ML24019A002

From kanterella
Jump to navigation Jump to search
Sdaa Chapter 18, Human Factors Engineering, SE with No Open Items
ML24019A002
Person / Time
Site: 05200050
Issue date: 08/19/2024
From: Hayden T
NRC/NRR/DNRL/NRLB
To:
References
Download: ML24019A002 (57)
v • d • e


Text

18 HUMAN FACTORS ENGINEERING

This chapter of the safety evaluation report (SER) documents the U.S. Nuclear Regulatory Commission (NRC) staffs review of Chapter 18, Human Factors Engineering, of the NuScale Power, LLC (the applicant), Standard Design Approval Application (SDAA), Part 2, Final Safety Analysis Report (FSAR), for the US460 standard plant design. The staffs regulatory findings documented in this report are based on Revision 1 of the US460 FSAR, dated October 31, 2023 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML23304A372).

The staff used NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), Chapter 18, Revision 3, Human Factors Engineering, issued December 2016 (ML16125A114), to verify that the applicant is using a state-of-the-art human factors design process. Consistent with SRP Chapter 18, the staff compared the application to the relevant 1 review criteria in NUREG-0711, Revision 3, Human Factors Engineering Program Review Model, issued November 2012 (ML12324A013), to determine whether the application complies with the human factors engineering (HFE) regulations cited under the Regulatory Basis subsections of this SER. As stated in NUREG-0711, Rev. 3 (at ix and 1), that guidance document is used by the NRC staff in its reviews of HFE programs for construction permits, operating licenses, standard design certifications, combined operating licenses, and license amendments. Although NUREG-0711, Rev. 3, does not discuss its applicability to standard desi gn approvals (SDAs), the NRC staff has used NUREG-0711 in the staffs HFE reviews for SDA applications.

In general, the staffs review considers the following:

  • statements in the SDAA and IPs that describe human factors methodologies and control various human factors design activities.
  • results of an audit (audit plan issued on March 22, 2023 - ML23067A300) that evaluated the outcomes of human factors activities and the adherence of the applicant to processes described in the SDAA and the IPs.
  • final results of HFE activities as described in RSRs, where available.
  • the SDA applicants identification of combined license (COL) items for a COL applicant to address designated HFE activities that do not need to be reviewed prior to NRC approval of the SDA.
  • Inspections, tests, analyses, and acceptance criteria (ITAAC) to confirm that the final design has incorporated HFE principles (e.g., through completion of activities described in the IPs) and minimizes the potential for operator error. ITAAC will also be used to ensure that the results of these activities support the conclusion that the operators can maintain plant safety.

1 Not all review criteria in NUREG-0711 are relevant to an SDAA. For example, some criteria are relevant only to licensees that are modifying a control room design at an operating reactor. Those criteria are identified in NUREG-0711 but are not included in this report.

18-1 As discussed in this SER, although the US460 HFE design is not yet complete, the staff finds that the NuScale US460 control room design process reflects state-of-the art human factors principles and provides reasonable assurance that the final HFE design will comply with applicable requirements in 10 CFR 52.137(a)(8), 50.34(f)(2)(iii), and other regulatory provisions discussed herein. In making this determination, the staff conducted an in-depth review of NuScales HFE program as described in Ch 18 of the SDAA and a series of documents that NuScale submitted to support Chapter 18, including:

  • Results summary reports (RSRs) - documents that summarize the results of an SDA applicants conformance to a particular NUREG-0711 element and include a brief description of the methodology used to derive the results.
  • Implementation plans (IPs) - documents that describe a methodology for completing a NUREG-0711 element. IPs are submitted for work that is not complete at the time of the SDA application. IPs must be followed by the submittal of an RSR for most NUREG-0711 review elements to show that the associated activities are complete.

RSRs are not necessary for the NUREG-0711 elements that are programmatic, including HFE program management, human per formance monitoring (HPM), procedure development, and training program development. As stated in the Applicant Products and Submittals subsections for the non-programmatic elements in NUREG-0711, Rev.

3, the applicant is to submit the RSR when the work described in the IP is completed.

The timing for completion of the elements and submittal of the RSRs is not prescribed by the NRC or tied to any particular licensing step. However, given that (1) to ensure completion of an HFE element where only an IP was submitted, NUREG-0711 establishes the need for an associated ITAAC, and (2) as stated in 10 CFR 52.103(g),

the licensee shall not operate the facility until the Commission makes a finding that the ITAAC in the combined license are met, except for those acceptance criteria that the Commission found were met under § 52.97(a)(2). the NRC staff concludes that RSRs must be submitted before the NRC makes a 10 CFR 52.103(g) finding. Accordingly, a COL licensee that references the NuScale US460 SDA should make the RSRs for non-programmatic elements available for NRC staff review prior to fuel load and/or during any ITAAC inspections to allow verification that the non-programmatic HFE elements are complete.

As discussed in Chapter 1 above, NuScale has requested that its US460 SDA application be approved for use by COL applicants that reference the SDA in a 10 CFR Part 52 COL application. The NRCs regulations contemplate the use of ITAAC for COL applications, which may be used to verify the acceptability of the final HFE design.

Accordingly, in evaluating the NuScale HFE design, the staff considered use of the SDA design by Part 52 COL applicants and licensees only. The NRC reserves the right to determine in what manner the SDA may be referenced or utilized by an applicant for a construction permit or operating license under 10 CFR Part 50.

As stated in NUREG-0711, Rev. 3 (at 4), IPs are a main basis for the NRCs safety findings for incomplete HFE activities. To determine whether an IP is acceptable, the NRC staff evaluates whether the IP is complete, detailed, and verifiable. NUREG-0711, Section 1.2.2, provides additional guidance to the staff for how submittals using IPs are to be treated. It states the following:

18-2 When the final results for an HFE element are not available for the review, the NRC staff accepts implementation plans (IP) for HFE activities as the basis for making a safety finding for a particular plant design. However, when an applicant uses an IP for design certification, an associated set of ITAAC is required to ensure completion of the HFE element in accordance with the IP.

For instance, the applicant did not submit an HSI Design RSR, and the SDAA does not include a specific ITAAC for the completion of HSI design. During the August 2023 audit (ML23067A300), the staff asked how the NRC staff can be sure that the HFE elements will be complete in accordance with the IPs for operating experience review (OER), functional requirements analysis/function allocation (FRA/FA), task analysis (TA), HSI design, and Verification and Validation (V&V). NuScale responded that the HFE program for the SDAA concludes with design implementation (DI) and that, as detailed in the PMP, DI cannot occur without the completion of the other HFE elements. The DI activity for the NuScale SDAA has an associated ITAAC 03.15.01 to verify its completion, and this also ensures completion of the other elements (ML23304A498). The staff finds that this approach is acceptable as the proposed ITAAC meets the criteria for an associated ITAAC.

The staffs safety evaluation is organized into twelve subsections, each of which corresponds to one of the 12 elements in NUREG-0711.The elements are HFE activities that, when integrated and completed, will result in a control room design that reflects state-of-the-art human factors principles as well as inputs for a COL applicants use in the development of applicable operational programs.

When the NuScale SDAA was docketed, it included RS Rs for HFE activities that were complete, and IPs for HFE activities that were not yet complete. For the incomplete HFE activities, the staff reviewed NuScales methodology for conducting the HFE activity, as detailed in the SDAA, an implementation plan (IP), and the HFE ITAAC proposed in the SDAA.

SDAA Part 8, License Conditions; Inspections, Tests, Analyses and Acceptance Criteria, Section 3.15, Human Factors Engineering, Table 3.15-1, Human Factors Engineering Inspections, Tests, Analyses, and Acceptance Criteria, includes two ITAAC for the US460 HFE design: ITAAC 03.15.01 and ITAAC 03.15.02, which state as follows:

No. Design Commitment Inspections, Tests, Acceptance Criteria Analyses The configuration of the main A report exists and concludes the as-control room HSI is consistent An inspection will be built configuration of the main control with the design verified and performed of the as-built room HSI is consistent with the design 03.15.01 validated by the integrated configuration of the main verified and validated by the system validation as reconciled control room HSI. integrated system validation as by the Design Implementation reconciled by the Design Plan. Implementation-Implementation Plan.

An integrated system A report exists and concludes that The MCR design incorporates validation (ISV) test is acceptance criteria associated with 03.15.02 HFE principles that reduce the performed in accordance each ISV test scenario are satisfied potential for operator error. with the Verification and upon initial performance of the Validation Implementation scenarios or upon remediation of Plan. failures.

