ML22193A281

From kanterella
Jump to navigation Jump to search
Shine OL SER Chapter 7.4.9 with No Open Items - Human Factors Engineering
ML22193A281
Person / Time
Site: SHINE Medical Technologies
Issue date: 07/12/2022
From: Gavello M
NRC/NRR/DANU/UNPL
To:
Gavello M
Shared Package
ML22073A179 List:
References
Download: ML22193A281 (16)
v • d • e


Text

7.4.9 Human Factors Engineering The NRC staff evaluated the sufficiency of SHINEs human factors engineering (HFE), as described in SHINE FSAR Chapter 3, Design of Structures, Systems, and Components, Chapter 7, Instrumentation and Control Systems, Chapter 12, Conduct of Operations, and Chapter 13, Accident Analysis, using guidance and acceptance criteria from NUREG-1537, Parts 1 and 2 and the ISG augmenting NUREG-1537, Parts 1 and 2.

The NRC staff reviewed the HFE-related portions of SHINE FSAR Chapters 3, 7, 12, and 13 to assess the sufficiency of the HFE-related design aspects and programmatic considerations for the SHINE facility. To allow for the appropriate scoping and grading of its HFE review, the staff considered the credited operator role in facility safety, including for defense-in-depth (DID),

within the context of the SHINE facility design and operational concept. As part of this review, the staff evaluated the sufficiency of the design criterion for the SHINE facility control room, as well as the ability of the control room to meet the design criterion. Additionally, the staff evaluated whether the control console and display system final design incorporates HFE principles in accordance with relevant guidance. Finally, the staff evaluated whether HFE-related aspects of the administrative controls and management measures programs are sufficient to support the operator role in the safe operation of both the IF and RPF portions of the SHINE facility.

7.4.9.1 SHINE Design Criterion 6 SHINE uses design criteria to ensure that the structures, systems, and components (SSCs) within the SHINE facility demonstrate adequate protection against the hazards present. The design criterion that is within the scope of the NRC staffs HFE review is Criterion 6, Control room, which states:

A control room is provided from which actions can be taken to operate the irradiation units safely under normal conditions and to perform required operator actions under postulated accident conditions.

As part of its HFE review, the NRC staff evaluated the sufficiency of Criterion 6 for the SHINE facility control room, as well as the ability of the control room to, in turn, meet Criterion 6.

In its response to RAI HFE-8 (ADAMS Accession No. ML21288A050), SHINE clarified that it developed Criterion 6 using General Design Criterion (GDC) 19, Control room, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 as a basis. GDC 19 states, in part, that [a] control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions. SHINE explained that the scope of GDC 19 is limited to a nuclear power unit and that SHINEs irradiation units (IUs) represent the closest analog to a nuclear power unit for the SHINE facility. However, SHINE further stated that the scope of Criterion 6, which refers specifically to the IUs, does not limit the scope of the control room functions that are incorporated into the final design of the SHINE facility and that the control 1

room allows for operation of systems and components related both to the IUs in the IF and to the RPF.

Regulatory Guide (RG) 1.232, Revision 0, Guidance for Developing Principal Design Criteria for Non-Light-Water Reactors (ADAMS Accession No. ML17325A611), contains guidance on how the GDC in Appendix A to 10 CFR Part 50 may be adapted for non-light-water reactor designs. This RG includes Advanced Reactor Design Criterion (ARDC) 19, which is comparable to SHINEs Criterion 6 and states, in part, that [a] control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions.

The NRC staff compared SHINE Criterion 6 to GDC 19 and ARDC 19 and determined that it is consistent with the HFE aspects of these criteria with appropriate changes based on differences in technology. Therefore, the staff finds that SHINE Criterion 6 is sufficient to support the safe operation of the SHINE facility with respect to HFE.

7.4.9.2 The Operators Role in SHINE Facility Safety The SHINE FSAR includes the following characterizations concerning the role of humans at the SHINE facility:

  • Manual actuations of automated safety functions are not required to ensure adequate safety of the facility (FSAR Section 7.6.1.1);
  • There are no time constrained operator-required responses (FSAR Section 7.6.2.2.3);
  • Operator action inside the facility is not required to stabilize accident conditions (FSAR Section 13a2.2);
  • Safe shutdown conditions are capable of being achieved without operator actions (FSAR Section 13b.2.3);
  • The main control board, process integrated control system (PICS), and neutron driver assembly system (NDAS) operator workstations and supervisor workstation are not credited with performing safety functions and only assist operators in performance of normal operations or diverse actuations to the safety systems (FSAR Section 7.6);
  • The target solution vessel (TSV) reactivity protection system (TRPS) and the engineered safety features actuation system (ESFAS) are the safety-related control systems for the main production facility (FSAR Section 7.3.1.3.11);
  • Preventative or mitigative controls are identified to reduce the overall risk of the evaluated scenarios to within acceptable limits (FSAR Section 13b.1.2); and
  • The radiological consequences of criticality accidents are not included in the accident analysis because preventative controls are used to ensure criticality events are highly unlikely (FSAR Section 13b.1.2.4).

