HF V&V

h. DI The HFE standards and specifications that are sources of HFE requirements are identified and described in the HFEPP.

Evaluations and analyses, with the use of the simulator and pressurized water reactor (PWR) plant operators, provide inputs for determining the adequacy of the HSI design. Testing and evaluation of HSI designs are used throughout the HSI development.

Details of the design testing and evaluations using a simulator are described in Subsection 18.7.2.6.

18.1.6 Combined License Information No COL information is required with regard to Section 18.1.

18.1.7 References

1. NUREG-0711, Human Factors Engineering Program Review Model, Rev. 3, U.S.

Nuclear Regulatory Commission, November 2012.

2. APR1400-E-I-NR-14001-P, Human Factors Engineering Program Plan, Rev. 2, KHNP, January 2018.

3. 10 CFR 50.54, Conditions of Licenses, U.S. Nuclear Regulatory Commission.

4. 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants, U.S. Nuclear Regulatory Commission.

5. 10 CFR Part 55, Operators Licenses, U.S. Nuclear Regulatory Commission.

6. APR1400-E-I-NR-14012-P, Style Guide, Rev. 2, KHNP, January 2018.

18.1-12 Rev. 2

APR1400 DCD TIER 2

7. APR1400-K-Q-TR-11005-NP, KHNP Quality Assurance Program Description (QAPD) for the APR1400 Design Certification, Rev. 5, KHNP, April 2016.

8. NUREG-0700, Human-System Interface Design Review Guidelines, Rev. 2, U.S.

Nuclear Regulatory Commission, May 2002.

9. NUREG-0696, Functional Criteria for Emergency Response Facilities, U.S. Nuclear Regulatory Commission, 1981.

10. NUREG-0654, Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants, Rev. 1, U.S.

Nuclear Regulatory Commission, November 1980.

11. Regulatory Guide 1.97, Criteria for Accident Monitoring Instrumentation for Nuclear Power Plants, Rev. 4, U.S. Nuclear Regulatory Commission, June 2006.

12. Regulatory Guide 1.23, Meteorological Monitoring Programs for Nuclear Power Plants, Rev. 1, U.S. Nuclear Regulatory Commission, March 2007.

18.1-13 Rev. 2

APR1400 DCD TIER 2 President & CEO Vice President of QA Executive Vice President of Planning

& Community Cooperation Division Vise President QA Organization Deputy Director General of Advanced Reactor Development Laboratory Project Manager HFE Design Team Leader (Technical Manager)

HFE Operating Group Coordinator Maintainabil Plant Plant Personnel ity/Inspect-Procedure Operation Training ability HFE Architect Group Coordinator Computer Reliability/ System BOP I&C BOP System Architect HF Engineer System Availability Safety Engineer Engineer Engineer Engineer Engineer Engineer HFE NSSS Engineering Coordinator Group NSSS NSSS System Nuclear System I&C Safety Engineer Engineer Engineer Engineer Figure 18.1-1 APR1400 HFE Design Team Organization 18.1-14 Rev. 2

APR1400 DCD TIER 2 Technical Project Manager HFE Group 1

- I&C Design

- HSI Design

- Paper Procedure HFE Group 2 HF Engineer

- CBP Design

- HFE Design - HSI Design Guide

- HFE Design HFE Group 3

- NSSS I&C Design

- NSSS HSI Design

- Paper Procedure(EOGs)

HFE Issue Tracking Systems Figure 18.1-2 Work flow for HFE Design Team 18.1-15 Rev. 2

APR1400 DCD TIER 2 Test Scenarios including HSI related with IHAs TIHA Performance Validation Detailed Task IHAs Requirements Operating Sequences Procedure TA Development Instruction Operating Philosophy Operating Roles Training S&Q Program Development Sampling of Operational Conditions Staffing Organization HSI Resource Design FRA&FA (Display, Control, Design Verification Implementation Alarm, CBP, etc.)

HFEPP Function Integrated Hierarchy, ICR, System Validation Engineering experience HSI Facility Human OER (MCR, RSR, LDP, Performance Criteria etc.) Document, HED Resolution As-Built Monitoring Drawings Plan Analysis HSI Design V&V Operation Figure 18.1-3 HFE Design Process 18.1-16 Rev. 2

APR1400 DCD TIER 2 Database Pending HFE Design Team Issues Cognizant Engineers No Issues Issue Registration Addressed Yes Raised Closed Issues Issues Issues Resolution Review Process Figure 18.1-4 Issue Tracking System 18.1-17 Rev. 2

APR1400 DCD TIER 2 18.2 Operating Experience Review 18.2.1 Objectives and Scope The objective of the human factors engineering (HFE) operating experience review (OER) program element is to enable the human factors analyst to identify and understand experience-based human factors related safety issues to provide reasonable assurance that these issues are kept out of the APR1400 design while positive features are retained.

These issues are encountered in designs that are similar to the APR1400 design, as well as other existing nuclear power plants. OER issues are provided to the HFE design team and related system designers at the beginning of the design process so that OER issues can be incorporated into the HFE design.

The OER applies the OER Implementation Plan (Reference 1).

The scope of the OER includes the following categories:

a. Predecessor plants and systems

b. Recognized industry HFE issues

c. Related HSI technology

d. Issues identified by plant personnel

e. Important human actions (IHAs)

f. U.S. nuclear industry operating experience

g. Interviews with predecessor plant operations personnel

h. Non-nuclear experience of similar HSI or system design 18.2.2 Methodology 18.2.2.1 OER Process The HFE design team reviews operating experience issues and identifies those issues that are relevant to the APR1400 design, using a defined set of criteria. The operating experience is grouped, categorized, and documented in an operating experience database.

18.2-1 Rev. 2

APR1400 DCD TIER 2 The operating experience results are incorporated into the HFE design process. The issues that are identified as being relevant to the other HFE design elements are added to the issues tracking system (ITS) as human engineering discrepancies (HEDs) (see Subsection 18.1.4).

The OER is performed in the following steps:

a. Operating experiences are identified using international and U.S. HFE-related information from License Event Reports, Safety Evaluation Reports (SERs),

Significant Operating Experience Reports, corrective action programs, and plant staff input.

b. OER issues are screened so that only issues that are related to the APR1400 are assessed for application to the APR1400 design.

1) Is the experience applicable/related to a pressurized water reactor (PWR)?

2) Is the human performance related operating experience related to functions performed by the APR1400, regardless of reactor type?

3) Is the experience related to human performance?

4) Is the experience related to the level of automation in the HSI design?

5) Is the experience concerned with an automation or HSI technology that is being planned for use in the APR1400?

c. Each issue is entered into the operating experience database.

d. Operating experience issues are grouped using the following recognized fields as described in NUREG/CR-6400 (Reference 2).

1) U.S. NRC Unresolved Safety Issues and Generic Safety Issues

2) Three Mile Island (TMI) issues

3) U.S. NRC Generic Letters and Information Notices

4) NUREG-1275 series, Volume 1 through 14 (Reference 3) 18.2-2 Rev. 2

APR1400 DCD TIER 2

5) Low-power and shutdown operations

6) Operating plant event reports

e. An operating experience issue or groups of issues are classified into one of three categories. Figure 18.2-1 depicts the process for classifying operating experience issues.

1) Class 1 issues contain information that relates to activities that may impact the HFE-related safety goals to maintain the safety and health of the public and plant staff. Class 1 issues are addressed with additional design effort, and a review of the resolution is performed during a verification process. Class 1 issues require continuous tracking until resolution.

2) Class 2 issues are those issues that do not impact safety goals directly but are addressed to provide improved consistency and to avoid the cumulative effects of significant issues. Class 2 issues are not deemed to be essential, but each is addressed. Class 2 issue resolutions will be audited by the HFE design team.

3) Class 3 issues are only required to be reviewed for quality improvement and are used for HFE designer reference only.

f. A lesson learned is developed for each issue or group of issues. A lesson learned is a positively worded statement that can be applied generically in the HFE design process.

g. Many of the issues are incorporated into the human systems interface (HSI) design.

1) The HFE design team delivers OER issues to the HSI designer.

2) The HSI designers response for design solutions is assessed by the HFE design team.

3) Relevant operating experience issues are incorporated into the HSI design.

4) Issue status is tracked in the operating experience database.

18.2-3 Rev. 2

APR1400 DCD TIER 2

h. Issues that are appropriate for the review of the other HFE program elements are considered to be HEDs and are added to the ITS.

18.2.2.2 Predecessor Plants and Systems The OER for the APR1400 is based on the OER used for the Shin-Kori Units 3&4 (SKN 3&4) design. The predecessor design for SKN 3&4 is the System 80+ design.

The predecessor plants for SKN 3&4 are System 80 plants such as the Palo Verde Nuclear Generating Station (PVNGS). The predecessor plant represents an operating plant with similar characteristics to the APR1400. PVNGS is a System 80 design from which the System 80+ plant was derived; however, no System 80+ plants are in operation. HFE-related OER issues in previous plants and designs are identified and analyzed so the issues can be avoided in the APR1400 design.

OER issues for predecessor plants and systems are identified through the following sources:

a. Design issues from South Korean pressurized water reactors

b. Unresolved design issues from SKN 3&4

c. Interviews, as described in Subsection 18.2.2.4

d. Available U.S. sources of operating experience for System 80 plants, such as the PVNGS 18.2.2.3 Sources of Operating Experience The OER describes the operating experience associated with human performance issues identified through the following sources:

a. Electric Power Research Institute (EPRI) research documents (References 4 through 8)

b. The Nuclear Safety Analysis Center (NSAC), which is hosted by EPRI

c. Experimental Evaluation of the Computerized Procedure System (Reference 9)

d. Hybrid Human-System Interface: Human Factors Considerations (Reference 10)

e. Control Room Systems Design for Nuclear Power Plants (Reference 11) 18.2-4 Rev. 2

APR1400 DCD TIER 2

f. Organization for Economic Co-operation and Development (OECD) Specialists Meeting, Human Factors and Operation Aspects in Computerization of the Control Room: A French Safety View Based on N4 Experience (Reference 12)

g. Halden Reactor Project reports

h. U.S. NRC NUREGs, including NUREG/CR-6400, that address lessons learned from U.S. and non-U.S. experience.

i. TMI

j. U.S. vendor owners groups

k. The Institute for Nuclear Power Operations (INPO)

l. Significant operating experience and significant event reports from the World Association of Nuclear Operators (WANO)

m. The U.S. NRC maintained Human Factors Information System, which includes summaries of human performance issues identified in Licensee Event Reports, inspection reports, and licensed operator examination reports.

n. U.S. NRC Unresolved and Generic Safety Issues 18.2.2.4 Issues Identified by Plant Personnel Plant personnel interviews are conducted to determine operating experience related to predecessor plants and systems. OER issues obtained during the interviews are reviewed and documented by the HFE design team. The following topics are included in the interviews:

a. Plant operation

1) Normal plant evolutions (e.g., startup, full power, shutdown)

2) Instrument failures (e.g., safety system logic and control unit, fault-tolerant controller, communication systems)

3) HSI equipment and processing failure (e.g., loss of displays, loss of information processing system, loss of large display panel) 18.2-5 Rev. 2

APR1400 DCD TIER 2

4) Transients (e.g., turbine trip, loss of offsite power, station blackout, loss of all feedwater, loss of service water, loss of power to selected buses or control room power supplies, safety relief valve transients)

5) Accidents (e.g., main steam line break, positive reactivity addition, control rod insertion at power, control rod ejection, anticipated transients without scram, various-sized loss-of-coolant accidents)

6) Reactor shutdown and cooldown using the remote shutdown system

7) Issues identified by maintenance and test personnel

8) Main control room (MCR) and auxiliary (local control station) operator interviews

9) Operator training instructor interviews

10) Emergency operator (e.g., shift technical advisors, technical support center staff) interviews

b. HFE-related design topics

1) Alarm and annunciation

2) Display

3) Control and automation

4) Information processing and job aids

5) Communication with plant personnel and other organizations

6) Procedures, training, staffing and qualifications, and job design 18.2.2.5 Important Human Actions The operating experience reviewer identifies important human actions (IHAs) from the OER database, and then ensures the issues are provided to the treatment of IHA (TIHA) element of the HFE program as HFE design inputs in the form of HEDs, so that the issue is adequately considered in the human factors design. These issues are maintained in the ITS and a periodic status is obtained for each, through resolution.

