ML19340A065
| ML19340A065 | |
| Person / Time | |
|---|---|
| Site: | NuScale |
| Issue date: | 12/16/2019 |
| From: | Prosanta Chowdhury NRC/NRR/DNRL/NRLB |
| To: | |
| Chowdhury P / 415-1647 | |
| Shared Package | |
| ML19175A030 | List: |
| References | |
| Download: ML19340A065 (172) | |
Text
18-1 18 HUMAN FACTORS ENGINEERING This chapter of the safety evaluation report (SER) documents the U.S. Nuclear Regulatory Commission (NRC or Commission) staffs review of Chapter 18, Human Factors Engineering, of the NuScale Power, LLC (hereinafter referred to as the applicant), Design Certification Application (DCA), Part 2, Final Safety Analysis Report (FSAR), Revision 3 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19241A315). The Phase 2 SER for this chapter (ML18199A279) identified 23 Open Items (OIs), all of which the applicant addressed through information submitted on the docket. Rather than discuss the individual OIs in this SER chapter, the staff has directly evaluated the adequacy of the information submitted on the docket to address them, which is included in the current version of the DCA. All OIs for Chapter 18 have been satisfactorily closed. The staffs regulatory findings documented in this SER are based on Revision 3 of the application on the docket.
The staff reviewed the human factors engineering (HFE) of the control room design in accordance with NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), Chapter 18, Human Factors Engineering, Revision 3, issued December 2016. Consistent with SRP Chapter 18, the staff compared the application to the relevant1 review criteria in NUREG-0711, Human Factors Engineering Program Review Model, Revision 3, issued November 2012 (ADAMS Accession No. ML12324A013), in order to gain reasonable assurance that the application complies with the HFE regulations cited under the Regulatory Basis subsections of this SER. The HFE regulations include requirements for specific controls and displays to be available to plant personnel, and they also include a requirement that the applicant provide a control room design that reflects state-of-the-art human factors principles so that the HFE design will support plant personnel in the safe operation of the plant.
NUREG-0711 describes a systematic method for developing a control room HFE design that complies with the HFE regulations. The method includes four general activities: (1) planning and analysis, (2) design, (3) verification and validation, and (4) implementation and operation.
These four general activities consist of the following 12 HFE program elements, which together provide for the successful integration of human characteristics and capabilities into nuclear power plant design:
Planning and analysis: HFE program management, operating experience review (OER),
functional requirements analysis (FRA) and function allocation (FA), task analysis (TA),
staffing and qualifications (S&Q), and treatment of important human actions.
Design: human-system interface (HSI) design, procedure development, and training program development.
1 Not all of the review criteria in NUREG-0711 are relevant to a DCA. For example, some criteria are relevant only to licensees that are modifying a control room design at an operating reactor. Those criteria are identified in NUREG-0711 and are not included in this SER.
18-2 Human factors verification and validation (V&V).
Implementation and Operation: design implementation (DI) and human performance monitoring.
This SER is organized with these 12 elements. The staff conducted a bottom-up review by assessing each of the relevant review criteria associated with each of the 12 elements in NUREG-0711. The 12 Technical Evaluation sections of this SER contain the staffs evaluation of the relevant review criteria in NUREG-0711 for that HFE element. The Technical Evaluation sections of this SER also include the results of the audits the staff performed to evaluate the applicants HFE design. The results of the staffs review of the application using the review criteria in NUREG-0711 and the results of the staffs audits are summarized below.
Planning and Analysis Activities HFE program management element: The staff reviewed the applicants methods for managing its HFE program. As discussed in detail in Section 18.1.4 of this SER, the staff found that the applicants HFE program conforms to the relevant review criteria in NUREG-0711, and therefore, the staff concluded that the applicants HFE design team has the responsibility, authority, placement within the organization, and qualifications to verify that the plant design commitment to HFE is met and that the plan reasonably assures that the HFE design is properly developed, executed, overseen, and documented.
OER, FRA and FA, TA, and treatment of important human actions elements: The staff reviewed the results of the applicants OER, FRA and FA, TA, and treatment of important human actions using the review criteria in NUREG-0711. The results of the applicants analyses are summarized in DCA Part 2, Tier 2, Sections 18.2, Operating Experience Review; 18.3, Functional Requirements Analysis and Function Allocation; 18.4, Task Analysis; and 18.6, Treatment of Important Human Actions, and are described in more detail in the results summary reports the applicant submitted with the application (refer to Section 18.1.2 of this SER for a list of the HFE reports the applicant submitted with the application). The staff also conducted two audits (ADAMS Accession Nos. ML17181A415 and ML18208A370) to review additional samples of the applicants OER, FRA and FA, and TA results.
The staff observed that the applicant had conducted a thorough review of relevant operating experience from the nuclear industry and also from other industries that have similar operational concepts, which was necessary due to the lack of operating experience for small modular reactors. The staff also observed that the applicant identified lessons learned from its OER and applied them appropriately in the HFE design process to avoid negative aspects of man-machine interfaces from both the nuclear and relevant non-nuclear industries and replicate positive man-machine interactions in the NuScale design.
During the review of the FA results, the staff determined that the applicant had appropriate technical justification for the use of relatively higher levels of automation of plant operations compared to other U.S. nuclear power plants. Automation of tasks has
18-3 the potential to reduce operator errors and workload, but it may also create new types of errors during operation, such as those initiated by the automation or by operator interaction with the automation. The staff found that the applicant appropriately considered such factors in its automation strategy and that certain HSI design features help to minimize the potential for negative effects on plant operation. For instance, the increased use of automation compared to the current operating fleet helps to keep the operators workload at manageable levels while operating 12 units. The use of overview screens and alarm systems in the control room help operators to maintain awareness of the plant by providing key information in a spatially dedicated, continuously visible format and alerting operators when there are abnormal conditions.
Additionally, the staff observed that the applicant performed a thorough TA that was sufficient to identify the discrete actions that operators need to perform their tasks and the information that operators need to perform those tasks. The results of the TA were appropriately used to inform the design of the control room HSIs to ensure that operators have the controls and displays necessary to successfully perform their tasks. The staff also observed that the applicants TA database enables the TA results to be provided as inputs to the plant procedures and training programs. The staff considers the close coordination with the procedures and training elements a good practice that helps ensure continuity from the analysis stage to the design stage and eventually into operations.
Furthermore, the staff observed that the applicant had appropriately identified those human actions considered to be more important relative to others. No operator actions are credited to mitigate the events that are analyzed in DCA Part 2, Tier 2, Chapter 15, Transient and Accident Analysis, or the diversity and defense-in-depth coping analysis discussed in DCA Part 2, Tier 2, Chapter 7, Instrumentation and Controls; therefore, there are no deterministically identified important human actions to be addressed in the HFE design. Compared to the operating fleet, a relatively few number of operator actions are credited to mitigate beyond-design basis events in the applicants probabilistic risk assessment (PRA) described in DCA Part 2, Tier 2, Chapter 19, Probabilistic Risk Assessment and Severe Accident Evaluation. The PRA identified two risk-important operator actions which were addressed in the HFE design. For example, the staff observed that the control room design includes alarms, controls and displays to help plant personnel understand when they must perform these two risk-significant actions and to ensure the operators have the necessary controls and displays to perform these actions. The staff also observed that the applicant had included these actions in its control room staffing plan and integrated systems validation tests, and the results of those tests indicate that the tasks can be performed by trained operators within the completion times assumed in the PRA.
Sections 18.2.4, 18.3.4, 18.4.4, and 18.6.4 of this SER contain the staffs evaluation of the applicants operating experience review, FRA and FA, task analysis, and treatment of IHAs, respectively, using the relevant review criteria from NUREG-0711 and additional detail on the audits the staff performed of these HFE analyses. For each of these HFE analyses, the staff concluded that the applicant conducted the analyses in accordance with state-of-the-art human factors principles and included sufficient consideration of the unique human factors topics associated with small modular reactors, such as controlling
18-4 multiple units from a single control room, using new automation techniques to help ensure operator workload will be manageable, and developing appropriate concept of operation strategies.
Staffing and qualifications element: In DCA Part 7, Exemptions, Section 6, 10 CFR 50.54(m), Control Room Staffing, the applicant requested that minimum licensed operator staffing requirements specific to the NuScale standard plant design be adopted as requirements applicable to licensees referencing the NuScale standard plant design certification (DC) in lieu of the requirements stated in Title 10 of the Code of Federal Regulations (10 CFR), Section 50.54(m). The staffing requirements in 10 CFR 50.54(m) are applicable to facility licensees; they are not applicable to applicants for a design certification. Therefore, although the proposed licensed operator staffing requirements for the NuScale standard plant design are included in DCA Part 7, the applicant does not propose an exemption from the requirements in 10 CFR 50.54(m).
NUREG-1791, Guidelines for Assessing Exemption Requests from the Nuclear Power Plant Licensed Operating Staff Requirements Specified in 10 CFR 50.54(m), issued July 2005 (ADAMS Accession No. ML052080125), contains guidance the staff uses to determine whether an applicants staffing proposal provides adequate assurance that public health and safety will be maintained at a level that is comparable to that afforded by compliance with the current regulations. Specifically, NUREG-1791 describes a process for systematically reviewing and assessing alternative staffing plans. This process includes reviewing the results of validation exercises specifically performed to demonstrate that the proposed staffing plan is acceptable. The applicant performed a staffing plan validation (SPV) test by having trained personnel perform pre-planned scenarios, which consisted of challenging, high-workload conditions in the 12-module control room simulator. Section 18.5.4 of this SER includes the staffs evaluation of the applicants proposed design-specific staffing plan using the criteria in NUREG-1791 and a discussion of the activities the staff performed to independently evaluate the applicants proposed staffing level. These activities are summarized below:
o The staff reviewed the applicants methodology for performing the SPV test during an audit (ADAMS Accession No. ML16137A129). The staff observed that the scenarios selected for the SPV test included simultaneous abnormal and emergency events on multiple modules in the control room simulator and thus were likely to produce challenging and high-workload conditions, which is appropriate for a test used to evaluate whether the proposed minimum number of operators is adequate to safely operate the plant. The staff observed that the applicant selected appropriate performance measures that could be used to evaluate whether the SPV test was successful and the proposed minimum staffing level was acceptable: successful task performance, adequate situation awareness, and manageable workload.
o The staff observed one of the two weeks of the SPV test during an audit (ADAMS Accession No. ML16259A110). The staff observed that the operators were able to complete all of the tasks in the scenarios, while maintaining adequate situation awareness, and it appeared to the staff during the observations that their workload was manageable. The operators were also able to use the indications
18-5 provided by the HSI to diagnose the scenario events in a timely manner and take appropriate actions. For example, one event resulted in an increase in megawatts and reactor power for one unit. The HSI for the affected unit showed an increase in megawatts and reactor power. The operators identified the change in these plant parameters for the affected unit within seconds of the HSI indicating the changes. During this event, the operators also used other indications provided by the HSI on the affected unit to confirm their diagnosis.
o The staff reviewed the results of the applicants SPV test. The results are summarized in DCA Part 2, Tier 2, Section 18.5, and provided in detail in a technical report included with the DCA (refer to Section 18.1.2 of this SER for a list of the HFE reports the applicant submitted with the application). The results showed that task performance was acceptable and that measured levels of situation awareness and workload were also found to be acceptable. The staff concluded that the SPV test results indicate that the proposed staffing plan is acceptable.
Design Activities HSI design element: The staff reviewed the applicants HFE Style Guide, which contains the guidelines the applicant used to design features of the HSIs, their layout, and their environments. The staff concluded that the Style Guide is based on the guidelines in NUREG-0700, Human-System Interface Design Review Guidelines, Revision 2 (ADAMS Accession No. ML021700373) (i.e., generic HFE guidance that is acceptable to the staff), and the applicant developed design-specific guidelines that were tailored to incorporate the results of the applicants HFE analyses and addressed specific goals of the applicants HSI design. Section 18.7.4 of this SER contains the staffs evaluation of applicants HFE Style Guide and the design of the displays and controls in the control room using the relevant review criteria from NUREG-0711.
The staff also reviewed a sample of the control room HSIs as modeled in the control room simulator to confirm that the design complies with regulatory requirements and that they conform to the applicants HFE Style Guide. For example, the staff assessed the Safety Display and Indication System (SDIS), which displays the minimum set of parameters defining the safety status of the plant. Section 18.7.4 of this SER contains the staffs evaluation of the HSIs using the relevant review criteria from NUREG-0711 and additional detail on the independent review activities the staff performed. The staff concluded that the HSIs complied with their respective regulatory requirements and conformed to acceptable HFE design guidelines.
Plant procedure development and training program development: Plant procedures and the plant training programs use inputs from the results of the HFE analyses. The staff reviews the plant procedure development and training program development elements as operating programs. As discussed in staffs SER Chapter 13, Conduct of Operations, Sections 13.2, Training, and 13.5, Plant Procedures, the application includes combined license (COL) information items for procedure development and training program development. Therefore, no review of plant procedure development or training program development is documented in this SER.
18-6 Verification and Validation Activities The integrated system validation (ISV) is an evaluation, using performance-based tests, to determine whether the integrated system design (i.e., hardware, software, and personnel elements) meets performance requirements and supports the plants safe operation. The applicant performed the ISV test by having trained personnel perform pre-planned scenarios, which consisted of a broad sample of normal, abnormal, and emergency plant events, in the 12-module control room simulator. Section 18.10.4 of this SER contains the staffs evaluation of applicants ISV methods and the test results using the relevant review criteria from NUREG-0711 and additional detail on the independent review activities the staff performed. The staff conducted an audit (ADAMS Accession No. ML18135A049) to review the applicants test plan for the ISV test.
Additionally, the staff observed two of the seven weeks of ISV testing.
The staff observed that the applicant conducted the ISV test in accordance with its test plan, which the staff reviewed and determined contained appropriate test methods. The staff also observed that personnel were able to use the control room HSIs to perform tasks during the scenarios. Also, there were no significant HFE issues identified during the scenarios that had direct safety consequences, which are those that could adversely impact personnel performance such that the margin of plant safety may be reduced below an acceptable level. Although the applicant identified and documented issues (referred to as human engineering discrepancies or HEDs) for further analysis and evaluation, the staff observed that none of these issues caused the operators to make significant errors of operation. Furthermore, the staff reviewed the results of the ISV test as summarized in the application and found that the results provided evidence that the design supports operators in the safe operation of the plant. The staff also confirmed that the ISV results also provided evidence that the proposed minimum staffing level is acceptable. The staff concluded that the ISV results, which included task performance, situation awareness and work load levels, provided evidence that the integrated system was acceptable to help plant personnel safely operate the plant.
Implementation and Operation Activities Design implementation element: Design implementation activities are performed by the COL holder and occur after construction of the as-built plant and prior to plant startup.
Section 18.11.4 of this SER contains the staffs evaluation of the applicants proposed methods for performing the design implementation activities and an ITAAC provided to ensure they are completed prior to operation of the plant. The staff concluded that the applicants method of completing the design implementation activities and the ITAAC are sufficient to ensure that HFE activities that need to be completed prior to plant operation will be performed as described in the DCA. For example, an inspection of the as-built plant must be performed prior to plant startup to ensure that the HFE design of the control room is consistent with the certified HFE design.
Human performance monitoring element: Human performance monitoring occurs for the life of the plant and is a COL activity. The staff confirmed that the applicant provided a COL item for this element. As discussed in Section 18.12.6 of this SER, the staff
18-7 concluded the applicants COL item appropriately addresses the information that the COL applicant should provide with respect to human performance monitoring.
For these reasons stated above and based on the staffs assessment that the application conforms to the relevant review criteria in NUREG-0711 and NUREG-1791, the staff concludes that the applicants HFE design complies with the HFE-related regulations and the applicants proposed staffing plan is acceptable.
18.1 Human Factors Engineering Program Management 18.1.1 Introduction The objective of this element is to verify that the applicant has an HFE design team with the responsibility, authority, placement within the organization, and composition to reasonably assure that the plant design meets the commitment to HFE. NUREG-0711, Chapter 2, HFE Program Management, Section 2.3, Applicant Products and Submittals, states that the applicant should provide an implementation plan (IP) for HFE program management, and there is no results summary report (RSR) for this (Applicant Products and Submittals) element. The staff evaluated the applicants HFE PMP (i.e., its implementation plan for HFE program management) using the relevant review criteria in NUREG-0711, Section 2.4, Review Criteria, and the results of the staffs evaluation are discussed below in Section 18.1.4, Technical Evaluation, of this SER.
18.1.2 Summary of Application DCA Part 2 Tier 1: DCA Part 2 Tier 1, Section 3.15, Human Factors Engineering, Revision 3, contains the Tier 1 information associated with Design Description (System Description, Design Commitments).
DCA Part 2 Tier 2: The applicant provided a description of this HFE element in DCA Part 2 Tier 2, Section 18.1, Human Factors Engineering Program Management.
ITAAC: There are no inspections, tests, analyses, and acceptance criteria (ITAAC) associated with this HFE element.
Technical Specifications: There are no technical specifications (TS) associated with this HFE element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: The applicant submitted the following technical reports (TRs) in support of the HFE design:
RP-0914-8534, Human Factors Engineering Program Management Plan, Revision 5, dated April 2019 (ADAMS Accession No. ML19119A341) (referred to herein as the HFE PMP).
RP-0215-10815, Concept of Operations, Revision 3, dated May 2019 (ADAMS Accession No. ML19133A292) (referred to herein as the ConOps).
18-8 RP-0316-17616, Human Factors Engineering Task Analysis Results Summary Report, Revision 2, dated April 2019 (ADAMS Accession No. ML19119A392) (referred to herein as the TA RSR).
RP-0316-17614, Human Factors Engineering Operating Experience Review Results Summary Report, Revision 0, dated December 2016 (ADAMS Accession No. ML16364A341) (referred to herein as the OER RSR).
RP-0316-17615, Human Factors Engineering Functional Requirements Analysis and Function Allocation Results Summary Report, Revision 0, dated December 2016 (ADAMS Accession No. ML16364A341) (referred to herein as the FRA/FA RSR).
RP-0316-17618, Human Factors Engineering Treatment of Important Human Actions Results Summary Report, Revision 0, dated December 2016 (ADAMS Accession No. ML17004A221) (referred to herein as the TIHA RSR).
RP-0316-17619, Human-System Interface Design Results Summary Report, Revision 2, dated April 2019 (ADAMS Accession No. ML19119A397) (referred to herein as the HSI Design RSR).
ES-0304-1381, Human-System Interface Style Guide, Revision 4, dated December 2019 (ADAMS Accession No. ML19338E948) (referred to herein as the Style Guide).
RP-0914-8543, Human Factors Verification and Validation Implementation Plan, Revision 5, dated April 2019 (ADAMS Accession No. ML19119A371) (referred to herein as the V&V IP).
RP-0914-8544, Human Factors Engineering Design Implementation Implementation Plan, Revision 4, dated November 2019 (ADAMS Accession No. ML19331A910)
(referred to herein as the DI IP).
RP-1215-20253, Control Room Staffing Plan Validation Methodology, Revision 3, dated December 2, 2016 (ADAMS Accession No. ML16365A179) (referred to herein as the SPV Methodology TR).
RP-0516-49116, Control Room Staffing Plan Validation Results, Revision 1, dated December 2, 2016 (ADAMS Accession No. ML16365A190) (referred to herein as the SPV Results TR).
RP-0316-17617, Human Factors Engineering Staffing and Qualifications Results Summary Report, Revision 0, dated December 2, 2016 (ADAMS Accession No. ML17004A221) (referred to herein as the S&Q RSR).
RP-1018-61289, Human Factors Engineering Verification and Validation Results Summary Report, Revision 1, dated July 2019 (ADAMS Accession No. ML19212A773)
(referred to herein as the V&V RSR).
18-9 18.1.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
Title 10 of the Code of Federal Regulations (10 CFR), Section 52.47(a)(8), as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except 10 CFR 50.34(f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 50.34(f)(2)(iii), to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.
SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.
Acceptance criteria for HFE design methodology are provided in NUREG-0711 (listed below).
(NUREG-0711 references NUREG-0700, Human-System Interface Design Review Guidelines, which provides detailed acceptance criteria for HFE design attributes.)
NUREG-0711, Revision 3, Section 2.4, Review Criteria.
The following documents also provide additional criteria or guidance in support of the SRP acceptance criteria to meet the above requirements:
NUREG-0696, Functional Criteria for Emergency Response Facilities, issued February 1981.
NUREG-0700, Human-System Interface Design Review Guidelines, Revision 2, issued May 2002.
NUREG/CR-7126, Human-Performance Issues Related to the Design and Operation of Small Modular Reactors, issued June 2012.
NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors, issued June 2015.
18.1.4 Technical Evaluation 18.1.4.1 General Human Factors Engineering Program Goals and Scope (Criteria 2.4.1(1)-(7))
NUREG-0711, Section 2.4.1, General HFE Program Goals and Scope, includes seven criteria for this topic. The seventh criterion applies only to plant modifications and therefore is not applicable to this DCA review. The staff evaluated the first six criteria as discussed below. The six criteria address HFE program goals (Criterion 2.4.1(1)); assumptions and constraints (Criterion 2.4.1(2)); HFE program duration (Criterion 2.4.1(3)); HFE facilities (Criterion 2.4.1(4));
HSIs, procedures, and training (Criterion 2.4.1(5)); and personnel (Criterion 2.4.1(6)).
18-10 18.1.4.1.1 HFE Program Goals (Criterion 2.4.1(1))
Criterion 2.4.1(1) identifies four general human-centered goals for an HFE program, and it also states that as the HFE program develops, the generic goals should be further defined and used as a basis for HFE tests and evaluations. The applicants HFE PMP, Section 2.1, Program Goals, lists the goals of the applicants HFE program. The staff reviewed these goals and found they include the four generic human-centered HFE design goals listed in Criterion 2.4.1(1). The generic goals are that personnel tasks can be accomplished within time and other performance criteria, and that the integrated system (i.e., hardware, software, and personnel elements) supports personnel situation awareness, provides acceptable workload levels, and supports error detection and recovery capability.
The HFE PMP, Section 2.1, also states that as the program develops, the goals are further defined and used as a basis for HFE tests and evaluations. One significant HFE evaluation the applicant conducted was the staffing plan validation (SPV). The staff reviewed the SPV Results TR, Section 6.1, Staffing Plan Validation Evaluation Methods, which identifies the criteria the applicant used to evaluate the proposed minimum staffing level during the SPV test. The staff found that the applicant identified specific methods to evaluate whether task performance, personnel situation awareness, workload, and error detection and recovery capability were acceptable under challenging operating conditions. For example, the applicant identified time limits within which certain tasks were required to be performed, as well as the upper and lower acceptable limits of workload.
Another significant HFE evaluation is the integrated systems validation (ISV). Human engineering discrepancies (HEDs) are identified if performance criteria are not met. The applicants V&V IP, Section 4.5.1, Types of Performance Measures, and Section 4.5.2.1, Collection Methods, identify the methods the applicant used to evaluate the ISV results.
These include methods to evaluate (1) whether task performance meets time and performance criteria, (2) situation awareness (3) if workload levels are acceptable, and (4) if HSIs minimize personnel errors and support error detection and recovery.
Based on the above, the staff finds that the applicant defined the general HFE program goals and developed specific acceptance criteria based on these general goals for evaluating the results of HFE tests and evaluations in order to assess whether the general HFE program goals have been met. Thus, the application conforms to this criterion.
18.1.4.1.2 Assumptions and Constraints (Criterion 2.4.1(2))
Criterion 2.4.1(2) states that the applicant should identify the design assumptions and constraints (i.e., aspects of the design that are inputs to the HFE program). The applicant identified the following design assumptions and constraints in HFE PMP, Section 2.2.1, Assumptions and Constraints:
Passive features: The passive safety features reduce the need for operator action during any design-basis event (DBE). Specifically, DCA Part 2 Tier 2, Section 15.0.0.5, Limiting Single Failures, states that no operator actions are required for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a DBE.
18-11 Modular design: The plant is intended to be scalable up to 12 units at a site, and operation of the first unit can begin before successive units are complete. Refueling of individual units can occur with others online. All units are controlled from a single main control room (MCR).
High degree of automation: The NuScale plant is highly automated to reduce the need for operator actions and to allow for monitoring multiple units simultaneously. Routine operating tasks are automated to the extent that human interactions to start, stop, or suspend automated sequences do not distract the operator.
Additionally, in DCA Part 2 Tier 2, Section 18.5.2, Methodology, the applicant identified the initial MCR staffing assumption, which is that the MCR staff consists of three licensed reactor operators (ROs) and three licensed senior reactor operators (SROs). The applicant explained that the basis for the initial MCR staffing assumption is that the passive safety systems, simplicity of operation, high levels of automation, and a limited number of IHAs will keep workload levels within acceptable limits for the MCR staff. The initial staffing assumption was an input to the other HFE analyses, such as the task analysis (TA), and also to the SPV, which the staff discusses in detail in Section 18.5 of this SER.
The HSI Design RSR Section 3.3, Human-System Interface Design Overview, states that the HFE team presents findings and solicits input from the instrumentation and control (I&C) and computer systems design disciplines in order to consider whether the HFE design concepts are technically feasible, with a special emphasis on performance requirements. The HSI Design RSR, Section 4.1.2.1, System Requirements, states, There are no known I&C platform system constraints related to the MCR layout optimization or HSI design for monitoring and control of multiple units.
The staff finds that the applicant identified HFE design assumptions as summarized above and therefore, conforms to this criterion.
18.1.4.1.3 HFE Program Duration (Criterion 2.4.1(3))
Criterion 2.4.1(3) states that the applicants HFE program should be in effect at least from the start of the design cycle through completion of the initial plant startup test program. The HFE PMP, Section 2.2.2, HFE Program Duration, states that the HFE program is applicable from the start of conceptual design through the completion of plant startup testing. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.1.4 HFE Facilities (Criterion 2.4.1(4))
Criterion 2.4.1(4) states that the applicants HFE program should cover the MCR, remote shutdown facility, technical support center (TSC), emergency operations facility (EOF), and local control stations (LCSs). However, applicants may apply the elements of the HFE program in a graded fashion to facilities other than the MCR and remote shutdown facility, providing justification in the HFE program plan. The executive summary of the HFE PMP states that the HFE program incorporates all 12 elements listed in NUREG-0711. The HFE PMP, Section 2.2.3, Applicable Facilities, states that the HFE program scope includes the alarms, controls, indications, and procedures applicable to the MCR and the remote shutdown station
18-12 (RSS) (i.e., the remote shutdown facility). Therefore, the staff finds that the HFE program covers the MCR and RSS.
The SRP Chapter 18,Section II.7, states, [t]ypically the HFE design responsibility is split between the DC applicants (identifies the displays and alarms) and the COL applicant (identifies facility layout, radiation level data, and communications). Sections 18.7.4.6 and 18.7.4.7 of this SER contain the staffs evaluation of how the applicant identified the displays and alarms to be included in the TSC and EOF. Those sections also document the staffs conclusion that the applicant fulfilled its HFE design responsibility for the TSC and EOF as discussed in SRP Chapter 18, Revision 3,Section II.7.
As stated in DCA, Part 2, Tier 1, the HSI of local control stations (LCS) are derivatives of the MCR HSI. The TIHA RSR, Section 3.3.5, Addressing Important Human Actions during Human-System Interface Design, also states the following:
When a local control station (LCS) is required for conducting an IHA that LCS HSI is designed using the same style guide as the MCR HSIs. This ensures HSI design consistency, training efficiency, clear labeling, easy accessibility, and avoidance of hazardous locations.
The staff finds the applicants plan to design LCSs for IHAs using the HFE guidelines in the same style guide that applies to the design of the MCR acceptable because the Style Guide contains relevant guidance for HSIs at LCSs, including guidelines for labeling, accessibility, and avoidance of hazardous locations.
The ConOps, Section 3.2.5, Arrangement of Human-System Interfaces, identifies HSIs that support refueling activities as LCSs. The TIHA RSR did not list any IHAs related to refueling activities; the applicant did not identify any human actions performed during refueling that met its criteria to be considered an IHA. Because of the relative risk significance of the reactor building crane (RBC) in the Low Power and Shutdown Operations Probabilistic Risk Assessment (PRA), which is discussed in DCA Part 2 Tier 2, Section 19.1.6.2, Results from the Low Power and Shutdown Operations Probabilistic Risk, the staff needed to understand whether HFE guidelines have been or will be applied to the HSIs used during module movement to help prevent occurrence of significant operator errors during module movement.
In the response to RAI 9360, Question 18-42 (ADAMS Accession No. ML18172A227), the applicant stated the following:
The LCS HSI used for module movement are vendor-supplied. The HFE design for these controls will be developed by the vendor because the controls must reflect the specialized nature of crane operation. The NuScale HFE design team is working with engineering to develop procurement specifications that characterize the crane control function requirements.
Implementation of the Style Guide standards will be included in the purchase specification to establish as much consistency with NuScale HFE design as possible but on a not to interfere basis with establishing the safety and control standards required by crane design. Since this effort is at an early stage of
18-13 development and beyond the scope of the current MCR verification and validation (V&V) process, specific details on the scope of HFE related direction in the procurement specification cannot be addressed at this time.
The staff understands that the design of the RBC HSIs is not complete at this time, and that it will include the HFE standards in the Style Guide to the extent possible by incorporating the HFE guidelines in the purchase specifications. The staff also considers having the HFE design team work with engineering staff to develop procurement specifications that characterize the crane control function requirements to be a sound HFE practice to help minimize the occurrence of human errors during module movement. Therefore, the staff concludes that the applicants plan to include HFE guidelines in the procurement specifications would help minimize operator errors that might occur during module movement. DCA Part 2 Tier 2, Chapter 9 discusses the design features of the RBC that ensure the safe handling of the nuclear power module. The staffs evaluation of the design of the RBC and conclusion that the design of the RBC meets NRC requirements is in SER Section 9.1.5.
Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.1.5 HSIs, Procedures and Training (Criterion 2.4.1(5))
Criterion 2.4.1(5) states that the applicants HFE program should address the design of HSIs and identify inputs to the development of procedures and training for all operations, accident management, maintenance, test, inspection, and surveillance tasks that operational personnel will perform or supervise. In addition, the HFE design process should identify training program input for I&C technicians, electrical maintenance personnel, mechanical maintenance personnel, radiological protection technicians, chemistry technicians, and engineering support personnel. Any other personnel who perform tasks directly related to plant safety also should be included.
The applicant described the HSI design in sufficient detail in the HSI Design RSR and DCA Part 2 Tier 2, Section 18.7, Human-System Interface Design. Therefore, the staff finds the applicant addressed the design of HSIs in the HSI Design RSR.
The TA RSR, Section 3.6.1, Functional Requirements Analysis and Function Allocation and Task Analysis, describes how the applicant used the VISION developer application to identify input to the development of procedures and the training program for operational personnel.
VISION is a relational database that is used to store the FRA/FA, TA, S&Q analysis, development of HSIs, procedures, and training data. VISION is commonly used in the nuclear industry to manage the training programs for plant personnel, including licensed operators and personnel identified in 10 CFR 50.120, Training and Qualification of Nuclear Power Plant Personnel, that must be trained using a systems approach to training. As shown in the TA RSR, Table 3-2, VISION icon descriptions, VISION can document the steps required to complete a task, which are direct inputs to procedure development, and also the skills, knowledge, and abilities personnel need to perform the tasks, which are direct inputs to the training program. Further, DCA Part 2 Tier 2, Section 18.4.3, Results, states that the TA also produced a basic knowledge and abilities catalog.
18-14 In addition, the TA RSR, Section 1.2, Scope, states that the HFE program analyzes tasks associated with activities performed by the plant personnel identified in 10 CFR 50.120 and other personnel, such as information technology technicians, when those activities include tasks that impact licensed operator workload. Also, the HFE PMP, Section 2.2.4, Applicable Human-System Interfaces, Procedures and Training, states that the program provides input to the training programs for personnel identified in 10 CFR 50.120 and other personnel who perform tasks directly related to plant safety. During an audit conducted May 9-11, 2017 (ADAMS Accession No. ML17181A415), the staff reviewed the results of the TA. The staff found the applicant had identified tasks for nonlicensed operators as well as licensed operators (licensed operators supervise nonlicensed operators). The staff finds that the HFE design process includes inputs to the training program for operations personnel and other relevant personnel.
The staff finds that Criterion 2.4.1(5) is satisfied because the HFE program addresses the design of the HSIs, as documented in the HSI Design RSR, and inputs to the procedures and training programs for operations personnel, categories of personnel listed under 10 CFR 50.120(b)(2), and other personnel who perform tasks related to plant safety.
Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.1.6 Personnel (Criterion 2.4.1(6))
Criterion 2.4.1(6) states that the applicants HFE program should consider operations S&Q, including licensed control room operators as defined in 10 CFR Part 55, Operators Licenses; nonlicensed operators; shift supervisors; and shift technical advisors. The applicant described staffing and the qualifications of licensed operators, including the shift supervisor and shift technical advisor, in DCA Part 2 Tier 2, Section 18.5.3, Results, as well as in the S&Q RSR.
DCA Part 2 Tier 2, Section 18.5.3 states the following:
A staffing plan validation was conducted using guidance in NUREG-0711, NUREG-1791, and NUREG/CR-6838 as well as other industry guidance...The results of the S&Q analysisconfirm that up to 12 NuScale Power Modules and the associated plant facilities may be operated safely and reliably by a minimum staffing contingent of three licensed reactor operators and three licensed senior reactor operators from a single control room during normal, abnormal, and emergency conditions.
The staff evaluates the SPV in Section 18.5.4 of this SER. Because the applicant has identified the required operations staffing and the qualifications (i.e., licensed operators), the staff finds that the applicants HFE program considered S&Q for licensed operators.
The S&Q RSR, Section 1.2, Scope, states the following:
Staffing analysis for non-licensed operatorsare included only if they are determined to impact licensed operator workload. When licensed operator workload is impacted, then the area of concern was analyzed to a degree sufficient to quantify the impact to licensed operator workload or staffing and to develop any human-system interface (HSI) or staffing adjustments required to address the specific task and associated staffing requirements.
18-15 During the May 2017 audit (ADAMS Accession No. ML17181A415), the staff reviewed TA results and found the applicant identified tasks for nonlicensed operators as well as licensed operators. Also, the S&Q RSR, Section 4.8, Staffing Levels, Position Descriptions, and Qualifications, states that the number of nonlicensed operators requested by the control room staff was tracked during the SPV scenarios to include the workload of managing this resource.
The ISV Test Plan also includes procedures for tracking the use of nonlicensed operators. The applicant has identified the number of nonlicensed operators to be available during the SPV and ISV, which will allow the applicant to gain data about whether the number of nonlicensed operators is reasonable. The applicant documented the ISV results in the V&V RSR, and the information about the use of nonlicensed operators will be made available to the COL applicant referencing the NuScale standard plant DC. DCA Part 2 Tier 2, Section 18.5, Staffing and Qualifications, also contains COL Item 18.5-1, which states, A COL applicant that references the NuScale Power Plant design certification will address the staffing and qualifications of non-licensed operators.
As such, the staff observed that the applicant has considered nonlicensed operator staffing with respect to the support the licensed operators will need from such staff to operate the plant from the control room, and a COL item covers the responsibility of the COL applicant to address S&Q of nonlicensed operators. The staff documents the appropriateness of COL Item 18.5-1 in Section 18.5.6 of this SER.
Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.2 Human Factors Engineering Team and Organization (Criteria 2.4.2(1)-(4))
NUREG-0711, Section 2.4.2, HFE Team and Organization, includes four criteria for this topic.
The four criteria address the following aspects of the applicants HFE team: responsibilities (Criterion 2.4.2(1)), organizational placement and authority (Criterion 2.4.2(2)), composition and expertise, (Criterion 2.4.2(3)), and team staffing (Criterion 2.4.2(4)).
18.1.4.2.1 Responsibility of the HFE Team (Criterion 2.4.2(1))
Criterion 2.4.2(1) lists activities the applicants HFE team should be responsible for performing.
These activities include overseeing and reviewing all activities in HFE design, development, test, and evaluation, including the initiation, recommendation, and provision of solutions through designated channels for problems identified in implementing the HFE work. The HFE PMP, Section 3.1, Responsibility, states that the HFE team is the primary organization responsible for the HFE program. The staff reviewed the HFE PMP, Section 3.1, and found that the responsibilities of the HFE team include all those listed in the criterion. Therefore, the staff concludes that the applicant has established a specific entity to be responsible for the applicants HFE design. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.2.2 Organizational Placement and Authority (Criterion 2.4.2(2))
Criterion 2.4.2(2) states that the applicant should describe the primary HFE organization(s) or function(s) within the engineering organization designing the plant. The organization should be illustrated to show organizational and functional relationships, reporting relationships, and lines
18-16 of communication. The applicant also should address necessary transitions between responsible organizations and how the HFE team has the authority and appropriate organizational placement to reasonably assure that all its areas of responsibility are completed; to identify problems in establishing the overall plan; and to control further processing, delivery, installation, or use of HFE products until the disposition of a nonconformance, deficiency, or unsatisfactory condition is resolved.
The HFE PMP, Section 3.2, Organizational Placement and Authority, states that the HFE team consists of two groups: a core group and another group that includes other members of the design organization who provide expertise to the core group when needed. The core group members report directly to the HFE Supervisor, who reports to the Operations Manager, who reports directly to the Vice President of Operations. The members of the other group are distributed throughout the design organization and provide expertise to the core HFE team as needed. These personnel take direction from the HFE Supervisor while performing HFE activities. Therefore, the applicant has identified the organizational and functional relationships, reporting relationships, and lines of communication.
The HFE PMP, Section 3.2, explains that the HFE Supervisor has ultimate responsibility for scheduling and overseeing various HFE activities and is the owner of the human factors engineering issue tracking system (HFEITS) database. The HFE Supervisor or other members of the HFE team elevate HFE issues within the management chain as necessary. Also, DCA Part 2 Tier 2, Section 18.1.3.1, General Process and Procedures, states, Any member of the HFE team may identify problems and propose solutions using the HFEITS tool. The HFE Supervisor has authority to make decisions regarding resolution of HFEITS items...
Because the HFE team has been given the responsibility for the HFE design as discussed under Criterion 2.4.2(1), and because the HFE Supervisor is the owner of the HFEITS and has the authority to make decisions to resolve issues, the staff concludes that the applicants HFE team has adequate authority and organizational placement to reasonably assure that its areas of responsibility are completed. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.2.3 Composition and Expertise (Criterion 2.4.2(3))
Criterion 2.4.2(3) states that the applicants HFE design team should include the expertise described in the appendix to NUREG-0711. The HFE PMP, Section 3.3, Composition, states the following:
The experience and education levels of the members of the core HFE team meet many of the requirements listed in Table 3-1; however, both the core HFE team and the HFE team members distributed throughout the organization taken together meet all the required experience and qualifications as listed in Table 3-1.
The staff compared the HFE PMP, Table 3-1, Human Factors Engineering Team Member Qualifications, to the appendix to NUREG-0711 and found that Table 3-1 lists all the qualifications in the appendix to NUREG-0711. Therefore, the staff concludes that the
18-17 applicants HFE team includes the expertise described in the appendix to NUREG-0711.
Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.2.4 HFE Team Staffing (Criterion 2.4.2(4))
Criterion 2.4.2(4) states that the applicant should describe team staffing in terms of job descriptions and assignments of team personnel. The HFE PMP, Section 3.4, Team Staffing, states the following:
The HFE supervisor assigns members of the HFE team (including personnel from outside the Plant Operations organization) to HFE activities to ensure that needed expertise is applied in performing those activities. Members of the core HFE team are assigned as leads and owners of various HFE related areas. For example, each core HFE team member is assigned a group of systems and is the primary interface and representative with engineering for that system.
Additionally, this person is responsible for completing all the work in support of functional requirements analysis and function allocation (FRA/FA), TA, HSI, procedures, and training development for the systems assigned. This person also performs all system design document and functional specification reviews for the assigned group of systems. Members of the core HFE team are also assigned as functional leads for nonsystem areas such as probabilistic risk analysis (PRA), emergency planning, and simulator design.
Additionally, the HFE PMP, Table 3-2, Human Factors Engineering Team Participant Primary Responsibilities, shows the assignment of the personnel qualifications listed in Table 3-1 to each of the 12 HFE program elements. The appendix to NUREG-0711 explains the typical contributions of personnel with the particular set of qualifications to an HFE design team. The staff reviewed Table 3-2 and found that the qualifications were appropriately assigned to the 12 HFE program elements. For example, the appendix to NUREG-0711 states that personnel with computer system engineering qualifications typically participate in designing and selecting computer-based equipment, such as controls and displays. Table 3-2 shows that personnel with computer system engineering qualifications are assigned to HSI design activities.
The staff concludes the applicant has given job descriptions of the HFE team members and assigns tasks to HFE team members with the appropriate expertise to perform those tasks.
Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.3 Human Factors Engineering Process and Procedures (Criteria 2.4.3(1)-(6))
NUREG-0711, Section 2.4.3, HFE Processes and Procedures, includes six criteria for this topic. The six criteria address process procedures (Criterion 2.4.3(1)), process management tools (Criterion 2.4.3(2)), integration of HFE and other plant design activities (Criterion 2.4.3(3)),
HFE program milestones (Criterion 2.4.3(4)), HFE documentation (Criterion 2.4.3(5)), and subcontractors (Criterion 2.4.3(6)).
18.1.4.3.1 Process Procedures (Criterion 2.4.3(1))
Criterion 2.4.3(1) states that the applicant should identify the process through which the team will execute its responsibilities and include procedures for governing the internal management of
18-18 the team, making decisions on managing the HFE program, making HFE design decisions, controlling changes in the design of equipment, and reviewing HFE products. The HFE PMP, Section 4.1.1, Human Factors Engineering Team Assignment, states that the HFE Supervisor assigns tasks to HFE team members based on the expertise necessary to complete the task, which is identified in the HFE PMP, Table 3-2. The HFE PMP, Section 4.1.6, Review of Human Factors Engineering Products, states that the HFE Supervisor is responsible for scheduling and overseeing HFE activities, including reviewing HFE team products. The HFE PMP, Section 4.1.3, Making HFE Design Decisions, states that the HFE Supervisor has primary authority to make management decisions for HFE activities. If design decisions require input from multiple organizations, the HFE Supervisor may elevate issues to management through the use of internal procedures, design review boards, and the Corrective Action Program.
Additionally, the HFE PMP, Section 4.1.6, Review of Human Factors Engineering Products, states that HFE activities are conducted in accordance with the Quality Management Plan (QMP), which establishes controls to ensure that all provisions and commitments contained in the Quality Assurance Program Description (QAPD)2 have been implemented appropriately, and in accordance with other procedures governing the design control process. The design process includes provisions to control design inputs, outputs, changes, interfaces, records, and organization interfaces within NuScale and with suppliers. The applicants and suppliers procedures describe design change processes and the division of responsibilities for design-related activities.
Therefore, the staff concludes that the applicant has identified the process through which the HFE team executes its responsibilities in the HFE PMP and the procedures that govern that process. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.3.2 Process Management Tools (Criterion 2.4.3(2))
Criterion 2.4.3(2) states that the applicant should identify the tools and techniques the team members use to verify that they fulfill their responsibilities. The applicant identified the following tools and techniques the HFE team members use to verify that they fulfill their responsibilities:
Verification checklists: The HSI Design RSR, Appendix B, Human-System Interface Task Support Verification Form, contains an example of the task support verification form, which the HFE team uses to verify the design supports operator tasks by comparing the HSI to TA results. Appendix C, Human Factors Engineering Design Verification Form, contains an example of the design verification form the HFE team uses to verify that the design conforms to the design-specific HFE guidelines by comparing the HSI to the Style Guide.
2 The staff documents its finding that NuScales QAPD, NP-TR-1010-859-NP, NuScale Topical Report:
Quality Assurance Program Description for the NuScale Power Plant, Revision 3, issued October 2016 (ADAMS Accession No. ML16347A405), complies with the requirements in Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, for the quality assurance program and is therefore acceptable in Safety Evaluation of the NuScale Topical Report: Quality Assurance Program Description for Design Certification of the NuScale Small Modular Reactor (ADAMS Accession No. ML16203A107).
18-19 HFEITS Records: The HFE PMP, Section 5.3, Human Factors Engineering Issues Tracking Documentation, lists the information contained in the HFEITS. The HFEITS is used to document issues and resolutions and assign issue owners and evaluators.
Issue owners are responsible for resolving the issues. The HFE Supervisor has overall responsibility for managing the HFEITS. The HFEITS Review Committee is responsible for reviewing documentation on all issues in the HFEITS to verify that the resolutions have been completed before closing an issue.
HFE Databases: The HFE PMP, Section 6.1, Operating Experience Review, states that the results of the operating experience review (OER) are contained in the OER database. The HFE PMP, Section 6.2, Functional Requirements Analysis and Function Allocation, and Section 6.3, Task Analysis, state that databases also contain the results of the FRA, FA, and TA. The databases can be used to search and review the results of these analyses. During the May 2017 audit (ADAMS Accession No. ML17181A415), the staff observed how the databases allow the HFE team to determine the extent of the completion of a given analysis by observing whether the data fields are complete.
Additionally, as explained in the staffs evaluation of Criterion 2.4.3(1), the HFE Supervisor oversees the HFE team and reviews HFE team products. Therefore, the staff concludes that the applicant has identified the tools and techniques the HFE team members use to verify that they fulfilled their responsibilities. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.3.3 Integration of HFE and Other Plant Design Activities (Criterion 2.4.3(3))
Criterion 2.4.3(3) states that the applicant should describe the process for integrating the inputs from other design work to the HFE program, and the outputs from the HFE program to other plant design activities. The applicant should also discuss the iterative aspects of the HFE design process. The HFE PMP, Appendix A, NuScale HFE Program Design Integration, contains Figure A-1, NuScale and Human Factors Engineering Program Design Integration, which illustrates how the HFE team is integrated into the iterative design process. Appendix A describes in detail how the HFE team participates in the plant engineering design process. The staff reviewed this description in Appendix A and found that it describes a means for HFE team members to review plant design documents and provide recommendations. Appendix A also provides an example of how the plant design was changed as a result of HFE team review and feedback.
Also, the HFE PMP, Section 4.1.5, Controlling Changes in Design Equipment, states the following:
As discussed in Section 3.4, the HFE team members perform reviews of the assigned system design documents and have the authority to approve the documents. They also participate in key meetings such as system design phase reviews. This ensures that the HFE team members have the authority to influence and control design changes.
18-20 The FRA/FA RSR, Section 4.6, Design Incorporation Recommendations Examples, and the OER RSR, Appendix G, Issues Identified by NuScale HFE Team Personnel Incorporated into Design, list plant system design issues identified by the HFE team that have been incorporated into the design. As such, the staff concludes that the applicants interdisciplinary review process, the HFEITS, and the participation of HFE team members in the system design reviews integrate the HFE team and the plant systems designers to help ensure that HFE is considered in the design of the plant systems.
As shown in DCA Part 2 Tier 2, Figure 18.1-1, Overview of Human Factors Engineering Program Process, and the HFE PMP, Appendix A, Figure A-1, the plant system design documents are inputs to the FRA, FA, and TA. The HFE PMP, Section 3.4, explains that the HFE team core group members are assigned plant systems and are the primary interface or point of contact with the engineering organization for that system. The HFE team core group member is responsible for completing the FRA, FA, TA, HSI design, and procedure and training program development for his or her assigned plant system. As such, the staff concludes that the applicants process provides inputs from other plant design work to the HFE team.
DCA Part 2 Tier 2, Figure 18.1-1, and the HFE PMP, Appendix A, Figure A-1, also show that the HFE team uses the HFEITS to track HFE issues that impact plant design documents. The HFE PMP, Section 5.4.2, Human Factors Engineering Issue Tracking System Team Lead, states that one of the responsibilities of the HFEITS Team Lead is to coordinate the resources, including plant system subject matter experts (SMEs), to resolve HFE issues. Also, the HFE PMP, Appendix A, Figure A-2, Human Factors Engineering Program Process, illustrates the feedback from the HFE program to other plant engineering disciplines. For example, Appendix A shows that the results of V&V activities may be provided as input to the PRA and human reliability analysis (HRA). Appendix A explains that the ISV tests design assumptions made in the PRA and HRA, and feedback about those assumptions is documented and tracked to the appropriate disciplines using the HFEITS. As such, the staff concludes that the applicants process of using the HFEITS provides output from the HFE program as input to other plant design disciplines.
The HFE PMP, Figure A-2, also illustrates the iterative aspects of the HFE design process by showing that results and products of the HFE program elements may be refined as further design detail is developed. For example, Appendix A explains that revisions to the PRA/HRA are considered for impact on the TIHA results.
Therefore, the staff concludes the applicant has described the process for integrating the design activities (i.e., the inputs from other design work to the HFE program, and the outputs from the HFE program to other plant design activities) and discussed the iterative aspects of the HFE design process. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.3.4 HFE Program Milestones (Criterion 2.4.3(4))
Criterion 2.4.3(4) states that the applicant should identify HFE milestones that show the relationship of the elements of the HFE program to the integrated plant design, development, and licensing schedule. A relative program schedule of HFE tasks should be available for review. The HFE PMP, Table 4-1, Human Factors Engineering Program and Design Activity Milestones, identifies when the HFE elements will be
18-21 completed relative to the design, development, and licensing schedule. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.3.5 HFE Documentation (Criterion 2.4.3(5))
Criterion 2.4.3(5) states that the applicant should identify the HFE documentation items, such as RSRs and their supporting materials, and briefly describe them, along with the procedures for their retention and for making them available to the staff for review. The applicant provided an IP for staff review for the HFE program management element, the design implementation element, and the V&V element. The applicant provided an RSR for staff review for each of the following HFE program elements: OER, TA, FRA, FA, S&Q, HSI design, and V&V.