Though not directly referred to as Design Acceptance Criteria (DAC) in the SDAA, the staff considers HFE ITAAC No. 03.15.02 for the ISV test to be a DAC approach to finalizing the HFE design of the main control room after the SDA licensing process is complete. The staffs 18-3 conclusions regarding the applicants proposed HFE ITAAC are provided in Section 14.3.9, Human Factors EngineeringInspections, Tests, Analyses, and Acceptance Criteria of this SE. In brief, the HFE ITAAC include (1) a requirement for verification and validation of the main control room (MCR) design, through the performance of an inspection of the as-built configuration of the MCR HSI (ITAAC 03.15.01) and (2) a DAC ITAAC to ensure that the final control room design, culminating from the combined results of the various HFE activities, supports the conclusion that the operators can maintain plant safety. ITAAC 03.15.02 requires completion of the integrated systems validation (ISV) test; acceptance criteria for the ISV test are discussed in the applicants Verification and Validation (V&V) IP. As discussed in Section 18.11.4 of this SER, the staff has concluded that the acceptance criteria discussed in the Verification and Validation IP conform to NUREG-0711 criteria for validation testing and are specific and objective, thus assuring that they can be successfully implemented by a COL applicant or licensee.

18.1 Human Factors Engineering Program Management

18.1.1 Introduction

The staff reviewed the HFE program management element to verify the following:

  • The applicant has an HFE design team with the responsibility, authority, placement within the organization, and qualifications to verify that the plant design commitment to HFE is met.
  • The applicant has an HFE program plan that reasonably ensures that the HFE is properly developed, executed, overseen, and documented.
  • The HFE program plan describes the HFE elements to ensure that HFE principles are applied to the development, design, and evaluat ion of human system interfaces (HSIs),

procedures, and training.

  • The HFE program provides assurance that modifications to the plant do not compromise good human factors design.

The staff used the review criteria in NUREG-0711, Section 2.4, Review Criteria, to support the review of the applicants HFE program managem ent plan (HFE PMP). Section 18.1.4 of this SER documents the results of this review.

NUREG-0711, Section 2.3, Applicant Products and S ubmittals, states that the applicant should provide an IP for HFE program management, and there is no RSR for this element. The applicant provided an IP as discussed in Section 18.1.2 below (TR-130414-NP, Revision 0, Human Factors Engineering Program Management Plan, issued December 2022).

18.1.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.1, Human Factors Engineering Program Management.

18-4 ITAAC: There are no ITAAC associated with this HFE element.

Technical Specifications: There are no technical specifications (TS) associated with this HFE element.

Topical Reports: There are no topical reports associated with this HFE element.

Technical Reports: The applicant submitted the following technical reports (TRs) in support of the HFE design:

  • TR-130414-NP, Revision 0, Human Factors Engineering Program Management Plan, issued December 2022 (referred to here as the HFE PMP)
  • TR-130408-P, Revision 0, Concept of Operations, issued December 2022 (referred to here as the ConOps)
  • TR-130413-P, Revision 0, Human Factors Engineering Task Analysis Implementation Plan, issued December 2022 (referred to here as the TA IP)
  • TR-130409-P, Revision 0, Human Factors Engineering Operating Experience Review Implementation Plan, issued December 2022 (referred to here as the OER IP)
  • TR-124333-NP, Revision 0, Human Factors Engineering Functional Requirements Analysis and Function Allocation Implementation Plan, issued December 2022 (referred to here as the FRA/FA IP)
  • TR-130416-NP, Revision 0, Human Factors Engineering Treatment of Important Human Actions Result Summary Report, issued December 2022 (referred to here as the TIHA RSR)
  • TR-130417-NP, Revision 0, Human Factors Engineering Human-System Interface Design Implementation Plan, issued December 2022 (referred to here as the HSI Design IP)
  • TR-130415-NP, Revision 0, Human Factors Engineering Verification and Validation Implementation Plan, issued December 2022 (referred to here as the V&V IP)
  • TR-130418-NP, Revision 0, Human Factors Engineering Design Implementation -

Implementation Plan, issued December 2022 (referred to here as the DI IP)

  • TR-130412-P, Revision 0, Human Factors Engineering Staffing and Qualification Result Summary Report, issued December 2022 (referred to here as the S&Q RSR)

FSAR Section 18.1.3.5, Human Factors Engineering Documentation, states that an RSR is prepared for the following elements upon completion of the associated HFE activities: OER, FRA/FA, TA, HSI design, and human factors V&V. The RSRs contain sufficient detail to demonstrate that the results are derived from implementing the methodology and that the scope of the RSRs is consistent with the applic able guidance of NUREG-0711, Revision 3. FSAR Table 18.1-1, Human Factors Engineering Program and Design Activity Milestones, states that the RSRs for OER, FRA/FA, TA, HSI design, and V&V will be provided before fuel load. COL items are used to address procedure developm ent, training program development, and human

18-5 performance monitoring. A COL applicant must provi de plans to conduct these activities with the COL application.

The NRC staffs review approach and status for each NuScale HFE activity is provided in in Table 18-1.

Table 18-1: NuScale human factors implementation plans and results summary reports, and strategy for closure Safety NUREG-0711 Review Evaluation Process Status of Review Submittal Criteria Section and Assuring NRC Staffs Element Conclusion Completion2 Review

Activity is Human Factors Implementation NUREG-Section 18.1.5, complete. An Engineering Plan (TR- 0711, Section Conforms to RSR is not Complete Program 130414-NP, 2.4 review criteria required per Management Revision 0) NUREG-0711, Section 2.3 Staff may Operating Implementation NUREG-Section 18.2.6, An RSR will be review RSR as Experience Plan (TR- 0711, Section Conforms to available part of Review 130409-P, 3.4 review criteria before fuel verifying Revision 0) load completion of ITAAC Functional Staff may Requirement Implementation NUREG-Section18.3.6, An RSR will be review RSR as Analysis and Plan (TR- 0711, Section Conforms to available part of Function 124333-NP, 4.4 review criteria before fuel verifying Allocation Revision 0) load completion of ITAAC Staff may Implementation NUREG-18.4.6, An RSR will be review RSR as Task Analysis Plan (TR- 0711, Section Conforms to available part of 130413-P, 5.4 review criteria before fuel verifying Revision 0) load completion of ITAAC Results Staffing and Summary NUREG-18.5.6, This activity is Qualifications Report (TR- 0711, Section Conforms to complete Complete 130412-P, 6.4 review criteria Revision 0)

Results Treatment of Summary NUREG-18.6.6, This activity is Important Report (TR- 0711, Section Conforms to complete Complete Human Actions 130416-NP, 7.4 review criteria Revision 0)

Human-System Implementation NUREG-18.7.6, An RSR will be Staff may Interface Plan 0711, Section Conforms to available review RSR as Design (TR-130417-8.4 review criteria before fuel part of NP, Rev 0) load verifying

2 Either the SDA applicant or a COL applicant or holder will complete the RSR prior to fuel load.

18-6 completion of ITAAC Treated as an Staff reviews operational To be procedure program for the NUREG-18.8, reviewed at development Procedure COL applicant 0711, Section Reviewed at the COL as an Development to develop; see 9.4 COL stage application operating SER Chapter stage program prior 13 COL Items to COL issuance Treated as an Staff reviews operational 18.9, To be training Training program for the NUREG-Reviewed at reviewed at program as Program COL applicant 0711, Section COL stage the COL an operating Development to develop; see 10.4 application program prior SER Chapter stage to COL 13 COL Items issuance Staff will review ITAAC Implementation 18.10.6, An RSR will be closure Human Factors Plan (TR-NUREG-Conforms to available notification3 as Verification and 130415-NP, 0711, Section review criteria before fuel part of Validation Revision 0) 11.4 load verifying completion of ITAAC 03.15.02 Staff will review ITAAC Implementation 18.11.6, An RSR will be closure Design Plan (TR-NUREG-Conforms to available notification4 as Implementation 130417-NP, 0711, Section review criteria before fuel part of Revision 0) 12.4 load verifying completion of 03.15.01

To be To be Human NUREG-18.12.6, reviewed at reviewed at Performance COL Item 0711, Section Reviewed at the COL the COL Monitoring 18.12-1 13.4 COL stage application application stage stage prior to COL issuance

18.1.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

  • Title 10 of the Code of Federal Regulations (10 CFR) 52.137(a)(8), as it pertains to the information necessary to demonstrate compliance with any technically relevant portions

3 The required ITAAC closure notification may include the RSR. Regardless, it must indicate adequate information to support closure of ITAAC 03.15.02 for the ISV.

4 The required ITAAC closure notification may include the RSR. Regardless, it must indicate adequate information to support closure of ITAAC 03.15.01 for design implementation activities in the as-built plant.

18-7

of the Three Mile Island (TMI) requirements in 10 CFR 50.34(f), except 10 CFR 50.34(f)(1)(xii), (f)(2)(ix), and (f)(3)(v)

  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.