18.2-6 Rev. 2

APR1400 DCD TIER 2 18.2.2.6 Issue Tracking and Review All screened operating experience issues are included in the operating experience database.

Issues identified during the OER that are appropriate for inclusion in the other HFE program elements are entered into the ITS as HFE design inputs in the form of HEDs.

18.2.3 Results An example of an OER issue extracted from OER source data is provided in Table 18.2-1.

OER results are documented in the results summary report (ReSR).

18.2.4 Combined License Information No COL information is required with regard to Section 18.2.

18.2.5 References

1. APR1400-E-I-NR-14002-P, Operating Experience Review Implementation Plan, Rev. 2, KHNP, January 2018.

2. NUREG/CR-6400, Human Factors Engineering Insights for Advanced Reactors Based Upon Operating Experience, U.S. Nuclear Regulatory Commission, January 1997.

3. NUREG-1275, Causes and Significance of Design-Basis Issues at U.S. Nuclear Power Plants, U.S. Nuclear Regulatory Commission, 2000.

4. EPRI TR-1003090, I&C Upgrade - Implementation Experience and Perspective, Interim Report, Palo Alto, CA: Electric Power Research Institute, December 2001.

5. EPRI TR-1003322, Guidance for Incorporating Organizational Factors into Nuclear Power Plant Risk Assessments, Final Report, Palo Alto, CA: Electric Power Research Institute, December 2002.

6. EPRI TR-1003329, Template for Performing Human Reliability Analyses, Final Report, Palo Alto, CA: Electric Power Research Institute, June 2002.

7. EPRI TR-1007794, Critical Human Factors Technology Needs for Digital Instrumentation and Control and Control Room Modernization, Final Report, Palo Alto, CA: Electric Power Research Institute, March 2003.

18.2-7 Rev. 2

APR1400 DCD TIER 2

8. EPRI TR-1008122, Human Factors Guidance for Control Room and Digital Human-System Interface Design and Modification, Final Report, Palo Alto, CA: Electric Power Research Institute, November 2004.

9. OECD, Halden Reactor Project, Experimental Evaluation of the Computerized Procedure System, HWP-277, December 1990.

10. Brookhaven National Laboratory, Hybrid Human-System Interface: Human Factors Considerations, December 1996.

11. IAEA-TECHDOC-812, Control Room Systems Design in Nuclear Power Plants, International Atomic Energy Agency, July 1995.

12. OECD Specialists Meeting, Human Factors and Operation Aspects in Computerization of the Control Room: A French Safety View Based on N4 Experience, August 1999.

18.2-8 Rev. 2

APR1400 DCD TIER 2 Table 18.2-1 Example of OER Issue and Resolution for the APR1400 HSI Completion Category/No. Issues System Rationale Resolution Status (1) 1 / 70 AEOD/S92- Alarm Visual display The information Resolved 12:54 August unit (VDU) - processing system item 26, 1992, Draft based alarm (IPS) and qualified 2-A: Loss of system is not indication and alarm Annunciator available to system (QIAS) provide and Computer provide access redundant and diverse Availability to any alarm annunciator functions.

message Validation of the alarm because it is systems provides not shown on reasonable assurance the current that the operator can display page. use them effectively under all operational conditions including complete loss of the IPS and loss of a QIAS segment.

(1) Issues identified in Nuclear Regulatory Authority Documents (Analysis and Evaluation of Operational Data) 18.2-9 Rev. 2

APR1400 DCD TIER 2 Consider each OER issue identified Yes Is the issue Yes Is the issue Class 1 significantly linked Verify that each issue relevant to the HFE (High-priority to HFE related is addressed design item) safety goals No No Class 2 Verify that each issue (Medium-priority is addressed item)

Class 3 Document issue for (Low-priority future consideration item)

Re-evaluate if the HSI interface changes Figure 18.2-1 Selection Process of OER Issues 18.2-10 Rev. 2

APR1400 DCD TIER 2 18.3 Functional Requirements Analysis and Function Allocation 18.3.1 Objectives and Scope The objectives of the functional requirements analysis (FRA) of the HFE functional requirements analysis and function allocation (FRA/FA) program element of the APR1400 HFE program is to define the critical (i.e., high-level) plant functions. These must be accomplished to meet the plants safety and power production goals. The FRA also delineates the hierarchical relationships between the critical functions and the plants processes, systems, components, and control actions (i.e., success paths) responsible for performing the functions. The FA allocates the accomplishment of these functions to human and/or system resources in a manner that takes advantage of human strengths and avoids human limitations.

The FRA/FA for the APR1400 is based on the methodology and results of the functional analyses and allocation of the System 80+ predecessor design. The FRA/FA represents a complete stand-alone analysis.

18.3.1.1 Functional Requirements Analysis The FRA scope includes all of the functions needed to achieve the plant safety and power production goals. The success paths for critical safety functions (CSFs) are specified considering both safety and non-safety structures, systems, and components (SSCs). The FRA considers all operating modes (Modes 1 through 6) for normal, abnormal, and emergency conditions. The FRA is conducted to:

a. Define the critical functions that have to be accomplished to meet the plants goals

b. Delineate the hierarchical relationships between critical functions and processes, systems, components, and actions (i.e., success paths) needed to control or maintain those critical functions

c. Provide a framework for determining the allocation of success path actions to personnel and automation 18.3.1.2 Function Allocation The FA is conducted to allocate the control actions associated with each success path identified in the FRA to personnel (e.g., manual control), system elements (e.g., automatic 18.3-1 Rev. 2

APR1400 DCD TIER 2 control or passive, self-controlling resources), or combinations of personnel and system elements (e.g., shared control or automatic systems with manual backup). The FA considers all operating modes (1 through 6) for normal, abnormal, and emergency conditions. All important human actions (IHAs) are considered.

18.3.2 Methodology 18.3.2.1 Methodology for Functional Requirements Analysis The APR1400 FRA is a complete, stand-alone analysis. It encompasses and builds on the System 80+ predecessor designs evaluation of functions to account for:

a. Any changes in critical functions

b. Evolutionary design changes resulting modifications to the functional hierarchy (i.e., changes to processes, systems, and components)

c. Increased detail in the definition of the functional hierarchy to the level of control actions

d. Operating experience incurred subsequent to the System 80+ evaluation

e. Additional information need to facilitate review to the criteria of NUREG-0711 (Reference 6)

The FRA is conducted using the structured top-down methodology established for the certified predecessor design (Reference 1) and operating predecessor plants (Reference 2).

The analysis defines functions that must be carried out to meet the APR1400s safety goals and power production goals and identifies the success paths and success path control actions needed to maintain or restore those functions for different plant conditions.

The APR1400 FRA starts by defining the CSFs that must be maintained to achieve the plant safety goals. The established CSFs of predecessor PWRs (References 1 and 2) are reviewed by subject matter experts (SMEs) and confirmed or, if deemed necessary, modified. Likewise, critical power production functions of the predecessor designs are reviewed by SMEs and confirmed or modified.

After critical functions have been identified, the FRA develops a hierarchy of supporting functions including processes, systems, components, and control actions, including IHAs.

Individual branches of the hierarchy are success paths capable of maintaining each of the 18.3-2 Rev. 2

APR1400 DCD TIER 2 critical functions or restoring a critical function when required. A set of plant success paths is clearly defined for each critical safety and power production function. The breakdown or decomposition of the critical functions to specify the functional hierarchy is top down, starting from critical functions and proceeding through processes, systems, components, and control actions. The details of these supporting functions are captured in functional definition tables (FDTs). The FDTs are linked in parent-child relationships to allow the hierarchy to be traced up and down. These paths are also displayed graphically in success path resource trees. The resource trees originated with predecessor plants development of Functional Recovery Guidelines for Critical Safety Functions in CEN-152.

The concept is applied for other power production critical functions as well.

For all critical functions, the FDT identifies:

a. Purpose of the critical function

b. Conditions indicating that the critical function is needed

c. Parameters indicating that the high-level function is available

d. Parameters indicating that the critical function is operating

e. Parameters indicating that the critical function is achieving its purpose

f. Parameters indicating that the operations of the critical function can be terminated 18.3.2.2 Methodology for Function Allocation FA is the process of allocating the success path control actions identified in the FRA to one of a range of allocation configurations ranging from manual to fully automatic. A set of factors that influence the choice between system and human are used to make the allocation by characterizing each control actions relative to the factors. The factors are drawn from the principles of NUREG/CR-3331 (Reference 3). Based on the characteristics, one of a set of discrete automation configurations ranging from manual to fully automatic is selected.

The factors considered include:

a. Performance demands

b. Human and machine limitation 18.3-3 Rev. 2

APR1400 DCD TIER 2

c. Existing practices

d. Operating experience

e. Regulatory requirements

f. Technical feasibility

g. Cost The FA considers the characteristics of the function and uses those characteristics to select the appropriate automation configuration. The starting point for the selection is the System 80+ allocation analysis described in Reference 1. The control actions of the success paths are analyzed considering the selection factors and whether the characteristic of the control action favors system action or human action, or a combination of both. The methodology used is a progressive decision process based on the principles of NUREG/CR-3331, and is described in the FRA/FA Implementation Plan (Reference 4).

Based on the results of the analysis of the control action characteristics, the appropriate automation configuration is selected from five automation configurations ranging from full automation to manual operation. The selection is made based on the path traced through the progressive decisions process. The selection is recorded in the allocation table, which provides a tabular listing of all control functions and their allocation configurations.

If there are known differences between the APR1400 design and the selected allocation, an human engineering discrepancy (HED) is prepared and entered into the ITS for subsequent resolution. Additional differences between the selected allocation and the design, discovered in other elements of the HFE Program, result in HEDs from those elements.

HEDs are processed in accordance with the DCD Subsection 18.1.4. Resolution of allocation issues may result in an iteration of a portion of the FRA/FA to maintain the FRA/FA current.

The FA generates not only the primary allocations to personnel, but also considers their responsibilities to monitor automatic functions and to assume manual control in event of an automatic system failure. The operators role in executing safety functions is summarized as follows:

a. Monitor the plant to verify that the safety functions are being accomplished 18.3-4 Rev. 2

APR1400 DCD TIER 2

b. Detect degradations and failures

c. Intervene when the automatically actuated systems are not operating as intended The FA as documented in the allocation table selects the automation configuration on a action-by-action basis. To provide reasonable assurance that the overall roles of personnel are acceptable in terms of an appropriate assignment of responsibilities, the sum aggregate of a roles function is considered. This is accomplished primarily through interaction with and feedback from the TA and S&Q elements of the HFE Program.

18.3.2.3 FRA/FA Implementation The FRA/FA is implemented in accordance with the HFE FRA/FA Implementation Plan to provide:

a. Description of critical functions and success paths in the design (FDT and resource trees)

b. Identification of relevant changes from predecessor designs

c. Statement of the operators role in executing safety functions

d. Identification of all legally mandated allocations

e. Function allocation criteria

f. Rationale for assigned allocations The HED resolution process described in the HFEPP (Reference 5), provides a mechanism to track HFE feedback as the plant design progresses. As the design information becomes more detailed and complete or modified, issues relative to the HFE design are identified.