The HFE PMP, Section 4.5, Human Factors Engineering Documentation, states that HFE documents, including RSRs, HFEITS records, and verification checklists, are quality records that will be retained in accordance with the QMP. The applicant stated that all such documentation is available for staff review upon request. As discussed in the staffs evaluation of Criterion 2.4.3(4), the applicant provided RSRs and IPs for review. NUREG-0711 explains that IPs and RSRs are the two primary types of applicant submittals that the staff reviews.
Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.3.6 Subcontractor Efforts (Criterion 2.4.3(6))
Criterion 2.4.3(6) states that the applicant should include HFE requirements in each subcontract contributing to the HFE program, periodically verify the subcontractor's compliance with HFE requirements, and describe milestones and the methods used for this verification. The HFE PMP, Section 4.2, Process Management Tools, states that the HFE activities are conducted in accordance with the QMP, which establishes controls to ensure that all provisions and commitments contained in the QAPD have been implemented appropriately. Further, the HFE PMP, Section 4.6, Subcontractor HFE Efforts, states, If a subcontractor is involved in HFE activities, the HFE team verifies that the subcontractor is properly trained and complies with the QMP. This section also states that the quality assurance organization verifies that the subcontractors conduct work in accordance with the QMP or the subcontractors quality assurance program as contracted.
DCA Part 2 Tier 2, Section 17.5, Quality Assurance Program Description, states that the QAPD is provided in NP-TR-1010-859-NP, Revision 3 (ADAMS Accession No. ML16347A405).
The staff reviewed that document. The QAPD, Section 3.1.4, Procurement Document Control, states the following:
Procurement documents for items and services obtained by or for NuScale include or reference documents describing applicable design bases, design requirements, and other requirements necessary to ensure component performance. The procurement documents are controlled to address deviations from the specified requirements.
Because the applicants QAPD states that procurement documents include design requirements and because HFE is conducted in accordance with the QMP, which implements the
18-22 commitments in the QAPD, the staff concludes that procurement documents provided to any subcontractors will include HFE design requirements.
Further, the QAPD, Section 3.1.3, Design Control, states the following:
NuScale has design control measures to ensure that the established design requirements are included in the design. These measures ensure that applicable design inputs are included or correctly translated into the design documents and deviations from those requirements are controlled. Design verification is provided through the normal supervisory review of the designer's work.
The QAPD, Section 3.1.18, Audits, states the following:
NuScale employs measures for line management to periodically review and document the adequacy of processes, including taking any necessary corrective action. Audits independent of line management are not required. Line management is responsible for determining whether reviews conducted by line management or audits conducted by any organization independent of line management are appropriate. If performed, audits are conducted and documented to verify compliance with design and procurement documents, instructions, procedures, drawings, and inspection and test activities.
Because the QAPD states that supervisors review the design products and line management also periodically reviews products to verify conformance to the HFE design requirements, the staff concludes that the applicant has described methods for verifying compliance with procurement requirements. The applicant also identified that the milestones for review include periodic review determined by line management and supervisory review of the products by supervisors. Therefore, the staff concludes that the applicant includes HFE requirements in procurement documents and has established methods of verifying conformance to those requirements. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.4 Tracking Human Factors Engineering Issues (Criteria 2.4.4(1)-(4))
NUREG-0711, Section 2.4.4, Tracking HFE Issues, includes four criteria for this topic. The four criteria address HFE issue tracking availability (Criterion 2.4.4(1)), methods (Criterion 2.4.4(2)), documentation (Criterion 2.4.4(3)), and responsibility (Criterion 2.4.4(4)).
18.1.4.4.1 Availability (Criterion 2.4.4(1))
Criterion 2.4.4(1) states that the applicant should have a tracking system to address human factors issues that are known to the industry; identified throughout the life cycle of the HFE aspects of design, development, and evaluation; and deemed by the HFE program as HEDs.
The HFE PMP, Section 5.1, Availability of Human Factors Engineering Issue Tracking System, states that the applicant uses the HFEITS database to address HFE issues, including those issues specifically listed in Criterion 2.4.4(1). Therefore, the staff concludes the applicant
18-23 established a tracking system for HFE issues. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.4.2 Methods (Criterion 2.4.4(2))
Criterion 2.4.4(2) states that the applicant should establish criteria for entering issues into the system and tracking issues until the potential for negative effects on human performance is reduced to an acceptable level. The HFE PMP, Section 5.2, Human Factors Engineering Issues Tracking Methodology, states the following:
Because the HFE team is imbedded into the design engineering process, most potential HFE issues are able to be resolved immediately. This is accomplished through direct feedback to design engineers, at engineering design phase review meetings, and during design document review and comment resolution. If the issue cannot be immediately resolved, it is entered into the HFEITS database and is assigned a unique tracking number.
For example, the HFE PMP, Section 6.1, states that if an OER issue is applicable to the design, and the issue cannot be resolved at the current point of the design, then the issue is entered into HFEITS. The HFE PMP, Section 5.4.7, Human Engineering Discrepancy Resolution, explains that HFE issues identified during V&V activities are specifically referred to as HEDs, and HEDs are also entered in the HFEITS. Thus, the staff concludes that the applicant established criteria for entering issues into the tracking system.
The HFE PMP, Section 5.4.8, HED Process Flow, states that each HED is assigned one of the following three priority classifications:
(1)
Priority 1 HEDs have a potential direct or indirect impact on plant safety.
(2)
Priority 2 HEDs have a direct or indirect impact on plant performance and operability.
(3)
Priority 3 HEDs are those that are not Priority 1 or Priority 2.
Section 5.4.8 also discusses when these issues are resolved such that tracking of the issues is no longer required:
Priority 1 HEDs are resolved by the applicant as part of the design certification review.
Priority 2 HEDs are resolved by the applicant before turning over HFE responsibilities to a licensee.
Priority 3 HEDs are HEDs that are not Priority 1 or 2 HEDs. They are resolved in accordance with QA policy-related programs and processes.
NUREG-0711, Section 11.4.4, Human Engineering Discrepancy Review Criteria, contains guidance for determining which HEDs to correct such that possible negative impacts on human performance are reduced to an acceptable level. The staff found the applicants plan to track and resolve Priority 1 and 2 HEDs to be consistent with this guidance, and, therefore, the
18-24 applicant will track HEDs that could have negative impacts on human performance until they have been resolved. (Because Priority 3 HEDs do not have direct or indirect impacts on plant safety, plant performance or operability, the staff does not consider these types of issues to require resolution; they may be addressed as time and resources permit, if they are addressed at all.)
The HFE PMP, Section 6.6, Human-System Interface Design, states that HFE issues generated during HSI design or from earlier program elements are resolved during HSI design so that the final output is a complete HSI design suitable for V&V. Thus, the staff concludes that resolving Priority 1 and 2 HEDs, as well as resolving HFE issues identified from the HFE elements completed before V&V, provides reasonable assurance that the potential for negative effects on human performance will be reduced to an acceptable level. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.4.3 Documentation (Criterion 2.4.4(3))
Criterion 2.4.4(3) states that the applicant should document the actions taken to address each issue in the system, and if no action is required, this should be justified. The HFE PMP, Section 5.3, lists information that is entered in the HFEITS for each issue, which includes the actions taken to address each issue (i.e., resolutions) and justification if no action is taken. The HFE PMP, Section 5.3, states that descriptions of resolutions are sufficiently detailed to provide traceability and third-party review. Also, the HFE PMP, Section 5.4.7, states that HEDs may not always be resolved, and the basis for accepting an HED without change is documented.
Because the actions taken to address issues and descriptions of the resolutions will be documented, the staff concludes that the applicants method is acceptable. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.4.4 Responsibility (Criterion 2.4.4(4))
Criterion 2.4.4(4) states that the applicants tracking procedures should describe individual responsibilities for logging, tracking, and resolving issues, along with the acceptance of the outcome. The HFE PMP, Section 5.4, Human Factors Engineering Tracking Responsibilities, states that all HFE team members are responsible for identifying, logging, evaluating, and tracking HFE issues to resolution. HFE team members are assigned the following specific responsibilities to address HFE issues documented in the HFEITS:
Issue evaluators are assigned to evaluate issues, recommend issue owners, and recommend corrective actions. Issue evaluator assignments are documented in the HFEITS.
Issue owners are assigned to resolve issues, update the HFEITS with proposed and completed actions, and update design documentation, if necessary. Issue owner assignments are documented in the HFEITS.
The HFEITS Team Lead coordinates resources to identify and implement resolutions, approves resolution of issues with support from the HFE team as needed, coordinates the HFEITS Review Committee, and tracks issue resolution and due dates.
18-25 The HFEITS Review Committee reviews all HFE issues before final closure to verify completion of the resolution (i.e., accepting the outcome of the HFE resolution process).
The HFE Supervisor has overall responsibility for administering and managing the HFEITS and the HFEITS Review Committee.
Therefore, the staff concludes that the applicant has described individual responsibilities for logging, tracking, and resolving HFE issues, along with the acceptance of the outcome.
Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.5 Technical Program (Criteria 2.4.5(1)-(5))
NUREG-0711, Section 2.4.5, Technical Program, includes five criteria for this topic. The fifth criterion addresses plant modifications and is not applicable to this DCA review; therefore, the staff evaluated the first four criteria as discussed below. The four criteria address status (Criterion 2.4.5(1)); schedule (Criterion 2.4.5(2)); standards and specifications (Criterion 2.4.5(3)); and facilities, equipment, tools, and techniques (Criterion 2.4.5(4)).
18.1.4.5.1 Status (Criterion 2.4.5(1)) and Schedule (Criterion 2.4.5(2))
Criterion 2.4.5(1) states that the applicant should describe the applicability and status of each of the 12 HFE elements, and Criterion 2.4.5(2) states that the applicant should provide a schedule for completing HFE activities that are unfinished at the time of application. The HFE PMP, Table 4-2, Human Factors Engineering Element Documentation, shows the HFE elements and explains the status of each. All of the HFE elements listed in the criterion are shown in Table 4-2 and are identified as being applicable to the HFE program. The applicant provided with the application an RSR for each element that is the responsibility of the DC applicant, with the exception of the RSR for the V&V element, which was submitted after the initial DCA submittal. The information in Table 4-2 is consistent with the letter dated January 14, 2016, from the NRC to the applicant (ADAMS Accession No. ML15302A516) and the letter dated April 8, 2016, from the applicant to the NRC (ADAMS Accession No. ML16099A270).
The applicant provided COL items for the HFE elements that had not been completed at the time of the application: training program development, procedure development, design implementation, and human performance monitoring. The application addresses the COL responsibilities as follows:
DCA Part 2 Tier 2, Section 13.2, Training, contains COL Items 13.2-1 and 13.2-2 for the COL applicant to provide a description and schedule of the initial training and qualification as well as requalification programs for ROs, SROs, and nonlicensed plant staff (plant management, supervisory personnel, technicians, and general employees).
SRP Chapter 18,Section II, states, Training programs are considered operational programs as identified in SRP Section 13.4, Operational Programs. For a new nuclear power plant (NPP) the training program will usually be reviewed during the COL FSAR review rather than the DC. Providing a COL item for training program development is consistent with the SRP guidance. (The staff evaluates these COL items in Section 13.2 of this SER.)
18-26 DCA Part 2 Tier 2, Section 13.5, Plant Procedures, contains COL Items 13.5-1, 13.5-2, 13.5-3, 13.5-5, 13.5-7, and 13.5-8 for the COL applicant to describe the site-specific plant procedures and provide a schedule for development, implementation, and procedure control. NUREG-0711, Section 9.1, Background, states, In the nuclear industry, procedure development is the responsibility of individual utilities. The procedures program is reviewed by staff using SRP Chapter 13. Providing COL items for procedure development is consistent with the guidance in NUREG-0711. (The staff evaluates these COL items in Section 13.5 of this SER.)
The applicant provided the DI IP to address the HFE design implementation program element. The applicant cannot complete the activities in the DI IP at this time because the as-built plant and site-specific information must exist to complete these activities, and the plant and site-specific information does not exist yet.
The HFE PMP, Table 4-2, states that Human performance monitoring is the responsibility of a COL applicant. No implementation plan or RSR is submitted as part of design certification application. DCA Part 2 Tier 2, Section 18.12, Human Performance Monitoring, includes COL Item 18.12-1 for the COL applicant to develop the human performance monitoring program. NUREG-0711, Section 13.2, Objective, explains that human performance monitoring is an operational program that may be incorporated into a COL applicants problem identification and resolution program and the training program. As such, human performance monitoring is a COL applicants responsibility, and providing a COL item for human performance monitoring is consistent with the guidance in NUREG-0711. (The staff evaluates this COL item in Section 18.12 of this SER.)
Therefore, the staff concludes that the applicant has described the program status and schedule, and they are consistent with the schedule discussed with the applicant and the staff before receiving the DCA for review. Accordingly, the staff finds that the application conforms to this criterion.
18.1.4.5.2 Standards and Specifications (Criterion 2.4.5(3))
Criterion 2.4.5(3) states that the applicants plan should identify and describe the standards and specifications that are sources of the HFE requirements. The executive summary of the HFE PMP states that the HFE program incorporates 12 HFE elements in accordance with the guidance of NUREG-0711, and Revision 3 is specified in the HFE PMP, Section 7.0, NUREG-0711 Conformance Evaluation.
The HSI Design RSR, Section 3.5.1, HSI Style Guide, states that The style guide contains instructions for determining where and how HFE guidance is used in the overall design process. The HSI Design RSR, Section 4.5.1.2, Purpose, states that the Style Guide primarily draws from NUREG-0700 for guidance, and other documents, including accepted commercial HSI, and military HFE design standards were reviewed and are properly referenced.
The staff reviewed the Style Guide, Volume II, and found that it identifies the references for the design-specific HFE requirements established by the applicant for the HFE design. Accordingly, the staff finds that the application conforms to this criterion.
18-27 18.1.4.5.3 Facilities, Equipment, Tools, and Techniques (Criterion 2.4.5(4))
Criterion 2.4.5(4) states that the applicants plan should specify HFE facilities, equipment, tools, and techniques (such as laboratories, simulators, and rapid prototyping software) that the HFE program will employ. The applicant described the following HFE facilities, equipment, tools, and techniques used in the HFE program:
HFE facilities and equipment: The applicant developed a control room simulator that was used in the process of developing the HFE design. The HSI Design RSR, Section 3.2, Simulator Development, states, The NuScale simulator is an evolutionary expression of the MCR interface that is built incrementally and represents the design detail as it emerges. The V&V IP, Section 4.3, Validation Test Beds, explains the use of the control room simulator for ISV testing conducted to validate the HFE design:
The principal validation test bed for the ISV is the control room simulator.
The fidelity of the validation test beds models and HSI are verified to represent the current, as designed NuScale plant prior to use for the validation. The test bed model is made up of four modeling software packages, all working from current NuScale designs. Together, they provide a high level of fluid and reactivity modeling. Precisely modeling the predicted behavior of the reactor core, thermodynamic performance, balance of plant, and electrical system design is desired as NuScale does not have a comparison reference plant. All 12 units are simultaneously and independently modeled, but they all correctly share systems that provide input for multiple units.
The staff concludes that using the control room simulator, which models the current plant system design and the HSIs resulting from the HFE design process, helps to ensure the design that is validated represents the design that will be built and operated.
Tools: The applicant uses databases, such as the HFEITS, for tracking HFE issues, and the OER database for storing the results of the OER. The applicant also uses the VISION Developer application, which is described in Section 18.1.4.1 of this SER in the staffs evaluation of Criterion 2.4.1(5), as a means for documenting the results of HFE analyses, such as TAs, and using them as inputs to the development of the procedures and training programs. In addition, the HSI Design RSR, Section 4.2.1, Simulator Software, explains how the applicant used proprietary software to ensure the HFE design guidelines were applied consistently to all of the HSIs to which the guidelines were applicable. Other tools the applicant uses include verification checklists, which the staff discusses in its evaluation of Criterion 2.4.3(2) in Section 18.1.4.3 of this SER.
The staff concludes that these tools help to ensure the consistent application of the applicants HFE design criteria to the HSIs, help to provide for efficient and thorough verification activities, and help to ensure that necessary design changes are implemented. The staff also concludes that these tools allow for the documentation of HFE issues, facilitate integration of the results of the HFE analysis elements (e.g., TA) to
18-28 be used as inputs to the HSI design elements (e.g., procedure development), and help to ensure that HFE guidelines are applied consistently to HSIs.
Techniques: The HSI Design RSR, Section 3.3.4, Rapid Prototyping, states the following:
Based on the latest conceptual sketches and feedback from interfacing with other disciplines, mock-ups or prototype screens integrated with a software simulator of the system are developed for review and evaluation.
While the prototype provides a realistic user experience with the system, the focus is on testing design concepts and soliciting feedback, rather than producing an engineering-quality software architecture and user interface.
The staff concludes that the applicants technique is an acceptable means of gaining user feedback that can be incorporated into the design as it evolves.
Accordingly, the staff finds that the application conforms to this criterion.
18.1.5 Combined License Information Items No COL information items are associated with HFE program management.
18.1.6 Conclusion The staff evaluated the applicants method for HFE program management and finds that it conforms to the criteria in NUREG-0711, Section 2.4. Therefore, the staff concludes that the applicants HFE program description addresses the goals and scope of the HFE program, identifies the HFE team and member qualifications, identifies HFE processes and procedures, covers methods for tracking HFE issues, and provides an overview of how each of the HFE program elements will be addressed. Accordingly, the staff finds the application satisfies the requirements in 10 CFR 50.34(f)(2)(iii) and 10 CFR 52.47(a)(8) related to this element.
18.2 Operating Experience Review 18.2.1 Introduction The objective of this review is to verify that the applicant has identified and analyzed HFE-related problems and issues encountered in previous designs so that these problems and issues may be avoided in the development of the new design. This review should also verify that the applicant has retained the positive features of previous designs. This is done through an evaluation of licensee event reports, Institute of Nuclear Power Operations significant event reports and significant operating experience reports, plant corrective action systems, operational and maintenance logs and records, and data from interviews with experienced plant personnel.
18.2.2 Summary of Application DCA Part 2 Tier 1: Refer to Section 18.1.2 of this SER.
18-29 DCA Part 2 Tier 2: The applicant provided a description of this HFE element in DCA Part 2 Tier 2, Section 18.2, Operating Experience Review.
ITAAC: There are no ITAAC associated with this element.
Technical Specifications: There are no TS associated with this element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: Refer to Section 18.1.2 of this SER.
18.2.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR 52.47(a)(8) as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 50.34(f)(3)(i) addresses administrative procedures for evaluating operating, design, and construction experience.
10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts.
SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.
Acceptance criteria for HFE design methodology are provided in NUREG-0711 (listed below).
(NUREG-0711 references NUREG-0700, Human-System Interface Design Review Guidelines, which provides detailed acceptance criteria for HFE design attributes.)
NUREG-0711, Revision 3, Human Factors Engineering Program Review Model, Chapter 3, Operating Experience Review, Section 3.4, Review Criteria, issued November 2012.
The following documents also provide additional guidance in support of the SRP acceptance criteria to meet the above requirements:
NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors, issued June 2015.
NUREG/CR-7126, Human-Performance Issues Related to the Design and Operation of Small Modular Reactors, issued June 2012.
NUREG-0711 states, The main reason an applicant conducts an OER as part of the HFE program is to identify HFE-related safety issues. The objective is to ensure that the applicant has reviewed previous designs and analyzed the results so that the design process can maintain positive features from predecessors and eliminate or minimize negative aspects of the
18-30 design. The staff reviewed the RSR and applied the acceptance criteria in NUREG-0711, Section 3.4, to ensure that this objective is met (Section 3.4.3, Plant Modifications, applies only for plant modifications and therefore was not used).
Some aspects of the design necessitate a modified version of an OER compared to what has been done for previous DCs. For example, nonnuclear industry OERs (e.g., unmanned aerial vehicles and teleoperative medicine) will play a much greater role in understanding the strengths and weaknesses of various automation techniques that are unique to NuScale.
NUREG/CR-7202 provides guidance to the staff to identify these new considerations with respect to small modular reactor (SMR) designs like NuScale. NUREG-7126 provides additional detail that supports the criteria in NUREG/CR-7202.
The review criteria in NUREG-0711, Section 3.4, do not specifically mention the use of nonnuclear OER; however, the background section states, It may be based on multiple predecessors and encompass both non-nuclear and nuclear industry sources. Additionally, NUREG/CR-7202, Section 2.2, Novel Systems and Limited Operating Experience from Predecessor Systems, identifies questions the staff may consider when evaluating the ways the applicant has compensated for aspects of the design that may not have any or have only limited relevant predecessor plant operating experience.
The staff review verified that the applicant has a systematic and dedicated process for identifying, tracking, and addressing operating experience in the design in a manner similar to previous DC reviews. However, the staff focused this review using the guidance in NUREG/CR-7202 by verifying that the scope of the operating experience information reviewed includes appropriate surrogate industry information and by assessing whether a sufficient OER has been performed even when there may be limited or no relevant predecessor nuclear industry operating experience.
18.2.4 Technical Evaluation The staff reviewed the application using the criteria in NUREG-0711, Sections 3.3, Applicant Products and Submittals, and 3.4, Review Criteria. All acceptance criteria in NUREG-0711, Section 3.4, were applied to this review, with the exception of those in Section 3.4.3, Plant Modifications, which apply only to plant modifications, and therefore are not applicable to this DCA review. The subsections below document the results of the staffs evaluation.
18.2.4.1 Scope (Criteria 3.4.1(1)-(5))
NUREG-0711, Section 3.4.1, Scope, includes five criteria for this topic. Each criterion addresses confirming that the applicants OER program includes certain types of operating experience, including predecessor/related plants and systems, recognized industry HFE issues, related HSI technology, issues identified by plant personnel, and IHAs.
18.2.4.1.1 Summary of Application The following sections of the OER RSR contain information on predecessor/related plants and systems (Criterion 3.4.1(1)):
18-31 Section 3.1, Review of Predecessor and Related Plants and Systems, describes the methodology used to identify predecessor/related plants and systems.
Appendix A, Issues from Predecessor and Related Plants and Systems Incorporated into Design, lists the issues identified during the OER, most of which are not applicable to the NuScale design because of the nature of the design.
Tables 3-1, Comparison of commercial PWR systems to NuScale systems, and 3-3, OER scope, predecessor determination, and relevance, illustrate the comparisons of systems in the NuScale design relative to existing designs. Table 3-2, Examples of systems and components eliminated in the NuScale design, provides examples of systems that have been eliminated completely from the NuScale design and highlights the design features that make the elimination of the systems possible.
Section 4.1, Predecessor and Related Plants and Systems, summarizes those systems and processes that do not apply to the NuScale design by virtue of the design.
Elimination of these systems and processes removes many of the problems identified by the OER that traditional operating plants experience.
In addition, the following sections of the OER RSR contain information on recognized industry HFE issues (Criterion 3.4.1(2)):
Section 2.1, Operating Experience Review Process Overview, indicates that the analysis considered NUREG/CR-6400, Human Factors Engineering (HFE) Insights for Advanced Reactors Based Upon Operating Experience, issued January 1997, and the other sources of operating experience listed in the criterion.
Appendix B, List of Operating Experience Sources Reviewed, gives the number of issues identified based on each source of operating experience and describes how these issues were handled in the OER process. Appendix B also indicates which OER items have already been closed.
Section 3.2, Review of Recognized Industry HFE Issues, provides additional detail on the process used to review this information. This section indicates that lessons learned from the accident at Fukushima were included, as was information from NRC generic communications. These sources of information demonstrate that the applicant has considered sources of operating experience information that was created after 1996, as described in Criterion 3.4.1(2).
The following sections of the OER RSR contain information on related HSI technology (Criterion 3.4.1(3)):
Section 3.3, Review of Related HSI Technology, provides a detailed methodology for reviewing HSI technology that goes beyond consideration of the traditional nuclear industry HSI. The scope of this section includes nonnuclear HSI technologies that may be applicable to this design.
18-32 Appendix D, Related HSI Technology Issues Incorporated into Design, provides the results of HSI technology issues that were identified and included in the design process.
The following sections of the OER RSR contain information on issues identified by plant personnel (Criterion 3.4.1(4)):
Section 3.4, Review of Issues Identified by Plant Personnel, provides the methodology used to review operating experience gathered from plant personnel. This methodology includes interviewing a wide range of operating plant personnel, including operators, procedure writers, supervisors, maintenance technicians, and others, to solicit operating experience.
Appendix F, Plant Personnel Interviews and Findings, contains information about the personnel who were interviewed, as well as the topics that were discussed in the interviews.
Section 4.4, Issues Identified by Plant Personnel, summarizes the issues identified during the data collection process. This is supplemented by Appendices E-G, which provide a sample of the findings.
The following sections of the OER RSR contain information about IHAs (Criterion 3.4.1(5)):
Section 3.5, Review of Important Human Actions, includes an OER methodology for the review of IHAs. IHAs were identified early in the design process (see Section 18.6 of this SER) and entered into the OER database for tracking. The methodology considers both the successful operation of systems used to conduct IHAs as well as conditions that may have caused errors in predecessor plants. The process also considers any IHA that may be different from plants that were reviewed.
Section 3.5 also indicates that the NuScale design has only two IHAs; however, other HAs that could have negative consequences (but were not identified as IHAs) are also identified and analyzed in the OER process.
Section 4.5, Important Human Actions, includes the results of the OER process related to IHAs. It describes two IHAs: one is relevant compared to a benchmark operating plant and the other is unique to NuScale, with some similarities to the benchmark plant.
Appendix H, Important Human Action Issues Incorporated into Design, provides export-controlled information results from this process. A table describes the source of the operating experience, each issue, and a design solution and method of implementation for each entry.
18.2.4.1.2 Staff Assessment The staff compared the scope of the five methods used to assess relevant sources of operating experience described in the OER RSR to the associated NUREG-0711 criteria and considered the supplemental guidance in NUREG/CR-7202, which describes challenges related to OER methodologies that are unique to SMR technologies.
18-33 The staff found that the scope described in the OER RSR was consistent with the applicable NRC guidance described above with the following exceptions:
The OER RSR submittal did not specifically identify some notable published examples of OER that apply to SMRs (see NUREG/CR-7202, Appendix A: Questions for SMR Applicants Organized by NUREG-0711 Element, Section A.1 Operating Experience Review). The response to RAI 9153, Question 18-5 (ADAMS Accession No. ML17346A971) describes the results obtained from the OER process when applied to certain nonnuclear technologies. Therefore, staff was able to determine that the OER process had, in fact, included the appropriate scope including relevant nonnuclear industries.
The bulleted list of considerations in the OER RSR, Section 3.3, was, for the most part, consistent with Criterion 3.4.1(3) and the supplemental guidance in NUREG/CR-7126, however, it was not apparent that multi-unit considerations were included. The response to RAI 9153, Question 18-5, clarifies how multiunit operation and other issues described in NUREG/CR-7126 were considered in the OER process and used to improve the design. The response clarifies that NUREG/CR-7126 was used as an additional source of input to the OER analysis, and it summarizes a sample of results that are uniquely relevant to the NuScale design, such as the lessons learned from unmanned aircraft systems, oil refinery control systems, and teleoperative medicine experience.
During the June 2018 audit, (ADAMS Accession No. ML18208A370) the staff confirmed that the sample of results presented in the OER RSR was representative of the full set of results contained in the OER database by reviewing a sample of OER items and ensuring that they were consistent with the applicable acceptance criteria.
18.2.4.1.3 Conclusion The staff found that the methodology described in the OER RSR covers most of the scope of an acceptable OER program as described in NUREG-0711 and the supplemental SMR guidance.
The response to RAI 9153, Question 18-5, clarifies the scope of the OER described in the original application materials.
During the June 2018 audit, the staff confirmed that the sample of results provided in the OER RSR was an adequate representation of the full set of OER results in the OER database.
The staff considered the scope of the analysis and found it to be consistent with the applicable NUREG-0711 criteria, and therefore, the staff finds this treatment to be acceptable.
18.2.4.2 Issue Analysis, Tracking and Review (Criteria 3.4.2(1)-(4))
NUREG-0711, Section 3.4.2, Issue Analysis, Tracking and Review, includes four criteria for this topic. These criteria address the applicants ability to analyze and track relevant operating experience events. This includes describing an adequate OER process (Criterion 3.4.2(1)),
analyzing OER content to identify relevant human performance issues (Criterion 3.4.2(2)),
documenting the OER process (Criterion 3.4.2(3)), and tracking relevant OER entries (Criterion 3.4.2(4)).
18-34 18.2.4.2.1 Summary of Application The following sections of the OER RSR contain information related to describing an adequate OER process (Criterion 3.4.2(1)):
Section 2.1 describes the process used, which includes methods for screening, reviewing, providing recommendations, and documenting results. This section also discusses team member roles and important decisionmaking points. Figure 2-1, Operating experience review process, illustrates the processes.
Section 1.2, Scope, identifies the scope of the OER, which includes various operating, design, and construction experience.
The following sections of the OER RSR contain information related to analyzing OER content to identify relevant human performance issues (Criterion 3.4.2(2)):
Section 2.2, OER Team Composition and Responsibilities, identifies the responsibilities of the OER team, which include the bulleted items listed in Criterion 3.4.2(2).
Section 3.6.3, HFE Issue Tracking System Database, describes the documentation and tracking of considerations listed in this criterion.
The following sections of the OER RSR contain information related to documenting the OER process (Criterion 3.4.2(3)):
Section 3.6 describes the documentation of OER issues, including the use of three separate databases. Appendices J-L provide screen capture examples of each of the three databases.
Section 3.6.1 describes the OER database, which documents issues that are preliminarily screened into the OER. The OER team assesses all entries. Any entries that are found to be out of the scope of OER are closed out after a justification is written, but the information is retained. Any entries that are found to be within the scope of OER are transferred to either the engineering database (for issues that are within the scope of OER but are not human factors issues) or to the HFEITS (for OER issues that are related to human factors).
The following section of the OER RSR contains information related to tracking OER entries (Criterion 3.4.2(4)):
Appendix I, Sample of Open Issues Being Tracked, to the RSR identifies a sample of open items that are still being tracked in the HFEITS.
18.2.4.2.2 Staff Assessment The staff reviewed the OER RSR sections noted above and compared the descriptions of the methodologies used to the applicable NUREG-0711 criteria.
18-35 The staff found that although a specific NuScale procedure for conducting OER is not referenced, the content of the OER RSR provides adequate detail for the process to be implemented as described. The staff determined this treatment to be adequate to meet Criterion 3.4.2(1).
The staff assessed the methodology described in Sections 2.2 and 3.6.3 of the OER RSR and found that it is consistent with Criterion 3.4.2(2). The staff found that the entries in the appendices illustrate that the process described in the methodology represents adequate results related to human performance issues, sources of human error, and design elements that support human performance.
The staff reviewed the screen shots of the databases in the RSR and concluded that the database structure captures the relevant parameters necessary to implement the program as described in the OER RSR. In addition, the staff reviewed the OER database during the May 2017 audit (ADAMS Accession No. ML17181A415) and found it to be an adequate means of the documenting the OER process in accordance with Criterion 3.4.2(3).
In June 2018, the staff audited the applicants OER analysis (ADAMS Accession No. ML18208A370). The staff confirmed that the sample of results presented in the OER RSR was representative of the full set of results contained in the OER database by reviewing a sample of OER items and ensuring that they were consistent with the applicable acceptance criteria.
18.2.4.2.3 Conclusion The staff finds that the methodology described in the OER RSR is consistent with the relevant NUREG-0711 criteria as described above. In addition to reviewing the relevant sections of the OER RSR, the staff audited the OER database and HFEITS database during the May 2017 audit. The OER database was found to be a sufficient means to document and track OER analyses. The June 2018 audit confirmed that the results of the OER process in the OER database are consistent with those results reported in the OER RSR. Therefore, the staff finds this treatment to be an acceptable means of meeting these review criteria.
18.2.5 Combined License Information Items No COL information items are associated with DCA Part 2 Tier 2, Section 18.2.
18.2.6 Conclusion The staff evaluated the applicants method for conducting the OER and finds that it conforms to the relevant review criteria in NUREG-0711, Section 3.4. The staff found that the OER process was well structured and controlled by the use of the OER database, which was confirmed to be consistent with the OER criteria in NUREG-0711. In addition, staff found that the applicant considered the various sources of OER described in NUREG-0711 as well as several additional sources of OER that were derived from non-nuclear technologies. This non-nuclear OER is important consideration for small modular reactors because other industries have already addressed similar problems, and these lessons learned were used to inform the design of the NuScale HSIs. These observations give the staff confidence that the applicant has applied appropriate human factors principles to help ensure that the design maintains important features
18-36 that help operators safely control the plan, and when possible, design problems of legacy systems out of the plant completely. The staff finds this treatment of the OER analyses to be consistent with the guidance in NUREG-0711 supplemented by NUREG/CR-7202. Accordingly, the staff finds the application satisfies the requirements in 10 CFR 50.34(f)(2)(iii), 10 CFR 50.34(f)(3)(i), and 10 CFR 52.47(a)(8) related to this element.
18.3 Functional Requirements Analysis and Function Allocation 18.3.1 Introduction Functional Requirements Analysis (FRA) is the identification of functions that must be performed to satisfy plant overall goals (e.g., safe operation, power generation). FA is the analysis of requirements for plant control and the assignment of control functions to (1) personnel (e.g., manual control), (2) system elements (e.g., automatic control and passive, self-controlling phenomena), and (3) combinations of personnel and system elements (e.g., shared control, automatic systems with manual backup).
The objective of the staffs review is to verify that (1) the plant's functions that must be performed to satisfy plant safety objectives have been defined, and (2) the allocation of those functions to human and system resources has resulted in a role for personnel that takes advantage of human strengths and avoids human limitations.
18.3.2 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR Section 52.47(a)(8) as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts.
The SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.
Acceptance criteria for HFE design methodology are provided in NUREG-0711 (listed below).
(NUREG-0711 references NUREG-0700, Human-System Interface Design Review Guidelines, which provides detailed acceptance criteria for HFE design attributes.)
NUREG-0711, Revision 3, Human Factors Engineering Program Review Model, Chapter 4, Functional Requirements Analysis and Function Allocation, Section 4.4, Review Criteria, issued November 2012.
The following documents also provide additional guidance in support of the SRP acceptance criteria to meet the above requirements:
NUREG/CR-7126, Human-Performance Issues Related to the Design and Operation of Small Modular Reactors, issued June 2012.
18-37 NUREG/CR-3331, A Methodology for Allocation of Nuclear Power Plant Control Functions to Human and Automated Control, issued 1983.
NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors, issued June 2015.
18.3.3 Summary of Application DCA Part 2 Tier 1: Refer to Section 18.1.2 of this SER.
DCA Part 2 Tier 2: The applicant provided a description of this HFE element in DCA Part 2 Tier 2, Section 18.3, Functional Requirements Analysis and Function Allocation.
ITAAC: There are no ITAAC associated with this element.
TS: There are no TS associated with this element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: Refer to Section 18.1.2 of this SER.
18.3.4 Technical Evaluation The NuScale design will rely on automation more so than operating plants do; therefore, the staff gave special consideration to the FA portion of the review to ensure that the issues described in NUREG/CR-7126 and NUREG/CR-7202 were adequately addressed. Specifically the staff focused on the relevant issues in NUREG/CR-7202, Appendix A.2, Functional Requirements Analysis and Function Allocation, to ensure they are are adequately addressed, in addition to the NUREG-0711 criteria.
NUREG-0711, Section 4.4, contains nine acceptance criteria, eight of which are applicable to DC applicants (the ninth is applicable only for modifications). The staff used the applicable criteria to review the FRA/FA RSR (RP-0316-17615) to ensure the objectives are met as discussed below. In addition, issues of significant interest with regard to human/automation interaction may be observed during ISV testing.
18.3.4.1 Methodology (Criteria 4.4(1)-(2))
NUREG-0711, Section 4.4, Criteria 4.4(1)-(2), address the methodology used for the FRA/FA processes. Criterion 4.4(1) focuses on ensuring a structured and documented methodology that reflects HFE principles, and Criterion 4.4(2) says that the process should be performed iteratively.
18.3.4.1.1 Summary of Application Information supporting the documentation of the FRA/FA methodology reflecting HFE principles (Criterion 4.4(1)) includes a high-level summary of the FRA and FA methodologies in DCA Part 2 Tier 2, Sections 18.3.2-18.3.2.2. Figure 3-1, FRA/FA activity and information flow, of the FRA/FA RSR illustrates both types of analysis, described in detail in the subsections below.
18-38 18.3.4.1.1.1 Functional Requirement Analysis Methodology The DCA Part 2, Tier 2, Section 18.3.2.1, Objectives and Scope, describes the FRA methodology. This method describes an iterative process that identifies specific plant-level functions and decomposes these functions into subfunctions, system functions, processes, and components necessary to accomplish the plant-level function, identified in the FRA/FA RSR, Table 3-1, NuScale Plant Functions.
The FRA/FA RSR, Section 2.1, FRA/FA Process Overview, provides a brief overview of the FRA/FA processes. The FRA/FA RSR elaborates on them in Sections 3.0 - 3.8 and provides an export-controlled methodology for developing plant functional requirements, performing function decomposition and requirements analysis, conducting FA, and documenting the processes illustrated in Figure 3-1.
18.3.4.1.1.2 Function Allocation Methodology The DCA Part 2, Tier 2, Section 18.3.2.2, Function Allocation Methodology, describes the FA methodology. This method systematically assigns control of functions to automation, manual operation, or a combination of both. This process considers relevant concerns related to safe operation, including repetition of action, operator safety, likelihood of errors, and several others.
The FRA/FA RSR, Section 3.5, Automation Philosophy, indicates that the overall philosophy is to use automation to support the needs of the operator. NuScales strategy is that automation should be used for routine tasks and error-prone tasks and that interlocks should be used to prevent operators from performing undesired actions.
The FRA/FA RSR, Section 3.6, Automation Criteria, provides specific descriptions about how the applicant allocates functions to automation, operators, or a combination of both. The process uses SMEs to consider the tasks and to select an appropriate allocation. Table 3-2, Levels of automation, identifies and defines various levels of automation that the NuScale design uses.
The DCA Part 2, Tier 2, Section 18.3.2, Methodology, describes information related to the iteration of the FRA/FA (Criterion 4.4(2)), which indicates that the FRA/FA process is iterative and is kept current throughout the plant life cycle. Similarly, the FRA/FA RSR, Section 2.1, indicates that the process is performed iteratively throughout the design process and is kept current through decommissioning.
18.3.4.1.2 Staff Assessment With regard to Criterion 4.4(1), the staff reviewed Figure 3-1 of the FRA/FA RSR and found that it documents an analysis process that is both logical and structured. The FRA/FA database is used to document and track the analyses (Section 4.2, FRA/FA Database, of the FRA/FA RSR provides additional details). In June 2018, the staff conducted an audit of the FRA/FA database (ADAMS Accession No. ML18208A370) in which the staff confirmed that the entries in the database were complete and consistent with the methodology described in the FRA/FA RSR.
The HFE principles discussed in Sections 3.5, Automation Philosophy, and 3.6, Automation Criteria, of the FRA/FA RSR were consistent with the goal of FAto use the strengths of
18-39 humans and automations to optimize system performance. During the June 2018 audit (ADAMS Accession No. ML18208A370), staff reviewed database entries associated with a sample of the topics in NUREG/CR-7202 and concluded that the applicant had adequately considered them in the FRA/FA process by confirming that there were completed entries in the FRA/FA database for these items.
In addition, the staff considered the results of the SPV audit, which took place in August 2016 (ADAMS Accession No. ML16259A110). These results provided preliminary evidence that the automation schemes used have been successful in managing high workload conditions with the NuScale design during scenario testing.
Regarding Criterion 4.4(2), the staff compared the statement in DCA Part 2 Tier 2, Section 18.3.2, to the criterion and found it to be consistent with the intent of the criterion, but it was unclear from the FRA/FA RSR how the process will be managed by the COL applicant. The response to RAI 9220, Question 18-22 (ADAMS Accession No. ML18115A441), clarified that NuScale will maintain the FRA/FA current in accordance with Regulatory Guide (RG) 1.206, Combined License Applications for Nuclear Power Plants (LWR Edition), issued June 2007.
Future COL holders will need to prepare an application in accordance with RG 1.206, which instructs COL holders to submit an update to the DCA Part 2.
The response to RAI 9220, Question 18-22, also indicates that iterations to the FRA/FA will occur when modifications are proposed, rather than at predetermined periodic intervals. This strategy will address any relevant concerns that may arise after the initial DC approval, thus ensuring that the FRA/FA remains current over time.
18.3.4.1.3 Conclusions The staff finds the FRA/FA methodology is structured and documented in accordance with Criterion 4.4(1) of NUREG-0711. The staff confirmed during the June 2018 audit that the NuScale process adequately addresses the HFE principles applicable to SMRs described in NUREG/CR-7202. Therefore, the staff finds this treatment conforms to Criterion 4.4(1).
The staff finds that the FRA/FA process is iterative. Reliance on RG 1.206 provides an adequate means of ensuring that the FRA/FA is updated accordingly during the COL application process. Therefore, the staff finds this treatment conforms to Criterion 4.4(2) of NUREG-0711.
18.3.4.2 Functional Requirements Analysis Results (Criteria 4.4(3)-(4))
NUREG-0711, Section 4.4, Criteria 4.4(3)-(4), focus on ensuring that the results of the FRA analysis are adequate. Criterion 4.4(3) gives specific properties that the plants functional hierarchy should address. Criterion 4.4(4) focuses on identifying design requirements associated with the high-level plant functions identified in the plants functional hierarchy.
18.3.4.2.1 Summary of Application The following application materials address Criterion 4.4(3):
DCA Part 2 Tier 2, Section 18.3.2.1, describes the functional hierarchy/task decomposition at a high level. This section gives two high-level goals: plant safety and
18-40 power generation. The listed plant-level functions support these goals. In addition, Figures A-1, CVCS decomposition for fuel assembly heat removal and reactivity control, and A-2, Example of removing fuel heat assembly decomposition during operation, in the FRA/FA RSR illustrate a sample of vertical slices through the NuScale functional hierarchy that resemble Figure 4-1, Vertical slice through a plants functional hierarchy for ensuring safety, of NUREG-0711.
DCA Part 2 Tier 2, Section 18.3.2.1, addresses the treatment of predecessor plant systems and compares them to traditional nuclear power plant systems and functions. It describes how the applicant decomposes the high-level functions in a way that ultimately supports the FA process.
The FRA/FA RSR, Section 3.2, Plant Functional Requirement Development, reiterates much of the process identified in DCA Part 2 Tier 2, with additional detail. It lists the NuScale plant functions in Table 3-1, next to NuScale design features intended to support each function. Section 2.1 indicates that the applicant defines the plant functions using the design reliability assurance program expert panel. SRP Section 17.4, Reliability Assurance Program (RAP), addresses the review of the design reliability assurance program process.
The FRA/FR RSR, Section 4.4.2, Predecessor Designs, illustrates how the FRA/FA database is used to consider and document NuScale functions compared to predecessor designs and to assess their influence on plant functions.
The following sections of the application address Criterion 4.4(4):
DCA Part 2 Tier 2, Section 18.3.1, Objectives and Scope, indicates that the purpose of the FRA/FA process is to ensure that safety and power generation goals are sufficiently defined, analyzed, and allocated.
The FRA/FA RSR, Section 4.4, Functional Requirements Analysis and Database Examples of Results, describes the applicants FRA/FA database. Sections 4.4.1-4.4.8 describe how the database documents each of the bulleted items in the criterion. In addition, Figures 4-1-4-24 show sample entries from the FRA/FA database for three different systems that correspond directly with the bullets.
18.3.4.2.2 Staff Assessment With respect to Criterion 4.4(3), the applicant provided a reasonable high-level description of the FRA/FA process in DCA Part 2 Tier 2, supported by the diagrams in Appendix A, System Decomposition, to the FRA/FA RSR that closely resemble the functional hierarchy shown in NUREG-0711, Chapter 4, Functional Requirements Analysis and Function Allocation. The tables below the diagrams provide examples of how the data in the FRA/FA database are represented. Appendix A shows only a sample of two sections of the functional hierarchy. This is reasonable because the full functional hierarchy is very large and would be difficult to represent on paper. The functional decomposition breaks down the systems into progressively more specific subsystems and components, as described in the criterion.
18-41 Although NuScale does not have an immediate predecessor design, the applicant has considered systems and functions that resemble pressurized-water reactors in a way that is consistent with the intention of the criteria. The FRA/FA database captures this information in a manner that preserves the information with other important system information.
Figures 4-10 through 4-24 of the FRA/FA RSR illustrate how the FRA/FA database identifies system configurations necessary for safe operation. These figures show a variety of parameters necessary for the operator to understand, such as when the associated function is necessary, working, and ready for termination.
The applicant credited the design reliability assurance program in this process (see SRP Chapter 17, Quality Assurance, Section 17.4, and ER-0000-3387, NuScale Plant Functions, Revision 0).
In June 2018, the staff used an audit of the FRA/FA database (ADAMS Accession No. ML18208A370) to confirm that the results in the database were adequately represented by the sample of results in the FRA/FA RSR. The database entries reviewed were consistent with the method described in the FRA/FA RSR.
With respect to Criterion 4.4(4), the staff reviewed the sample database entries found in the FRA/FA RSR and found them to contain entries for each of the bulleted areas listed in this criterion. The structure of the database helps to ensure that the FRA/FA process will include those bulleted items of the criterion. The staff finds that the use of the FRA/FA database is an effective means for working through and documenting the process. In addition, the June 2018 audit of the FRA/FA database (ADAMS Accession No. ML18208A370) confirmed that the results of the process were consistent with the method described in the FRA/FA RSR.
18.3.4.2.3 Conclusion The staff finds that the methodology described in the FRA/FA RSR is consistent with the applicable NUREG-0711 criteria because Criteria 4.4(3)-(4) are met as described above. The staff confirmed during the June 2018 audit that the results in the FRA/FA database were consistent with the FRA/FA methodology. Therefore, the staff concludes that this treatment of Criteria 4.4(3)-(4) is acceptable.
18.3.4.3 Function Allocation Results (Criteria 4.4(5)-(7))
Criteria 4.4(5)-(7) address the results of the FA. Criterion 4.4(5) indicates that the FA should identify the level of automation for each function as well as the technical bases for the allocation. Criterion 4.4(6) indicates that the FA should address primary actions taken by the operator as well as other operator actions, such as monitoring automation, detecting degradations/failures, and assuming manual control. Criterion 4.4(7) addresses the overall role of the operators while considering all functions allocated to them.
18.3.4.3.1 Summary of Application The following sections of the application address Criterion 4.4(5):
18-42 DCA Part 2 Tier 2, Section 18.3.2.2, provides high-level rules for determining the appropriate allocation and level of automation. The applicant expanded on these rules in the FRA/FA RSR, Section 3.5, which provides the set of conditions used by SMEs to decide whether a function should be allocated to the human, the automation, or a combination of both. In addition, Section 3.6 of the FRA/FA RSR presents eight automation criteria used by SMEs to allocate functions to the specific levels of automation defined in Table 3-2 of the FRA/FA RSR.
The FRA/FA RSR, Section 4.5, Function Allocation Example, provides a partial FA table. This table of export-controlled information represents a sample of the results of the FA process. The table presents tasks that are paired with the assigned allocation, technical basis for the allocation, and a description of the role of the operator while performing/monitoring the task.
The following sections of the application address Criterion 4.4(6):
DCA Part 2 Tier 2, Section 18.3.2, provides a very high-level indication that the process will address this criterion, stating that the HFE team determines the conditions and parameters necessary for monitoring and control.
The FRA/FA RSR, Section 2.1, provides additional detail and states, FA provides a framework for determining roles and responsibilities of personnel and automation.
The FRA/FA RSR, Section 4.5, describes the information that FA tables are to include.
Table 4-2, Partial function allocation table for CVCS, shows a partial FA table.
Appendices E-G show three sample allocation tables for select systems. These tables show the allocation (including the level of automation used (e.g., automatic with the consent of the operator), technical basis for the allocation, and the role of the operator.
When the function is allocated to manual control, the table typically includes a brief description of what the operator must do. When the allocation is to automation, the role of the operator typically is to monitor and take control when automation fails. Although Table 4-2 does not explicitly describe how the operator will understand that the automation has failed (i.e., parameters to monitor), the FRA/FA collects, and stores information needed by the operator to successfully monitor and back up failed automation (see the FRA/FA RSR, Sections 4.4.4 through4.4.8). Moreover, the TA process iterates and supplements this information.
The following sections of the application address Criterion 4.4(7):
Although the associated Tier 1 or Tier 2 material associated with FRA/FA does not explicitly address an overall operator role, the FRA/FA RSR contains much information about how operator roles are developed:
o The FRA/FA RSR, Table 4-1, VISION Icon Descriptions, has an entry for Job Position, which is defined as, A way to determine the roles and responsibilities of a task. This indicates that roles and responsibilities of a task are considered in the FRA/FA database. In addition, Table 4-1 has an entry for Tasks, which are defined
18-43 as, A well-defined unit of work having an identifiable beginning and end which is a measurable component of a specific job.
o The FRA/FA RSR, Section 4.5, provides an example of a partial FA table. It shows entries in the Role of the Operator Column, which describes how operators will interact with various systems during tasks.
o Appendices E-G of the FRA/FA RSR show sample allocation tables. These tables show the allocation, technical basis for the allocation, and the role of the operator.
When the allocation is to automation, the role of the operator typically is to monitor and take control when automation fails.
The applicant compiled a more comprehensive description of operator roles in the ConOps:
o The ConOps, Section 2.2, Operations Crew Composition, Qualification, Training and Command and Control, describes the crew composition, qualifications, and training and the basic command and control concept. Section 2.1, Plant Mission, describes additional duties associated with the SROs and ROs, including tasks that go beyond direct manipulation of plant controls, such as implementation of the emergency plan, directing/overseeing staff, and conducting surveillances.
o The ConOps, Section 2.3, Operator Roles and Responsibilities, covers the roles and responsibilities of operators and describes how operators should control and monitor plant functions and communicate with other team members.
o The ConOps, Section 2.4, Machine Agent and Shared Roles, describes the roles of machine agents (automation) and shared roles between the machine and human operators. It describes various methods through which the operator may communicate with the automated system (such as setting control parameters, initiating actions, securing automation, or making manual adjustments to automated processes).
o The ConOps, Section 2.4.3, Parameter Monitoring, defines conditions in which the operator should increase his or her interaction with a system and explains when the operator should intervene to interrupt an automated process.