SRP Chapter 18,Section III, Acceptance Criteria, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.

NUREG-0711, Revision 3, Section 2.4, presents acceptance criteria for the HFE design methodology. (NUREG-0711 references NUREG-0700, Revision 3, Human-System Interface Design Review Guidelines, issued July 2020, which provides detailed acceptance criteria for HFE design attributes.)

The following documents provide additional criteria or guidance in support of the SRP acceptance criteria to meet the above requirements:

  • NUREG-0696, Functional Criteria for Emergency Response Facilities, issued February 1981
  • NUREG-0700, Revision 3, Human-System Inte rface Design Review Guidelines, issued July 2020
  • NUREG/CR-7126, Human-Performance Issues Related to the Design and Operation of Small Modular Reactors, issued June 2012
  • NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors, issued June 2015

As stated in RG 1.206, the Commission addressed the need for design completeness in its February 15, 1991, SRM for SECY-90-377, Requirements for Design Certification under 10 CFR Part 52.Section III, Level of Detail, of SRM-SECY-90-377 addressed the expected level of detail in DC applications. Specifically, in accordance with the SRM, the design should be complete except for adjustment within established design envelopes during the procurement and installation process. The Commission did not expect in all instances that design detail would be developed to the level found in actual procurement and construction specifications, thus affording some flexibility to accommodate as-procured characteristics. In SRM-SECY 377, the Commission approved the NRC staffs proposal for a graded approach for the level of needed design detail, reflecting the safety significance of the SSC. The Commission considered an appropriate level of detail to be that provided in the FSAR at the operating license stage for a recently licensed plant (except for site-specific, as-procured, and as-built information).

As further stated in RG 1.206, SECY-92-053, Use of Design Acceptance Criteria during 10 CFR Part 52 Design Certification Reviews, dated February 19, 1992 (Ref. 90), describes topics for which the design could not be completed to the level of detail originally envisioned in SECY-90-377 and its associated SRM. In SECY 92-053, the staff informed the Commission regarding the use of Design Acceptance Criteria (DAC) for Part 52 applications. The DAC approach allows applicants to delay some portions of the design of a plant until after the licensing process is complete. Human factors design is one of the limited areas that are permitted to use DAC. COL holders that seek to use an approved SDA must ensure that all ITAAC are closed, including

18-8 DAC items, prior to operation. This allows the NRC an opportunity to ensure that the final as-built design is adequate. Additional information regarding DAC can be found in RG 1.206.

18.1.4 Technical Evaluation

The staff reviewed Section 18.1 of NuScale US460 FSAR, Revision 1, in accordance with the objectives of Section 2.2, Objective, of the HFE Program Management element in NUREG-0711 and concluded the following:

  • The applicant has an HFE design team with the responsibility, authority, placement within the organization, and qualifications to verify that the plant design commitment to HFE is met.
  • The applicant has an HFE program plan that reasonably ensures that the HFE is properly developed, executed, overseen, and documented.
  • The HFE program plan describes the HFE elements to ensure that HFE principles are applied to the development, design, and evaluation of HSIs, procedures, and training.
  • The HFE program plan appropriately considers and addresses the deterministic aspects of design, discussed in RG 1.174.
  • The HFE program provides assurance that modifications to the plant do not compromise good human factors design.

NUREG-0711, Section 2.4.1, General HFE Program Goals and Scope

Section 18.1 of the FSAR summarizes the HFE PMP. More details are in the HFE PMP.

The FSAR defines the general goals and scope of the human-centered HFE program in Section 18.1.1, Human Factors Engineering Program Goals and Scope, and the associated subsections. These include developing an HFE program that addresses unique features and design assumptions of the NuScale design (such as the levels of automation and staffing concerns). The program runs through initial startup testing of the plant. The program is applied to the main control room (MCR), technical support center (TSC), emergency operations facility (EOF), and other relevant areas of the plant in a scaled manner. The staff finds these descriptions to be consistent with the guidance in NUREG-0711, criteria 2.4.1(1)- (4), which address the same topics.

Section 18.1.1.5 describes the HFE process which uses a series of human factors analyses that inform the design of HSI, procedures, and training programs. The process includes verification and validation activities to ensure that HSI, procedures, and training programs work together to support the operator. In addition, there are processes in place to ensure that these programs are appropriately implemented. In general, Nu Scales SDAA does not include details regarding procedures and training programs, deferring such items for the COL applicant. NuScales process is consistent with the process described in NUREG-0711. (Other elements of the program address additional details about the design of HSIs, procedures, and training programs). Section 18.1.1.5 also indicates that the program will provide input to the training programs for personnel identified in 10 CFR 50.120, Training and qualification of nuclear power plant personnel. The staff finds this treatment to be consistent with NUREG-0711, criteria 2.4.1(5) and (6).

18-9 NUREG-0711, Section 2.4.2, HFE Team and Organization

Section 18.1.2 of the FSAR describes the HFE team staffing, including the composition of the team, responsibilities, placement in the organization, and team member duties (such as assignments to various HFE elements and tracking of identified issues). This is consistent with the criteria in NUREG-0711, Section 2.4.2, because the descriptions of the qualifications of the team and the scope of their duties will be overseen by a management chain that is sufficiently high in the organization to stop work if significant safety issues arise.

NUREG-0711, Section 2.4.3, HFE Process and Procedures

Section 18.1.3 of the FSAR describes the processes and procedures used to implement the human factors program. This includes descriptions (in Section 18.1.3.1 of the FSAR) of the process for assigning work, responsibilities of managers and human factors staff, processes for reviewing and approving products, and identification of design issues. The staff finds that this treatment is consistent with NUREG-0711, criterion 2.4.3(1).

Section 18.1.3.2 of the FSAR indicates that the Quality Assurance Program (QAP) will be used as a process management tool. The NRC staff will review and approve the QAP; therefore, the staff find this to be a reasonable method to address criterion 2 in Section 2.4.3 of NUREG-0711.

Section 18.1.3.6 describes how the QAP will be used to ensure quality products from contractors in a manner that addresses NUREG-0711, criterion 2.4.3(6).

FSAR Sections 18.1.3.3 and 18.1.3.4 address the integration of the HFE program within the larger design process and provide a reference to milestones associated with the HFE program.

The program is iterative and interrelated with other design activities, helping to ensure that issues identified during the HFE process can be addressed within the associated design activities. Therefore, the staff finds that th is treatment is consistent with NUREG-0711, criteria 2.4.3(3) and (4).

FSAR Section 18.1.3.5 describes the documents that have already been submitted and those that will be submitted throughout the remainder of the design process. This includes a description of the IPs and RSRs as ex plained in NUREG-0711. NUREG-0711 defines the expected content of these submittals for each re view element (usually in Section X.3 of each element). NuScales approach is generally consistent with these sections because an RSR is typically submitted, or will be submitted, fo r each applicable element for which an IP has been submitted (for some elements, NUREG-0711 does not state a need for RSRs to be submitted, such as HFE PMP and HPM. Section 18.1.2 of this report describes this strategy.

SRP Chapter 18 explains that elements that interface with operating programs are typically evaluated with SRP, Chapter 13, Conduct of Operations. This includes procedure development, training program development and human performance monitoring. The SRP permits deferring site or plant specific elements to future COL applicants via COL action or information items. The applicant addressed thes e elements by creating COL information items to defer to the COL applicant. While it is true that these activities are associated with a COL, procedures and training are necessary to ensure an adequate verification and validation (V&V) process. In FSAR Section 18.10, Human Factors Verification and Validation, NuScale describes how it will address training and pr ocedures for V&V. The associated documentation will be treated as quality records in accordance with the QAP. This treatment ensures that the documents will be produced in accordance with NUREG-0711, criterion 2.4.3(5).

18-10 NUREG-0711, Section 2.4.4, Tracking HFE Issues

Section 2.4.4 of NUREG-0711 provides criteria to ensure that issues identified during the human factors process are appropriately tracked. Section 18.1.4 and the associated subsections of the FSAR provide details about NuScales approach to tracking issues. These sections describe the system, responsibilitie s of those using the system, and information necessary for documenting issues. Section 18.1.4 also indicates that the Human Factors Engineering Issue Tracking System (HFEITS) w ill be used to store issues and descriptions of their eventual resolution. During the HFE audit in August 2023 (ML23067A300), the staff reviewed the HFEITS database to verify that it meets the criteria in Section 2.4.4 of NUREG-0711 for tracking HFE issues. During the audit, NuScale explained its method for tracking HFE issues using HFEITS, including what types of issues are tracked and the criteria used for entering an issue into the database. The audit found that the HFEITS database and NuScales method for tracking HFE issues meet the criteria in Section 2.4.4 (ML23304A499).