To the extent those issues impact the FRA/FA and require changes to functional requirements or allocations, the FRA/FA is updated. The FDTs are maintained current throughout the design process to provide a snapshot of functional requirements and are integrated with the overall projects configuration management and design change procedures.

An independent review by SME confirms that the FRA/FA has accomplished the following:

a. All the critical functions needed to achieve safe operation are identified.

18.3-5 Rev. 2

APR1400 DCD TIER 2

b. All requirements of each high-level function are identified.

c. The allocation of functions to human and automatic systems helps to define a role for personnel that takes advantage of human strengths and avoids human limitations.

18.3.3 Results The results of the FRA/FA are documented in the results summary report. The report includes:

a. The FRA/FA results overview, which describes the principal findings of the HFE program element, including confirmation of IHAs and an overview of any HEDs

b. An explanation of methodology used to define critical functions

c. Each FRA/FA team members name, the SME position fulfilled, and the types of FRA/FA outputs generated by that team member

d. The set of APR1400 critical functions (critical function resource trees) and reference to the FDT database

e. A summary tabular listing of all control actions and associated automation configuration (allocation table)

f. Comment and resolution record from the confirmation review

g. A detailed description of any resulting HEDs, including conflicts between FRA/FA results and the results of other HFE program elements or the APR1400 plant design

h. A conclusion that the FRA/FA program element:

1) Has been conducted in accordance with the FRA/FA IP

2) Has defined those functions that must be carried out to satisfy the plants safety goals and its goal of generating power

3) Has allocated control actions to personnel and automation in a way that takes advantage of human strengths and avoids human limitations 18.3-6 Rev. 2

APR1400 DCD TIER 2 18.3.4 Combined License Information No COL information is required with regard to Section 18.3.

18.3.5 References

1. NPX80-IC-RR790-02, Human Factors Evaluation and Allocation of System 80+

Functions, Rev. 2, February 1994.

2. CEN-152, Combustion Engineering Emergency Procedure Guidelines (CE EPGs),

Rev. 6, Combustion Engineering Inc., December 2012.

3. NUREG/CR-3331, A Methodology for Allocation of Nuclear Power Plant Control Functions to Human and Automated Control, U.S. Nuclear Regulatory Commission, June 1983.

4. APR1400-E-I-NR-14003-P, FRA/FA Implementation Plan, Rev. 2, KHNP, January 2018.

5. APR1400-E-I-NR-14001-P, Human Factors Engineering Program Plan, Rev. 2, KHNP, January 2018.

6. NUREG-0711, Human Factors Engineering Program Review Model, Rev. 3, U.S.

Nuclear Regulatory Commission, November 2012.

18.3-7 Rev. 2

APR1400 DCD TIER 2 18.4 Task Analysis 18.4.1 Objectives and Scope Task analysis (TA) is an activity of human factors engineering (HFE) that examines task requirements allocated to personnel. The HFE TA program element is performed in compliance with NUREG-0711 (Reference 1), and according to the Human Factors Engineering Program Plan (Reference 2), and the Task Analysis Implementation Plan (Reference 3).

TA identifies the tasks that are needed to accomplish the functions allocated to plant operations personnel, including the tasks required to monitor and back up automated systems. TA analyzes the information, controls, and task support requirements needed to perform these tasks.

The completed TA provides the following analytical bases for the HFE design:

a. Identifies the human-system interface (HSI) inventory to be implemented in the HFE HSI design (HD) program element

b. Establishes the number and qualifications of operations personnel for each plant operations task. Staffing for individual tasks provides input to the staffing and qualification (S&Q) program element, which examines multiple tasks as they are aggregated together for various plant scenarios.

c. Confirms the human performance assumptions for important human actions (IHAs), which are extracted from the probabilistic risk assessment (PRA),

transient and accident analysis (TAA), and diversity and defense-in-depth coping analysis (D3CA) during the HFE treatment of important human actions (TIHA) program element

d. Confirms the allocation results from the FRA/FA program element and resolves any HEDs generated during FRA/FA for allocations that are not consistent with the plant design at the time the FRA/FA is conducted

e. Establishes the basis for task support verification within HFE verification and validation (V&V) program element.

18.4-1 Rev. 2

APR1400 DCD TIER 2 TA may be conducted before or after instrumentation and control (I&C) design requirements have been established by the mechanical and I&C system designers for a specific plant system. If TA is conducted before the I&C design, then TA establishes HSI inventory requirements that are fulfilled by the plant system design. If TA is conducted after the I&C design has been developed for a specific plant system, then the TA confirms that the I&C design is acceptable to support the HSI inventory; if not, HEDs are generated as the conclusion of TA. For all plant systems, the piping and instrumentation diagrams (P&IDs) are the starting point for creating HSI indication and control designs during the HD. Any discrepancies between those HSI designs and TA are identified during V&V.

The HFEPP describes the HED resolution process.

The scope of TA includes:

- All IHAs as determined by probabilistic and deterministic means

- Tasks that were not identified as IHAs but have negative consequences if performed incorrectly

- Tasks that are new compared to those in predecessor plants, such as ones related to new systems or procedures

- Tasks that, while not new, are performed significantly differently from predecessor plants

- Tasks related to monitoring of automated systems that are important to plant safety, and the use of automated support aids for personnel, such as computer based procedures

- Tasks related to identifying the failure or degradation of automation, and implementing backup responses

- Tasks anticipated to impose high demands on personnel, e.g., little time or high workload (such as administrative tasks that contribute to work load and challenge ability to monitor the plant)

- Tasks important to plant safety that are undertaken during maintenance, tests, inspections, and surveillances 18.4-2 Rev. 2

APR1400 DCD TIER 2

- Tasks with potential concerns for personnel safety (such as maintenance tasks performed in the containment)

The TA scope additionally includes tasks performed by senior reactor operators (SROs),

reactor operators (ROs) and non-licensed operators (NLOs) in the main control room (MCR), remote shutdown room (RSR), technical support center (TSC), emergency operations facility (EOF), and local control stations (LCSs), as follows:

a. Tasks directed by normal, abnormal, emergency, and alarm response procedures from APR1400 or procedures from predecessor plants or designs, during all modes of operation, shutdown, and refueling. Abnormal procedures include the following degraded HSI conditions:

1) Continued stable operation with loss of all non-safety HSI

2) Accident mitigation and safe shutdown with only safety HSI

3) Accident mitigation and plant stabilization with concurrent common-cause failure (CCF) in digital I&C systems (as defined by the D3CA)

4) Safe shutdown from the RSR

b. Tasks required for manual control for the control actions with human allocations from the FRA/FA program element.

c. Tasks required for supervising and backing up automation for the control actions with machine allocations from the FRA/FA program element.

d. Tasks associated with issues identified in the OER program element that are assumed to be resolved by actions assigned to plant operators.

e. Tasks performed from the TSC and local control stations (LCSs) that directly support operations, or abnormal event or accident mitigation. The TA encompasses communication with operators in the MCR or RSR.

f. TA for the EOF is limited to defining the plant safety information requirements (i.e., safety parameter display system) and communication with operators in the MCR or RSR.

18.4-3 Rev. 2

APR1400 DCD TIER 2 The tasks identified in the TA scope defined above originate from other HFE program elements or plant procedures. The tasks include tasks executed with both paper and computer-based procedures. SME judgment is therefore not required in the task selection.

The following areas are evaluated by SMEs using their plant operations and simulator training experience to identify and select additional tasks that have challenged predecessor plant operating crews:

a. Surveillance, test, inspection, and maintenance, with special focus on tasks that pose potential threats to personnel safety and plant safety.

b. Operational tasks that are precursors to plant transients that are not procedure based and are not IHAs. These tasks include unusual failure modes that may not have alarm response procedures, such as spurious opening of a pressurizer spray valve and a spurious control rod withdrawal, or situations in which the operators had to revert to skill-based manual operation (e.g., low-power steam generator level control).

c. Beyond-design-basis conditions such as station blackout and severe accident

d. Tasks associated with the APR1400 fire safe shutdown analysis In addition, SMEs use their judgment and experience to identify and select tasks they believe challenge plant operations crews based on new or unique features of the APR1400 plant design, with consideration of both workload and complexity. These tasks include tasks that are performed significantly differently from predecessor plants and tasks that use new automated support aids such as computer-based procedures.

The additional tasks selected by SMEs are those that are not already encompassed by previous HFE program elements and operating procedures.

The TA is based on generic assumptions that are made to establish a plant design that is reflected in the initial APR1400 HSI design. As site specific information is known, the generic assumptions are modified. When the COL applicant performs the HFE activities, the site specific information such as the switchyard and ultimate heat sink, is applied to develop the APR1400 HSI design at the site, and the TA is updated accordingly. The updated information is ultimately reflected in the complete APR1400 HSI design for V&V.

The design implementation (DI) program element confirms the as-built design with the application of the site specific information.

18.4-4 Rev. 2

APR1400 DCD TIER 2 18.4.2 Methodology TA includes the following methods:

a. Basic task analysis is used to define HSI inventory requirements, including the characteristics of that inventory that are needed for all tasks within the scope of TA.

b. Task timing analysis (TTA) is applied to selected tasks to evaluate the operators workload and the margin between the time available for the task and the time required to perform the task. The selection criteria are described below.

18.4.2.1 Basic Task Analysis For each task, there are three distinct outputs generated during the basic task analysis:

Task Narrative For each task, a task narrative describes (in text format) the task goal (e.g., start reactor coolant pump) and what plant operations personnel need to do to accomplish the task.

The task narrative identifies the applicable plant conditions and any required precursors or permissives. The task narrative describes the required HSI inventory and also includes task support requirements, situational and performance-shaping factors, and time constraints.

HSI Inventory The HSI inventory is a compilation of detailed data in database format. It expands the HSI inventory overviewed in the task narrative to completely define the HSI inventory to a level of detail that directly leads to I&C requirements for plant system design.

Task Evaluation After completing the task narrative and HSI inventory, a task evaluation is conducted for each task if a TTA is warranted. The task evaluation determines whether a TTA is needed based on several evaluation criteria, including the following:

a. OER - The task is credited to resolve an issue identified in OER, but the TA SME cannot reach a clear conclusion from the basic task analysis that the task can be performed.

18.4-5 Rev. 2

APR1400 DCD TIER 2

b. FRA/FA - The task is conducted for a control action credited in FRA/FA to maintain or restore a critical safety function or critical power production function, but the TA SME cannot reach a clear conclusion from the basic task analysis that the task can be performed.

c. TIHA - A TTA is conducted for all IHAs.

d. Time constraint - All tasks with operational time constraints.

e. HED - A TTA is conducted for HEDs that document discrepancies between the FA results and the plant design and for any other HEDs for which the SMEs conducting the HED evaluation require the TTA to reach an HED resolution.

18.4.2.2 Task Timing Analysis A task timing analysis is conducted for selected tasks, as determined necessary by the task evaluation. The task timing analysis determines the personnel workload and the margin.

Workload Workload is evaluated on the basis of comparisons between estimates of time available for and time required by the elements of a task. The resulting fractional use of the available time an operator is actually engaged in performing the task is then compared to the predetermined acceptance criteria.

Time Margin Time margin is determined by (1) adding process delays (e.g., long valve stroke times) to the time an operator is engaged in the task, as determined during the workload analysis, to calculate the total time required to conduct the task, and then (2) subtracting that time required from the available time.

An HED is generated for any task that has an excessively high workload or insufficient time margin. HEDs generated by TA are resolved in subsequent HFE program elements through consideration of reallocation, staffing changes, and task efficiency improvements.