18.3.4.3.2 Staff Assessment With regard to Criterion 4.4(5), the staff reviewed the FRA/FA RSR, Table 4-2, and found that it identifies the allocations (including levels of automation) and the technical bases for the functions and components listed in the table. This constitutes reasonable evidence that the process described in the FRA/FA RSR will provide results that are consistent with the criterion.
The staff reviewed a sample of entries and confirmed that the sample of results in the FRA/FA RSR adequately represented the contents of the database during the June 2018 audit (ADAMS Accession No. ML18208A370). Therefore, the staff concludes that both the methodology described in the FRA/FA RSR and the results of the process are sufficient to meet Criterion 4.4(5).
18-44 With regard to Criterion 4.4(6), the staff reviewed the description of information in the FRA/FA RSR, Section 4.5, and the examples in the appendices. The columns in the tables show that some tasks are assigned to manual control, indicating that the task is a primary responsibility of the operator. The tables also demonstrate that those conducting the FA process should identify secondary tasks, including monitoring, detection of degradations, and assumption of manual controls, as part of the FA process. The staff examined a sample and found this to be the case.
The FRA/FA database supports the documentation of the information needed to support the allocations identified in the FRA/FA RSR, Section 4.5.
The response to RAI 9370, Question 18-25 (ADAMS Accession No. ML18103A153), clarified that the term direct operator actions used in the RSR includes activities such as monitoring (an activity that does not necessarily involve physical action by the operator); therefore, the staff concluded that this terminology does not inappropriately limit the scope of the analysis.
The staff finds this methodological treatment to be consistent with the acceptance criteria and, therefore, acceptable. The June 2018 audit (ADAMS Accession No. ML18208A370) confirmed that the results in the FRA/FA RSR are representative of the set of results in the FRA/FA database.
With regard to Criterion 4.4(7), the applicant described the role of the operators in the ConOps.
The roles describe the expected interactions between operators and automation and considers other tasks that may interfere with this interaction (such as supervising staff or implementing the emergency plan).
The ConOps describes the operator roles at a relatively high level. The SPV tested the concept of operations and confirmed that the operator roles can be effective in the MCR. The SPV was audited by staff (ADAMS Accession No. ML16137A257). The staff finds this description of operator roles in the ConOps to be an acceptable means of meeting this criterion because this high-level description of the roles has been tested with satisfactory results in the SPV.
Moreover, additional testing will occur during the ISV testing that can be used to further refine the details of the operator role.
18.3.4.3.3 Conclusions The staff reviewed the methodology in the FRA/FA RSR and found that it conforms to the guidance in NUREG-0711 as described above. The results presented in the FRA/FA RSR were derived consistently with the process described in the RSR. In addition, the staff confirmed that the results in the FRA/FA RSR are representative of the results in the FRA/FA database.
Therefore, the staff finds this an acceptable means to meet these NUREG-0711 criteria.
18.3.4.4 Verification that Functional Requirements Analysis/Function Allocation Is Complete (Criterion 4.4(8))
Criterion 4.4(8) focuses on verifying that the results of the FRA/FA are complete and have accomplished the objectives.
18.3.4.4.1 Summary of Application Several sections of the submitted materials address goals similar to this criterion:
18-45 DCA Part 2, Tier 2, Section 18.3.2.1, states, The HFE team members review the FRA and verify that all high-level functions necessary to achieve safe operation have been identified and analyzed along with the requirements for each of the identified functions.
The verification is documented in the FRA and function allocation database.
DCA Part 2, Tier 2, Section 18.3.3, Results, concludes that the FRA/FA processes were conducted in a manner that is consistent with the criterion. Specifically, it indicates that FRA/FA process results include a set of safety functions and provides a pointer to the FRA/FA RSR. It indicates that requirements for each high-level function are identified (e.g., conditions when the function is needed, indication that function is available). It also indicates that the FRA/FA RSR contains the allocation of functions and technical basis.
The FRA/FA RSR, Section 3.0, Methodology, describes the methods used to conduct these the FRA/FA processes. Section 4.0, Summary of Results, summarizes the results, and Appendices B-G provide sample database entries.
The FRA/FA RSR, Sections 3.4-3.6, provide information about how the allocations to humans and automatic systems are conducted in a way that takes advantage of human strengths and avoids human limitations.
18.3.4.4.2 Staff Assessment The methodologies described provide a means to identify high-level functions needed for safe operation and to track the requirements of the high-level functions (via the FRA/FA database).
In addition, the FRA/FA RSR provides rules for allocating functions to automation that are consistent with good human factors practice (e.g., using automation for repetitive and predictable tasks, using automation when fast results are necessary, and using automation when it is unsafe for an operator to perform a task).
The FRA/FA RSR, Section 5.0, Analysis of Conclusions, describes the interdisciplinary approach used in the design/analysis process. It indicates that the results are reviewed and evaluated but provides little detail as to how this is done. Moreover, the applicant submitted the FRA/FA RSR prior to conducting key verification and validation activities. The results of these activities had the potential to drive changes to the allocations described in the RSR.
Therefore, the staff conducted an audit in June 2019 (ADAMS Accession No. ML19220B675) after the verification and validation activities were completed to better understand the impact of the test results. The staff discussed the impact of the ISV results on the function allocations described in the RSR. Although there were some data points associated with automation, these were of low safety significance and did not require design changes to resolve them. NuScale staff indicated that the ISV results substantiated the initial allocations and that no changes were made to the allocations as a result of ISV testing. This was consistent with the staffs observations that none of the HEDs sampled involved changes to function allocations.
18-46 18.3.4.4.3 Conclusion The staff finds that the methodology described above is consistent with the criterion. In addition, the results of the ISV provide performance-based data that validates the initial function allocations. Therefore, the staff finds this treatment to be acceptable.
18.3.5 Combined License Information Items No COL information items are associated with NuScale DCA Part 2 Tier 2, Section 18.3.
18.3.6 Conclusion The staff found that the descriptions of the methodologies in the FRA/FA RSR, when supplemented by the RAI responses and the ConOps, are consistent with the NUREG-0711 criteria as described above.
During the June 2018 audit, the staff concluded that the results in the FRA/FA database are consistent with NUREG-0711 and that the results in the FRA/FA RSR adequately represent the contents of the database. Therefore, the staff concludes that the results of the FRA/FA analyses documented in the FRA/FA RSR are consistent with NUREG-0711.
The June 2019 audit was used to confirm that the ISV results supported the allocation of function. There were no significant safety issues associated with the function allocations described in the RSR, nor were there any changes needed to this FA to resolve HEDs identified during ISV.
Therefore, the staff concludes that the methods and results of the FRA/FA process were sufficient to achieve the objectives descried in NUREG-0711 and thus the results provide reasonable assurance that the FRA/FA supports safe operation. Accordingly, the staff finds the application satisfies the requirements in 10 CFR 50.34(f)(2)(iii) and 10 CFR 52.47(a)(8) related to this element.
18.4 Task Analysis 18.4.1 Introduction Task analysis (TA) identifies the tasks that plant personnel must perform to accomplish the functions that are allocated to HAs. TA also identifies the alarms, information, controls, and task support that must be available for plant personnel to successfully perform these tasks. TA generates input to several program elements: staffing and qualifications (S&Q), HSI design, procedure development, training program development, and V&V.
18.4.2 Summary of Application DCA Part 2 Tier 1: Refer to Section 18.1.2 of this SER.
DCA Part 2 Tier 2: The applicant provided a description of this HFE element in DCA Part 2 Tier 2, Section 18.4, Task Analysis.
18-47 ITAAC: There are no ITAAC associated with this element.
TS: There are no TS associated with this element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: Refer to Section 18.1.2 of this SER.
18.4.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR) 52.47(a)(8) as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts.
The SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections. Acceptance criteria for HFE design methodology are provided in NUREG-0711 (listed below). (NUREG-0711 references NUREG-0700, Human-System Interface Design Review Guidelines, which provides detailed acceptance criteria for HFE design attributes.)
NUREG-0711, Revision 3, Human Factors Engineering Program Review Model, Chapter 5, Task Analysis, Section 5.4, Review Criteria.
18.4.4 Technical Evaluation The staff used the criteria in NUREG-0711, Section 5.4, to evaluate the applicants task analysis results. NUREG-0711, Section 5.4, includes 10 criteria for this topic. The tenth criterion addresses plant modifications and is not applicable to this DCA review; thus, the staff evaluated only the first nine criteria, as discussed below.
18.4.4.1 Scope (Criterion 5.4(1))
The staff reviewed the TA RSR, Section 3.2, Task Screening, which addresses the scope of the applicants TA. The staff compared this information to Criterion 5.4(1), which lists tasks that should be part of the scope of the applicants TA, including (1) all IHAs (determined by probabilistic and deterministic means), (2) tasks that represent the full range of plant operating modes, and (3) eight specific types of tasks as listed in Criterion 5.4(1) (e.g., tasks that are new compared to those in predecessor plants).
In the TA RSR, Section 3.2, the applicant stated that the scope of its TA includes IHAs (probabilistic and deterministic), the full range of plant operating modes, and the eight types of tasks listed in Criterion 5.4(1).
18-48 In addition, the staff reviewed a sample of TA results provided in the application as well as during a May 2017 audit (ADAMS Accession No. ML17181A415). The staff observed that the tasks included were within the applicants stated scope. Accordingly, the staff finds that the application conforms to this NUREG-0711 criterion.
18.4.4.2 Screening Methodology (Criterion 5.4(2))
The staff reviewed the HFE PMP; DCA Part 2, Tier 2, Section 18.4.2.1, Task Identification Methodology; and the TA RSR, Section 3.3.2, Surveillance, Test, Inspection, and Maintenance Procedure Tasks. The staff compared this information to Criterion 5.4(2), which states that the applicant should describe the screening methodology used to select the tasks for analysis, based on criteria specifically established to determine whether analyzing a particular task is necessary.
The HFE PMP, Section 6.3, states, Tasks are first screened. From the wide range of plant operating conditions, any task that meets the following criteria receives a more detailed TA. A list of eight criteria follows the statement. Additionally, in DCA Part 2 Tier 2, Section 18.4.2.1, the applicant further explained that Determination of tasks to be analyzed is performed by subject matter experts on the basis of their experience at current operating nuclear plants. The process typically includes review of operating experience and available system design material.
In the TA RSR, Section 3.3.2, the applicant stated the following:
To select which risk-significant surveillance, test, inspection, and maintenance tasks are to be analyzed, the SME reviews the design material available, including system design packages, piping and instrument diagrams (P&IDs),
logic diagrams, and electrical schematics for each system the task involvesactivities that by SME judgment have challenged operating crews at current commercial U.S. operating nuclear plants, or which potentially impact the ability of a NuScale plant operating crew to manage up to twelve units in one control room, are selected for TA. An SME who did not conduct the evaluation for a specific system reviews the results documentation for completeness and confirmation of the task selections.
The response to RAI 8805, Question 18-3 (ADAMS Accession No. ML17304B488), specified that detailed TA was performed on all tasks. Therefore, the staff concludes that screening criteria did not need to be established because the applicant chose to analyze all tasks that were included in the scope of TA.
18.4.4.3 Tasks Attributes and Iterative Process (Criteria 5.4(3)-(8))
NUREG-0711, Criteria 5.4(3)-(7), state that the applicant should (1) begin TA with detailed narratives of what personnel have to do, along with specifying the alarms, information, controls, and task support needed to accomplish the task, (2) identify the relationships among tasks, (3) estimate the time required to perform tasks, (4) identify the number of people required to perform each task, and (5) identify the knowledge and abilities required to perform each task.
Criterion 5.4(8) states that the applicants TA should be iterative and updated as the design is
18-49 better defined. The staff reviewed both the DCA Part 2 and multiple sections of the TA RSR and compared this information to Criteria 5.4(3)-(8).
Task Narrative (Criterion 5.4(3))In DCA Part 2 Tier 2, Section 18.4.2.2, Personnel Task Narrative, the applicant described the task narrative. It includes a description of the objectives of a specific system's operator tasks; an overview of the activities personnel are expected to accomplish to complete the task; a definition of alarms, information, controls, and task support needed to accomplish the task; and a basic outline of the procedure steps. The TA RSR, Section 3.5, Detailed Task Narratives, provides details on the information that is included in the task narrative (e.g., associated alarms, anticipated workload, communications needs). In the TA RSR, Table 3-1, Task Considerations, the applicant listed specific task considerations addressed in the task narratives, which is consistent with NUREG-0711, Table 5-1, Task Considerations.
The applicant addressed the processes used to identify relationships among tasks, estimate the time required to perform tasks, identify the number of people required to perform each task, and identify the knowledge and abilities required to perform each task in the following ways:
Relationships Among Tasks (Criterion 5.4(4))In DCA Part 2 Tier 2, Section 18.4.2.3, Relationships Among Tasks, the applicant stated the following:
each task is decomposed by identifying the parent task, subtasks, and task elements. An operational sequence diagram is created and used for certain tasks as necessary to aid in evaluating the flow of information between the operators and the HSI from the beginning to the end of the task. Information flow includes operator decisions, operator and control activities, and the transmission of data.
Time Required (Criterion 5.4(5))In DCA Part 2 Tier 2, Section 18.4.2.4, Time Required for Performing Tasks, the applicant stated the following:
The time required to complete a task is a combination of cognitive processing time, physical movement time, and HSI response time (e.g., screen navigation, control operation, I&C platform processing, plant system response). Calculations of time required for task performance consider decision-making (which may or may not be part of cognitive processing depending on task complexity), communications with the operations team, task support requirements, situational and performance-shaping factors, and workplace factors and hazards for each step of a task. The analysis of time required is also based on a documented sequence of operator actions. Time estimates for individual task components (e.g., acknowledging an alarm, selecting a procedure, verifying that a valve is open, starting a pump), and the basis for the estimates are established through a method applicable to the HSI characteristics of digital computer-based I&C.
Number of Personnel (Criterion 5.4(6))In the TA RSR, Section 3.5.2, Personnel Required for Performing Tasks, the applicant stated, The number of personnel required
18-50 to perform each task is determined by the task narrative, complexity of the task, time required to perform the task, and the time available.
Knowledge and Abilities (Criterion 5.4(7))In TA RSR, Section 3.5.6, Knowledge and Abilities Identification, the applicant stated the following:
each task is analyzed to determine the knowledge and abilities needed for success of the task. The knowledge and abilities are benchmarked against a modern pressurized water reactor using NUREG-2103, and a gap analysis is performed. The results of this analysis are used to develop the NuScale-specific KA [knowledge and abilities] catalog written to specifically address the unique nature of the design.
The TA RSR, Section 4.4, Knowledge and Abilities, provides specific examples of the types of knowledge and abilities captured and how they are associated with tasks.
The staff reviewed task examples in the TA RSR, Section 4.0, Summary of Results, and confirmed that they contained detailed narratives of what personnel need to do to accomplish the task, as well as the alarms, information, controls, and task support personnel need to accomplish the tasks. The staff also found that the examples addressed each of the task considerations listed in NUREG-0711, Table 5-1. Further, the examples showed how task decomposition allows for the identification of relationships among tasks in the TA database used by the applicant. For example, each task is linked to the function(s) it supports, and each component, instrument, alarm, and control in the database is linked to the tasks it supports.
Thus, task relationships can be identified via common functions, HSI components, and the like.
The operational sequence diagrams demonstrate the sequential relationships between tasks.
The staff also found that the examples addressed the estimated time required to perform each task, the number of people required to perform each task, and the knowledge and abilities needed to perform each task. The staff concludes the examples provided are consistent with Criteria 5.4(3)-(7).
The staff conducted two audits of the applicants TA results in the applicants TA database to verify the methodology used and confirm the completeness of the TA results. During the May 2017 audit (ADAMS Accession No. ML17181A415), the staff found that the TA results sampled were either complete or incomplete. For those analyses that were complete, the staff found that the analyses were consistent with Criteria 5.4(3)-(7). For tasks that were incomplete, the staff found that the task had been entered into the database, and the database included fields for each of the attributes discussed in Criteria 5.4(3)-(7). Some tasks were partially complete. During the audit, the applicant explained that TA had been completed for tasks that were part of the sample of tasks included in the SPV, which is discussed in more detail in SER Section 18.5.4. The applicant explained that it was continuing (1) to perform new TA and modify existing analyses as the design developed and (2) to prepare for the final design validation test (i.e., the ISV test) scheduled in 2018.
The staff conducted an audit in June 2018 (ADAMS Accession No. ML18208A370) and found that the analyses for all of the tasks sampled had been completed, and the TAs conformed to Criteria 5.4(3)-(7). Therefore, the staff concluded that the applicants TA was iterative and was
18-51 updated as the design was developed, which is consistent with Criterion 5.4(8). Accordingly, the staff finds that the application conforms to these NUREG-0711 criteria.
18.4.4.4 Reliability and Feasibility (Criterion 5.4(9))
NUREG-0711, Criterion 5.4(9), states that the applicant should analyze the feasibility and reliability of IHAs and lists topics that should be considered in doing so.
The staff reviewed the TA RSR, DCA Part 2, and TIHA RSR and compared the information to Criteria 5.4(9). The TA RSR, Section 3.7, Analysis of Feasibility and Reliability for Important Human Actions, states that the time available to perform actions is the length of time from the initiation of the task to the time the task needs to be completed as defined in the analysis (i.e.,
PRA). The TIHA RSR, Section 4.1, Identification of Risk Important Human Actions from the PRA/HRA, states that two IHAs associated with the NuScale plant design were identified. The applicant relied upon the PRA to specify the time available for IHAs.
The time required for the IHAs was analyzed using an integrated MCR simulator that reflected the NuScale design to date. This analysis was part of the SPV testing. The IHAs were simulated, and the time required for completion was recorded. Staffing for the analysis was nominal (i.e., three ROs, three SROs). The procedures developed from the applicants TA guided the sequence of operator actions. The testing included the applicable alarms, controls, and displays.
The applicants response to RAI 9409, Question 18-36 (ADAMS Accession No. ML18143B532) clarified apparent inconsistencies in the time available to perform certain IHAs. The applicant explained that ((
)). However, the SPV results still remained within the applicants established SPV acceptance criteria. The staff understands that this is an iterative process and that the results were still acceptable.
Additionally, the applicant established two criteria related to the amount of margin between time available and time required to perform the IHAs:
(1)
IHAs must have been completed within (( )) of the time available, as calculated by the PRA (i.e., a (( )) margin). If this criterion was not met, then the scenario would not have been considered successful.
(2)
All tasks with time constraints, including IHAs, that were not completed within (( )) of the time available (i.e., a (( )) margin) were (( )).
Given that the most limiting times for these IHAs in the PRA are about 30 minutes and that the actions are generally simple, operators are trained, procedures are available, the IHAs all occur in the MCR, and the controls and displays operators need to use to complete the IHAs are provided in the MCR design, the staff finds that the time margins and the estimate of time required are reasonable.
18-52 Because the actions were simulated in a MCR simulator that included the procedures for completing these IHAs, the staff concludes that the time for operators to complete these actions was sufficient to allow for the successful execution of applicable steps in the procedures.
Therefore, the staff concludes the applicant addressed the topics in Criterion 5.4(9) and analyzed whether the IHAs can be performed reliably and feasibly. Thus, the staff finds that the application conforms to Criterion 5.4(9).
18.4.5 Combined License Information Items No COL information items are associated with DCA Part 2 Tier 2, Section 18.4.
18.4.6 Conclusion The staff evaluated the applicants TA methodology and results and found that all of the criteria in NUREG-0711, Section 5.4, are met. Therefore, the staff concludes that the applicants TA identifies the specific tasks personnel perform to accomplish their functions, identifies the necessary control room inventory to accomplish those tasks, and provides reasonable assurance that operator tasks identified can be executed with the available inventory.
Accordingly, the staff finds this treatment to be acceptable, and the staff finds the application satisfies the requirements in 10 CFR 50.34(f)(2)(iii) and 10 CFR 52.47(a)(8) related to this element.
18.5 Staffing and Qualifications 18.5.1 Introduction The objective of the staffs review is to verify that the applicant has systematically analyzed the number and necessary qualifications of personnel in concert with task requirements and regulatory requirements.
18.5.2 Summary of Application DCA Part 2 Tier 1: Refer to Section 18.1.2 of this SER.
DCA Part 2 Tier 2: The applicant provided a description of this HFE element in DCA Part 2 Tier 2, Section 18.5, Staffing and Qualifications.
ITAAC: There are no ITAAC associated with this element.
Technical Specifications: The following TS are associated with this element:
TS 5.2.2 contains requirements for the minimum number of licensed operators at a NuScale plant.
TS 5.1.2 requires that the shift manager shall be responsible for the control room command function, and during the shift managers absence from the control room while any unit is in MODE 1, 2, 3, 4, or 5, an individual with an active SRO license shall be designated to assume the control room command function.
18-53 Topical Reports: There are no topical reports associated with this element.
Technical Reports: Refer to Section 18.1.2 of this SER.
18.5.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR 52.47(a)(8) as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts.
The SRP Chapter 18,Section II, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.
NUREG-0711, Revision 3, Chapter 6, Staffing and Qualifications, Section 6.4, Review Criteria.
The following documents also provide additional criteria, or guidance in support of the SRP acceptance criteria to meet the above requirements:
NUREG-1791, Guidance for Assessing Exemption Requests from the Nuclear Power Plant Licensed Operator Staffing Requirements Specified in 10 CFR 50.54(m).
NUREG/CR-6838, Technical Basis for Regulatory Guidance for Assessing Exemption Requests from the Nuclear Power Plant Licensed Operator Staffing Requirements Specified in 10 CFR 50.54(m), issued February 2004.
Brookhaven National Laboratory (BNL) TR No. 20918-1-2015, Methodology to Assess the Workload of Challenging Operational Conditions in Support of Minimum Staffing Level Reviews, issued March 2015 (ADAMS Accession No. ML15083A205) (BNL Tech Report).
18.5.4 Technical Evaluation The NUREG-0711, Section 6.4, includes six criteria for the staffing and qualifications review element. Section 13.1 of this SER addresses Criterion 6.4(1). Criterion 6.4(2) addresses NRC requirements for minimum staffing of licensed operators that are applicable to facility licensees; these requirements are not applicable to DC applicants. The applicant proposed a staffing level for its design that would not allow a facility licensee to meet some requirements in 10 CFR 50.54(m). Therefore, the applicant provided the methodology used to conduct, and the results of, a performance-based test, referred to as the SPV, as technical justification to support a new design-specific staffing requirement that a facility licensee referencing the NuScale design could meet in lieu of 10 CFR 50.54(m). The applicant proposed a new design-specific staffing requirement in DCA Part 7, Section 6, to be added to the DC rule such that a licensee for a
18-54 NuScale plant could meet the design-specific staffing rule in lieu of the requirements in 10 CFR 50.54(m). The staff evaluates the applicants technical basis supporting the proposed minimum staffing level in Section 18.5.4.2 of this SER.
The remaining review criteria in NUREG-0711 address inputs from the TA to S&Q analyses (Criterion 6.4(3)), staffing for the full range of plant conditions and tasks (Criterion 6.4(4)),
iteration (Criterion 6.4(5)), and staffing-related issues (Criterion 6.4(6)). The staff addresses these criteria in Section 18.5.4.3 of this SER.
Before discussing the review criteria, the staff provides relevant background information in Section 18.5.4.1 of this SER.
18.5.4.1 Rationale for a Design-Specific Staffing Requirement The requirements in 10 CFR 50.54(k) and 10 CFR 50.54(m) identify the minimum number of licensed operators that must be on site, in the control room, and at the controls. The requirements are conditions in every nuclear power reactor operating license issued under 10 CFR Part 50. The requirements are also conditions in every COL issued under 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants; however, they are only applicable after the Commission makes the finding under 10 CFR 52.103(g) that the acceptance criteria in the COL are met.
In a letter to the NRC dated September 15, 2015 (ADAMS Accession No. ML15258A846), the applicant proposed that six licensed operators will operate up to 12 reactor modules from a single control room. However, the staffing proposal would not allow a facility licensee to meet the requirements in 10 CFR 50.54(m)(2)(i) because the table in 10 CFR 50.54(m)(2)(i) does not address operation of more than two units from a single control room. The proposal also would not allow a facility licensee to meet 10 CFR 50.54(m)(2)(iii) because the regulation requires a licensed operator at the controls for each fueled unit (i.e., 12 licensed operators). Absent alternative staffing requirements, future NuScale licensees would need to request an exemption from these requirements.
In a letter dated January 14, 2016 (ADAMS Accession No. ML15302A516), the staff discussed ways in which NuScales DCA could address the regulatory requirements of 10 CFR 50.54(m) in order to provide the greatest degree of issue finality and regulatory certainty on the issue of control room staffing. In a letter dated April 8, 2016 (ADAMS Accession No. ML16099A270),
the applicant stated that it would propose for certification as part of the DC rulemaking an alternative control room staffing level requirement that a facility licensee could satisfy in lieu of 10 CFR 50.54(m).
On June 23, 2016, and August 30, 2016, the staff held public meetings with the applicant to discuss the regulatory process for implementing this approach in the NuScale DC rulemaking.
The public meeting summary (ADAMS Accession No. ML16252A258) lists the information the staff stated the applicant should include with the DCA. The staff reviewed the DCA to assess whether it contained the information listed in the meeting summary and determined the DCA included all of the information except for a statement in DCA Part 2 Tier 1 that the minimum staffing requirements are located in the DC rule (i.e., a pointer statement). In the response to RAI 8747, Question 18-10 (ADAMS Accession No. ML17354A845), the applicant stated that a
18-55 pointer should not be added to Tier 1 because such information is not typical of the contents of Tier 1, and the requirements in the DC rule and TS 5.2.2 are sufficient to ensure that a licensee is aware that alternative staffing requirements are to be used in lieu of 10 CFR 50.54(m). The staff agrees that such a pointer statement does not need to be added to Tier 1 because the requirements stated in the NuScale DC rule and TS 5.2.2 would be sufficient to ensure a licensee referencing the NuScale design is aware that alternative staffing requirements stated in the NuScale DC rule may be used in lieu of 10 CFR 50.54(m).
The applicant provided as part of the DCA the technical basis for rulemaking language that would address control room staffing in conjunction with control room configuration. A future NuScale licensee that follows the certified NuScale-specific staffing requirements will not need an exemption from 10 CFR 50.54(m) because the DC rule will address the applicability of the regulation (i.e., paragraph V, Applicable Regulations, of the DC rule in the applicable 10 CFR Part 52 appendix will include the alternative staffing requirement rule language, including the requirement provisions, staffing table, and appropriate table notes). DCA Part 7, Section 6 includes the requirement provisions, staffing table, and appropriate table notes.
18.5.4.2 Evaluation of the Applicants Technical Basis (Criterion 6.4(2))
Criterion 6.4(2) states that the staff should assure that the applicants proposed staffing meets the requirements of 10 CFR 50.54, Conditions of Licenses, and, if not, the NRCs reviewers should use the guidance in NUREG-1791 and NUREG/CR-6838.3 The executive summary of NUREG-1791 states the following:
The purpose of this review is to ensure public health and safety by verifying that the applicants staffing plan and supporting analyses sufficiently justify the requested exemption. The applicants submittal should include (1) the description of the request, the concept of operations, and operational conditions considered, (2) supporting analyses and documentation from the operating experience, functional requirement analysis and function allocation, task analysis, job definition, and staffing plan, and (3) data and analysis from validation exercises performed to demonstrate the effectiveness and safety of the proposed staffing plan.
The validation exercise discussed in the quotation above is the SPV.
The abstract of the SPV Results TR states the following:
A staffing plan validation was conducted using guidance in NUREG-0711, NUREG-1791, and NUREG/CR-6838 as well as other industry guidance. The staffing plan validation included performance-based tests using a simulator focused on operator performance, workload, and situation awareness during challenging plant operating conditions which included design basis events, beyond design basis events, multi-module events, and events in series and parallel. The results of the analysis, performed using the methods described 3
NUREG/CR-6836 contains the technical basis for the staffs guidance in NUREG-1791. The staff used NUREG/CR-6836 as a reference if it needed clarification of the review guidance in NUREG-1791.
18-56 above, confirm that up to 12 NuScale power modules and the associated plant facilities may be operated safely and reliably by a minimum staffing contingent of three licensed reactor operators and three licensed senior reactor operators from a single control room during normal, abnormal, and emergency conditions.
The staff used the guidance in NUREG-1791, Appendix A, Review Checklists, which contains 11 review steps, and the guidance in the BNL Tech Report to review the results of the applicants SPV and evaluate whether the results support the applicants proposed design-specific minimum staffing level. Because the applicant conducted the SPV using the simulator, which according to NUREG/CR-6838 is the most realistic means of validating the acceptability of minimum staffing levels, the staff focused the review on the evaluation of these results to determine the acceptability of the minimum staffing level, as summarized below.
Step 1: Review the Request NUREG-1791, Section 1.1, Discussion, explains that the staff needs to understand the scope of the review and ensure that the applicant has provided the necessary information for the staff to perform the review. As explained above, the applicant does not need to request an exemption because the minimum staffing requirements apply to facility licensees, not DC applicants. However, in order to provide the greatest degree of regulatory certainty and finality for COL applicants, the DCA will address staffing to support the establishment of a design-specific staffing rule for a licensee to use in lieu of 10 CFR 50.54(m).
The SPV Methodology, Section 6.1, Operating Staff Assignments, states the following:
The following staff and qualifications are assumed to be available as part of the on-shift operating crew. Six licensed operators in the main control room consisting of the following: one shift manager maintaining an active senior reactor operator license, one control room supervisor maintaining an active senior reactor operator license, one shift technical advisor maintaining an active senior reactor operator license and having a degree in a science or applied science field, and three unit supervisors maintaining active reactor operator licenses.
The staff also reviewed DCA Part 7, Section 6, which contains the applicants proposed rule to be used in lieu of 10 CFR 50.54(m). The proposed requirements are as follows:
(1)
A senior operator licensed pursuant to Part 55 of this chapter shall be present at the facility or readily available on call at all times during its operation, and shall be present at the facility during initial start-up and approach to power, recovery from an unplanned or unscheduled shutdown or significant reduction in power, and refueling, or as otherwise prescribed in the facility license.
(2)
Licensees shall meet the following requirements:
- a.
Each licensee shall meet the minimum licensed operator staffing requirements in the following table:
18-57 Table 1: Minimum Requirements Per Shift for On-Site Staffing of NuScale Power Plants by Operators and Senior Operators Licensed Under 10 CFR Part 55 Number of units operating (a nuclear power unit is considered to be operating when it is in MODE 1, 2, or 3 as defined by the unit's technical specifications)
Position One to twelve units One control room None Senior operator 1
Operator 2
One to twelve Senior operator 3
Operator 3
Source: DCA Part 7, Section 6.1.3, Requested Action.
- b.
Each licensee shall have at its site a person holding a senior operator license for all fueled units at the site who is assigned responsibility for overall plant operation at all times there is fuel in any unit.
- c.
When a nuclear power unit is in MODE 1, 2, or 3, as defined by the unit's technical specifications, each licensee shall have a person holding a senior operator license for the nuclear power unit in the control room at all times. In addition to this senior operator a licensed operator or senior operator shall be present at the controls at all times. In addition to the senior operator and licensed operator or senior operator present at the controls, a licensed operator or senior licensed operator shall be in the control room envelope at all times.
- d.
Each licensee shall have present, during alteration or movement of the core of a nuclear power unit (including fuel loading, fuel transfer, or movement of a module that contains fuel), a person holding a senior operator license or a senior operator license limited to fuel handling to directly supervise the activity and, during this time, the licensee shall not assign other duties to this person.
The proposed minimum staffing requirements in Table 1 of the DCA Part 7, Section 6, differ from the table in 10 CFR 50.54(m)(2)(i) to address the number of operators necessary to operate up to 12 reactors from a single control room. Additionally, the definition of operating as used in the proposed table is modified to mean when a unit is in MODE 1, 2, or 3, as defined by the units technical specifications. In 10 CFR 50.54(m)(2)(i), Footnote 2 states that a unit is considered to be operating when it is in a mode other than cold shutdown or refueling as defined by the units technical specifications (the same definition for operating is also used in 10 CFR 50.54(m)(2)(iii)). DCA Part 4, Section 1.0, Table 1.1-1, MODES, defines the five NuScale plant modes. Modes 1, 2 or 3 are comparable to a mode other than cold shutdown or refueling, and so the proposed definition of operating is comparable to the definition in 50.54(m)(2)(i).
18-58 Also, the proposed minimum staffing requirements in DCA Part 7, Section 6, are the same as those in 10 CFR 50.54(m)(2)(ii) except that they do not include the following statement: If a single operator does not hold a senior operator license on all fueled units at the site, then the licensee must have at the site two or more senior operators, who in combination are licensed as senior operators on all fueled units. Although this statement would provide flexibility in the case where a single operator does not hold a senior operator license on all fueled units at the site, it is not necessary because the proposed requirement states that there will be a single person holding a senior operator license for all fueled units at the site.
Additionally, the proposed minimum staffing requirements in DCA Part 7, Section 6, are the same as those in 10 CFR 50.54(m)(2)(iii) except that the proposed requirements do not state that an operator shall be present at the controls for each fueled nuclear power unit at the site.
The staff finds this acceptable because, if an operator was required to be at the controls for each fueled unit, then it would be necessary to have up to 12 operators for a 12-unit site. As discussed in this section of the SER, the staff has found that the proposed minimum staffing requirements when up to 12 units are operating are acceptable based on the results of the applicants staffing plan validation and integrated systems validation tests.
Finally, the proposed minimum staffing requirements in DCA Part 7, Section 6, are the same as those in 10 CFR 50.54(m)(2)(iv) except that the applicant has proposed an additional requirement for a person holding a senior operator license or a senior operator license limited to fuel handling to directly supervise movement of a module that contains fuel. Movement of a module that contains fuel is an activity that occurs prior to and after refueling that is unique to the NuScale plant design. Because 10 CFR 50.54(m)(2)(iv) requires a licensed senior operator to supervise fuel handling operations and core alterations, the staff finds this additional requirement adequate and necessary.
The only other regulation related to licensed operator staffing is in 10 CFR 50.54(k). The applicant has not proposed any rule apply in lieu of 10 CFR 50.54(k) because a licensee that references the NuScale design will be able to comply with 10 CFR 50.54(k).
The staff also reviewed TS 5.2.2 in DCA Part 4 and found that the requirements in TS 5.2.2 are consistent with those proposed in DCA Part 7, Section 6. Also, TS 5.1.2 requires either the shift manager or an SRO to be in the control room when any unit is in MODES 1-5, which is also consistent with the proposed requirements.
The audit reports, dated May 26, 2016 (ADAMS Accession No. ML16137A129), and November 30, 2016 (ADAMS Accession No. ML16259A110), document the results of the staffs audit of the SPV methodology and observations of SPV testing, respectively. The knowledge the staff gained from these audits; DCA Part 2 Tier 2, Chapter 7, Instrumentation and Controls; Chapter 15, Transient and Accident Analyses; and Chapter 19, Probabilistic Risk Assessment; the HFE TRs included with DCA Part 2 Tier 2, Chapter 18 to address the 12 HFE elements in NUREG-0711; the SPV Methodology TR; and the SPV Results TR provided sufficient information to enable the staffs review of the applicants SPV.
Step 2: Review the Concept of Operations
18-59 The NUREG-1791, Section 2.1, Discussion, states that the staff performs Step 2 to gain a comprehensive understanding of how the proposed staffing fits into the overall design and operation of the plant. NUREG-1791, Appendix A, lists topics the applicant should address in order to provide a complete concept of operations (ConOps). The staff reviewed the applicants ConOps and SPV Results TR and found that together they address these topics. As such, the staff concludes that the applicants description of the concept of operations is complete and addresses the roles of control personnel (i.e., personnel (control room operators) who will have plant monitoring and operational control responsibilities on each shift), and the applicant has adequately explained how the proposed staffing relates to the plants design and operation.
Step 3: Review the Operational Conditions NUREG-1791, Section 3.1, Discussion, states that the staff performs Step 3 to ensure that the operational conditions that present the greatest potential challenges to the effective and safe performance of control personnel were analyzed by the applicant and support the request. The BNL Tech Report, Section 5.1, Identify Challenging Operating Conditions, states, The applicant should identify the plant specific operating conditions that are challenging and create high workload. The objective of identifying these conditions is the evaluation of the minimum staffing level needed to address immediate and short-term actions. The BNL Tech Report, Section 5.1, lists plant conditions, personnel tasks, and situational factors applicants should consider when choosing the sample of challenging operating conditions to use for the staffing analysis. The list includes multiunit monitoring, management of off-normal conditions and emergencies, fatigue situations (e.g., repetitive tasks), tasks requiring interaction with other plant personnel, tasks with high cognitive workload, and tasks that are performed to complete IHAs.
The SPV Methodology TR, Section 3.0, Identify Challenging Operational Conditions, explains that the applicant used the TA results as one input to the selection of the sample of challenging operational (i.e., operating) conditions and states the following:
The task analysis contains numerous attributes that have been recorded into a VISION database. The VISION database allows task attributes to be searched and correlated to assess which impact workload the most.
The SPV Methodology TR, Section 3.0, is proprietary and describes in detail the applicants method and criteria for selecting the challenging operating conditions using the task attributes in the VISION database. The staff reviewed the applicants method and criteria and found that the applicant considered the plant conditions listed in the BNL Tech Report, Section 5.1, as well as conditions in which operators need to perform actions within any time constraints in order to develop the sample of operating conditions (SOC) for the staffing analysis. The S&Q RSR, Section 3.3.2, Staffing Plan Validation Scenario Development, summarizes the selected conditions, including changing conditions on multiple modules, common system interface failures and their effect on multiple modules, high levels of automation, and beyond design basis events.
The SPV Methodology TR, Section 3.0, contains the detailed information about the SOC and the events included in the sample. The staff reviewed Section 3.0 and found that the SOC included the following tasks and conditions:
18-60 Multiunit monitoring, management of off-normal conditions and emergencies, fatigue situations (e.g., repetitive tasks), tasks requiring interaction with other plant personnel, tasks with high cognitive workload, and tasks that are performed to complete the risk-important HAs identified in the PRAs. As discussed in the BNL Tech Report, Section 5.1, these kinds of conditions are likely to result in high operator workload.
Conditions that require operators to perform actions in a relatively short amount of time (relative to other tasks that operators perform at a NuScale plant) before any other staff can be called in for support. These conditions also can create stress, which may increase the chance of human performance errors, and therefore are relatively more challenging to successfully manage.
Conditions that require operators to perform actions under situations that would be unfamiliar because they are infrequently performed, which would likely result in higher cognitive demand. These conditions would also likely be stressful because of the potential for safety-significant consequences if tasks are not performed correctly. As a result, there could be perceived higher levels of workload, which could make these scenarios more challenging to operators and also could increase the likelihood of human performance errors during task performance.
Highly dynamic and unusual situations that would be relatively complex to manage, which would likely cause high cognitive workload demands and make these scenarios more challenging for the operators. Such conditions could also increase the likelihood of human performance errors during task performance.
Thus, the staff concludes the applicants selected SOC conforms to the guidance in NUREG-1791, Section 3.1, and the BNL Tech Report, Section 5.1, and as such includes challenging operational conditions.
Step 4: Review Operating Experience The NUREG-1791, Section 4.1, Discussion, states that the staff performs Step 4 to ensure that the applicant reviewed relevant operating experience to identify and address staffing-related lessons learned. The purpose of the applicants review of operating experience should be to identify previous staffing-related problems in order to avoid repeating them. It is also used to identify similar staffing practices that have proven to be effective and successful implementations of similar technologies and concepts of operation.
The S&Q RSR, Section 3.1.1, Operating Experience Review, describes how the applicant reviewed relevant operating experience to identify and address staffing-related lessons learned.
The applicant collected and reviewed staffing-related operating experience from a variety of sources. The S&Q RSR, Section 3.1.1, states, Initial staffing goals for the NuScale power plant were developed in consideration of the following factors based on SME knowledge and experience. The factors listed include staffing-related issues documented in NRC information notices and regulatory issues summaries, such as Regulatory Issue Summary 2009-10, Communications Between the NRC and Reactor Licensees During Emergencies and Significant Events, dated June 19, 2009. The OER RSR, Section 4.2, Recognized Industry HFE Issues, states, NuScales staffing plan for licensed operators was
18-61 tested to ensure required communications to the NRC could be made in high workload situations. The testing referred to in the OER is the SPV.
Also, the OER RSR, Section 3.4, states that the applicant interviewed plant personnel at various sites, including a nuclear power plant that operates multiple units from a single control room.
Appendix E, List of Sample Sites Visited that Impacted Design, lists the sites visited and the topics discussed, and Appendix F lists the applicants conclusions and lessons learned from interviews. The staff found that the lessons learned include those related to the operation of more than one unit from a single control room, which is a feature of the NuScale design. The OER RSR, Section 4.4, explains how the applicant used observations of the control personnel working at a Canadian facility that operates four units from one control room to inform the concept of operations at a NuScale plant.
Additionally, the OER RSR, Section 2.2, states that the HFE team consists of previously licensed U.S. operators. These previously licensed operators used their own operating experience to conduct the OER, which includes a review of staffing-related lessons learned.
The S&Q RSR, Section 3.1.1, states the following:
The roles and responsibilities of the three senior reactor operators, specifically the SM [shift manager], CRS [control room supervisor], and STA [shift technical advisor], in existing commercial nuclear plants is considered very effective in establishing and maintaining command and control and technical oversight during normal and off-normal conditions. Therefore, initial staffing goals for the MCR crew levels and qualifications are based, in part, on staffing levels and qualifications from commercial nuclear power plants, while taking into account the passive features and a high degree of automation of the NuScale plant.
Thus, the staff concludes that the applicant reviewed relevant operating experience to identify and address staffing-related problems in order to avoid repeating them and also to identify similar staffing practices that have proven to be effective.
Step 5: Review FRA and FA The NUREG-1791, Section 5.1, Discussion, states that the staff performs Step 5 to ensure that the applicant has defined and evaluated the impact of the staffing plan on the plant/system functions that must be performed to satisfy plant safety objectives (i.e., the safety functions).
The second purpose is to ensure that the allocation of functions to humans and systems has resulted in a role for control personnel that uses human strengths, avoids human limitations, and can be performed under the operational conditions evaluated (i.e., the selected SOC).
The applicant provided the FRA/FA RSR with the DCA. (The staff reviews the applicants FRA/FA results in Section 18.3.4 of this SER.) The FRA/FA RSR, Table 3-1, lists all the plant functions, including the safety functions, the applicant identified for the NuScale plant. The applicants SOC described in the SPV Methodology TR, Section 3.0, includes events that the staff determined could potentially impact all the plant safety functions (e.g., beyond-design-basis events (BDBEs)). The staff found that the applicant also specifically addressed monitoring all the safety functions in the selected SOC. Thus, the staff concludes that the applicant evaluated the impact of the staffing plan on the safety functions during the SPV.
18-62 The HSI Design RSR, Section 3.1.1, Personnel Task Requirements, explains that the applicant established automation criteria to allocate functions to personnel, automated systems/machine, or a combination of the two. The results of the FA are an input to TA to identify the alarms, displays, and controls (i.e., the HSI) personnel need to perform tasks associated with functions allocated to them. The HSI Design RSR, Figure 3-1, NuScale Main Control Room Simulator Development Venn Diagram, shows that the results of the TA were inputs to the development of the HSI design, and the HSI Design RSR, Section 3.2, states that the HSI design was an input to the development of the control room simulator. The HSI Design RSR, Section 3.2, also states that The NuScale simulator is an evolutionary expression of the MCR interface that is built incrementally and represents the design detail as it emerges. The HSI Design RSR, Section 3.7, Human-System Interface Tests and Evaluation Overview, explains that the applicant verified that the simulator included all of the HSIs personnel would need to perform tasks, and thus the functions allocated to personnel, within the SOC before conducting the SPV.
Because the SPV was conducted using a simulator control room design that the applicant confirmed included the HSIs that personnel needed to perform tasks allocated to them, and because the FA results were inputs to the TA, the staff concludes that the SPV tested whether the allocation of functions to humans and systems resulted in a role for control personnel that uses human strengths, avoids human limitations, and can be performed under the selected SOC.
Step 6: Review the Task Analysis NUREG-1791, Section 6.1, Discussion, states that the purpose of the step is to confirm that the applicants TA adequately addresses the set of tasks that personnel will be required to perform for the SOC. The BNL Tech Report, Section 5.2, Identify Primary Tasks; Section 5.3, Identify Dependent Tasks; and Section 5.4, Identify Potential Independent Tasks, describe a method that may be used to comprehensively identify the tasks that personnel will be required to perform for the SOC for the SPV. The BNL Tech Report, Section 5.5, Construct Scenarios and Assign Operator Responsibilities, states that applicants should construct scenarios based on combining the primary, dependent, and independent tasks. These scenarios will be used to conduct the workload analysis (i.e., the SPV). Additionally, NUREG-1791, Section 6.1, states, For each task, the information, control, and task support requirements should be addressed by the applicants task analysis, as applicable.
The SPV Methodology TR, Section 6.5, Creation of Scenario Guide, explains how the applicant identified the primary, dependent, and independent tasks personnel needed to perform for the SOC and constructed scenarios by combining these tasks. The staff reviewed Section 6.5 and found that the applicants method of identifying the primary, dependent, and independent tasks that personnel perform during the SOC for the SPV conformed to the guidance in the BNL Tech Report, Sections 5.2, 5.3, and 5.4.
The SPV Results TR, Appendix D, "Scenario 1 Description and Basis; Appendix E, Scenario 2 Description and Basis; and Appendix F, Scenario 3 Description and Basis; describe the scenarios the applicant developed by combining the primary, dependent, and independent tasks that personnel perform during the SOC. The staff reviewed these appendices and found that the scenario descriptions identify the tasks for each event and also identify the task type (i.e.,
18-63 primary, dependent, and independent) for each event included in the scenarios. The staff also found that the scenarios included all of the conditions in the applicants selected SOC.
Therefore, the staff concludes that the applicant identified the tasks operators will be required to perform for the selected SOC.
Because the NuScale standard plant is a new design, the applicant performed TA as one of the HFE design program activities and provided the TA RSR with the DCA. (The staff evaluates the applicants methods for TA and the applicants TA results in Section 18.4.4 of this SER.) The TA RSR, Section 3.5, identifies the task attributes the applicant documented for each task, as applicable, during TA. The TA RSR, Table 3-1, summarizes this information and shows how it conforms to NUREG-0711, Table 5-1. The staff compared the TA RSR, Table 3-1, to NUREG-0711, Table 5-1, and found that the attributes include all of those listed in NUREG-0711, Table 5-1. The task attributes include the alarms, information, controls, and task support needed to accomplish a given task as well as the task performance requirements, including time required (only for IHAs), task time (non-IHAs), and accuracy. The applicant used the results of TA as inputs to the SPV in the following ways:
The TA RSR, Section 3.5.5, Inventory of Alarms, Controls, and Displays, explains that the TA results are used to develop the HSI inventory for the NuScale plant. The S&Q RSR, Section 4.5, Simulator HSI Testing for Staffing Plan Validation, describes the method the applicant used to verify that the alarms, information, controls, and task support needed for personnel to perform the tasks included in the SPV scenarios were available in the MCR simulator before the SPV. The staff concludes that the applicant identified the information, control, and task support requirements for tasks operators performed in the scenarios for the SPV and verified that they were available to personnel before the SPV.
The S&Q RSR, Section 4.1, Staffing and Qualification Results as Compared to NUREG-0711 Review Criteria, explains how some task characteristics identified by TA, such as the time required to perform a task, were used to develop the acceptance criteria for the SPV.
The staff concludes that the applicant adequately identified the set of tasks that personnel will be required to perform for the SOC and also verified that the information, control, and task support requirements that needed to be available for the personnel to perform these tasks were included in the simulator used for the SPV testing.
Step 7: Review the Job Definitions NUREG-1791, Section 7.1, Discussion, states, The purpose of the job definition review is to confirm that the applicant has established clear and rational job definitions for the personnel who will be responsible for controlling the plant. Section 7.1 also states the following:
A job is defined as the group of tasks and functions that are assigned to a personnel position. A job definition specifies the responsibilities, authorities, knowledge, skills, and abilities that are required to perform the tasks and functions assigned to a job. A job that consists of interrelated responsibilities and authorities that do not conflict would be coherent.
18-64 The staff reviewed the ConOps, Section 2.2.1, Operating Crew Composition, and found that it identifies the roles, responsibilities, and qualifications of the operators that form the minimum operating crew. The three SROs fulfill the roles of shift manager, control room supervisor, and shift technical advisor. Based on the descriptions in the ConOps, Section 2.2.1, the staff observed that their roles, responsibilities, and authorities are the same as those of licensed SROs in operating reactors.
The crew complement also includes three licensed ROs, distinguished as RO 1, RO 2, and RO 3. The staff observed that the applicant identified specific roles and responsibilities for RO 1 and that these roles and responsibilities differ from those for RO 2 and RO 3 (RO 2 and RO 3 perform the same roles but have different responsibilities). The staff observed that the roles, responsibilities, and authorities of the ROs are similar to those of the licensed ROs at operating reactors, and that the applicant has defined some roles and responsibilities differently as a result of the unique nature of the applicants control room and plant design.
Additionally, when the staff observed the SPV testing, the staff observed that the roles and responsibilities were clearly defined and did not consist of responsibilities and authorities that conflicted with one another. For example, the SRO assigned as the control room supervisor is given supervisory tasks only and does not perform actual control tasks, similar to the role of the control room supervisor at an operating reactor.