In its response to RAI HFE-1, SHINE clarified that certain operator actions are credited to prevent or mitigate specific accident sequences and that these credited operator actions (referred to as specific administrative controls (SACs)) occur during routine activities within the 2

facility. SHINE stated that the operator role in facility safety is supported by HFE via implementation of the SHINE HFE Program. This program ensures that the control room and human system interfaces conform to specific style guidance via the use of a checklist that is used to verify that SHINEs HFE design guidelines are met and that the physical installation of systems and components adhere to the HFE design guidelines. SHINE also stated that the operator role in facility safety is supported by procedure development and training programs.

Additionally, SHINE FSAR Section 12.1.3 states that there are no postulated accident sequences that credit operator action to mitigate the consequences of the event after initiation of the event and that should an initiating event of a postulated accident sequence occur, operator actions provide a DID, nonsafety-related, diverse means of actuating components.

SHINE FSAR Section 7.6.3.3 further states that modifications to safety-related instrumentation and control systems after the SHINE facility is in operation will include human factors considerations and that issues related to human factors will be identified and tracked to resolution using the corrective action program.

The NRC staff assessed and confirmed that the role of operators with respect to safety at the SHINE facility is associated with (1) DID actions and (2) the implementation of administrative controls, with the administrative controls themselves not involving mitigative actions for event response. This information was applied to scope the review used to make the regulatory findings in Sections 7.4.9.3, 7.4.9.4, and 7.4.9.5 of this SER.

7.4.9.3 Application of Human Factors Engineering Principles to the SHINE Facility Control Room The NRC staff evaluated the HFE-related acceptance criteria in Section 7.6, Control Console and Display Instruments, of NUREG-1537, Part 2 as they relate to the specifics of the SHINE facilitys design and equipment configuration. The staffs interpretation of these acceptance criteria within the context of the SHINE facility and their evaluation from an HFE perspective is detailed in Sections 7.4.9.3.1 through 7.4.9.3.3 of this SER. Additionally, SHINEs HFE Program, which is also relevant to the evaluation of these acceptance criteria, is evaluated in Section 7.4.9.3.4 of this SER.

7.4.9.3.1 Outputs and Display Devices Observability Acceptance Criterion The NRC staff evaluated the following acceptance criterion in Section 7.6 of NUREG-1537, Part 2 as it relates to the specifics of the SHINE facilitys design and equipment configuration:

The outputs and display devices showing reactor nuclear status should be readily observable by the operator while positioned at the reactor control and manual protection systems.

As explained below, the NRC staff determined that within the context of the SHINE facility, the control systems are the PICS and the NDAS and the protection systems are the TRPS and the ESFAS. The staff then evaluated whether outputs and display devices showing parameters related to SHINE facility safety would be readily observable by the operator while positioned at 3

the SHINE facility control room operator PICS and NDAS workstations and the main control board TRPS and ESFAS manual actuation controls.

The NRC staff reviewed the description of outputs and display devices for parameters related to SHINE facility safety provided in the SHINE FSAR. SHINE FSAR Section 7.6 describes the SHINE facility control room as containing a main control board, two PICS operator workstations, two NDAS workstations, and a supervisor workstation. The operator workstations consist of display screens and human interface equipment, and the main control board consists of a console, static display screens, and manual actuation interfaces.

SHINE FSAR Section 7.6.1.1 states that the main control board static display screens, which show the variables important to the safety functions of the IUs and other facility processes, are located on the upper half of the main control board, aligned in three rows of displays. SHINE FSAR Section 7.6.2.2.3 states that the main control board is readily accessible by operators normally located at either PICS operator workstation. SHINE FSAR Section 7.6.2.2.3 also states that the parameters required to be displayed for TRPS and ESFAS are displayed on the main control board and are accessible from the operator and supervisor workstations. TRPS and ESFAS indications and manual actuation controls are further evaluated in Section 7.4.9.3.2 of this SER.

SHINE FSAR Section 7.6.3.3 further states that the design of the SHINE facility control room, display screens, and operator interfaces incorporates HFE principles by means of the implementation of the SHINE HFE Program. The layout of screens presenting the same set of information at multiple locations is identical at each location (i.e., PICS operator workstation, supervisor workstation, local control station, or main control board). The displays and controls are generally grouped by system to aid the operator in the recognition and operation of the controls. The supervisor workstation is placed and arranged so that the supervisor has a visual of both operator workstations, the displays that the operators are working from, and the main control board. Operator workstations are oriented such that the main control board static display screens are directly in front of the operator workstation. During the audit conducted between November 5, 2020, and May 19, 2021, the NRC staff verified these FSAR statements in part through observing that the HFE design guidelines in SHINEs TECRPT-2020-0018, Human Factors Engineering (HFE) Design Guidelines, include guidelines related to the observability, content, readability, and arrangement of displays. Additionally, the staff observed that those guidelines were based, in part, on portions of NUREG-0700, Revision 2, Human-System Interface Design Review Guidelines, issued May 2002 (ADAMS Accession No. ML021700337).

