Text

LLC - Submittal of Human-System Interface Design Results Summary Report, RP-0316-17619, Revision 2
	ML19119A398
Person / Time
Site:	NuScale
Issue date:	04/29/2019
From:	Bergman T; NuScale
To:	; Document Control Desk, Office of New Reactors
Shared Package
ML19119A397	List: ML19119A398;
References
	LO-0219-64505
	Download: ML19119A398 (138)
	v • d • e

LO-0219-64505 April 29 , 2019 Docket No.52-048 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738

SUBJECT:

NuScale Power, LLC Submittal of "Human-System Interface Design Results Summary Report," RP-0316-17619, Revision 2

REFERENCE:

Letter from NuScale Power, LLC to Nuclear Regulatory Commission , "NuScale Power, LLC Submittal of Third Set of Human Factors Engineering Documentation for Design Certification Application ," dated December 29 , 2016 (ML16364A348)

NuScale Power, LLC (NuScale) submitted Revision O of the "Human-System Interface Design Results Summary Report," RP-0316-17619, to the NRC (Reference 1). The purpose of this letter is to submit Revision 2 of the "Human-System Interface Design Results Summary Report" to the NRC. Revision 1 of the "Human-System Interface Design Results Summary Report" was not submitted to the NRC. contains the proprietary version of the report entitled "Human-System Interface Design Results Summary Report. " NuScale requests that the proprietary version be withheld from public disclosure in accordance with the requirements of 10 CFR § 2.390. The enclosed affidavit (Enclosure

3) supports this request. Enclosure 1 has also been determined to contain Export Controlled Information. This information must be protected from disclosure per the requirements of 10 CFR § 810. contains the nonproprietary version of the report entitled "Human-System Interface Design Results Summary Report. "

This letter makes no regulatory commitments and no revisions to any existing regulatory commitments.

If you have any questions , please contact Carrie Fosaaen at 541-452-7126 or at cfosaaen@nuscalepower.com.

Sincerely, Distribution: Gregory Cranston , NRC, OWFN-8H12 Samuel Lee, NRC , OWFN-8H12 Prosanta Chowdhury, NRC, OWFN-8H12 NuScale Power, LLC 1100 NE Circle Blvd , Suite 200 Corvallis, Oregon 97330 Office 541.360-0500 Fax 541.207.3928 www.nuscalepower.com

LO-0219-64505 Page 2 of 2 04/24/19 Enclosure 1: Human-System Interface Design Results Summary Report, RP-0316-17619-P, Revision 2, proprietary version Enclosure 2: Human-System Interface Design Results Summary Report, RP-0316-17619-NP, Revision 2, nonproprietary version Enclosure 3: Affidavit of Thomas A. Bergman, AF-0219-64506 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvallis, Oregon 97330 Office 541.360-0500 Fax 541.207.3928 www.nuscalepower.com

LO-0219-64505 :

Human-System Interface Design Results Summary Report, RP-0316-17619-P, Revision 2, proprietary version NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvallis, Oregon 97330 Office 541.360-0500 Fax 541.207.3928 www.nuscalepower.com

LO-0219-64505 :

Human-System Interface Design Results Summary Report, RP-0316-17619-NP, Revision 2, nonproprietary version NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvallis, Oregon 97330 Office 541.360-0500 Fax 541.207.3928 www.nuscalepower.com

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Human Factors Engineering Human-System Interface Design Results Summary Report April 2019 Revision 2 Docket: 52-048 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvallis, Oregon 97330 www.nuscalepower.com

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 COPYRIGHT NOTICE This report has been prepared by NuScale Power, LLC and bears a NuScale Power, LLC, copyright notice. No right to disclose, use, or copy any of the information in this report, other than by the U.S. Nuclear Regulatory Commission (NRC), is authorized without the express, written permission of NuScale Power, LLC.

The NRC is permitted to make the number of copies of the information contained in this report that is necessary for its internal use in connection with generic and plant-specific reviews and approvals, as well as the issuance, denial, amendment, transfer, renewal, modification, suspension, revocation, or violation of a license, permit, order, or regulation subject to the requirements of 10 CFR 2.390 regarding restrictions on public disclosure to the extent such information has been identified as proprietary by NuScale Power, LLC, copyright protection notwithstanding. Regarding nonproprietary versions of these reports, the NRC is permitted to make the number of copies necessary for public viewing in appropriate docket files in public document rooms in Washington, DC, and elsewhere as may be required by NRC regulations.

Copies made by the NRC must include this copyright notice and contain the proprietary marking if the original was identified as proprietary.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Department of Energy Acknowledgement and Disclaimer This material is based upon work supported by the Department of Energy under Award Number DE-NE0008820.

This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 CONTENTS Abstract ....................................................................................................................................... 1 Executive Summary .................................................................................................................... 2 1.0 Introduction ..................................................................................................................... 3 1.1 Purpose ................................................................................................................. 3 1.2 Abbreviations and Definitions ................................................................................ 4 2.0 Implementation ................................................................................................................ 8 2.1 Human-System Interface Design Process Overview............................................. 8 2.2 Human-System Interface Design Team Composition and Responsibilities ........... 9 2.2.1 Human-System Interface Design Team Composition ............................................ 9 2.2.2 Simulator Development Responsibility .................................................................. 9 2.2.3 Human-System Interface Development Responsibility ......................................... 9 2.2.4 General Considerations ......................................................................................... 9 2.2.5 Special Considerations for the Human-System Interface Design........................ 10 3.0 Methodology .................................................................................................................. 11 3.1 Human-System Interface Design Inputs .............................................................. 11 3.1.1 Personnel Task Requirements............................................................................. 11 3.2 Simulator Development ....................................................................................... 12 3.3 Human-System Interface Design Overview......................................................... 15 3.3.1 Survey of State-of-the-Art in HSI Technologies ................................................... 15 3.3.2 Preparation of Human-System Interface Design Support Documentation .......... 16 3.3.3 Conceptual Sketches .......................................................................................... 16 3.3.4 Rapid Prototyping ................................................................................................ 17 3.3.5 Tests and Evaluations ......................................................................................... 17 3.4 Human-System Interface Concept of Use ........................................................... 17 3.4.1 Operator Roles and Responsibilities ................................................................... 17 3.4.2 Automation Roles ................................................................................................ 18 3.4.3 Shared Roles ....................................................................................................... 19 3.4.4 Document Review ............................................................................................... 20 3.4.5 Main Control Room Layout .................................................................................. 20 3.5 Human Factors Engineering/Human-System Interface Design Guidance .......... 21

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 3.5.1 HSI Style Guide ................................................................................................... 21 3.5.2 Concept of Operations ........................................................................................ 22 3.5.3 Conduct of Operations ........................................................................................ 22 3.6 Human-System Interface Detailed Design and Integration ................................. 22 3.7 Human-System Interface Tests and Evaluation Overview................................... 22 3.7.1 Internal Review of Design ................................................................................... 23 3.7.2 Testing and Evaluation of Design ........................................................................ 23 3.7.3 Iteration Decision Point ....................................................................................... 25 3.7.4 Human Engineering Discrepancy Resolution ...................................................... 25 4.0 Results ........................................................................................................................... 27 4.1 Human-System Interface Design Inputs .............................................................. 27 4.1.1 Personnel Task Requirements............................................................................. 27 4.1.2 Applicable Regulatory Guidance for Human-System Interface Development ....................................................................................................... 28 4.2 Main Control Room Simulator ............................................................................. 29 4.2.1 Simulator Software .............................................................................................. 29 4.2.2 Module Control System Layout and Workstation Design .................................... 30 4.3 Human-System Interface Design Overview......................................................... 36 4.3.1 Survey of State-of-the-Art in Human-System Interface Technologies ................. 37 4.3.2 Develop a Human-System Interface Global Layout and Navigation Schema ............................................................................................................... 38 4.3.3 Develop Notification Schema .............................................................................. 39 4.3.4 Develop Procedures ............................................................................................ 40 4.3.5 Develop Automated Processes ........................................................................... 40 4.3.6 Conceptual Sketches .......................................................................................... 40 4.3.7 Rapid Prototyping and Trade Off Evaluations ..................................................... 43 4.3.8 Human-System Interface Design Evolution ......................................................... 44 4.3.9 Color Selection Chart .......................................................................................... 57 4.3.10 Chevron Icon ....................................................................................................... 57 4.3.11 Reactor Module Icon ........................................................................................... 57 4.4 Human-System Interface Concept of Use ........................................................... 61 4.4.1 Direct Component Operation ............................................................................... 64

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.4.2 Embedded Procedures ........................................................................................ 65 4.4.3 Automation Interface ........................................................................................... 67 4.4.4 Shared Roles ....................................................................................................... 70 4.4.5 Plant Notifications ................................................................................................ 71 4.4.6 Operations Crew Interaction ................................................................................ 84 4.5 Human Factors Engineering/Human-System Interface Design Guidance .......... 85 4.5.1 NuScale Human-System Interface Style Guide Description................................ 85 4.5.2 Volume I Style Guide Administration and Process Sections................................ 88 4.5.3 Volume II Common Human-System Interface Requirements and Guidelines ........................................................................................................... 88 4.5.4 Volume III System Human-System Interface Description and Display Page Examples ................................................................................................... 89 4.5.5 Appendices Specific NuScale Human-System Interface Design Information .......................................................................................................... 89 4.5.6 Concept of Operations ........................................................................................ 89 4.5.7 Conduct of Operations ........................................................................................ 89 4.6 Human-System Interface Detailed Design and Integration ................................. 90 4.6.1 General Considerations ....................................................................................... 90 4.6.2 Main Control Room ............................................................................................. 92 4.6.3 Locations outside of the Main Control Room .................................................... 101 4.6.4 Local Control Stations Design ........................................................................... 102 4.7 Degraded I&C and Human-System Interface Conditions .................................. 102 4.7.1 Defense in Depth ............................................................................................... 103 4.8 Human-System Interface Tests and Evaluations ............................................... 104 4.8.1 Human-System Interface Inventory & Characterization .................................... 104 4.8.2 Human-System Interface Task Support Verification .......................................... 105 4.8.3 Human Factors Engineering Design Verification ............................................... 105 4.8.4 Staffing Validation .............................................................................................. 105 5.0 Analysis Conclusions ................................................................................................. 107 6.0 References ................................................................................................................... 108 6.1 Source Documents ............................................................................................ 108 6.2 Referenced Documents ..................................................................................... 108

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 7.0 HSI Display Page Examples ....................................................................................... 109 Appendix A. Human-System Interface Inventory and Characterization Form................. 114 Appendix B. Human-System Interface Task Support Verification Form .......................... 117 Appendix C. Human Factors Engineering Design Verification Form ............................... 121 TABLES Table 1-1. Abbreviations ......................................................................................................... 4 Table 1-2. Definitions .............................................................................................................. 6 Table 3-1. Iterative human-system interface design and evaluation plan............................. 24 Table A-1. Human-system interface inventory and characterization form .......................... 115 Table B-1. Human-system interface task support verification form..................................... 118 Table C-1. Pump ICON human factors engineering design verification form...................... 122 Table C-2. Valve ICON human factors engineering design verification form ...................... 123 FIGURES Figure 3-1. NuScale main control room simulator development Venn diagram ..................... 13 Figure 4-1. NuScale main control room layout concept ......................................................... 31 Figure 4-2. Stand-up unit workstation .................................................................................... 33 Figure 4-3. Common systems workstation............................................................................. 34 Figure 4-4. Sit-down workstation ........................................................................................... 35 Figure 4-5. SDI panel ............................................................................................................. 36 Figure 4-6. Example of a navigation schema ........................................................................ 39 Figure 4-7. NuScale notification alarm, caution and notice icons .......................................... 40 Figure 4-8. Example of a conceptual sketch .......................................................................... 42 Figure 4-9. Example of a HSI display page ........................................................................... 43 Figure 4-10. Phase 3 human-system interface design evolution ............................................. 45 Figure 4-11. Phase 4 human-system interface design evolution ............................................. 47 Figure 4-12. Phase 5 human-system interface design evolution ............................................. 49 Figure 4-13. Phase 5.3 human-system interface design evolution .......................................... 51 Figure 4-14. Phase 3 unit group view display page ................................................................. 53 Figure 4-15. Phase 4 unit group view display page ................................................................. 54 Figure 4-16. Phase 5 unit group view display page ................................................................. 55 Figure 4-17. Phase 5.3 Unit group view display page - normal operations............................. 56 Figure 4-18. Phase 5.3 Unit group view display page - shutdown operations ........................ 56 Figure 4-19. Chevron icon ....................................................................................................... 57 Figure 4-20. RXM icon views 1 ................................................................................................ 58 Figure 4-21. RXM icon views 2 ................................................................................................ 59 Figure 4-22. RXM icon views 3 ................................................................................................ 60 Figure 4-23. RXM icon view 4 .................................................................................................. 61 Figure 4-24. Stand-up unit labeling example ........................................................................... 62 Figure 4-25. Main navigation bar labeling example ................................................................. 62 Figure 4-26. Control element pop-up window .......................................................................... 62