The TA RSR, Section 2.1, Task Analysis Process Overview, explains how the results of the FRA/FA are inputs to the TA and states that HAs and actions allocated to automation defined during FRA/FA are decomposed to identify control and monitoring tasks for the operators and the machine (i.e., automation). The S&Q RSR, Section 2.1.2, Task Analysis Inputs, states that personnel tasks are assigned to staffing positions considering task characteristics, such as the knowledge and abilities required, relationships among tasks, time available, and time required to perform the task; the operators ability to maintain situation awareness within the area of assigned responsibility; teamwork and team processes such as peer checking; and workload associated with each job within the crew. Thus, the staff concludes that the applicant assigned tasks to job positions using the results of the FRA/FA and TA.
NUREG-1791, Section 7.1, also states the following:
An important aspect of the job definition review is to ensure that the qualifications required for each position are delineated. The qualifications required for a plant staff position consist of the knowledge, skills, and abilities/aptitudes (KSAs) an individual must possess to meet the performance criteria established for the tasks assigned to the position. The information derived from the function and task analyses should provide a basis for identifying the required KSAs for each position.
The applicant specified the qualifications required for the staffing positions as either senior operator or operator. Additionally, the TA RSR, Section 3.5.6, explains that as part of TA, each task is analyzed to determine the knowledge and abilities needed to successfully complete the task, and the VISION database contains the results of TA. The TA RSR, Section 4.4, includes examples of the knowledge, skills, and abilities/aptitudes for a given task documented in the VISION database. The S&Q RSR, Section 2.1.2, states the following:
18-65 TA results are used to determine the crew roles and responsibilities and are used as input to the initial licensed operator staffing level. Personnel tasks, addressed in TA, are assigned to staffing positions considering: task characteristics, such as the knowledge and abilities required.
Therefore, the staff concludes that the applicant has delineated the qualifications required for each position, including the knowledge, skills, and abilities that are required to perform the tasks and functions assigned to these positions.
Step 8: Review the Staffing Plan NUREG-1791, Section 8.1, Discussion, states the following:
The purpose of the staffing plan review is to ensure that the applicant has systematically analyzed the requirements for the numbers of qualified personnel that are necessary to operate the plant safely under the operational conditions analyzed. The applicants staffing plan should be supported by the results of the functional requirements analysis and function allocation, task analyses, and the job definitions for each position required under the operational conditions considered. In addition, the applicants submittal should define the proposed shift composition and shift scheduling.
The S&Q RSR, Section 3.1, Establishing the Basis for Staffing and Qualification Levels, explains that the applicant initially started with a staffing goal that was an input to the other HFE program elements. (To complete some analyses, such as TA, it is necessary to start with assumptions about the number and qualifications of personnel who will be available in the control room.) The S&Q RSR, Section 3.3, Evaluation of Staffing Levels and Operator Qualifications, states, The bases for licensed operator personnel staffing are established as described in Section 3.1 using input from other HFE program elements to support the initial staffing goals for the MCR crew (numbers and qualifications baseline) described in Section 3.2.
The S&Q RSR, Section 3.1, also states, The initial staffing goals were subject to revision based on the results of HFE analyses, including operating experience review (OER), FRA/FA, TA, HSI Design, and S&Q. These analyses provide the basis for any changes to the initial staffing levels. The S&Q RSR, Section 4.1, also states, NuScales staffing analysis methodology is iterative as described in Section 2.1.4. Although staffing levels have not changed from initial goals, they have been continuously evaluated throughout the HFE analysis and design process.
The applicant did not define proposed shift scheduling. The staff concludes that this is not necessary at this time because the COL holder that operates a NuScale plant schedules when personnel will be on shift.
Therefore, the staff concludes that the applicant evaluated whether the initial staffing goal needed to be revised based on the results of the OER, FRA/FA, and TA the applicant performed. Because the results did not require changes to be made, the staff concludes that the applicant determined that the results of the FRA/FA and TA support the staffing level. Thus, the staff concludes that the applicant systematically analyzed the requirements for the numbers of qualified personnel that are necessary to operate the plant safely under the operational
18-66 conditions analyzed. The staff discusses the results of the applicants validation of the staffing level, which confirmed the minimum staffing level was adequate, under Step 10.
Step 9: Review Additional Data and Analysis The applicant did not provide any additional data as described in NUREG-1791, and the staff determined that no additional data or analyses were necessary to complete the review.
Step 10: Review the Staffing Plan Validation NUREG-1791, Section 10.1, Discussion, states the following:
The purpose of reviewing the validation of the staffing plan is to ensure that the applicant fully considered the dynamic interactions between the plant design, its systems, and control personnel for the operational conditions identified for the exemption request. The applicant should provide data or demonstrations that the control personnel specified in the staffing plan can satisfy the plant and human performance requirements identified in the functional requirements analysis, function allocation, and task analyses. The data or demonstrations should include the full range of operational conditions identified for therequest, as well as a reasonable representation of the human performance variability expected in the context of the operational conditions.
NUREG-1791 identifies four components of the SPV review: operational conditions sampling, human performance measures and criteria, data sources or demonstration methods, and outcomes. The staff discusses these four components below.
Operational Conditions Sampling NUREG-1791, Section 10.1.1, Operational Conditions Sampling, states the following:
The applicants submittal should identify the operational conditions included in each scenario. The submittal should identify the key plant and system parameters relevant to the scenario and the state of these parameters at the start of the scenario, during critical transition points in the scenario, at times when action by control personnel is expected, the results of control actions, and the status of the parameters at the end of the scenario.
The submittal should sample a sufficient number of operational conditions such that the personnel and plant performance are challenged.
The submittal should also identify the criteria for determining successful performance of the plant, system, and control personnel within the scenarios.
The SPV Results TR, Appendices D, E, and F, contain the scenario descriptions and the scenario bases that summarize the information in the scenario guides. The staff reviewed Appendices D, E, and F and found that, together, they fully incorporate the SOC and identify the key plant and system parameters relevant to the scenario and the state of these parameters at the start of the scenario, during critical transition points in the scenario, and at times when
18-67 action by control personnel is expected; the results of control actions; and the status of the parameters at the end of the scenario. Additionally, as discussed in the review of Step 3, the staff found the applicants SOC to be sufficiently challenging and liable to produce a high workload, and therefore the number of conditions is adequately sampled in the applicants scenarios.
The SPV Methodology TR, Section 9.0, Conclusions and Acceptance Criteria, identifies the criteria the applicant established to evaluate whether a scenario was successfully performed. It also states that the failure of any scenario to meet the criteria requires the applicant to perform corrective actions and then conduct subsequent retesting.
The staff reviewed the applicants criteria for determining successful scenario performance and found that the criteria focused on assessing acceptable task performance and workload levels, which the applicant defined and are discussed below with human performance measures. The staff found that the applicants criteria for determining whether task performance was successful were based on ensuring the safe operation of the plant by not violating certain time limits assumed in the PRA, which would help to ensure successful plant performance. Because the goal of the test is to show that workload is acceptable to help ensure that the minimum staffing levels can achieve successful task performance, the staff determined that the criteria were relevant to the purpose of the SPV and therefore were adequate for determining successful performance.
Human Performance Measures and Criteria NUREG-1791, Section 10.1.2, Human Performance Measures and Criteria, states the following:
The applicant needs to identify the measures of human performance used to evaluate individual and crew performance of the control personnel in the scenarios. In addition to defining the measures of human performance used in validating the staffing plan, the applicant should identify the criteria established to determine the acceptability of the results obtained.
The BNL Tech Report, Section 3.1, General Considerations for the Review of Minimum Staffing Exemption Requests, provides additional guidance for the selection of human performance measures:
Successful task performance is the main criterion for evaluating a proposed staffing level. That is, if the crew at the minimal staffing level cannot perform their tasks, the staffing level is not acceptable. However, while task performance is an important acceptance criterion, its not the only one. High workload, inattention, and poor SA [situation awareness] are examples of the factors that can lead to poor task performance and hence should be considered in staffing evaluations.
Therefore, the staff evaluated whether the applicant at a minimum identified task performance, workload, and situation awareness as human performance measures and also evaluated the applicants criteria for determining whether the results measured were acceptable.
18-68 The staff found that the applicant identified the completion of tasks as one of the SPV human performance measures in the SPV Methodology TR, Section 4.0, Identify Primary and Dependent Tasks, and Appendix A, Scenario Testing Plan, Section A.1, Introduction. The staff found that the SPV Results TR, Section 6.1.1, Time Analysis, explained that the applicant also established additional criteria for determining whether task performance was successful.
The staff reviewed the criteria and found that they were based on assumptions about task performance in the PRA, industry standards, SME judgment, and other regulatory requirements, such as NRC reporting requirements. Therefore, the staff concludes that the applicants criteria for evaluating whether task performance was successful are reasonable and relevant to the tasks included in the SPV.
The SPV Methodology TR, Appendix C, Situational Awareness Questionnaire, explains the method the applicant used to measure situation awareness and identifies the minimum numerical value the applicant established to determine whether measured situation awareness was acceptable. The staff found the applicants method of measuring situation awareness to be an explicit situation awareness probe method as described in NUREG/CR-7190, Workload, Situation Awareness, and Teamwork, issued March 2015. The staff considered the applicants numerical value for determining whether measured situation awareness would be acceptable.
Because situation awareness is context specific, the actual value of situation awareness measured does not provide as much insight as an evaluation of the trends in the operators responses to the questions. For example, if all operators incorrectly answer a certain question, then the applicant should investigate to determine why it was widely missed. Such a result could indicate a problem with the HSI or a problem with the wording of the question.
In the SPV Methodology TR, Appendix C, the applicant provided examples of the types of situation awareness questions administered to the operators. The staff found that these questions were context specific. In addition, the SPV Methodology TR, Appendix A, explains how trends in the operators responses would be identified and evaluated and the actions that would be taken if measured situation awareness was below the minimum numerical value. The staff finds the applicants minimum numerical value a reasonable threshold for triggering a more in-depth evaluation to understand whether there is a problem with the HSI design or the staffing level if measured situation awareness is not acceptable.
The SPV Results TR, Section 6.1.2, Task Load Index, explains that the applicant used the National Aeronautics and Space Administration Task Load Index (NASA-TLX) to measure workload. The staff finds the applicants use of the NASA-TLX to measure workload acceptable because, as discussed in NUREG/CR-7190, the method is a commonly used means of measuring workload, and it has been used previously in the nuclear power plant domain.
The executive summary of the SPV Results TR states the following:
the task load index (TLX) data collection methodology and the data analysis approach used were intentionally designed to identify potential high workload by facilitating the examination of deviations in data regardless of the absolute value of the data. This was done so that even small deviations at low workload levels would be identified. In these instances, other tools such as direct questioning, observations, and self-critiques were used to validate or gather further
18-69 evidentiary information on actual or perceived level of workload and stress and their impact on performance.
The SPV Results TR, Section 6.1.2, further explains the method the applicant used to determine whether measured workload was high. The staff reviewed the alternative method and concluded that it could account for individual biases that might be reflected in the subjective measures of workload, and the method could enable the applicant to identify relative levels of high workload for the individual rater or raters. The staff agrees that the applicants method helps to account for the individual subjectivity reflected in the workload ratings. The staff also notes that the BNL Tech Report, Section 4.3, Identifying Approaches to Workload Analysis, contains guidance for acceptable values of workload and is relevant to the staffs review of the applicants SPV results:
The Department of Defense (DoD, 1999) gives the following criteria for workload analysis based on time utilization: In general, workloads over 100 percent are not acceptable, between 75 percent and 100 percent are undesirable, and under 75 percent are acceptable provided that the operator is given sufficient work to remain reasonably busy.
For these reasons, the staff concludes that the applicant identified relevant human performance measures (i.e., task performance, situation awareness, and workload) and established appropriate criteria to evaluate whether the results of these performance measures were acceptable. The staff documents its review of the SPV results below under Staffing Plan Validation Outcomes.
Data Sources or Demonstration Methods The NUREG-1791, Section 10.3.3, Data Sources and Demonstration Methods, states that the staff should confirm that the applicant met the following criteria:
The selected design of the SPV, the data sources, and the demonstration methods comprehensively address the dynamic aspects of the staffing plan.
The data sources and demonstration methods were used appropriately.
The appropriate quantitative, objective measures and criteria were defined and captured.
NUREG/CR-6838, Section 5.2, Validating Staffing Plans, contains further information.
The data collection and analysis were conducted appropriately.
The scope and data quality were adequate.
The outcomes were reasonable and valid.
DCA Part 2 Tier 2, Section 18.5.3, states the following:
The staffing plan validation included performance-based tests using a simulator focused on operator performance, workload, and situation awareness during challenging plant operating conditions, which included design basis events,
18-70 beyond design basis events, multi-module events, and events in series and parallel. Two independent crews were trained and qualified to conduct three challenging and workload-intensive scenarios utilizing conduct of operations guidance that was reflective of the current industry standards with respect to communications and use of human performance tools. A team of trained and qualified observers consisting of operations, management, and HFE personnel observed and analyzed the crew performances utilizing multiple methods of monitoring crew performance, workload, and situation awareness.
Because the applicant used performance-based tests in the NuScale plant simulator to perform the SPV, the staff relied on the guidance in NUREG/CR-6838, Section 5.2.4, Simulator Studies, to evaluate whether the criteria in NUREG-1791, Section 10.3.3, were met.
NUREG/CR-6838, Section 5.2.4, lists the steps applied below for conducting valid simulator testing and states, Using methods for conducting in-simulator studies for staffing, which are similar to those described in NUREG-0711 Section 11.4.3, Integrated System Verification, leads to effective and robust data collection. Thus, the staff also considered the guidance for ISV testing in NUREG-0711, Section 11.4.3, when evaluating as follows in accordance with the steps from NUREG/CR-6838, Section 5.2.4:
Define the test objectives. The executive summary of the SPV Results TR explains that the objective of the SPV was to demonstrate that the proposed NuScale licensed operator staffing size is sufficient to protect public health and safety while operating a twelve-unit NuScale nuclear power plant from a single control room. The results of the test are necessary to provide a basis for the design-specific minimum staffing requirement that will be included in the DC rule. Thus, the staff concludes that the applicant defined the test objective.
Validate the testbed. The S&Q RSR, Section 3.3.4, Simulator Scenario Based Testing, states the following:
Scenario-based testing is performed in accordance with the NuScale Simulator Scenario-Based Testing Procedure described in detail in Reference 6.2.10. The testing is conducted by determining a set of key parameters and ensuring those parameters behave as expected for the developed staffing plan validation scenarios. ANSI/ANS-3.5-2009 Nuclear Power Plant Simulators for Use in Operator Training and Examination (Reference 6.1.21) is referenced to select steady state and transient parameters.
The SPV Results TR, Section 4.2, Simulator Testing and Validation, discusses in more detail the scenario-based testing method the applicant used to validate the fidelity of the simulator to the control room HFE design and the plant systems modeled. The staff finds that this method is similar to the method of scenario-based testing for licensed operator exams discussed in Nuclear Energy Institute 09-09, Nuclear Power Plant-Referenced Simulator Scenario Based Testing Methodology, Revision 1, dated December 8, 2009, which the NRC endorsed in Regulatory Guide (RG) 1.149, Nuclear Power Plant Simulation Facilities for Use in Operator Training and License Examinations, Revision 4, issued April 2011. This method is a comprehensive method
18-71 that demonstrates simulator fidelity to the reference plant for the selected scenarios.
Therefore, the staff concludes that the applicant validated the testbed (i.e., the simulator) before conducting the SPV testing.
Select plant personnel. The executive summary of the SPV Results TR states the following:
Two independent participant crews were selected based on having prior nuclear control room operating experience and some experience with the NuScale design. All participants had previous licensed operator experience at nuclear facilities, which allowed the training to be condensed and drew on the operators experience with nuclear power plant fundamentals and control room etiquette.
The SPV Results TR, Section 3.1, Crew Selection, discusses the test participants (i.e., the operators) and lists the biographical information for the participants. The staff reviewed the biographical information and, given that information and the fact that the participants were all previously licensed operators in the United States, determined that the participants are representative of licensed operators in the U.S. nuclear industry, which are the possible pool of operators that may be licensed at a NuScale plant. Thus, the staff concludes that the applicant selected a pool of representative test personnel.
Define scenarios. As discussed under Steps 3 and 6, the staff determined that the applicant defined an adequate set of scenarios for the challenging SOC identified for SPV testing.
Define performance measures. As noted above under the discussion of human performance measures and criteria, the staff determined that the applicant defined a sufficient set of human performance measures and acceptance criteria.
Design test.
o Couple control room personnel and scenarios. The executive summary of the SPV Results TR states, each of the two crews performed three challenging high workload scenarios for a total of six tests. NUREG-0711, Section 11.4.3.6.1, Scenario Sequencing, calls for providing each crew with a similar, representative range of scenarios and balancing the order of presentation such that the scenarios are not always given in the same sequence (e.g., the easiest scenarios are not always presented first). Because each of the crews participated in all three scenarios, and because all of the scenarios were designed to be challenging, the staff concludes that the applicant adequately coupled scenarios and personnel.
o Create test procedures. NUREG-0711, Section 11.4.3.6.2, Test Procedures, contains elements that test procedures should include to ensure that testing is conducted in a controlled manner, which is necessary to ensure the validity of the test results. The SPV Methodology TR, Appendix A, describes the test procedures the applicant used to administer the SPV tests. The SPV Methodology TR, Appendix B, Simulator Crew Evaluation Pre-Job Brief, contains a prejob brief sheet
18-72 used during testing. The staff reviewed Appendix A and Appendix B and found that, together, they include all of the elements in NUREG-0711, Section 11.4.3.6.2.
Additionally, the audit report dated November 30, 2016 (ADAMS Accession No. ML16259A110), states the following:
The NuScale staff followed its testing plan and scenario guidance for interacting with participants during the scenarios. The NRC staff observed the NuScale staff maintaining physical control of the scenario documentation to prevent the operators from viewing it and learning the scenario events before the scenarios commenced. NuScale used video and sound recording to support analysis of the scenarios. During the pre-job briefs for the NuScale staff conducted prior to the start of each scenario, the NuScale staff confirmed that the testing prerequisites were satisfied. They also reviewed the scenario events and discussed when the workload and situational awareness assessments would be performed during the scenarios. In summary, the NRC staff observed the NuScale staff exercised appropriate test controls during performance of the staffing plan validation.
Therefore, the staff concludes that the applicant created adequate test procedures and followed them.
o Train test personnel. The SPV Results TR, Section 3.2, Observer Selection, discusses the number of HFE and operations SMEs who conducted observations during the SPV testing. The SPV Results TR, Section 3.3, Support Staff, discusses the simulator support staff and their roles for setting up the test environment and administering the data collection tools during the scenarios. Section 3.3 indicates that the support staff had limited interaction with the test participants, as necessary to conduct the testing. Together, the observers and the simulator support staff are the test personnel.
The SPV Results TR, Section 3.2.1, Observer Training, and Appendix I, Training,Section I.3, Observer Lesson Plan, together describe the training the observers received before the SPV testing. NUREG-0711, Section 11.4.3.6.3, Training Test Personnel, lists topics on which test personnel should be trained during validation testing. The staff reviewed the SPV Result TR, Section 3.2.1 and Appendix I.3, and found that the training topics addressed the topics listed in NUREG-0711, Section 11.4.3.6.3. The SPV Results TR, Section 3.3, also states that simulator support personnel were specifically briefed on their roles and that the test procedures guided their interactions with test participants. The staff concludes that the applicant adequately trained the test personnel in order to prevent them from introducing bias or errors into the data through failures to follow test procedures or to interact with participants properly.
o Train test participants. The executive summary of the SPV Results TR states the following:
18-73 Two independent participant crews were selected based on having prior nuclear control room operating experience and some experience with the NuScale design. Information on the testing scenarios was not shared with the crew participants prior to performance of the testing. The crew participants were trained in basic fundamental operation of the safety systems, important to safety systems, and applicable support systems. The participants also received basic human-system interface (HSI) navigation, conduct of operations, and administrative task training. All participants had previous licensed operator experience at nuclear facilities, which allowed the training to be condensed and drew on the operators experience with nuclear power plant fundamentals and control room etiquette.
The SPV Results TR, Section 3.1.1, Crew Training, describes the training program that test participants received. The staff finds this to be a minimal amount of training when compared to the training that licensed operators complete at operating reactors. For ISV testing, NUREG-0711 states that participants should be trained to near-asymptotic performance as operators in the actual plant. This is in part to help ensure the test participants are representative of the actual users of the HSI in the actual plant. However, given that the scope of this test was limited to operating the plant during a subset of all operating conditions, whereas ISV samples a much broader range of all possible operating conditions, participants for SPV testing do not necessarily need to be trained to the same level as participants for the ISV. The training for this test should at a minimum be sufficient so the participants can understand the information provided by the HSI to diagnose plant conditions and also understand how to use the HSI. The SPV Results TR, Section 3.1.1, states that the participants were required to demonstrate a minimum level of proficiency before the SPV. Thus, the staff concludes that using participants who can rely on their previous experience as licensed operators, have received training on how to use the HSI and how the NuScale plant operates, and have demonstrated an acceptable minimum proficiency level before testing is acceptable.
o Perform pilot test. The SPV Results TR, Section 2.0, Test Design and Assumptions, states the following:
Pilot testing of the scenarios was performed by the members of the simulator design team and observers. Scenario based testing criteria was established and implemented to ensure the testing scenarios would achieve their desired evaluation goals.
Refinements to the scenarios were made to ensure the scenario guides were accurate, the simulator performed as expected, and testing methods were well defined.
Thus, the staff concludes that the applicant conducted a pilot test for the SPV scenarios and made adjustments to the scenarios as needed.
Collect, analyze, and interpret data. The SPV Results TR, Section 6.0, Data Collection, explains how the applicant collected data. Test personnel observed the test
18-74 participants during the SPV scenarios and collected data by direct observation and also by administering questionnaires to the observers and test personnel. The SPV Results TR, Appendix A, Section A.4, Observation Comments (HFE and Operations), lists the observers comments and the participants comments from Scenario 1. The SPV Results TR, Appendices B and C contain the same information for Scenarios 2 and 3.
The applicant listed HFEITS item numbers for those items requiring further resolution in accordance with the HFE issue resolution process discussed in the HFE PMP.
The audit report dated November 30, 2016 (ADAMS Accession No. ML16259A110),
states, NuScale used multiple types of data collection tools to measure human performance, workload and situation awareness (SA) during the staffing validation testing. The audit report lists the various data collection tools the NRC staff observed the NuScale staff use during the testing. Additionally, the audit report documents the staffs observations of the applicants methods for collecting data and controlling the SPV testing. For example, the audit report states that the staff observed that the applicant exercised appropriate test controls by following its testing plan and scenario guidance for interacting with participants during the scenarios. The audit report states that the staff observed that the NuScale staff exercised appropriate test controls during performance of the SPV.
Validate conclusions. The conclusion as to whether the objective of the SPV was met is determined by reviewing the results and comparing them to the predetermined acceptance criteria. The staff documents these results below, under Staffing Plan Validation Outcomes.
Because the applicant used simulator testing, the operators were able to perform their assigned roles and responsibilities and also interact together and with the HSI to accomplish the tasks in the scenarios. Before testing, the applicant verified that the simulator provided feedback to the operators that was representative of the expected plant response. The test personnel were able to observe the operators task performance and also measure workload and situation awareness. Thus, the staff concludes that the demonstration method (i.e., simulator testing) addressed the dynamic aspects of the staffing plan, and the simulator was used appropriately.
Also, because the applicant identified acceptable human performance measures and criteria and also collected data during the testing to evaluate whether those criteria were met, the staff concludes that the scope and data quality were adequate, and the data collection and analysis were conducted appropriately. Therefore, the staff concludes that the data collection methods were adequate. The staff discusses the applicants analysis and interpretation of the data below, under Staffing Plan Validation Outcomes.
Staffing Plan Validation Outcomes NUREG-1791, Section 10.3.4, Staffing Plan Validation Outcomes, states the following:
The reviewer should confirm that the following criteria have been met, as applicable:
18-75 The results of analyses demonstrate that control personnel, individually and working in crews, if applicable, can accomplish their tasks within performance criteria.
The results of analyses demonstrate that the staffing plan does not result in either excessively high or minimal workload demands on control personnel for the operational conditions considered.
The results of the analyses demonstrate that the staffing plan does not compromise control personnel situational awareness.
The staffing plan effectively addressed any identified environmental conditions or staffing practices that could potentially degrade individual or crew performance.
The SPV Results TR, Appendix A; Appendix B, Scenario 2 Results Report; and Appendix C, Scenario 3 Results Report, contain the results of the applicants SPV. Specifically, they contain conclusions as to whether task performance, situation awareness, and workload were acceptable based on the predetermined acceptance criteria. The following discusses the staffs review of the SPV results in these appendices:
Task performance was successful. Appendix A, Section A.6, Conclusions; Appendix B, Conclusion section; and Appendix C, Section C.7, Conclusion, document that all scenario tasks met established task performance criteria and were completed successfully.
The staff observed that for the SPV, the applicant used a value of time available for the two risk-important HAs that was greater than the time available for those two actions documented in DCA Part 2 Tier 2, Chapter 19. In the response to RAI 9409, Questions 18-37, 18-38, 18-39, and 18-40 (ADAMS Accession No. ML18143B532), the applicant explained that the PRA was revised after the SPV was conducted, and, as a result, the time available for these two risk-important HAs documented in the DCA Part 2 Tier 2, Chapter 19 is different than the time available that was used to evaluate the performance of these actions during the SPV. Thus, although the time available in the DCA Part 2 Tier 2, Chapter 19 was more limiting than that used for the SPV, it did not change the applicants conclusions that the SPV scenarios were completed successfully.
The staff reviewed the performance times of these two risk-important HAs documented in the SPV Results TR, Appendix A, Section A.1, and compared them to the time available in DCA Part 2 Tier 2, Chapter 19. The staff determined that the results still met the applicants criteria related to successful scenario performance for the SPV, and the change to time available did not invalidate the results of the SPV.
The staffing plan does not compromise situation awareness. The SPV Results TR, Appendix A, Section A.3, Situation Awareness Results; Appendix B, Section B.4, Situation Awareness Results; and Appendix C, Section C.4, Situation Awareness Results, summarize the results obtained for situation awareness for each of the scenarios. The staff reviewed the results and found that, in general, situation awareness
18-76 met the acceptance criteria for each scenario trial such that situation awareness was determined to be adequate. Additionally, the staff found that the applicant provided additional analysis when the majority of personnel missed situation awareness questions, which is consistent with the methodology in the SPV Methodology TR. Given these results, the staff concludes that the staffing plan does not compromise situation awareness.
The staffing plan does not result in excessive high or minimal workload demands. The SPV Results TR, Appendix A, Section A.2, TLX Results; Appendix B, Section B.3, TLX Results; and Appendix C, Section C.3, TLX Results, summarize the results obtained for workload in each of the scenarios. The applicant provided workload results for the crew as well as for individuals. The SPV Methodology TR, Section 8.0, Analyze Workload, and Appendix D.2, Instructions to Complete the Workload Worksheets, explain the method the applicant used to calculate the values of workload. The applicant calculated weighted and nonweighted workload values. The staff considers weighted TLX ratings and nonweighted TLX ratings to both be valid methods; weighting is typically not used because there is evidence that (1) there is no major difference between weighted and nonweighted TLX scores, and (2) using the nonweighted method might increase experimental validity.
The staff found that one aspect of the applicants method for calculating the weighted workload, as discussed in the SPV Methodology TR, Section 8.0, was not consistent with the method described in the NASA-TLX v. 1.0 Manual. In the response to RAI 9392, Question 18-48 (ADAMS Accession No. ML18198A521), the applicant stated that there were no significant differences between the weighted and nonweighted workload values. Therefore, the staff reviewed the weighted workload values for each scenario in the SPV Results TR, Appendices A, B, and C, to evaluate whether measured workload was acceptable.
For Scenario 1, the staff found that all measured TLX values for the total crew and each individual participant were well below the threshold for unacceptable levels of workload (i.e., values of 75-100 are considered undesirable, and levels above 100 are considered unacceptable in accordance with the BNL Tech Report, Section 4.3). ((
)). When the threshold was exceeded, the applicant further analyzed the reasons for those participants perceived relatively higher workload levels. In Appendix A,
18-77 Section A.6, Conclusion, the applicant explained that improvements to the HSI design could be implemented to help reduce workload for those cases in which relatively higher levels of workload were measured. The staff found that the applicant entered these opportunities for improvement in the HFEITS as shown in Appendix A.5, Post Job Critique Comments.
For Scenario 2, the staff found that all measured TLX values for the total crew and each individual participant were well below the threshold for unacceptable levels of workload,
((
)). When the threshold was exceeded, the applicant further analyzed the reasons for those participants perceived relatively higher workload levels. In the SPV Results TR, Appendix B, Conclusion, section, the applicant explained that improvements to the HSI design could be implemented to help reduce workload for those cases in which relatively higher levels of workload were measured. The staff found that the applicant entered these opportunities for improvement in the HFEITS as shown in Appendix B.6, Post Job Critique Comments.
For Scenario 3, the staff found that all measured TLX values for the total crew and each individual participant were well below the threshold for unacceptable levels of workload.
((
)). When the threshold was exceeded, the applicant further analyzed the reasons for those participants perceived relatively higher workload levels. In Appendix C, Section C.7, Conclusion, the applicant explained that improvements to the HSI design could be implemented to help reduce workload for those cases in which relatively higher levels of workload were
18-78 measured. The staff found that the applicant entered opportunities for improvement in the HFEITS as shown in Appendix A.5.
In general, the staff concludes that most of the participants at some point during the scenarios experienced a relatively high amount of workload. The staff would expect this to occur because the purpose of the SPV scenarios is to simulate challenging, high workload situations. Furthermore, because the SPV participants received a relatively minimal amount of training as compared to the training that will be provided to actual operators of a NuScale plant, the staff believes that the lack of familiarity with operations may have contributed to higher perceived levels of workload. Perceived workload for actual operators, who will receive much more training, may be less in the plant. In all cases, measured workload did not exceed unacceptable levels. In nearly all cases, measured workload ratings did not exceed undesirable workload levels (i.e., TLX ratings between 75 and 100); in the one scenario when it did exceed the undesirable level for one participant, and in other cases in which workload thresholds were exceeded, task performance was not affected. When workload was found to exceed the applicants thresholds for high workload, the applicant conducted additional analysis to understand the reason. The applicant also identified potential improvements to the HSI design to help reduce workload and entered them for evaluation in the HFEITS. Therefore, the staff concludes that the applicants staffing plan does not result in excessive high workload demands.
With respect to excessive minimal workload, the BNL Tech Report, Section 4.3, Identifying Approaches to Workload Analysis, states that levels of reported workload under 75 percent are acceptable provided that the operator is given sufficient work to remain reasonably busy. The staff reviewed the observer comments and the participant comments in Appendices A, B, and C of the SPV Results TR and did not find any comments related to participants experiencing too low workload. Situation awareness was found to be acceptable during the scenarios, indicating that participants were actively engaged in the scenarios such that they had sufficient awareness of plant status, and task performance was successful. Thus, for the selected SOC for the SPV, the results did not indicate the workload was too low.
The SPV cannot fully assess whether the applicants staffing plan results in excessive minimal workload demands because the SPV focuses only on the most challenging and high workload scenarios. Unlike the SPV, the ISV samples a much broader range of operating conditions, including scenarios in which it is highly likely operators could experience relatively low workload levels, and so the ISV provides an opportunity to evaluate whether there are excessive low workload levels that could significantly impact an operators ability to safely operate the plant. The V&V RSR, Section 5.8.2.1, Workload, explains that the applicant used NASA TLX to measure workload during the ISV, which is the same method that was used during the SPV. The V&V RSR, Section 5.8.2.1 states, Overall workload was shown to be very low when rated holistically over the entirety of the ISV testing. ((
)).
18-79 The staff reviewed the results of task performance and situation awareness during the ISV to assess whether the consistently measured low workload levels negatively affected task performance or situation awareness, which could have the potential to impact the safe operation of the plant. The V&V RSR, Section 2.1, General, summarizes the results of task performance during ISV, and states that ((
)). This section and the V&V RSR, Section 5.8.1.4, Notifications to Off-Site Stakeholders, include a description of the missed tasks and the applicants explanation of the reasons why the few tasks that were missed were not performed. The staff found that none of the missed tasks were related to actions that operators must perform to ensure the safe operation of the plant, and also low workload was not a contributing factor in the few instances where operators did not perform tasks as expected during the scenarios.
Additionally, the V&V RSR, Section 5.8.2, Diagnostic Measures Overview, summarizes the situation awareness results and states, Overall situational awareness was high with a 94 percent success rate. ((
)).
Given that nearly all tasks were completed by the operators during the ISV, and because low workload was not a contributing factor in the few instances where tasks were not performed, and because measured levels of situation awareness remained relatively high during the scenarios, the staff concludes that low levels of measured workload did not negatively impact the ability of the crews to perform tasks during the ISV scenarios.
Therefore, the staff concludes that workload is not excessively low such that it could impact the ability of the operators to safely operate the plant. In addition, the staff has added assurance that even with relatively low levels of workload associated with operating a NuScale plant as compared to operating reactors, other design features such as the control room alarm system provide means of informing operators when conditions are abnormal so that they can take any actions that might be necessary.
Environmental conditions were considered. The SOC consisted of events performed in the MCR. The staff reviewed the scenario descriptions in the SPV Results TR, Appendices D, E, and F, to determine whether any of the events in the SPV scenarios might result in changes to the control room environment that might lead to degraded individual or crew performance. Of these scenarios, the staff observed that the SPV Results TR, Appendix E, Section E.2, Detailed Description, included an event that the staff thought could have the potential to affect environmental conditions in the control room, which could impact human performance. In the response to RAI 9392, Question 18-49 (ADAMS Accession No. ML18198A521), the applicant explained that the control room environment would not change in that scenario because backup power systems would still be available to provide power to plant systems. Thus, the staff concludes there were no environmental conditions in the SOC for the SPV, and therefore none needed to be simulated in the SPV.
18-80 Step 11: Determine Acceptability of the Request The NUREG-1791, Section 11.1, Discussion, states that the staff is to make a final decision as to whether acceptance of the applicants proposed staffing plan will provide at least the same level of assurance that public health and safety are maintained as the current regulations require. As a result of the staffs review, the staff determined that task performance results, situation awareness results, and workload results were satisfactory, and therefore the SPV results support a proposed minimum staffing of six control room operators on shift in the control room, which was the staffing level validated by the SPV testing.
As stated in the V&V IP, Section 4.2, Test Objectives, one of the objectives of the ISV test is to validate the acceptability of shift staffing. The staff also reviewed the ISV results provided in the V&V RSR to assess whether the ISV results also provide evidence that the proposed staffing level is acceptable. As discussed under the staffs evaluation of Step 10 above, measured workload levels and situation awareness levels were determined to be acceptable during the ISV, which provide evidence from ISV testing that the proposed staffing level is acceptable.
Task performance was also acceptable in nearly all of the ISV scenarios. ((
)). This issue is discussed in the V&V RSR, Section 5.8.1.4, Notifications to Off-Site Stakeholders, and the applicants proposed resolution is identified in the V&V RSR, Table 6-2, The Following Human Engineering Discrepancies were Identified During Integrated System Validation Testing. ((
)). During an audit of the applicants V&V results (ADAMS Accession No. ML19220B675), the staff reviewed the procedures and screenshots of the indications that would have been available in the control room during this event. The staff concluded that the information available during the scenario was sufficient for the crew to be able to perform the task correctly. Because the applicants proposed staffing does provide for operators to perform the tasks tested in this scenario, and because the information necessary to complete the task was available, the staff concludes that the applicants proposed corrective actions are reasonable and appropriate, and insufficient staffing is not a related causal factor.
18-81 Therefore, the staff concludes that the ISV results also provide evidence that the proposed minimum staffing level is acceptable.
The staff also observed that for the SPV, the assumed contingent of on-shift control room operators was in the MCR simulator for the duration of the testing, with one exception. ((
)). The staff concludes that it is acceptable to not include a test participant to fill the role of this operator because, given the operators roles as defined in the applicants ConOps, it is reasonable to assume that this operator will not be available to perform primary tasks during abnormal events. However, when the staff reviewed the proposed rule in DCA Part 7, Section 6, the staff observed that the requirement for six licensed operators is an onsite requirement, and the DCA Part 2 provides separate requirements for the minimum numbers of licensed operators inside the control room (i.e., one SRO must be in the control room, and one RO must be at the controls). It is possible during any given shift that some control room staff may be on site outside of the control room, and only one RO and one SRO may be in the control room at any given time.
The response to RAI 9392, Question 18-50 (ADAMS Accession No. ML18198A521), clarifies that several ISV scenarios simulate cases in which one or two control room operators are on site outside the control room for some portion of the scenario. The operators can be recalled to the control room, and it is expected that they will be able to return to the control room within 10 minutes or less. The applicant also said that because no operator actions need to be performed during this timeframe to safely operate the plant, the applicant has not added further reduction in the staffing level to the ISV scenarios. The staff considered the applicants response and concluded that it is not necessary to simulate scenarios in which only one SRO and one RO are in the control room to verify that the plant can be safely operated at that staffing level for the following reasons:
Because at least one SRO and at least one RO must be in the control room at all times, these operators will be present at the start of any design-basis accident that occurs. As discussed in DCA Part 2, Tier 2, Chapter 15, the accident analyses do not credit operator actions to mitigate the consequences of design-basis accidents. Any actions operators would take as directed by their procedures mitigate the consequences of these events; however, performance of these actions is not required to meet the acceptance criteria for these events in DCA Part 2, Tier 2, Chapter 15.
Because at least one SRO and at least one RO must be in the control room at all times, these operators will be present at the start of any beyond-design-basis accident that occurs. As discussed in DCA Part 2, Tier 2, Chapter 19, operators are assumed to perform two actions in certain BDBEs that occur as a result of multiple failures of the plant safety systems. Operators can perform these two actions from the control room, and, as the staff observed during the SPV, one operator can perform these relatively simple actions. In the unlikely event the either of these two actions needs to be accomplished and only one RO and one SRO are in the control room to perform them, the staff concludes that there is reasonable assurance that performing these actions is well within the capabilities of one RO and one SRO.
18-82 The staff finds that simulating having one or two control room operators outside of the control room during the ISV scenarios incorporates realism into these scenarios.
Based on the results of the SPV and ISV test, the staff concludes that the applicants proposed staffing level as described in DCA Part 7, Section 6 is acceptable.
18.5.4.3 Other Review Criteria (Criteria 6.4(3)-(6))
Inputs from TA to S&Q Analyses (Criterion 6.4(3))
Criterion 6.4(3) states that the applicant should use the results of the TA as input to the S&Q analyses. It also states that personnel tasks should be assigned to staffing positions to ensure that jobs are defined, considering task characteristics, team processes, and the persons ability to maintain situation awareness. The TA RSR, Section 2.1, states the following:
Output from TA to other HFE program elements includes the following:
Tasks are arranged into specific job categories and assigned to staff positions (e.g., licensed operators, non-licensed operators). This provides input to the control room staffing plan validation operator training (Reference 6.2.3) and is analyzed in the staffing and qualifications (S&Q) HFE element.
Tasks are assigned knowledge and abilities (KA) required to perform the tasks.
These KA requirements provide the foundation for the operator training program development.
Additionally, the S&Q RSR, Section 2.1.2, states the following:
As described in the Human Factors Engineering Task Analysis RSR (Reference 6.2.4), TA results are used to determine the crew roles and responsibilities and are used as input to the initial licensed operator staffing level.
Personnel tasks, addressed in TA, are assigned to staffing positions considering:
task characteristics, such as the knowledge and abilities required, relationships among tasks, time available, and time required to perform the task; the operators ability to maintain situation awareness within the area of assigned responsibility; teamwork and team processes such as peer checking; and workload associated with each job within the crew.
The staff concludes that the applicant used the results of TA as an input to the S&Q analyses and assigned tasks to jobs considering the task characteristics, impact on the ability to maintain situation awareness, and teamwork and team processes. Accordingly, the staff finds that the application conforms to this criterion.
18-83 Staffing for the Full Range of Plant Conditions and Tasks (Criterion 6.4(4))
Criterion 6.4(4) states that the applicants staffing analysis should determine the number and qualifications of operations personnel for the full range of plant conditions and tasks (including operational tasks conducted under normal, abnormal, and emergency conditions; plant maintenance; plant surveillance; and testing) and should address how interactions with plant personnel working outside of the control room interface with the operators in the control room.
As discussed in the staffs evaluation of Criterion 6.4(2), the applicant conducted the SPV to determine the minimum number of licensed operators needed in the MCR by simulating challenging, high workload conditions and evaluating task performance, workload, and situation awareness under those conditions. The SPV simulated normal, abnormal, and emergency conditions and also included tasks related to maintenance, surveillance, and testing. The applicant also simulated interactions with plant personnel outside the control room during the SPV. The S&Q RSR, Section 2.1.1, Initial Staffing Levels, states the following:
The results of the analysis, performed using the methods described above, confirm that up to 12 NuScale power modules and the associated plant facilities may be operated safely and reliably by a minimum staffing contingent of three licensed reactor operators and three licensed senior reactor operators from a single control room during normal, abnormal, and emergency conditions.
The operations personnel are qualified as either licensed RO or licensed senior operator.
When challenging conditions are used to create high workload conditions and task performance, situation awareness, and workload results are measured and found to be acceptable, then it would seem logical to conclude that under less challenging conditions, workload levels, situation awareness and task performance will still be acceptable. However, when workload levels are too low, operators may lose some degree of situation awareness (e.g., operators may shift focus to performing other administrative tasks and may not promptly notice changes in plant status), which could impact task performance (e.g., the time to determine which actions need to be taken may increase, which could be important if any task needs to be performed within a relatively short period of time to ensure the safe operation of the plant). For the following reasons, the staff concludes there is reasonable assurance that, even when underload (i.e., low levels of workload) conditions occur, the NuScale plant can still be safely operated:
The applicants proposed staffing level includes, and the ConOps describes, an operator whose main responsibility is to monitor plant conditions. Therefore, at least one member of the control room team is continuously responsible for monitoring the status of the plant.
The applicants control room design includes an alarm system to notify operators of changes in plant conditions.
There are no actions that operators need to take to mitigate the consequences of a DBE, and the few actions that operators do need to take to mitigate the consequences of a BDBE do not need to be taken until a relatively long period of time after event initiation.
18-84 Therefore, the staff concludes that the applicants staffing analysis determined the number and qualifications of operations personnel for the full range of plant conditions and tasks.
Accordingly, the staff finds that the application conforms to this criterion.
Iteration (Criterion 6.4(5))
Criterion 6.4(5) states that the applicants staffing analysis should be iterative; that is, the initial staffing goals should be modified as information from the HFE analyses from other elements becomes available. The S&Q RSR, Section 2.1.4, Iterative Nature of Staffing Analysis, states the following:
Initial staffing level goals and staffing roles and responsibilities are evaluated and modified, as required, in an iterative fashion through NuScale design change control procedures, through the use of the human engineering discrepancy (HED) process, and as information from other HFE elements and S&Q analyses, evaluations, and tests becomes available.
HEDs are generated during human factors verification and validation (V&V) activities within the NuScale HFE program as described in the Human Factors Engineering Program Management Plan (Reference 6.2.1). Design discrepancies identified during HFE design development activities are resolved as part of the NuScale design process, whenever possible. Those HFE issues that cannot be immediately resolved or that potentially change the initial staffing goals for the MCR or potentially impact their roles and responsibilities are captured in the Human Factors Engineering Issues Tracking System (HFEITS) for evaluation and resolution during staffing plan validation (SPV) or integrated system validation (ISV), as appropriate.
Because the SPV results validated the applicants initial staffing goal, the applicant did not need to modify its initial staffing goal following the SPV. If the ISV results indicate the staffing level needs to be modified, the staff concludes that the applicant has a method of addressing any changes that need to be made to the staffing level.
Therefore, the staff concludes that the applicants staffing analysis is iterative such that the initial staffing goals will be modified as information from the HFE analyses from other elements becomes available. Accordingly, the staff finds that the application conforms to this criterion.
Staffing-Related Issues (Criterion 6.4(6))
Criterion 6.4(6) states that the applicant should address the basis for S&Q levels and lists topics to be considered. The topics are associated with the following HFE elements: OER, FRA/FA, TA, TIHA, procedure development, and training program development.
As discussed in the evaluation of Criterion 6.4(2), the applicant submitted the SPV results in the SPV Results TR as the basis for its proposed MCR operator staffing levels and qualifications.
The applicant also used the results of the OER, the FRA/FA, and the TA as the basis for the staffing level that was validated during the SPV.
The S&Q RSR, Section 3.1.4, Treatment of Important Human Actions, states the following:
18-85 The staffing plan validation conducted as part of the S&Q element includes all of the IHAs and confirmsthe assumptions that IHAs can be conducted within the time available by the minimum licensed MCR staff for all applicable plant operating modes and conditions.
Thus the staff concludes that the applicant considered the effect of the staffing level on the performance of the IHAs by including the IHAs in the SPV, which demonstrated that the crew could perform these IHAs within time constraints.
The S&Q RSR, Section 3.1.5, Procedure Development, states the following:
S&Q analyses use task sequencing from TA as preliminary procedures and assume specific personnel numbers, and a certain level of secondary tasks such as communication. S&Q analyses also consider when task sequencing suggests the concurrent use of multiple procedures. Computer-based procedures are utilized during scenario-based testing of operator and crew performance tests, workload analysis, and situation awareness assessment.
S&Q related HEDs identified during procedure development are entered into the HED database. Procedure development related HEDs that affect human factors V&V scenarios (Reference 6.2.7) are resolved prior to ISV. Other procedure development related HEDs may be resolved prior to completion of the design implementation HFE element (see Reference 6.2.8).
During the SPV, which is discussed under the staffs evaluation of Criterion 6.4(2), the applicant included a scenario that required the crew to use multiple procedures concurrently. The results of the scenario indicated that the staffing level was sufficient to meet demands resulting from the concurrent use of multiple procedures. Thus, the staff concludes that the applicant considered demands resulting from requirements to concurrently use procedures on the staffing level.
The S&Q RSR, Section 3.1.6, Training Program Development, states the following:
S&Q analyses provide input to the training program development related to knowledge, skills, and abilities to be attained and maintained. As S&Q analyses encompass licensed operator personnel, they provide input essential to coordinating actions between individuals inside and outside the MCR. The training program includes this set of knowledge, skills, and abilities.
S&Q related HEDs identified during training program development are entered into the HED database. Training program development related HEDs are resolved during human factors V&V (Reference 6.2.7) or design implementation (Reference 6.2.8), as applicable.
The criterion specifically addresses concerns with coordinating personnel that are identified in the development of training. The development of training programs is an operational program, which is the responsibility of the COL holder. The applicant explained that any staffing concerns identified during the development of training may be documented as an HED, and the HED can be addressed during design implementation,
18-86 which is an HFE activity performed by the COL holder. As discussed in Section 18.11.4.4.2 of this SER, the DI IP explains that all HEDs will be closed as part of design implementation activities. Thus, the applicant has identified a means by which staffing concerns may be addressed by a COL holder, and the staff concludes that the applicant considered how concerns with coordinating personnel identified during training development will be addressed.
Accordingly, the staff finds that the application conforms to this criterion.
18.5.5 Combined License Information Items Table 18.5-1 lists one COL information item related to staffing from DCA Part 2 Tier 2, Section 18.5.1, Objectives and Scope.
Table 18.5-1: NuScale COL Information Items for DCA Part 2 Tier 2, Section 18.5 Item No.
Description DCA Part 2 Tier 2 Section 18.5-1 A COL applicant that references the NuScale Power Plant design certification will address the staffing and qualifications of non-licensed operators.
18.5 The staff concludes that the applicant appropriately assigned the determination of the number of nonlicensed operators to the COL holder because the number will depend in part on the number of units constructed on site. For example, nonlicensed operators will likely have more tasks to perform at a NuScale plant that consists of 12 units than at a NuScale plant that consists of six units.
18.5.6 Conclusion The staff evaluated the applicants S&Q analysis method and finds that it conforms to the criteria in NUREG-0711, Section 6.4. Therefore, the staff concludes that the applicants S&Q analysis method provides for systematically analyzing the required number and necessary qualifications of personnel, in concert with regulatory requirements and task requirements.
Accordingly, the staff finds the application satisfies the requirements in 10 CFR 50.34(f)(2)(iii) and 10 CFR 52.47(a)(8) related to this element.
Additionally, the staff finds that the results of the applicants SPV and ISV tests provide an adequate technical basis for the proposed staffing requirements in DCA Part 7, Section 6, that a COL holder may use in lieu of the requirements in 10 CFR 50.54(m).
18-87 18.6 Treatment of Important Human Actions 18.6.1 Introduction The treatment of important human actions (TIHA) program element identifies the human actions (HAs) that are most important to safety and considers those HAs in the HFE design of the plant.
The design should minimize the likelihood of personnel error and help ensure that personnel can detect and recover from any errors that occur.
Probabilistic and deterministic analyses are used to identify important human actions (IHAs).
The PRA, which includes HRA, identifies risk-important HAs. Deterministic engineering analyses identify important HAs that are credited with the prevention or mitigation of accidents and transients.
18.6.2 Summary of Application DCA Part 2 Tier 1: Refer to Section 18.1.2 of this SER.
DCA Part 2 Tier 2: The applicant provided a description of this HFE element in DCA Part 2 Tier 2, Section 18.6, Treatment of Important Human Actions.
ITAAC: There are no ITAAC associated with this element.
TS: There are no TS associated with this element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: Refer to Section 18.1.2 of this SER.
18.6.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR 52.47(a)(8) as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts.
The SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.
Acceptance criteria for HFE design methodology are provided in NUREG-0711 (listed below).