18.4.2.3 Results Documentation TA data are stored on a database system to allow manipulation and updating of information.

As additions are made to the database, existing portions of the analysis are updated to 18.4-6 Rev. 2

APR1400 DCD TIER 2 provide reasonable assurance of the internal consistency of the final TA results and consistency with the APR1400 design. When completed, the TA database incorporates all event sequences specified in Subsection 18.4.1 and the related results from the analysis of those sequences.

The summary of analysis results is described in the TA results summary report (ReSR).

TA is a one-time, non-recurring HFE program element whose closure is marked by the TA ReSR. However, the TA is iterative, in that HEDs generated by other HFE program elements are evaluated for any potential changes needed in the TA. Similarly, plant design changes are evaluated for their impact on the output of all HFE program elements, including TA; HEDs are generated as needed. Therefore, any TA changes that may be needed after completing the TA ReSR are managed through the HED resolution process.

HEDs that affect TA are resolved prior to completing HD, which establishes the HSI design for V&V.

After completion of V&V, site-specific changes, including any required task analysis changes, are managed within the DI program element, which is a recurring program element for each plant. DI also ensures that all HEDs are closed.

18.4.3 Results The TA results are documented in the ReSR.

The results provide input to the design of HSIs, procedures, personnel training programs, and HF V&V.

18.4.4 Combined License Information No COL information is required with regard to Section 18.4.

18.4.5 References

1. NUREG-0711, Human Factors Engineering Program Review Model, Rev. 3, U.S.

Nuclear Regulatory Commission, November 2012.

2. APR1400-E-I-NR-14001-P, Human Factors Engineering Program Plan, Rev. 2, KHNP, January 2018.

18.4-7 Rev. 2

APR1400 DCD TIER 2

3. APR1400-E-I-NR-14004-P, Task Analysis Implementation Plan, Rev. 2, KHNP, January 2018.

18.4-8 Rev. 2

APR1400 DCD TIER 2 18.5 Staffing and Qualifications 18.5.1 Objectives and Scope The objective of the human factors engineering (HFE) staffing and qualifications (S&Q) program element of the APR1400 HFE Program is to determine the number and necessary qualifications for operations personnel over the full range of plant conditions and tasks.

This section describes the analysis for the staffing and qualifications of APR1400 operators.

The main purposes of S&Q are to:

a. Establish an assumed number and qualifications of the APR1400 operations personnel that can be used as a starting point for the S&Q analysis as well as the other elements of the HFE Program.

b. Conduct an S&Q analysis of plant evolutions comprising tasks to challenge the adequacy of the initial S&Q assumption and determine the final operational staffing level and qualifications.

c. Resolve human engineering discrepancies (HEDs) from task analysis (TA), S&Q analysis, and any other HFE program element that identified issues related to the number or qualifications of operations personnel.

The S&Q scope initially includes operations performed by a senior reactor operator (SRO),

reactor operator (RO), and non-licensed operator (NLO), which are performed in the main control room (MCR), remote shutdown room (RSR), technical support center (TSC),

emergency operations facility (EOF), and local control stations (LCSs) where important human actions (IHAs) are performed; see Table 18.5-1. The S&Q for the EOF is limited to consideration of communication with operators in the MCR or RSR.

The initial staffing constraint for the MCR is described in Subsection 18.1.1.1.

The ranges of operating conditions considered for S&Q analysis cover normal, abnormal, and emergency operating conditions. In addition, the staffing numbers and qualifications are analyzed for any other plant personnel who perform tasks that are determined to be IHAs.

As the iterative analysis progresses, the design detail increases and the scope expands to plant maintenance, plant surveillance, and testing positions outside the MCR including:

18.5-1 Rev. 2

APR1400 DCD TIER 2

a. Instrumentation and control (I&C) technicians

b. Electrical maintenance personnel

c. Mechanical maintenance personnel

d. Radiological protection technicians

e. Chemistry technicians

f. Engineering support personnel 18.5.2 Methodology The goal of S&Q analysis is to determine the number and qualifications of personnel to safely operate the plant under the full range of plant conditions. The method for conducting this HFE program element consists of three sequential activities:

a. Initial S&Q assumption

b. S&Q analysis

c. Resolution of issues related to S&Q The first activity picks a starting point for S&Q analysis, as well as other HFE program elements, based on predecessor designs, operating experience review (OER), and U.S.

regulations. The initial staffing levels and qualifications are selected to satisfy the requirements of 10 CFR 50.54 (Reference 1), and applicable guidance in Subsection 13.1.2 of NUREG-0800 (Reference 2). Staffing levels and qualifications for individual tasks are received from the TA program element. The second activity uses the individual task data from the TA, aggregated to represent actual plant evolutions, to challenge the acceptability of the initial S&Q assumption and identify resulting issues via HEDs. The third activity is the resolution of staffing-related issues from the TA analysis and other HFE program elements to determine the final S&Q. The second and third activities are expanded with additional iterations periodically as the design progresses and additional issues are identified to keep the analysis current.

This staffing level is reviewed and validated through the process described in the Human Factors Engineering Program Plan (Reference 3), and using the methods described in the Staffing and Qualification Implementation Plan (Reference 4).

18.5-2 Rev. 2

APR1400 DCD TIER 2 18.5.2.1 Staffing and Qualifications Assumption An initial S&Q assumption is used as a starting point for the S&Q analysis as well as for other HFE program elements. It is specified based on the predecessor and reference plants staffing, utility's staffing policy, and government regulation. Input from OER is reviewed for any indications that the staffing issues at predecessor plants should be addressed. The assumption states the number and qualifications for licensed operators in the MCR - SROs and ROs. The assumption is subject to the staffing constraint of the HFEPP.

18.5.2.2 Staffing and Qualifications Analysis During the TA, individual tasks are analyzed and staffing numbers and qualifications determined on a per-task basis. Following the TA, S&Q examines the acceptability for plant evolutions composed of multiple tasks. The evolutions are defined from plant procedures or portions of plant procedures. For each evolution, the contributing tasks are identified and the task data aggregated. Subject matter experts (SMEs) assess the integrated impact of task data. Cases where the combinations of tasks are judged to challenge the number or qualifications of the operating staff result in human engineering discrepancies (HEDs).

The basis for the final staffing and qualifications is developed considering issues from the other HFE program elements as follows:

a. OER - As an evolutionary pressurized water reactor (PWR) design, APR1400 has been developed incorporating the success and experience accrued from prior generations of similar large two-loop PWRs. Operating experience at predecessor PWRs is reviewed as part of the OER HFE program element. The reviews include evaluation of S&Q issues. In particular, OERs that identify human performance errors that may indicate strengths or weaknesses in the predecessor S&Q are examined.

Other sources for industry operating experience feedback review include:

1) NUREG/CR-6400, Human Factors Engineering (HFE) Insights for Advanced Reactors Based upon Operating Experience (Reference 5)

2) U.S. NRC Information Notice 95-48, Results of Shift Staffing Study (Reference 6) 18.5-3 Rev. 2

APR1400 DCD TIER 2

3) U.S. NRC Information Notice 97-78, Crediting of Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times (Reference 7)

b. FRA/FA - During functional allocation, control actions are assigned to one of a set of discrete automation configurations ranging from manual to fully automatic. If the selected automation configuration is not consistent with current design goals including the staffing constraints of the HFEPP, an HED is submitted for resolution in subsequent elements of the HFE Program. Concerns specifically considered for HED resolution are:

1) Potential mismatches between functions allocated to personnel and their qualifications

2) Changes to the roles of personnel as allocated due to later design modifications

c. TA - The TA establishes staffing on a task-by-task basis. S&Q examines staffing through the combination of multiple tasks, as they are aggregated during various plant evolutions. Individual tasks are related to specific procedures or portions of procedures to identify evolutions. Evolutions are also identified from 10 CFR 50.47 (Reference 8) and procedures to implement the emergency plan (initial accident responses in key functional areas).

The cumulative set of task data is available for analysis of the evolution. Task characteristics are examined collectively for the multiple task evolutions by SMEs to make judgments regarding numbers and qualifications of staff. The characteristics from the TA used for S&Q analysis include:

1) Knowledge and abilities required

2) Relationships among tasks

3) Time required to perform the task

4) Response time limits

5) Estimated workload 18.5-4 Rev. 2

APR1400 DCD TIER 2 Additionally, tasks with common characteristics can be linked and the distribution of responsibilities to specific roles (jobs) assessed. Interactions related to diagnosing, planning, and controlling the plant are considered. Responsibilities for administrative, communications, and reporting activities are also considered in assignment of specific responsibilities.

d. Treatment of important human actions (TIHA) - S&Q reexamines the IHAs as they are aggregated in abnormal and emergency operating procedures, to:

1) Identify any times when adverse synergistic effects are created by the combination of primary tasks and secondary task

2) Include the effect of staffing levels on the performance of the identified IHAs

3) Include the effect of staffing levels on personnel coordination for IHAs The evolutions that encompass these IHAs are included in the S&Q evaluation. S&Q generates HEDs where adequate staffing cannot be confirmed to ensure successful completion of an IHA.

NUREG/CR-6753 (Reference 9) is considered in the human reliability analysis (HRA)

The TA analyzes individual tasks. An HED is generated if TA concludes a task cannot be supported by the staffing available at the plant location designated to perform the task.

Additionally, HEDs result from issues identified during the evaluation of aggregated data in the S&Q analysis. All S&Q-related issues are registered in the ITS and are reviewed and resolved following Section 4.2 of the HFEPP.

18.5.3 Results The results of S&Q activities are documented in the results summary report (ReSR). The S&Q ReSR includes the following:

a. The S&Q results overview, which describes the principal findings of the S&Q program element with tabular listing of number and qualifications of operations personnel and an overview of any HEDs

b. An explanation of the methodology used to conduct the S&Q analysis 18.5-5 Rev. 2

APR1400 DCD TIER 2

c. Each S&Q team members name, the SME position fulfilled, and the types of outputs generated by that team member

d. A summary from each SME review

e. A detailed description of any resulting HEDs

f. A conclusion that the S&Q program element:

1) Has been conducted in accordance with the S&Q IP

2) Has determined the number and qualifications of operations personnel for the full range of plant conditions and tasks, including operational tasks (under normal, abnormal, and emergency conditions), plant maintenance, plant surveillance, and testing 18.5.4 Combined License Information No COL information is required with regard to Section 18.5.

18.5.5 References

1. 10 CFR 50.54, Conditions of Licenses, U.S. Nuclear Regulatory Commission.

2. NUREG-0800, Standard Review Plan, Section 13.1.2 Operating Organization, U.S.

Nuclear Regulatory Commission, March 2007.

3. APR1400-E-I-NR-14001-P, Human Factors Engineering Program Plan, Rev. 2, KHNP, January 2018.

4. APR1400-K-I-NR-14005-P, Staffing and Qualifications Implementation Plan, Rev. 1, KHNP, February 2017.

5. NUREG/CR-6400, Human Factors Engineering Insights for Advanced Reactors Based Upon Operating Experience, U.S. Nuclear Regulatory Commission, January 1997.

6. Information Notice 95-48, Results of Shift Staffing Study, U.S. Nuclear Regulatory Commission, October 10, 1995.

18.5-6 Rev. 2

APR1400 DCD TIER 2

7. Information Notice 97-78, Crediting of Operator Actions In Place of Automatic Actions and Modifications of Operator Actions, Including Response Times, U.S.

Nuclear Regulatory Commission, October 23, 1997.

8. 10 CFR 50.47, Emergency Plans, U.S. Nuclear Regulatory Commission.