Based on the above, the NRC staff finds that the applicant has demonstrated that the outputs and display devices observability acceptance criterion in Section 7.6 of NUREG-1537, Part 2 is satisfied because outputs and display devices showing parameters related to SHINE facility safety are readily observable by the operator while positioned at the SHINE facility control room PICS and NDAS operator workstations and at the main control board TRPS and ESFAS manual 4

actuation controls. This finding is further supported by SHINEs HFE Program, which is evaluated in Section 7.4.9.3.4 of this SER.

7.4.9.3.2 Accessibility/Understandability of Important Controls and Displays Acceptance Criterion The NRC staff evaluated the following acceptance criterion in Section 7.6 of NUREG-1537, Part 2 as it relates to the specifics of the SHINE facilitys design and equipment configuration:

Other controls and displays of important parameters that the operator should monitor to keep parameters within a limiting value, and those which can affect the reactivity of the core should be readily accessible and understandable to the reactor operator.

As explained below, the NRC staff determined that within the context of the SHINE facility, other controls and displays of important parameters that the operator should monitor to keep parameters within a limiting value, and those that can affect reactivity, are readily accessible and understandable to the operator.

Other Controls and Displays (Not Specific to Manual Protective Actions)

The NRC staff reviewed the description in the SHINE FSAR of other SHINE facility control room controls and displays of important parameters. SHINE FSAR Section 7.6.2.2.7 states that the design of the SHINE facility control room, display screens, and operator interfaces incorporates HFE principles. Displays that an operator may use to perform a task are placed such that they are visible from the operator workstation, with the displays most frequently used placed closest to the operator. The supervisor workstation is placed and arranged so that the supervisor can see both operator workstations, the displays that the operators are working from, and the main control board. SHINE FSAR Section 7.6.3.1 describes the supervisor workstation as providing displays so that the supervisor can select and monitor the appropriate screen applicable to the current tasks being performed by the operator. SHINE FSAR Section 7.6.1.2 describes that there are four desks that make up the main operator workstations, centrally located in front of the main control board, which has TRPS and ESFAS indications and manual actuation controls; the two outermost desks are designated as PICS workstations and the two inner desks are NDAS control stations. SHINE FSAR Section 7.6.4.1 describes what displays of information related to the operation of the main production facility are available to the operator on the workstations and the main control board. The displays at each of the operator workstations, supervisor workstation, and main control board are digital displays. Displays are programmed such that the range of the displayed information includes the expected range of variation of the monitored variable.

SHINE FSAR Section 7.1.1 describes the PICS as being a nonsafety-related, distributed digital control system that provides monitoring and control of the various processes throughout the SHINE facility. The PICS includes system controls, both automated and manual, and human system interfaces (HSIs) necessary to provide the operator interaction with the necessary 5

process control mechanism. The functions of the PICS enable the operator to perform irradiation cycles, transfer target solution to and from the IU, as well as throughout the RPF, and interface with the tritium purification system (TPS), processes in the supercell, waste handling operations, and the auxiliary systems. SHINE FSAR Section 7.6.4.1 states that values on each PICS display screen are automatically updated as more current data becomes available.

Section 7.6.4.1 also states that each PICS display screen presented on the operator workstation has a title or header and unique identification to distinguish each display page. SHINE FSAR Section 7.6.4.3 states that manual controls are provided on both of the PICS operator workstations (via input to the PICS) and on the main control board, with controls for normal operation provided at the operator workstations. Multiple equipment control displays are set up at each operator workstation for operators to select the PICS (or NDAS) display screen that coincides with the task that the operator is currently performing. Operators interface with the equipment control displays through a keyboard and mouse provided at each operator workstation. SHINE FSAR Section 7.6.4.3 also states that on a failure of one PICS operator workstation, the control functions assigned to that station can be transferred to the remaining PICS operator workstation or to the supervisor workstation.

SHINE FSAR Section 7.6.4.3 states that an enable nonsafety switch is in each main control board section next to the manual push buttons to allow the operator to control actuation components or to reset the safety-related control systems using the PICS following the actuation of a protective function. The enable nonsafety switch is described as a two-position switch with Enable and Disable positions. Additionally, a single manual key switch is located at the facility process section of the main control board below the static display screens to provide the operators the ability to place the facility into the Facility Secure state. This switch is described as having two positions of operation: Secured and Operating.

Additionally, SHINE FSAR Section 7.6.4.1 states that each of the variables associated with TRPS and ESFAS are continuously displayed on the static displays of the main control board.

The position indication of actuation components associated with TRPS and ESFAS are also available on the static display screens. Variables available to the PICS, including variables associated with TRPS and ESFAS, are available for display on the various PICS displays at the operator workstations and supervisor workstation. Display of interlock and bypass status is available on each of the PICS displays of the equipment control display screens for the equipment or instrument channel that has been bypassed. Bypassed channels for the safety systems are also visible on the maintenance workstation. Additionally, the variables displayed at the PICS operator workstation displays include both those that would be associated with a breach of the primary system boundary and those that would be used in determining and assessing the magnitude of a radioactive material release.