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Figure 4-27. 12 unit overview .................................................................................................. 63 Figure 4-28. Safety function monitoring page .......................................................................... 63 Figure 4-29. Chemical volume and control system display page............................................. 64 Figure 4-30. Process library page ........................................................................................... 65 Figure 4-31. Process library page showing an embedded procedure .................................... 66 Figure 4-32. Process library - active process progress bar..................................................... 67 Figure 4-33. Process library - showing automation ................................................................. 68 Figure 4-34. Main navigation bar with notifications circled ...................................................... 74 Figure 4-35. NuScale non-active alarm icon ............................................................................ 75 Figure 4-36. NuScale active alarm icon ................................................................................... 75 Figure 4-37. NuScale acknowledged alarm icon ..................................................................... 76 Figure 4-38. NuScale cleared alarm icon ................................................................................ 76 Figure 4-39. Summary of NuScale alarm icon behavior .......................................................... 77 Figure 4-40. NuScale active or acknowledged caution icon .................................................... 78 Figure 4-41. NuScale cleared caution icon .............................................................................. 78 Figure 4-42. Summary of NuScale caution icon behavior........................................................ 79 Figure 4-43. NuScale notice icon ............................................................................................. 80 Figure 4-44. Example of a NuScale icon tagged-out status indicator ...................................... 80 Figure 4-45. Safety function monitoring page example ........................................................... 82 Figure 4-46. Safety function monitoring page with notifications............................................... 83 Figure 4-47. 12 unit overview page displaying the safety function notifications ...................... 84 Figure 4-48. Example operator active and passive control icons ............................................ 85 Figure 4-49. NuScale human system interface style guide organization ................................. 88 Figure 4-50. Example of NuScale icon status indicators ......................................................... 91 Figure 4-51. Hard-wired manual actuation switches ................................................................ 99 Figure 4-52. Hard-wired non-safety enable switch ................................................................ 100 Figure 7-1. Safety function monitoring page ........................................................................ 109 Figure 7-2. Plant overview page .......................................................................................... 109 Figure 7-3. SDI pages .......................................................................................................... 110 Figure 7-4. 12 unit overview page ....................................................................................... 111 Figure 7-5. Unit group view display page ............................................................................ 111 Figure 7-6. Process library - automation ............................................................................. 112 Figure 7-7. Process library - procedure .............................................................................. 113 Figure 7-8. RXM overview page .......................................................................................... 113

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Abstract This report documents the process NuScale Power, LLC (NuScale) followed to translate the functional and task requirements to the human-system interface (HSI) design requirements, and to the detailed design of alarms, displays, controls, and other aspects of the HSI. The results of this process produced a unique HSI Style Guide and a consistent state-of-the-art HSI design used by operators of the NuScale plant to carry out the plants goals under normal, abnormal, and emergency operating conditions. This report also documents the methodology used to develop the HSI, the analysis performed on the HSI and the results of the analyses. The process used is consistent with the applicable provisions of Section 8 of U.S. Nuclear Regulatory Commission, Human Factors Engineering Program Review Model, NUREG-0711, Rev. 3 (Reference 6.1.2).

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Executive Summary The NuScale HSI design was developed by a multi-faceted HFE design team that brought unique skills and knowledge to the effort and worked collaboratively and cohesively to reach the project goals. The NuScale HFE design team includes former nuclear plant operators and supervisors, plant system engineers, instrumentation & control (I&C) engineers, a simulator plant model, and HSI software developers and human factors engineers.

The plant functions, operators tasks, and concepts of use were incorporated into the NuScale HSI Style Guide (Reference 6.2.2) for use by the HFE design team to produce a consistent state-of-the-art HSI design. The design team followed the NuScale HSI design and validation process to create and analyze the HSI that the operators will use to satisfy the plants overall safety and operating objectives and goals.

The HSI was analyzed to verify in-scope tasks can be performed in a consistent and timely manner, verify the design took advantage of human and machine strengths to avoid human error and machine limitations, were consistent with the HSI Style Guide (Reference 6.2.2), and satisfied the guidance in Section 8 of NUREG-0711 (Reference 6.1.2). Staffing validation confirmed the main control room (MCR) layout and HSI design met the needs of the staffing and qualification effort discussed in the Human Factors Engineering Staffing and Qualifications Results Summary Report (Reference 6.2.7).

This report is organized as follows. Sections 1.0 and 2.0 provide an introduction to the HSI process and the HSI implementation process, respectively. Section 3.0 describes the methodology followed by the HFE design team during the development of the HSI. Section 4.0 provides a detailed summary of the results of the HSI effort including task support validation and design verification testing. Section 5.0 provides a high-level conclusion of the HSI effort. The source and referenced documents applicable to and used in the HSI effort are listed in Section 6.0. Examples of the HSI display pages are provided in Section 7.0. Finally, examples of the forms used during HSI testing process are provided in Appendix A through Appendix C.

This report supersedes RP-0914-8540, Human Factors Engineering Human-System Interface Design Implementation Plan, in its entirety.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 1.0 Introduction 1.1 Purpose The purpose of this results summary report (RSR) is to document the methodology and results of an iterative human-system interface (HSI) design process. This process translates the functional and task requirements to the HSI design requirements and to the detailed design of alarms, displays, controls, and other aspects of the HSI, which are based on systematically applying state-of-the-art human factors engineering (HFE) principles and the criteria to support the safe and reliable operation of the NuScale plant.

Scope This RSR includes a summary of the research, design, and testing efforts performed by the NuScale HFE design team that produced a coherent and consistent screen-based HSI design for the licensed operators located in the main control room (MCR) during normal, abnormal, and emergency operating conditions.

This RSR does not include results for ergonomic design, maintenance or refueling activities, environmental conditions, activities completed by craft/technical personnel (i.e., mechanical, electrical, or I&C, health physics, chemistry, engineering, or information technology), and activities associated with the remote shutdown station (RSS), the technical support center (TSC), emergency operations facility (EOF),

operations support center, or any other emergency response facilities unless they were determined to impact licensed operator workload.

The NuScale HSI design and validation process addresses:

the guidance documents used for the HSI detailed design.

the in-scope facilities and HSIs within those facilities covering form, function, and performance characteristics.

required inputs to the HSI design process.

the concept of how HSIs are used and an overview of the HSI design process.

alarms, cautions, status indications, controls, and computer-based procedures.

systems used to communicate with personnel outside the MCR.

how the design minimizes the effects of degraded I&C and HSI conditions on the performance of personnel.

the outcomes of tests and evaluations undertaken to support the HSI design.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 This RSR also documents the efforts performed by the HFE design team that produced an HSI that:

supports the crews tasks under normal, abnormal, and emergency operating conditions.

accounts for the strengths and limitations of human operators.

incorporates state-of-the-art HFE/HSI principles, technology, and overall design features.

supports the MCR staffing plan validation (SPV) for the safe control and monitoring of 12 NuScale Power Modules and the common systems associated with them.

1.2 Abbreviations and Definitions Table 1-1. Abbreviations Term Definition BISI bypassed and inoperable status indication BOP balance of plant CCF Common-cause failure CIS containment isolation signal CIO containment isolation override CRS control room supervisor CVC chemical & volume control DAS data acquisition system DB database DCA design certification application DHR decay heat removal DMI demin isolation signal ECC emergency core cooling EOF emergency operations facility FRA/FA functional requirements analysis and function allocation GVD group view display HED human engineering discrepancy HFE human factors engineering HFEITS human factors engineering issue tracking system HRA human reliability analysis HSI human-system interface I&C instrumentation & control IHA important human action IRM information and records management ISV integrated system validation

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Term Definition LCS local control station LTOP low temperature over pressure MCR main control room MCS module control system MPS module protection system NPM NuScale power module NSE Non-safety enable NSIDE NuScale simulator interface development environment OER operating experience review P&ID piping and instrumentation diagram PAM post-accident monitoring PCS plant control system PHT pressurizer heater manual actuation PPS plant protection system PRA probabilistic risk assessment PSS process sampling system PWR pressurized water reactor RCS reactor coolant system RO reactor operator RSR results summary report RSS remote shutdown station RTS reactor trip signal RXM reactor module S&Q staffing and qualification SA situational awareness SDCV spatially dedicated continuously visible SDI safety display and indication SM shift manager SMR small modular reactor SOC sampling of operational conditions SPV staffing plan validation SSC structure, system and component STA shift technical advisor TA task analysis TSC technical support center V&V verification & validation VDU visual display units WLA work load analysis WPF windows presentation foundation

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Table 1-2. Definitions Term Definition A computer-based procedure system assists plant personnel by computerizing paper-based procedures. Their purpose is to guide Computer-Based Procedure operators' actions in performing their tasks in order to increase the likelihood that the goals of the tasks will be safely achieved.

Dynamic Object Oriented Requirements software is designed to DOORS capture, trace, analyze, and manage requirements while maintaining compliance with industry standards and regulations.

Embedded Procedure ((2(a),(c) HFE Design Team Generic term for the Plant Operations organization which consists of Operators, Human Factor Engineers, and Simulator Developers. The HFE Design Team does not include Plant Personnel. The HFE Design Team is responsible for the human factors engineering associated with the NuScale design. Also referred to as the design team. Human System Interface The human-system interface (HSI) is that part of the system through which personnel interact to perform their functions and tasks. In this document, "system" refers to a nuclear power plant. Major HSIs include alarms, information displays, controls, and procedures. Use of HSIs can be influenced directly by factors such as, (1) the organization of HSIs into workstations (e.g., consoles and panels) (2) the arrangement of workstations and supporting equipment into facilities such as a main control room, remote shutdown station, local control station, technical support center, and emergency operations facility and (3) the environmental conditions in which the HSIs are used, including temperature, humidity, ventilation, illumination, and noise. HSI use can also be affected indirectly by other aspects of plant design and operation such as crew training, shift schedules, work practices, and management and organizational factors. (( ((

                                                                                                      }}2(a),(c)
                          }}2(a),(c)

Process Library ((

                                                                                             }}2(a),(c)

Screen-based HSI A defined set of information that is intended to be displayed as a single unit. Typical nuclear power plant display pages may combine several different formats on a single display screen, such as putting bar charts and digital displays in a graphic P&ID format. Display pages typically have a label and designation within the computer system so they can be assessed by operators as a single "display." An electronic device for the display of visual information in the form of Video Display Unit text and/or graphics. VISION The VISION Developer application is a relational database that is © Copyright 2019 by NuScale Power, LLC 6

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Term Definition used to store the FRA/FA, task analysis, staffing and qualifications analysis, development of human-system interfaces (HSI), procedures, and training data. In this document it may be referred to as the FRA/FA & TA database or database. © Copyright 2019 by NuScale Power, LLC 7

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 2.0 Implementation 2.1 Human-System Interface Design Process Overview The analyses performed in the early stages of the HFE program are important steps in establishing the inputs to the design requirements for the NuScale HSIs. The HSI design inputs that are analyzed and/or developed include the following:

operating experience review (OER)
functional requirements analysis and function allocation (FRA/FA)
task analysis (TA)
staffing and qualifications (S&Q)
treatment of important human actions (IHAs)
concept of operations
l&C systems design
alarm management
system requirements
HSI Style Guide Once the inputs are established, the design effort follows the NuScale HSI process steps listed below when designing the MCR, conceptual workstations, and screen-based HSIs needed to complete the design effort.

1. Follow the appropriate chapters of the NuScale HSI Style Guide needed to establish a safe, user-friendly workplace.

2. Follow the appropriate chapters of the NuScale HSI Style Guide needed to establish safe, user-friendly workstations.

3. Design and develop the HSI needed to accomplish safe and reliable operation of the plant.

4. Test and evaluate the HFE/HSI design of the simulator and products developed to support SPV testing The HSI design products are the physical HSI screens, the embedded procedure functionality, and the plant notification functionality maintained within the simulator control room hardware and software. Examples and illustrations of these results are provided in Section 4.0 of this report.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 2.2 Human-System Interface Design Team Composition and Responsibilities 2.2.1 Human-System Interface Design Team Composition The NuScale HFE/HSI design process is instituted by a multi-faceted HFE design team that brings unique skills and knowledge to the effort and works collaboratively and cohesively to reach the projects goals. The HFE design team includes former nuclear plant operators and supervisors, plant system engineers, instrumentation and controls engineers, human factors engineers and software developers that work collaboratively and cohesively to reach the projects goals. This unique membership combination provides representation from all user and designer perspectives. 2.2.2 Simulator Development Responsibility The HFE design team begins by designing an MCR simulator. An MCR simulator, referred to as simulator for the remainder of this document, is a computer-based, interactive work location that brings the operators as close as practicable to a true representation of the NuScale plant responses and user interfaces located in the MCR. The simulator is where the design team carries out rapid development, tests evolving state-of-the-art HSI design, and validates the NuScale MCR concepts and staffing goals. The simulator is also an effective tool for demonstrating plant operating and control concepts. 2.2.3 Human-System Interface Development Responsibility The NuScale HSI design incorporates results of the OER, literature reviews, informal trade-off evaluations, informal consideration of multiple alternatives, and tests and evaluations. These support the technical basis for demonstrating that the design is state-of-the-art and supports personnel performance. 2.2.4 General Considerations The following design goals are emphasized during the HSI design and evaluation process:

        *    ((
                         }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

        *    ((
                           }}2(a),(c) 2.2.5    Special Considerations for the Human-System Interface Design The following special high-level design considerations identified as part of a preliminary analysis of the essential and desirable features of an HSI for the NuScale plant are emphasized during the HSI design and evaluation process:
        *    ((
                                                                      }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 3.0 Methodology 3.1 Human-System Interface Design Inputs 3.1.1 Personnel Task Requirements The analyses discussed below are performed in the early stages of an HFE program and are used to establish design requirements for the NuScale HSIs. During operating experience review (Reference 6.2.4), issues from other plants and similar HSI designs are evaluated for inclusion or exclusion in the NuScale HSI design. The HSI design element confirms that the issues found during OER remain adequately addressed as the HSI design progresses. Discovered OER issues are resolved within the HSI design element or tracked in the human factors engineering issues tracking system (HFEITS) as applicable. During functional requirements analysis and function allocation (Reference 6.2.5), the NuScale plant system functions that support safety are defined. Each system function is analyzed to determine the tasks, how the task is performed (manual, automated, or both), the technical basis, and the role of the operator. Safety functions are used as input to the design of the overview screens within the HSI inventory. HSIs for lower level functions are further analyzed during task analysis. Automation criteria established during function allocation define the levels of automation anticipated for the HSI design. HSI design issues initiated in FRA/FA are also generally resolved during HSI design. The task analysis (Reference 6.2.6) provides the information needed to build a complete HSI inventory and the characteristics of that inventory needed to monitor and control critical functions during normal and abnormal operating conditions. Alarms, indications, procedures, and backup control for automated functions are also defined during TA. While building the HSI inventory during TA, characteristics such as alarm conditions, indication range and resolution, control function modes and accuracy, and procedure applicability conditions are established. Grouping of HSI elements in TA leads to HSIs designed for specific tasks and may reduce both reliance on system-based HSIs and navigation between screens. Task support requirements are defined in TA and may be implemented during HSI design or as issues tracked for resolution by other engineering disciplines. HSI design considers IHAs from the probabilistic risk analysis (PRA) and from deterministic analyses (see Reference 6.2.9) to determine if the assumptions regarding HSI characteristics for IHAs are implemented in the HSI; for example,

reduction of time required for human actions via simplified or reduced navigation.
development of dedicated HSI.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

developing alarms specifically associated with IHAs.