9. NUREG/CR-6753, Review of Findings for Human Performance Contribution to Risk in Operating Events, U.S. Nuclear Regulatory Commission, August 2001.

18.5-7 Rev. 2

APR1400 DCD TIER 2 Table 18.5-1 Staffing and Qualification Assumptions for the APR1400 MCR Title Number of Operators Qualification Shift supervisor 1 Senior reactor operator Shift technical advisor 1 Senior reactor operator Reactor operator 1 Reactor operator Turbine operator 1 Reactor operator Electric operator 1 Reactor operator 18.5-8 Rev. 2

APR1400 DCD TIER 2 18.6 Treatment of Important Human Actions 18.6.1 Objectives and Scope The identification of important human actions (IHAs) is based on a combination of probabilistic insights from the probabilistic risk assessment (PRA) and human reliability analysis (HRA) and deterministic insights from Chapters 7 and 15. IHAs are integrated into the HFE program and the HSI design process so that personnel errors are minimized and their detection and recovery capabilities are enhanced.

The objective of the human factors engineering (HFE) treatment of important human actions (TIHA) program element is to create a consolidated list of IHAs, including the HFE characteristics assumed for those actions, as extracted from APR1400 plant-level analyses.

The process for creating this list of IHAs and assumptions is described in the TIHA Implementation Plan (Reference 1). The IP also provides an overview of how IHAs are addressed in subsequent APR1400 HFE program elements per NUREG-0711 (Reference 2).

The details of how IHAs are treated are provided in the IPs for each of the HFE programs elements.

The scope of IHAs includes risk-important human actions (RIHAs) identified by the PRA (DCD Chapter 19), and deterministically important human actions (DIHAs), which are the credited manual actions from the transient and accident analysis (DCD Chapter 15), and the credited manual actions from the diversity and defense-in-depth (D3) analysis of the instrumentation and control (I&C) design process (DCD Chapter 7).

All IHAs are addressed in functional requirements analysis and function allocation (FRA/FA), task analysis (TA), staffing and qualifications (S&Q) analysis, human-system interface (HSI) design, procedure development, human factors (HF) verification and validation (V&V), design implementation (DI) and training program development to ensure that the design supports IHAs to minimize human error and to enhance detection and recovery capability. These HFE program elements confirm the HFE characteristics assumed for the IHAs in the plant analyses, design the HSI to support the IHAs, and then confirm that the HSI design facilitates achieving acceptable human performance.

18.6.2 TIHA Methodology The TIHA identifies risk-important human actions (RIHAs) and deterministic important human actions (DIHAs) as follows:

18.6-1 Rev. 2

APR1400 DCD TIER 2

a. RIHAs The list of RIHAs is developed from the analysis results of Chapter 19. RIHAs are those that have a significant impact on plant risk. These actions are identified from the Level 1 and Level 2 PRAs for internal and external events of all operating modes. The RIHAs are identified using more than one importance measure and an HRA sensitivity analysis to provide reasonable assurance that an important action is not overlooked because of the selection of the measure or the use of a particular assumption in the analysis. For each RIHA, the PRA identifies assumptions regarding factors that lead to human performance error probability, including the action location, time available to take the action, and action complexity.

RIHAs and associated HFE characteristics are identified and extracted from the PRA for inclusion in the TIHA results summary report (ReSR). I&C engineering subject matter experts (SMEs) will coordinate with personnel who have PRA/HRA knowledge to extract the RIHAs from the PRA.

b. DIHAs DIHAs are identified from the D3 (Chapter 7) and transient accident analysis (TAA) (Chapter 15). Operator actions directly credited to mitigate an accident and achieve plant stabilization, as identified for any accident examined in the TAA or D3, are considered DIHAs. These manual actions are credited because automatic actions, such as reactor trip (RT) and engineered safety features (ESF) actuation, are not triggered. Operator actions needed to maintain a stable plant condition for the long term are not DIHAs, even though they may be identified in the TAA or D3.

A plant operations or systems safety engineering SME reviews the TAA and D3 to extract the DIHAs. DIHAs are listed in the TIHA ReSR along with the assumed HFE characteristics, including the time available and time required to execute these actions, as documented in the TAA and D3.

The RIHAs and the resulting list of DIHAs are combined into one list of IHAs that are then applied to the HFE program.

18.6-2 Rev. 2

APR1400 DCD TIER 2 18.6.3 Results The TIHA ReSR includes the list of IHAs and their corresponding HFE characteristics, as extracted from the PRA, TAA, and D3.

TIHA is a one-time, non-recurring HFE program element whose closure is marked by the TIHA ReSR. Plant analysis changes are evaluated for their impact on the output of all HFE program elements, including TIHA; human engineering discrepancies (HEDs) are generated as needed. Therefore, any changes in the TIHA results that may be needed after completing the TIHA ReSR are managed through the HED resolution process.

After completion of APR1400 HF V&V, site-specific changes, including any required changes to the TIHA, are managed within the DI program element, which is a recurring program element for each plant.

18.6.4 Combined License Information No COL information is required with regard to Section 18.6.

18.6.5 References

1. APR1400-E-I-NR-14006-P, Treatment of Important Human Actions Implementation Plan, Rev. 2, KHNP, January 2018.

2. NUREG-0711, Human Factors Engineering Program Review Model, Rev. 3, U.S.

Nuclear Regulatory Commission, November 2012.

18.6-3 Rev. 2

APR1400 DCD TIER 2 18.7 Human-System Interface Design 18.7.1 Objectives and Scope The objective of the human factors engineering (HFE) human-system interface design (HD) program element is to translate plant instrumentation and control (I&C), function, and task requirements into the functional designs of the APR1400 human-system interface (HSI) and APR1400 HSI facilities, through the systematic application of HFE principles and criteria.

The APR1400 HSI facilities within the scope of HD are the main control room (MCR),

remote shutdown room (RSR), technical support center (TSC), and local control stations (LCSs) associated with important human actions (IHAs). The emergency operations facility (EOF) is in the scope of the COL applicant; therefore, the EOF is outside the scope of the HD.

HSI resources are controls, alarms, information displays, and operating procedures. HD includes the detailed functional design of the APR1400 basic HSI and APR1400 HSI.

The APR1400 basic HSI establishes the generic indication, alarm, control, and procedure methods applied to all systems and functions controlled from the MCR and RSR. The detailed design for the APR1400 basic HSI is an extension of the conceptual design described in the APR1400 Basic HSI Technical Report (TeR) (Reference 1). The APR1400 basic HSI includes generic methods applied to computer-based procedures (CBPs), critical function monitoring (CFM), success path monitoring, accident monitoring, and bypassed and inoperable status indication (BISI). These same HSI methods apply to the safety parameter display system (SPDS) indications provided in the MCR and the TSC.

The APR1400 basic HSI also defines indication, alarm, and control methods for LCSs associated with IHAs.

The APR1400 HSI establishes the specific soft and conventional indications, alarms, controls, and operating procedures that encompass the HSI inventory defined by task analysis (TA) and plant system designs, within the generic HSI methods defined by the APR1400 basic HSI.

The complete integration of APR1400 HSI and APR1400 HSI facilities is referred to as the APR1400 HSI design. The end product of HD is the complete functional design of the 18.7-1 Rev. 2

APR1400 DCD TIER 2 APR1400 HSI design, which is then implemented in the detailed designs of HSI hardware, software, and physical facilities by APR1400 engineers in multiple disciplines.

The APR1400 HSI design is then formally verified and validated in the HF V&V program element through high-fidelity simulation. Therefore, a key purpose of HD is to ensure that its end product (i.e., the APR1400 HSI design) reflects the resolution of all HEDs generated in previous HFE program elements, and the resolutions of any HEDs that may have been generated during HD.

HD conforms to the acceptance criteria of NUREG-0711 (Reference 2), (i.e., the APR1400 HSI design).

18.7.2 Methodology The HFE program elements described in Sections 18.2, 18.3, 18.4, 18.5, and 18.6 generate outputs that provide input to HD. The APR1400 basic HSI, including its Style Guide (Reference 3), has been developed to encompass each HSI resource and thereby facilitate the standard and consistent application of HFE principles to the design.

Issues related to the detailed functional design of the APR1400 basic HSI and specific aspects of the APR1400 HSI are resolved during HD tests and evaluations rather than during V&V.

The HD Implementation Plan (Reference 4) provides a detailed description of the methodology used to develop the detailed functional designs for:

a. APR1400 basic HSI

b. APR1400 HSI

c. APR1400 HSI facilities 18.7.2.1 HSI Design Input The analyses that are conducted prior to HD are used to identify HSI requirements. The analyses include the following:

a. Operating experience review (OER) - Lessons learned from other complex HSI systems, especially predecessor designs and designs involving similar HSI technology, are used as input to the APR1400 HSI design. OER evaluates past 18.7-2 Rev. 2

APR1400 DCD TIER 2 human performance issues to ensure they are resolved in the APR1400 HSI design, known at the time OER is conducted. OER generates HEDs for unresolved issues.

b. Functional requirements analysis and function allocation (FRA/FA) - HSIs support the operators role (e.g., appropriate levels of automation and manual control). The critical functions and success paths defined by FRA/FA establish the basis of the APR1400 basic HSI features intended to facilitate plant-level situation awareness. These include the large display panel (LDP) and graphical displays and alarms for critical function monitoring (CFM) and success path monitoring (SPM).

c. TA - HSI requirements to support the role of personnel are provided by TA. TA encompasses tasks that are necessary to control the plant for the full range of operating conditions, from normal through accident conditions, during normal and degraded HSI conditions. This includes the tasks necessary to execute the IHAs identified through TIHAs. TA generates detailed information and control requirements (ICRs) (e.g., requirements for display range, precision, accuracy, units of measurement) that are implemented during HD in the APR1400 HSI.

TA generates task support requirements (e.g., special lighting, ventilation requirements) that are implemented during HD in the APR1400 HSI facilities.

d. Staffing and qualifications (S&Q) - The APR1400 staffing constraints provide input for the layout of the APR1400 HSI facilities and the allocation of controls and displays to individual consoles, panels, and workstations as defined by the APR1400 basic HSI. These constraints establish the minimum and maximum number of personnel to be accommodated and requirements for coordinating activities between personnel. TA establishes staffing for each task, and thereby confirms these staffing constraints. While this is done in TA on a task-by-task basis, S&Q establishes staffing (again confirming these constraints) by aggregating tasks for various plant modes and scenarios. HD accommodates task execution through features that simplify management of the HSI, such as task-based displays, and facility features to enhance crew interaction, such as work area partitions, conferencing tables, and plant-wide communications.

18.7-3 Rev. 2

APR1400 DCD TIER 2

e. Plant system requirements - I&C requirements defined by plant system designs and constraints imposed by the overall I&C system are significant inputs for the HSI design and are considered throughout the HSI design process.

The HSI requirements defined by TA are reflected in the I&C components of the plant system designs. Therefore, the piping and instrumentation diagrams (P&IDs) and plant system descriptions are the starting point for creating the APR1400 HSI during HD.