SHINE FSAR Section 7.6.3.1 describes the NDAS control stations as displaying variables associated with the neutron drivers located in each IU. SHINE FSAR Section 7.3.1.1.5 states that the NDAS control system also allows the operator to manually adjust the deuterium beam, control the ion source, manually start and stop various system auxiliaries, and open and close NDAS system valves. The operator uses PICS to provide signals to manually open or close the 6

neutron driver high voltage power supply breakers to meet TRPS mode transition criteria and allow the beam to be energized. The operator is able to use the PICS to manually open and close individual valves that are capable of being actuated by TRPS. SHINE FSAR Section 7.6.4.3 states that while the NDAS control stations can each provide control of any of the eight neutron drivers, each NDAS control station can only provide control commands to one neutron driver at any given time.

SHINE FSAR Section 7.3.1.1.6 states that the neutron flux detection system (NFDS) monitors the neutron flux in the IU during TSV fill and irradiation. Furthermore, SHINE FSAR Section 7.8.3.9 states that the NFDS provides source range, wide range, and power range neutron flux signals to the TRPS to transmit to the PICS for display to the operator. SHINE FSAR Section 7.8.1 states that the NFDS performs the task of monitoring and indicating the neutron flux to determine the multiplication factor and power level during filling of the TSV and irradiating the target solution. The NFDS also provides continuous indication of the neutron flux during operation, from filling through maximum power during irradiation.

Finally, SHINE FSAR Section 7.6.4.1 states that radiation monitoring information is conveyed from the radiation monitoring instruments to the PICS and displayed in the SHINE facility control room, where it is available on demand at the operator workstations. SHINE FSAR Section 7.7.1.1 further states that information from safety-related process radiation monitors is displayed in the SHINE facility control room on the operator workstations via PICS. SHINE FSAR Section 7.7.1.3.6 states that selection and display of process radiation monitor variables are designed with consideration of HFE principles.

During the audit conducted between November 5, 2020, and May 19, 2021, the NRC staff verified these FSAR statements in part through observing that the HFE design guidelines in SHINEs TECRPT-2020-0018 include guidelines related to the accessibility of controls and displays, as well as guidelines associated with the understandability of displays. Additionally, the staff observed that those guidelines were based, in part, on portions of NUREG-0700, Revision 2.

Other Controls and Displays (Specific to Manual Protective Actions)

The NRC staff also considered controls used for the manual initiation of protective actions under the accessibility and understandability acceptance criterion in Section 7.6 of NUREG-1537, Part

2. SHINE FSAR Section 7.3.1.3.11 states that the TRPS and ESFAS are the safety-related control systems for the main production facility. Therefore, the staff evaluated the applicants description of how the SHINE HSI supports the operators role in DID by implementing the manual initiation of protective actions that are automatically actuated by the TRPS and ESFAS.

SHINE FSAR Section 7.4.3.7 states that the TRPS provides manual actuation capabilities via individual manual push buttons for each TRPS subsystem (i.e., IU Cell Safety Actuation, IU Cell Nitrogen Purge, and Driver Dropout). Both TRPS divisions (i.e., A and B) respond to the activation of a push button. Furthermore, a manual IU Cell TPS actuation on all eight TRPS 7

subsystems is initiated via the manual TPS Isolation push button located on the ESFAS main control board panel. To support the use of manual safety actuations, the TRPS subsystem associated with each IU cell includes outputs for each safety-related instrument channel to provide monitoring and indication information to the PICS. To facilitate operator indication of mode control status, TRPS actuation function status, manual initiation, and reset of protective actions, the TRPS, at the division level, includes indication of TRPS variable values, parameter values, logic status, equipment status, actuation device status, and mode. SHINE FSAR Section 7.4.2.2.14 states that human factors are a design consideration for development of the TRPS and that changes to the design throughout the lifecycle process include human factors considerations. The TRPS provides manual safety actuation capability that is supported by human factors design and to support the use of manual safety actuations, the TRPS associated with each IU includes isolated outputs for each safety-related instrument channel to provide monitoring and indication information to the PICS.

SHINE FSAR Section 7.5.3.6 states that the ESFAS provides manual actuation capabilities for safety functions (i.e., RCA [radiologically controlled area] Isolation, Supercell Isolation, Vacuum Transfer System Actuation, TPS Isolation, Carbon Delay Bed Group 1, 2, and 3 Isolations, Extraction Column A, B, and C Alignment Actuations, Iodine and Xenon Purification Alignment Actuation, RPF Nitrogen Purge, and Dissolution Tank Isolation) via manual push buttons located on the main control board. To support the use of manual actuations, the ESFAS includes isolated outputs for each safety-related instrument channel to provide monitoring and indication information to the PICS. To facilitate operator indication of ESFAS actuation function status, manual initiation, and reset of protective actions, the ESFAS, at the division level, includes indication of ESFAS variable values, parameter values, logic status, equipment status, and actuation device status. SHINE FSAR Section 7.5.2.2.14 states that human factors are a design consideration for development of the ESFAS and that changes to the design throughout the lifecycle process include human factors considerations. SHINE FSAR Section 7.5.2.2.14 also states that the ESFAS provides manual safety actuation capability that is supported by human factors design and that to support the use of manual safety actuations, the ESFAS includes isolated outputs for each safety-related instrument channel to provide monitoring and indication information to the PICS.