(NUREG-0711 references NUREG-0700, Human-System Interface Design Review Guidelines, which provides detailed acceptance criteria for HFE design attributes.)
NUREG-0711, Revision 3, Human Factors Engineering Program Review Model, Chapter 7, Treatment of Important Human Actions, Section 7.4, Review Criteria.
18-88 The following documents also provide additional guidance in support of the SRP acceptance criteria to meet the above requirements:
NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors.
18.6.4 Technical Evaluation The staff used the criteria in NUREG-0711, Section 7.4, to evaluate the methodology applied to generate the results as described in the TIHA RSR. Section 7.4 includes four criteria for this topic. The fourth criterion addresses plant modifications and is not applicable to this DCA review; therefore, the staff evaluated the first three criteria as discussed below.
The staff supplemented its review with NUREG/CR-7202, which identifies relevant issues related to SMRs.
18.6.4.1 Identification of Important Human Actions (Criteria 7.4(1)-(2))
18.6.4.1.1 Staff Assessment The scope of the HFE review focuses on confirming that the HFE process includes certain actions identified in the NRC reviews under SRP Chapter 7, Instrumentation and Controls, and SRP Chapter 15, Transient and Accident Analysis, and SRP Chapter 19, Probabilistic Risk Assessment and Severe Accident Evaluation for New Reactors. Human factors reviews do not independently confirm the quality or accuracy of the reviews under SRP Chapters 7, 15, and 19.
The TIHA RSR, Section 4.2.1, Transient and Accident Analysis, indicates that the NuScale design will not credit any operator actions to mitigate anticipated operation occurrences, infrequent events, accidents, or special events associated with the DCA Part 2, Tier 2, Chapters 7 and 15 analyses. The TIHA RSR, Section 4.2.2, Diversity and Defense-in-Depth Coping Analysis, indicates that the diversity and defense-in-depth coping analysis did not identify any IHAs. Instead, automatic actions are used to place the reactor in a safe state without operator actions.
The fact that no deterministic actions are credited is a strength of the design, assuming the analyses used to justify this determination are sound. The staff finds that this treatment is consistent with NUREG-0711, Criterion 7.4(2), which indicates that the applicant should identify deterministic actions.
With regards to risk-important human actions identified in the SRP Chapter 19 review (see NUREG-0711, Criterion 7.4(1)), the staff reviewed the TIHA RSR, Section 4.1, Identification of Risk Important Human Actions from the PRA/HRA, which identifies two risk-important human actions. Section 4.1 briefly summarizes the actions and conditions needed to successfully complete each IHA. The staff confirmed that the HFE program addresses the actions included in the DCA Part 2, Tier 2, Chapter 19 submittal.
18-89 18.6.4.1.2 Conclusion The staff finds that the treatment currently described in the TIHA RSR is consistent with NUREG-0711, Criteria 7.4(1)-(2) because the applicant has identified IHAs using the appropriate inputs from the FSAR.
18.6.4.2 Treatment of Important Human Actions in the Human Factors Engineering Process (Criterion 7.4(3))
The TIHA RSR, Section 3.3, Addressing Important Human Actions in Other Human Factors Engineering Program Elements, describes the process used to ensure that IHAs are appropriately considered within other HFE program elements. The TIHA RSR, Sections 1.1, Purpose, and 1.2, Scope, include a high-level summary.
The TIHA RSR, Sections 3.3.1-3.3.8, provide additional details on individual HFE program elements, including the following:
The IHA are entered in the OER database and assessed to determine whether relevant operating experience may impact the IHA and, if so, the IHA is flagged for further analysis.
FAs are revisited to reconsider whether initial allocations are appropriate for IHAs.
Tasks involving IHA receive a detailed TA. Evaluations of the S&Q analysis consider the impact of IHAs.
Special HSI design considerations are applied to HSIs used to conduct IHA analysis.
Additional evaluations of procedures used to conduct IHA analysis are conducted, and these procedures are used during the ISV process. The COL applicant is responsible for the final procedures. The TIHA RSR, Section 3.3.6, Addressing Important Human Actions During Procedure Development, indicates that the design implementation process will be used to ensure that COL applicants include IHAs in the final procedures.
NuScale will consider IHAs when training ISV participants. This will help to ensure valid ISV results. However, the COL applicant is responsible for the final training program.
The TIHA RSR, Section 3.3.7,"Addressing Important Human Actions During Training Program Development, indicates that SRP Section 13.2.1, Reactor Operator Requalification Program; Reactor Operator Training, ensures that COL training programs include training for normal, abnormal, and emergency operating procedures.
Because these procedures include the IHAs, the training program will ultimately address all IHAs.
The ISV process uses scenarios designed to challenge operators while performing IHAs.
ISV acceptance criteria for operator performance of IHAs with respect to timing and errors are used to assess performance.
18-90 The staff reviewed the TIHA RSR and found that the processes described in the TIHA RSR, Section 3.3 and Sections 3.3.1-3.3.8, use IHAs as inputs to the various applicable human factors program elements. This treatment is consistent with the criterion.
The staff found that the applicant adequately described how the human factors program addresses risk-important human actions as described above. This treatment was found to be consistent with this criterion, and therefore, the staff finds this treatment to be acceptable.
18.6.5 Combined License Information Items No COL information items are associated with Section 18.6 of the DCA Part 2.
18.6.6 Conclusion The information described in the TIHA RSR adequately considers those important actions currently identified by the Chapter 7, 15, and 19 DCA Part 2 submittals and addresses them in the human factors program. The treatment of these IHAs have been in accordance with NUREG-0711. This treatment is consistent with the applicable criteria as described above.
Therefore, the staff finds the treatment of important human actions element sufficient to inform the HFE process. Accordingly, the staff finds the application satisfies the requirements in 10 CFR 50.34(f)(2)(iii) and 10 CFR 52.47(a)(8) related to this element.
18.7 Human-System Interface Design 18.7.1 Introduction The HSI design element represents the translation of function and task requirements into HSI design specifications. The objective of this review is to evaluate how HSI designs are identified and refined. The review verifies that the applicant has a process to translate functional and task requirements to the detailed design of alarms, displays, controls, and other aspects of the HSI through the systematic application of HFE principles and criteria.
18.7.2 Summary of Application DCA Part 2 Tier 1: Refer to Section 18.1.2 of this SER.
DCA Part 2 Tier 2: The applicant provided a description of this HFE element in DCA Part 2 Tier 2, Section 18.7, Human-System Interface Design.
ITAAC: There are no ITAAC associated with this element.
TS: There are no TS associated with this element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: Refer to Section 18.1.2 of this SER.
18-91 18.7.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR 52.47(a)(8), as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts.
10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants, General Design Criterion (GDC) 19, Control Room.
10 CFR 50.34(f)(2)(iv), with regard to the safety parameter display system (SPDS).
10 CFR 50.34(f)(2)(v), with regard to the automatic indication of the bypassed and operable status of safety systems.
10 CFR 50.34(f)(2)(xi), with regard to relief and safety valve indication.
10 CFR 50.34(f)(2)(xii), with regard to auxiliary feedwater system flow indication.
10 CFR 50.34(f)(2)(xvii), with regard to containment-related indications.
10 CFR 50.34(f)(2)(xviii), with regard to core cooling indications.
10 CFR 50.34(f)(2)(xix), with regard to instrumentation for monitoring postaccident conditions that include core damage.
10 CFR 50.34(f)(2)(xxvi), with regard to leakage control.
10 CFR 50.34(f)(2)(xxvii), with regard to radiation monitoring.
The SRP Chapter 18,Section III, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.
NUREG-0711, Revision 3, Chapter 8, Section 8.4, Review Criteria.
NUREG-0700, Revision 2.
The following documents also provide additional criteria, or guidance in support of the SRP acceptance criteria to meet the above requirements.
NUREG-1342, A Status Report Regarding Industry Implementation of Safety Parameter Display Systems, issued April 1989.
18-92 NUREG-0737, Clarification of TMI Action Plan Requirements, Supplement 1, "Clarification of TMI Action Plan RequirementsRequirements for Emergency Response Capability," issued January 1983.
NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors, issued June 2015.
RG 1.97, Criteria for Accident Monitoring Instrumentation for Nuclear Power Plants, with regard to instrumentation for light-water-cooled nuclear power plants to access plant and environmental conditions during and following an accident.
NUREG-0696, Functional Criteria for Emergency Response Facilities, with regard to functional criteria for emergency response facilities.
18.7.4 Technical Evaluation The staff reviewed the applicants HSI Design RSR and Style Guide, which discusses the following aspects of the applicants HSI design:
inputs to the HSI design process; the concept of how HSIs are used and an overview of the HSI design; the guidance used for the detailed HSI design; the detailed HSI description of the MCR, TSC, EOF, RSS, and LCSs, covering their form, function, and performance characteristics; how the design minimizes the effects of degraded I&C and HSI conditions on personnel performance; and the outcomes of tests and evaluations undertaken to support the HSI design.
Additionally, NUREG-0711 states the following:
The HSIs with which personnel interact should be designed through a structured methodology guiding designers in identifying and selecting candidate HSI approaches, defining the detailed design, and performing HSI tests and evaluations. The methodology should cover the development and use of HFE guidelines tailored to the unique aspects of the applicants design, including a style guide to define the design-specific conventions (e.g., colors, symbols) that will be used in the HSI design.
The staff has organized its technical evaluation of the applicants HSI design into the 11 subsections below that align with those in NUREG-0711, Section 8.4. Additionally, the staff relied on the guidance in NUREG/CR-7202, which identifies potential human performance issues for the staff to consider when reviewing an SMR applicants HFE design process. Thus, the staff evaluated how NuScale selected and applied HFE guidelines to address potential human performance issues that are unique to the NuScale plant.
18-93 18.7.4.1 Human-System Interface Design Inputs (Criteria 8.4.1(1)-(4))
NUREG-0711, Criterion 8.4.1(1), lists analyses and inputs that the applicant should use early in the design process to identify requirements for HSI design, including operational experience, FRA, FA, TA, and S&Q analysis. Criteria 8.4.1(2)-(4) state that the applicant should identify constraints on HSI design from system requirements, regulatory requirements, and other sources, such as customer requirements, as inputs to the HSI design.
The staff reviewed the OER RSR, Section 3.0, OER Methodology, which describes the applicants process to identify and screen operational experience for applicability to the NuScale HSI design. The applicant reviewed operational experience from predecessor and related plants and systems, recognized industry HFE issues, related HSI technology, issues identified by nuclear and nonnuclear plant personal, and results from the treatment of IHAs. The applicant entered findings from this review into the OER database. Members of the HFE design team screened operating experience in the OER database for applicability to the NuScale HFE design. Designers also reviewed OER issues to identify design features to support or enhance human performance for the NuScale design. For each relevant and applicable operating experience item in the database, the HFE design team determined whether the design addresses the item. If not addressed, it became an HFE item tracked in the HFEITS database for resolution by the HFE design team. Therefore, the staff concludes that the applicant used the results of the OER as inputs into the NuScale HSI design, which is consistent with Criterion 8.4.1(1).
The staff reviewed the FRA/FA RSR, which describes how the NuScale plant system functions and safety functions were defined and analyzed to determine tasks, how tasks are performed (manual, automated, or both), and the role of the operator. Safety functions were used as inputs to the design of overview screens in the MCR. Automation criteria established during FA defined the levels of automation for the HSI design. Therefore, the staff concludes that the results of the FRA/FA were used as inputs into the NuScale HSI design, which is consistent with Criterion 8.4.1(1).
The staff reviewed the HFE TA RSR, which describes how TA results establish HSI inventory requirements, including alarms, controls, displays, procedures, and training programs, to support the accomplishment of tasks across a range of plant operating conditions. TA generates the HSI inventory and its characteristics, such as alarm conditions, indication range and resolution, control function modes and accuracy. Detailed results from TA are used during HSI design to establish alarm logic, display and control designs, procedure step acceptance criteria, and a grouping of HSI inventory. HSI inventory grouping leads to HSIs designed for specific tasks. Task support requirements that were defined during TA are either implemented during HSI design or tracked as an issue for resolution by other engineering processes.
The IHAs determined during the TIHA were analyzed to determine whether HSI characteristics such as reduced screen navigation time and the development of dedicated HSI displays and alarms for the IHA should be implemented during HSI design. Therefore, the staff concludes that the results of the TA and IHA analyses were used as inputs in the NuScale HSI design, which is consistent with Criterion 8.4.1(1).
18-94 DCA Part 2 Tier 2, Section 18.7.2.4.1, General Considerations (of HSI Design), explains how S&Q activities were used as an input to the early stages of HSI design. For example, the initial number of video display units and their location in the MCR layout and the hierarchy of individual HSI screens for each workstation were based on job analysis, frequency and sequence of use, and operator roles defined during S&Q analysis. The S&Q RSR, Section 4.5, describes the HSI testing performed during the SPV, and the S&Q RSR, Section 5.0, Analysis Conclusions, describes the results of this HSI testing. Following the SPV, NuScale started recording HEDs, and the HSI used for the SPV established the baseline HSI for HED documentation. The HFE PMP describes the HED process. HEDs related to the HSI design are sent to the HFE design team for resolution and may result in changes to the NuScale HSI design. Therefore, the staff concludes that the results of S&Q analyses were used as inputs in the NuScale HSI design, which is consistent with Criterion 8.4.1(1).
The HSI Design RSR, Section 3.3, Human-System Interface Design Overview, states that the HFE team presents findings and solicits input from the I&C and computer systems design disciplines in order to consider whether the HFE design concepts are technically feasible, with a special emphasis on performance requirements. The HSI Design RSR, Section 4.1.2.1, states that there are no known I&C system constraints related to the MCR layout or HSI design for monitoring and controlling multiple units. Therefore, the staff concludes that the applicant considered I&C system constraints as an input to the HSI design, which is consistent with Criterion 8.4.1(2).
In DCA Part 2 Tier 2, Section 18.7.2.1.3, Regulatory and Other Requirements, the applicant stated that the NuScale HSI design incorporates the regulatory requirements and guidance that is listed in the applicable elements of NUREG-0711 and NUREG-0700.
The staff found that the applicants list of regulatory requirements matches the list of regulatory requirements in SRP Chapter 18,Section II.A.7, Human-System Interface, and concluded that the applicant has identified the applicable regulatory requirements as inputs to the HSI design process, which is consistent with Criterion 8.4.1(3). The staff evaluates how the applicant addressed each applicable regulatory requirement in Section 18.7.4.5 of this SER.
The applicant identified other requirements, such as inputs from vendor-supplied LCSs and COL-generated procedures, as inputs to the HSI design, which the staff concludes is consistent with Criterion 8.4.1(4).
Accordingly, the staff finds that the application conforms to NUREG-0711, Criteria 8.4.1(1)-(4).
18.7.4.2 Concept of Use and Human-System Interface Design Overview (Criteria 8.4.2(1)-(2))
The ConOps describes the roles and responsibilities of operations personnel based on an anticipated control room staff level of six licensed operators and provides an overview of how control room personnel will work with the HSI resources. Section 18.5 of this SER gives a detailed assessment of the control room staffing.
The staff reviewed the ConOps, Sections 2.2.1 and 2.3, and found that these sections contained a detailed description of the roles and responsibilities of the six control room operators. The
18-95 staff reviewed the ConOps, Section 3.2, Workstations, Displays, and Working Positions, and found that the applicant provided a detailed description of the HSI resources available in the MCR, which includes the sitdown operator workstations, standup unit workstations, a standup common systems panel, and safety display and indication system panels. The applicant also described how personnel will work with these HSI resources and the type of information displayed by these resources. For example, the ConOps, Section 3.2, states that six sitdown operator workstations provide each control room operator with access to displays and controls located on the plant control system (PCS) and module control system (MCS) networks for oversight and plant control activities. Each sitdown workstation includes four video display units, a keyboard, and a mouse. The displays are navigable and contain the alarms, controls, indications, and procedures necessary to monitor and manage any unit chosen by the operator during normal, abnormal, emergency, shutdown, and refueling operations.
The MCR operators interface with other licensed and nonlicensed members of the plant organization for a variety of activities, including maintenance and technical support. According to the ConOps, Section 2.3.2, Operations Crew Interaction, the MCR is also equipped with communication systems to allow for the coordination of plant activities with personnel outside the MCR. For example, communications between the MCR and locations outside the MCR are normally by secure telephone or radio. Within the MCR, operators communicate with teammates to share information, confirm receipt, recommend actions, and give direction. As members of an integrated multiunit team, operators perform differing tasks, and therefore each operator has unique situational information. An operator performing tasks on a specific unit will typically respond to off-normal conditions on that unit depending on the nature of the condition.
The Control Room Supervisor will ensure the appropriate operator response based on the current resource loading. Therefore, the staff concludes that the applicant developed a detailed concept of use that addresses the topics in Criterion 8.4.2(1).
Additionally, the staff reviewed the HSI Design RSR, Section 4.3, HSI Design Overview, and its overview of the NuScale HSI design, including the following topics:
the facility layouts and technologies to support teamwork and communication within the MCR and between the MCR and the RSS, the TSC, and the EOF.
the key HSI resources, including the alarms, displays, controls, and computer-based procedures, and their functionality.
the responsibilities of the crew for interacting with automatic systems.
the HFE guidelines and standards that will be applied to the NuScale HSI design.
The staff also reviewed the HSI Design RSR, Section 2.2.2, HSI Development Responsibility, which states that the NuScale HSI design incorporates the results of the OER, literature reviews, informal tradeoff evaluations, and consideration of alternatives, tests, and evaluations, which provide the technical basis for demonstrating that the design is state-of-the-art and supports personnel performance. The NuScale simulator was a major part of the applicants iterative HSI design process. MCR interfaces were built incrementally into the simulator software. Thus, the simulator became the emergent design and was available for rapid prototype testing, as explained in the HSI Design RSR, Section 3.3.4. The HSI Design RSR,
18-96 Section 3.3.3, Conceptual Sketches, states that conceptual screen sketches of displays were developed, and prototype screens were integrated with the simulator software and tested to solicit feedback from users. Additionally, the HSI design was tested during the SPV, which provided the opportunity for the applicant to collect feedback from operator users, HFE test observers, and operations test observers and make any necessary improvements to the HSI design before the final validation testing (i.e., the ISV). Therefore, the staff concludes that the applicants HSI design process is iterative, such that the applicant has evaluated alternative HSI designs using feedback from HSI users and from the results of tests and evaluations.
The staff concludes that the applicant has provided an overview of the HSI and described the technical bases. The overview describes the facility layouts, key HSI resources, technologies to support teamwork and communication, and responsibilities of the operators for interacting with automatic systems. The staff also concludes that the NuScale HSI design is an acceptable starting point for a state-of-the-art HFE design for two reasons. First, the HSI design evolved from an iterative process that incorporated operating experience from other designs as well as the results of HSI tests and evaluations. Second, the applicant developed a style guide for the NuScale HSI design based on NUREG-0700, which contains acceptable industry standards for HFE design. Section 18.7.4.3 of this SER includes a detailed review of the applicants Style Guide.
The staff also finds that the HSI evaluations that will be performed in accordance with the HSI V&V IP provide an additional opportunity to implement technology improvements. Therefore, the staff concludes that the application conforms to Criteria 8.4.2(1)-(2).
18.7.4.3 Human Factors Engineering Design Guidance for Human-System Interfaces (Criteria 8.4.3(1)-(5))
NUREG-0711, Section 8.4.3, HFE Design Guidance for HSIs, includes five criteria that the staff used to address design-specific HFE design guidance that an applicant should develop and use for HSI features, layout, and environment. NUREG-0711 refers to this type of design guidance as a style guide. For HSI design, the style guide should do the following:
Address the scope of HSIs and their form, function, operation, and environmental conditions that are relevant to human performance (Criterion 8.4.3(1)).
Contain guidance derived from generic HFE guidance and HSI design-related analyses and reflect the applicants decisions in addressing specific goals of the HSI design (Criterion 8.4.3(2)).
Contain precisely expressed individual guidelines and observable HSI characteristics and details for design personnel to use for the purpose of design consistency and verifiability (Criterion 8.4.3(3)).
Contain procedures, supplemented with graphical examples, figures, and tables to facilitate comprehension, for determining where and how HFE guidance will be used in the overall design process (Criterion 8.4.3(4)).
18-97 Be readily accessible and usable by designers, with references to source documents included, and be updated as the design matures (Criterion 8.4.3(5)).
The staff used these five criteria in conjunction with NUREG-0700 to review NuScales HSI Style Guide.
The staff found that the Style Guide, Section 1.0, Introduction, states that the guidance in the Style Guide is for work location and workstation design at the NuScale plant and that the scope of the standard covers all aspects of plant design. However, the guidelines listed in the Style Guide, Section 3.7, Workplace Design, are only applicable to the MCR, RSS, and LCS. In the response to RAI 9411, Question 18-45 (ADAMS Accession No. ML18164A394), the applicant explained that the Style Guide is not applicable to the design of the Emergency Response Facilities such as the TSC because those workstations are designed to comply with NUREG-0696. The staff finds this is acceptable because NUREG-0696 contains guidance for the design of emergency response facilities that may be used in lieu of NUREG-0700.
The staff finds that the Style Guide contains generic HFE guidance derived from NUREG-0700 as well as design-specific HFE standards and guidance that address the form, function, and operation of the HSI resources. The staff found that the Style Guide contained most of the HFE guidance identified in NUREG-0700. The Style Guide did not address some NUREG-0700 criteria because they did not apply to the design or the applicant addressed the criteria in other design documents.
The staff reviewed the Style Guide to determine whether it addressed the environmental conditions relevant to human performance for HSIs. The staff found that the Style Guide, Section 3.7, addressed environmental conditions for HSIs inside the MCR and at LCSs outside the MCR.
With regard to design consistency and verifiability criteria, the staff found that the Style Guide contains design-specific guidance that the applicant has designated as either an HSI requirement or an HSI guideline. The applicant defined HSI requirements as specifications that must be implemented unless the HFE design team approves a deviation. The applicant defined HSI guidelines as best practices for user interfaces; deviations from guidelines do not require approval. With each guideline or requirement, the applicant included HSI Design Criteria, which it defined as HSI characteristics for use when reviewing the acceptability of the HSI.
Volume II of the Style Guide contains a common set of system-dependent HSI requirements and guidelines for visual displays, plant notifications, CSFs and safety parameter displays, computer-based procedures, communication systems, workstation and workplace designs, hardware, and automation. The NuScale HFE design team uses the Style Guide during the cyclical development of individual display pages. As display pages mature during iterative cycles of development, the design team enters information in the Style Guide for each display page. Thus, the staff finds that the Style Guide reflects the applicants decisions in addressing specific goals of the HSI design. This process creates common user guidance documents based on the applicants HFE guidance in Volume II for the various HSIs. Volume III of the Style Guide provides HSI descriptions and display page examples for specific HSIs. Style Guide appendices address concepts or techniques that are employed on all systems, such as
18-98 display page navigation and operator notification. For example, the Style Guide, Appendix C, User Interfaces, contains specific icons for use in NuScale HSI design to ensure consistency across HSIs.
Volume III of the HSI Style Guide contains the NuScale HSI library and chapters with specific information about a system, location, or concept in a NuScale plant. Volume III of the HSI Style Guide is intended to contain an HSI library as an example of how the design criteria of Volume ll are applied to support maintaining design consistency across time.
The staff found that the Style Guide addresses the scope of HSIs and their form, function, operation, and environmental conditions that are relevant to human performance. The HSI Style Guide contains guidance derived from generic HFE guidance and HSI design-related analyses and reflects the applicants decisions in addressing specific goals of the HSI design.
As such, the applicants style guide conforms to Criteria 8.4.3(1)-(2).
Criterion 8.4.3(3) states that the guidelines in the style guide should be expressed precisely and describe easily observable characteristics. The staff reviewed the applicants Style Guide and observed that some guidelines are not expressed precisely and that some guidelines do not describe observable HSI characteristics and details. DCA Part 2 Tier 2, Section 18.7.2.3.3, HSI Style Guide, explains that as the HSI design progresses, the guidelines will become more precise and detailed and that easily observable guidance statements will be incorporated into subsequent revisions. The version of the Style Guide submitted with the application and reviewed by the staff provides a snapshot of the HSI design up to a certain point in the design.
The design will continue to evolve as the applicant finalizes the design before conducting V&V activities. The Style Guide, Section 1.1, Purpose, states that the guide is considering a living document, meaning that the applicant will update it continuously as needed because of the iterative nature of the design process. HEDs are used to document and resolve issues identified during the development of the HFE design. HEDs are tracked using the HFEITS, which is available to all HFE team members to track specific needs. The staff concludes that as the design matures, design personnel can use HEDs to document any changes that need to be incorporated in the HFE documents, including the Style Guide. As such, the staff finds that the applicant updates its Style Guide as the design matures.
As explained in the criteria from NUREG-0711 listed above, the applicant should update the Style Guide as the design matures. Thus, the staff finds it acceptable that, as the applicant continues to make design decisions, it will add detailed guidelines to the Style Guide.
However, as discussed in Section 18.10.4.2 of this SER, the applicant will perform HFE design verification to confirm that the HSIs conform to HFE guidelines. The applicant explained in DCA Part 2, Tier 2, Section 18.10.2.2.3, Human Factors Engineering Design Verification, that the Style Guide contains the acceptance criteria for design verification. When HSIs do not meet the acceptance criteria, the applicant will document an HED. Thus, the individual guidelines in the Style Guide need to be expressed precisely and need to describe easily observable HSI characteristics for design verification so that the design personnel have verifiable acceptance criteria. The staff reviewed Revision 3 of the Style Guide and confirmed that it to contains precisely written individual guidelines that were the acceptance criteria for design verification. During the June 11 - 13, 2019 V&V Audit (ADAMS Accession No. ML19220B675), the staff reviewed two HEDs that documented instances where the Style Guide did not contain aspects of the HSI and instances where features of the HSI were not in
18-99 accordance with the Style Guide. The staff did not find any impact to safety from these discrepancies. The staff finds that applicant used precise guidelines in the Style Guide as intended for verification activities and documented details to improve the precision and usability of the Style Guide for future design purposes.
The HSI Design RSR, Section 4.2.1, describes how HFE guidance is used in conjunction with the NuScale simulator software. The staff reviewed this section and found that NuScale developed proprietary software to help ensure that the HFE design guidelines in the Style Guide are applied consistently to the applicable HSIs. The HFE design team uses this software for designing MCR HSIs. Furthermore, instructions in the Style Guide are written so that designers can readily understand them, and the text is supplemented with graphical examples, figures, and tables to facilitate ease of use. Therefore, the staff concludes that the Style Guide is readily accessible and usable by designers.
The HFE PMP, Section 4.2, describes various HFE tools and techniques used to support each of the HFE elements. DCA Part 2 Tier 2, Section 18.1.3, Human Factors Engineering Process and Procedures, states that HFE activities are conducted, and design documents and control processes are retained, in accordance with NuScales quality assurance program. The staff evaluates the applicants quality assurance program in SER Chapter 17, Quality Assurance and Reliablity Assuranceand staff finds that the Style Guide is readily accessible by designers.
In summary, the staff finds that the Style Guide contains useable information about the form, function, and operation of HSIs in the NuScale plant and allows for a consistent and verifiable design. The Style Guide lists environmental conditions relevant to human performance for HSIs. The applicant derived the guidelines in the Style Guide from generic HFE guidance in NUREG-0711 and tailored them based on the applicants design decisions. The guidelines are detailed and contain information about when to use them. Graphical examples and figures supplement the text of the guidelines. The staff observed that each guideline and requirement in the applicants Style Guide includes a source reference. The Style Guide was updated as the designed matured and the version of the Style Guide used as the acceptance criteria for design verification contained precise guidelines and requirements for observable HSI characteristics.
Accordingly, the staff concludes that the applicants Style Guide conforms to Criteria 8.4.3(1),
8.4.3(2), 8.4.3(4), and 8.4.3(5).
18.7.4.4 General Human-System Interface Design and Integration (Criteria 8.4.4.1(1)-(8))
NUREG-0711, Section 8.4.4.1, General, includes eight criteria for this topic that address general attributes of the HSI design. The eighth criterion addresses plant modifications and is not applicable to the NuScale DCA; thus, the staff evaluated the first seven criteria as follows:
(1)
HSI design supports IHAs (Criterion 8.4.4.1(1))
The staff reviewed the HSI Design RSR to determine how the HSIs in the NuScale MCR minimize the probability that errors will occur and maximize the probability of error detection for IHAs. In general, the ((18-100
)). For the two IHAs that NuScale has identified, several deliberate operator actions are required at the standup unit workstation, which is clearly labeled.
Procedures have to be used when performing IHAs, which helps reduce human performance errors, and the HSI design provides valve position indication and other parameters to inform the operator that the action has been taken. Additionally, for the two IHAs, ((
)). The staff also reviewed the TA RSR, Section 3.3.5, for this criterion. The staff found that ((
)). If an LCS is required for conducting an IHA, that LCS HSI is designed using the same Style Guide as the MCR HSIs. This ensures HSI design consistency, training efficiency, clear labeling, easy accessibility, and avoidance of hazardous locations. For maximizing the probability of error detection,
((
)). Because the applicant has designed controls and displays to minimize error for the execution of IHAs and maximize opportunities for error detection, the staff finds that this criterion is met.
(2)
HSI layout based on job analysis (Criterion 8.4.4.1(2))
The staff reviewed the HSI Design RSR to determine the basis for the HSI layout and found that that the number and location of displays in the MCR, the hierarchy of the individual HSI screens for each workstation, and the arrangement of the workstations within the MCR are based on job analysis, an understanding of the frequency and sequence of use (e.g., startup, shutdown, normal operating, abnormal operating, and accident situations), and the roles defined for operators during S&Q analysis.
The HSI layout in the MCR is specifically designed to support minimum staffing during all operating plant modes. Shared system displays and unit and plant overview displays can be observed from multiple locations within the MCR. Unit workstations are spaced so that side-by-side operation at adjoining units allows sufficient elbow room.
Additionally, an operator at any sitdown workstation can access and display the HSI for all units on any of the screens at the workstation. Dedicated screens continuously display safety parameters. NuScale tested the MCR HSI layout during the SPV and used ISV to validate the MCR HSI layout. Because NuScale used several analyses to determine and then validate the HSI layout in the MCR, the staff finds that this criterion is met.
(3)
HSI design supports inspection, maintenance, and testing activities (Criterion 8.4.4.1(3))
The staff reviewed the HSI Design RSR, Section 4.6.1.3, Human-System Interface Support for Inspection, Maintenance, and Testing, to determine whether the HSI design supports inspection, maintenance, testing, and repair of both plant equipment and the HSIs. The staff also verified that HSI maintenance would not interfere with plant control activities. The NuScale Information and Records Management (IRM) system is used to 18-101 review technical documents, reports, test results, and other work documents to confirm the readiness of structures, systems, and components. Operators use the IRM system to control work and manage component tagging for out-of-service conditions. IRM information is used (directly or indirectly) to communicate status information to the HSI, which uses a shading and color scheme to alert the operators of those conditions on the system displays. This obviates the need for physical tags in the MCR. Because of the capabilities of the IRM system, the staff concludes that the operators can manage maintenance activities to prevent interference with other plant-control activities, and the HSI design supports maintenance and testing of both plant equipment and the HSIs.
Therefore, the staff concludes that this criterion is met.
(4)
HSI design supports task performance under conditions of minimal, typical, and maximum staffing (Criterion 8.4.4.1(4))
The staff reviewed the HSI Design RSR, Section 4.6.1.4, Support for Staffing Conditions, to determine how the applicants HSI design supports personnel task performance under various staffing levels.
Minimum staffing is supported through the NuScale plants passive features, modular design, and high degree of automation, which reduce the number of alarms, controls, indications, and procedures. The automation, along with the reduced task burden of managing the HSI, enhances the ability of operators to maintain situational awareness of overall plant conditions. The use of minimum staffing to operate the plant safely was confirmed through the analysis of IHAs, TA, and S&Q and preliminarily validated during the control room SPV.
The Style Guide, Section 3.7.2.1, Control Room Configuration, includes a guideline for designers to ensure coverage of controls, displays, and other equipment for all modes of operations. Maximum staffing, including augmented staff during an accident scenario, is accounted for in several aspects of the NuScale design. The ConOps, Section 3.2.5, states that the HSI layout in the MCR is specifically designed to support minimum, nominal, and enhanced staffing during all operating plant modes. A concave MCR layout provides control room personnel with a panoramic view of each of the unit overview displays and the common systems overview display. Large overview displays in the MCR allow any observer or operator in the control room to determine plant status and safety functions. The spatially dedicated, continuously visible safety display indication system (SDIS) panels provide easily accessible information about accident monitoring parameters to anyone in the MCR. The NuScale design includes provisions for a TSC in close proximity to the MCR where additional personnel can congregate to support emergency response functions. A work control center supports operations and maintenance personnel by providing a location outside of the MCR for maintenance-related tasks. Because the HSI design supports task performance for all modes of operations, the staff finds that this criterion is met.
(5)
HSI design process accounts for fatigue (Criterion 8.4.4.1(5))
The staff reviewed the HSI Design RSR, Section 4.6.1.5, Human Performance/Fatigue, to determine how the NuScale HSI is designed to enhance human performance by 18-102 reducing fatigue. Specifically, the automation of plant functions, including many routine tasks, reduces repetitive tasks required of operators. The NuScale design automates most functions to aid the operators in managing the workload for 12 units. SER Section 18.3 discusses automation in detail. HSI displays at each workstation allow the operator to monitor automation activities. In addition, navigation between individual screens at workstations is reduced because of a simplified plant design and through overview displays of plant status. Task-based displays are incorporated to reduce navigation steps during procedure use. The arrangement or hierarchy of individual HSI screens is based on job analysis, the frequency and sequence of use, and operator roles to increase the simplicity of navigation.
In addition, MCR facility attributes that are known to affect fatigue, such as lighting, ergonomics, and overall physical layout, were considered during HSI design and incorporated into the Style Guide.
With regard to the concern for decreased operator vigilance associated with a highly automated, low-workload environment, the staff concludes there is reasonable assurance that even when underload (i.e., low levels of workload) conditions occur, the NuScale plant can still be safely operated for the following reasons:
The applicants proposed staffing level includes, and the ConOps describes, an operator whose main responsibility is to monitor plant conditions. Therefore, at least one member of the control room team is continuously responsible for monitoring plant status. When a nuclear power unit is in MODE 1, 2, or 3, as defined by the unit's TS, each licensee shall have a person holding a senior operator license for the nuclear power unit in the control room at all times. In addition to this senior operator, a licensed operator or senior operator shall be present at the controls at all times. Therefore, the operator assigned to plant monitoring has an additional operator present in the control room with him or her to ensure that the operator remains attentive.
The applicants control room design includes an alarm system to notify operators of changes in plant conditions.
The operators do not need to take any actions to mitigate the consequences of a DBE, and the few actions that operators do need to take to mitigate the consequences of a BDBE do not need to be taken until a relatively long period of time after event initiation.
Because the applicant incorporated methods such as automation, task-based displays, and reduced screen navigation into its design, the staff finds that the HSI design process accounts for decrements in human performance as a result of fatigue over the duration of a shift. Therefore, this part of the criterion is met.
(6)
HSI characteristics support human performance under a full range of environmental conditions (Criterion 8.4.4.1(6))18-103 The staff reviewed the Style Guide, Section 3.7, which includes guidance for general workplace considerations, including thermal comfort, illumination, auditory environment, and facility layout. The Style Guide, Section 3.7.2, Control Room Requirements and Guidelines, identifies design-specific guidelines for the MCR and RSS that conform to the guidelines in NUREG-0700 that help to ensure that the MCR and RSS design supports human performance under the full range of environmental conditions by ensuring that adequate lighting, ventilation, and noise reduction are available during normal and credible extreme conditions such as a loss of lighting and ventilation. The Style Guide, Section 3.7.3, Local Control Stations Requirements and Guidelines, identifies design-specific guidelines for the design of LCSs that conform to the guidelines in NUREG-0700 to ensure that LCS design supports human performance under the full range of environmental conditions.
In addition, the HSI Design RSR, Section 4.6.1.6, Environmental Conditions, states that the MCR environmental conditions conform to RG 1.196, Control Room Habitability at Light-Water Nuclear Power Reactors, with regard to air quality and radiation protection. RG 1.196 contains guidance and criteria that the staff considers acceptable for the design of a control room that meets GDC 19. GDC 19 requires that a control room be provided from which actions can be taken to operate the nuclear reactor safely under normal conditions and to maintain the reactor in a safe condition under accident conditions, including a loss-of-coolant accident. GDC 19 also specifies that adequate radiation protection is to be provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of specified values. In SER Chapter 6, the staff reviews the application with regard to the satisfaction of GDC 19 for MCR habitability (radiation protection) under accident conditions.
The staff finds that the applicant considered a full range of environmental conditions, such as temperature, humidity, lighting, noise levels, and radiation, during HSI design and thus meets this criterion.
(7)
The applicant has a change process for HSIs in the operating plant (Criterion 8.4.4.1(7))
The staff reviewed DCA Part 2, Tier 2, Section 18.7.2.4.1, and found that HSI modifications in the operating plant are a COL responsibility to be addressed by the COL holders design change control processes, which are governed by requirements included in the DC rule.
With regard to temporary HSI changes such as setpoints, the staff reviewed the HSI Design RSR and found that the applicant described how the design allows for operators to make temporary changes to the HSI, such as modifying setpoints. Additionally, within the primary system process control HSI feature, operators can also modify recommended actions for dilution, boration, and letdown actions within limits. Thus, the staff finds that the applicant has identified a method for temporary HSI changes in an operating plant and thus meets this criterion.
The staff reviewed the HSI Design RSR and found that the design allows for MCR operators to create displays that will allow them to monitor specific parameters as18-104 needed through NuScale HSIs. Thus, the staff finds that the applicant meets this criterion for temporary displays that allow monitoring of a specific situation.
18.7.4.5 Main Control Room Design (Includes Three Mile Island Requirements)
The staff reviewed the HSI Design RSR and the DCA Part 2 to determine how the MCR HSI design meets the 15 criteria outlined in NUREG-0711, Section 8.4.4.2, Main Control Room, which includes the requirements in 10 CFR 50.34(f)(2) related to lessons learned from the accident at the Three Mile Island (TMI) reactors. The staff did not evaluate NUREG-0711, Criteria 8.4.4.2(8)-(9), because they are applicable to boiling-water reactors only, and the NuScale design is a pressurized-water reactor.
(1) 10 CFR 50.34(f)(2)(iv)Safety Parameter Display System (SPDS)
Criterion 8.4.4.2(1) contains guidance the staff uses to determine whether a design complies with the SPDS requirements. The criterion states that applicants should describe the SPDS, addressing the identification of critical safety functions (CSFs), the parameters plant personnel will use to monitor each CSF, and how the SPDS conforms to HFE guidelines. The staff reviewed the HSI Design RSR, Section 4.6.2, Main Control Room; DCA Part 2, Tier 2, Chapter 7, Instrumentation and Controls; and the Style Guide to verify that the design complies with SPDS requirements.
Identification of CSFs The safety display and indication system (SDIS) (i.e., the NuScale equivalent of the SPDS) includes a spatially dedicated, continuously visible display panel for each unit in the MCR. The applicant identified three CSFs for the NuScale designcontainment integrity, reactivity control, and core heat removalthat can be monitored for each unit on the SDIS consoles. These CSFs differ from the CSFs defined for other pressurized-water reactor designs. The NRC staff used guidance in Institute of Electrical and Electronics Engineers (IEEE) 497 2002, IEEE Standard Criteria for Accident Monitoring Instrumentation for Nuclear Power Generating Stations, which RG 1.97, Criteria for Accident Monitoring Instrumentation for Nuclear Power Plants, Revision 4, issued June 2006, endorses, and compared the NuScale CSFs the previously approved emergency response guidelines (ERGs) developed by the Pressurized-Water Reactor Owners Group.
The staff evaluated the acceptability of excluding critical safety functions that previously approved PWR ERGs include such as secondary heat sink, RCS integrity, RCS inventory, and radioactive effluent control. DCA Part 2 Tier 2, Section 7.1.1.2.2, Post-Accident Monitoring, states that the containment integrity CSF includes aspects of the radioactive effluent control function, and the core heat removal CSF includes aspects of the RCS integrity function. In response to RAI 9435, Question 13.05.02.01-21 (ADAMS Accession No. ML18176A256), the applicant explained how the NuScale staff determined the CSFs and provided additional information about the CSFs. The NuScale design does not include a separate function for RCS inventory control because it is considered an integral part of the reactor core cooling safety function. ((18-105
)). RCS integrity and radioactive effluent control are addressed as plant safety functions, but they were not identified as safety functions in the PRA. For the NuScale design, unlike large light water PWR designs, a loss of secondary heat sink by itself does not result in core damage. The loss of secondary heat sink is mitigated passively by reactor safety valves and eventually the ECCS. The applicant did not include RCS integrity as a stand-alone CSF because this function is monitored by the core heat removal safety function. The primary actuation that mitigates a loss of RCS integrity is the ECCS. When the ECCS actuation valves open, a natural circulation path is created, allowing heat to be removed by the containment vessel to the ultimate heat sink. In the NuScale design, the emergency core cooling system (ECCS) provides passive core cooling by retaining primary coolant inside the containment vessel, which facilitates the transfer of heat from the fuel to the ultimate heat sink. The staff finds that NuScale adequately defined and provided the methodology for determining design-specific CSFs.
The HSI Design RSR, Section 4.6.2, states that the NuScale PRA, safety analysis, and plant operations groups used guidance in NUREG-1342 to identify these CSFs for the NuScale design. Additionally, the applicants response to RAI 9435, Question 13.05.02.01-21, explains how NuScale desired a minimum set of CSFs in order to simply the diagnostic activities required of the control room operators during potentially complex, confusing conditions. The HFE FRA/FA RSR documents the incorporation of the PRA results into the HFE design.
The staffs evaluation verified the following goals:
The group of CSFs should be a straightforward diagnostic tool for the operator.
CSFs should account for passive safety systems. CSFs should not rely on automation or alternating or direct current power.
The HAs credited by the NuScale plant PRA should align with the CSFs that the HAs are designed to protect.
The staff finds that the applicant considered the unique characteristics of the plants design in conjunction with guidance in NUREG-1342 and identified CSFs applicable to the NuScale design. Additionally, the staff finds that the three NuScale CSFs are consistent with industry guidance and the purpose of CSFs from previously approved ERGs.
Identification of Parameters to Monitor Each CSF Institute for Electrical and Electronics Engineers (IEEE) Standard (Std.) 497-2002, IEEE Standard Criteria for Accident Monitoring Instrumentation for Nuclear Power Generating Stations, which is endorsed by RG 1.97, Revision 4, issued June 2006, defines Type B variables as those variables that provide primary information to the control room operators to assess the CSFs. IEEE Std. 497-2002 also describes a method for identifying Type B variables. In DCA Part 2 Tier 2, Section 7.1.1.2.2, the applicant stated that it selected the post accident monitoring (PAM) variables, including the Type B 18-106 variables, using the guidance provided in IEEE Std. 497-2002 as modified by RG 1.97, Revision 4.
The staff evaluates the applicants selection of the PAM variables in Section 7 of this SER.
DCA Part 2, Tier 2, Section 7.1.1.2.2, lists the Type B variables that the applicant has identified for the purpose of monitoring the CSFs. The Type B PAM variables displayed on the SDIS are also displayed on the MCS or PCS. DCA Part 2 Tier 2, Section 7.0.4.4, Safety Display Indication System, explains that the module protection system (MPS) and plant protection system (PPS) provide the SDIS data to operators in the MCR. Data from the MPS and PPS are displayed on dedicated monitors, with one monitor per division. Both SDIS divisional displays show both divisions of MPS and PPS data. The spatially dedicated, continuously visible SDIS panels indicate the CSF status and PAM variables for each unit. DCA Part 2 Tier 2, Section 7.2.12, Displays and Monitoring, states that each SDIS display panel presents data derived from both divisions of the MPS or PPS. Each unit has two separate SDIS displays, for a total of 24, allowing for two independent displays of the same parameters for each unit. There are also two redundant displays for common plant parameters. This gives MCR operators the ability to cross check data from independent divisions, sensors, and displays while increasing the amount of information and reducing ambiguity. During the July-August 2018 ISV audit (ADAMS Accession No. ML18298A189), the staff observed the applicants validation of safety function monitoring using the SDIS and found that the displays provide appropriate parameters for monitoring the CSFs. Accordingly, the staff concludes the applicant identified parameters to monitor the CSFs.
Evaluation of SPDS HSIs The staff also uses the guidance in NUREG-0700, Section 5, Safety Function and Parameter Monitoring System, to verify that the applicants SDIS system HSI conforms to acceptable HFE practices. The staff reviewed the applicants HFE guidelines for the SDIS system in the Style Guide, Section 3.3.2, "Requirements and Guidelines," and found that it contained the applicable guidance for SPDS in NUREG-0700, Section 5.
The staff found that the applicants Style Guide conforms to the applicable guidance from NUREG-0700, Section 5. Accordingly, the staff finds that the application conforms to this criterion.
Because the applicant described how the SDIS conforms to the HFE guidelines for the SPDS in NUREG-0700, the staff finds that the applicants SDIS conforms to acceptable HFE practices.
(2) 10 CFR 50.34(f)(2)(v)bypassed and inoperable status indication (BISI)
The staff reviewed the HSI Design RSR, Section 4.6.2.2, Bypassed and Inoperable Status Indication, to identify how the applicants HSI assures the automatic indication of the bypassed and operable status of safety systems, which is an indication required by 10 CFR 50.34(f)(2)(v). NUREG-0711, Criterion 8.4.4.2(2), contains guidance the staff uses to determine whether the applicant complied with the BISI requirements, including 18-107 the location of indications, administrative procedures for bypassing, confirmation that a bypassed safety function is properly returned to service, annunciation capabilities, decision points for reactor shutdown, and information about the operability of the bypass system. Because the NuScale design includes a common control room for up to 12 NuScale power modules (NPM) with HSI for both unit systems and common plant systems visible or accessible to all operators in the MCR, the staff finds that the applicant has complied with the NUREG-0711 guidance for the control room of all affected units to receive an indication of the bypass for their shared system safety functions.
The HSI Design RSR, Section 4.6.2.2, states that the HSI continuously monitors the operability and position status of components that support the plant safety-related functions and updates this information on the appropriate safety system display pages and at the spatially dedicated, continuously visible locations in the MCR. A designated color and symbol are used to distinctly display safety functions in the bypassed or inoperable condition, thereby allowing operators to recognize when a function is not meeting minimum operability requirements. This information is available to operators in the MCR on three displays, one of which is continuously visible. ((
)).
((
)).
These indications in conjunction with the appropriate technical specifications are how personnel can determine whether it is permissible to continue operating the reactor.
DCA Part 2, Tier 2, Section 7.2.13.4, Indication of Bypasses, describes how the HSI provides automatic indication of bypassed or deliberately rendered inoperable safety systems. Equipment status information is automatically sent from the MPS to the MCS and SDIS. The MCS provides continuous indication of MPS actions that are bypassed or deliberately rendered inoperable.
DCA Part 2, Tier 2, Section 7.2.13.4, states that NuScale evaluated BISI functions as part of the MPS failure modes and effects analysis. DCA Part 2 Tier 2, Section 7.2.13.5, Annunciator Systems, states that an independent monitoring system monitors the status of the MCS and PCS to detect and alert the operator to a loss of the overall I&C system. The Style Guide, Section 3.1.2.2.8, Indication of Proper System Operation, contains an HSI requirement that each NuScale HSI display page contains a heart beat indication to quickly alert operators that the data on the HSI have stopped operating or updating. The Style Guide, Section 3.1.2.2.9, Indication of Information Failure, contains an HSI requirement for color coding a device white upon a loss of indication or 18-108 communications failure. Therefore, the staff concludes that the BISI includes the ability for operators to ensure it is functioning properly.
The staff finds that the BISI is on displays in the MCR and provides automatic indication of safety system status, safety subsystem status (operable and inoperable), and the deliberate bypass of a safety function and associated systems. Because MCR operators are alerted in the event of a failure of the digital computer-based I&C system, and the HSI has designated indications for the loss of indication or communications failure for a component, the staff find that the BISI alerts operators about BISI system failures and the operators can verify BISI status. Operators can use the TS in conjunction with bypass status information in the MCR to determine whether it is permissible to continue operating the reactor. Accordingly, the staff finds that NuScales BISI system meets the criteria in NUREG-0711 and the requirements for BISI in 10 CFR 50.34(f)(2)(v).
(3) 10 CFR 50.34(f)(2)(xi)relief and safety valve indication The staff reviewed the NuScale DCA Part 2 and the HSI Design RSR to determine how the applicants HSI assures the direct indication of relief and safety valve position (open or closed) in the control room, which is an indication required by 10 CFR 50.34(f)(2)(xi) and addressed in NUREG-0711, Criterion 8.4.4.2(3).
DCA Part 2 Tier 2, Section 6.3.1, Design Basis, states that valve position indication is provided in the MCR for the five ECCS valves, the trip and reset actuator valves, and the reactor safety valves (RSV). Solenoid power indication for the ECCS trip and reset valves is also provided in the MCR.
The staff reviewed the HSI Design RSR, Section 4.6.2(3), Relief and Safety Valve Position Monitoring, which describes how the HSI provides position indication of these valves in the MCR. The staff found that the applicant identified the specific control room displays that convey this information to operators and how the I&C system provides the indication to the displays. The staff reviewed the HSI Design RSR, Section 7.0, HSI Display Page Examples, which contains display page examples, and the staff observed that position indication for the ECCS valves and RSVs is available for each unit on the SDIS displays during the July-August 2018 ISV audit (ADAMS Accession No. ML18298A189). The staff concludes the applicants HSI allows for the direct indication of relief and safety valve positions in the control and thus this requirement is met.