I&C systems, such as the engineered safety features-component control system (ESF-CCS), comply with regulatory requirements for redundancy and independence that tend to discourage HSI integration that might otherwise benefit human performance. Therefore, the APR1400 basic HSI, which is fully developed during HD, reflects a balance between I&C design regulatory constraints and HFE optimization.

f. Predecessor Plants and Designs - Since the APR1400 is an evolutionary plant, HD evaluates the HSI design from predecessor plants and predecessor designs for applicability to APR1400. Changes are made to reflect changes in the basic HSI, plant design, input from previous HFE program elements, and changes in regulatory compliance.

g. Regulatory and other requirements - Certain regulatory requirements and industry standards establish requirements that are directly applicable to the APR1400 HSI design. These include requirements for:

1) Safety parameter display system - 10 CFR 50.34(f)(2)(iv) (Reference 9)

2) Bypassed or inoperable status indication - Regulatory Guide (RG) 1.47 (Reference 10)

3) Accident monitoring instrumentation - RG 1.97 (Reference 11)

4) Alarms for credited manual operator actions - Staff Requirements Memorandum (SRM) on SECY 93-087 (Reference 12)

5) Coping with common-cause failures - SRM on SECY 93-087, and BTP 7-19 (Reference 13) 18.7-4 Rev. 2

APR1400 DCD TIER 2

6) Manual initiation of protective actions - RG 1.62 (Reference 14)

7) Safe shutdown from outside the MCR - GDC 19 of 10 CFR Part 50, Appendix A (Reference 15)

8) Computerized procedures - Section 1 of DI&C-ISG-05 (Reference 16)

9) Technical support center - NUREG-0696 (Reference 17) and NUREG-0737, Supplement 1 (Reference 18)

10) Emergency operations facility - NUREG-0737, Supplement 1 (Reference 18)

These requirements are reflected in the APR1400 basic HSI, the APR1400 HSI, and the APR1400 HSI facilities, as applicable.

18.7.2.2 Concept of Operations The concept of operations considers the following items and is developed and used during the HSI design process:

a. Crew composition

b. Roles and responsibilities of individual crew members

c. Personnel interaction with plant automation

d. Use of control room resources by crew members

e. Coordination of crew member activities The concept of operations is described in the HD IP.

18.7.2.3 Functional Requirements Specification During the design process, functional requirements including concept of operation and system functions are established for HSI resources including alarms, displays, controls, and procedures.

The functional requirements applicable to the methods for all HSI resources are described in the APR1400 basic HSI TeR. The functional specifications developed for the detailed 18.7-5 Rev. 2

APR1400 DCD TIER 2 design of the APR1400 basic HSI and for each HSI resource of the APR1400 HSI and for the APR 1400 facilities are described in the HD IP.

18.7.2.4 HSI Concept Design The Shin-Kori (SKN) 3&4 basic HSI is the predecessor design for the APR1400 basic HSI.

During the development of the conceptual design for the SKN 3&4 basic HSI, the designs used in other advanced reactor plants including System 80+, French N4, and Japanese Advanced Pressurized Water Reactor (APWR) were surveyed and reviewed to establish the SKN 3&4 basic HSI. The requirements of the Electric Power Research Institute (EPRI)

Utility Requirements Document (Reference 5) and technical trends of nuclear power plant advanced control rooms indicated the need for the transition toward a redundant compact operator console type of control room design for SKN 3&4.

From this design concept, HSI resources, their basic characteristics, and an initial MCR layout were identified.

The SKN 3&4 basic HSI has the following resources:

a. LDP

b. Integrated alarm system

c. Visual display unit (VDU) based information display

d. CBPs

e. Soft control

f. Safety console These control room resources, reflected in the SKN 3&4 basic HSI, define how the HSI supports operator performance. Evaluations and analyses with the use of a full-scope simulator and Korean plant operators demonstrated the adequacy of the SKN 3&4 HSI design.

The APR1400 basic HSI is the same as the SKN 3&4 basic HSI in all areas except the following: For SKN 3&4, safety components are normally controlled through multidivision operator consoles. For APR1400, safety components are normally controlled through separate operator consoles for each safety division.

18.7-6 Rev. 2

APR1400 DCD TIER 2 HD testing with full-scope dynamic simulation and licensed U.S. operators confirms the acceptability of the APR1400 basic HSI, including these changes from SKN 3&4.

18.7.2.5 HSI Detailed Design and Integration The HSI Style Guide contains the HSI resources to facilitate the standard and consistent application of HFE principles to the design. The Style Guide contains the standards and conventions that are produced by tailoring generic HFE guidance to the design of the HSI and defines how the HFE principles are applied. The HFE guidelines in NUREG-0700 (Reference 6) are included in the Style Guide.

Conformance to the Style Guide is confirmed during HFE design verification, which is conducted during V&V.

A design specification and a detailed design (e.g., display graphic, alarm-processing algorithm) will be produced for each HSI resource as a product of the detailed design process of the APR1400 HSI. The design specification is documented to develop the particular display or algorithm, including the functional and task requirements.

Overview of HSI Design and Key HSI Resources The monitoring and control resources used in the HSI and their major characteristics are described as follows:

Large Display Panel

a. The LDP is legible not only from the operator consoles but also from the expected locations of observers or support personnel in the MCR.

b. Selected parameters and component status that represent the critical safety functions and critical power production functions, and their preferred normal and emergency success paths, are provided through spatially dedicated continuously visible (SDCV) indications.

c. Plant-level alarms that indicate the performance of the critical functions are provided in the LDP alarm tiles.

18.7-7 Rev. 2

APR1400 DCD TIER 2

d. BISI at the system level is provided for a continuous indication of the bypassed and inoperable status of the engineered safety features (ESF) related process system.

e. System-level alarms and component-level alarms of high priority are provided.

f. Operators can display any format that is available at information displays on the variable display area.

Console Information Display Hierarchy

a. The console information display is an integrated presentation of the plant process information. The operator console information display provides access to displays incorporating system and component status, process parameters, and alarm status and acknowledgement.

b. The information display permits selectable access to any display page on the same VDU.

c. The console information display permits selection of display pages in other VDUs within the same operator console.

d. The console information display permits selection of component controllers or process controllers at the associated soft control display.

e. The console information display permits acknowledgement of alarms.

f. The console information display can be displayed in the variable area of the LDP.

g. The SPDS display pages that are integrated in the operator console information display.

Soft Control

a. Soft control is used to control the system and components of the component control system, power control system, and turbine-generator control system.

b. Soft control provides both continuous process control and discrete component control.

18.7-8 Rev. 2

APR1400 DCD TIER 2

c. Soft control permits the selection of auto/manual modes, control signals, and setpoints.

d. Soft control provides displays of all related information being controlled.

e. All non-safety components can be controlled from non-safety console information displays. Safety components can be selected for control from those same displays; however, actual control actions are activated from separate flat panel display units for each safety division.

Alarms

a. An alarm list grouped by priority is provided in the operator console information display.

b. An alarm list grouped by time of occurrence is provided in the operator console information display.

c. Alarm acknowledgement is possible either at the information display in operator consoles or at the qualified indication and alarm system-non-safety (QIAS-N) displays in the safety console.

d. Alarms are presented in one of the following three states: new, existing, or cleared.

e. Alarms are prioritized and presented so that operator responses can be made based on importance or urgency.

f. The alarm system is designed to minimize the number of alarms using alarm reduction methods.

g. The alarm processing and control at information processing system (IPS) is diverse and independent of that of the QIAS-N.

Computer-Based Procedure (CBP) Display

a. The CBP provides an overview pane where the current operation step as well as past and future steps of the procedure are presented.

b. The CBP provides detailed instructions of the current step.

18.7-9 Rev. 2

APR1400 DCD TIER 2

c. The CBP provides an integrated presentation of process information and the instructions.

d. The CBP supports the concurrent execution of multiple procedures.

e. The CBP supports retrieving procedures.

f. The CBP facilitates cross-referencing other procedures or other steps within the procedure.

g. The CBP keeps track of the step execution status.

h. The CBP monitors the conditions related to the continuously applied steps.

Hard-copy procedures, which are used when the CBP is not available, are consistent with the displays.

The APR1400 basic HSI TeR describes the overall HSI design concept and rationale for key resources of the HSI design such as information display, soft controls, computer-based procedures, alarm processing, and control room layout.

Safety Aspects of the HSI The safety aspects of the HSI are as follows:

a. Safety function monitoring (e.g., safety parameter display system)

b. Periodic testing of protection system actuation functions

c. BISI for plant safety systems

d. Manual initiation of protective actions

e. Instrumentation required to assess plant and environmental conditions during and following an accident

f. Set-points for safety instrumentation

g. HSIs for the emergency response facilities (TSC and EOF, where TSC and EOF use identical technologies) 18.7-10 Rev. 2

APR1400 DCD TIER 2 Minimum Inventory Control The minimum inventory controls are conventional SDCV safety and non-safety component controls required during emergency operating procedure (EOP) execution. Minimum inventory controls provide defense against operator console failure. The minimum inventory controls are selected from the results of TA to identify all controls necessary to perform the tasks required for EOP execution.

System-level Controls Reactor trip (RT) and engineered safety features (ESF) system-level actuation switches are provided to execute RT and ESF system-level actuation. Four channels of switches are provided at the safety console, with two-out-of four initiation for each function. These switches are provided primarily to give operators the ability to take preemptive manual actions for degrading plant conditions. The switches also provide backup initiation to accommodate failures in some portions of the automated RT and ESFAS initiation functions.

Diverse HSI To accommodate common-cause failure (CCF) of all digital safety functions, including automation and HSI, diverse automation and HSI are provided. The scope of the diverse functionality is less than the digital safety functionality, because an accident with concurrent CCF is a beyond-design-basis event. This regulatory classification allows less conservative analysis methods and acceptance criteria, which requires less automation and less HSI to maintain plant safety.

The diverse HSI is fulfilled by (1) the diverse indication system that includes soft displays with key parameters to monitor the critical safety functions, and (2) diverse manual actuation switches, which allow operators to take the necessary manual actions to mitigate accidents and maintain hot shutdown, and to actuate plant systems to control the critical safety functions.

HSI Change Process During the design process, all changes are controlled through the Korea Hydro & Nuclear Power Co., Ltd. (KHNP) Quality Assurance Program Description for the APR1400 Design Certification (Reference 7), and are under the HFEPP (Reference 8).

18.7-11 Rev. 2

APR1400 DCD TIER 2 18.7.2.6 HSI Tests and Evaluations Testing and evaluation of HSI designs are conducted throughout HD and are performed iteratively. Testing is conducted with part-task or full-scope simulation, as applicable, using U.S. licensed operators. HD testing provides high confidence that the APR1400 HSI design, which is simulated for integrated system validation during V&V, will result in acceptable human performance.

The simulations for HD tests are constructed and the methodology including test beds, performance measures and criteria, study participants, test design, and data analysis is developed to identify problems and find resolutions that are not readily achieved without simulating operation scenarios. The simulations are also used for testing problem resolutions that are developed based on iterative evaluations.

Three-dimensional (3-D) models are used during HD to examine and verify physical layout aspects such as the availability of workspace, physical access, visibility, and related anthropometric issues. Walk-through exercises are performed using the 3-D models to examine issues such as crew coordination and procedure usage.

18.7.3 Results The results of the HSI design are documented in the results summary report (ReSR).

HD is a one-time, non-recurring HFE program element whose closure is marked by the HD ReSR. The APR1400 HSI design generated by HD is the end product used for V&V.

Any HEDs generated during subsequent V&V are evaluated during V&V or design implementation (DI) for any potential changes needed in the APR1400 HSI design. Those changes are managed through the HED resolution process.

After completion of the HF V&V, site-specific changes, including any required HSI design changes, are managed within the DI program element, which is a recurring program element for each APR1400 plant. DI also ensures that all HEDs are closed.

18.7.4 Combined License Information No COL information is required with regard to Section 18.7.

18.7-12 Rev. 2

APR1400 DCD TIER 2 18.7.5 References

1. APR1400-E-I-NR-14011-P, Basic Human-System Interface, Rev. 2, KHNP, January 2018.

2. NUREG-0711, Human Factors Engineering Program Review Model, Rev. 3, U.S.

Nuclear Regulatory Commission, November 2012.