Additionally, SHINE FSAR Section 7.6.3.1 states that each IU-specific set of static display screens on the main control board indicates variables important for verifying proper operation of safety systems following automatic actuation of the TRPS. Similarly, the facility process set of static display screens indicates variables important for verifying proper operation of safety systems used in other facility systems following automatic actuation of the ESFAS. Each set of static display screens on the main control board is used to support an operator in performing manual actuation of a safety function. Manual actuations are performed from the main control board, where the static display screens are visible from the manual actuation push buttons.

SHINE FSAR Section 7.6.4.1 states that each of the variables associated with TRPS and ESFAS is continuously displayed on the static displays of the main control board, with the position indication of actuation components associated with TRPS and ESFAS also being available on the static display screens.

8

In its response to RAI 7-13 (ADAMS Accession No. ML21239A049), SHINE stated, in part, that the TRPS and ESFAS information displayed in the SHINE facility control room includes mode and fault status for each Highly Integrated Protection System module, the status and value of the monitored variables identified in SHINE FSAR Tables 7.4-1 and 7.5-1, Trip/Bypass switch status, divisional partial and full trip determination status, TRPS IU cell operational mode status, actuation output and fault status, and actuated component position feedback status. SHINE stated that this will enable operators to determine if manual actuation of a safety function is necessary by providing information on TRPS and ESFAS monitored variables, as well as on the status of those systems themselves. Additionally, SHINE stated that TRPS and ESFAS information will be provided to operators via the PICS workstations in the SHINE facility control room, with a subset of the TRPS and ESFAS monitoring and indication information also being displayed at the main control board thus providing this information at multiple locations in the control room (including near the manual controls for actuating TRPS and ESFAS equipment);

SHINE described this as being intended to ensure that operators will have the information needed to support manual actions.

Furthermore, SHINE FSAR Section 7.6.4.3 states that manual controls for the safety-related TRPS and ESAFS protective functions are located at the main control board and that these nonsafety manual push buttons provide a diverse actuation to the automatically generated safety actuations. SHINE FSAR Section 7.6.3.3 states that the manual actuation push buttons are located directly below the static display screens so that the operator can be directly monitoring the variables important to the safe operation of the facility when the manual actuation is performed. SHINE stated that the use of push buttons of the same product line ensures consistency in look and function. These push buttons also include a positive position indication and a protective guard to prevent inadvertent actuation.

The NRC staff finds that the applicant has demonstrated that the HSI will be capable of supporting the manual initiation of protective actions because displays and controls will be available in the SHINE facility control room for the manual, system-level actuation of safety functions and for monitoring those parameters that support them.

Conclusion on Other Controls and Displays Based on the above, the NRC staff finds that the applicant has demonstrated that the accessibility and understandability of other controls and displays acceptance criterion in Section 7.6 of NUREG-1537, Part 2 is satisfied because SHINE facility control room controls and displays of important parameters that the operator should monitor to keep parameters within a limiting value, and those that can affect reactivity, are readily accessible and understandable to the operator. This finding is further supported by SHINEs HFE Program, which is evaluated in Section 7.4.9.3.4 of this SER.

7.4.9.3.3 Control Console Annunciators and Alarms Acceptance Criterion 9

The NRC staff evaluated the following acceptance criterion in Section 7.6 of NUREG-1537, Part 2 as it relates to the specifics of the SHINE facilitys design and equipment configuration:

Annunciators or alarms on the control console should clearly show the status of systems such as operating systems, interlocks, [engineered safety features] initiation, radiation fields and concentration, and confinement or containment status.

As explained below, the NRC staff determined that within the context of the SHINE facility, the annunciators and alarms on the control console clearly show the status of systems such as operating systems, interlocks, TRPS and ESFAS initiation, radiation fields and concentration, and confinement.

SHINE FSAR Section 7.6.4.2 states that alarms are integrated into the PICS display systems.

The operator workstations provide detailed visual alarms to the operator to represent unfavorable status of the facility systems. Indications at the operator workstation are provided as visual feedback as well as visual features to indicate that systems are operating properly.

Indication of alarms present is also provided for each IU and for the facility process systems at the main control board.

Additionally, SHINE FSAR Section 7.6.3.1 states that the PICS operator workstations have multiple equipment control display screens available to support normal control functions and to provide indication of alarms. SHINE FSAR Section 7.6.1.2 states that one of the screens at the PICS workstation is used to display the alarms present in the facility. This screen is designated as monitoring only so that, when an alarm is present, the screen automatically changes the content displayed to the current alarms that are present without interrupting a control process.