The MCR layout considers providing workstations and video display units (VDUs) needed for the monitoring and control of multiple units and the common systems associated with them. Staffing and qualification analyses (Reference 6.2.9) are used to provide input to the HSI design by influencing the HSI hierarchy and navigation concepts, allocation of controls and displays to individual VDUs, and overall MCR layout. The S&Q analyses also validate the MCR crew complement and responsibilities of each member of the crew. 3.2 Simulator Development The development of the simulator is at the center of three major NuScale work efforts. The various aspects of the simulator design processes are interlinked as shown in Figure 3-1. © Copyright 2019 by NuScale Power, LLC 12

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Figure 3-1. NuScale main control room simulator development Venn diagram © Copyright 2019 by NuScale Power, LLC 13

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 All of the elements shown are needed to design the simulator and are defined below:

HSI design input - Discussed in Section 3.1
Plant model requirements - functionality needed from the plant models to support the HSI and simulator design efforts. The appropriate HSI design inputs are used to help determine the needs.
Plant models - set of models used to closely model and predicted behavior of the NuScale design.
Page animation - HSI software that provides the operators an interface to the plant models.
Human factors engineering - design effort discussed in this RSR
Interface requirements -includes the NuScale HSI Style Guide as well as any of the inputs information that drives HSI display page information (e.g. FRA/FA and TA).
Simulator - needed to support the necessary modeling to complete staffing plan validation.

The HSI process discussed in this RSR is highlighted in orange in Figure 3-1. The other elements shown are discussed at a high level and are needed to develop the simulator and accomplish the goals discussed in Section 8 of Reference 6.1.2. In more traditional simulator strategies, a simulator is developed for training and qualifying plant operators. The NuScale simulator is an evolutionary expression of the MCR interface that is built incrementally and represents the design detail as it emerges. The HFE design team ensures that the partnerships between various NuScale plant design communities and the use of the appropriate guidance documents drive the simulator and HSI design to support:

minimizing the probability that errors will occur.
maximizing the probability that any error made is detected.
analyses of personnel roles (job analysis).
systematic strategies for organization, such as arrangement by importance, and frequency and sequence of use.
the inspection, maintenance, test, and repair of (1) plant equipment, and (2) the HSIs.
personnel task performance under all staffing conditions (minimum, typical, and high-level or maximum).
consistent design for the HSIs.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

philosophy for updating the HSIs.
procedures.
automation.

3.3 Human-System Interface Design Overview An iterative methodology incorporating the HSI design inputs (Section 3.1), analysis of personnel task requirements, system and regulatory requirements, concept of use, and general requirements, is used to develop the HSI conceptual design. The iterative design and evaluation approach serves to

guide the selection of one from multiple candidate designs.
answer open HFE questions related to situational awareness (SA), workload, and staffing.
identify and eliminate HFE issues from the design early in the process.

Feedback from users on HSI prototypes is incorporated prior to the detailed design effort. The iterative design of the HSI is closely connected with other HFE activities. As a part of each design effort, the HFE team presents findings and solicits input from the following design disciplines:

I&C and computer systems - consider whether the design concepts are technically feasible, with a special emphasis on performance requirements
human reliability analysis (HRA) process - consider plant conditions, risk-important human actions and HSIs identified as being important to plant safety and reliability or operator actions credited for achieving plant stabilization when automatic actions are not triggered
S&Q plan efforts - determine any deficiencies or features of the design that are incompatible with the proposed staffing model
procedure development - HSI design supports clear, reasonable procedures and vice versa
training program development - consider the feasibility of the operator skills, rules, and knowledge necessitated by the proposed design 3.3.1 Survey of State-of-the-Art in HSI Technologies The state-of-the-art HSI technology is established with an emphasis on adaptability, principles, and design patterns that serve the needs of the NuScale plant. Various

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 options are evaluated for human usability and technical feasibility. Specific software and hardware development is not in the scope of the survey; however, an understanding of the state-of-the-art software and hardware technologies provides insight for development of the functional and procurement specifications for the HSI platform. 3.3.2 Preparation of Human-System Interface Design Support Documentation Due to the iterative nature of the NuScale design, the following documents have the potential to be updated during HSI conceptual design:

Concept of Operations
HSI Style Guide Note that these documents are revised as necessary throughout the design process as findings from testing and analyses are developed.

3.3.3 Conceptual Sketches Conceptual screen sketches are aimed at creating a template page of a system or process that conforms to a subset of the HSI functional requirements. A template page is developed for each major portion of the HSI (e.g., task-based screens, computer-based procedures interfaces, overview displays). The level of detail of the template coincides with the maturity of the plant design for that type of interface. Representative screens and task sequences are selected for depiction, demonstrating key concepts, features and interactions, and for providing concrete grounds for analysis and feedback. Conceptual sketches incorporate the best understanding of design principles as outlined in the latest HSI Style Guide. Conceptual sketches are maintained as design records. Screen designers produce multiple candidate approaches for the conceptual sketches. Major components that are initially investigated in this manner include:

template for screen layout(s)
navigation schema
information visualization approaches
advanced alarm system interface
computer-based procedures integration If elements of the conceptual sketches, once reviewed, bring positive features to the overall design, changes to the HSI Style Guide are made accordingly.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 3.3.4 Rapid Prototyping Based on the latest conceptual sketches and feedback from interfacing with other disciplines, mock-ups or prototype screens integrated with a software simulator of the system are developed for review and evaluation. While the prototype provides a realistic user experience with the system, the focus is on testing design concepts and soliciting feedback, rather than producing an engineering-quality software architecture and user interface. 3.3.5 Tests and Evaluations HSI design tests and evaluations are conducted and include trade-off evaluations and performance-based tests. Trade-off evaluations pertain to comparing HSI design approaches and consideration of alternatives. In comparing HSI design approaches, consideration is given to ways to enhance human performance for performance of tasks, including IHAs. Performance-based tests are performed to validate that the integrated system design (i.e., hardware, software, procedures, and personnel elements) supports the safe operation of the plant. The staffing plan validation is a performance-based test that is discussed in Section 4.8.4. 3.4 Human-System Interface Concept of Use 3.4.1 Operator Roles and Responsibilities MCR licensed operators and operating crews outside the MCR are responsible for safe operation of the common plant, each individual unit and for maintaining power production. To achieve these objectives, the operators perform a variety of activities such as:

structure, system and component (SSC) performance monitoring
local and remote SSC operation
commanding automated sequences
directing subordinate operators to perform procedures
monitoring the performance of sequences and procedures
interrupting and reprioritizing sequences or procedures
summoning additional resources to expand capabilities
monitoring and evaluating technical specification conditions
surveillance testing

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

reviewing trends
responding to off-normal conditions
responding to alerts and alarms
establishing plant conditions to support preventative or corrective maintenance, testing, and inspections
maneuvering the plant
performing emergency response duties such as offsite notifications
performing non-emergency off-site reporting
maintain a narrative log of events and activities that are relevant to the plant site
communicating plant status, constraints, and planned actions to the appropriate stakeholders Operators are guided in the performance of these activities by regulations, procedures, guidelines, training, and experience.

Operators follow procedures for equipment operation. Procedures direct the operation of components in the field, remote operation of components from the MCR, and the monitoring of automation to perform sub-steps, steps, and sequences to support the systems operation. Designing an integrated system for operation and monitoring roles at any location is a goal of the HFE design team. 3.4.2 Automation Roles Automation plays a key role in the control of a NuScale plant. Beyond controlling plant functions and systems, automation is applied to a wide range of other functions, including monitoring and notification, situational assessment, response planning, response implementation, and interface management. Automation is a critical component of the HSI design and supports operators in operation of the plant. Examples of automation as a function of the HSI design are:

placing equipment in service, conducting tests, and controlling processes
automated notifications and recommended sequences
performance of sequences not suited to manual operation (see description of process control roles below)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 3.4.2.1 Process Control Roles The control system continuously monitors key plant parameters. When one of these parameters approaches a control limit, the process control responds automatically to adjust the process. Depending on the parameter, the associated automation (process control) may respond with or without operator consent depending on the task. The criteria used to develop the process control systems roles are discussed below:

continuous monitoring - the NuScale plant relies on automation to control basic intermittent and continuous processes (such as hot well level control or turbine speed control) and provide continuous process parameter monitoring
repetitive tasks - those that involve multiple identical component manipulations, error-likely tasks for operators
high cognizant burden functions - such as plant maneuvering, control rod exercising and valve testing, pressurizer level and coolant temperature control
startup and shutdown support
power maneuvering evolution support
plant notifications - monitoring of plant parameters to provide visual and audible cues to the operator to maintain situational awareness and support the need to take manual control
data historian - monitors parameters and evolutions to safely operate and report on the condition of the plant

        *    ((
                       }}2(a),(c) 3.4.3    Shared Roles The HFE design team uses the following set of criteria to provide the information necessary to coordinate the shared activity when developing the HSI.

3.4.3.1 Parameter Monitoring Automation performs functions associated with parameter and process monitoring, defined sequence functions, continuous process control, alert and alarm monitoring, safety limit monitoring, and automatic safety functions including monitoring. Operators monitor and evaluate automated functions intervening as required. Properly providing the operators with the ability to monitor process parameters being controlled by automation supports situational awareness and enables the operator to © Copyright 2019 by NuScale Power, LLC 19

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 evaluate automated system performance and intervene, as necessary. Operators increase attention to system performance monitoring when:

transients are anticipated
sustained normal automated operation needs to be confirmed
degraded automation is suspected 3.4.3.2 Operator Intervention Operators intervene when the automation is asking for consent or when it becomes apparent that the automation has failed or is no longer appropriate for the current or planned plant conditions. The criterion for operator intervention involves judgment of continued safe operation of the plant.

3.4.4 Document Review When appropriate, operators access an information and records management (IRM) system to review technical documents, reports, test results, and other work documents to confirm the readiness of SSCs. 3.4.5 Main Control Room Layout The list below outlines the MCR layout design concepts used to develop the HSI features discussed in this document. Original design concepts were based on OER from operating nuclear power plants and control rooms from various industries in which few operators operate multiple units. The NuScale MCR concept includes the following attributes:

a bank of VDUs configured with spatially dedicated continuously visible (SDCV) HSIs (e.g., post-accident monitoring (PAM) variables, manual backups for protective functions)
sit-down workstations for three reactor operators, each able to access HSIs for all units
sit-down workstations for three senior reactor operators (shift manager (SM), shift technical advisor (STA), control room supervisor (CRS), each able to access HSIs for all units
a dedicated unit stand-up workstation for each unit to allow focused operation of that unit
a dedicated workstation for shared or common systems

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

technologies to support teamwork and communications including individual and group plant notification techniques and non-wireless communication such as standard phone, verbal and e-mail protocols 3.5 Human Factors Engineering/Human-System Interface Design Guidance 3.5.1 HSI Style Guide The NuScale HSI Style Guide applies to pertinent HSIs throughout the plant. The style guide includes a description of applicability for the included guidance. HSI designers consider the environment in which the HSIs are to be used, for example, colors, brightness and contrast, ambient lighting, and element spacing. Parameters such as accessibility, lighting, air quality, sound levels and quality, heat and humidity, and radiation zones are also considered in the design of HSIs.