3. APR1400-E-I-NR-14012-P, Style Guide, Rev. 2, KHNP, January 2018.

4. APR1400-E-I-NR-14007-P, Human-System Interface Design Implementation Plan, Rev. 2, KHNP, January 2018.

5. EPRI Utility Requirements Document, Man-Machine Interface Systems, Vol. II.

Chapter 10, Rev. 10, Electric Power Research Institute, 2008.

6. NUREG-0700, Human-System Interface Design Review Guidelines, Rev. 2, U.S.

Nuclear Regulatory Commission, May 2002.

7. APR1400-K-Q-TR-11005-NP, KHNP Quality Assurance Program Description (QAPD) for the APR1400 Design Certification, Rev. 5, KHNP, April 2016.

8. APR1400-E-I-NR-14001-P, Human Factors Engineering Program Plan, Rev. 2, KHNP, January 2018.

9. 10 CFR 50.34(f)(2)(iv), Safety Parameter Display System, U.S. Nuclear Regulatory Commission.

10. Regulatory Guide 1.47, Bypassed and Inoperable Status indication for Nuclear Power Plant Safety Systems, Rev. 1, U.S. Nuclear Regulatory Commission, February 2010.

11. Regulatory Guide 1.97, Criteria for Accident Monitoring Instrumentation for Nuclear Power Plants, Rev. 4, U.S. Nuclear Regulatory Commission, June 2006.

12. SRM on SECY 93-087, Alarms for Credited Manual Operator Actions, U.S. Nuclear Regulatory Commission, July 1993.

13. NUREG-0800, Standard Review Plan, BTP 7-19, Guidance for Evaluation of Diversity and Defense-In-Depth in Digital Computer-Based Instrumentation and Control Systems, Rev. 6, U.S. Nuclear Regulatory Commission, July 2012.

18.7-13 Rev. 2

APR1400 DCD TIER 2

14. Regulatory Guide 1.62, Manual Initiation of Protective Actions, Rev. 1, U.S.

Nuclear Regulatory Commission, June 2010.

15. 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants, U.S.

Nuclear Regulatory Commission.

16. DI&C-ISG-05, Digital Instrumentation and Controls, Rev. 1, U.S. Nuclear Regulatory Commission, 2008.

17. NUREG-0696, Functional Criteria for Emergency Response Facilities, U.S. Nuclear Regulatory Commission, 1981.

18. NUREG-0737, Clarification of TMI Action Plan Requirements, Supplement 1, U.S.

Nuclear Regulatory Commission, 1982.

18.7-14 Rev. 2

APR1400 DCD TIER 2 18.8 Procedure Development 18.8.1 Objective and Scope The objective of this section is to apply human factors engineering (HFE) processes and principles to develop plant procedures that are technically accurate, understandable, easy to use, and validated. The development plan and scope of procedures are described in Section 13.5.

18.8.2 Methodology The scope and contents of the APR1400 plant operating procedures are addressed in Section 13.5.

The following HF aspects are considered during the procedures development as described in Section 9.4 of NUREG-0711 (Reference 1):

a. Task analysis (TA) results

b. Treatment of important human actions (TIHAs) results 18.8.3 Results No results are required for this section.

18.8.4 Combined License Information No COL information is required with regard to Section 18.8.

18.8.5 References

1. NUREG-0711, Human Factors Engineering Program Review Model, Rev. 3, U.S.

Nuclear Regulatory Commission, November 2012.

18.8-1 Rev. 2

APR1400 DCD TIER 2 18.9 Training Program Development 18.9.1 Objective and Scope The objective of this section is to apply human factors engineering (HFE) aspects systematically during the development of the plant personnel training program. The approach described in this section is consistent with the information in Section 13.2.

18.9.2 Methodology The approach to training program development follows the applicable guidance and requirements in 10 CFR 55.4 (Reference 1), 10 CFR 52.78 (Reference 2), 10 CFR 50.120 (Reference 3), and NUREG-0711 (Reference 4). The approach includes the five elements related to training program development: (1) organization of training, (2) learning objectives, (3) content of the training program, (4) evaluation and modification of training, and (5) periodic retraining as described in Section 10.4 of NUREG-0711.

18.9.3 Results No results are required for this section.

18.9.4 Combined License Information No COL information is required with regard to Section 18.9.

18.9.5 References

1. 10 CFR 55.4, Definitions, U.S. Nuclear Regulatory Commission.

2. 10 CFR 52.78, Contents of Applications; Training and Qualification of Nuclear Power Plant Personnel, U.S. Nuclear Regulatory Commission.

3. 10 CFR 50.120, Training and Qualification of Nuclear Power Plant Personnel, U.S.

Nuclear Regulatory Commission.

4. NUREG-0711, Human Factors Engineering Program Review Model, Rev. 3, U.S.

Nuclear Regulatory Commission, November 2012.

18.9-1 Rev. 2

APR1400 DCD TIER 2 18.10 Human Factors Verification and Validation 18.10.1 Objectives and Scope The human factors (HF) verification and validation (V&V) program element is performed to confirm that the human-system interface (HSI) design conforms to human factors engineering (HFE) design principles and that it enables plant personnel to successfully perform tasks to achieve plant safety and other operational goals.

The HF V&V of the HSI design demonstrates operator task performance capabilities and the capabilities to perform operator functions. All HF V&V activities are performed according to the HF V&V Implementation Plan (Reference 1).

The IP applies to all HSIs in the main control room (MCR), remote shutdown room (RSR),

and voice communications when it influences the MCR crews performance, between the MCR and the technical support center (TSC), emergency operations facility (EOF), and other offsite emergency entities. The HF V&V also includes the HSIs on local control stations (LCSs) associated with the important human actions (IHAs).

The HF V&V consists of the following steps:

(1) Sampling of operational conditions (2) Design verification (3) Integrated system validation (ISV)

(4) Human engineering discrepancies (HEDs)

(5) Documentation of results of the HF V&V program Design verification is composed of HSI inventory and characterization, task support verification, and HFE design verification.

The HFE design verification uses the Style Guide (Reference 2) and the ISV uses HF V&V scenarios (Reference 3) as supporting technical reports.

The task support verification, HFE design verification, and ISV are performed using implementation procedures.

18.10-1 Rev. 2

APR1400 DCD TIER 2 The first step, sampling of operational conditions, identifies the conditions that (1) are representative of the range of events that could be encountered during the plants operation, (2) reflect the characteristics expected to contribute to variations in the systems performance, and (3) consider the safety significance of HSIs.

As part of the design verification, step two, an HSI inventory and characterization is performed to accurately describe all HSI displays, controls, and related equipment within the scope as defined by the sampling of operational conditions. The HSI task support verification verifies that the HSI provides the needed alarms, information, controls, and task support defined by task analysis (TA) for personnel to perform their tasks as identified by the HSI inventory resulting from the TA. The HFE design verification verifies that the HSI designs conform to the Style Guide.

The third step, ISV and HED resulting from HF V&V resolution, validates, through dynamic testing, that the integrated system design (e.g., hardware, software, procedures, and personnel elements) supports the safe operation of the plant.

The fourth step, HED resolution (1) documents, tracks, and evaluates HEDs to determine whether they require corrections, (2) identifies design solutions to address HEDs that require correction, and (3) verifies the completed implementation of the HED design solutions.

Step five is the documentation of the results of the HF V&V in the results summary report (ReSR).

18.10.2 Methodology 18.10.2.1 Sampling of Operational Conditions Sampling of operational conditions identifies the range of operational conditions for implementation in all HF V&V activities.

The purpose of sampling of operational conditions is to select representative operational conditions that may occur during the lifetime of the plant and to reflect the characteristics (including the HSI) that may affect system performance. The sampling supports determination of adequacy of the task scope for HF V&V of the three types of HFE activities: HSI task support verification, HFE design verification, and ISV.

A multidimensional sampling strategy is therefore adopted in the HF V&V IP.

18.10-2 Rev. 2

APR1400 DCD TIER 2 The multidimensional sampling strategy includes:

a. Plant conditions including normal operations, abnormal operations, and transients and accident conditions

b. Personnel tasks including all IHAs, results from the operating experience review (OER), manual activation of protective actions, monitoring of automated systems, procedure-guided tasks, knowledge-based tasks, cognitive activities, and team interactions

c. Situational factors known to challenge human performance including high workload, varying workload, fatigue, and environmental factors HF V&V scenarios are defined based on the sampling strategy and the operational conditions.

Operational conditions do not include situations when operators are expected to demonstrate high performance in carrying out the tasks, when tasks are relatively easy to perform, and when operators are expected have a high degree of familiarity with the tasks as a result of continuous training.

Scenarios are defined in accordance with the following:

a. The scenario is designed to be operated in sequence.

b. Each scenario is designed to have a different sequence (e.g., if the sequence of one scenario is normal-abnormal-emergency-safe shutdown, the sequence of another scenario may be normal-emergency-function recovery).

c. Each sequence includes, at a minimum, plant normal and abnormal operating modes including malfunctions. Malfunctions are designed to take place in the first part of the sequence and the scenario includes the tasks that are required of each operator, as well as the operation of safety components.

d. Each scenario is designed to enable participants to operate various systems and components of the plant systems.

e. Each scenario includes events and accidents that are required to operate a number of controls are included in the scenario.

18.10-3 Rev. 2

APR1400 DCD TIER 2

f. Each scenario includes an event and accident to comprehensively evaluate the task performance of each member of a crew team.

g. Each scenario is designed to generate a single alarm and also a number of simultaneous alarms.

h. Each scenario is designed so that it is difficult for operators to comprehend the event sequence.

i. Each scenario includes an accident that is designed to be controlled by safety systems:

1) Plant control tasks are designed to call up many displays of the primary and secondary systems through the information flat-panel display (IFPD).

2) When a number of alarms occur simultaneously, they are designed to include various types of alarms, including priority 1, 2, and 3 alarms.

3) Plant monitoring tasks are designed to call up many displays of the primary and secondary systems through the IFPD.

4) Each test scenario includes tasks involving the operation of soft controls such as on/off, start/stop, set-point control, and auto/manual mode selection.

5) A number of control tasks that are subject to urgent action in a timely manner are included in the scenarios.

6) Tasks to operate a group control within a limited time frame are included in the scenarios.

7) Each scenario includes tasks requiring a sequence of control for two or more systems and components.

8) The scenarios include an accident or postulated accident that is necessary to be able to evaluate IHAs.

9) Scenarios are designed to be completed in between 1 and 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

18.10-4 Rev. 2

APR1400 DCD TIER 2 18.10.2.2 Design Verification Design verification is a method that is used to determine that the HSI design meets task and human requirements. Verification activities require a characterization of the HSI.

Design verification is performed in accordance with the review criteria of NUREG-0711 (Reference 4). The design verification criteria are described in the HF V&V Implementation Plan.

Design verification consists of the following activities:

a. HSI inventory and characterization - Description of all HSI displays, controls, and related equipment within the scope defined by sampling of operational conditions

b. HSI task support verification - Evaluation of whether the designed HSI provides all alarms, information, control, and task support capabilities required for personnel tasks

c. HFE design verification - Evaluation of whether the characteristics of the HSI and the environment in which it is used conform to the Style Guide HSI Inventory and Characterization The objective of the HSI inventory and characterization is to identify the HSI inventory and characterizations required to operate the power plant and to provide input to the HSI task support verification and HFE design verification. In order to achieve this objective, various design documents are analyzed, and the results are compared with the HSI final design content.

The scope of the HSI inventory and characterization is to identify all HSI inventory and characterizations necessary for plant operation within the operational conditions that were selected for sampling. The HSI inventory and characterization includes information relevant to using the HSI resources and the navigational method of searching for interface information.