The remaining screens can be used for control or monitoring as the operator tasks demand.

SHINE FSAR Section 7.3.1.3.11 states that the PICS receives input from the TRPS and ESFAS and provides alarms related to the status and functionality of the safety-related control systems (e.g., communication errors, faulted modules, failed power supplies).

Furthermore, SHINE FSAR Section 7.1.6 states that radiation monitoring is used to monitor radiation levels within, and airborne effluent streams from, the SHINE facility and provides alarms for personnel within the facility and the control room. Area radiation monitoring and local alarms within the general areas of the facility RCA are provided by the radiation area monitoring system, which provides signals to the control room to inform operators of abnormal conditions within the facility. Airborne contamination monitoring within general areas of the RCA is performed by the continuous air monitoring system, which provides both local alarms and signals to the control room to inform operators of the occurrence and approximate location of abnormal conditions. SHINE FSAR Section 7.6.1.5 states that the control room also contains a criticality accident alarm system (CAAS) panel for processing alarms and monitoring the status of the CAAS, as well as a fire control panel for monitoring facility fire alarms from the facility fire protection system.

10

In its response to RAI HFE-3, SHINE clarified that stacklights, which produce audible alarm sounds and are programmed to represent both IU and non-IU alarms, are part of the control room and are evaluated with respect to HFE design guidelines both as part of initial installation and during future modifications. SHINE identified the following conditions as causing audible alarms: ESFAS actuation, TRPS actuation, high radiation or contamination levels, loss of electrical power, and improper transfer of target solution. SHINE also revised SHINE FSAR Section 7.6.4.2 to provide additional description of control room alarms. Specifically, SHINE described that configurable stacklights are mounted above the main control board to provide audible and visual alarm indications. Alarms are provided to inform the operator of off-normal operating system status, interlocks, engineered safety feature initiations, confinement status, and radiation fields and concentration.

During the audit conducted between November 5, 2020, and May 19, 2021, the NRC staff verified these applicant statements in part through observing that the HFE design guidelines in SHINEs TECRPT-2020-0018 include guidelines related to the design of alarms. Additionally, the staff observed that those guidelines were based, in part, on portions of NUREG-0700, Revision 2.

Based on the above, the NRC staff finds that the applicant has demonstrated that the control console annunciators and alarms acceptance criterion in Section 7.6 of NUREG-1537, Part 2 is satisfied because annunciators and alarms on the control console clearly show the status of systems such as operating systems, interlocks, TRPS and ESFAS initiation, radiation fields and concentration, and confinement. This finding is further supported by SHINEs HFE Program, which is evaluated in Section 7.4.9.3.4 of this SER.

7.4.9.3.4 SHINEs Human Factors Engineering Program The NRC staff evaluated SHINEs HFE Program and the way in which it is utilized. To support this evaluation, a regulatory audit was used to supplement the staffs understanding of the scope and nature of SHINEs HFE Program.

During the audit conducted between November 5, 2020, and May 19, 2021, the NRC staff verified the assertions in the SHINE FSAR that SHINE has an HFE program. The staff considered various aspects of SHINEs HFE Program that provide programmatic evidence that SHINE facility control room HSIs have been designed and evaluated in accordance with accepted human factors methods. Specifically, the staff noted that SHINEs HFE Program both establishes HFE design guidelines and implements a checklist-based process for verifying specific HFE attributes during equipment design, and then again following equipment installation. Further observations made regarding the specific content of SHINEs HFE Program, design guidelines, and associated checklists are documented in an audit report (ADAMS Accession No. ML22124A073).

SHINE FSAR Section 7.6.3.3 states that human factors is a design consideration for the TRPS and ESFAS systems, that modifications to safety-related instrumentation and control systems 11

after the SHINE facility is in operation will include human factors considerations, and that human factors issues are identified and tracked to resolution using the corrective action program.

The NRC staff finds that SHINE has elected to incorporate certain programmatic elements that include comparing the characteristics of HSIs with HFE guidelines, determining whether the HSI is acceptable according to those guidelines, and tracking and evaluating identified discrepancies. The use of an HFE style guide and checklists helps ensure that HSIs are designed, manufactured, and installed consistent with appropriate human factors principles, thereby supporting the ability of operators to safely operate the facility as required by SHINE Criterion 6. The staff also finds that these programmatic elements will be applicable to changes that are made to the safety-related TRPS and ESFAS systems throughout the lifecycle of the facility.

Based on the technical evaluations described in Sections 7.4.9.3.1 through 7.4.9.3.4 of this SE, the NRC staff finds that the applicant has demonstrated that the applicable acceptance criteria in Section 7.6 of NUREG-1537, Part 2 for the observability of outputs and display devices, for the accessibility and understandability of important controls and displays, and for control console annunciators and alarms are satisfied. Furthermore, the staff finds that SHINEs HFE Program supports the satisfaction of these acceptance criteria. Therefore, the staff concludes that SHINE has appropriately applied HFE principles to the SHINE facility control room.