The NRC staff finds HFEITS to be an adequate tracking mechanism.

NUREG-0711, Section 2.4.5, Technical Program

Section 18.1.5 (and the associated subsections) of the FSAR addresses the Technical Program.

This includes references to descriptions of how each of the NUREG-0711 elements will be addressed, as well as a reference to the project schedule, which indicates when various design activities will be completed relative to the SD AA review and fuel load. In addition, the section briefly describes the standards and specif ications (such as NUREG-0711, NUREG-0700, and the HSI style guide derived from these documents), as well as other tools that will be used during the HFE process (such as mockups and simulators).

The staff notes that although there are no ITAAC specifically associated with this program element, the applicant generally uses a strategy to complete certain elements of the technical program that uses ITAAC, as well as submission of RSRs at a later date; the RSRs for OER, FRA/FA, TA, HSI design, and human factors V&V will be available for staff review, along with ITAAC closure, prior to fuel load. This strategy is explained in Section 18.1.2 of this document and summarized in Table 18-1.

The description of these activities is consistent with the criteria in Section 2.4.5 of NUREG-0711.

18.1.5 Combined License Information Items

N/A

18.1.6 Conclusion

The staff finds that the applicants HFE pr ogram management plan description addresses the goals and scope of the program, identifies the HFE team and member qualifications, identifies HFE processes and procedures, covers methods for tracking HFE issues, and provides an overview of how each of the HFE program elements will be addressed. This treatment is consistent with the objectives of the HFE PMP element. The staff evaluated the applicants method for HFE program management and finds that it conforms to the criteria in NUREG-0711, Section 2.4. Accordingly, the staff finds that th is program element is consistent with application of state-of-the-art HFE principles to the MCR design as required by 10 CFR 50.34(f)(2)(iii).

18-11 18.2 Operating Experience Review

18.2.1 Introduction

The staff reviewed the operating experience review element to verify that the applicant has examined previous designs similar to the one currently under review and has identified, analyzed, and addressed HFE-related problems to ensure that the current design avoids any negative features in the predecessor designs while retaining their positive features. The staff used the review criteria in NUREG-0711, Section 3.4, Review Criteria, to support the review of the applicants operating experience review implementation plan (OER IP). Section 18.2.4 of this SER documents the results of this review.

NUREG-0711, Chapter 3, Operating Experience Review, Section 3.3, Applicant Products and Submittals, states that the applicant should provide an IP for OER followed by an RSR or submit an RSR with the application. The applicant submitted the IP evaluated in Section 18.2.4 of this SER.

18.2.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.2, Operating Experience Review.

ITAAC: SDAA Part 8, License Conditions; Inspections, Tests, Analyses and Acceptance Criteria, Section 3.15, Human Factors Engineering, Table 3.15-1, Human Factors Engineering Inspections, Tests, Analyses, and Acceptance Criteria, ITAAC No. 03.15.01 is associated with this HFE element.

Technical Specifications: There are no TS associated with this HFE element.

Topical Reports: There are no topical reports associated with this HFE element.

Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18.2.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 50.34(f)(3)(i), as it addresses administrative procedures for evaluating operating, design, and construction experience.
  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.

18-12 SRP Chapter 18,Section III, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections. NUREG-0711 provides the acceptance criteria for HFE design methodology:

  • NUREG-0711, Revision 3, Chapter 3, Operating Experience Review, Section 3.4, Review Criteria (NUREG-0711 references NUREG-0700, which offers detailed acceptance criteria for HFE design attributes)

The following documents provide additional guidance in support of the SRP acceptance criteria to meet the above requirements:

  • NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors, issued June 2015
  • NUREG/CR-7126, Human-Performance Issues Related to the Design and Operation of Small Modular Reactors, issued June 2012

NuScale cited the following documents in its SDAA:

  • NUREG/CR-6400, Human Factors Engineering (HFE) Insights for Advanced Reactors Based Upon Operating Experience, issued January 1997
  • NUREG-1275, Operating Experience Feedback Reports, Volumes 1 through 14 in the series

18.2.4 Technical Evaluation

The staff reviewed Section 18.2, Operating Experience Review, of the NuScale US460 FSAR, Revision 0, in accordance with the objectives of Section 3.2 of NUREG-0711. These objectives are to verify that the applicant has reviewed pr evious designs similar to the one currently under review and has identified, analyzed, and addressed HFE-related problems to ensure that the current design avoids any negative features in the predecessor designs while retaining their positive features. The staff finds that the applicants IP describes an OER program that is consistent with the guidance and criteria of NUREG-0711, Chapter 3.

Section 18.2 in the FSAR, Revision 1, and the associated subsections describe a systematic process for completing an OER that addresses nuclear industry experience (Sections 18.2.2.2 and 18.2.2.3), as well as relevant operating experience from nonnuclear industries (Section 18.2.2.4). This includes, but is not limited to, the use of passive systems as well as modern HSI technology. These data are drawn from relevant industries with significant experience with these technologies, such as the aviation and petroleum industries. The OER process also includes input from operators (Sec tion 18.2.2.5) as well as from the probabilistic risk assessment (Section 18.2.2.6). For these reasons, the staff finds that the scope of this program is consistent with the scope described in the criteria in Section 3.4.1 of NUREG-0711.

FSAR Section 18.2.2.1 provides a high-level description of the proposed process, which includes identification of relevant operating experience, screening of data, recording and relevant data, and tracking resolution of any is sues identified. Additional detail is found in Section 18.2.2.7, which describes the use of the Human Factors Engineering Issue Tracking System (HFEITS), a database used for recordin g and tracking human factors issues and others covered under the applicants QAP. During an audit in August 2023, the staff reviewed the

18-13 HFEITS database to verify that it meets NUREG-0711, criterion 3.4.2(4), for tracking HFE issues relevant to the design and yet to be addressed (ML23304A499). The staff observed that the HFEITS database is used to track issues such as those identified as potential human performance issues and design features that might support or enhance human performance.

The system is used to track issues that are within the HFE program scope. This includes tracking plant modifications. The description of the process is consistent with the acceptance criteria described in Sections 3.4.2 and 3.4.3 of NUREG-0711.

Several sections of the FSAR and OER IP indicate that there is no direct predecessor for the NuScale design. That statement was true for aspects of the design certification (DC); however, it is not completely accurate for the SDA. Although no reactor has been built based on the DC, a simulator has existed for several years, and extensive testing has been conducted. NuScale staff and contractors have several years of experience using the simulator associated with the design previously certified by the NRC. As such, they have gathered an understanding of the designs strengths and challenges. This accumulation of knowledge has been used to inform the current design. Section 3.4 of the OER IP describes the process to ensure that the lessons learned from the DC design are incorporated into the design associated with the FSAR. The staff finds this treatment to be an appropriate update to the OER process because it builds on the content of the previous OER by adding experience gained with the DC design.

18.2.5 Combined License Information Items

N/A

18.2.6 Conclusion

The staff evaluated the OER IP and found that the process it describes is consistent with the criteria in Chapter 3 of NUREG-0711 because the scope of the analysis appropriately covers existing nuclear experience, as well as data from relevant industries. In addition, the IP describes a process and tracking mechanisms that are sufficient to identify and document issues until they can be resolved. This treatment is consistent with the objectives of the OER element. The staff evaluated the applicants method for HFE OER and finds that it conforms to the criteria in NUREG-0711, Section 2.4.

The applicant uses a strategy to complete certain HFE program elements, including the OER, that relies on completion of the RSR at a later date. Section 18.1.2 of this document describes this strategy. The results of the OER will be documented in an RSR that will allow the staff to audit the results when the activity is complete, if necessary to verify closure of HFE ITAAC.

Accordingly, the staff finds that this program element is consistent with application of state-of-the-art HFE principles to the MCR design as required by 10 CFR 50.34(f)(2)(iii).

18.3 Functional Requirements Analysis and Function Allocation

18.3.1 Introduction

Functional requirements analysis (FRA) is the identification of functions that must be performed to satisfy the plants overall goals (e.g., safe operation, power generation). Function allocation (FA) is the analysis of requirements for plant control and the assignment of control functions to (1) personnel (e.g., manual control), (2) system elements (e.g., automatic control and passive,

18-14 self-controlling phenomena), and (3) combinations of personnel and systems elements (e.g., shared control, automatic systems with manual backup).

The staff reviewed the FRA/FA IP and results of the FA to verify that NuScale has (1) defined those functions that must be carried out to satisfy the plants safety goals and its goal of generating power and (2) allocated those functions to personnel and automation in a way that takes advantage of human strengths and avoids human limitations.