HSI Task Support Verification As part of the design verification process, the purpose of task support verification is to verify that alarms, controls, and displays identified during the TA are available, and to 18.10-5 Rev. 2

APR1400 DCD TIER 2 verify that all HSI (e.g., alarms, controls, and displays) that is needed to carry out the operator tasks is provided in the HSI design. Task support verification includes input data from the HSI inventory and characterization and task support items identified from the TA.

HSI task support verification items are collected from the HSI inventory and characterization among the selected operational conditions and the task support items (e.g.,

special and protective cloth, job aids, procedures, reference materials) identified during the TA.

The HSI inventory derived from the TA is provided as input data to the HSI task support verification, which is included in the HSI inventory and characterization.

If the results of task support verification identify any missing required HSI, HSIs that are not required, or HSI characteristics that do not match the requirements, an HED is identified and entered into the issue tracking system (ITS).

HFE Design Verification The purpose of the HFE design verification is to ensure that the HSI for the selected operational conditions, based on the sampling of operating conditions, is suitable considering the human capabilities and limitation, e.g., that the design of the HSIs conforms to the Style Guide. HSI designs include HSI inventory and characterization as well as normal environmental conditions of the control room where the HSIs are installed.

The HED process is used to identify, collect, track, and resolve the HEDs resulting from the design verification when the design does not meet the guidance contained in the Style Guide.

Integrated System Validation By applying human in the loop performance-based testing of the final integrated system, the ISV validates that the final integrated design supports safe plant operation. The realistic scenarios, defined by the sampling of operating conditions, are used to determine if human errors could occur due to operational complexity or excessive task load. The scenarios are carried out in tests using a full-scope simulator, the test bed. The ISV is conducted only after HEDs identified in previous HFE program elements have been resolved, including those identified by the task support verification and the HFE design verification. For the task support verification and HFE design verification, enough time is 18.10-6 Rev. 2

APR1400 DCD TIER 2 scheduled for those HEDs that are determined through the HED process to require design change to be completed before the ISV. In this way, the ISV is performed on the final HSI design. The only HSI design changes that may occur after the ISV will result from the ISV HEDs. These changes are evaluated under the DI program and may result in retesting. The ISV used a test bed containing an ANSI/ANS-3.5-2009 (Reference 5) simulator.

The pass or fail performance evaluation measures include directly observable performance data such as the execution time of operator tasks, frequency of human error, and measurable plant performance data collected by the test bed simulator. The diagnostic measures also include indirectly measurable performance data such as operator task load, situational awareness, and collaboration between operators. Various performance evaluation techniques, as described, in Reference 1 are applied to collect and analyze the evaluation data in detail. In order to provide reasonable assurance of reliability of the ISV results, a third-party review of the analysis results is performed by an independent organization. The validation includes operator interaction with the emergency operating procedures (EOPs) and other operating sequences to meet the following objectives:

a. Operators ability to execute tasks required by operating guidance

b. MCR configuration, staffing assumptions, and TA results

c. Time available for credited operator actions based on the safety analysis

d. Allocation of functions and support for operating crew situational awareness

e. Operator communication and team interaction

f. Operation with HSI and instrumentation and control (I&C) equipment failures

g. All IHAs Each of the postulated accidents, abnormal operational transients, normal operations including startup and shutdown, system lineups, and HSI and I&C equipment failures is performed, which physically represents the MCR configuration and dynamically represents the operational characteristics and responses of the design.

18.10-7 Rev. 2

APR1400 DCD TIER 2 Performance Measures The performance characteristic assessed in the ISV is multidimensional rather than single dimensional (i.e., single variable). Therefore, ISV performance measurements apply a hierarchical set of performance measures to take the multidimensionality into account by including multidimensional measures such as plant performance, personnel task performance (i.e., primary task, secondary task, error of omission, and error of commission),

situational awareness, workload, and anthropometric and physiological measures.

Success Criteria Measured values are differentiated to determine a pass or fail measure or a diagnostic measure. Explicit pass or fail success criteria are used in the data analysis to determine the conclusions of the ISV.

The performance measures that are used include:

a. Plant performance measures

b. Primary task measures such as time, subjective reports by observers, and records of errors

c. Secondary task measures

d. Situational awareness measures such as freeze probe techniques, real-time probe techniques, and self-ratings

e. Workload measures, such as subjective measures, based on the U.S. National Aeronautics and Space Administration (NASA) Task Load Index

f. Anthropometric and physiological measures ISV Conclusions The objective of the ISV is achieved once the scenario data analysis is complete and all scenarios have passed the established pass or fail measures, relevant performance measures are acceptable, and HEDs generated by the ISV are closed.

18.10-8 Rev. 2

APR1400 DCD TIER 2 18.10.2.3 Human Engineering Discrepancy Resolution HED resolution is the process of evaluating and resolving issues that are identified in HF V&V evaluations. HEDs are evaluated in accordance with the HF V&V IP.

18.10.3 Documentation The results of HF V&V are documented in the ReSR.

The HF V&V ReSR will contain the following information:

a. Each implementation team members name, expertise, and subject matter expert position

b. The HF V&V results, which include all details that demonstrate compliance with the methodology section of the IP. The ReSR includes the following:

Verification

1) A description of the application of the IP in conducting the verification program

2) Verification results based on the TA

3) Verification results based on the Style Guide

4) A description of all Priority 1 HEDs that resulted from the verification, their extent across the human-system interface design (HD), their resolution, and any subsequent HD changes made prior to the validation. Priority 1 HEDs have direct safety consequences, including those that could adversely impact personnel performance such that the margin of plant safety may be reduced below an acceptable level.

5) A summary description of Priority 2 HEDs. Priority 2 HEDs do not have direct safety significant consequences, but may have potential safety consequences to plant performance/operability, non-safety personnel performance/ efficiency, or other factors affecting overall plant operability.

6) A copy of the verification procedure and any analysis tools used to draw conclusions, such as tables or checklists 18.10-9 Rev. 2

APR1400 DCD TIER 2 Validation

1) A description of the application of the IP in conducting the validation program

2) A copy of the validation test procedures

3) A copy of any revisions or additions to scenarios contained in the HF V&V scenarios TeR with a statement of the reason for the revision and an assessment of any impacts the revision had on the HF V&V result

4) Scenario definition design requirement checklists

5) Data analysis results and validation conclusions, as compared to the test objectives

6) A discussion of the pass or fail HEDs that resulted from the validation, their extent across the HSI design, their resolution, and any subsequent HSI changes and analysis or retesting

7) A discussion of Priority 1 HEDs

8) A summary discussion of Priority 2 HEDs

9) A discussion of the performance improvement measures

10) A clear discussion of the validation results and conclusion that the pass or fail criteria set forth in the IP have been met

11) Identification of HEDs that were evaluated for HSI improvements during the design implementation A conclusion that the HF V&V program element has been conducted in accordance with the HF V&V IP, that the HSI has been verified, that the HSI has been validated, and that the HF V&V was performed on the final design.

The ReSR describes the priority and resolution of HEDs. When HED resolution involves a design change, the report will describe how the change complies with the HF V&V evaluation criteria.

18.10-10 Rev. 2

APR1400 DCD TIER 2 18.10.4 Combined License Information No COL information is required with regard to Section 18.10.

18.10.5 References

1. APR1400-E-I-NR-14008-P, Human Factors Verification and Validation Implementation Plan, Rev. 2, KHNP, January 2018.

2. APR1400-E-I-NR-14012-P, Style Guide, Rev. 2, KHNP, January 2018.

3. APR1400-E-I-NR-14010-P, Human Factors Verification and Validation Scenarios, Rev. 2, KHNP, January 2018.

4. NUREG-0711, Human Factors Engineering Program Review Model, Rev. 3, U.S.

Nuclear Regulatory Commission, November 2012.

5. ANSI/ANS-3.5-2009, Nuclear Power Plant Simulators for use in Operator Training and Examination, American Nuclear Society, 2009.

18.10-11 Rev. 2

APR1400 DCD TIER 2 18.11 Design Implementation 18.11.1 Objectives and Scope The two objectives of the human factors engineering (HFE) design implementation (DI) program element of the HFE program are (1) to confirm that the as-built human-system interface (HSI) system design is the same as the final verified HSI, and (2) to provide reasonable assurance that any changes to the finally verified design are done using a proper HFE change process.

18.11.2 Methodology The design implementation activity verifies the as-built design conforms to the HFE design process as verified and validated in the human factors (HF) verification and validation (V&V) program element.

Identify HSI design aspects to be evaluated:

a. All HSI design aspects verified and validated within the HF V&V program element

b. Design aspects not verified and validated during the HF V&V program element

c. The HF V&V results summary reports (ReSR) identifies those design aspects not verified and validated in the V&V implementation plan (IP), including design features that are not feasible, to test on the HF V&V test bed.

d. Human engineering discrepancies (HEDs) not resolved (closed) during the V&V

e. Design change(s) made after the V&V

f. Complete verification of design aspects not previously completed as part of the V&V Systematically evaluate as-built facilities and equipment against verified and validated HSI design documentation to ensure conformance. Any issues that fail this reconciliation are documented and entered as HEDs or HFE-related issues in the issue tracking system (ITS).

18.11-1 Rev. 2

APR1400 DCD TIER 2 Identify and Resolve HEDs and other HFE-related Issues This HFE program element applies to the final as-built design to provide reasonable assurance that it conforms to the final approved design documents. This is the last design activity prior to operation and as such, it shall provide reasonable assurance that all HEDs and other issues associated with the HFE design process shall be either justified, or otherwise resolved and retested per the HFEPP (Reference 1) issue closeout section. Any issues that cannot be closed out are evaluated and documented in the ITS to provide reasonable assurance they do not affect the HF V&V results.

Procedures and Training

a. Procedures are governed by DCD Chapter 13 and will be evaluated in this plan to the extent they are associated with the integrated system validation (ISV). These will include, at a minimum, the operating procedures used during the ISV testing (e.g., emergency operating procedures, abnormal operating procedures).

1) Computer-based procedures (CBPs)

CBP software will also be evaluated per Subsection 4.3.3 of this plan.

2) Paper-based procedures (PBPs)

PBPs will be reconciled against CBPs per Subsection 4.2.1 of this plan to ensure continuity.

b. Training is administered to the operating staff during ISV testing.

Training is governed by DCD Chapter 13, so it will be evaluated in this plan to the extent it is associated with the ISV.

Important Human Actions All important human actions (IHAs) applicable to the main control room (MCR) and the remote shutdown room (RSR) will be V&Vd as part of the ISV portion of the V&V program element and evaluated for design implementation per this plan.

18.11-2 Rev. 2

APR1400 DCD TIER 2 IHAs associated with local control stations (LCSs) cannot be examined during ISV since the LCSs are not modeled. Those not tested during ISV will be verified and evaluated as part of this IP.

Detail method of design implementation is described in the Design Implementation Plan (Reference 2).

18.11.3 Results The results of DI are described in the ReSR.

18.11.4 Combined License Information No COL information is required with regard to Section 18.11.

18.11.5 References

1. APR1400-E-I-NR-14001-P, Human Factors Engineering Program Plan, Rev. 2, KHNP, January 2018.

2. APR1400-K-I-NR-14009-P, Design Implementation Plan, Rev. 1, KHNP, February 2017.

18.11-3 Rev. 2

APR1400 DCD TIER 2 18.12 Human Performance Monitoring The human performance monitoring program is the responsibility of the COL applicant and not part of the KHNP human factors engineering (HFE) program. Analytical products and results from the HFE program are available to the COL applicant in support of their program.

The COL applicant is to provide the human performance monitoring program (COL 18.12(1)).

18.12.1 Combined License Information COL 18.12(1) The COL applicant is to provide the human performance monitoring program.

18.12-1 Rev. 2