7.4.9.4 Review Findings for Sections 7.4.9.1 through 7.4.9.3 In Sections 7.4.9.1 through 7.4.9.3 of this SER, the NRC staff evaluated the sufficiency of SHINE Criterion 6 for the SHINE facility control room, as well as the ability of the control room to meet this criterion, and whether the control console and display system final design incorporates HFE principles in accordance with relevant guidance. Based on these evaluations, the staff finds that:

  • The applicant has shown that all nuclear and process parameters important to safe and effective operation of the SHINE facility will be displayed at the control console. The display devices for these parameters are easily understood and readily observable by an operator positioned at the facility controls and the controls are readily accessible.
  • The annunciator and alarm panels on the control console provide assurance of the operability of systems important to safe facility operation.
  • The HSI supports the manual initiation of protective actions at the system level for safety systems and provides displays and controls in the SHINE facility control room for manual, system-level actuation of safety functions, and for monitoring those parameters that support them.

The NRC staff therefore finds that the SHINE operators DID role of manually actuating safety-related systems is reasonably supported by HFE principles and, furthermore, that the HFE-related aspects of SHINE Criterion 6 are met.

12

7.4.9.5 Administrative Controls Review The NRC staff also evaluated the HFE-related aspects of SHINEs administrative controls.

SHINE FSAR Section 13b.1.2 states that accident scenarios that presented potential consequences above the appropriate evaluation guidelines for worker or public exposure were subjected to preventative or mitigative controls to reduce the overall risk to within acceptable limits. SHINE FSAR Section 13b.1.2.4 states that nuclear criticality safety in the RPF is accomplished by using criticality safety controls to prevent criticality during normal and abnormal conditions and, furthermore, that the radiological consequences of criticality accidents are not included in the accident analysis because preventative controls are used to ensure that criticality events are highly unlikely. To adequately evaluate the applicable acceptance criteria of NUREG-1537, Part 2 and the ISG augmenting NUREG-1537, Part 2 for management measures that support the reliability of administrative controls, the staff determined that it was appropriate to supplement these criteria with relevant guidance from NUREG-1520, Revision 2, Standard Review Plan for Fuel Cycle Facilities License Applications (ADAMS Accession No. ML15176A258). Specifically, Section 11, Management Measures, of NUREG-1520 was consulted for general guidance regarding appropriate areas for evaluation.

During the audit conducted between November 5, 2020, and May 19, 2021, the NRC staff verified the SHINE FSAR statements regarding administrative controls related to HFE in part through observing that the SACs and Enhanced SACs identified by the applicant generally appeared to be comprised of activities in which procedures and training would constitute important, as well as cross-cutting, considerations. The staff noted that the SACs appeared to take place in a variety of plant locations and as such would not commonly be associated with any given HSI. Therefore, the staff determined that a scoped and graded review approach that focuses on the general ability of the applicants procedures and training programs to support the reliable implementation of the administrative controls was appropriate. In implementing this review, the staff considered the guidance of NUREG-1520 in conjunction with the acceptance criteria of NUREG-1537, Part 2, and the ISG augmenting NUREG-1537, Part 2, Sections 12.1 and 12.3. Sections 7.4.9.5.1 and 7.4.9.5.2 of this SE present the staffs resultant evaluation, from an HFE perspective, of SHINEs administrative controls by procedures and training, respectively.

7.4.9.5.1 Procedures Management Program Support of Administrative Controls The NRC staff evaluated whether the ability of SHINE operators to reliably implement administrative controls was adequately supported by SHINEs program for managing procedures. The staff informed this evaluation using areas described in NUREG-1520, Section 11.3 and considered the following:

  • The process for the preparation, use, and management control of written procedures;
  • The method for verifying and validating procedures before use; and
  • The method for ensuring that current procedures are available to personnel.

13

In its response to RAI HFE-6, SHINE provided clarification that SACs are specifically defined, safety-related, administrative controls that are credited within the SHINE safety analysis. The SACs themselves are incorporated into facility procedures. SHINE further clarified that the SHINE HFE Program does not address programmatic administrative controls (i.e., management measures), but that programmatic administrative controls, such as procedures and training, serve to ensure that operators are provided with procedures and trained as needed to ensure the reliability of SACs.

SHINE FSAR Section 12.3 states that procedures for the operation and use of the SHINE facility are written, reviewed, and approved by appropriate management and are controlled and monitored to ensure that the content is technically correct and the wording and format are clear and concise. The process required to make changes to procedures, including substantive and minor permanent changes, and temporary deviations to accommodate special or unusual circumstances during operation conforms to ANSI/ANS 15.1-2007, The Development of Technical Specifications for Research Reactors. Additionally, SHINE will prepare, review, and approve written procedures for topics including administrative controls for operations and maintenance and for the conduct of irradiations that could affect nuclear safety. The extent of detail in a procedure is dependent on the complexity of the task; the experience, education, and training of the users; and the potential significance of the consequences of error. The process for making changes and revisions to procedures is documented; a controlled copy of all operations procedures is maintained in the control room; and tasks are performed in accordance with approved implementing procedures.