The staff used the review criteria in NUREG-0711, Section 4.4, Review Criteria, to support the review of the applicants FRA/FA IP. Section 18.3.4 of this report documents the results of this review.

NUREG-0711, Chapter 4, Functional Requirements Analysis and Function Allocation, Section 4.3, Applicant Products and Submittals, states that the applicant should provide an IP for FRA followed by an RSR or submit an RSR with the application. The applicant has submitted an IP, which is evaluated in Section 18.3.4 of this report.

18.3.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.3, Functional Requirements Analysis and Function Allocation.

ITAAC: SDAA Part 8, Section 3.15, Table 3.15-1, ITAAC No. 03.15.01 is associated with this HFE element.

Technical Specifications: There are no TS associated with this HFE element.

Topical Reports: There are no topical reports associated with this HFE element.

Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18.3.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.

SRP Chapter 18,Section III, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections. NUREG-0711 provides acceptance criteria for HFE design methodology:

  • NUREG-0711, Revision 3, Chapter 4, Functional Requirements Analysis and Function Allocation, Section 4.4, Review Criteria, issued November 2012

The following documents provide additional guidance in support of the SRP acceptance criteria to meet the above requirements:

18-15

  • NUREG/CR-7126, Human-Performance Issues Related to the Design and Operation of Small Modular Reactors, issued June 2012
  • NUREG/CR-3331, A Methodology for Allocation of Nuclear Power Plant Control Functions to Human and Automated Control, issued August 1983
  • NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors, issued June 2015

18.3.4 Technical Evaluation

FSAR Section 18.3.2.1 lists the high-level plant functions that are consistent with safety functions for existing large light-water reactors (or predecessor plants). The staff finds that Section 18.3.2 and its subsections describe a systematic and iterative methodology for completing a functional decomposition, which breaks down high-level functions into goals, subgoals, and eventually systems, subsystems, and components. This is consistent with NUREG-0711, criteria 4.4(1)- (3). In the FRA/FA IP, the applicant stated that the US460 design builds on the FRA, FA, and TA database that was generated for the NuScale DC or the US600 design. The staff viewed portions of the FRA, FA, and TA database during an audit in September 2023 (ML23067A300) and found that the database was maintained and reflected the FSAR US460 design.

FSAR Section 18.3.2.2 describes a systematic methodology for building on the outcomes of the functional decomposition and assigning these functions to automation, human action, or a combination of the two. The staff considered the methodology described and found that the criteria used to make the allocation determination is like that used in predecessor designs and is consistent with NUREG-0711, criterion 4.4(5). The section also describes the information requirements needed to understand when each function is necessary. This is consistent with NUREG-0711, criterion 4.4(4). The staff reviewed entries in the FRA, FA, and TA database during a virtual demonstration conducted as part of an audit in September 2023. The staff found that it was the same database used for the design certification application (DCA) and concluded that it remained an adequate tool to document the FA.

Section 18.3.2.2 of the FSAR explains that the role of the automation is to aid the operator during operation of the plant to help reduce the workload. Automation reduces the role of the operator in certain conditions, such as during repetitive tasks, time critical tasks, and tasks that would be unsafe for operators to conduct. The staff finds that the criteria used to define these allocations is consistent with state-of-the-art human factors practice. As such, the staff finds this approach to be consistent with NUREG-0711, criteria 4.4(6)- (7).

FSAR Section 18.3 does not explicitly addr ess NUREG-0711, criterion 4.4(8) or (9).

(Criterion 4.4(9) applies only to modifications to operating reactors and so is not applicable.)

However, it is clear from the description of the human factors V&V IP (FSAR Section 18.10) how the outcome of the FA will be validated using V&V activities. Section 18.3.2.2 indicates that any problems with the allocations will be tracked as human engineering discrepancies (HEDs) and will be resolved through the HED resolution process. The staff finds this treatment sufficient to verify the adequacy of allocations and, therefore, consistent with criterion 4.4(8). Moreover, Section 18.3.3 describes how the data will be documented and reported. The staff can review the results when the work is complete in accordance with the ITAAC in Table 3.15-1. The strategy for doing so is documented in the response to audit question number A-18-1 (ML23304A498).

18-16 The executive summary of the FRA/FA IP indica tes that the FRA/FA conducted for the NuScale US600 DC was considered a starting point for the FSAR design (RP-0316-17615, Revision 0, Human Factors Engineering Functional Requirem ents Analysis and Function Allocation Results Summary Report). The staff reviewed the FRA/FA during the DC review and found it to be consistent with the guidance in NUREG-0711, a nd an audit of the database found that NuScale adequately followed the process and derived results consistent with that process. Chapter 18 in the NuScale Design Certification Final Sa fety Evaluation Report, issued August 2020 (ML20023B605), presents the staffs safety evaluation of the FRA/FA for the NuScale US600 DC.

Section 1.2, Scope, of the FRA/FA IP clarifies the method for using the data from the DC FRA/FA. It includes evaluation of changes to the operator actions from the DCA. The staff finds this to be consistent with the iter ative approach addressed throughout NUREG-0711.

Section 3.1, General Information, of the FRA/FA IP explains why this iteration is reasonable, whether it is part of the original process or an iteration of that process. Section 3.0, Methodology, describes the details of the process for both the FRA and FA.

Section 3.6 of the FRA/FA IP describes the automation philosophy. The staff finds this to be consistent with the philosophy applied during the staffs US600 DCA review and consistent with state-of-the-art human factors practices. Section 3.7 presents automation criteria for assigning functions to operators and automation. These criteria are based on the philosophy described in Section 3.6.

18.3.5 Combined License Information Items

N/A

18.3.6 Conclusion

The staff evaluated the FSAR and the FRA/FA IP and finds that the methods described are consistent with the applicable acceptance criteria. The analyses identify the high-level functions needed to keep the plant safe and deconstructs them to an appropriate level for the FA process.

The FA process applies criteria that appropriately consider the strengths and limitations of human operators, automation, and combinations of the two. The applicant uses a systematic and iterative process that can be easily audited when the activity is complete. The results of the FRA/FA will be documented in an RSR that will allow the staff to audit the results when the activity is complete, if necessary to verify closure of HFE ITAAC. Accordingly, the staff finds that this program element is consistent with application of state-of-the-art HFE principles to the MCR design as required by 10 CFR 50.34(f)(2)(iii).

18.4 Task Analysis

18.4.1 Introduction

Task analysis (TA) identifies the tasks that plant personnel must perform to accomplish the functions that are allocated to human actions (HAs). TA also identifies the alarms, information, controls, and task support that must be available for plant personnel to successfully perform these tasks. TA generates input to several progr am elements: staffing and qualifications (S&Q),

HSI design, procedure development, training program development, and V&V.

18-17 The staff reviewed the applicants TA program element in accordance with the objectives of NUREG-0711, Chapter 5, Task Analysis, Section 5.2:

  • Identify the specific tasks personnel perform to accomplish their functions.
  • Identify the alarms, information, controls, and task support needed to perform those tasks.

The staff used the review criteria in NUREG-0711, Section 5.4, Review Criteria, to support the review of the applicants task analysis implementation plan (TA IP). Section 18.4.4 of this report documents the results of this review.

NUREG-0711, Section 5.3, Applicant Products and S ubmittals, states that the applicant should provide an IP for TA followed by an RSR or submit an RSR with the application. The applicant has submitted the IP evaluated in Section 18.4.4 of this report.

18.4.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.4, Task Analysis.

ITAAC: SDAA Part 8, Section 3.15, Table 3.15-1, ITAAC No. 03.15.01 is associated with this HFE element.

Technical Specifications: There are no TS associated with this HFE element.

Topical Reports: There are no topical reports associated with this HFE element.

Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18.4.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.

SRP Chapter 18,Section III, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections. NUREG-0711 provides acceptance criteria for HFE design methodology:

18-18 18.4.4 Technical Evaluation

The staff used the criteria in NUREG-0711, Secti on 5.4, to evaluate the applicants TA IP.

NUREG-0711, Section 5.4, includes 10 criteria for this topic. However, Section 5.4(10),

Additional Considerations for Reviewing HFE Aspec ts of Plant Modifications, applies only to plant modifications and therefore was not used.

Descriptions of the objectives are provided below. Note that these descriptions focus primarily on content in the FSAR. The TA IP offers additional detail in each of these areas, which is helpful in determining specific information on factors like the scope of the TA process. Much of this detail appears in the TA IP Section 3.0, Methodology. Although this level of detail is helpful to the staff in determining the effectiveness of the process, it will not be described here for the sake of brevity, unless there is a special circ umstance, such as a deviation from the guidance or an unusual treatment that warrants additional discussion.