The NuScale HSI design employs an inclusive HSI Style Guide for various types and formats of HSIs. The design criteria listed below illustrates how the style guide is used during HSI design. The topics in the style guide address the scope of HSIs included in the design, and address their form, function, and operation, as well as the environmental conditions in which they will be used that are relevant to human performance. The style guide is consistent with the guidance of NUREG-0700 (Reference 6.1.1) HFE guidance and HSI design-related analyses are used to develop the guidance in the style guide. The style guide influences the design decisions that address specific goals of the HSI design .Specific analyses related to HSI design include an evaluation of recent literature, analysis of current industry practices and operational experience, tradeoff studies, and the findings from design-engineering experiments and evaluations. The style guide expresses precisely and describes easily observable HSI characteristics, such as Alarms are shown in red. The style guide contains sufficient detail so that design personnel can deliver a consistent, verifiable design. The style guide contains instructions for determining where and how HFE guidance is used in the overall design process. The instructions are written so designers can readily understand them; the text is supplemented with graphical examples, figures, and tables to facilitate comprehension. The style guide is maintained in a form that is readily accessible and usable by designers, and is easily modified and updated as needed. Each guidance statement includes a reference(s) to the source upon which it is based. © Copyright 2019 by NuScale Power, LLC 21

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 3.5.2 Concept of Operations The concept of operations provides an overview of the supporting processes, individual roles, overall staffing, organizational values, crew structure, and operating techniques used by the crews of a NuScale plant to achieve a high level of safety and production. The concept of operations is refined as the design, engineering and simulator evaluation associated with safety analysis, system design, control system automation, and human-system interface progresses. 3.5.3 Conduct of Operations The conduct of operations provides a set of standards to influence operator behaviors to ensure high quality, consistent task performance that supports the safe and reliable operation of the NuScale plant. The conduct of operations is applicable to on-shift operations staff. The conduct of operations is refined as the design, engineering and simulator evaluation associated with safety analysis, system design, control system automation, and human-system interface progresses. 3.6 Human-System Interface Detailed Design and Integration In addition to the input elements discussed in Section 3.1 the HFE design team also takes into consideration the design elements listed below during the HSI design process. The team addresses each area individually and applies the results to the overall HSI design.

important human actions
HSI layout bases
HSI support for inspection, maintenance, and testing
support for staffing conditions
human performance and fatigue
environmental conditions
HSI updates of plant modifications 3.7 Human-System Interface Tests and Evaluation Overview This section describes the method NuScale uses to verify and document the review of the HSI displays, controls, and related equipment lying within the scope defined by the sampling of operational conditions (SOC) discussed in the Control Room Staffing Plan Validation Methodology, RP-1215-20253 (Reference 6.2.10).

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Detailed design is a stage of development for a certain portion of the HSI. Different portions of the overall HSI are in conceptual design or detailed design depending on their level of development. Detailed design applies to the information gained from the iterative conceptual design phases to the production of a comprehensive HSI design. ((

                                             }}2(a),(c) 3.7.1    Internal Review of Design Before performing tests on a hardware or software implementation, the design is subject to review. The review identifies HFE issues to be addressed prior to experimental evaluation and ensures that the design maturity is commensurate with the current design phase. Review of the design may also generate HFE questions or identify design trade-offs that cannot be resolved via static analysis, and should be considered for inclusion in subsequent tests.

The review steps include ((

                                                                 }}2(a),(c) 3.7.2    Testing and Evaluation of Design Testing and evaluation consists of several stages.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Table 3-1 shows anticipated testing and evaluation efforts with respect to design phase. Table 3-1. Iterative human-system interface design and evaluation plan ((

                                                                                                           }}2(a),(c)
  © Copyright 2019 by NuScale Power, LLC 24

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                                 }}2(a),(c)

The following criteria are used to select the design approach. Once a design approach is advanced enough to be tested, these criteria are used to determine whether or not a design approach will be part of detailed design.

Are all personnel-task requirements considered?
Does the design approach take advantage of human-performance capabilities and limitations?
Does the design approach enhance HSI-system performance requirements?
Does the design approach unduly increase inspection and testing needs or maintenance demands?
Is proven technology used in the design approach?
Has the design approach taken into account the operating experience review findings?

3.7.3 Iteration Decision Point The HFE team conducts a design review following completion of the testing and compilation of the results to determine the next steps. The HSI design tested may be accepted as is, re-designed, or tabled pending further development or testing. 3.7.4 Human Engineering Discrepancy Resolution Human engineering discrepancies (HEDs) are identified throughout the HSI design process to ensure that HEDs are being discovered, documented, and resolved accordingly. NuScale begins to record HEDs after the completion of staffing plan

© Copyright 2019 by NuScale Power, LLC 25

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 validation. At this point in the HSI design process, the HFE team can use the HSI used for Staffing Plan Validation as a baseline to work from for recording HEDs. HEDs may not always be resolved; HEDs may be found acceptable after an evaluation in the context of the integrated design. The basis for a decision for accepting an HED without change in the integrated design is documented. It may be based on accepted HFE practices, currently published HFE literature, trade-off studies, tests, or engineering evaluations. © Copyright 2019 by NuScale Power, LLC 26

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.0 Results 4.1 Human-System Interface Design Inputs NuScale utilized the collective operating experience of its design staff, FRA/FA and TA results, tabletop activities and preliminary simulator observations to determine initial staffing levels. The initial staffing level and qualifications for the NuScale control room operators as defined in the concept of operations (Reference 6.2.1) provided the basis for the development of the control room, workstation, and group view display (GVD) layout, which led to the construction of the MCR simulator. The control room communications protocols used by the control room operators are defined in the conduct of operations. All of the above inputs in conjunction with the NuScale passive safety systems, simple operation, automation, expected reduced licensed operator workload, and limited number of IHAs led to the first of a kind, state-of-the art HSI design that successfully met the needs of and enhanced the ability of six licensed operators to safely and reliably operate a 12-unit power plant. 4.1.1 Personnel Task Requirements 4.1.1.1 Documented Results of Human-System Interface Inputs The following documents discuss the results of the specific HSI input effort.

1. The Human Factors Engineering Operating Experience Review Results Summary Report (Reference 6.2.4).

2. The Human Factors Engineering Functional Requirements Analysis and Function Allocation Results Summary Report (Reference 6.2.5).

3. The Human Factors Engineering Task Analysis Result Summary Report (Reference 6.2.6).

4. The Human Factors Engineering Staffing and Qualifications Results Summary Report (Reference 6.2.7).

4.1.1.2 Key Influences Listed below are some of the key influences to the HSI design provided by the input efforts:

1. NuScale performed a site visit where it was noted that over 500 alarms for the HVAC system alone were alarming. Alarm notifications were determined by design engineering without operations and HFE input. This visit drove the NuScale HFE team to design more effective notification criteria.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

2. NuScale utilized the expertise of its HFE team members to perform reviews of NuScale design documents and provide recommendations for improvements and refinements to the design as appropriate. These personnel possessed significant experience in the operation of commercial nuclear power plants, and were an integral part of the HFE team. The safety functions and the information provided from these reviews were used by the HFE design team as inputs to the design of the Unit Overview, Plant Overview and Safety Function Monitoring pages (Section 7.0).

3. System automation criteria (levels of automation anticipated for the HSI design) established during function allocation development directly drove the development of the Process Library page shown in Section 7.0.

4. The detailed information, control requirements (e.g., requirements for display range, precision, accuracy, and units of measurement) and tasks needed to control the plant during a range of operating conditions from normal through accident conditions helped create:

individual system pages. overall navigation schema. notification schema. group view display pages. embedded procedures. automation interface.

5. Hardware toggle switches were located at the stand-up unit workstations to satisfy Regulatory Guide 1.62 requirements.

4.1.2 Applicable Regulatory Guidance for Human-System Interface Development 4.1.2.1 System Requirements There are no known I&C platform system constraints related to the MCR layout optimization or HSI design for monitoring and control of multiple units. 4.1.2.2 Regulatory Requirements/Guidance The code of federal regulations, staff requirements memoranda, Nuclear Regulatory Commission Regulation (NUREGs), and regulatory guides considered during the HSI design process are listed in the applicable elements of Reference 6.1.2. 4.1.2.3 Other Requirements Other requirements used in the HSI design are described with respect to specific design features as applicable. © Copyright 2019 by NuScale Power, LLC 28

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.2 Main Control Room Simulator Simulator readiness to support staffing validation was essential for testing in a meaningful way. The simulator allowed the operators to interface with working models of the plant design and allowed concepts of operation to be put into practice. The NuScale simulator uses high fidelity modeling and is frequently updated to remain current as the reactor and plant design progress. The simulator was critical to the success of the SPV testing. NuScale will continue to maintain and update this critical asset for use throughout integrated system validation (ISV) testing. 4.2.1 Simulator Software ((

                                                                    }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

        *    ((
                                                                      }}2(a),(c) 4.2.2    Module Control System Layout and Workstation Design The NuScale conceptual control room includes the following attributes:

bank of VDUs configured with SDCV HSIs safety (PAM) variables is referred to as the safety display and indication (SDI) panel
sit-down workstations for three reactor operators, each able to access HSIs for all individual units and common plant systems
sit-down workstations for three senior reactor operators (SM, STA, CRS)
a dedicated stand-up workstation for each unit to allow for focused operation of that unit, including the manual backups (hardwired switches) for system level actuation and other protective functions
a dedicated workstation for shared or common systems
technologies to support teamwork and communications, including enhanced individual and group plant notification techniques and non-wireless communication such as standard phone, verbal and e-mail protocols
HSIs displayed on the VDUs are navigable and contain the alarms, controls, indications, and procedures necessary to monitor and manage any unit chosen by the operator during normal, abnormal, emergency, and shutdown.
HSI displayed on the GVDs is SDCV information and are not navigable
multiple units may be controlled by a single operator at any sit-down workstation simultaneously due to high levels of automation and passive safety functions

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Figure 4-1. NuScale main control room layout concept 4.2.2.1 Stand-Up Unit Workstations The MCR contains 12 stand-up unit workstations. Each stand-up workstation has five VDUs, a keyboard, a mouse, and manual switch backups for protection functions. The unit overview display VDU is a GVD that provides SDCV unit status information to MCR personnel. The unit overview display does not have navigation capabilities. The HSIs displayed on all four lower VDUs are navigable and contain the alarms, controls, indications, and procedures necessary to monitor and manage the corresponding unit during normal, abnormal, emergency, and shutdown operations. The function of the four lower VDUs may be accomplished by other means providing the operators utilizing the workstation can view four independent HSI display pages simultaneously. The GVD must remain independent and non-navigable. ((

                                       }}2(a),(c),ECI

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

              *    ((
                          }}2(a),(c),ECI

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.2.2.2 Common Systems Workstation The common systems workstation includes a keyboard, a mouse, and six VDUs that provide HSIs for alarms, controls, indications, and procedures for systems common to all 12 units (e.g., electric plant, reactor pool cooling, instrument air, reactor building and radwaste building ventilation, radioactive waste systems, radioactive waste drain system, demineralized water system, fire protection system, and communications system). The common system plant overview GVD displays the plant status information needed to support the safe operation of the plant and provide a common location for the crew to monitor plant status. The function of the six lower VDUs may be accomplished by other means providing the operators utilizing the workstation can view six independent HSI display pages simultaneously. The GVD must remain independent and non-navigable. Figure 4-3. Common systems workstation © Copyright 2019 by NuScale Power, LLC 34

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.2.2.3 Sit-Down Workstation Each sit-down workstation has at a minimum four VDU, a keyboard and a mouse as shown in Figure 4-54. The HSIs displayed on those VDUs contain the alarms, controls, indications, and procedures necessary to monitor and manage any unit chosen by the operator during normal, abnormal, emergency, shutdown, and operations. A single operator can control multiple units simultaneously. The function of the four VDUs may be accomplished by other means providing the operators utilizing the workstation can view four independent HSI display pages simultaneously. The MCR operators and supervisors interface with the plant at their designated workstations using HSI software located on the plant control system (PCS) and MCS networks. Due to high levels of automation and passive safety functions, multiple units may be controlled by a single operator at any workstation simultaneously. Additionally, common or shared plant systems are able to be fully monitored and managed from each workstation. The capability of the HSI and the supporting PCS and MCS network architecture structure allows the operator workstations to support oversight and control activities. Figure 4-4. Sit-down workstation © Copyright 2019 by NuScale Power, LLC 35

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.2.2.4 Safety Display and Indication Panel The SDI bank of SDCV VDUs provides redundant, highly reliable indications of plant conditions. Operators rely on these indications to give them the status of the plant even in conditions where normal power and backup power have been lost for an extended period of time. ((

                                                                                                            }}2(a),(c)

Figure 4-5. SDI panel 4.3 Human-System Interface Design Overview The NuScale HSI design incorporated pertinent design considerations based on accepted HFE principles and industry standards. In addition, the design incorporated high-level design considerations identified during preliminary analyses such as; maintaining situational awareness with a highly automated system and acceptable workload levels with multiple modules assigned to a single operator. Within the HSI design process, there were common design elements that drove the entire architecture and usability of the user interface. The elements, below, are discussed in detail in subsequent subsections.

Survey of state-of-the-art in HSI technologies

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

Develop an HSI global layout and navigation schema
Develop notification schema
Develop procedures
Develop automated process 4.3.1 Survey of State-of-the-Art in Human-System Interface Technologies There is no single solution to every HSI design situation; therefore, the HSI Style Guide maintains consistency when design decisions require a unique situation. The following summarizes the results of a few key survey issues.