In its response to RAI HFE-6, SHINE clarified that procedures are written and reviewed by operations personnel under the SHINE operating procedure development process. Procedures that include SACs are specifically reviewed by the Review and Audit Committee (described in SHINE FSAR Section 12.2). Following these review processes, procedures are also verified and validated prior to issuance for use within the facility. Procedures that implement SACs are verified and validated to be technically accurate, comprehensive, explicit, and easy to use, such that assumptions made about the reliability of SACs in the SHINE safety analysis are supported via these processes.

Based on the above, the NRC staff finds that the applicant has demonstrated that the combination of processes used for the preparation, use, and management control of written procedures; the methods used for verifying and validating procedures before use; and the methods used for ensuring that current procedures are available to personnel supports the ability of SHINE operators to reliably implement administrative controls. Therefore, the staff concludes that the applicants procedures management program adequately supports the implementation of administrative controls.

7.4.9.5.2 Training and Qualification Program Support of Administrative Controls 14

The NRC staff evaluated whether the ability of SHINE operators to reliably implement administrative controls was adequately supported by SHINEs training and qualification program. The staff informed this evaluation using areas described in NUREG-1520, Section 11.3 and considered the following:

  • Provisions for the initial training of personnel;
  • Personnel qualifications; and
  • Provisions for the retraining of personnel.

SHINE FSAR Section 12.10 states that the initial training program for operators was developed to conform to the requirements of 10 CFR Part 55, as it pertains to non-power facilities, following the guidance of ANSI/ANS 15.4-2016, Selection and Training of Personnel for Research Reactors. The initial training program also contains, in part, the additional topics of criticality control features and management measures required for processes involving Special Nuclear Material (SNM). During the audit conducted between November 5, 2020, and May 19, 2021, the NRC staff verified the SHINE FSAR statements regarding operator training in part through observing that both the operator initial and requalification training programs included training within the areas of design features (theory and principles of the radioisotope production process involving SNM, theory and principles of the radioisotope extraction and purification process, critical control features and management measures required for each process involving SNM), reactivity, alterations and control systems, and uranium handling.

In its response to RAI HFE-6, SHINE clarified that the operator training program ensures that individuals are trained in the knowledge, skills, and abilities needed to conduct assigned activities. The operator training program utilizes a systems approach to training, with the implementation and evaluation of the program including elements of self-study, classroom, mentoring, and simulation.

Based on the above, the NRC staff finds that the applicant has demonstrated that the combination of provisions for the initial training of personnel, personnel qualifications, and the retraining of personnel supports the ability of SHINE operators to reliably implement administrative controls. Therefore, the staff concludes that the applicants training and qualification program adequately supports the implementation of administrative controls.

7.4.9.6 Conclusion The NRC staff finds that the applicant has demonstrated that SHINE Criterion 6 is sufficient to support the safe operation of the SHINE facility with respect to HFE and that the HFE-related design aspects and programmatic considerations for the SHINE facility meet the HFE-related aspects of Criterion 6 because, within the specific context of the operator role in safety at the SHINE facility, operators will reasonably be able to take actions to control the facility; be provided with controls designed to support safe actions; have sufficient knowledge about the status of the facility; be able to make decisions about the appropriate course of action given a 15

particular operating circumstance; and be provided with indications, displays, alarms, and controls that are designed to reflect cognitive needs.

The NRC staff finds that the applicant has demonstrated that the HFE-related design aspects of the SHINE facility control console and display instruments are acceptable because all nuclear and process parameters important to safe and effective operation of the SHINE facility will be displayed at the control console, the display devices for these parameters are easily understood and readily observable by an operator positioned at the facility controls, the controls are readily accessible, and the annunciator and alarm panels on the control console provide assurance of the operability of systems important to safe facility operation. Furthermore, within the specific context of the operator role in safety at the SHINE facility, the applicant has demonstrated that the HSI supports the manual initiation of protective actions for safety systems and provides displays and controls for manual actuation of safety functions and for monitoring those parameters that support them. Therefore, the staff concludes that the requirement of 10 CFR 50.34(b) for an operating license application to include a final analysis and evaluation of the structures, systems, and components of the facility showing that safety functions will be accomplished is met within the context of the HFE-related aspects of Criterion 6.

The NRC staff finds that the applicant has demonstrated that the HFE-related programmatic considerations for the SHINE facility, specifically, the programs for procedures management and training and qualification, are acceptable, within the specific context of the operator role in safety at the SHINE facility, because they reasonably support the ability of SHINE operators to reliably implement administrative controls at the facility. Therefore, the staff concludes that the requirement of 10 CFR 50.57(a)(3) for reasonable assurance that activities authorized by the operating license can be conducted without endangering the health and safety of the public is supported by the application of HFE measures within the context of administrative controls.

16

Retrieved from "https://kanterella.com/w/index.php?title=ML22193A281&oldid=3448959"