(4) 10 CFR 50.34(f)(2)(xii)manual feedwater control NUREG-0711, Criterion 8.4.4.2(4), for the applicant to describe how the control room HSI provides automatic and manual initiation of the auxiliary feedwater system and indication of flow, does not apply because the NuScale design does not include an auxiliary feedwater system. The staff confirmed that the requirements in 10 CFR 50.34(f)(2)(xii) for automatic and manual auxiliary feedwater initiation and system flow indication in the MCR are not technically relevant to the NuScale SMR design. As stated in NuScale DCA Part 7, in which the applicant requested an exemption from the portion of 10 CFR 50.62(c)(1) requiring diverse equipment to initiate a turbine trip, under conditions indicative of an anticipated transient without scram 18-109 (ATWS), The NuScale Power Plant design does not include an auxiliary or emergency feedwater system.
(5) 10 CFR 50.34(f)(2)(xvii)containment monitoring The staff reviewed the HSI Design RSR and DCA Part 2 Tier 2, Chapter 7, for information about how the control room alarms and displays inform personnel about (A) containment pressure, (B) containment water level, (C) containment hydrogen concentration, (D) containment radiation intensity (high level), and (E) noble gas effluents for all potential accident release points. NUREG-0711, Criterion 8.4.4.2(5),
contains guidance the staff uses to verify the requirements to provide instrumentation to measure, record, and display these same parameters (A-E) in the control room.
(A) containment pressure and (B) containment water level The staff reviewed the HSI Design RSR, Section 4.6.2, and found that the applicant identified the HSIs in the MCR that provide indication of containment pressure and containment water level. In DCA Part 2 Tier 2, Section 7.2.13.5, the applicant stated that alarms alert the operators about deviations from setpoints, excessive rates of change, high or low process values, and contact changes of state from normal.
Therefore, the staff concludes that the applicant described how the HSIs provide information to the operators about containment pressure and water level.
(C) containment hydrogen concentration DCA Part 2 Tier 2, Section 7.2.13, Displays and Monitoring, states that, consistent with 10 CFR 50.34(f)(2)(xvii)(C) and 10 CFR 50.44(c)(4), the containment process sampling system includes non-safety-related oxygen and hydrogen analyzers to continuously monitor the concentrations of these elements in the containment environment during operation and beyond-design-basis conditions. The analyzers are designed to be functional, reliable, and meet the design criteria discussed in Regulatory Position C.2 of RG 1.7, Control of Combustible Gas Concentrations in Containment. The hydrogen analyzer output signal is sent to the MCS, which can provide readout in the MCR.
Additionally, local indication serves as a backup display or indication if information from the MCS cannot be displayed in the control room after an accident.
HSI Design RSR, Section 4.6.2 states that continuous monitoring of the containment hydrogen level for combustible gas control will be unavailable when the containment is isolated during an accident scenario. It further states that containment hydrogen monitoring is not necessary immediately after an event because hydrogen combustion scenarios that occur within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following event initiation have no adverse effect on containment integrity or plant safety functions. The applicant stated that its analysis of combustion events demonstrates that no compensatory measures or mitigating actions are required for any scenario within the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. For the period after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, accumulation of combustible gases can be managed by licensee implementation of severe accident management guidelines because after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, sufficient time is available to implement mitigating actions and re-establish containment gas sampling and monitoring when conditions support postaccident sampling. In DCA Part 2, Tier 2,18-110 Chapter 6, the applicant states that containment hydrogen monitoring equipment is capable of functioning following a significant beyond design-basis accident. In SER Chapter 6 Engineered Safety Features, the staff evaluates combustible gas concentrations during accidents and how NuScale meets the requirements in 10 CFR 50.44, Combustible Gas Control for Nuclear Power Reactors. As stated in SER Chapter 6, the staff finds that a combustion event in the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after an accident does not threaten containment integrity. The staff concludes that because containment integrity is not threatened, it is not necessary to monitor containment hydrogen concentration for the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an event. The staff finds that reestablishing containment hydrogen concentration monitoring in the period after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is acceptable for meeting the requirements associated with monitoring in 10 CFR 50.44(c)(4). Therefore, the staff concludes that the applicant described how the HSIs provide information to the operators about containment hydrogen concentration.
(D) containment radiation intensity (high level)
The HSI Design RSR, Section 4.6.2, states that the radiation monitor under the bioshield provides radition levels for the purpose of core damage assessment.
DCA Part 2, Tier 2, Section 12.3.4.2, Fixed Area Radiation Monitoring Instrumentation, provides information about the radiation monitors under the bioshield, which are used to detect fuel damage under accident conditions and are considered PAM system B and C variables. Two monitors are located at the top of each NuScale power module (NPM) beneath the bioshield. The radiation monitors under the bioshield are environmentally qualified to survive an accident and perform their design functions. In SER Chapter 12, the staff evaluated the radiation monitors under the bioshield and found that they meet the requirement for the applicant to provide instrumentation to monitor containment radiation. NuScale area radiation monitors provide both indication and alarm functions to the local plant area, the MCR, and, for selected areas, the waste management control room. This ensures operator and worker awareness of changing radiological conditions that could indicate system leakage or component malfunction and provides a warning to plant personnel before they enter the affected areas. Where appropriate, local visual alarms are provided outside of the monitored area to ensure worker awareness before they enter the affected area. Thus, the staff concludes that visual and audible indications of containment abnormal conditions, and thus high radioactivity, are provided to operators in the MCR.
(E) noble gas effluents for all potential accident release points The HSI Design RSR, Section 4.6.2, states that the MCR HSI displays noble gas effluents using information from radiation monitors installed at each potential effluent point. The HSI will alarm when the noble gas release rate, for each release point, exceeds the rate that would result in an emergency declaration. The capability to add additional notifications is available, for each release point, to set at a rate below the emergency declaration release rate. These additional notifications provide the operator with situational awareness cues of changing radiological conditions and that an effluent parameter is trending toward an emergency declaration. DCA Part 2 Tier 2, Section 11.5, Process and Effluent Radiation Monitoring Instrumentation and Sampling 18-111 System, states that monitoring and sampling equipment has been designed to provide monitoring and sampling instrumentation for measuring and recording noble gas radiological data at release points and that the system also provides continuous monitoring and sampling of radioactive iodine and particulates in gaseous effluents.
Therefore, the staff concludes that the applicant described how the HSIs provide information to the operators about noble gas effluents.
Thus, the staff finds that the NuScale MCR HSIs inform personnel about containment conditions and meet the requirements for containment monitoring in 10 CFR 50.34(f)(2)(xvii). The applicant described how the HSIs inform operators about containment conditions.
(6) 10 CFR 50.34(f)(2)(xviii)core cooling The staff reviewed the NuScale DCA Part 2 and the HSI Design RSR using the guidance in NUREG-0711, Criterion 8.4.4.2(6), to determine how the applicants HSI provides unambiguous indication of inadequate core cooling (ICC) in the control room, an indication required by 10 CFR 50.34(f)(2)(xviii).
In DCA Part 2 Tier 2, Section 7.2.13.6, Three Mile Island Action Items, the applicant stated that the following parameters are used to monitor ICC in the control room to satisfy the requirements of 10 CFR 50.34(f)(2)(xviii): core exit temperature, wide-range reactor coolant pressure, degrees of subcooling, wide-range reactor coolant hot temperature, reactor pressure vessel water level, and containment water level. The staff reviewed the HSI Design RSR, Section 4.6.2, and found that the applicant identified the displays in the control room that provide the operators with these indications of ICC.
Additionally, in the response to RAI 9318, Question 18-29 (ADAMS Accession No. ML18141A866), the applicant clarified that the SDIS will provide the core cooling information to MCR operators. The staff compared the list of parameters provided on the SDIS as described in DCA Part 2 Tier 2, Chapter 7, to the list of ICC variables and found that the SDIS does include the ICC variables. The staff finds that the parameters available on the SDIS that provide indications of ICC are a suitable combination of information that indicate primary coolant saturation and coolant levels in both the reactor vessel and containment vessel.
(7) 10 CFR 50.34(f)(2)(xix)post-accident monitoring (PAM)
The staff reviewed the NuScale DCA Part 2 and the HSI Design RSR using NUREG-0711, Criterion 8.4.4.2(7), to determine how the applicants HSI assures the monitoring of plant and environmental conditions following an accident including core damage as required by 10 CFR 50.34(f)(2)(xix).
The NuScale design allows for the monitoring of plant and environmental conditions following an accident through the display of PAM variables on the SDIS and through MCS and PCS interfaces.
DCA Part 2, Tier 2, Section 7.1.1.2.2, Post-Accident Monitoring, states that the NuScale design has no PAM Type A variables because no operator actions are credited 18-112 in any SRP Chapter 15 anticipated operational occurrence, infrequent event, or accident, or in the station blackout (SBO) or ATWS analyses. The staff verified that DCA Part 2 Tier 2, Chapters 15 and 7, did not credit operator actions, and therefore the staff agrees that the NuScale design has no Type A variables. In SER Section 7.2.13, Displays and Monitoring, the staff verifies that Type B, C, D, and E variables conform to the performance, design, and qualification criteria in Sections 5 through 9 of IEEE Std. 497-2002, as modified by RG 1.97, Revision 4.
In the discussion below, the staff verified that Type B, C, D, and E variables conform to the display criteria in Sections 5 through 9 of IEEE Std. 497-2002, as modified by RG 1.97, Revision 4.
Using the display criteria in IEEE-497-2002, the staff reviewed the SDIS screen shots in the HSI Design RSR, Figure 7-3, SDI Page, and the information in DCA Part 2 Tier 2, Section 7.2.13.2, System Status Indication. The display criteria in IEEE-497-2002 for the PAM variables include precision, format, units, response time, ease of use, and how PAM variables are uniquely identified. The PAM variables are displayed in the MCR on the SDIS, MCS, and PCS. Type E PAM variables are only displayed on the MCS and PCS.
The staff compared the PAM variables listed in Revision 2 of DCA Part 2 Tier 2, Chapter 7, Table 7.1-7, Summary of Type A, B, C, D and E Variables, with the SDIS sample page provided in the HSI Design RSR, Figure 7-3, and found that the SDIS displays contain the Type B, C, and D PAM variables as listed in Table 7.1-7.
Next, the staff reviewed how the Type B, C, D, and E PAM variable displays meet the display criteria in IEEE Std. 497-2002. The applicant addressed HFE design display characteristics, such as the precision, format, units, and response time of the PAM variables, through the NuScale HSI Style Guide. The staff found that the Style Guide, Section 3.3, Safety Display and Indication System, and Appendix F, Safety Display and Indication System, contains criteria for PAM variable display on the SDIS. The staff found that Type B, C and D variables are uniquely identified as accident monitoring variables because of the spatially dedicated, continuously visible SDIS displays in the MCR, which constantly display the PAM variables. Thus, the staff concludes that the applicant meets this criterion for determining how the applicants HSIs display the PAM variables.
(8) 10 CFR 50.34(f)(2)(xxvi)leakage control Regulations in 10 CFR 50.34(f)(2)(xxvi) require an applicant to provide for leakage control and detection in the design of systems outside containment that contain or might contain radioactive materials. NUREG-0711, Criterion 8.4.4.2(10), states that an applicant should describe how the HSI provides for leakage control and detection in the design of systems outside containment that contain (or might contain) accident source term radioactive materials after an accident.
Using this criterion, the staff reviewed the HSI Design RSR, Section 4.6.2, Main Control Room, which states leakage control and detection parameters for systems outside 18-113 containment are provided on display pages available at the MCR sitdown operator workstation VDUs. Parameters for leakage detection include system flows, pressures, tank levels, radiation levels, and alarms. All systems that leave containment have isolation valves to control leakage, which are operated in the MCR. There are no safety-related systems that circulate reactor coolant outside of containment. However, NuScale utilizes the containment evacuation system (CES), process sample system (PSS), and containment flood and drain (CFD) system to perform combustible gas monitoring during the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after a severe accident. Containment must be unisolated to perform combustible gas monitoring. NuScale has not analyzed potential leakage from these systems, and the design does not include the capability to re-isolate these systems after unisolating for monitoring. Therefore, the COL applicant will be required to provide information necessary to ensure that leakage control for these systems is appropriately addressed. Refer to SER Chapters 6, 9, 12, and 15 for additional information on leakage from these systems and the potential consequences related to offsite and MCR dose. The staff finds this approach acceptable because the COL applicant will follow a design implementation process that when paired with the associated HFE ITAAC, ensures the applicant will address aspects of the HFE design that were not addressed as part of the ISV prior to plant startup (see SER Section 18.11.4 for additional information on the design implementation process). Therefore, the staff finds that the applicant has described how the MCR HSI provides for leakage control for systems outside of containment that contain (or might contain) accident source term radioactive materials after an accident. The staff also finds that the applicant has described how the HSI provides for leakage detection for systems outside of containment.
(9) 10 CFR 50.34(f)(2)(xxvii)radiation monitoring Using NUREG-0711, Criterion 8.4.4.2(11), and 10 CFR 50.34(f)(2)(xxvii), which requires an applicant to provide monitoring of in-plant radiation and airborne radioactivity as appropriate for a broad range of routine and accident conditions, the staff reviewed DCA Part 2 Tier 2 and the HSI Design RSR to determine how NuScales MCR HSI provides appropriate monitoring of in-plant radiation and airborne radioactivity under a broad range of routine and accident conditions.
In DCA Part 2 Tier 2, Section 12.3.4, the applicant stated that both fixed area radiation monitors and continuous airborne radiation monitors placed in selected plant locations provide MCR indication of radiation levels and MCR alarms when predetermined thresholds are exceeded. DCA Part 2, Tier 2, Tables 12.3-10, 12.3-11, and 12.3-12, list the area radiation monitors and continuous airborne radiation monitors. The applicant stated that these radiation monitors provide plant area and airborne radiation level monitoring for a broad range of routine and accident conditions, thus conforming to 10 CFR 50.34(f)(2)(xxvii).
The HSI Design RSR, Section 4.6.2, states that radiation monitoring is a shared system for all units and that in-plant radiation and airborne radioactivity for the range of routine and accident conditions are displayed on the common systems panel VDU in the MCR.
Because MCR HSIs allow for the monitoring of in-plant radiation and airborne 18-114 radioactivity under routine and accident conditions, the staff finds that the application conforms to this NUREG-0711 criterion and complies with 10 CFR 50.34(f)(2)(xxvii).
(10) manual initiation of protective actions The staff reviewed DCA Part 2 Tier 2, Chapter 7, and the HSI Design RSR to determine how the NuScale HSI design meets NUREG-0711, Criterion 8.4.4.2(12), for supporting the manual initiation of protective actions at the system level for safety systems otherwise initiated automatically.
DCA Part 2 Tier 2, Section 7.2.12.2, Manual Control, states that the MPS conforms to RG 1.62, Manual Initiation of Protective Actions, Revision 1, issued June 2010.
Division I and Division II manual actuation switches are provided in the MCR for each of the following protective actions for the MPS:
reactor trip; ECCS actuation; decay heat removal actuation; containment isolation; demineralized water system isolation; chemical and volume control system isolation; pressurizer heater trip; secondary system isolation; and low-temperature over pressure protection.
The staff also used the guidance in RG 1.62, Revision 1, to review the HSI design of the applicants manual initiation switches. The staff found that the control interfaces for these manual initiations are located in the control room on a division-level basis. They are easily accessible to the operator so that action can be taken in an expeditious manner during plant conditions for which the protective actions of the safety systems need to be initiated. The HSI supports acknowledgement of safety function operation.
Because NuScale described how the HSI supports the manual initiation of protective actions at the system level for safety systems otherwise initiated automatically, and the HSI features for manual initiation meet the guidance in RG 1.62, the staff finds that NuScale meets this criterion.
(11) diversity and defense in depth The staff reviewed DCA Part 2 Tier 2, Chapter 7, and the HSI Design RSR to determine how the NuScale HSI provides displays and controls in the MCR for manual, system-
18-115 level actuation of CSFs and for monitoring those parameters that support them. These displays and controls should be independent of, and different from, the normal I&C. This criterion corresponds to NUREG-0711, Criterion 8.4.4.2(13), and Point 4 in SRP Branch Technical Position 7-19, Guidance for Evaluation of Diversity and Defense-in-Depth in Digital Computer-Based Instrumentation and Control Systems.
DCA Part 2, Tier 2, Section 7.2.12.2, states that MCR operators can use the safety-related enable nonsafety control switch for manual component-level control of engineered safety feature (ESF) equipment. This control is overridden by any automatic or manual safety-related signal within the actuation priority logic. DCA Part 2 Tier 2, Section 7.1.5.3, Diversity and Defense-in-Depth Assessment Regulatory Conformance, states that the SDIS provides independent and diverse display of CSFs. SER Chapter 7 documents the staffs evaluation of the independence and diversity of the display and manual controls.
The staff finds that NuScale meets this NUREG-0711 criterion because it describes how the HSI provides displays and controls in the MCR for the manual actuation of CSFs and for monitoring those parameters that support them. In addition, the displays and controls are different from the normal I&C.
(12) IHAs NUREG-0711, Criterion 8.4.4.2(14), states that the applicant should describe how the HSI provides the controls, displays, and alarms that ensure the reliable performance of identified IHAs.
The staff reviewed the TIHA RSR to understand how the applicant identified IHAs. The applicant has identified two IHAs associated with the NuScale design, listed in the TIHA RSR, Section 4.0, Summary of Results. No IHAs are required to be performed by MCR operators during normal, abnormal, and emergency operating conditions outside the MCR and RSS. The TIHA RSR, Section 4.3.5, HSI Design, and the HSI Design RSR, Sections 4.6.2 and 4.4.5.5, Alarm Definition and Criteria, describe HSI design features intended to reduce the human error probability for the IHAs. When reviewing these sections of the RSRs, the staff found that the operator actions needed to complete the two IHAs are relatively simple and require few steps. MCR displays and alarms inform the operator of the status of the plant, and the required actions and procedures direct the operators when to take these actions based on plant status.
Because the applicant has described how the HSI provides the controls, displays, and alarms to ensure the operators can perform IHAs, the staff finds that the application conforms to this criterion.
(13) computer-based procedure platform The staff reviewed the application using NUREG-0711, Criterion 8.4.4.2(15), to determine whether NuScale computer-based procedures (CBP) are consistent with the design review guidance in NUREG-0700, Section 8, Computer-Based Procedure System, and in Section 1, Computer-Based Procedures, of DI&C-ISG-5, Task 18-116 Working Group #5: Highly-Integrated Control RoomsHuman Factors Issues (HICR HF), Revision 1, dated November 3, 2008.
The staff found that the design guidance for computer-based procedures in the Style Guide is consistent with the guidance in NUREG-0700, Section 8, except that the Style Guide did not address NUREG-0700, Criteria 8.2.2-10 and 8.3.1-1. In response to RAI 9318, Question 18-33 (ADAMS Accession No. ML18141A866), the applicant explained how NuScale computer-based procedures meet NUREG-0700, Criteria 8.2.2-10 and 8.3.1-1, for procedure step placekeeping and transitions and terminations which were not directly referenced in the Style Guide. In this RAI response, the applicant also provided a detailed explanation of how the computer-based procedures meet each of the 30 general review criteria of DI&C-ISG-05, Section 1, with the exception of general review criterion 20, which is not applicable to new designs. During the July-August 2018 ISV audit, the staff sampled NuScale CBPs available in the Process Library against the HFE design guidelines and found applicable criteria met or that the applicant had sufficient justification for not meeting the guidance. For example, operators are unable to take notes in the CBPs (NUREG-0700 Criterion 8.3.3-3, Note Taking). The applicant agrees that this capability is useful but they are unable to add this capability to the CBP platform at this time. The applicant explained that operators are expected to make written notes on paper or make an electronic log entry for procedure-related issues. The staff finds that this justification is acceptable because intent of the guidance for note-taking is met through other methods of capturing the information. The staff finds that NuScale computer-based procedures conform to the applicable design guidance in the ISG and NUREG-0700, and therefore this criterion is met.
18.7.4.6 Technical Support Center Design As discussed in SER Section 18.1.4.1, the scope of the DC applicants activities includes identifying displays and alarms for the TSC. The HFE PMP, Section 2.2.3, states that HSIs in the TSC are derivatives of the MCR HSI. The HSIs in the TSC will comply with the guidance of NUREG-0696 and with the Style Guide; these HSI are for information display only.
DCA Part 2, Tier 2, Section 13.3, Emergency Planning, states that a TSC is provided in the plant design, and it conforms to NUREG-0696. SRP Chapter 18, Revision 3, states the following:
NUREG-0696, Functional Criteria for Emergency Response Facilities, also includes general HFE criteria for these facilities and the staff has accepted a commitment to implement these criteria as an alternative to the NUREG-0711 criteria. As a result, the staff used the NUREG-0696 criteria to review the NuScale DCA Part 2 for the TSC HSI design.
The staff reviewed DCA Part 2 Tier 2, Section 13.3, for the applicants description of how the HSIs in the TSC provide personnel the information needed for analyzing the plants steady-state and dynamic behavior before and during an accident, including environmental and radiological conditions, and communication capabilities for the purpose of understanding the accident sequence, deciding mitigation actions, and evaluating the extent of damage for recovery operations. Additionally, NUREG-0696, Section 2.9, Technical Data and Data System, states18-117 that at a minimum, the set of Type A, B, C, D, and E variables specified in RG 1.97 and the information displayed by the SPDS should be displayed in the TSC. As stated in DCA Part 2 Tier 2, Section 7.2.13.2, the NuScale design does not include Type A PAM variables.
NUREG-0696, Section 2.8, Instrumentation, Data System Equipment, and Power Supplies, states that the design of the TSC data system equipment shall incorporate HFE with consideration for both operating and maintenance personnel. NUREG-0696, Section 2.9, states that TSC displays shall be designed so that call-up, manipulation, and presentation of data can be performed easily. The TSC data display formats shall present information so that it can be easily understood by the TSC personnel.
DCA Part 2, Tier 2, Section 13.3, states that the TSC includes engineering workstations as described in DCA Part 2 Tier 2, Section 7.2.13.7, Other Information Systems. In the response to RAI 8925, Question 13.03-3 (ADAMS Accession No. ML17264B172), the applicant explained that the TSC engineering workstations, which are part of the MCS and PCS, will display the PAM variables in the TSC. The TSC engineering workstations have data recording, trending, and historical retention capabilities. The applicant clarified that the PAM variables that are on the MCR SDIS displays are also available on MCS and PCS displays. Type E variables are only displayed on MCS and PCS displays. Thus, the staff concludes that all Type B, C, D, and E PAM variables are available on TSC engineering workstation displays. According to DCA Part 2 Tier 2, Section 18.7.2.4.3, TSC, EOF and RSS, the HSIs in the TSC are derivatives of the MCR HSIs and comply with the HSI Style Guide.
NUREG-0711, Criteria 8.4.4.3(1), and NUREG-0696 contain criteria for reliable voice communication facilities both on and off site from the TSC. DCA Part 2, Tier 2, Section 13.3, states that the TSC is equipped with voice communications systems that provide communications between the TSC and plant, local, and offsite emergency response facilities; the NRC; and local and state operations centers.
Because HSIs in the TSC are designed using HFE design criteria contained in the applicants Style Guide, which is based on accepted HFE principles, and the TSC contains communication equipment for voice communication between the TSC and onsite and offsite locations, the staff finds that the TSC HSI design complies with the general HFE design criteria in NUREG-0696 and that the design of the TSC includes appropriate parameter displays (the PAM variables) for accident conditions.
18.7.4.7 Emergency Operations Facility Design As discussed in SER Section 18.1.4.1, the scope of the DC applicants activities includes identifying displays and alarms for the emergency operating facility. The HFE PMP, Section 2.2.3, states that the EOF HSI will comply with the guidance in NUREG-0696.
NuScale has included the EOF design as a COL item. DCA Part 2 Tier 2, Section 13.3, Emergency Planning, COL Item 13.3-2, states that a COL applicant that references the NuScale power plant DC will provide a description of an EOF for management of overall licensee emergency response, and that the facility will meet the requirements of 10 CFR 50.47(b)(8) and Section IV.E, Emergency Facilities and Equipment, of Appendix E to 10 CFR Part 50. SRP Chapter 18, Revision 3, states that NUREG-0696 includes general HFE criteria 18-118 for these facilities, and the staff has accepted a commitment to implement these criteria as an alternative to the NUREG-0711 criteria.
Thus, the application includes a commitment for the COL applicant to design the EOF in accordance with NUREG-0696. Accordingly, the staff finds that the application conforms to these NUREG-0711 criteria.
18.7.4.8 Remote Shutdown Facility Design (Criteria 8.4.4.5(1)-(2))
NUREG-0711, Section 8.4.4.5, Remote Shutdown Facility, includes two criteria for the staff to use during an HFE review of the remote shutdown facility. First, the applicant should describe how the HSI provides a design capability for remote shutdown of the reactor outside the MCR, which is required by 10 CFR Part 50, Appendix A, GDC 19 (Criterion 8.4.4.5(1)). Second, the applicant should describe how the HSIs at the remote shutdown facility are consistent with those in the MCR (Criterion 8.4.4.5(2)). The staff reviewed NuScale DCA Part 2 Tier 2, Chapter 7, and the HSI Design RSR to determine how the NuScale RSS conforms to this criterion.
GDC 19 states, in part, Equipment at appropriate locations outside the control room shall be provided: (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures. NuScale requested an exemption from GDC 19 to depart from the portion of the rule requiring equipment to be provided outside the control room with a potential capability for subsequent cold shutdown of the reactor when the control room is evacuated. NuScale established PDC 19 to require remote safe shutdown capability instead of cold shutdown. The staff evaluated this exemption request in SER Section 1.14, Index of Exemptions.
The staff reviewed DCA Part 2, Tier 2, Section 3.1.2.10, Criterion 19 - Control Room, which states that the displays, alarms, and controls in the RSS are not credited to meet the criteria of PDC 19 regarding equipment at appropriate locations outside the control room having the capability for safe shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe shutdown. DCA Part 2, Tier 2, Section 7.1.1.2.3, Remote Shutdown Station, states that operators can achieve safe shutdown of the reactors from outside the main control in the Module Protection System (MPS) equipment rooms. The staff evaluates the adequacy of these indications and controls to achieve safe shutdown in Section 7.1.1.4.1.2 of this SER.
HSI RSR Section 4.6.3, Locations Outside the Main Control Room, states that the RSS provides an alternate location to monitor the safe shutdown and status of each NPM and to operate the MCS and PCS during an MCR evacuation. The MPS cabinents provide an independent and redundant shutdown capability that is physically and electrically separate from the controls in the MCR. Reactor shutdown is also possible using the MCS in the RSS; during a main control room evacuation, operators are expected to use the MPS to trip each unit and intiate safety sytems prior to leaving the MCR. Controls at the MPS cabinents provide the remote shutdown capability and the RSS displays contain the process variables necessary to monitor the safe shutdown of each NPM. The staff finds that the application meets Criteria 8.4.4.5(1) because the applicant has described how the HSI provides shutdown and monitoring 18-119 capabilities outside the MCR equipment in the event of a MCR evacuation. During the June 2019 Verification and Validation audit (ADAMS Accession No. ML19220B675), the staff watched portions of a recorded ISV scenario that demonstrated the operators successfully performing a main control room evacuation event, using an abnormal operations procedure, and a simulated RSS.
The RSS contains a set of MCS and PCS displays identical to the MCS and PCS displays in the MCR. The RSS provides an alternate location to monitor all 12 NPMs via the MCS and PCS.
The staff finds that the applicant meets Criterion 8.4.4.5(2) because all 12 units can be monitored at the RSS and that the MCS and PCS controls and displays in the RSS are identical those in the MCR. Thus, the staff concludes that they will be consistent with the MCR HSI.
18.7.4.9 Local Control Station Design (Criteria 8.4.4.6(1)-(2))
NUREG-0711, Section 8.4.4.6, Local Control Stations, includes two criteria for the HSI design of an applicants LCSs. The applicant should describe the basis for deciding which HSIs to include in the MCR and which HSIs to provide locally (Criterion 8.4.4.6(1)). The applicant should then describe how HFE is used in the HSI design of the LCSs to ensure that the HSIs for the LCSs are consistent with those in the MCR for ease of understanding (Criterion 8.4.4.6(2)).
In the response to RAI 9402, Question 18-20 (ADAMS Accession No. ML18113A641), the applicant stated that plant operations SMEs followed the TA methodology discussed in the TA RSR to determine which HSIs to include in the MCR and which to provide locally. The staff reviewed the methodology in the TA RSR and found that an SME assigns task attributes to each task during the TA process. The TA RSR, Section 4.3.1, Task Attributes, states that these task attributes include supporting information for the task, such as personal protective equipment, tools needed, workspace, physical position, and primary operator. During the TA phase, the SMEs also determined which displays to include in an inventory of control room HSIs based on the need for operators to perform tasks in the control room. Section 18.4 of this SER includes the staffs review of the TA methodologies as described in the TA RSR. Additionally, in this response, the applicant listed the plant systems that it excluded from the MCR HSI. These systems did not receive further HFE evaluation unless a subsequent HFE phase identified a need to include them. The staff finds the applicants response provides a basis for which HSIs are included in the control room, and therefore this criteria is met.
The TIHA RSR, Section 3.3.5, states the following:
When a local control station (LCS) is required for conducting an IHA that LCS HSI is designed using the same style guide as the MCR HSIs. This ensures HSI design consistency, training efficiency, clear labeling, easy accessibility, and avoidance of hazardous locations.
Section 18.1.4.1 of this SER discusses the staffs evaluation of the applicants graded approach to applying HFE to the design of LCSs. As such, the applicants plan to design LCSs used for IHAs according to the guidelines in the Style Guide is acceptable because the guidelines will help to ensure that errors are minimized during the performance of operator actions at these LCSs. Therefore, the staff concludes that the application conforms to Criterion 8.4.4.6(1)-(2).18-120 18.7.4.10 Degraded Instrumentation and Controls and Human-System Interface Conditions (Criteria 8.4.5(1)-(4))
NUREG-0711, Section 8.4.5, Degraded I&C and HSI Conditions, includes four criteria for this topic. The staff evaluates how NuScale met each of the criteria in the sections below.
18.7.4.10.1 Automation Failures and Instrumentation and Control Degradations NUREG-0711, Criterion 8.4.5(1), states that the applicant should identify the effects of automation failures on personnel and plant performance and HFE-significant I&C degradations that might adversely affect HSIs used to accomplish IHAs.
NuScale identified the effects of degraded conditions and automation failures of the nonsafety control systems on plant performance in DCA Part 2 Tier 2, Chapter 7, Table 7.7-1, Control Groups for the NSSS Control Functions, and the control system common-cause failure analysis.
The applicant identified the effects of degraded conditions and automation failures of the safety-related systems by performing a failure modes and effects analysis documented in DCA Part 2 Tier 2, Section 7.1.1.2, Additional Design Considerations (for the MPS and neutron monitoring system).
Additionally, the applicant identified the effects on plant performance of a common-cause failure of the safety-related and non-safety-related digital I&C systems during transients, abnormal operating occurrences, and accident conditions, as described in DCA Part 2 Tier 2, Section 7.1.5, Diversity and Defense-in-Depth. The applicant also performed a hazards analysis of the NuScale I&C systems for the neutron monitoring system, MPS, PPS, and SDIS, as described in DCA Part 2 Tier 2, Section 7.1.8, Hazards Analysis. The hazard analysis included internal and external hazards. SER Chapter 7 documents the staffs evaluation of these analyses.
The V&V IP, Section 2.1, Sampling Dimensions, describes the types of operational conditions that were sampled during ISV. It shows an emphasis on I&C and HSI failures and degraded conditions due to the increased use of digital technology in the NuScale MCR. Additionally, the applicant tested all IHAs during ISV.
The staff reviewed 12 ISV scenario basis documents, used to develop the ISV scenarios, made available in the NuScale electronic reading room, during an audit from July 25, 2017, through February 14, 2018 (ADAMS Accession No. ML18135A049). The staff observed that the scenario basis documents identified the sampling dimensions associated with each event included in the scenarios, and the total SOC was commensurate with those conditions listed in Criteria 11.4.1.1(1)-(3) and includes I&C and HSI failures and degraded conditions. As part of a June 2018 audit (ADAMS Accession No. ML18208A370), the staff reviewed a sample of the finalized scenario guides and observed that they contained I&C and HSI failures and degraded conditions.
By including these types of degraded I&C conditions and automation failures in the ISV scenarios and collecting performance measurements described in the V&V IP, Section 4.5,18-121 Performance Measurement, the applicant tested the effects of HSI and automation failures on personnel performance. As reported in the V&V RSR and audited by the staff during the June 2019 V&V audit (ADAMS Accession No. ML19220B675), the applicant did not identify any Priority 1 HEDs during ISV.
Therefore, the staff finds that the applicant has identified the effects of automation failures and degraded conditions, including HFE-significant I&C degradations, on plant and personnel performance. Accordingly, the staff finds that the application conforms to this NUREG-0711 criterion.
18.7.4.10.2 Alarms and Notifications NUREG-0711, Criterion 8.4.5(2), states that the applicant should specify the alarms and information that personnel need to detect degraded I&C and HSI conditions in timely manner and to identify their extent and significance.
DCA Part 2 Tier 2, Section 7.2.15.3, Fault detection and self-diagnostics, describes the fault detection and alarming functions of the MPS, which includes an indication to operators of the impact of the failure to help determine the overall status of the system. DCA Part 2 Tier 2, Section 7.2.13.2, System Status Indication, describes the fault detection and alarming functions of the SDIS. Annunciators and alarms are used to inform operators about deviations from normal operating conditions for MPS and PPS variables.
DCA Part 2, Tier 2, Section 7.2.13.5, Annunciator Systems, states that an independent monitoring system monitors the mutual status of the MCS and PCS to detect and alert the operator to a loss of the overall I&C system. The HSI Design RSR, Section 4.7.1.1, Common Cause Software Failures, states that alarms notify MCR operators upon failure of the PCS or MCS (or both). The HSI Design RSR, Section 4.7, Degraded I&C and HSI Conditions, states that failures of automation sequences are alarmed in the MCR. These indications allow the operators to verify that the HSI at their workstations is capable of communicating information.
Because the applicant specified the alarms and information that personnel need to detect degraded I&C and HSI conditions in a timely manner, the staff finds that the application conforms to this NUREG-0711 criterion.
18.7.4.10.3 Backup Systems and Compensatory Actions NUREG-0711, Criterion 8.4.5(3), states that the applicant should determine whether backup systems are necessary to ensure that important personnel tasks can be completed under degraded I&C and HSI conditions. NUREG-0711, Criterion 8.4.5(4), states that the applicant should determine the necessary compensatory actions and supporting procedures to ensure that personnel effectively manage degraded I&C and HSI conditions and transition to backup systems.
The applicant accounted for I&C failures and degradations in the diversity and defense-in-depth coping analysis in DCA Part 2 Tier 2, Chapter 7. The staff evaluates this coping analysis in Chapter 7 of the SER. In the HSI Design RSR, Section 4.7, the applicant stated that failures of the MCR HSI VDUs are accommodated by the use of other VDUs at the same workstation, or by use of another workstation or the standup unit workstations. Failures of hardware that lead 18-122 to a loss of all VDUs at a workstation are accommodated by redundant VDUs in the RSS.
NuScale procedures govern operator response to the various I&C and HSI failure modes.
Because the applicant has determined backup systems and compensatory actions for degraded I&C and HSI conditions, the staff finds that the application conforms to this NUREG-0711 criterion.
18.7.4.11 Human-System Interface Tests and Evaluations (Criteria 8.4.6(1)-(2))
NUREG-0711, Section 8.4.6, HSI Tests and Evaluations, has two criteria:
(1)
Tradeoff evaluations are comparisons between design options, based on aspects of human performance that are important to successful task performance and to other design considerations.
(2)
Performance-based tests involve assessing personnel performance, including subjective opinions, to evaluate design options and design acceptability.
The staff reviewed the HSI Design RSR, Section 3.7.2, Testing and Evaluation of Design, and found that the applicant incorporated tradeoff evaluations and assessments of personnel performance across all stages of HSI design. In DCA Part 2 Tier 2, Section 18.7.3, Results, the applicant stated that HSI test and evaluation activities were part of the HSI design analysis and include HSI inventory and characterization, HSI task support verification, and HSI design verification. The staff reviews the applicants methodology for task support verification and design verification in Section 18.10 of this SER. NuScale performed an SPV that meets the performance-based test description in this criterion. The applicants SPV Results TR details the general approach to testing, including information about the participants, testbed, scenarios, performance measures, test procedures, data analyses, and conclusions from the SPV.
The staff finds that NuScale conducted both tradeoff evaluations and performance-based tests during iterative HSI design stages and thus meets these criteria in NUREG-0711.
18.7.4.12 NUREG/CR-7202 Topics NUREG/CR-7202 identifies potential human performance issues for the staff to consider when reviewing an SMR applicants HFE design process. The staff evaluated how NuScale selected and applied HFE guidelines to address the following potential human performance issues that are applicable to the NuScale plant:
Multiple modules are operated by one crew of six personnel in one control room. One design feature is that an operator has the ability to operate any one of the 12 modules from his or her sitdown operator console. Therefore, the HSI design should help to minimize the possibility that actions intended to be taken for one unit are taken on a different unit (i.e., wrong unit errors) (see NUREG/CR-7202, Section 2.17, HSI Design for Multi-unit Monitoring and Control). The design of the sitdown operator workstations in the NuScale MCR currently allows for operation of any module at any workstation.
The staff reviewed the ConOps, which states that the six sitdown operator workstations in the MCR provide each control room operator with access to displays and software controls located on the PCS and MCS networks for oversight and plant control activities.18-123 The HSI Design RSR, Section 4.4, HSI Concept of Use, includes details about the HSI design that support the oversight of plant operations and minimize operator errors. The staff reviewed this section and found that the MCR workstation HSI design includes consistent and clear schemes for unit labeling on display pages used for monitoring and control. Thus, the staff finds that the NuScale design satisfies this criterion.
If multiple alarms are received at once for more than one unit, the HSI should help operators identify the high-priority alarms to determine what actions, if any, must be taken (NUREG/CR-7202, Section 2.17). Using this criterion, the staff reviewed the HSI Design RSR, Section 4.4.5, Plant Notifications, and finds that the NuScale plant notification system is designed with multiple features that allow operators to identify high-priority alarms and determine how to respond. During the July-August 2018 ISV audit, the staff observed alarm prioritization and did not observe any cascading alarm conditions that impacted operator performance. Thus, the staff finds that the NuScale HSI design satisfies this criterion.
NuScale has increased the role of automation relative to U.S. operating reactors in order to keep workload within acceptable limits and therefore minimize human performance errors. The HSI should enable the operators to determine whether the automation is functioning properly (see NUREG/CR-7202, Section 2.4, High Levels of Automation for All Operations and its Implementation). Furthermore, the HSI design should allow operators to detect when automation is degraded (see NUREG/CR-7202, Section 2.11, Operational Impact of Control Systems for Shared Aspects of SMRs). The staff reviewed the HSI Design RSR to determine how HSI features allow the operators to determine proper automation and how operators are made aware of automation degradation. The HSI Design RSR, Section 4.7, states that automation failures are alarmed in the MCR. Operators are also expected to monitor most automations and subsequent plant response and detect automation failures. The staff reviewed NuScales ConOps and found that operators are expected to either directly monitor automation while performing a sequence or rely on limits incorporated with the automation. Within the automation is a feature that terminates, pauses, or alerts the operator to the condition if process parameters reach specific limits. During the July-August 2018 ISV audit, the staff observed (scripted) automation failures and found that the HSI design enables operators to determine whether the automation is functioning properly and thus this criterion is met.
Modules may be in different states of operation. The HSI design should ensure that operators can maintain awareness of each units state of operation (see NUREG/CR-7202, Section 2.9, Different Unit States of Operation). The staff reviewed the example displays in the HSI Design RSR, Section 7.0, that show information about each units operating status on a one-page display. Additionally, the individual unit overview displays constantly show information about the status of each units state of operation. The staff observed this feature during the July-August 2018 ISV audit and found obvious indication of unit status available in the main control room. Accordingly, the staff finds that the NuScale HSI design allows the operator to maintain awareness of the operating state of each unit.18-124 Unit design differences may exist over time as new units are added. The HSI should indicate the difference to the operator (see NUREG/CR-7202, Section 2.10, Unit Design Differences). At the time of this DCA, the staff finds that there are no identified unit differences; thus, this criterion is not applicable.
Certain HSIs or control stations are needed for refueling. These should be integrated into the overall control room design and concept of operations similar to other control room HSI designs (see NUREG/CR-7202, Section 2.15, Novel Refueling Methods).
Refer to SER Section 18.1.4.1.4, which discusses the HSIs for refueling.
The HSI should allow operators to detect and monitor the unplanned shutdowns or degraded conditions of one unit while monitoring multiple units (see NUREG/CR-7202, Section 2.20, Potential Impacts of Unplanned Shutdowns or Degraded Conditions of One Unit on Other Units). As observed by the staff during the audit of the SPV and the ISV audit, when there is an unplanned trip of a unit, specific shutdown-related displays appear for that unit and along with an audible alert. The staff reviewed the HSI Design RSR, Section 4.4.5.13, Safety Function Monitoring Page, and found that information that signals operators to unit specific degradations in safety functions and defense-in-depth capabilities. During the ISV audit, the staff observed that the applicants HSI design effectively provides operators information about unplanned shutdowns and degraded conditions. Thus, the staff finds that this criterion is met.
The HSI should provide operators with indications to allow them to detect and handle off-normal conditions in multiple units (see NUREG/CR-7202, Section 2.21, Handling Off-normal Conditions at Multiple Units). The staff finds that the integration of multiple NuScale HSI design features, such as the notification system, embedded procedures, and the workstation MCS and PCS displays, allows operators to detect and handle off-normal conditions in multiple units. During the SPV and ISV audits, the staff observed that operators could successfully meet specific performance criteria when faced with off-normal conditions at multiple units. Thus, the staff finds that this criterion is met.
The HSI should provide operators with indications to allow them to monitor the status and verify the success of passive systems (see NUREG/CR-7202, Section 2.24, Passive Safety Systems). The staff reviewed sample HSI displays in the HSI Design RSR to determine whether operators have indications for the status and success of passive systems. The staff found that several display pages in the MCR include status information and information about the success or failure of a safety system actuation.
Because the MCR HSI has several aspects that help operators determine the status and success of passive systems, the staff finds that this criterion is met.
18.7.5 Combined License Information Items No COL information items are associated with Section 18.7 of the NuScale DCA Part 2.
18.7.6 Conclusion The staff evaluated the applicants HSI design and finds that is conforms to the criteria in NUREG-0711, Section 8.4. Therefore, the staff concludes that the applicant has a process to 18-125 translate the functional and task requirements to HSI design requirements,, and to the detailed design of alarms, displays, controls and other aspects of the HSI. which is based on systematically applying HFE principles and and critiera. Accordingly, the staff finds the application satisfies the applicable requirements in 10 CFR 50.34(f)(2)(iii), 10 CFR 52.47(a)(8),
10 CFR Part 50, Appendix A, GDC 19, and the applicable main control room display requirements of 10 CFR 50.34(f)(2) related to this element.
18.8 Procedure Development NUREG-0711 includes procedure development because HFE attributes are associated with the procedures. However, as an operating program, the staff reviews procedure development and documents its conclusions in Chapter 13, Section 13.5, Plant Procedures, of this SER.
18.9 Training Program Development NUREG-0711 includes training program development because of the interfaces between the HFE design, procedures, and training. However, as an operating program, the staff reviews training program development and documents its conclusions in Chapter 13, Section 13.2, Training, of this SER.
18.10 Verification and Validation 18.10.1 Introduction NuScale initially submitted the V&V IP with the design certification application. The staff used the criteria in NUREG-0711, Section 11.4, Review Criteria, to evaluate the applicants V&V IP, which defines methodologies that will be used for the various activities associated with V&V during Phase 1 and Phase 2 of the review.
NuScale conducted testing associated with the V&V IP during the course of the staffs DCA review and subsequently submitted the V&V RSR which summarizes the results of the testing during Phase 4 of the staffs DCA review.
The staff review of this element considers both the V&V IP as well as the V&V RSR. In addition to reviewing the methodology described in the IP & RSR, the staff conducted a series of audits to: 1) verify the adequacy of documents used to support V&V testing (such as reviewing test scenario basis documents), 2) observe the conduct of V&V testing, and 3) verify that non-docketed results of the test are adequately represented by the V&V RSR and support the conclusions that the NuScale HSI are adequate to help operators to safely control the plant.
18.10.2 Summary of Application DCA Part 2 Tier 1: Refer to Section 18.1.2 of this SER.
DCA Part 2 Tier 2: The applicant provided a Tier 2 description of this HFE element in DCA Part 2 Tier 2, Section 18.10, Human Factors Verification and Validation (ADAMS Accession No. ML17013A289).
ITAAC: There are no ITAAC associated with this element.18-126 TS: There are no TS associated with this element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: Refer to SER Section 18.1.2.
18.10.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR 52.47(a)(8) as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts.
SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections. Acceptance criteria for HFE design methodology are provided in NUREG-0711 (listed below). (NUREG-0711 references NUREG-0700, Human-System Interface Design Review Guidelines, which provides detailed acceptance criteria for HFE design attributes.)
NUREG-0711, Revision 3, Human Factors Engineering Program Review Model, Chapter 11, Human Factors Verification and Validation, Section 11.4, Review Criteria The following documents also provide additional guidance in support of the SRP acceptance criteria to meet the above requirements:
NUREG/CR-6393, Integrated System Validation: Methodology and Review Criteria, issued 1995.
18.10.4 Technical Evaluation 18.10.4.1 Sampling of Operational Conditions 18.10.4.1.1 Sampling Dimensions (Criteria 11.4.1.1(1)-(3))
NUREG-0711, Section 11.4.1.1, Sampling Dimensions, includes three criteria. These criteria list the plant conditions, personnel tasks, and situational factors/error-forcing contexts that should be included in the sampling of operational conditions (SOC) used by the applicant to combine and identify a set of V&V scenarios to guide subsequent analyses.
The V&V IP, Section 2.1, states the following:
A range of plant conditions, personnel tasks, and situational factors is considered within the sampling dimensions included in Section 11.4.1 of Human Factors18-127 Engineering Review Model, NUREG-0711, Rev. 3 (Reference 8.1.1) as applicable to the NuScale design.
The staff reviewed all of the ISV scenario basis documents during an audit from July 25, 2017, through February 14, 2018 (ADAMS Accession No. ML18135A049). NuScale explained that these documents would be used to develop the detailed scenario guides. The staff observed that the scenario basis documents identified the sampling dimensions associated with each event included in the scenarios, and the total SOC was consistent with those conditions listed in NUREG-0711, Section 11.4.1.1. As part of an audit in June 2018 (ADAMS Accession No. ML18208A370), the staff reviewed a sample of the finalized scenario guides and observed that they conform to the criteria in NUREG-0711, Section 11.4.1.1.
18.10.4.1.2 Identification of Scenarios NUREG-0711, Section 11.4.1.2, Identification of Scenarios, includes two criteria that state that the applicant (1) should combine the results of the sampling to identify a set of V&V scenarios to guide subsequent analyses and (2) should not bias the scenarios by overly representing those in which only positive outcomes are expected, those that are relatively easy to conduct, and those that are familiar and well structured.
The V&V IP, Section 2.2, Identification of Scenarios, states that Members of the NuScale HFE Team develop the ISV scenarios using multiple sampling dimensions to accomplish the goals and set the conditions to be included in each scenario based on the SOC. The V&V IP, Section 2.2, also stated the following:
Biases for individual dimensions are possible, but collectively, the scenarios avoid bias by representing scenarios that:
Have both positive and negative outcomes.
Require varying degrees of administrative burden to run (test bed set-up, instructor input).
Minimize the use of well-known and well-structured sequences (i.e., textbook design-basis accident mitigation).
As part of an audit in June 2018 (ADAMS Accession No. ML18208A370), the staff reviewed a sample of the finalized scenario guides and observed that the scenarios conform to Criteria 11.4.1.2(1)-(2).
18.10.4.1.3 Scenario Definition (Criteria 11.4.1.3(1)-(3))
NUREG-0711, Section 11.4.1.3, Scenario Definition, includes three criteria.
The staff reviewed the V&V IP, Section 2.3, Scenario Definition, which describes the development of the applicants V&V scenarios and the information included for each scenario.
The staff compared this information to Criterion 11.4.1.3(1), which lists the information that should be specified for each V&V scenario and found the lists to be consistent. As part of an 18-128 audit in June 2018 (ADAMS Accession No. ML18208A370), the staff reviewed a sample of the finalized scenario guides and observed that the scenario guides specifically define the information in Criterion 11.4.1.3(1), with the exception of a precise definition of workplace factors and staffing levels. The applicant explained that these factors are only specified when they are other than nominal. The applicant identified the nominal workplace factors and staffing level in the ConOps. The staff finds that the application conforms to Criteria 11.4.1.3(1).
Criteria 11.4.1.3(2)-(3) state that the applicants scenarios should: (1) realistically replicate operator tasks in the tests and (2) realistically simulate the effects of potentially harsh environments on personnel performance when the applicants scenarios include work associated with operations remote from the MCR. The V&V IP, Section 2.3, states that The ISV scenarios are developed to be representative of the range of events that could be encountered during the plants operation, determined by SOC as described in Section 2.1. The V&V IP, Section 2.3, also states the following:
Tasks performed by operators remote from the MCR are modeled in the ISV scenario to realistically simulate effects on personnel performance due to potentially harsh environments. Effects such as additional time to don protective clothing, set up of radiological access control areas, and employment of damage control, emergency, or temporary equipment are described in scenarios by use of time constraints/additions.
As part of an audit in June 2018 (ADAMS Accession No. ML18208A370), the staff reviewed a sample of the finalized scenario guides and observed that they conform to Criteria 11.4.1.3(2)-
(3).