The HFE design team investigated the use of the following state-of-the-art technologies for use in the NuScale HSI design:

mouse cursor-based interaction
process and information visualization techniques
abstraction hierarchy-based presentation (i.e., multiple levels of detail)
techniques for facilitating navigation and orientation, including windowing
direct manipulation interfaces and soft controls
alarm filtering and prioritization systems
computer-based procedures

1. The HSI design primarily uses mouse-based technology with touch screen being considered for future enhancements.

2. The organization and presentation of information is critical in designing a display for safety-critical systems. The effect of functional organization and the choice of information presentation styles (process display vs. functional display), parameter presentation (text vs. bar chart), and component presentation (mimic vs. simplified graph) were considered.

Listed below are the HSI Style Guide (Reference 6.2.2) guidelines that address the evolution of the HSI and the decisions made to improve the interface. (1) NuScale Guideline

Title:

Operator Information Linking, NuScale HSI Style Guide, ES-0304-1381-7925. (2) NuScale Guideline

Title:

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 (3) NuScale Guideline

Title:

User Verification of Higher-Level Information, NuScale HSI Style Guide, ES-0304-1381-7933.

3. All techniques for facilitating navigation and orientation of the system (formats, terminology, grouping, windowing and operator's decision-support aids) reflect a clear logic based on task requirements. Each display, control, and data-processing aid to the overall task/function was made such that operators can recognize where they are in the data space and rapidly access data not currently visible (e.g., on other display pages).

Listed below are the HSI Style Guide (Reference 6.2.2) guidelines that address proper menu and navigation design. (1) NuScale Guideline

Title:

Menu Design, NuScale HSI Style Guide, ES-0304-1381-9116. (2) NuScale Guideline

Title:

General List of Menu Options, NuScale HSI Style Guide, ES-0304-1381-9002.

4. Direct manipulation interfaces allow users to act on visible objects to accomplish tasks, e.g., opening a display by clicking on its icon. Icons shown on mimic displays represent specific plant components, systems, or functions. Clicking on them may provide access to information about these components and systems, or display an interface for their operation. Input is provided by using a pointing device to manipulate the graphical object, causing the computer operations to be performed on the object or information it represents.

5. The basic function of soft control systems is to provide operators with control interfaces that are mediated by software rather than by direct physical connections.

The HFE design team used the guidance provided in the Soft Controls section of Reference 6.2.2 for the implementation of soft controls.

6. The HFE design team created an alarm filtering and prioritization schema for the plant notifications. This schema is discussed below in the HSI Concept of Use section of this RSR.

7. The traditional computer-based procedures are being developed for the NuScale plant for use during the ISV testing phase. The embedded procedure schema that NuScale designed is discussed in Section 4.3.4.

4.3.2 Develop a Human-System Interface Global Layout and Navigation Schema A well-designed navigation schema is critical to support the goal of reducing the number of operators in the NuScale MCR. The navigation design incorporates the organization of shared information, screen content, and labeling schemes in a way that is easy for the operators to find, understand, and manage. © Copyright 2019 by NuScale Power, LLC 38

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 The navigational design developed utilized a global architecture that works to incorporate the navigational look and feel throughout the library of pages. When developing the TA and associated conceptual sketch, attention was paid to where and how the navigation development fit within the navigation organizational structure as shown in Figure 4-6. ((

                                                                                                           }}2(a),(c)

Figure 4-6. Example of a navigation schema Developing more than one path to a desired HSI element achieves a goal of the HFE design team. Operators react and respond differently while trouble shooting a problem so the HSI navigation should not restrict the operator to follow a single-minded solution. By providing multiple navigational paths, the operators have the freedom to choose a path that best matches their mental model. 4.3.3 Develop Notification Schema Plant notifications are a vital piece of the HSI design. It must aid the control room staff in understanding the current plant status without creating distracting clutter. The NuScale notification icons are shown below and discussed further in the HSI Concept of Use section of this RSR. © Copyright 2019 by NuScale Power, LLC 39

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                         }}2(a),(c)

Figure 4-7. NuScale notification alarm, caution and notice icons 4.3.4 Develop Procedures ((

                                                                    }}2(a),(c) 4.3.5     Develop Automated Processes Due to the fact that most processes and transitions in a NuScale plant are controlled by automation, an automation interface schema was developed. The schema developed includes how operators will interact with the automation processes to provide limits, ensure prerequisites, initiate changes, secure evolutions, and monitor additional process elements as the design matures.

4.3.6 Conceptual Sketches A conceptual sketch is a two-dimensional illustration of an interface that specifically focuses on space allocation and prioritization of content, functionalities available, and © Copyright 2019 by NuScale Power, LLC 40

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 intended behaviors. For these reasons, conceptual sketches typically do not include any styling or graphics. Conceptual sketches also help establish the relationships between an application and its various screen templates. An example of a conceptual sketch is shown in Figure 4-8. ((

                                                                 }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Conceptual sketches serve multiple purposes by helping to:

communicate and explore the concepts that come out of sketching the system.
connect the system page to the HSI library navigation schema.
clarify consistent ways for displaying particular types of information on the system page.
determine intended functionality in the interface.
prioritize content through the determination of the amount of space to allocate to a given item and where that item is located.

((

                                                                                                    }}2(a),(c)

Figure 4-8. Example of a conceptual sketch

3. ((

                                                                    }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                    }}2(a),(c)

Figure 4-9. Example of a HSI display page

5. ((

                                                                                             }}2(a),(c) 4.3.7    Rapid Prototyping and Trade Off Evaluations While the simulator provides a realistic user experience with the system, the focus in this effort is on rapidly testing design concepts and soliciting feedback. Rapid prototyping centers around capitalizing on the simulators ability to provide a platform where software code and hardware layouts can be quickly evaluated and dismissed or modified in fast subsequent development iterations.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.3.8 Human-System Interface Design Evolution Phase 1 and 2 of the simulator development effort focused on significant software code changes that developed the data exchange between the HSI and the plant models. As a result, the HSI did not change with respect to the graphics, just the connectivity to the models. Efforts to format the HSI began in Phase 3 with the creation of the HFE design team and the start of weekly simulator team meetings. During each phase of the development, a list of changes and the reasons for those changes was discussed. Note: Only the display page elements that the HFE design team deemed relevant to the HSI design evolution and implementation process were discussed. 4.3.8.1 Display Page Evolution During Phase 3, the HFE design team focused on the page navigation schema and overall HSI page design. The goal was to design an HSI that provided a common look and feel with an SDCV navigation interface. Following this concept would provide the operators with easy to use HSI that provides continuous access to the navigation buttons regardless of which page is displayed. ((

                                                     }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

11. ((

                                                                                                           }}2(a),(c)

Figure 4-10. Phase 3 human-system interface design evolution Phase 4 of the design focused on the HSI layout by performing early task support verification and enforcing the newly developed HSI Style Guide. As a result, more required information and consistency was added to the use of colors and icons. ((

                             }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

4. ((

                                                                                                  }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                           }}2(a),(c)

Figure 4-11. Phase 4 human-system interface design evolution Phase 5 of the design created a more simplistic and easier to use interface. The design team determined that the Phase 4 display was cluttered and the navigation interface was becoming cumbersome, so the design team made the decision to provide ((

                                                                   }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

3. ((

                                        }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                      }}2(a),(c)

Figure 4-12. Phase 5 human-system interface design evolution Phase 5.3 of the HSI design was primarily inspired by the scenario development and testing leading up to the staffing validation effort. ((

                                                                                     }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

4. ((

                                                         }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                          }}2(a),(c)

While these particular touch points do not meet the style guide requirements for size, the design team has waived that requirement here because it is a secondary means of accessing the system page. ((

                                                                                                           }}2(a),(c)

Figure 4-13. Phase 5.3 human-system interface design evolution 4.3.8.2 Unit Group View Display Evolution This particular HSI page is individually discussed due to the significant role it plays in the success of the NuScale staffing qualification effort. All evolutions mentioned in the Display Page Evolution section above apply to the GVD evolution with a few unique characteristics about the GVD page added below. © Copyright 2019 by NuScale Power, LLC 51

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Phase 3 of the GVD page was developed to test out many options that the team thought would be needed by the operation crew. During the first phases of the simulator layout many parameters, icons, and alarm tile concepts were evaluated on the GVD while the plant models were being developed and tested. The large format of the GVD allowed the team to evaluate many ideas at once for their inclusion on the GVD and elsewhere in the HSI library. The GVD is a SDCV page that will not have any navigation capabilities. Its purpose is to provide unit specific information needed by the operating crew to safely operate the plant. ((

                                                                   }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                     }}2(a),(c)

Figure 4-14. Phase 3 unit group view display page ((

                                                                                                        }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                         }}2(a),(c)

Figure 4-15. Phase 4 unit group view display page ((

                                   }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                       }}2(a),(c),ECI Figure 4-16.       Phase 5 unit group view display page

((

                               }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                       }}2(a),(c),ECI Figure 4-17.       Phase 5.3 Unit group view display page - normal operations

((

                                                                                                       }}2(a),(c),ECI Figure 4-18.       Phase 5.3 Unit group view display page - shutdown operations

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.3.9 Color Selection Chart The NuScale software design team has two HSI software designers with color vision deficiency. This allowed the HFE design team to create and test a color palette that serves users with similar color vision deficiencies. 4.3.10 Chevron Icon ((

                                                                                          }}2(a),(c)

Figure 4-19. Chevron icon 4.3.11 Reactor Module Icon ((

                                               }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                 }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                         }}2(a),(c)

Figure 4-21. RXM icon views 2 ((

                                                                                        }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                          }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                      }}2(a),(c)

Figure 4-23. RXM icon view 4 4.4 Human-System Interface Concept of Use The operating crew is responsible for the safe operation of the plant and maintaining power production. This section discusses how the HSI design helps the crew communicate amongst themselves and with other members of the staff outside of the MCR. The HSI design provides intuitive HSIs and supervisor oversight that minimizes personnel errors (e.g., performing the right action on the wrong module) and supports error detection and recovery capability. Some of the attributes of the HSI are listed below and discussed in greater detail in the following subsections. © Copyright 2019 by NuScale Power, LLC 61

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                }}2(a),(c)

Figure 4-24. Stand-up unit labeling example ((

                                                                                                              }}2(a),(c)

Figure 4-25. Main navigation bar labeling example ((

                                                                                     }}2(a),(c)

Figure 4-26. Control element pop-up window ((

                            }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                    }}2(a),(c),ECI Figure 4-27.       12 unit overview

((

                                                                                                     }}2(a),(c),ECI Figure 4-28.       Safety function monitoring page

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.4.1 Direct Component Operation NuScale HSI system display pages were created using the system PI&D and TA. The pages have the capability to control the components needed to successfully complete tasks and monitor parameters needed to maintain safe operation of the plant. The Chemical Volume and Control System page is shown below as an example of a typical NuScale HSI display page. ((

                                                                                                          }}2(a),(c)

Figure 4-29. Chemical volume and control system display page ((

                                                           }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.4.2 Embedded Procedures ((

                                                                                                     }}2(a),(c)

Figure 4-30. Process library page

1. ((

                          }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

7. ((

                                                                                                         }}2(a),(c)

((

                                                                                                               }}2(a),(c)

Figure 4-31. Process library page showing an embedded procedure

9. ((

                                                                                                }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                               }}2(a),(c)

Figure 4-32. Process library - active process progress bar ((

                                                                                              }}2(a),(c) 4.4.3    Automation Interface

((

                                                 }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                           }}2(a),(c)

Figure 4-33. Process library - showing automation 4.4.3.1 Continuous Monitoring A key HSI feature associated with automated operation is to enable performance monitoring by operators. The HSI enables operators to manage automation by providing the necessary information, displays, and controls to enable support observation, independent verification, and operator intervention. For example, if automation is monitoring or controlling a parameter, operators have access to observe the setpoints for action and consequential actions should the setpoint be reached. If the setpoint allows for operator adjustment, then the operator may intervene and adjust appropriate setpoints within allowable limits. 4.4.3.2 Repetitive Tasks ((

                                                             }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.4.3.3 High Cognizant Burden Functions ((

                                                            }}2(a),(c) 4.4.3.4 Startup and Shutdown

((

                                                                       }}2(a),(c) 4.4.3.5 Power Maneuvering

((

                                                                                                       }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                            }}2(a),(c),ECI 4.4.3.6 Primary System Process Control Key reactor coolant parameters are continuously monitored by automation. When one of these parameters approaches the administrative limit, the automation responds.

Depending on the parameter, the associated automation may respond with or without operator involvement. Reactor pressure control at normal operating pressure is an example of primary system process control without operator involvement. As described above under continuous monitoring, operators may elect to monitor the pressure controlling automation performance at any time. The automation controlling pressure does so without direct operator involvement. The operator may elect to take manual control, such as for drawing or collapsing the pressurizer steam bubble or changing the control pressure during automatic operation. Boron concentration control is an example where operator control may be used. The automation monitors dilution and boration history, average coolant temperatures, pressurizer level, core age, historical power, and boron concentration data to generate recommendations for dilution or boration. When the automation detects conditions warranting a dilution or boration, the automation notifies the operator with an action recommendation and recommended limits. Supporting the recommendation, the automation provides the supporting basis for this recommendation, thereby facilitating the operators evaluation of the recommendation. The operator may elect to take no action, accept the recommendation, or modify the recommended dilution/boration/letdown actions within the recommendation limits. Once the automation begins performing the sequence, the operator may abort or alter the sequence at any time. 4.4.4 Shared Roles 4.4.4.1 Parameter Monitoring Automation performs functions associated with parameter and process monitoring, defined sequence functions, continuous process control, alert and alarm monitoring, safety limit monitoring, and automatic safety functions. Operators monitor and evaluate automated functions, intervening as required. Operators may also elect to share control with the automation or assume control of the automated function. © Copyright 2019 by NuScale Power, LLC 70

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Generally, operators observe process parameters being monitored by automation. This shared role of process monitoring supports situational awareness and enables the operator to evaluate automated system performance. Operators increase attention to performance monitoring when

transients are anticipated.
an automated operation needs to be confirmed.
degraded automation is suspected.