The purpose of the TA is to systematically eval uate those HAs allocated to the humans in the FA and to identify the various information, control, and task support needs necessary to support the operator. The staff reviewed Section 18.4, Task Analysis, of NuScale US460 FSAR, Revision 1, and noted that it describes a process to identify the specific tasks personnel perform to accomplish their functions and to identify the alarms, information, controls, and task support needed to perform those tasks.

Section 18.4.1 of the FSAR includes a list of objectives for the TA, which is consistent with the objectives in NUREG-0711, criterion 5.4(1), with an added focus on workload for licensed operators. This is an important considerati on given the unique staffing approach used by NuScale. Section 18.4.2.1 of the FSAR expands on this list of objectives. The staff observed that the scope described in the IP very closely matches criterion 5.4(1) of NUREG-0711.

Section 18.4.2.1 of the FSAR also indicates that all tasks will be screened into the TA process.

This is consistent with NUREG-0711, criterion 5. 4(2), which allows for, but does not mandate, the use of a screening mechanism for tasks to be included. Although it is not unusual to scale the depth of a TA, doing so based on the complexity of the task narrative is a novel approach.

The staff considered Section 3.5, Detailed Task Narratives, of the TA IP and found that bulleted points provide a reasonable basis for scaling the TA. For instance, one area considered is the description of alarms, information, controls, and task support needed to accomplish the task. Complex tasks will generally include more alarms, controls, and displays and will therefore receive a more detailed TA. These task narratives are also used to meet NUREG-0711, criterion 5.4(3), which indicates that detailed task narratives should be used as a basis for the analysis. Section 18.4.2.2 of the SDA describes how task narratives are derived, including identifying key information (such as a preliminary discussion of how alarms, displays, and controls will be used). The section also indicates that these narratives will be revised as the design matures.

Sections 18.4.2.3-18.4.2.6 of the FSAR discuss the specific parameters to be included in the analysis as recommended by NUREG-0711, criteria 5.4(4)- (7). For instance, criterion 5.4(4) addresses the relationships between tasks. NuScale considers this in Section 18.4.2.3, which describes a process for considering relationships between tasks (such as sequential tasks or tasks conducted in parallel), and they consider the informational and task support needs of the operator and tie this back to the design of the HSI. The process described in Section 18.4.2.3 of the FSAR meets criterion 5.4(4) of NUREG-0711.

FSAR Section 18.4.2.7 addresses the iteration of the TA. It describes how any identified 18-19 deviations will be used to trigger an iteration and identifies how the HFE team will conduct this.

This is consistent with NUREG-0711, criterion 5.4( 8). The staff also notes that the entire SDAA design is an iteration of the design approved by the NRC during the DC. The staff reviewed the first iteration of the TA in an audit (ML23067A300). The staff also conducted an audit of the TA iteration supporting the FSAR, which focused on changes from the certified design. These observations support the conclusion that the applicant is using an iterative design process as described in criterion 5.4(8) and elsewhere in NUREG-0711.

Criterion 5.4(9) of NUREG-0711 describes the treatment of important human actions (IHAs).

FSAR Section 18.6 indicates that there are no IHAs for this design, so this criterion is not applicable. However, the staff notes that although there are no credited IHAs identified for this design, NuScale is still conducting a TA for all tasks. This is a conservative design choice which helps ensure adequate HFE for all tasks considered.

Section 3.6.1, Functional Requirements Analysis and Function Allocation and Task Analysis Database, of the TA IP describes the database used to document and track the data generated during the TA. In August 2023, the staff audited the TA database. The staff found that the database was designed in a way to document the important technical details described in the IP. It also provides sufficient documentation to track those design details and provide them as inputs to other HFE program elements such as S&Q and HSI design. The staff observed that the quality of data entries in the database appeared to be controlled in accordance with the process described in the FSAR.

18.4.5 Combined License Information Items

N/A

18.4.6 Conclusion

The staff evaluated the FSAR and the TA IP and finds that the TA process described is consistent with the applicable criteria in Section 5 of NUREG-0711. The FSAR describes a systematic and iterative process that will identif y the specific tasks that personnel would perform to accomplish the functions assigned to them by the FA. The TA process identifies the alarms, information, controls, and task support needed to successfully perform those tasks. In addition, the staff audited the database used for documenting and tracking TA activities and data and finds it to be adequate. The sample of results reviewed appeared to be derived from the process described in the TA IP.

The results of the TA will be documented in an RSR that will allow the staff to audit the results when the activity is complete, if necessary to verify closure of HFE ITAAC. Accordingly, the staff finds that this program element is consistent with application of state-of-the-art HFE principles to the MCR design as required by 10 CFR 50.34(f)(2)(iii).

18.5 Staffing and Qualification

18.5.1 Introduction

The objective of the staffs review is to verify that the applicant has systematically analyzed the required number and qualifications of personnel in concert with task requirements and regulatory requirements. The scope of the review is the applicants staffing plan for the licensed

18-20 control room operators as defined in 10 CFR Part 55, Operators Licenses, and the following categories of personnel: non licensed operators, sh ift supervisor, and shift technical advisor.

NUREG-0711, Chapter 6, Staffing and Qualificati ons, Section 6.3, Applicant Products and Submittals, states that the product of the applicants S&Q analyses defines the operating levels and the related qualification requirements for the facility. The applicant should provide an IP that describes the methodology for conducting the S&Q analyses or a completed RSR. NuScale defined the minimum licensed operator staffing requirements, submitted an S&Q RSR, and referenced a topical report for control room staffing that the NRC staff had previously approved.

The staff evaluated the applicants S&Q RSR using the relevant review criteria in NUREG-0711, Section 6.4, Review Criteria. Section 18.5.4 of this report discusses the results of the staffs evaluation.

18.5.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.5, Staffing and Qualifications.

ITAAC: There are no ITAAC associated with this HFE element.

Technical Specifications: The following TS are associated with this element:

  • TS 5.1.2 requires that the shift manager shall be responsible for the control room command function, and during the shift managers absence from the control room while any unit is in MODE 1, 2, 3, 4, or 5, an individual with an active senior reactor operator (SRO) license shall be designated to assume the control room command function.
  • TS 5.2.2 contains requirements for the minimum number of licensed operators at a NuScale plant.
  • TS 5.3 contains requirements for facility staff qualifications.

Topical Reports: TR-0420-69456-A, Revision 1, NuScale Control Room Staffing Plan issued August 2021

Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18.5.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.
  • 10 CFR 50.54(k), which requires a licensed operator or senior operator to be present at the controls at all times during the operation of the facility.

18-21

  • 10 CFR 50.54(m), which requires minimum licensed operator staffing requirements for the facility based on the number of units operating.
  • 10 CFR 50.120, Training and qualification of nuclear power plant personnel, which requires operating license and COL applicants and holders to establish, implement, and maintain training programs derived from a systems approach to training for specific categories of nuclear power plant personnel.

SRP Chapter 18,Section II, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections:

  • NUREG-0711, Revision 3, Chapter 6, Staffing and Qualifications, Section 6.4, Review Criteria

The following documents provide additional criteria or guidance in support of the SRP acceptance criteria to meet the above requirements:

  • NUREG-1791, Guidance for Assessing Exem ption Requests from the Nuclear Power Plant Licensed Operator Staffing Requirements Specified in 10 CFR 50.54(m), issued July 2005
  • Brookhaven National Laboratory TR No. 20918-1-2015, Methodology to Assess the Workload of Challenging Operational Conditions in Support of Minimum Staffing Level Reviews, issued March 2015 (ML15083A205)

18.5.4 Technical Evaluation

NUREG-0711, Section 6.4, includes six criteria for the S&Q review element. SER Section 13.1, Organizational Structure, addresses criterion 6.4(1) and the applicable S&Q guidance in NUREG-0711, Section 13.1. Criterion 6.4(2) concerns NRC requirements for minimum staffing of licensed operators that are applicable to facility licensees; these requirements do not apply to standard design approval applicants. The applicant proposed a staffing level for its design that would not allow a facility licensee to meet some requirements in 10 CFR 50.54(m). Therefore, the applicant provided the S&Q RSR, which contains the methodology used to conduct performance-based tests and their results, referred to as staffing plan validations (SPVs), as a technical justification to support a design-specific staffing requirement that a facility licensee referencing the NuScale standard design could use to seek exemption from 10 CFR 50.54(m).

The staff evaluates the applicants technical basis supporting the proposed minimum staffing level in Section 18.5.4.2 of this report.

The remaining review criteria in NUREG-0711 address inputs from the TA to S&Q analyses (criterion 6.4(3)), staffing for the full range of plant conditions and tasks (criterion 6.4(4)),

iteration (criterion 6.4(5)), and staffing-related issues (criterion 6.4(6)). Section 18.5.4.3 of this report addresses these criteria.