18.10.4.2 Design Verification 18.10.4.2.1 Human-System Interface Inventory and Characterization (Criteria 11.4.2.1(1)-(3))
NUREG-0711, Section 11.4.2.1, HSI Inventory and Characterization, includes three criteria for this topic.
18.10.4.2.1.1 Scope and Inventory (Criteria 11.4.2.1(1) and (3))
Criterion 11.4.2.1(1), which states that the applicant should develop an inventory of all HSIs that personnel require to complete tasks identified in its SOC, including aspects of the HSI used for managing the interface and those that control the plant. Criterion 11.4.2.1(3) states that the applicant should verify the inventory description of HSIs to ensure that it accurately reflects their current state.
The V&V IP, Section 3.1.1, Human-System Interface Inventory, describes how an inventory is generated during TA. The TA results define the inventory and characterization for alarms, controls, indications, and procedures needed to execute all operator tasks. This inventory is then compared to the HSIs needed for the tasks included in the applicants SOC, which area subset of all operator tasks. The staff finds that this scope conforms to Criterion 11.4.2.1(1).
Additionally, Appendix A to the applicants HSI Design RSR states the following: 18-129 Table A-1 shows the form used by the HFE design team to perform preliminary Inventory and Characterization testing. The purpose of this effort was to formalize a process for the testing and verification of the HSI inventory. Only the elements needed to successfully complete the SPV testing were evaluated.
The same form and process will be followed during ISV testing on every element on the page.
The V&V RSR summarizes the issues identified with the design. The staff reviewed the HEDs identified by the ISV and found that there were no priority 1 HEDs identified in which HSIs were needed for a task but were not available to operators.
Thus, the staff finds that this methodology conforms to Criterion 11.4.2.1(3).
18.10.4.2.1.2 Human-System Interface Characterization (Criterion 11.4.2.1(2))
The staff reviewed the V&V IP, Section 3.1.2, in which the applicant listed the minimum set of information provided for HSI characterization. The staff compared the list in the V&V IP, Section 3.1.2, to the list in Criterion 11.4.2.1(2) and found the lists to be consistent. In addition, the staff reviewed the HSI Design RSR, Section 7.0, HSI Design Page Examples, which contains samples of the HSI inventory and characterization. The samples are consistent with the description of the characterization in the V&V IP, Section 3.1.2. Thus, the staff finds that this methodology conforms to Criterion 11.4.2.1(2).
18.10.4.2.2 Human-System Interface Task Support Verification (Criteria 11.4.2.2(1)-(5))
NUREG-0711, Section 11.4.2.2, HSI Task Support Verification, includes five criteria for this topic. The fifth criterion addresses plant modifications and is not applicable to this DCA review; thus, the staff evaluated only the first four criteria, as discussed below.
18.10.4.2.2.1 Verification Criteria (Criterion 11.4.2.2(1))
The staff reviewed DCA Part 2 Tier 2, Section 18.10.2.2.2, Design Verification, which describes the applicants HSI task support verification criteria. The staff compared DCA Part 2 Tier 2, Section 18.10.2.2.2 to Criterion 11.4.2.2(1), which states that the HSI task support verification criteria should be based on the HSI identified by the applicants TA. DCA Part 2, Tier 2, Section 18.10.2.2.2 states that the verification criteria are based on the TA results that define the inventory and characterization for the alarms, controls, indications, procedures, automation, and task support needed to execute operator tasks, including manual tasks, automation support tasks, and automation monitoring tasks.
In May 2017, the staff audited the TA results (ADAMS Accession No. ML17181A415) and confirmed that the TA defines the HSI (e.g., alarms, controls, displays) necessary for personnel to complete their tasks. Thus, the staff concludes that the HSI task support verification criteria are based on the HSIs identified in the TA. Thus, the staff finds that this methodology conforms to Criterion 11.4.2.2(1).18-130 18.10.4.2.2.2 Methodology (Criterion 11.4.2.2(2))
Criterion 11.4.2.2(2) states that the applicant should compare the HSIs and their characteristics to the needs of personnel identified in the TA for the defined sampling of operational conditions.
The V&V IP, Section 3.2.2, HSI Task Support Evaluation Methodology, states that the HFE design team conducts task support verification using the personnel task requirements identified by the most recent TA and compares them with the HSI inventory and characterization. The staff also reviewed the applicants HSI Design Verification Test Plan during an audit from July 25, 2017, through February 14, 2018 (ADAMS Accession No. ML18135A049). The HSI Design Verification Test Plan provides detailed methodological information on the verification process and the products that result from that process, which helped the staff to understand how the comparison between the TA and HSI inventory and characterization was carried out.
The staff concluded that the methodology is acceptable because it conforms to Criterion 11.4.2.2(2).
18.10.4.2.2.3 Human Engineering Discrepancy Identification and Documentation (Criteria 11.4.2.2(3)-(4))
Criteria 11.4.2.2(3)-(4) state that an HED should be identified and documented as specified by the criteria.
In DCA Part 2 Tier 2, Section 18.10.2.2.2, the applicant stated that an HED is written when (1) an HSI is needed for completion of a task and is not identified or not available, (2) an HSI is identified as available but is not needed for any task, and (3) an HSI does not meet the established requirements for the task. In addition, the V&V IP, Section 5.0, states that HEDs are identified and documented in the HFEITS. The applicants response to RAI 9394, Question 18-16 (ADAMS Accession No. ML18123A540) supplements the DCA with detailed information on NuScales procedural guidance for tracking HFE issues, including how HEDs are categorized and the specific information captured for each issue. The staff finds this methodology to be consistent with criteria 11.4.2.2(3)-(4) for HEDs.
The staff considered the types of information documented in HFEITS during the June 2019 audit (ADAMS Accession No. ML19220B675). The staff found that the level of information available was consistent with the IP and NUREG-0711 and was sufficient to understand the scope of problem identified as well as relevant parameters that may affect human performance.
Therefore, the staff finds that the level of documentation associated with the HEDs is sufficient to meet this criterion.
18.10.4.2.3 Human Factors Engineering Design Verification (Criteria 11.4.2.3(1)-(5))
NUREG-0711, Section 11.4.2.3, HFE Design Verification, includes five criteria for this topic.
The fifth criterion addresses plant modifications and is not applicable to this NuScale DCA review; thus, the staff evaluated the first four criteria, as discussed below.18-131 18.10.4.2.3.1 Verification (Criterion 11.4.2.3(1))
Criterion 11.4.2.3(1) states that the applicant should base the criteria used for HFE design verification on HFE guidelines. The V&V IP, Section 3.3.1, Verification Criteria, states that The criteria for HFE design verification is provided by the HSI style guide. The Style Guide contains the applicants HFE guidelines and procedural guidance for determining appropriate steps when a deviation from the Style Guide is necessary. Therefore, the staff finds that the application conforms to Criterion 11.4.2.3(1).
18.10.4.2.3.2 Methodology (Criterion 11.4.2.3(2))
Criterion 11.4.2.3(2) states that the applicants HFE design verification methodology should include procedures for (1) comparing the characteristics of the HSIs with HFE guidelines for the SOC and the general environment in which HSIs are sited, (2) determining for each guideline whether the HSI is acceptable or discrepant, and (3) evaluating whether an HED is a potential indicator of additional issues.
In the V&V IP, Sections 3.3.2, Design Verification Evaluation Methodology, and 5.2, Human Engineering Discrepancy Analysis, the applicant cited the following as the means to compare the characteristics of HSIs with HFE guidelines:
checklists and guidelines for comparing the HFE design criteria (Style Guide) to HSI components (e.g., alarms, controls, indications, procedures, navigation aids).
a description of the means of comparing HFE design criteria to HSI components in the context of the various environmental conditions or locations of those HSIs (e.g., noise, lighting, ambient temperature and humidity).
Therefore, the staff concludes the applicants method includes procedures for comparing characteristics of the HSIs with the HFE guidelines for the SOC and the general environment in which HSIs are sited.
The V&V IP, Section 3.3.2, states that the HSI design verification methodology includes guidelines for determining whether the HSI is acceptable or discrepant based on the associated HFE design criteria. Specifically, HSIs that do not meet the HFE design criteria completely result in identification of a design verification HED. Therefore, the staff concludes the applicants method includes a procedure for determining whether an HSI is acceptable or not.
When an HED is generated, the V&V IP, Section 5.2, describes the procedure for assessing whether the HED is an indicator of additional issues. Specifically, the applicant will use the following methods to assess the extent of condition and causal effects across HSI design features to determine whether an HED is an indicator of additional issues:
((18-132
)).
Therefore, the staff concludes the applicants methodology includes procedures for evaluating whether an HED is a potential indicator of additional issues. The staff finds that the application conforms to Criterion 11.4.2.3(2).
18.10.4.2.3.3 Human Engineering Discrepancies (Criteria 11.4.2.3(3)-(4))
Criteria 11.4.2.3(3)-(4) state that the applicant should identify an HED when a characteristic of the HSI is discrepant from a guideline and document HEDs in terms of the HSI involved and how its characteristics depart from a particular guideline.
The V&V IP, Section 3.3.2, states that design verification HEDs are generated for HSIs that do not meet the HFE design criteria (as specified by the HSI Style Guide) completely. In addition, the V&V IP, Section 5.0, states that HEDs are identified and documented in the HFEITS.
The staff reviewed the V&V RSR to ensure that HEDs identified during design verification were documented consistently with Criteria 11.4.2.3(3)-(4). The V&V RSR only presents high-level summaries of the HEDs, therefore, the staff verified that the documentation was appropriate during the June 2019 V&V RSR audit (ADAMS Accession No. ML19220B675). The staff found the level of documentation in the HED tracking system to be consistent with these criteria.
The staff found that the plan described for tracking HEDs described in the ISV IP was consistent with NUREG-0711 and the results in the HED tracking system appeared consistent with this method, therefore, the staff finds this treatment to be acceptable.
18.10.4.3 Integrated System Validation The objective of the ISV review is to verify that the applicant validated, using performance-based tests, that the integrated system design (i.e., hardware, software, procedures and personnel elements) supports the safe operation of the plant.
18.10.4.3.1 Validation Team (Criterion 11.4.3.1(1))
NUREG-0711, Section 11.4.3.1, Validation Team, states that the applicant should describe how the team performing the validation has independence from the personnel responsible for the actual design. Criterion 11.4.3.1(1) also says the members of the validation team should have never been part of the design team. The main intent of Criterion 11.4.3.1(1) is to ensure that bias is adequately controlled during ISV data collection (e.g., via observer notes and evaluations) and during the analysis and evaluation of ISV results performed to determine whether design changes are necessary.
The response to RAI 8758, Question 18-2 (ADAMS Accession No. ML18134A353) supplements the V&V IP by providing justification for using some members of the HFE design team and provided revisions to the V&V IP to explain the controls the applicant will take to minimize bias.
The applicant stated the following:
NuScale is taking an exception to NUREG-0711, review criterion 11.4.3.1 with respect to its direction that the team be entirely independent of the HFE design 18-133 process. Understanding how the design was developed and what it is expected to accomplish brings additional diversity to the validation observation team.
Specifically, those who contributed to the design understand what was intended to be accomplished and can identify where objectives are not met. Two of the observers will be independent of the ISV test design. This alternate approach provides for more diversity within the team, a detailed knowledge of HFE design attributes and functions, a combination of practical and theoretical perspectives, and an enhanced orientation to the challenges that operators face.
The applicant provided a multifaceted strategy for controlling the potential for bias among the validation team that includes the following:
The acceptance criteria used to determine whether an HED should be categorized as a Priority 1 HED are objective. Subjective measures are intended to be used only to identify lower level issues.
Validation team members are trained and qualified to conduct the ISV in an objective manner. This training will include the specific roles of the two independent observers and their importance to mitigate team bias. Additionally, validation team members who have participated in design activities will receive training on the importance of independent observer input.
NuScale plans to preserve independent observer comments as a record for future audit or review.
The independent observers have equal participation in the observer conference session, during which notes will be categorized and assigned as HEDs with an initial prioritization.
If an independent observer does not agree with the disposition of an observation comment, the observation team members will table the comment and present it to the NuScale operations senior management for review. Because all notes will be captured and scanned, the original notes are available to compare with the final consensus for discrepancies.
An independent individual or group will review the test results and actions to resolve first-priority HEDs to ensure that actions have been properly characterized and dispositioned appropriately.
The staff finds that including team members who have knowledge of the design is reasonable given the applicants first-of-a-kind, unique design. Section 5.4, Observation Team Overview, of the V&V RSR provides a brief description of how the team maintains independence even though it leverages observers that are responsible for the design of some HSI.
The staff finds this to be an acceptable means of assuring that independent assessment of the design were provided in addition to utilizing the insights from observers who are more familiar with the design features, therefore, the staff finds this treatment to be acceptable.18-134 18.10.4.3.2 Test Objectives (Criterion 11.4.3.2(1))
NUREG-0711, Section 11.4.3.2, Test Objectives, includes two criteria for this topic. The second criterion addresses plant modifications and is not applicable to the NuScale DCA; thus, the staff evaluated the first criterion, as discussed below.
Criterion 11.4.3.2(1) states that the applicant should develop detailed test objectives to provide evidence that the integrated system adequately supports plant personnel in safely operating and includes a list of considerations. The staff compared the list in the V&V IP (Revision 5), Section 4.2, Test Objectives, to the list in Criterion 11.4.3.2(1) and found the lists to be consistent with this criterion.
18.10.4.3.3 Validation Testbeds (Criteria 11.4.3.3(1)-(9))
NUREG-0711, Section 11.4.3.3, Validation Testbeds, includes nine criteria for this topic.
18.10.4.3.3.1 Interface (Criteria 11.4.3.3(1)-(3))
Criteria 11.4.3.3(1)-(3) states that the applicants testbed should represent the complete integrated system (i.e., it should not only include those HSIs and procedures that are needed to complete the ISV scenarios), with HSIs and procedures that are represented with high physical and functional fidelity to the reference design.
The V&V IP, Section 4.3, states the applicants validation testbed for the ISV is its control room simulator. The V&V IP, Section 4.3.2, Interface Physical Fidelity, describes the testbed as a replica in form, appearance, and layout of the NuScale MCR design and includes presentation of alarms, displays, controls, procedures, automation, job aids, communications, interface management tools, layout, and spatial relationships. The V&V IP, Section 4.3.1, Interface Completeness, states the testbed also represents interfaces such as the RSS and LCSs (i.e.,
communications). Additionally, the V&V IP, Section 4.3.1 states, The test bed represents a complete and integrated system with HSI and procedures not specifically required in the test scenarios (e.g., alternate procedures).
The V&V IP, Section 4.3.3, Interface Functional Fidelity, states, High functional fidelity in the HSI, procedures, and automation is represented so that the HSI functions are available and the HSI component modes of operation, types of feedback, and dynamic response characteristics operate in the same way as the actual plant. Based on the V&V IP, Section 4.3.6, Data Content Fidelity, the staff understands that the term actual plant equates to the engineering design of the NuScale plant because a NuScale plant has not yet been built.
Therefore, the staff finds that the information provided in the V&V IP is consistent with Criteria 11.4.3.3(1)-(3).
18.10.4.3.3.2 Environmental Fidelity (Criterion 11.4.3.3(4))
Criterion 11.4.3.3(4) states that the testbeds environmental fidelity should be represented with high physical fidelity to the reference design, including the expected levels of lighting, noise, temperature, and humidity. The V&V IP, Section 4.3.4, states, The test bed is representative of the actual NuScale plant with regard to environmental features such as lighting, noise,18-135 temperature, humidity, and ventilation characteristics. In cases where the test bed cannot accurately simulate the environment, the ISV captures human factors engineering issue tracking system (HFEITS) entries for evaluation and resolution. Those environmental aspects of the design that cannot be considered during ISV are addressed specifically in the Design Implementation element of NUREG-0711. Therefore, the staff finds that the information provided in the V&V IP is consistent with Criterion 11.4.3.3(4).
The V&V RSR indicates that the simulator environment closely resembles the design of the main control room. Section 3.0, Simulator Overview describes some deviations from the design, such as two structural columns that are present in the simulator but would not be in the main control room. In some instances, these columns could potentially obscure an operators view of the displays. This makes the operators jobs more difficult, therefore, the staff considered this to be a conservative deviation, which should not create an inappropriate bias when considering the environment of the main control room. This and other environmental considerations listed in the RSR are consistent with staff observations during the V&V Audit (ADAMS Accession No. ML19220B675).
The staff finds that the applicant has identified and described differences between the ISV simulator and the main control room and that these deviations do not challenge the credibility of the ISV results. Therefore, the staff finds this treatment acceptable.
18.10.4.3.3.3 Data (Criteria 11.4.3.3(5)-(7))
Criterion 11.4.3.3(5) states that information and data provided to personnel should completely represent the plants systems they monitor and control. Criteria 11.4.3.3(6)-(7) state that the data content and data dynamics fidelity should be represented with high physical fidelity to the reference design. Specifically, the underlying model should provide input to the HSI such that the information accurately matches what is presented during operations, and the model should also be able to provide input to the HSI so that information flow and control responses occur accurately and within the correct response time (e.g., information should be sent to personnel with the same delays as occur in the plant).
The V&V IP, Section 4.3.5, Data Completeness Fidelity, states, In the test bed, information and data provided to personnel represent the complete set of plant systems monitored and controlled from that facility. Therefore, the staff finds that the information provided in the V&V IP is consistent with Criterion 11.4.3.3(5).
The V&V IP, Section 4.3.6, states that the alarms, controls, indications, procedures, and automation presented are based on an underlying plant model that accurately reflects the engineering design of the NuScale plant. In addition, it states that the model accurately provides input to the HSI, such that the information matches what is presented during operations. Therefore, the staff finds that the information provided in the V&V IP is consistent with Criterion 11.4.3.3(6).
The V&V IP, Section 4.3.7, Data Dynamics Fidelity, states that the plant model provides input to the HSI in a manner such that information flow and control responses occur accurately and in a correct response time. Information is provided to personnel with the same anticipated delays18-136 as would occur in the plant. Therefore, the staff finds that the information provided in the V&V IP is consistent with Criterion 11.4.3.3(7).
18.10.4.3.3.4 Important Human Action (Criterion 11.4.3.3(8))
Criterion 11.4.3.3(8) states that for IHAs at complex HSIs remote from the MCR, the applicant should consider the use of a simulator or mockup to verify that the requirements for human performance can be met. The V&V IP, Section 4.3.8, Remote Human-System Interfaces Containing Important Human Actions, states that none of the identified IHAs occur outside of the MCR. The applicant identified IHAs in the TIHA RSR, Section 4.1, Identification of Risk Important Human Actions. The staff confirmed these actions are performed in the MCR.
Therefore, the staff finds that Criterion 11.4.3.3(8) is not applicable.
18.10.4.3.3.5 Verification (Criterion 11.4.3.3(9))
Criterion 11.4.3.3(9) states that the applicant should verify the conformance of the testbed to the required testbed characteristics before validation tests are conducted. It also states that one approach an applicant can use to meet Criteria 11.4.3.3(1)-(7) is to use a testbed that complies with ANSI/ANS-3.5-2009, Nuclear Power Plant Simulators for Use in Operator Training (ANS 3.5).
The V&V IP, Section 4.3.9, Test Bed Conformance, states, The testbed is verified to conform with the required characteristics before validation tests are conducted. Also, the V&V IP, Section 4.3 states, The fidelity of the validation test beds models and HSI are verified to represent the current, as-designed NuScale plant prior to use for the validation.
In the response to RAI 9396, Question 18-44 (ADAMS Accession No. ML18170A157), the applicant added Section 4.3.10, ISV Simulator Performance Testing, to the V&V IP to explain that the simulator is verified to conform to the testbed criteria in NUREG-0711 by conducting the real time and repeatability testing, limits of simulation testing, normal evolution testing, malfunction testing, and steady state testing described in ANS 3.5. ANS 3.5, Section 4, Testing Requirements, refers to real time and repeatability tests, limits of simulation tests, normal evolution tests, malfunction tests, and steady state tests as performance tests, which are conducted to evaluate the fidelity of the simulator to the reference plant for a range of plant normal and abnormal events, and it contains the general methodology and acceptance criteria for these performance tests. ANS 3.5, Section 4 explains that the intent of these performance tests is to ensure that no noticeable differences exist between the simulator and the reference plant. ANS 3.5, Section 5.1.1, Utilization of Baseline Data, lists potential sources of reference plant data that may be used for comparison to simulator response during performance testing in order to evaluate simulator fidelity. When data from the actual plant is not available for comparison, which is the case for the applicant, then data generated from engineering analysis and subject matter expertise may be used.
The applicant also added Section 4.3.11, Scenario-Based Testing, to the V&V IP to explain that scenario-based testing (SBT) is also conducted prior to the ISV for all scenarios. SBT is conducted by determining a set of key plant parameters to be evaluated and ensuring those parameters behave as expected for the developed ISV scenarios. The scenarios are then conducted in real time, using the procedures available in the simulator that were developed from 18-137 the task analyses, to perform the scenario events. The applicant also included a proprietary list of items that are evaluated during SBT. The staff reviewed the list and found that the applicants SBT method is consistent with the method of SBT described in Nuclear Energy Institute 09-09, Nuclear Power Plant-Referenced Simulator Scenario Based Testing Methodology, Revision 1, dated December 8, 2009 (NEI 09-09), which the staff also endorsed in RG 1.149, Revision 4. ANS 3.5, Section 4.4.3.2, Simulator scenario-based testing, explains that the purpose of SBT is to ensure that for a given scenario, the simulator is capable of producing the expected reference unit response without significant performance discrepancies or deviation from an approved scenario sequence, and the appropriate cues and operator actions are included in the scenario.
The applicant conducted simulator performance testing which is summarized in the RSR Section 3.0, Simulator Overview, and the associated subsections. The report identifies a small number of deficiencies and describes their impact on the ISV. The deficiencies identified were expected to have little or no effect on the validity of the ISV test.
The RSR also describes the results of task support verification (see section 4.3, Human-System Interface Task Support Verfication, of the RSR) and HFE design verification (see section 4.2, Human Factors Design Verification, of the RSR) prior to ISV testing. Task support verification verified that the HSIs and procedures in the testbed satisfy the HSI design requirements identified by the applicants task analysis. Design verification verified that the HSIs, including procedures, conform to the HFE design guidelines in the applicants Style Guide. Design verification also includes verification of the environmental conditions in the control room (e.g., noise, lighting, temperature). Completing task support verification and design verification provide confidence that the simulators HSIs and procedures have physical fidelity to the HSI design that resulted from the applicants HFE design process. Table 6-1, The Following Human Engineering Discrepencies were Identified During Design Verification, of the RSR provides one-line summaires of the results during these processes. The staff reviewed a sample of these HEDs during the June 2019 audit and found that the issues were priority 2 or 3, and therefore had no impact on safety (ADAMS Accession No ML19220B675).
The applicants methods for conducting simulator performance testing and SBT are comparable to those methods the staff has previously found to be acceptable for verifying a simulator has a high degree of fidelity to its reference plant. During performance testing, the simulated plant parameters, which are provided information from the underlying plant model, are verified to respond as expected in the reference plant for those conditions. During SBT, the specific HSIs and procedures included in the ISV scenarios are used and verified to provide the expected feedback, and the simulator is verified to provide the expected plant response to operator input.
Therefore, the applicants method to verify the HSI and procedure functionality fidelity, data completeness fidelity, data content fidelity, and data dynamics fidelity of the testbed is acceptable.
Therefore, the staff concludes the applicant identified sufficient methods to verify the testbed conforms to Criteria 11.4.3.3(1)-(7), and Criterion 11.4.3.3(9) is met. The staff reviewed section 3.0 Simulator Overview, of the RSR and the associated subsections provide descriptions of the simulator as well as any deficiencies identified. The staff found that material in this section was generally consistent with the simulators commonly used by the industry.18-138 During the July-August 2018 ISV audit (ADAMS Accession No. ML18298A189), the staff reviewed the applicants procedures for conducting simulator performance testing and scenario-based testing, a sample of test results, and also observed simulator performance during ISV scenarios. The staffs observations are discussed below.
Simulator Testing Procedures: The staff reviewed the applicants procedures for conducting the simulator performance testing and SBT described in the V&V IP. The staff observed the simulator performance testing procedure referenced the draft version of ANSI/ANS-3.5 that was published in 2017. The NRC has not yet endorsed the 2017 version of the standard. The only significant difference between the performance testing portion of the recent draft and ANS 3.5 is that the draft does not prescribe abnormal events (i.e., malfunctions) that should be included in malfunction testing. Rather, it contains generic guidance for the selection of malfunctions to test that are intended to be applicable to any type of nuclear power plant design. ANS 3.5 prescribed malfunctions to ensure licensees could comply with the operator training requirements in 10 CFR Part
- 55. The applicants simulator is not being used at this time to train and examine licensed operators, and the requirements in 10 CFR Part 55 are not applicable to the applicant at this time.
The staff observed the applicants procedure for performance testing generally conformed to ANS 3.5, and the applicant identified where exceptions were taken or modifications were made. The staff observed the applicant made modifications to the guidance in ANS 3.5 in its procedure to address the fact that ANS 3.5 is written specifically for use in operator training and examination programs. The staff also observed the applicant applied the guidance for malfunction testing in the draft version of the standard. ((
)). The staff determined the applicants selected malfunction tests represented a range of abnormal plant events that included events not specifically included in the ISV scenarios.
Further, the staff found the applicant modified the criteria used to determine whether noticeable differences between the simulator and the plant needed to be corrected.
ANS 3.5, Section 4.2.1.4, Assessment of deviations, states a training needs assessment should be conducted to determine whether noticeable differences impact the actions to be taken by operators; differences that do not impact operator actions or detract from training do not need to be corrected. Because the applicant is using the simulator for ISV testing rather than training, the staff noted the applicant modified the criteria such that ((
)). The staff also reviewed the list of uncorrected simulator discrepancies and determined the applicants justifications for not correcting those discrepancies prior to ISV testing were reasonable. For example, the applicant identified that some of the controls on a particular HSI that will be available in the actual main control room are not modeled in the simulator. The staff compared the controls in the simulator to the reference plant design and concluded that the absence of these particular controls from 18-139 the HSI in the simulator was not likely to affect the decisions made by the ISV participants during testing.
The staff observed the applicants procedure for scenario-based testing generally conformed to ANS 3.5 and NEI 09-09 as discussed in the V&V IP. The staff found the applicant made a limited number of modifications to the method described in NEI 09-09 to address the fact that NEI 09-09 is written specifically for use in operator training and examination programs at nuclear power plants. For example, NEI 09-09 says scenario-based testing should be conducted by a crew of instructors certified as senior reactor operators. Because the applicant does not have, nor is it required to have, a licensed operator training program, it is not required to have instructors certified as senior reactor operators. The applicant identified personnel with ((
)) as the performers of the scenario-based testing. The staff concluded these personnel were sufficiently knowledgeable of the design and the simulator to conduct the SBT.
Test Results: The staff observed that the applicant documented the completion of performance testing and scenario-based testing prior to commencing ISV testing in accordance with their procedures. The test results showed the tests were completed satisfactorily, and in some cases, the applicant identified and documented discrepancies that were identified during testing. In these cases, the applicant provided justification for why the discrepancies did not need to be corrected prior to ISV testing. The staff observed the justifications were made consistent with the applicants procedures.
Simulator Performance during ISV Testing: The staff observed simulator performance during ISV testing for a sample of the scenarios. The applicants scenario guides described the expected plant response for each scenario event. The staff observed that the simulator demonstrated the expected plant response documented in the scenario guides. Also, the staff compared the expected plant response documented in the scenario guides to the descriptions of plant systems and the accident analyses in the DCA Part 2 for a sample of events and found that the expected plant response in the scenario guides was consistent with the plant system response or accident analysis documented in the DCA Part 2. Additionally, the staff discussed the simulator model with the applicant during the audit. The staff observed that the applicant used industry standard models to simulate plant system response.
Therefore, the staff concludes the applicant conducted simulator performance testing and SBT prior to ISV testing as described in the V&V IP.
Section 4.0, Design Verification, of the V&V RSR summarizes the methodologies used to conduct task support verification and HFE design verification. Table 6-1, Verification, identifies the HEDs that were identified during the process and Table 6-3 identifies HEDs that were closed prior submitting the V&V RSR. The staff compared the tables and found that nearly all the HEDs had been closed prior to conducting the ISV. The staff found this treatment to be consistent with the implementation plan which had previously been assessed against NUREG-0711.18-140 Section 4.0, Design Verification, of the V&V RSR summarizes the methodologies used to conduct task support verification and HFE design verification. Table 6-1, Verification identifies the HEDs that were identified during the process and Table 6-3 identifies HEDs that were closed prior submitting the V&V RSR. The staff compared the tables and found that nearly all the HEDs had been closed prior to conducting the ISV. The staff found this treatment to be consistent with the implementation plan which had previously been assessed against NUREG-0711.
18.10.4.4 Plant Personnel (Criteria 11.4.3.4(1)-(4))
NUREG-0711, Section 11.4.3.4, Plant Personnel, includes four criteria for this topic.
18.10.4.4.1 Participant Sample Composition (Criteria 11.4.3.4(1), (2), and (4))
Criteria 11.4.3.4(1), (2), and (4) address the composition of the sample of those who will participate in the applicants validation tests:
Participants should be representative of the plant personnel who will interact with the HSI.
The sample of participants should reflect the characteristics of the population from which it is drawn. Those characteristics expected to contribute to variations in system performance should be specifically identified; the sampling process should reasonably assure that the validation encompasses variation along that dimension. Determining representativeness should include considering the participants license type and qualifications, skill and experience, age, and general demographics.
Bias in the sample of participants should be prevented by avoiding the use of participants who (1) are members of the design organization, (2) participated in prior evaluations, and (3) were selected for some specific characteristic, such as crews identified as good performers or more experienced.
The intent of Criteria 11.4.3.4 (1), (2), and (4) is twofold: to ensure that those participating in the ISV testing are representative of those that will eventually operate the real plant and to ensure bias is adequately controlled such that not only good performers are included or personnel with some unfair advantage like superior knowledge of the design, both of which may bias results.
The V&V IP, Section 4.4, describes the participants, stating that Individual operating crews participating in the ISV may be previously licensed commercial reactor or senior reactor operators, operators with Navy nuclear experience, or design engineering staff members familiar with the NuScale Power plant design. Section 4.4 states that crew members are selected and distributed across crews with consideration for age, gender, education level, and experience. Because the applicant cited members of the design engineering staff as potential ISV participants, the staff issued RAI 9371, Question 18-24 (ADAMS Accession No. ML18077A001) to clarify how these participants are representative of the anticipated plant 18-141 personnel who will interact with the HSI, how bias is prevented, and whether participants have participated in prior evaluations (e.g., SPV).
Regarding representativeness, the applicant provided the following information in the response to RAI 9371, Question 18-24 (ADAMS Accession No. ML18101B398):
The selected individuals are categorized into three groups based on their previous experience.
Previously licensed commercial nuclear power plant operators (either SRO or RO) (nine individuals).
Previously non-licensed commercial nuclear power plant operators or Navy nuclear plant operators (eight individuals).
Engineering degree with no previous operating experience (five individuals).
This is representative of the pool of plant personnel expected to operate in a NuScale control room and is consistent with the types of operators currently found in the existing nuclear industry (reference ACAD 10-001, Guidelines for Initial Training and Qualification of License Operators).
Because the ISV test participants have qualifications consistent with those in ACAD 10-001, which contains education and experience guidelines for operators license applicants that are equivalent to those in Regulatory Guide 1.8, Qualification and Training of Personnel for Nuclear Power Plants,4 the staff finds the ISV participants were representative of the personnel expected to operate the plant (i.e., licensed operators).
The applicants response to RAI 9371 also said that two of the ISV participants have had previous involvement with NuScale. One is a NuScale employee who has not been involved with the HSI or control room design or any prior evaluations; therefore, the staff determined this individual would not have a significant amount of additional experience with or knowledge of the NuScale control room design that would bias the test results. The other individual participated in the staffing plan validation (SPV). Because the SPV occurred earlier in the design process, the SPV testing was limited to a few scenarios, the training program for SPV participants was relatively short compared to the training provided to ISV participants and was focused on the information participants would need to perform the SPV scenarios, the participant was not involved with any activities conducted after SPV to finalize the HFE design, and all ISV test participants completed a training program prior to ISV that addressed a broad range of NuScale control room operations, the staff determined that the applicants prior experience with the SPV was not likely to significantly bias the ISV results. Furthermore, having only one ISV participant who participated in the SPV is not likely to significantly bias test results because the ISV test results are derived from multiple sets of data collected from all ISV participants. Thus, the staff 4 Refer to NUREG-1021, Operator Licensing Examination Standards for Power Reactors, Section ES-202.B, Background.18-142 finds that the sample of participants is both representative of actual plant personnel and that bias is adequately controlled within the sample. The staff finds that the application conforms to Criteria 11.4.3.4 (1), (2), and (4).
18.10.4.4.2 Shift Staffing Levels (Criterion 11.4.3.4(3))
Criterion 11.4.3.4(3) states that the applicant should consider the minimum shift staffing levels, nominal levels, and maximum levels (including shift supervisors, ROs, shift technical advisors, and similar positions) when selecting personnel for participating in validation tests.
The V&V IP, Section 4.4, states the following:
Operating crew size for the validation tests includes a range of expected sizes to ensure that the HSI supports operations and event management. This range includes the minimum operating crew, nominal levels, and higher levels as defined during the staffing and qualifications program element NuScale Human Factors Engineering Staffing and Qualifications Results Summary Report (Reference 8.2.3) for a range of plant operating modes.
The applicant specified that the ISV includes at least one scenario with more than minimum crew staffing defined. Minimal and nominal staffing for the NuScale plant are synonymous.
As part of an audit in June 2018 (ADAMS Accession No. ML18208A370), the staff reviewed a sample of the finalized scenario guides and observed that crew size is considered within the set of ISV scenarios. Thus, the staff finds that the application conforms to Criterion 11.4.3.4(3).
18.10.4.4.2.1 Performance Measurement (Criteria 11.4.3.5.1(1)-(6))
18.10.4.4.2.1.1 Types of Performance Measures (Criteria 11.4.3.5.1(1)-(6))
NUREG-0711, Section 11.4.3.5.1, Types of Performance Measures, includes six criteria for this topic. Criteria 11.4.3.5.1(1)-(6) state that the applicant should identify plant performance measures, primary task measures, secondary task measures, measures of situation awareness, workload measures, and anthropometric and physiological measures for each ISV scenario.
Criterion 11.4.3.5.1(2) also states that for primary task measures, the applicant should identify the primary tasks so that primary tasks measures can be developed, primary task measures should reflect the aspects of the task that are important to performance, and the performance of primary tasks should be evaluated to identify errors of commission and omission.
In the V&V IP, Section 4.5.1.2, Personnel Task Performance Measures, the applicant provided its general approach to primary task measurement, which includes (1) identifying tasks that personnel are required to perform, (2) choosing measures to evaluate task performance that reflect those aspects of the task that are important to system performance, and (3) comparing actual and expected actions to identify errors of omission and commission. The applicant listed possible aspects of the task, such as time, accuracy, and frequency, to be measured. The applicant also explained that the complexity of the task will influence the performance measures that are selected such that more complex tasks may be assessed using more detailed performance measures. During the July-August 2018 ISV audit, the staff reviewed a sample of ISV scenario guides and observed that primary task measures were identified for each scenario.18-143 The staff also observed that the primary task measures reflected the aspects of the task that were most important to performance. Therefore, the staff concludes the applicant identified adequate primary task measures consistent with Criterion 11.4.3.5.1(2).
The staff reviewed the ISV Test Report during the June 2019 audit (ADAMS Accession No. ML19220B675). The report describes several errors that occurred, none of which led to any safety consequence and none led to incorrect equipment being manipulated. This conclusion was consistent with the conclusion in the RSR.
Although the reports do not classify errors as errors of commission or errors of omission, it is clear that the ISV identified errors and that they have been documented with an appropriate level of detail to support resolution. The staff noted that there were no apparent errors of commission. However, staff acknowledges that errors of commission are not likely to be observed in a small sample of testing like this.
The staff finds that the V&V RSR adequately documents assessment of operator actions, including identification and assessment operator errors based on the observations described above. Therefore, the staff finds this treatment to be acceptable.
The V&V IP, Section 4.5 Performance Measures, states that performance measures include measures of plant performance. During the July-August 2018 ISV audit, the staff reviewed the applicants ISV Test Plan and observed that the applicant identified general plant performance measures for all ISV scenarios. For example, for an ISV scenario to be considered to be successful, ((
)). Therefore, the staff concludes the applicant identified plant performance measures consistent with Criterion 11.4.3.5.1(1).
The V&V IP, Section 4.5.1.2 also addresses secondary task measures and states, For each scenario, tasks that personnel are required to perform are identified and assessed. Primary and secondary personnel tasks are evaluated Secondary task performance measures reflect the workload associated with HSI manipulations associated with maintaining the overall plant. Test personnel evaluate secondary tasks in conjunction with primary tasks to observe effects on overall performance and workload both at individual and operating crew level.
During the July-August 2018 ISV audit, the staff reviewed a sample of ISV scenarios and observed that specific secondary task measures were identified for each scenario, and the measures were appropriate for the event being addressed. Therefore, the staff concludes the applicant identified secondary task measures consistent with Criterion 11.4.3.5.1(3).
The V&V IP, Section 4.5.1.5, Anthropometric and Physiological Factor Performance Measures, states, The primary purpose of anthropometric and physiological performance measures during ISV is to assess those aspects of the design that cannot be evaluated during design verification. Anthropometric and physiological performance measures evaluate how well the HSI supports plant personnel in monitoring and 18-144 control of the plant. Many of these design aspects are assessed as part of verifying the HFE design. Therefore, the focus is on those areas of the design that only can be addressed by testing the integrated system, e.g., the ability of personnel to effectively use the various controls, displays, workstations, or consoles while performing their tasks.
The staff understands that much of the acceptability of a design is assessed during design verification to ensure that the design conforms to the design-specific HFE guidelines. Thus, the staff agrees that measuring just those aspects that assess how well the design supports dynamic operation during ISV is appropriate. The V&V IP, Section 4.5.1.5 also identifies the types of anthropometric and physiological performance measures for the ISV scenarios.
Therefore, the staff concludes the applicant identified secondary task measures consistent with Criterion 11.4.3.5.1(6).
The staff confirmed that revision 5 of the V&V IP included the following updates regarding workload and situation awareness measures:
Workload: The applicant explained that both the NASA Task Load Index (refered to as NASA TLX) Workload Questionnaire and (( )) are used to measure workload. NASA TLX is a validated and accepted workload measurement in the nuclear domain. Both NASA TLX and (( )) are subjective in nature; however, primary and secondary task performance can provide objective indications of workload (e.g., failure of the ISV participants to perform a task may be indicative high workload). The use of multiple workload metrics provides a more comprehensive assessment of workload. The use of multiple measures also allows one to look for convergent evidence regarding workload levels and helps identify any issues that need to be addressed. Therefore, the staff concludes the applicant identified workload measures consistent with Criterion 11.4.3.5.1(5).
Situation Awareness: The applicant described that situation awareness is measured in multiple ways including a questionnaire, which is an explicit measure as described in NUREG/CR-7190, and subject matter expert observations, which is an implicit measure as described in NUREG/CR-7190. The applicant provided sample questions for the questionnaire. The applicant also stated that the scenarios introduce primary tasks, external tasks unrelated to the primary task, and embedded tasks to measure situational awareness. Subject matter expert (SME) observations are used to assess the human-system interface (HSI) effectiveness in supporting the operator's situational awareness during task performance. The use of multiple measures of situation awareness provides a higher degree of confidence that situation awareness has been assessed in a comprehensive way and allows one to look for convergent evidence that adequate situation awareness is present or may indicate where situation awareness issues exist.
Therefore, the staff concludes the applicant identified situation awareness measures consistent with Criterion 11.4.3.5.1(4).
In addition, the staff reviewed the workload and situation awareness questionnaires for a sample of scenarios at the ISV audit (ADAMS Accession No. ML18298A189). The staff determined that the situation awareness questions were appropriate to assess the ISV test 18-145 participants understanding of the plants condition. The staff also observed that the content of the NASA TLX questionnaires conformed to the standard NASA TLX methodology.
18.10.4.4.2.1.2 Performance Measure Information and Validation Criteria (Criteria 11.4.3.5.2(1)-(5))
NUREG-0711, Section 11.4.3.5.2, Performance Measure Information and Validation Criteria, includes five criteria for this topic. Criteria 11.4.3.5.2(1)-(5) state that, for each performance measure, the applicant should describe how and when it is obtained, describe its characteristics, identify the criteria used to judge its acceptability and the basis for the criteria, and identify whether it is a pass/fail or diagnostic measure.
V&V IP, Section 4.5.1.1, Plant Performance Measures, describes when plant performance measures are obtained as follows:
Plant performance resulting from operator action or inaction includes plant process data (e.g., temperature, pressure) and component status (e.g., on/off; open/closed) as a function of time at as many locations in the plant simulation as is possible. These data are obtained from the entire plant: nuclear, fluid, structural, and electrical components. The test bed has the ability to record all plant process data and component status (including state changes) for the full length of any ISV Scenario.
The V&V IP, Section 4.5.2.1, Collection Methods, explains how plant performance measure are obtained and states, Objective data (e.g., video recording, administrator observations) collected during test scenarios are analyzed to assess impacts of operator actions on plant processes and equipment states. The analysis compares the performance derived from parameters and times collected by the test bed to the evaluation criteria for operator actions and for overall plant process behavior developed for each scenario.
Therefore, the staff concludes the applicant explained how and when the plant performance measures are obtained, which is consistent with Criteria 11.4.3.5.2(1)-(2).
The V&V IP, Section 4.5.1.2 states, Test personnel evaluate secondary tasks in conjunction with primary tasks to observe effects on overall performance and workload both at individual and operating crew level. The V&V IP, Section 4.1, also states, Objective performance measures and success criteria are developed as part of the methodology and listed within the scenario guides used for the conduct of ISV tests. During the July-August 2018 ISV audit, the staff observed the ISV scenario guides identified when each primary task should be completed such that the validation team could observe whether actual performance was consistent with expected performance. Therefore, the staff concludes the applicant explained how and when the plant performance measures are obtained, which is consistent with Criteria 11.4.3.5.2(1)-
(2).
The V&V IP, Section 4.5.1.5 identifies when and how the anthropometric and physiological measures are obtained. The V&V IP, Section 4.5.1.5 states,18-146
((
)).
The V&V IP, Section 4.5.2.1, Collection Methods, states, Operator feedback on the HSI is collected via scenario debriefs and questionnaires. Both types of operator feedback include scale rating questions and open feedback (long answer) questions. Thus, the ISV participants have the ability to document any anthropometric or physiological concerns. Therefore, the staff concludes the applicant explained how and when the anthropometric and physiological measures are obtained, which is consistent with Criteria 11.4.3.5.2(1)-(2).
Revision 5 of the V&V IP clarified how certain performance measures were to be used including:
When and how situation awareness and workload measures are obtained. The applicant explained that the questionnaire used to measure situation awareness is administered ((
)). The applicant also stated that the NASA TLX is administered ((
)). During the July-August 2018 ISV audit, the staff observed the
((
)). The staff observed that intrusiveness was minimal, and there were no observable impacts on the ISV participants actions during the scenarios as a result of administering the situation awareness questionnaire or the NASA TLX.
Therefore, the staff concludes the applicant identified how and when situation awareness and workload measures are obtained, which is consistent with Criteria 11.4.3.5.2(1)-(2).
The characteristics for each performance measure, the associated criterion used to judge the acceptability of performance, and whether the measure was pass/fail or diagnostic. The staff determined that the applicant appropriately characterized the performance measures in accordance with the guidance in NUREG-0711, Table 11-1, Characteristics of Performance Measures. The staff also found the applicant appropriately identified those performance measures that are pass/fail measures and those that are diagnostic measures such that the pass/fail measures are adequate to determine whether the HFE design should be accepted or not (i.e., whether the design is validated or not), and the diagnostic measures are adequate to facilitate the analysis of human performance errors and HEDs.
Additionally, the staff reviewed the applicants criteria selected to judge the acceptability of performance for each measure and the basis for the acceptance criteria provided in Appendix A of the revised V&V IP. During the ISV audit, the staff observed the primary task performance criteria was identified in the scenario guides, and the criteria for these performance measures were appropriately based on administrative requirements, technical specifications, equipment operating limits, and PRA assumptions about task 18-147 performance, as applicable to the particular primary task. The staff found the acceptance criteria for primary tasks included criteria that would ensure safe plant performance, and thus the plant performance criteria were tied to primary task performance criteria. The staff also found the acceptance criteria for secondary task performance is also adequate to evaluate the demands of the HSI use such that the effectiveness of the HSI in supporting personnel in task performance can be determined.
The criteria for anthropometric and physiological measures is based on ((
)), which is used to evaluate ((
)), and to ((
)). Given the subjective nature of these measures, the use of (( )) is sufficient to evaluate the significance of any anthropometric or physiological issues and their potential impact on human performance.
The criteria for SA is based on a (( )), and the criteria for workload is based on ((
)). During the ISV audit, the staff observed the applicant established a minimum numerical threshold for acceptable SA. The staff finds the applicants minimum numerical value is a reasonable threshold for triggering a more in-depth evaluation to understand whether there is an issue with the HFE design. The staff also observed the applicant established a maximum threshold for workload, which is consistent with that described in the BNL Tech Report, Section 4.3.
Therefore, the staff concludes the applicant described the characteristics for each performance measure, identified the criteria used to judge its acceptability and the basis for the criteria, and identified which measures are pass/fail and diagnostic measures, which is consistent with Criteria 11.4.3.5.2(3)-(5).
18.10.4.4.2.2 Test Design 18.10.4.4.2.2.1 Scenario Sequencing (Criteria 11.4.3.6.1(1)-(2))
NUREG-0711, Section 11.4.3.6.1, includes two criteria for this topic. The criteria state that the applicant should balance (1) scenarios across crews to provide each crew with a similar, representative range of scenarios and (2) the order of presentation of scenarios to crews to provide reasonable assurance that the scenarios are not always presented in the same sequence (e.g., the easy scenario is not always used first). The V&V IP, Section 4.6.1, Scenario Sequencing, discusses the applicants sequencing for validation testing and states the following:
The scenario performance sequence is developed using the following guidance:
Equalize the opportunity for testing among all participants.
Vary the types of scenarios within the sequence; such that all are not easy at first and then progress too hard.18-148 Therefore, the staff concludes the applicants method is consistent with Criteria 11.4.3.6.1(1)-
(2). As part of an audit in June 2018 (ADAMS Accession No. ML18208A370), the staff reviewed the assignment of crews to ISV scenarios and found it conformed to Criteria 11.4.3.6.1(1)-(2).
18.10.4.4.2.2.2 Test Procedures (Criteria 11.4.3.6.2(1)-(2))
NUREG-0711, Section 11.4.3.6.2, includes two criteria for this topic. Criteria 11.4.3.6.2(1)-(2) state that the applicant should use detailed, unambiguous procedures to govern the conduct of the tests, and the test procedures should minimize the opportunity for bias in the test personnels expectations and in the participants responses. Criterion 11.4.3.6.2(1) also lists the information that should be included in the test procedures in order to develop detailed and unambiguous test procedures.
The V&V IP, Section 4.6.2, Test Procedures, states that prior to ISV, test procedures are prepared to manage tests, assure consistency, control test bias, support repeatable results, and focus the test on the specific scenario objectives.
In the V&V IP, Section 4.6.2, the applicant also stated:
The test observers/administrators use the test procedures to set up each scenario, manage the scenario, and analyze the test results. ISV test procedures are designed to minimize the introduction of bias by both observer/administrators and operating crews. A standardized scenario template is part of the test procedure.
The staff reviewed the applicants detailed test procedures during an audit from July 25, 2017, through February 14, 2018 (ADAMS Accession No. ML18135A049) and found the test procedures address the information listed in Criterion 11.4.3.6.2(1). Additionally, the staff found the test procedures contained detailed and standardized instructions to minimize the opportunity for bias in the validation team members and the ISV participants govern the interaction between the validation team members expectations and the ISV participants responses. For example, the procedures included pre-determined, scripted cues from the test personnel and responses to participants questions in order to maintain consistency across scenario trials. Additionally, the procedures contained instructions for the validation team to minimize intrusiveness and impact on the ISV participants during testing. Also, the procedures included provisions for limiting bias in the ISV participants responses that could result if the participants had prior knowledge of the scenario content and expected outcomes.
During the ISV audit, the staff observed that the applicant followed its ISV test procedures with one exception. The staff observed the applicant continued an ISV scenario after stopping the scenario to address a simulator issue for an amount of time that exceeded the time limit specified in the applicants procedure. The applicant explained that because the issue occurred after a predetermined data collection point, all necessary ISV data was collected, and it was feasible to restart the scenario at the point where the scenario had been paused for data collection. The staff did not observe any significant impact on the test as a result of the applicant resuming the scenario following a delay that exceeded the time limit identified in its ISV test procedure.18-149 Therefore, the staff concludes the applicant developed and used detailed, unambiguous procedures to govern the conduct of the tests, which is consistent with Criteria 11.4.3.6.2(1)-(2).
18.10.4.4.2.2.3 Training Test Personnel (Criterion 11.4.3.6.3(1))
NUREG-0711, Section 11.4.3.6.3, includes one criterion for this topic. This criterion states that the applicant should train test personnel and lists topics that the training should cover. The V&V IP, Section 4.6.3, Training Test Personnel, states that the observers and administrators are trained and qualified on NuScale plant systems, the HSI, and the ISV test procedures. The training program consists of both classroom training and time in the testbed simulator.
The training programs have the following stated goals:
assuring familiarity with test procedures and scenarios; reducing bias and errors that may be introduced by the observers and administrators as a result of test-based learning, failure to follow the test procedure, or incorrect interaction with the operating crew; showing how to use the test procedure; documenting each test, including the following:
o where the test did not follow the scenario; o problems that occur during testing, even if they resulted from an oversight or error of those conducting the test; conveying the necessity of limiting observer and administrator interaction with test personnel to that in the scenario description; showing how to conduct post scenario debriefings; assuring familiarity with HFE data collection tools and techniques; and assuring familiarity with observation techniques, goals, and responsibilities specific to each observers role.