4.4.4.2 Operator Intervention Operators intervene when it becomes apparent that the automation has failed or when the automation is no longer appropriate for the current or planned plant conditions. The criteria for operator intervention involve judgment of continued safe operation of the plant. 4.4.5 Plant Notifications ((

                                                                                                    }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.4.5.1 Functional Specifications ((

                                                                              }}2(a),(c) 4.4.5.2 Tiered System

((

                     }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

4. ((

                                                           }}2(a),(c) 4.4.5.3 Personnel Response Operators respond to all notifications promptly regardless of type. The type only impacts the operators response to a notification when more than one notification is received.

Emergent alarms are addressed before cautions, and cautions are addressed before notices, etc. ((

                                                   }}2(a),(c) 4.4.5.4 Plant Notifications Human-System Interface Implementation

((

                                        }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                           }}2(a),(c)

Figure 4-34. Main navigation bar with notifications circled ((

                                                                            }}2(a),(c) 4.4.5.5 Alarm Definition and Criteria

((

                                    }}2(a),(c) 4.4.5.6 Navigation and Alarm Response

((

                                                                    }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                           }}2(a),(c)

Figure 4-35. NuScale non-active alarm icon ((

                                                                }}2(a),(c)

((

                                                                            }}2(a),(c)

Figure 4-36. NuScale active alarm icon ((

                                 }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                         }}2(a),(c)

Figure 4-37. NuScale acknowledged alarm icon ((

                                                       }}2(a),(c)

((

                                                                         }}2(a),(c)

Figure 4-38. NuScale cleared alarm icon ((

                 }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                          }}2(a),(c)

Figure 4-39. Summary of NuScale alarm icon behavior ((

                                                                             }}2(a),(c) 4.4.5.7 Caution Definition and Criteria

((

                         }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.4.5.8 Navigation and Caution Response ((

                  }}2(a),(c)

((

                                                                               }}2(a),(c)

Figure 4-40. NuScale active or acknowledged caution icon ((

                             }}2(a),(c)

((

                                                                                   }}2(a),(c)

Figure 4-41. NuScale cleared caution icon ((

                 }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                        }}2(a),(c)

Figure 4-42. Summary of NuScale caution icon behavior ((

                                                                              }}2(a),(c) 4.4.5.9 Notice Definition and Criteria

((

                             }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                        }}2(a),(c)

Figure 4-43. NuScale notice icon 4.4.5.10 Status Indication Definition and Criteria ((

                                                                        }}2(a),(c)

((

                                                                               }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                     }}2(a),(c) 4.4.5.11           Event Definition and Criteria

((

                                                                   }}2(a),(c) 4.4.5.12           Integration with other Human-System Interface Elements

((

                                                                                                        }}2(a),(c) 4.4.5.13           Safety Function Monitoring Page

((

                         }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                             }}2(a),(c)

((

                                                                                                       }}2(a),(c),ECI Figure 4-45.       Safety function monitoring page example

((

                 }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                   }}2(a),(c),ECI Figure 4-46.       Safety function monitoring page with notifications

((

                               }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                       }}2(a),(c),ECI Figure 4-47.       12 unit overview page displaying the safety function notifications 4.4.6    Operations Crew Interaction

((

                                                                   }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                   }}2(a),(c)

Figure 4-48. Example operator active and passive control icons 4.5 Human Factors Engineering/Human-System Interface Design Guidance 4.5.1 NuScale Human-System Interface Style Guide Description 4.5.1.1 Introduction The NuScale Human-System Interface Style Guide promotes design consistency of human interface design components throughout the plant. The primary users of the style guide are:

the NuScale Plant Operations group
simulator Plant Modeling engineers
HFE/HSI engineers
display page developers
I&C engineers
System engineers The initial design and development of the MCR and the individual workstations located within the MCR follow the style guides requirements and guidelines. Additionally, the designers apply the appropriate level of HFE fundamentals to design an intuitive, user-friendly work environment and simple but informative HSI display pages.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 This style guide was primarily developed by integrating requirements and guidelines from NUREG-0700 (Reference 6.1.1). Other accepted commercial HSI and military HFE design standards were reviewed, and are properly referenced where appropriate. The development of the guide fulfills the NUREG-0711 (Reference 6.1.2) guidance to ensure the implementation of HFE/HSI principles in the development of NuScale HSI display pages, work locations and workstations. The inclusion of early and continuous HFE activities, as defined in the style guide, throughout the entire design process results in safer and more reliable operation of the plant. It provides the baseline design verification needed for a combined license application. This document is a living document, meaning changes will be made during the HSI design and verification and validation (V&V) process. Version control is provided through the use of the requirements management software tool, Dynamic Object Oriented Requirements System (DOORS). 4.5.1.2 Purpose The purpose of this document is to provide a single NuScale Power oriented and easy-to-use source of human factors and human system interface guidance. It consolidates guidance from the source materials of several government and commercial agencies and provides one reference for application to NuScale Power plants. It primarily draws upon NUREG 0700 guidance, but does selectively draw from other documents oriented to other agency missions and adapts and expands upon them to meet the needs of the NuScale Power plants missions and systems The style guide is intended to promote consistency and user interface best practices across all aspects of the NuScale HSI design that impact the intended users ability to successfully perform tasks and achieve operational goals. This includes any workstation informational display pages and controls. The scope of this standard covers all aspects of the overall plant design including:

the human system interface (display pages) for control panels
environmental considerations including ambient noise levels, temperature, lighting
communications including public address, telephones, microphones, email, and text
electronic document support including tech manuals, training, and on-line help
input devices such as touch screens, laptops, tablets, mice, trackballs, joysticks, and cameras
output devices such as laptops, tablets, printers, plotters, and video screens
hardware such as physical switches, knobs, gauges, and analog and digital meters
anthropometric and ergonomic considerations for the immediate work area

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 These aspects of the plant design combine to create the total user experience and contribute to the users ability to efficiently, effectively, and accurately complete tasks. The style guide is written to help optimize the interaction of these elements of design. 4.5.1.3 Promote Consistency The NuScale HSI Style Guide promotes the creation of user interfaces that are consistent throughout the plant. When user interface consistency is achieved for similar work across all users, ease of use and ease of learning will be significantly improved. The style guide addresses both work location and workstation user interface design consistency and is intended for use by the HFE design team as part of a comprehensive HSI process. 4.5.1.4 Increase Awareness of the Importance of Human Factors Engineering and Human-System Interface The HSI Style Guide increases awareness and understanding of the importance of integrating HSI processes and HSI design requirements into the design and development for the NuScale plant design. The benefits of applying HSI processes and HSI design requirements early in the development cycle is that it promotes consistency and efficiency, which provides a cost advantage for the design, operation, and overall lifecycle of the plant, including standardization of maintenance and training. 4.5.1.5 Applicability The requirements and guidelines are applied to design and development efforts for the NuScale Power plant. The HFE design team utilizes the style guide standards in the design of operator workstations and the locations they are managed from. The HFE design team created the NuScale HSI Style Guide (Reference 6.2.2) early in the simulator development effort to be continuously applied throughout the design lifecycle thereby serving as the set of guidelines and requirements meant to drive display page consistency and incorporate lessons learned from previous design efforts. The style guide is unique in that it represents more than just a collection of HFE/HSI requirements. The style guide is designed to supply the users of the document all of the information, requirements, functional specifications, and examples in one location. The NuScale HSI Style Guide consists of three volumes and a set of appendices as discussed and shown below. © Copyright 2019 by NuScale Power, LLC 87

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Figure 4-49. NuScale human system interface style guide organization 4.5.2 Volume I Style Guide Administration and Process Sections Volume I provides administrative and background information for the HSI stakeholders, system engineers, and management. Any information that describes how to use the HSI Style Guide and all reference documents used to create the style guide are included in this volume. Chapter topics include but are not limited to:

purpose and organization of the volumes
intended users/stakeholders
process for change within the volumes
process for using Volume II, Volume III and the appendices to design and develop HSI display pages 4.5.3 Volume II Common Human-System Interface Requirements and Guidelines Volume II provides the users with a single, common set of HSI guidelines and requirements that are system independent. All sources are consolidated into this volume and include the adjudication of the differences, where necessary.

The sources, at a minimum, include:

NUREG 0700
ANSI and HFES

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.5.4 Volume III System Human-System Interface Description and Display Page Examples Volume III provides the HSI Library that reflects the implementation of Volume II. The volume will contain chapters comprised of specific information about a system, location, or concept in a NuScale Plant. Volume III will be provided to a combined operating license applicant upon request. Chapter topics include but are not limited to:

system overview and scope
definitions
system specific information
HSI display page 4.5.5 Appendices Specific NuScale Human-System Interface Design Information The appendices have been created as designer guides that address key HFE and HSI design elements. Their use drives consistency and commonality throughout the project.
Appendix A - Language and Text
Appendix B - Color Usage
Appendix C - User Interfaces
Appendix D - Display Page Design
Appendix E - Plant Notifications
Appendix F - Safety Display and Indication System
Appendix G - HFE Design
Appendix H - Automation and Computer-based Procedures 4.5.6 Concept of Operations The concept of operations provides an overview of the supporting processes, individual roles, operations staffing, crew structure, and operating techniques that will be used by the operating crews of a NuScale facility to achieve safety and production goals.

4.5.7 Conduct of Operations The conduct of operations provides a set of standards to influence operator behaviors to ensure high quality, consistent, task performance that supports the safe and reliable operation of the NuScale plant. This is applicable to all on-shift operations staff. © Copyright 2019 by NuScale Power, LLC 89

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.6 Human-System Interface Detailed Design and Integration 4.6.1 General Considerations In addition to the input elements discussed in Section 4.1, the HSI process also took into consideration the design elements listed below. HFE issues initiated and tracked in HFEITS during the analyses performed with the NuScale simulator (testbed) were evaluated during HSI design and incorporated as appropriate. 4.6.1.1 Important Human Actions The NuScale HSI design minimizes the probability of error in the performance of IHAs and provides the opportunity to detect errors, should they occur. A minimum of two actions are required for all VDU controls (e.g., an action to call up the control function on the VDU (a pop-up window) and an action to actuate the control). This two-step actuation technique reduces the potential for erroneous operator actions that could cause a transient. 4.6.1.2 Human-System Interface Layout Bases The layout of workstations (number and location of VDUs) in the MCR, the arrangement or hierarchy of the individual HSI screens for each workstation, and the arrangement of the workstations within the MCR are based on job analysis, an understanding of the frequency and sequence of use (e.g., considers procedures for startup, shutdown, normal operating, abnormal operating, and accident situations), and the roles defined for operators during S&Q analysis. The HSI layout in the MCR is specifically designed to support staffing during all operating plant modes. Shared system VDUs and unit and plant overview VDUs are located such that they can be observed from multiple locations within the MCR. Unit workstations are spaced so that side-by-side operation at adjoining units allows sufficient elbow room. 4.6.1.3 Human-System Interface Support for Inspection, Maintenance, and Testing The NuScale HSI is designed to support inspection, maintenance, test, and repair of plant equipment. The IRM system is used to control work and manage component tagging for out-of-service conditions. IRM information is used (directly or indirectly) to communicate status information to the HSI, which uses the shading and a color scheme to alert the operators of those conditions on the system display VDUs. Figure 4-50 shows the most current notification examples of possible states or conditions that a control element can have in a NuScale plant. As the HSI design evolves, this list may change if different solutions or new conditions are discovered. © Copyright 2019 by NuScale Power, LLC 90

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                          }}2(a),(c)

Figure 4-50. Example of NuScale icon status indicators 4.6.1.4 Support for Staffing Conditions The NuScale HSI supports minimum staffing. The passive features, modular design, and high degree of automation reduce the number of alarms, controls, indications, and procedures. The automation, along with the reduced task burden of managing the HSI, enhances the ability of operators to maintain SA of overall plant conditions. The use of minimum staffing to operate the plant safely was confirmed through the analysis of IHAs, TA, and S&Q. In addition, the HSI design activity included the MCR facility, which is the result of HSI design and has been validated for the conditions included in the SPV scenarios. 4.6.1.5 Human Performance/Fatigue The NuScale HSI is designed to enhance human performance by reducing fatigue. Automation of plant functions reduces repetitive tasks. Reduced navigation between individual screens is accomplished by simplified plant design. The arrangement or hierarchy of individual HSI screens is based on job analysis, the frequency and sequence of use, and operator roles to increase the simplicity of navigation. Task-based displays are incorporated to reduce navigation steps during procedure use. VDUs are designed for pointing device (e.g., mouse) operation. © Copyright 2019 by NuScale Power, LLC 91

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 In addition, the detailed design conducted during the HSI design element optimizes MCR facility attributes that are known to affect fatigue, such as lighting, ergonomics, and overall physical layout. 4.6.1.6 Environmental Conditions MCR environmental conditions comply with Regulatory Guide 1.196 with regard to temperature, humidity, air quality, and radiation protection. Auxiliary systems such as heating, ventilation, air conditioning, and lighting systems are designed by other engineering disciplines with input from the HFE design team. 4.6.1.7 Human-System Interface Updates of Plant Modifications ((

                                                                                      }}2(a),(c) 4.6.2    Main Control Room The HFE design team ensured that the HSI process and the resulting products addressed the following important MCR considerations:

1. Safety Display and Indication Console The NuScale PRA, Safety Analysis, and Plant Operations groups considering the guidance of NUREG-1342 determined the critical safety functions. The selection of the variable type (A, B, C, D, or E) was performed. The minimum set of parameters chosen for display are available on the SDCV SDI display panel for each unit in the MCR. An SDI Display page example is shown in Section 7.0.