18-22 Before discussing the review criteria, relevant background information is provided in the next section.

18.5.4.1 Rationale for a Design-Specific Staffing Requirement

The requirements in 10 CFR 50.54(k) and 10 CFR 50.54(m) identify the minimum number of licensed operators who must be on site, in the control room, and at the controls. The requirements are conditions in every nuclear power reactor operating license issued under 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities. The requirements are also conditions in every COL issued under 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants; however, they are applicable only after the Commission makes the finding under 10 CFR 52.103(g) that the acceptance criteria in the COL are met.

A future COL applicant that references the US460 standard design will need an exemption from 10 CFR 50.54(m) because the table in 10 CFR 50.54(m)(2)(i) does not address operation of more than two units from a single control room. Also, the applicants proposed minimum staffing level would not allow a facility licensee to meet 10 CFR 50.54(m)(2)(iii) because the regulation requires a licensed operator at the controls for each fueled unit (i.e., six licensed operators).

During the September 2023 HFE audit, NuScale clarified its expectation that a COL applicant referencing the US460 standard design approval w ill seek an exemption from 10 CFR 50.54(m) and that FSAR Section 18.5 provides a technical basis and justification to support the finding that the US460 standard design plant can be safely operated using a minimum MCR shift contingent of one licensed reactor operat or (RO) and two licensed SROs (ML23304A507).

FSAR Section 18.5 references the NRC-approv ed topical report, NuScale Control Room Staffing Plan (TR-0420-69456-NP-A), and the S&Q RSR.

18.5.4.2 Evaluation of the SDA Applicants Technical Basis

The S&Q RSR states that the S&Q results for the NuScale US460 design are derived from the HFE analysis work completed for the design-specific staffing requirement for the NuScale US600 DC rule in which six licensed operators operate up to 12 reactor modules from a single control room. The S&Q RSR and FSAR Section 18.5 reference the NRC-approved topical report, NuScale Control Room Staffing Plan (TR-0420-69456-NP-A). Both the topical report and the S&Q RSR yield a minimum control room shift contingent for the US460 standard design of one licensed RO and two licensed SROs. The US460 is designed for the operation of up to six reactor modules from a single control r oom. Section 2.3 of TR-130408-P, Concept of Operations, discusses the minimum MCR staffing levels, as well as operator roles and responsibilities. The COL applicant will address the number of non-licensed operators as described in COL Item 18.5-1.

NUREG-0711, criterion 6.4(2), states that the staff should ensure that the applicants proposed staffing meets the requirements of 10 CFR 50.54, Conditions of licenses, and, if not, the NRCs reviewers should use the guidance in NUREG-1791 and NUREG/CR-6838. 5 FSAR section 18.5.3 states that the applicant performed two SPVs and one ISV test using the guidance in NUREG-0711, Revision 3; NURE G-1791; and NUREG/CR-6838. The first SPV and subsequent initial system validation resulted in comprehensive data that supported the initial staffing plan (i.e., six licensed operators for up to 12 units). Using the guidance in NUREG-1791 and NUREG/CR-6838, the staff reviewed the applicants staffing plan and supporting analyses submitted as part of the NuScale DCA and found that NuScales staffing plan for six licensed

5 NUREG/CR-6838 contains the technical basis for the staffs guidance in NUREG-1791. The staff used NUREG/CR-6838 as a reference if it needed clarification of the review guidance in NUREG-1791.

18-23 operators to operate up to 12 reactor modules from a single control room was acceptable for the US600 certified design. The minimum requirements per shift for onsite staffing of the NuScale Power Plant were included as part of the DC rule for NuScale found in Appendix G to 10 CFR Part 52. The staffs safety evaluation of the S&Q for the NuScale US600 DC is in Chapter 18 of the NuScale Design Certification Final Safety Evaluation Report.

The S&Q RSR, Section 2.1.4, for the NuScale SDA describes the iterative nature of the staffing analysis, including how the applicant evaluated and modified the initial staffing level through the NuScale design change control procedures and the use of the human engineering discrepancy (HED) process, and as information from the ot her HFE activities, S&Q analyses, evaluations, and tests became available. The S&Q RSR, Section 5.0, Results Summary of Revised Staffing Plan Validation Testing, states that following the SPV and the ISV testing using the initial US600 staffing level (i.e., six licensed operators for up to 12 units), the applicant conducted an additional study, titled Revised Control Room Staffing Plan Validation Report. The crew complement for the revised testing was one licensed RO and two licensed SROs for the US600 design. The applicant also eliminated the shift tec hnical advisor position from the on-shift crew.

The revised SPV resulted in comprehensive data that supports the revised staffing plan (i.e.,

three licensed operators) for the NuScale SDA.

Again, using the guidance in NUREG-1791 and NUREG/CR-6838, the staff reviewed the applicants analyses and results for the revised staffing plan for three licensed operators to operate up to 12 NuScale power modules from a single control room as described in the NuScale Control Room Staffing Plan (TR-0420-69456-NP-A). As outlined in Section 3.0 of the staffs safety evaluation for the topical report, and subject to the conditions of applicability listed in Section 5.0 of that evaluation, the staff found it to be acceptable for the 12-unit version of the NuScale small modular reactor (ML21012A363). Additionally, the staff wrote a SECY paper informing the Commission that the shift techni cal advisor role was not necessary for the NuScale design because of a number of unique design features (SECY-21-0039, Elimination of the Shift Technical Advisor for the NuScale Design, dated April 5, 2021 (ML21060A823).

The methodology described in NUREG-1791 uses performance-based tests in a simulator to confirm staffing levels. This is done by identifying very high workload scenarios and testing them with the minimum staff complement to ensure that it is possible to successfully complete all operations necessary to ensure safety. The previous staffing analyses for the US600 DCA considered high workload conditions for 12 units. For the US460 design, the reduction in the number of units reduced the workload of operators from that previously tested. Therefore, subject to the conditions of applicability listed in Section 5.0 of the staffs safety evaluation of the topical report NuScale Control Room Staffing Plan, the staff concludes that the previous staffing analyses and results documented in the S&Q RSR provide a technical basis for an exemption request by a COL applicant from 10 CFR 50.54(m) for three licensed operators to operate up to six US460 SDA units.

18.5.4.3 Other Review Criteria

Inputs from Task Analysis to Staffing and Qualifications Analyses (Criterion 6.4(3))

Criterion 6.4(3) states that the applicant should use the results of the TA as input to the S&Q analyses. It also states that personnel tasks should be assigned to staffing positions to ensure that jobs are defined considering task characteristics, team processes, and the persons ability to maintain situation awareness. The TA IP, Section 2.1, states the following:

18-24 Output from TA to other HFE program elements includes the following:

Tasks are arranged into specific job categories and assigned to staff positions (e.g., licensed operators, non-licensed operators). These assignments are analyzed in the staffing and qualifications (S&Q) HFE element.

Tasks are assigned knowledge and abilities (KA) required to perform the tasks.

These KA requirements provide the foundation for the Operator Training Program development.

Additionally, the S&Q RSR, Section 2.1.2, states the following:

Task Analysis results are used to determine the crew roles and responsibilities and are used as input to the initial licensed operator staffing level. Personnel tasks, addressed in TA, are assigned to staffing positions considering:

  • task characteristics, such as the knowledge and abilities required, relationships among tasks, time available, and time required to perform the task.
  • the operators ability to maintain situation awareness within the area of assigned responsibility.
  • teamwork and team processes such as peer checking; and
  • workload associated with each job within the crew.

The staff concludes that the applicant used the results of TA as an input to the S&Q analyses and assigned tasks to jobs considering the task characteristics, impact on the ability to maintain situation awareness, and teamwork and team processes. Accordingly, the staff finds that the SDA application meets this criterion.

Staffing for the Full Range of Plant Conditions and Tasks (Criterion 6.4(4))

Criterion 6.4(4) states that the applicants staffing analysis should determine the number and qualifications of operations personnel for the full range of plant conditions and tasks (including operational tasks conducted under normal, abnormal, and emergency conditions; plant maintenance; plant surveillance; and testing) and should address how plant personnel working outside of the control room interface with the operators in the control room. As discussed in the staffs safety evaluation reports for both the NuScale DC and the control room topical report, NuScale conducted the initial SPV and the revised SPV to determine the minimum number of licensed operators needed in the MCR by simulating challenging, high-workload conditions and evaluating task performance, workload, and sit uation awareness under those conditions. Both validations simulated normal, abnormal, and emergency conditions and also included tasks related to maintenance, surveillance, and testing. NuScale also simulated interactions with plant personnel outside the control room.