The staff finds that the items listed in the V&V IP are consistent with those in Criterion 11.4.6.3(1). Thus, the staff finds that the application conforms to this review criterion.
18.10.4.4.2.2.4 Training Participants (Criteria 11.4.3.6.4(1)-(2))
NUREG-0711, Section 11.4.3.6.4, Training Participants, includes two criteria for this topic.
Criterion 11.4.3.6.4(1) states that participants should be trained such that there is reasonable assurance that the participants knowledge of the plants design, operations, and use of the HSIs and procedures represents that of experienced plant personnel. Participants should not be trained specifically to carry out the selected validation scenarios. The V&V IP, Section 4.6.4,18-150 Training Participants, describes the applicants participant training program. The staff reviewed the V&V IP, Section 4.6.4, and compared it to Criterion 11.4.3.6.4(1).
The V&V IP, Section 4.6.4, states the following:
Test participants undergo training similar to that which plant operators receive including conduct of operations, plant systems, HSI, plant events, and operating procedures. Test participants are not trained specifically on the scenarios in which they will participate.
In addition, the staff was able to audit the ISV test plan, which provided more details about the participant training. The staff found the training approach acceptable and that the application conforms to Criterion 11.4.3.6.4(1).
Criterion 11.4.3.6.4(2) states that, to assure that the participants performance is representative of plant personnel, the applicants training of participants should result in near-asymptotic performance and should be tested for such before conducting the validation. The staff reviewed the V&V IP, Section 4.6.4, which discusses the applicants participant training, and compared it to Criterion 11.4.3.6.4(2).
The V&V IP, Section 4.6.4, states the following:
To assure near-asymptotic performance and a consistent level of proficiency between individuals making up the operating crews, only participants who have successfully completed the training program and have reached an acceptable level of proficiency are considered to be qualified for operating crew assignment.
The response to RAI 9397, Question 18-19 (ADAMS Accession No. ML18101B177), describes that training consists of 9 weeks of classroom training to provide an in-depth level of knowledge of the NuScale design. Throughout this training, participants take periodic written examinations to ensure a consistent baseline knowledge level within the ISV participant group. Remediation is provided to address knowledge deficiencies. The applicant also described that participants receive 10 weeks of simulator training, focusing on the conduct of operations and plant operations, in which the ISV participants are assessed through periodic monitored dynamic simulator scenarios including a final audit examination that is administered similar to an ISV examination scenario. The ISV test team and NuScale management review the examination scores and determine whether participants have successfully completed the training program and are considered qualified for operating crew assignment. Therefore, the staff finds that the application acceptably conforms to Criterion 11.4.3.6.4(2).
18.10.4.4.2.2.5 Pilot Testing (Criteria 11.4.3.6.5(1)-(2))
NUREG-0711, Section 11.4.3.6.5, Pilot Testing, includes two criteria for this topic. These criteria state that the applicant (1) should conduct a pilot study before the validation tests begin to offer an opportunity for the applicant to assess the adequacy of the test design, performance measures, and data collection methods and (2) should not use participants in the pilot testing who will then participate in the validation tests. The staff reviewed the V&V IP, Section 4.6.5, Pilot Testing, which describes the applicants pilot testing.18-151 The V&V IP, Section 4.6.5, states that the applicant will conduct a pilot test before the ISV in order to do the following:
Assess the adequacy of test design, performance measures, and data collection methods.
Give the observers and administrators experience in running the test.
Ensure that the ISV runs smoothly and correctly.
The V&V IP also states that a test operating crew, which does not participate in the ISV, will conduct the pilot testing.
The staff finds that the application conforms to these criteria.
18.10.4.4.2.3 Data Analysis and Human Engineering Discrepancy Identification (Criteria 11.4.3.7(1)-(7))
NUREG-0711, Section 11.4.3.7, Data Analysis and HED Identification, includes seven criteria for this topic.
18.10.4.4.2.3.1 Analysis Methods (Criteria 11.4.3.7(1)-(2))
Criteria 11.4.3.7(1)-(2) state that the applicant should (1) use a combination of quantitative and qualitative methods to analyze data, such that the analysis should reveal the relationship between the observed performance and the established performance criteria, and (2) discuss the method by which data are analyzed across trials and include the criteria used to determine successful performance for a given scenario.
In the V&V IP, Section 4.7, the applicant stated the following:
Test data are analyzed using both quantitative and qualitative methods. The analysis identifies the relationship between the observed and measured performance and the established acceptance criteria described in Section 4.5.2.
Therefore, the staff concludes the applicants data analysis methods conform to Criterion 11.4.3.7(1).
The staff confirmed that both quantitative and qualitative data analysis methods were applied in the V&V RSR by describing the use of both qualitative and quantitative measures. For instance, Section 5.8, Performance Measures, describes how quantitative diagnostic measures for situation awareness and workload were measured and compared to thresholds. When these thresholds were exceeded the applicant followed up by collecting qualitative information via semi-structured interviews with operators in order to better understand the circumstances that caused the threshold to be exceeded (for instance, determining if there was something about the HSI that made the task more challenging).18-152 The staff finds this treatment to be an acceptable means of integrating both quantitative and qualitative data to identify, assess, and address, potentially challenging operating conditions during ISV testing.
The V&V IP, Section 4.7, also states the following:
Data are analyzed for each scenario across multiple trials. The method of analysis, consistency of measure assessing performance, and criteria used to determine successful performance for a given scenario is determined by the HFE Design Team.
Although the applicant committed to analyzing data across trials, it did not provide any information on the methodology or on the criteria used to determine successful performance for a given scenario. The applicants supplemental response to RAI 9399, Question 18-35 (ADAMS Accession No. ML18249A421) provides both revisions to the V&V IP and specific proprietary examples of trending techniques across trials. The applicant stated, Data is collected from multiple sources including crew debriefs, observer debriefs, NASA TLX questionnaires, Situational Awareness questionnaires, and management observations. The data is collected and added to a database where an HFE Subject Matter Expert (SME) and an Operations SME bin and code the performance data and then independently identify significant issues and trends within the data. This analysis compares and contrasts data sources, data across crews, data across trials, and data across scenarios. The HFE and Operations SMEs then collaborate on trending results and Human Engineering Discrepancy (HED) identification.
Additionally, in the response to RAI 9399, Question 18-35 (ADAMS Accession No. ML18137A584) the applicant identified the specific criteria used to determine successful performance for a given scenario.
During the June 2019 audit (ADAMS Accession No. ML19220B675) of the analyses supporting the V&V RSR, staff found that the data was analyzed as described in the V&V IP.
The staff found the methodology in the IP to be consistent with applicable guidance and the analyses in the RSR were conducted accordingly. As such, the staff finds this treatment to be acceptable because it conforms to this criterion.
Measurement (Criterion 11.4.3.7(3))
Criterion 11.4.3.7(3) states that the applicant should evaluate the degree of convergence between related measures.
DCA Part 2 Tier 2, Section 18.10.2.3.7, Data Analysis and Human Engineering Discrepancy Identification, states:
Assessments attained by different means, which are intended to measure same or similar performance measures, are compared. When differing conclusions are reached, more detailed cause analysis is performed, including the review of 18-153 simulator logs, video and audio tapes, if necessary. Measuring convergence may be necessary for a single team and single scenario or for multiple teams and across several scenarios depending on the performance measure.
Therefore, the staff concludes the applicants data analysis methods conform to Criterion 11.4.3.7(3).
The staff confirmed that V&V RSR demonstrated the convergence among related measures.
The results in the V&V RSR consistently indicate low overall workload, high overall situation awareness, and good operator performance when assessed using objective performance measures. The success of operators to safely operate the plant throughout the wide variety of operational scenarios tested suggests that the HSI design is an effective tool when combined with procedures and training. The high situation awareness ratings suggest that operators are aware of relevant parameters that may be needed during normal or emergency events, and the low workload ratings suggest that operators are not overwhelmed by the tasks at hand.
Together, these indications demonstrate convergence supporting the claim that operators can safely use the design to operate the plant. Therefore, the staff finds this treatment to be acceptable.
18.10.4.4.2.3.2 Interpretation (Criterion 11.4.3.7(4))
Criterion 11.4.3.7(4) states that the applicant should allow a margin of error when interpreting test results.
DCA Part 2, Tier 2, Section 18.10.2.3.7, states, Expert judgment is employed to infer a margin of error from the observed performance or data analysis. This allows for the possibility that actual performance may be slightly more variable than ISV test results. In the response to RAI 9399, Question 18-35 (ADAMS Accession No. ML18137A584), the applicant stated, The "HFE design team" will be expected to use expert judgment, specifically the Operators and Human Factor Engineers who administer the ISV exams, provide observations, and analyze the resulting data. The HFE PMP, Table 3-1, lists the qualifications of the HFE design team. The applicant also stated that the HFE and operations personnel will compare the actual performance with the expected performance as documented in the respective ISV scenario guide, which is validated during the pilot test. The applicant also described that tasks identified in the scenario guide evaluation criteria that directly support mitigating core damage or large radiological releases are completed with a time completion ratio less than or equal to 0.75, thus leaving a margin of 25 percent to account for variability in performance.
The staff finds the methodology is consistent with Criterion 11.4.3.7(4).
The staff reviewed the V&V RSR and confirmed that the results are interpreted allowing for a margin of error.
Section 2.1 General, of the V&V RSR addresses some of the verification and validation results. This section indicates that the important human actions were addressed in all trials using no more than 28 percent of the time available to do so. This suggests that even if the operator were to try to complete the action and fail, he could conceivably have more than 18-154 enough time to make two subsequent attempts. This suggests ample time margin is available for these tasks.
Section 2.1 also describes how the applicant set conservative thresholds for diagnostic criteria (situation awareness and workload). This is important because human performance varies between operators (i.e. some operators are more capable of handling high workload situations than others) and it varies within a particular operator (for instance, fatigue may cause an operators situation awareness to be somewhat lower during the night shift compared to the day shift). By setting conservative thresholds for these measures, the applicant increased the probability of identifying problematic operating conditions where workload/situation awareness would be challenged. The results of the V&V suggest that operators had adequate support from the HSI, procedures, and training to support them in the most challenging operating conditions tested in the V&V.
The staff finds the means described above to be adequate means of addressing this criterion because the methodology is consistent with the standard and the results adequately reflect ample margin based on conservative thresholds. Therefore, the staff finds this treatment conforms with criterion 11.4.3.7(4) and is acceptable.
18.10.4.4.2.3.3 Verification (Criterion 11.4.3.7(5))
Criterion 11.4.3.7(5) states that the applicant should verify the correctness of the data analyses using individuals or groups other than those who performed the original analysis.
In DCA Part 2 Tier 2, Section 18.10.2.3.7, the applicant stated the following:
Integrated system validation data analysis is reviewed to verify the correctness of the analyses of the data. Data and data-analysis tools (e.g., equations, measures, spreadsheets, expert opinions, resulting HEDs) are documented and available for review and subsequent audit and application during HFE program elements design integration or human performance monitoring.
In the response to RAI 9399, Question 18-35 (ADAMS Accession No. ML18137A584), the applicant stated, The completed analysis will be compiled into an ISV test report. The test report will be reviewed by at least one peer from the observation group that was not directly involved in the original data analysis. The reviewer(s) will not be segregated or otherwise separate from the observation group other than they will not be involved in the initial analysis of the data. The test report will be reviewed and approved by a manager that was not directly involved with the original analysis of the data. Therefore, the staff concludes the applicants method includes verification of the correctness of the data analysis, which is consistent with Criterion 11.4.3.7(5).
During the June 2019 audit, the staff noted that the V&V RSR, as well as the supporting ISV Test Report had been reviewed and approved for accuracy.
The staff finds that NuScale followed an acceptable methodology and used a common reviewer signature based verification technique to ensure adequate results. Therefore, the staff finds this treatment acceptable.18-155 18.10.4.4.2.3.4 Human Engineering Deficiencies (Criteria 11.4.3.7(6)-(7))
Criteria 11.4.3.7(6)-(7) state that the applicant should (1) identify HEDs when the observed performance does not meet the performance criteria and (2) resolve HEDs identified by pass/fail measures before the design is accepted.
The V&V IP, Section 5.1, HED Design Solution Implementation, states that the HFE design team performs an analysis to categorize HEDs into one of three categories (Priority 1, 2, or 3).
Priority 1 HEDs have a potential direct or indirect impact on plant safety and are resolved before ISV testing is considered complete, which occurs prior to concluding the design has been validated and is therefore acceptable. HEDs initiated as a result of a measure not being met (pass or fail performance measures) are Priority 1 HEDs.
The staff finds the applicants methodology for Criteria 11.4.3.7(6)-(7) acceptable.
In addition, the staff reviewed the RSR to ensure that the results were consistent with the above described methodology. The applicant describes HEDs in Section 6.0, Human Engineering Deficiencies Overview, of the VSV RSR and the related sub-sections. To generate HEDs the applicant created problem statements associated with system performance related to the performance measures and diagnostic measures described in sections 5.8, Performance Measures and the associated subsections. The staff observed part of this process during the ISV audit (ADAMS Accession No. ML19220B675). This treatment is consistent with the implementation plan that staff reviewed and as well as with the applicable NUREG-0711 criteria.
Therefore, staff finds this treatment to be adequate to meet this NUREG-0711 criterion.
18.10.4.4.2.4 Validation Conclusions (Criteria 11.4.8(1)-(2))
NUREG-0711, Section 11.4.8, Validation Conclusions, includes two criteria for this topic.
Criteria 11.4.8(1)-(2) state the applicant should (1) document the statistical and logical bases for determining that performance of the integrated system is and will be acceptable and (2) document the limitations in the validation tests, their possible effects on the conclusions of the validation, and their impact on implementing the design.
The V&V IP, Section 4.8, Validation Conclusions, states that the V&V RSR will include the following:
the statistical and logical bases for determining that performance of the integrated system is acceptable.
the limitations in identifying possible effects on validation conclusions and that the impact on the design integration HFE program element is considered, including the following:
aspects of the tests not well controlled; potential differences between the test situation and actual operations, such as the absence of productivity-safety conflicts; and 18-156 differences between test platform design and the as-built NuScale plant.
The staffs review of the V&V IP identified a concern with the methodology that could impact the applicants ability to satisfy Criterion 11.4.8(1) (i.e., demonstrating that performance of the integrated system is and will be acceptable).
Specifically, the V&V IP, Section 4.6.1, states that a minimum of two operating crews will perform each scenario. NUREG/CR-6393 contains the following guidance about the sample size used for the ISV test:
The objective of validation is to provide evidence that the integrated system
[(i.e., software, hardware, and personnel elements)] adequately supports plant personnel in the safe operation of the plant; i.e., that the integrated design remains within acceptable performance envelopes. To accomplish this objective, the methodology must permit a logical and defensible inference to be made from validation tests to predicted integrated system performance under actual operating conditions.
As a general rule, the larger the sample size (number of participating crews), the more confidence can be placed in generalizing the observed test performance to actual performance. Low sample sizes make it difficult to examine the effects of human variability. However, it should be recognized that there is a significant tradeoff between sample size and the difficulty, time, and cost of the validation program. Since human and integrated system variability is important to the generalization process, methods should be employed to ensure its adequate estimation.
The actual sample size is difficult to specify precisely because it depends on several factors... The less sensitive the integrated system performance is to human performance, the less that variation needs to be assessed and the lower the needed sample size.
The staff was concerned that a minimum of two trials for each ISV scenario does not provide (1) enough opportunities for users of the integrated system to identify problems with the HFE design or (2) reasonable assurance that results from the ISV test will be indicative of the ability of the integrated system to support safe plant operation. As stated in NUREG/CR-6393, The less sensitive the integrated system performance is to human performance, the less that variation needs to be assessed and the lower the needed sample size. The staff did not find that the applicant had provided justification that the integrated system performance is less sensitive to human performance (specifically, human performance errors) to justify having a minimum of two trials per scenario.
In the responses to RAI 8758, Question 18-1 (ADAMS Accession Nos. ML17322A051 and ML18134A353), the applicant described the bases for determining that performance of the integrated system using a minimum of two operating crews per scenario will be acceptable.
This included identifying design features that limit the likelihood and consequences of safety-significant errors of omission (i.e., one in which an operator action is required to be taken and the operator fails to take that action) and commission (i.e., one in which the operator takes an 18-157 erroneous action when no action is needed or a different action is needed) as justification for using a minimum of two operating crews per scenario. The staffs assessment of the applicants justification is provided in sections 18.10.1.4.2.4.1 and 18.10.1.4.2.4.2 below.
18.10.4.4.2.4.1 Errors of Omission With respect to errors of omission, the applicant discussed the results of the deterministic analyses presented in DCA Part 2 Tier 2, Chapter 15 and Chapter 7 and the results of the PRAs discussed in DCA Part 2 Tier 2, Chapter 19. In the response to RAI 8758, Question 18-1 (ADAMS Accession No. ML17322A051), the applicant stated, NuScale has a uniquely safe design with only a few simple, passive safety systems, few support systems, and no reliance on AC [alternating current] or DC [direct current] power for mitigating design basis events (DBEs).
As a result of NuScale's simple and passive design, no operator actions are required for DBE mitigation. DCA Part 2 Tier 2, Section 15.0.0.6.4, Required Operator Actions, states the following:
There are no operator actions credited in the evaluation of NuScale DBEs. After a DBE, automated actions place the NPM in a safe-state and it remains in the safe-state condition for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> without operator action, even with assumed failures.
DCA Part 2, Tier 2, Section 15.0.0.5, Limiting Single Failures, also states the following:
Operator actions allowed by procedure make the consequences less severe.
Failure to take one of these actions cannot make the consequences worse than the bounding Chapter 15 analysis.
Additionally, the analyses described in DCA Part 2, Tier 2, Chapter 7 do not credit any operator actions to mitigate DBEs following a common-cause failure of the digital I&C protection system.
Also, DCA Part 2 Tier 2, Section 7.1.1.2.2, Post-Accident Monitoring, states that no operator actions are credited for ATWS and SBO scenarios, which are BDBEs. As compared to large light-water plant designs, ATWS event mitigation requires operator actions to be taken within minutes to trip the reactor and place it in a safe state, and SBO event mitigation requires operators to take action to restore power to the site to ensure the availability of those plant systems that are needed for long-term core cooling within hours of the event. Operators do not need to trip the reactor following an ATWS event to meet ATWS acceptance criteria, and no operator actions are required until 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after an SBO.
Given that the analysis of DBEs does not credit any operator actions, the staff concludes that there are no errors of omission for operator actions that are relied upon to mitigate the consequences of DBEs. Although plant procedures direct operators to take some actions during these DBEs, if operators fail to take any of these actions, the consequences cannot be any more severe than those described in DCA Part 2 Tier 2, Chapter 15. Because no operator actions are required to be performed to meet the acceptance criteria for the events analyzed in DCA Part 2 Tier 2, Chapter 15, the staff concludes the design is not sensitive to any errors of omission during DBEs, ATWS, and SBO.18-158 The applicant also discussed the impact of errors of omission for BDBEs analyzed using probabilistic methods as discussed in DCA Part 2, Tier 2, Chapter 19. In the response to RAI 8758, Question 18-1 (ADAMS Accession No. ML17322A051), the applicant stated the following:
The PRA evaluated operating sequences that could lead to core damage. All sequences that lead to core damage have very low frequencies (less than 1E-10 per module critical year) and involved BDBEs. For the sequences that led to core damage, one of the following three conditions must occur: (Reference TR-1117-57216 NuScale Generic Technical Guidelines):
- 1.
A malfunction of the ECCS to actuate as designed. For example, when the ECCS vent valves open but both of the ECCS recirculation valves do not, inhibiting water from reentering the core.
- 2.
An isolable loss of coolant accident outside of the containment vessel with a failure to add makeup coolant. In this case, sufficient RCS inventory may be lost leading to core uncovery.
- 3.
A situation where both trains of decay heat removal have failed in a manner to not remove RCS heat, and both of the RCS ASME Code safety relief valves do not open.
The PRA identified seven BDBE human actions. Six of the actions that could be taken to mitigate the events occur in the Main Control Room and two of these actions are considered IHAs [important human actions]. Since there are only six PRA identified actions that are performed in the control room, NuScale plans to sample the performance on all of those tasks to ensure there is confidence in the results of the testing. In lieu of performing each designed scenario three times, the scenarios have been designed such that the PRA actions are each sampled in at least two separate scenarios and the crews are sequenced such that all three crews perform each of the six PRA actions at least once.
Despite uncertainties in the applicants PRA as a result of incomplete design detail and lack of operating experience, the staff acknowledges that the applicants PRA identified fewer human actions (HA) relative to other certified designs and operating reactors. When compared to other certified designs and operating reactors, the PRA also identified fewer important human actions (IHA). As such, the staff concludes that the low number of HAs identified in the PRA shows a limited reliance on operator actions to mitigate the consequences of BDBEs. As discussed in the DCA Part 2 Tier 2, Section 18.6.3, Results, and DCA Part 2 Tier 2, Section 18.5.3, Results, the IHAs were included in the SPV, and the operating crews satisfactorily performed them. The staff observed some SPV testing as discussed in the audit report dated November 30, 2016 (ADAMS Accession No. ML16259A110) and noted that the tasks operators perform to accomplish the IHAs are not complex actions but rather are directed by plant procedures in a few steps. Also, the HFE design also includes alarms and indications to notify the operators of these events requiring HAs to be performed.
Additionally, each of the crews performed these IHAs and the other HAs during the ISV.
Satisfactory results must be obtained, or compensatory actions must be taken if the crews18-159 cannot perform these actions within the time required. Therefore, the staff concludes that the proposed testing of these HAs and IHAs in the ISV by (( )), in addition to the successful demonstration of the IHAs during the SPV, is an acceptable approach to demonstrate the feasibility and reliability of the IHAs and HAs.
18.10.4.4.2.4.2 Errors of Commission With respect to errors of commission, because up to 12 units can be operated from a single control room, and up to 12 units can be operated from a single operator console, there is a relatively higher probability of operators taking an action intended for one unit on a wrong unit as compared to other certified designs. In the response to RAI 8758, Question 18-1 (ADAMS Accession No. ML18134A353), the applicant discussed how the MCR, MPS, and HSI designs help to limit the probability and consequences of safety-significant errors of commission. DCA Part 2, Tier 2, Section 7.0.4.1, Module Protection System, describes purpose of the MPS:
The primary purpose of the MPS is to monitor process variables and provide automatic initiating signals in response to out-of-normal conditions, providing protection against unsafe NPM operation during steady state and transient power operation. Each NPM has a single dedicated MPS. The two major functions that the MPS performs are:
monitors plant variables and trips the reactor when specified setpoints, which are based on the plant safety analysis analytical limits described in Chapter 15, are reached or exceeded during anticipated operational occurrences.
monitors plant variables and actuates engineered safety features actuation system (ESFAS) equipment when specified setpoints, which are based on the plant safety analysis analytical limits described in chapter 15, are reached or exceeded during anticipated operational occurrences.
Actuation of ESFAS equipment prevents or mitigates damage to the reactor core and reactor coolant system components and ensures containment integrity.
In the response to RAI 8758, Question 18-1 (ADAMS Accession No. ML18134A353), the applicant stated the following:
Control room operators cannot manipulate safety-related SSCs [structures, systems, and components] except through the use of the module protection system (MPS) hard-wired manual actuation switches located at the standup panel for each unit. Operation of any of these switches is an infrequent operation directed by procedure and normally requires a peer-check prior to operation.
Operation of these switches is also expected to receive supervisory oversight and because of their physical location, operation of these safety-related switches is conspicuous to the operating crew.
The MPS cannot be overridden by an operator either before or after initiation, with the exception of containment isolation override to support either adding 18-160 inventory to the reactor vessel using the chemical and volume control system (CVCS) or to containment using the containment flooding and drain system (CFDS). Once an MPS setpoint is reached, the associated safety related SSCs will transition to their single safety position. The containment isolation override function is only required during highly improbable beyond-design basis events which are addressed in Chapter 19 and is beyond the scope of this response, which is for Chapter 15 events only. The containment isolation override function requires multiple deliberate steps which are directed by procedures. The Conduct of Operations and generally accepted industry standards on human performance and use of error reduction tools ensure that a peer check and proper supervisory oversight would be provided to complete this Important Human Action. To accidentally perform this action in error or to complete this action on the wrong unit is not deemed credible.
DCA Part 2, Tier 2, Section 7.1.1.2.1, Protection Systems, provides more detail as to when and how safety-related structures, systems, and components are operated and states, When allowed by plant procedures to reconfigure systems after a reactor trip or an ESF actuation, the components can be repositioned using the non-safety-related MCS when the enable nonsafety control switch is activated and no automatic or manual safety actuation signal is present. The HSI Design RSR states that the safety-related Enable Nonsafety Control Switch is a ((
)). DCA Part 2 Tier 2, Section 7.1.5.1.6, Guideline 6 Postulated Common Cause Failure of Blocks, explains that control of safety-related components using non-Class 1E controls (i.e., the MCS) can only be enabled by the operator using the enable nonsafety control switch; otherwise, the non-Class 1E signals to the actuation priority logic are ignored. DCA Part 2, Tier 2, Section 7.2.12.2 states the following:
If enabled by the operator using the safety-related enable nonsafety control switch, the capability for manual component level control of ESF equipment is possible using nonsafety discrete hard-wired inputs from the MCS to the HWM.
These signals are then input to the actuation priority logic circuit on the EIM. Any automatic or manual safety related signal will override the nonsafety signal and is prioritized within the actuation priority logic.
As stated in the response to RAI 8758, Question 18-1 (ADAMS Accession No. ML18134A353),
situations in which the operators need to operate the safety-related structures, systems, and components are expected to occur infrequently and also are directed by procedures. These components cannot be operated from the sitdown or standup workstations without first taking the correct Enable Nonsafety Control Switch for that module to the correct position, and they also cannot be operated if an ESF actuation signal is present. Therefore, they cannot be operated by the operator if the MPS determines the valve needs to be in its safety state.
Although it is possible that the operator might select the incorrect Enable Nonsafety Control Switch (e.g., he or she might operate the Enable Nonsafety Control Switch for Unit 9 instead of Unit 6), the operator would have to also make a subsequent error during operation of the actual components to actually reposition any equipment. If that did occur, and if the consequences of that action were significant enough to actuate an ESF signal for that unit, or if an ESF actuation setpoint was reached on that unit for other reasons, then the MPS would actuate the necessary 18-161 ESF signal, and the components would automatically go to the position required for the ESF actuation regardless of what position the operator had selected using the MCS.
Additionally, although it is possible that the operator could operate the wrong ESF valve or valves (e.g., he or she might accidentally select an ECCS valve to operate rather than a Decay Heat Removal System valve) following operation of the correct Enable Nonsafety Control Switch for a particular unit, if the consequences of that action were significant enough to actuate an ESF signal for that unit, or if an ESF actuation setpoint was reached on that unit for other reasons, then the MPS would actuate the ESF signal, and the components would transition to the position required for the ESF actuation regardless of what position the operator had selected the component to be in using the MCS.
Because the operator must first enable the Enable Nonsafety Control Switch for a particular unit to operate the components that are relied upon to perform safety functions for that unit, and because safety signals from the MPS to those components are prioritized such that actions taken by the operator are overridden when safety setpoints are reached, the staff concludes that the design is relatively insensitive to possible errors of commission related to the operation of safety-related components.
Therefore, the staff concludes that the design features of the NuScale plant and HSI design do help to reduce the sensitivity of the integrated system to human performance errors and thus do provide justification for the applicants proposed number of trials.
In addition, the staff reviewed the results in the V&V RSR. There were no priority 1 HEDs associated wrong unit errors, thus suggesting that if these errors occurred, there would be no safety consequence.
For the reasons stated above, the staff finds this treatment to be acceptable.
18.10.4.5 Human Engineering Discrepancy Resolution Review (Criteria 11.4.4(1)-(5))
NUREG-0711, Section 11.4.4, includes five criteria for this topic.
18.10.4.5.1 Human Engineering Discrepancy Analysis (Criterion 11.4.4(1))
The V&V IP, Section 5.2, Human Engineering Discrepancy Analysis, describes the applicants analysis of HEDs. The staff compared this information to Criterion 11.4.4(1), which lists items that should be included in HED analyses. The staff found the information in the V&V IP, Section 5.2, includes all of the items listed in Criterion 11.4.4(1). Specifically, in the V&V IP, Section 5.2, the applicant stated the following:
HFE V&V HEDs are categorized based on their principal impact on:
personnel tasks and functions plant systems human-system interface feature 18-162 individual HSI component operating procedure Extent of condition and causal effect across the various HSI design features and functions are assessed as part of the HED process. Extent of condition determination considers:
cumulative or combined effects of multiple HEDs human engineering discrepancies that may represent a broader issue The staff finds the described analysis approach acceptable.
Section 5.7, Data Analysis, of the V&V RSR demonstrates how the applicant considered the combined effects of HEDs. For instance, Figure 5-1 shows how HEDs were categorized by the HFE team to ensure that HEDs were considered holistically, and not isolated to scenario or operational situation in which they were identified. This binning process was used to compile the 32 ISV HEDs summarized on Table 6-2 of the V&V RSR.
The summaries on Table 6-2 are high-level, therefore, the staff reviewed the non-docketed ISV Test Report during the June 2019 audit (ADAMS Accession No. ML19220B675). The staff found that the Test Report was consistent with the summaries in Table 6-2 and that the supporting data (such as workload assessments and time evaluations) were generally sufficient to support the conclusions drawn in the Test Report.
The staff reviewed this method and found it to be a reasonable means of assessing HEDs to ensure that there are no cumulative effects. When reviewing the results, it was observed that the results were derived from the method described above and that there were no apparent cumulative effects of significance. Therefore, the staff finds this treatment acceptable to meet this NUREG-0711 criterion.
18.10.4.5.2 Selection of Human Engineering Discrepancies to Correct (Criterion 11.4.4(2))
Criterion 11.4.4(2) states that the applicant should conduct an evaluation to identify which HEDs to correct, correct those with direct safety consequences or potential safety impact (unless the applicant justifies leaving the condition as is), and correct HEDs that may adversely impact personnel performance in a way that has potential consequences to plant performance; operability of structures, systems, or components; and personnel performance or efficiency.
As discussed in Section 18.1.4.4 of this SER, the V&V IP, Section 5.1, states that the HFE design team performs an analysis to categorize HEDs as Priority 1, 2, or 3. Priority 1 HEDs are those with direct safety consequences or potential safety impact, and Priority 2 HEDs are those with potential consequences to plant performance and operability. Section 18.1.4.4 of this SER explains that the applicant intends to correct these HEDs and identifies when they will be corrected.18-163 The staff finds that the applicants method is acceptable because the applicant will conduct an evaluation to identify those HEDs that need to be corrected based on whether they could impact plant safety or plant performance, which is consistent with Criterion 11.4.4(2).
The staff reviewed the V&V RSR and found a detailed description of one HED that would have been a priority 1 HED but had been justified as a priority 2 HED. Staff discussed this prioritization with the applicant during the June 2019 audit (ADAMS Accession No. ML19220B675). The staff reviewed a variety of supporting analyses and found them sufficient to preclude the design of the HSI as a factor in the associated crew failures. The RSR describes a means to prevent reoccurrence of the issue which is consistent with current industry practice.
In addition to the HED described above, the staff reviewed a sample of priority 2 and 3 HEDs during the June 2019 audit. In all other cases reviewed, the staff agreed with the assessed priorities. There were no other potential priority 1 HEDS identified in the sample, therefore, the staff does not expect the other HEDs to have an impact on safety.
The staff finds that the applicant has appropriately prioritized HEDs, with the single exception described above. This HED was sufficiently justified and the resolution was found sufficient to minimize the likelihood of recurrence. Therefore, the staff considers the applicants prioritization process to be adequate to address this criterion.
18.10.4.5.3 Development of Design Solutions (Criterion 11.4.4(3))
Criterion 11.4.4(3) states that the applicant should identify design solutions to correct HEDs and, as part of the design solution, should evaluate the interrelationships of individual HEDs.
The V&V IP, Section 5.1, explains that after an HED has been prioritized, it is routed to the HFE design team, simulator review board, or both, as appropriate for resolution. The V&V IP, Figure 5-1, Human engineering discrepancy resolution process, illustrates the process the applicant will use to identify, review, implement, and verify design solutions. The V&V IP, Section 5.2 explains that the applicant will assess the cumulative or combined effects of multiple HEDs (i.e.,
the interrelationships of individual HEDs) as part of the HED resolution process.
The staff finds the applicants design solution approach acceptable because the applicant will identify design solutions to correct HEDs and also evaluate the interrelationships of individual HEDs, which is consistent with Criterion 11.4.4(3).
The staff verified the implementation of above practices through a review of the V&V RSR. The V&V RSR describes the HEDs that were found, none of which were classified as priority 1 HEDs. By definition, priority 1 HEDs are HEDs that have potential direct or indirect impact on plant safety. If there had been priority 1 HEDs these would have required design changes (or changes to training and/or procedures) or a documented defensible justification as to why no changes were necessary. Since there were no priority 1 HEDs, there are no changes necessary to mitigate the effects.
In addition, the staff reviewed entries in HFEITS during the June 2019 audit. The staff observed that design solutions were signed-off by the HFEITS Review Team and marked confirmed once the design solution was implemented.18-164 The staff reviewed a sample of priority 2 and 3 HED design solutions and found them to be reasonable solutions which would address the issue. When needed, additional testing occurred to ensure that the design change did not introduce new issues.
For the reasons stated above, the staff finds this treatment to be acceptable.
18.10.4.5.4 Design Solution Evaluation (Criterion 11.4.4(4))
Criterion 11.4.4(4) states that the applicant should evaluate design solutions to demonstrate the resolution of HEDs and to ensure that new HEDs are not introduced. Criterion 11.4.4(4) also says that generally, the evaluation should use the V&V method that originally detected the HED.
In the responses to RAI 9394, Question 18-17 (ADAMS Accession Nos. ML18123A540 and ML18239A250), the applicant stated it will revise the V&V IP to include the following information regarding the evaluation of design solutions to ensure that no new issues are introduced:
Generally, design solutions will be verified to be acceptable using the same V&V method that originally detected the issue. For example, if an HED-1 is identified during performance of an ISV scenario, a similar scenario would be run to verify the solution was acceptable. Because the impact of design solutions varies widely this general practice may be adjusted using engineering judgment to ensure a thorough and appropriate test is conducted.
The following elements are considered when making this judgment:
number of procedures affected number of HSIs affected complexity of the condition under which the design solution is used uniqueness of the design solution Because the applicant plans to verify that design solutions are acceptable by using the same method that originally detected the issue is acceptable, the applicants method is consistent with Criterion 11.4.4(4). The staff also understands that in some cases, it may not be necessary to verify a design solution is acceptable by using the same method that originally detected the issue, and the applicant has identified appropriate factors to consider when making this decision.
While considering the results of the ISV, the staff found that there were no design solutions necessary to ensure safe operation based on the results in the V&V RSR, because there were no Priority 1 HEDs, therefore, no design changes were necessary. However, there may have been elective changes, such as to resolve priority 2 and 3 HEDs, therefore, the staff considered the design evaluations anyway.
During the June 2019 ISV Audit (ADAMS Accession No. ML19220B675) the staff reviewed a sample of the resolved design solutions and found that all but one of the design solutions reviewed was retested using the same or similar method as was used to initially identify the 18-165 HED. This exception relied on improved operator training rather than a design change. Training programs are ultimately the responsibility of the license holder, and therefore, additional retesting of these particular operators in the NuScale training program would have added minimal new information. Appendix C, Training Inputs to COL Holder Approved Training Program, of RSR provides inputs to future licensees while developing training programs, thus providing assurance that this issue will be addressed. Therefore, the staff found this exception to be reasonably justified.
The staff found that the methods used to evaluate HED resolutions were consistent with the methods used to identify the issues, therefore, the staff found this treatment to be acceptable to meet this criterion.
18.10.4.5.5 HED Evaluation Documentation (Criterion 11.4.4(5))
The staff reviewed the V&V IP, Section 5.1, which discusses the applicants documentation of the evaluation of HEDs. The staff compared this information to Criterion 11.4.4(5), which states that the applicant should document each HED, including the following:
the basis for not correcting an HED related personnel tasks and functions related plant systems cumulative effects of HEDs HEDs as indications of broader issues In the V&V IP, Section 5.0, the applicant explained that HFE issues and HEDs are documented and tracked in the HFEITS database. If an HED is not resolved the basis for a decision for accepting an HED without change in the integrated design is documented. It may be based on accepted HFE practices, current published HFE literature, trade-off studies, tests, or engineering evaluations.
In the V&V IP, Section 5.2, the applicant described how HEDs are categorized based on their impact on the following:
personnel tasks and functions plant systems HSI feature individual HSI component operating procedure 18-166 In addition, the applicant described an extent of condition analysis for HEDs that considers cumulative or combined effects of multiple HEDs and HEDs that may represent a broader issue.
In the response to RAI 9394, Question 18-18 (ADAMS Accession No. ML18123A540), the applicant stated the following:
Human engineering discrepancies (HEDs) are documented in the human factors engineering issues tracking system (HFEITS) database. A working level HFEITS procedure is used by the NuScale HFE staff to ensure the applicable information related to the five bullets is documented in the HFEITS database. The Human Factors Verification and Validation Implementation Plan (RP-0914-8543) has been revised to reflect this documentation.
Because the applicant plans to document all of the information listed in Criterion 11.4.4(5), the staff finds the applicants method is acceptable.
During the June 2019 ISV audit (ADAMS Accession No. ML19220B675) the staff reviewed a sample of HEDs and observed that the database entries were complete. The staff had previously found that the entry fields in the database addressed the necessary elements to address this criterion, therefore, the staff concluded that the database entries sufficiently addressed this criterion.
In addition, the staff confirmed that HED tracking will be sufficient during the transition of ownership with the COL.
The V&V RSR does not contain any priority 1 HEDs. Had any been identified, they would have needed to be tracked through resolution. Since there were none, no additional tracking is necessary because no design changes are necessary to resolve safety issues.
Priority 2 and 3 HEDs, by definition, do not impact safety, therefore, they may or may not be resolved. The staff finds that the documentation of these items in the V&V RSR is a sufficient means of tracking these issues because each item is associated with a unique HFEITS tracking number. The staff has previously audited the HFEITS tracking system and found this to be an effective tracking tool (ADAMS Accession No. ML18208A371).
18.10.5 Combined License Information Items No COL information items are associated with NuScale DCA Part 2 Tier 2, Section 18.10.
18.10.6 Conclusion The staff reviewed the V&V methodologies described in the V&V IP and summarized in the V&V RSR and found that they were consistent with the applicable NUREG-0711 acceptance criteria.
This gives the staff confidence that the results of these tests provide valid results that demonstrate how the design supports the safe operation of the plant. In addition, the staff reviewed the results of V&V tests as described in the V&V RSR and found that the results support the conclusion that operators can use the NuScale HSI to safetly operate the plant under the wide variety of operational conditions tested.18-167 Accordingly, the staff finds the application satisfies the requirements in 10 CFR 50.34(f)(2)(iii) and 10 CFR 52.47(a)(8) related to this element.
18.11 Design Implementation 18.11.1 Introduction The objective of the staffs review is to ensure that the applicants as-built design conforms to the verified and validated design that resulted from the HFE design process.
18.11.2 Summary of Application DCA Part 2 Tier 1: Refer to Section 18.1.2 of this SER.
DCA Part 2 Tier 2: The applicant provided a description of this HFE element in DCA Part 2 Tier 2, Section 18.11, Design Implementation.
ITAAC: The ITAAC associated with this element is in Tier 1, Section 3.15, Table 3.15-1.
TS: There are no TS associated with this element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: Refer to Section 18.1.2 of this SER.
18.11.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR 52.47(a)(8) as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).
10 CFR 52.47(b)(1), which requires that a DC application include the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a facility that incorporates the DC has been constructed and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended (AEA), and the NRC's rules and regulations.
10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts.
SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.
Acceptance criteria for HFE design methodology are provided in NUREG-0711 (listed below).
(NUREG-0711 references NUREG-0700, Human-System Interface Design Review Guidelines, which provides detailed acceptance criteria for HFE design attributes.)18-168 NUREG-0711, Revision 3, Chapter 12, Section 12.3, Applicant Products and Submittals, and Section 12.4, Review Criteria.
18.11.4 Technical Evaluation 18.11.4.1 NUREG-0711, Section 12.3, Applicant Products and Submittals NUREG-0711, Section 12.3, Applicant Products and Submittals, states the following:
If the applicant submits an IP, it should describe the methodology for conducting design implementation. The NRC will review it using the criteria in Section 12.4 below.
The staff used the criteria in NUREG-0711, Section 12.4, to evaluate the applicants DI IP in order to verify the following:
The as-built design conforms to the verified and validated design resulting from the HFE design process.
The implementation of plant changes considers the effect on personnel performance and provides the necessary support to give reasonable assurance of safe operations.
Unlike most other NUREG-0711 elements that have RSRs as part of the DCA, NuScale has submitted an IP for the design implementation element. This is because it is not possible to submit the RSR for this element until the plant is constructed and the as-built MCR can be evaluated to verify that it conforms to validated design.
The staff noted one exception from the guidance in NUREG-0711, Section 12.3, Applicant Submittals. The DI IP explicitly states that COL applicants will not submit an RSR as a means of closing out the element. Instead, COL applicants will need to submit ITAAC closure notifications as a means of closing out the associated ITAAC. The COL applicant will implement and document the DI activities in accordance with the DI IP. The staff will consider the criteria in this review element when reviewing the ITAAC closure documents, therefore, there is effectively no difference between an RSR and an ITAAC closure notification. The wording of the ITAAC includes a reference to the DI IP ensuring that it is clear to both the COL applicant and NRC ITAAC inpsectors what criteria should be considered during an ITAAC closure review.
NUREG-0711, Section 12.4.1, Final HFE Design Verification for New Plants and Control Room Modifications, includes four applicable review criteria for this topic. The review criteria in Section 12.4.2 Additional Considerations for Reviewing the HFE Aspects of Control Room Modifications, of NUREG-0711 apply only to plant modifications and are therefore not applicable to this DCA review.18-169 18.11.4.2 Evaluation of Aspects of the Design Not Addressed in Verification and Validation (Criterion 12.4(1))
18.11.4.2.1 Summary of Application and Staff Assessment The DI IP, Section 1.2, Scope, indicates that other aspects of the facility that were not simulated but are relevant to the overall HFE program are evaluated using an appropriate V&V method are within the scope of the design implementation.
The DI IP, Section 3.0, Design Implementation Assessments, identifies several specific methods that will be used during the design implementation process to ensure that the software, hardware, and facility configurations match the appropriate design drawings and specifications.
In addition, it clearly indicates the types of assessments that the licensee should consider using.
Section 3.0, provides guidance regarding the methods that should be used to validate any activities that were not validated during the ISV. It allows flexibility in selecting an appropriate method for validating those HEDs for which an analysis has confirmed that the ISV results will not change (such as by using walkdown and subject matter expert review). If an HED may change the results of the ISV, a more controlled approach is proposed, which may include rerunning the applicable portion of the ISV to confirm that the results remain valid.
18.11.4.2.2 Conclusion The staff finds that the applicant proposed a methodology that covers the appropriate scope of DI activities including aspects of the design that were not addressed in the V&V. The DI methods described above are common methods for validating actions and demonstrate an increased focus on those deviations that may affect the ISV results. Therefore, the staff finds this treatment to be acceptable to meet this criterion.
18.11.4.3 Comparison of Final Products to Planned Design and Identification of Discrepancies (Criterion 12.4(2))
18.11.4.3.1 Summary of Application, Staff Assessment, and Conclusion The ITAAC incorporates by reference the DI IP and addresses a scope that covers the design validated by the ISV and considers any changes that have been validated as part of the DI activities. The staff finds this treatment an adequate means to ensure the final as-built design is consistent with the approved design. As such, the staff find this treatment adequate to address this criterion. (Refer to Section 14.3.9 for a detailed analysis of the associated ITAAC.)
18.11.4.4 Verification that All Human Factors Engineering Issues Have Been Addressed (Criterion 12.4(3))
18.11.4.4.1 Summary of Application and Staff Assessment The DI IP, Section 4.0, Human Factors Engineering Issues Issue Resolution, indicates that all Priority 1 and 2 HEDs will be addressed prior to transferring ownership to a COL applicant.
Priority 3 HEDs can be resolved either before or after transfer of ownership.18-170 By definition, Priority 1 HEDs are the only HEDs with a potential impact on safety. Therefore, NuScales commitment to resolving these HEDs as well as the Priority 2 HEDs ensures that there will be no unresolved HEDs that could impact safety when the COL takes possession of the plant. (See Section 5.4.8 of the HFE PMP for a description of NuScales plan to resolve HEDs).
DI IP, Section 3.0, Design Implementation Assessments, provides a description of the assessments used to address HEDs.
Although it is unlikely, it is possible that new Priority 1 HEDs could be identified after the COL takes possession of the plant, but before startup. In this case, it is the responsibility of the COL to resolve these HEDs before closing the ITAAC (see Section 14.3.9). Section 3.0, Design Implementation Assessments, provides a means of assessing new HEDs that is consistent with the types of analyses used and methods for justification of deviations described in NUREG-0711.
18.11.4.4.2 Conclusion The staff finds that the methods described in the DI IP provides assurance that all HEDs that could influence safety will be addressed prior to transference of ownership. These activities are verifiable via assessment of the related ITAAC. Therefore, the staff finds this treatment to be acceptable.
18.11.4.5 Description of How the Human Factors Engineering Program Addressed Important Human Actions (Criterion 12.4(4))
18.11.4.5.1 Summary of Application and Staff Assessment The DI IP, Section 5.0, Addressing Important Human Actions, indicates that the treatment of IHAs is described in the TIHA element of the HFE program (see section 18.6 of this report). In addition, the analyses of the IHAs is described in the V&V RSR.
The staff reviewed the TIHA RSR and the V&V RSR and found that these documents include a sufficient description of the treatment of the IHAs throughout the HFE process, up to, and including the analysis conducted during V&V. The June 2019 audit (ADAMS Accession No. ML19220B675) of the V&V RSR considered the results of the ISV and found no significant issues associated with IHAs. Operator performance associated with IHAs has been acceptable using the HSI design.
18.11.4.5.2 Conclusion The staff finds that the applicant has described the treatment of all known IHAs in the TIHA RSR and addressed the evaluation of IHAs in the V&V RSR. Therefore, the staff finds this treatment to be acceptable.
18.11.5 Combined License Information Items No COL information items are associated with NuScale DCA Part 2 Tier 2, Section 18.11, Design Implementation.18-171 18.11.6 Conclusion The staff considered the acceptance criteria described above and found that the DI IP is consistent with these criteria. The DI IP when paired with the associated ITAAC provide a means of addressing human factors insights that occur after completion of the ISV test, up until the plant startup.
The staff noted a deviation from the guidance regarding the expectation that a COL applicant will produce an RSR as described in NUREG-0711. Instead, the staff will rely on the documents used to support ITAAC closure notification. The content of these documents is similar, therefore, the staff found this to be acceptable.
Accordingly, the staff finds the application satisfies the requirements in 10 CFR 50.34(f)(2)(iii),
10 CFR 52.47(b)(1), and 10 CFR 52.47(a)(8) related to this element.
18.12 Human Performance Monitoring 18.12.1 Introduction The objective of the staffs review is to assure that the applicant has prepared a human performance monitoring strategy for ensuring that no significant safety degradation occurs because of any changes that are made in the plant and to verify that the conclusions that have been drawn from the human performance evaluation remain valid over the life of the plant.
18.12.2 Summary of Application DCA Part 2 Tier 1: There is no Tier 1 information associated with this element.
DCA Part 2 Tier 2: The applicant identified a COL information item that will address this element in DCA Part 2 Tier 2, Section 18.12, Human Performance Monitoring.
ITAAC: There are no ITAAC associated with this element.
TS: There are no TS associated with this element.
Topical Reports: There are no topical reports associated with this element.
Technical Reports: There are no TRs associated with this element.
18.12.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:
10 CFR 52.47(a)(8) as it pertains to the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v)18-172 10 CFR 50.34(f)(2)(iii) - Provide, for Commission review, a control room design that reflects state-of-the-art human factor principles prior to committing to the fabrication or revision of fabricated control room panels and layouts SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections. Acceptance criteria for HFE design methodology are provided in NUREG-0711 (listed below). (NUREG-0711 references NUREG-0700, Human-System Interface Design Review Guidelines, which provides detailed acceptance criteria for HFE design attributes.)
NUREG-0711, Revision 3, Chapter 13, Human Performance Monitoring, Section 13.4, Review Criteria 18.12.4 Technical Evaluation DCA Part 2, Tier 2, Revision 1, Section 18.12, contains one COL information item pertaining to human performance monitoring. The staff evaluates the acceptability of the COL information item in this SER section. The staff concluded that no additional COL information items were needed.
18.12.5 Combined License Information Items Table 18.12-1 lists COL information item numbers and descriptions related to human performance monitoring from DCA Part 2 Tier 2, Section 18.12.
Table 18.12-1: NuScale COL Information Items for DCA Part 2 Tier 2, Section 18.12 Item No.
Description DCA Part 2 Tier 2 Section 18.12-1 A COL applicant that references the NuScale Power Plant design certification will provide a description of the human performance monitoring program in accordance with applicable NUREG-0711 or equivalent criteria.
18.12 18.12.6 Conclusion A COL information item has been identified for this HFE element because a human performance monitoring IP was not provided for it. The staff finds this acceptable because the monitoring of human performance, which includes maintaining personnel skills and ensuring no safety degradation from modifications to the design, starts after the plant becomes operational and is therefore a COL activity.