Note: There are no Type A variables in the NuScale plant design or E variables shown on the SDI HSI. The NuScale HSI design addresses the 10 CFR 50.34(f)(2)(iv) requirement to provide a plant safety SDI console that will display to operators a minimum set of parameters defining the safety status of the plant, capable of displaying a full range of important plant parameters and data trends on demand, and capable of indicating when process limits are being approached or exceeded as discussed below. The SDI bank of SDCV video display units provides redundant, highly reliable indications of plant conditions provided by the MPS and PPS networks. Operators rely on these indications to give them the status of the plant during normal operations and for 72 hours © Copyright 2019 by NuScale Power, LLC 92

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 after a loss of normal power. Additionally, the MPS and PPS provide information to the MCS and PCS, respectively, via unidirectional communication paths. The PCS and MCS communicate with each other via bi-directional communication paths. Each SDI VDU will provide one display page that covers all five modes of operation. This is appropriate based on the plants simple, passive design where all required information can be displayed on a single HSI page. This approach allows for a more simplistic SDI implementation and provides the operators with consistent display page behavior across all SDI VDUs. The organization of information (e.g., grouping) of related data is important for supporting prompt recognition and comprehension of plant status. The information presented by the SDI includes parameters and indications of functions important to plant safety. Important presentation characteristics include the conciseness of the display format, the arrangement of information, the range of conditions displayed, the display system's response to transient and accident conditions, the data sampling rate, the display's accuracy, the continuous presentation of information, the visibility of displayed data, limit marks for variables, and the indication of magnitudes and trends for variables. Some of the more important SDI display page requirements are listed below:

The SDI display page parameters accuracy and update sampling rates will be consistent with the MPS/PPS system that drives them.
The SDI display page will provide visual cues for the initiation and completion of a safety function by highlighting a reserved area on the display page indicating the current status of that function. Each safety function has its own status area reserved on the display page.
The SDI display page will utilize the trending feature to a set of predetermined parameters to help the operators maintain attention to slow and rapidly changing variables.
The SDI display page trends will be appropriately scaled to the magnitudes of the variables in 5-10 divisions based on the parameter(s) being displayed. The trends will be designed to provide the adequate space for scaling. All trend areas will have a 30 min data display requirement with no auto-ranging capability.

        *    ((
                     }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

        *    ((
                                                               }}2(a),(c)

2. Bypassed and Inoperable Status Indication The NuScale HSI design addresses the bypassed or inoperable status indication (BISI) function 10 CFR 50.34(f)(2)(v) requirement to provide for automatic indication of the bypassed and operable status of safety systems as discussed below.

The HSI continuously monitors the operability and position status of the components supporting the plant safety related functions. The HSI updates the information on the appropriate system display pages and for the SDCV locations. ((

                                                                                                           }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                               }}2(a),(c)

3. Relief and Safety Valve Position Monitoring The NuScale HSI design addresses the 10 CFR 50.34(f)(2)(xi) requirement to provide direct indication of relief and safety valve position (open or closed) in the control room as discussed below.

((

                                                                                                           }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                          }}2(a),(c)

4. Manual Feedwater Control 10 CFR 50.34(f)(2)(xii) refers to a safety-related auxiliary feedwater system that is not applicable in the NuScale plant.

5. Containment Monitoring The NuScale HSI design addresses the 10 CFR 50.34(f)(2)(xvii) requirement to provide instrumentation to measure, record and readout in the control room: (A) containment pressure, (B) containment water level, (C) containment hydrogen concentration, (D) containment radiation intensity (high level), and (E) noble gas effluents at all potential, accident release points as discussed below.

The HSI provides containment vessel pressure, water level, and radioactive release path ((

                                                          }}2(a),(c)

Note: The underlying purpose of the containment hydrogen monitoring requirements of 10 CFR 50.44(c)(4), and 10 CFR 50.34(f)(2)(xvii)(C) is to:

1) identify and assess core damage during and following an accident, and

2) assess containment combustible gas conditions to determine if mitigating actions are required.

The containment hydrogen level parameter is not needed for assessing core damage because the NuScale design uses the under Bioshield Radiation monitors to provide core damage assessment capabilities. The containment hydrogen level parameter is used for assessment of containment combustible gas conditions during and following a design bases event or beyond design bases event. Because the containment sampling system equipment is located outside of the containment, the continuous monitoring of hydrogen level for the combustible gas control is unavailable when the containment is isolated during an accident scenario. However, containment hydrogen monitoring immediately after an event is not necessary as hydrogen combustion scenarios occurring within 72 hours following an event initiation have no adverse effect on containment integrity or plant safety functions. The analysis of combustion events in the NuScale containment demonstrates that no compensatory measures or mitigating actions are required for any scenario, within the first 72 hours of an event. Accumulation of combustible gases beyond 72 hours can be managed by licensee implementation of severe accident management guidelines because after 72 hours, sufficient time is available to implement mitigating actions. Containment gas sampling © Copyright 2019 by NuScale Power, LLC 96

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 and the monitoring of flow paths can be re-established when the plant conditions are amenable to perform post-accident sampling. The NuScale HSI displays noble gas effluents using information from radiation monitors installed at each potential effluent point. The HSI will alarm when the noble gas release rate, for each release point, exceeds the rate that would result in an emergency declaration. There will also be additional notifications, for each release point, set at a rate below the emergency declaration release rate. These additional notifications provide the operator with situational awareness cues of changing radiological conditions and that an effluent parameter is trending toward an emergency declaration.

6. Core Cooling The NuScale HSI design addresses the CFR 50.34(f)(2)(xviii) requirement to provide unambiguous indication of inadequate core cooling, such as primary coolant saturation meters in pressurized water reactors (PWR), and a suitable combination of signals from indicators of coolant level in the reactor vessel and in-core thermocouples as discussed below.

((

                      }}2(a),(c)

7. Post-accident Monitoring The NuScale HSI design addresses the CFR 50.34(f)(2)(xix) requirement to ensure the monitoring of plant and environmental conditions following an accident that includes core damage as discussed below.

The HSI provides indication of plant conditions following an accident including core damage on the appropriate SDI display VDU in the MCR. Refer to the Safety Display and Indication System (Item 1 above) for more detail on the type of information displayed at this location.

8. Leakage Control The NuScale HSI design addresses the 10 CFR 50.34(f)(2)(xxvi) requirement to provide for leakage control and detection in the design of systems outside containment that contain (or might contain) accident-source-term radioactive materials following an accident as discussed below.

During accident conditions, the CVC is isolated from the RCS by the containment isolation valves and is not needed to circulate primary coolant outside of containment. In © Copyright 2019 by NuScale Power, LLC 97

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 addition, there are no safety systems that circulate reactor coolant outside of containment. However, in order to support post-accident sampling by the PSS, the CVC is capable of being unisolated from the RCS, when conditions permit, to establish the sample flow path from the CVC discharge piping upstream of the Regenerative Heat Exchanger. The leakage control and detection parameters for systems outside containment are provided on the display pages that are available on the workstation VDUs in the MCR. These parameters include flows, pressures, tank levels, radiation levels, and alarms generated from these indications.

9. Radiation Monitoring The NuScale HSI design addresses the 10 CFR 50.34(f)(2)(xxvii) requirement to provide appropriate monitoring of in-plant radiation and airborne radioactivity for a broad range of routine and accident conditions as discussed below.

Radiation monitoring for the NuScale plant is a shared unit system. Thus, the monitoring and display of in-plant radiation and airborne radioactivity for the range of routine and accident conditions is on the common systems panel VDU in the MCR. In addition, the Feed and Condensate and Containment Evacuation display pages contain trends to display system radiation levels.

10. Manual Initiation of Protective Actions As required by Regulatory Guide 1.62, safety system automation override and manual initiation of safety functions during unanalyzed conditions is provided ((

                                           }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                           }}2(a),(c)

Figure 4-51. Hard-wired manual actuation switches

11. Diversity and Defense-in-depth

((

                                                                   }}2(a),(c)

((

                                          }}2(a),(c),ECI

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                           }}2(a),(c)

Figure 4-52. Hard-wired non-safety enable switch

12. Important Human Actions The NuScale HFE/HSI design minimizes the probability of error in the performance of IHAs and provides the opportunity to detect errors, should they occur. ((

                                      }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                               }}2(a),(c)

13. Computer-Based procedure platform Procedures are provided to guide operators in all aspects of plant operations at a NuScale plant. Traditional paper-based procedures will be available. The use of computer-based procedures facilitates mobility and enhances operator use. NuScale computer-based procedures are designed in accordance with the guidance in Section 8 of Reference 6.1.2 and Section 1 of D I&C ISG-05 2008.

NuScale investigated several types of computer-based procedure techniques so that the unique need of the plant is satisfied. Complete electronic versions of the paper copies are available on a tablet via the computer-based procedure system. This will help operators outside of the MCR to have mobile versions of all the procedures. The operators inside of the MCR will also have access to this system via a tablet as well as paper-based procedures for back-up purposes. Note I: Neither the computer-based procedure system, nor the paper-based procedures are part of this RSR discussion. ((

                                                                                }}2(a),(c)

All three versions (i.e., paper, electronic and embedded) of the procedures are available for ISV testing. 4.6.3 Locations outside of the Main Control Room The suite of HSI display pages used to provide the alarms, indications, procedures and touch controls to the MCR are available in the RSS. The operators will be provided a set of MCS and PCS displays identical to the MCS and PCS displays in the MCR which include the process variables necessary to monitor safe shutdown of multiple modules via the navigation schema designed by NuScale. © Copyright 2019 by NuScale Power, LLC 101

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 The RSS provides an alternate location to monitor the NuScale Power Module (NPM) status and to operate the MCS and PCS following a MCR evacuation. The MCS equipment in the RSS provides a set of MCS and PCS displays identical to the MCS and PCS displays in the MCR for the process variables necessary to monitor safe shutdown of each NPM. SDI displays are not provided in the RSS as there is no manual control of safety-related equipment allowed from the RSS. The only differences between the I&C system control/monitoring between the MCR and RSS is:

No SDI displays provided in RSS.
No manual actuation switches provided in RSS.
No nonsafety-enable switch provided in RSS (hence, no ability to control safety-related components).
No override switches provided in RSS.
Two MCR isolation switches (one per division) are provided in the RSS to isolate the MCR manual actuation and nonsafety-enable switches.

The HSI of the TSC, the EOF, and LCS are all derivatives (i.e., operated from the same platform and connected to the same I&C distributed control system) of the MCR HSI. The HSI in the TSC and EOF are for information display only. No control functions are provided in any of the emergency response facilities. 4.6.4 Local Control Stations Design The HSIs on the VDU-based LCSs are MCR derivatives. For vendor-supplied LCSs, the NuScale HFE program scope is limited to ensuring that those interfaces adhere as closely as possible to Reference 6.2.2. Inputs from the vendor-supplied LCSs are replicated on the VDU-based HSI on an as-needed basis. 4.7 Degraded I&C and Human-System Interface Conditions The NuScale plant is controlled with fewer operator actions than current PWRs due to the number of passive safety features, fail-safe components, and the high degree of automation. The NuScale plant HSI is designed to accommodate specific types of I&C and HSI system failures. Procedures govern operator identification of and response to the various failure modes. I&C sensor failures are accounted for in the diversity and defense-in-depth coping analysis (Reference 6.2.8). Sensors are redundant within system trains and safety © Copyright 2019 by NuScale Power, LLC 102

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 systems have multiple trains. Alarm response procedures guide operator troubleshooting. Failures of individual HSI VDUs are accommodated for by use of other VDUs at the workstation, by use of another workstation or by use of the stand-up unit workstations. Failures of hardware that lead to loss of all VDUs at a workstation are accommodated by redundant MCR-derivative VDUs in the RSS. Generally, the unit with a failed MCR stand-up workstation is shut down. Automated functions have manual backup at the MCR workstation. Failures of automation sequences are alarmed in the MCR. Operators also monitor most automation for expected plant response and detect automation failures when plant response is not as anticipated. Multiple communications systems are included in the NuScale plant design. Failure of one is accommodated by use of another and controlled by procedure. TA includes consideration of loss of HSIs that support IHAs as discussed in Reference 6.2.6. TA findings are incorporated in the HSI design as described above in the HSI inputs section. 4.7.1 Defense in Depth Modern control systems rely on digital I&C systems that possess considerably more power and functionality than their analog predecessors. The I&C system senses basic parameters, monitors performance, integrates information, and makes needed adjustments to plant operations. Digital I&C systems enable the precise monitoring of the plants performance, thus providing better data to control systems. In turn, improved controls support better performance and offer a means to operate closer to performance limits. The use of digital computer technology in I&C systems could result in safety-significant common-cause failures (CCFs). Some of the major concerns are:

Common-mode failures could defeat the redundancy achieved by the hardware architectural structure, and could result in the loss of more than one echelon of defense-in-depth provided by the monitoring, control, and reactor protection, and engineered safety functions performed by the digital I&C systems.
The two principal factors for defense against common-mode and common-cause failures are quality and diversity. Maintaining high quality will increase the reliability of both individual components and complete systems. Diversity in assigned functions (for both equipment and human activities) equipment, hardware, and software, can reduce the probability that a common-mode failure will propagate.
Some level of diversity, such as a reliable analog backup is required From the HSI perspective the two types of CCFs are discussed below.

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 4.7.1.1 Common-Cause Software Failures A common-cause failure is multiple failures attributable to a common-cause. A subset of CCF is a software CCF, which is a failure caused by software errors or software developed logic that could defeat the redundancy achieved by hardware architecture. Two basic forms that prevent CCFs in a system are either to reduce coupling factors or to increase the systems ability to resist those coupling factors. ((

                                                      }}2(a),(c) 4.8      Human-System Interface Tests and Evaluations 4.8.1    Human-System Interface Inventory & Characterization This section describes the method NuScale uses to perform inventory and characterization of the HSI displays, controls, and related equipment lying within the scope defined by the scenarios discussed in the Control Room Staffing Plan Workload Analysis, RP-1215-20253 (Reference 6.2.10) and capture the required information as discussed in Sections 8.4.6 and 11.4.2 of (Reference 6.1.2).

((

                                                                       }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2

5. ((

                                                                       }}2(a),(c)

A sample of a form is shown in Table A-1. 4.8.2 Human-System Interface Task Support Verification The purpose of HSI task support verification is to assess HSIs as they support the tasks identified in TA. HSI task support verification confirms that the HSI design accurately reflects the HSI inventory and characterizations required by TA. The scope of this verification includes alarms, controls, indications, and procedures, and supports needed to perform the scenarios selected for ISV through application of the SOC. The task support verification is based on the most recent TA results. The TA defines the inventory and characterization for the alarms, controls, indications, and procedures needed to execute operator tasks for normal and abnormal plant conditions including manual tasks, automation support tasks, and automation monitoring tasks. A sample of a form is shown in Table B-1. 4.8.3 Human Factors Engineering Design Verification The HFE design verification is conducted to confirm that HSI characteristics conform to HFE guidelines as represented in the NuScale HSI Style Guide. The style guide consists of procedures for use, general considerations, and system-specific guidance for screen-based HSIs. ((

                    }}2(a),(c)

A sample of a form is shown in Table C-1 and Table C-2. 4.8.4 Staffing Validation The S&Q RSR (Reference 6.2.7) includes staffing evaluations for activities performed by licensed control room operators. When licensed operator workload was impacted, the area of concern was analyzed to quantify the impact to licensed operator workload or staffing and to develop any HSI or staffing adjustments required to address the specific task and associated staffing requirements. © Copyright 2019 by NuScale Power, LLC 105

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 For specific details about the staffing validation effort, refer the Control Room Staffing Plan Validation Methodology RP-1215-20253 (Reference 6.2.10). © Copyright 2019 by NuScale Power, LLC 106

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 5.0 Analysis Conclusions NuScales integrated HSI design was developed by a multi-faceted HFE design team that brought unique skills and knowledge to the effort and worked collaboratively and cohesively to reach the projects goals. The HFE design team included former nuclear plant operators and supervisors, plant system engineers, I&C engineers, simulator plant model and HSI software developers and human factors engineers. This collaboration drove multi-disciplinary analyses to complex design decisions early in the conceptual design. NuScale utilized the collective operating experience of its design staff, the FRA/FA, TIHA and TA results, tabletop activities and preliminary simulator observations to determine initial staffing levels. This information helped the team develop the layout and construct the MCR simulator, develop the HSI Style Guide, screen layouts and communications protocols used by the operators during the SPV effort. ((

                                                               }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 6.0 References 6.1 Source Documents 6.1.1 U.S. Nuclear Regulatory Commission, "Human-System Interface Design Review Guidelines, NUREG-0700, Rev. 2. May 2002. 6.1.2 U.S. Nuclear Regulatory Commission, Human Factors Engineering Program Review Model, NUREG-0711, Rev. 3. November 2012. 6.2 Referenced Documents 6.2.1 Concept of Operations, RP-1215-10815. 6.2.2 NuScale Human System Interface Style Guide, NP-ES-304-1381. 6.2.3 Human Factors Verification and Validation Implementation Plan, RP-0914-8543. 6.2.4 Human Factors Engineering Operating Experience Review Results Summary Report, RP-0316-17614. 6.2.5 Human Factors Engineering Functional Requirements Analysis and Function Allocation Results Summary Report, RP-0316-17615. 6.2.6 Human Factors Engineering Task Analysis Results Summary Report, RP-0316-17616. 6.2.7 Human Factors Engineering Staffing and Qualifications Results Summary Report, RP-0316-17617. 6.2.8 Diversity and Defense-in-Depth Analysis of the Module Protection System, ER-E00-3530. 6.2.9 Human Factors Engineering Treatment of Important Human Actions Results Summary Report, RP-0316-17618. 6.2.10 Control Room Staffing Plan Validation Methodology, RP-1215-20253. © Copyright 2019 by NuScale Power, LLC 108

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 7.0 HSI Display Page Examples ((

                                                                                                      }}2(a),(c),ECI Figure 7-1.        Safety function monitoring page

((

                                                                                                       }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                       }}2(a),(c),ECI Figure 7-3.        SDI pages

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                        }}2(a),(c),ECI Figure 7-4.        12 unit overview page

((

                                                                                                       }}2 (a),(c),ECI Figure 7-5.        Unit group view display page

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                       }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                           }}2(a),(c)

Figure 7-7. Process library - procedure ((

                                                                                                           }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Appendix A. Human-System Interface Inventory and Characterization Form Table A-1 shows the form used by the HFE design team to perform preliminary Inventory and Characterization testing. The purpose of this effort was to formalize a process for the testing and verification of the HSI inventory. In this example, the Safety Function Monitoring display page was reviewed. Only the elements needed to successfully complete the SPV testing were evaluated. The same form and process will be followed during ISV testing on every element on the page. ((

                          }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Table A-1. Human-system interface inventory and characterization form ((

                                                                                                                                                   }}2(a),(c)
  © Copyright 2019 by NuScale Power, LLC 115

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                                           }}2(a),(c)
  © Copyright 2019 by NuScale Power, LLC 116

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Appendix B. Human-System Interface Task Support Verification Form Table B-1 shows the form used by the HFE design team to perform preliminary Task Support Verification. The purpose of this effort was to formalize a process for the testing and verification of the HSI inventory. In this example the chemical and volume control system display page was evaluated against the TA for that system. Only the tasks needed to successfully complete the SPV testing were evaluated. Also, only a small portion of the form is shown in order to provide an abbreviated sample of the process. The same form and process will be followed during ISV testing covering all tasks in the TA deemed necessary to complete Task Support Verification. ((

              }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Table B-1. Human-system interface task support verification form ((

                                                                                                                     }}2(a),(c)
  © Copyright 2019 by NuScale Power, LLC 118

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                                      }}2(a),(c)
  © Copyright 2019 by NuScale Power, LLC 119

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 ((

                                                                                                                 }}2(a),(c)
  © Copyright 2019 by NuScale Power, LLC 120

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Appendix C. Human Factors Engineering Design Verification Form Table C-1 and Table C-2 show the form used by the HFE design team to perform preliminary HFE design verification. The purpose of this effort was to formalize a process for the testing and verification of the HSI inventory. ((

                     }}2(a),(c) The same form and process will be followed during ISV testing covering all new icons, icon enhancements and HSI elements needed to complete HFE Design Verification.

((

                                         }}2(a),(c)

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Table C-1. Pump ICON human factors engineering design verification form Pump ICON Template PURPOSE: This icon is used to control any of the pumps that are connected to the control system. For SPV, all pumps used the same icon; for ISV, pump icons that more closely resemble the pump type they represent will be used. ((

                                                                                                                     }}2(a),(c)
  © Copyright 2019 by NuScale Power, LLC 122

Human Factors Engineering Human-System Interface Design Results Summary Report RP-0316-17619-NP Rev. 2 Table C-2. Valve ICON human factors engineering design verification form PURPOSE: This icon is used to control any of the valves that are connected to the control system. For SPV, all valves used the same icon; for ISV, valve icons that more closely resemble the valve type they represent will be used. ((

                                                                                                                  }}2(a),(c)
  © Copyright 2019 by NuScale Power, LLC 123

LO-0219-64505 : Affidavit of Thomas A. Bergman, AF-0219-64506 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvallis, Oregon 97330 Office 541.360-0500 Fax 541.207.3928 www.nuscalepower.com

NuScale Power, LLC AFFIDAVIT of Thomas A. Bergman I, Thomas A. Bergman, state as follows: (1) I am the Vice President of Regulatory Affairs of NuScale Power, LLC (NuScale), and as such, I have been specifically delegated the function of reviewing the information described in this Affidavit that NuScale seeks to have withheld from public disclosure, and am authorized to apply for its withholding on behalf of NuScale (2) I am knowledgeable of the criteria and procedures used by NuScale in designating information as a trade secret, privileged, or as confidential commercial or financial information. This request to withhold information from public disclosure is driven by one or more of the following: (a) The information requested to be withheld reveals distinguishing aspects of a process (or component, structure, tool, method, etc.) whose use by NuScale competitors, without a license from NuScale, would constitute a competitive economic disadvantage to NuScale. (b) The information requested to be withheld consists of supporting data, including test data, relative to a process (or component, structure, tool, method, etc.), and the application of the data secures a competitive economic advantage, as described more fully in paragraph 3 of this Affidavit. (c) Use by a competitor of the information requested to be withheld would reduce the competitors expenditure of resources, or improve its competitive position, in the design, manufacture, shipment, installation, assurance of quality, or licensing of a similar product. (d) The information requested to be withheld reveals cost or price information, production capabilities, budget levels, or commercial strategies of NuScale. (e) The information requested to be withheld consists of patentable ideas. (3) Public disclosure of the information sought to be withheld is likely to cause substantial harm to NuScales competitive position and foreclose or reduce the availability of profit-making opportunities. The accompanying report reveals distinguishing aspects about the method by which NuScale develops its human-system interface. NuScale has performed significant research and evaluation to develop a basis for this method and has invested significant resources, including the expenditure of a considerable sum of money. The precise financial value of the information is difficult to quantify, but it is a key element of the design basis for a NuScale plant and, therefore, has substantial value to NuScale. If the information were disclosed to the public, NuScale's competitors would have access to the information without purchasing the right to use it or having been required to undertake a similar expenditure of resources. Such disclosure would constitute a misappropriation of NuScale's intellectual property, and would deprive NuScale of the opportunity to exercise its competitive advantage to seek an adequate return on its investment. (4) The information sought to be withheld is in the enclosed report entitled Human-System Interface Design Results Summary Report. The enclosure contains the designation Proprietary" at the top of each page containing proprietary information. The information considered by NuScale to be proprietary is identified within double braces, "(( }}" in the document. (5) The basis for proposing that the information be withheld is that NuScale treats the information as a trade secret, privileged, or as confidential commercial or financial information. NuScale relies upon the exemption from disclosure set forth in the Freedom of Information Act ("FOIA"), 5 USC § AF-0219-64506 Page 1 of 2

552(b)(4), as well as exemptions applicable to the NRC under 10 CFR §§ 2.390(a)(4) and 9.17(a)(4 ). (6) Pursuant to the provIsIons set forth in 10 CFR § 2.390(b)(4), the following is provided for consideration by the Commission in determining whether the information sought to be withheld from public disclosure should be withheld: (a) The information sought to be withheld is owned and has been held in confidence by NuScale. (b) The information is of a sort customarily held in confidence by NuScale and , to the best of my knowledge and belief, consistently has been held in confidence by NuScale. The procedure for approval of external release of such information typically requires review by the staff manager, project manager, chief technology officer or other equivalent authority, or the manager of the cognizant marketing function (or his delegate), for technical content, competitive effect, and determination of the accuracy of the proprietary designation. Disclosures outside NuScale are limited to regulatory bodies , customers and potential customers and their agents , suppliers , licensees , and others with a legitimate need for the information, and then only in accordance with appropriate regulatory provisions or contractual agreements to maintain confidentiality. (c) The information is being transmitted to and received by the NRC in confidence. (d) No public disclosure of the information has been made, and it is not available in public sources. All disclosures to third parties , including any required transmittals to NRC , have been made, or must be made, pursuant to regulatory provisions or contractual agreements that provide for maintenance of the information in confidence. (e) Public disclosure of the information is likely to cause substantial harm to the competitive position of NuScale, taking into account the value of the information to NuScale, the amount of effort and money expended by NuScale in developing the information , and the difficulty others would have in acquiring or duplicating the information. The information sought to be withheld is part of Nu Scale's technology that provides Nu Scale with a competitive advantage over other firms in the industry. NuScale has invested significant human and financial capital in developing this technology and Nu Scale believes it would be difficult for others to duplicate the technology without access to the information sought to be withheld. I declare under penalty of perjury that the foregoing is true and correct. Executed on April 29, 2019. AF-0219-64506 Page 2 of 2}}

ML19119A398

Contents

Text

SUBJECT:

REFERENCE:

Title:

Title:

Title:

Title:

Title:

Navigation menu

ML19119A398

Text

SUBJECT:

REFERENCE:

Title:

Title:

Title:

Title:

Title:

Navigation menu

Search