The SDA operations personnel are qualified as either licensed ROs or licensed SROs. The S&Q RSR, Section 3.2, Baseline Assumptions, addresses the education and experience of the licensed operator personnel at a NuScale Power Plant and states that they are expected to be similar to those described in ACAD 10-001, Guidelines for Initial Training and Qualification of Licensed Operators (ML21144A141).

18-25 When challenging conditions are used to create high-workload conditions and task performance, situation awareness, and workload results are measured and found to be acceptable, then it would seem logical to conclude that under less challenging conditions, workload levels, situation awareness, and task performance will still be acceptable. However, when workload levels are too low, operators may lose some degree of situation awareness (e.g., operators may shift their focus to other administrative tasks and may not promptly notice changes in plant status), which could impact task performance (e.g., the time to determine which actions need to be taken may increase, which could be important if any task needs to be performed relatively quickly to ensure the safe operation of the plant). For the following reasons, the staff concludes that there is reasonable assurance that, even when underload (i.e., low levels of workload) conditions occur, the NuScale SDA reactors can still be safely operated:

  • The applicants proposed staffing level includes, and the ConOps describes an operator whose main responsibility is to monitor plant conditions. Therefore, at least one member of the control room team is continuously responsible for monitoring the status of the plant.
  • The applicants control room design includes an alarm system to notify operators of changes in plant conditions.
  • There are no actions that operators need to take to mitigate the consequences of a design-basis event, and the few actions that operators do need to take to mitigate the consequences of a beyond-design-basis event do not need to be taken until a relatively long time after event initiation.

Therefore, the staff concludes that the applicants staffing analysis determined the number and qualifications of operations personnel for the full range of plant conditions and tasks.

Accordingly, the staff finds that the SDA application meets this criterion.

Iteration (Criterion 6.4(5))

Criterion 6.4(5) states that the applicants staffing analysis should be iterative; that is, the initial staffing goals should be modified as information from the HFE analyses from other elements becomes available. The S&Q RSR, Section 2.1.4, Iterative Nature of Staffing Analysis, states the following:

Initial staffing level goals and staffing roles and responsibilities are evaluated and modified, as required, in an iterative fashion through NuScale design change control procedures, through the use of the human engineering discrepancy (HED) process, and as information from other HFE elements and S&Q analyses, evaluations, and tests becomes available.

Human engineering discrepancies are generated during human factors verification and validation (V&V) activities within the NuScale HFE Program as described in the Human Factors Engineering Program Management Plan (Reference 8.2.10). Design discrepancies identified during HFE design development activities are resolved as part of the NuScale design process, whenever possible. Those HFE issues that cannot be immediately resolved or that potentially change the initial staffing goals for the MCR or potentially impact their roles and responsibilities are captured in the Human Factors Engineering issues tracking system (HFEITS) for evaluation and resolution.

18-26 If the ISV results for the FSAR indicate that the staffing level needs to be modified, the staff concludes that the applicant has a method of addressing any needed changes to the staffing level. Therefore, the staff concludes that the applicants staffing analysis was iterative such that the staffing level can be modified by COL applicants as information from the HFE analyses from other elements bec omes available. Accordingly, the staff finds that the application meets this criterion.

Staffing-Related Issues (Criterion 6.4(6))

Criterion 6.4(6) states that the applicant should address the basis for S&Q levels and lists topics to be considered. The topics are associated with the following HFE elements: OER, FRA/FA, TA, TIHA, procedure development, and training program development.

As discussed in the staffs evaluation of criterion 6.4(2), the US460 minimum staffing levels are based on the initial S&Q analyses performed for the 12-unit NuScale Power Plant designs. The applicant submitted SPV results as the basis for its proposed staffing levels and qualifications.

The applicant also used the results of the OER, the FRA/FA, and the TA as the basis for the staffing level that was validated during the SPV for the US600 DCA.

The S&Q RSR, Section 3.2, Baseline Assumptions, states the following:

The initial staffing goals for the MCR crew reflect the inputs from OER, FRA/FA, TA and TIHA. The staffing goals were then adjusted and validated as described throughout this document.

Thus, for the US600 DCA, the applicant considered the effect of the staffing level on the performance of the important human actions (IHA s) by including them in the initial SPV and subsequent revised SPV, which demonstrated that the minimum shift complement could perform the IHAs associated with the NuScale DCA within applicable time constraints. In contrast, as discussed in SER Section 18.6 and S&Q RSR, Section 3.1.4, Treatment of Important Human Actions, there are no IHAs for the US460 design.

For the US460 SDA, the S&Q RSR, Section 3.1.5, Procedure Development, states the following:

S&Q analyses use task sequencing from TA as preliminary procedures and assume specific personnel numbers, and a certain level of secondary tasks such as communication. S&Q analyses also consider when task sequencing suggests the concurrent use of multiple procedures. Computer-based procedures are utilized during scenario-based testing of operator and crew performance tests, workload analysis, and situation awareness assessment.

Procedure development is a licensee acti vity. Issues identified during S&Q or other HFE activities performed by NuScale during the design development process that have impacts to procedure development are entered into the HFEITS database. Training program development related issues are then passed to the licensee for disposition by their training program, as applicable.

Further, the US460 S&Q RSR, Section 3.1.6, Training Program Development, states the following:

18-27 S&Q analyses provide input to the training program development related to knowledge, skills, and abilities to be attained and maintained. As S&Q analyses encompass licensed operator personnel, they provide input essential to coordinating actions between individuals inside and outside the MCR. The training program includes this set of knowledge, skills, and abilities.

Training program development is a licensee activity. Any issue identified during S&Q or other HFE activities performed by NuScale during the design development process that have impacts to training program development are entered into the HFEITS database. Training program development related issues are then passed to the licensee for disposition by their training program, as applicable.

The NUREG-0711 criterion specifically addresses concerns with coordinating personnel who are identified in the development of training. The development of training programs is an operational program, which is the responsibility of the COL holder. The applicant explained that any staffing concerns identified during the development of training may be documented and addressed by the COL holder. Thus, the applicant has identified a means by which a COL holder may address staffing concerns. Therefore, the staff concludes that the applicant has considered how to address concerns with coordinating personnel identified during training development.

Accordingly, the staff finds that the SDA application meets this criterion.

18.5.5 Combined License Information Items

FSAR Chapter 18, COL Item 18.5-1, addresses the number of non-licensed personnel:

COL Item 18.5-1: An applicant that references the NuScale Power Plant US460 standard design will address the staffing and qualifications of non-licensed operators.

The staff concludes that the applicant appropriately assigned the determination of the number of non-licensed operators to the COL holder because the number will depend in part on the number of units constructed on site. For exampl e, non-licensed operators will likely have more tasks to perform at a NuScale plant that consists of six units than at a NuScale plant with three units.

18.5.6 Conclusion

The staff evaluated the S&Q RSR and found that the process described is consistent with the applicable criteria in NUREG-0711, Section 6.4. The FSAR describes a systematic and iterative process that appropriately considers the S&Q necessary to safely operate the plant.

Furthermore, the staff notes the iterative process used by the applicant for staffing analyses for the NuScale SDA small modular reactor design. The staff has reviewed earlier iterations of the applicants S&Q analyses and results and found them consistent with NUREG-0711 and NUREG-1791. The staff concludes that the results of the applicants staffing validation tests as documented in the FSAR, including use of the NuScale Control Room Staffing Plan in TR-0420-69456-A, Revision 1, provide an adequate technical basis for a COL holder to use to justify an exemption from the requirements in 10 CFR 50.54(m).

18-28 18.6 Treatment of Important Human Actions

18.6.1 Introduction

The treatment of important human actions (TIHA) program element identifies the HAs that are most important to safety and considers those actions in the HFE design of the plant. The design should minimize the likelihood of personnel error and help ensure that personnel can detect and recover from any errors that occur.

Probabilistic and deterministic analyses are used to identify IHAs. The probabilistic risk assessment, which identifies the Human Reliability Assessment, identifies risk-important HAs.

Deterministic engineering analyses identify IHAs that are credited with the prevention or mitigation of accidents and transients.

The staff reviewed the TIHA program element to verify that it did the following:

  • identified the IHAs.
  • considered them in designing the HFE aspects of the plant to minimize the likelihood of personnel error and to help ensure that personnel can detect and recover from any errors that occur.

NUREG-0711, Chapter 7, Treatment of Important Human Actions, Section 7.3, Applicant Products and Submittals, states that the applicant should provide an IP for TIHA followed by an RSR or submit an RSR with the application. The staff used the review criteria in NUREG-0711, Section 7.4, Review Criteria, to support the review of the applicants TIHA results summary report (RSR). Section 18.6.4 of this report documents the results of this review.

18.6.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.6, Treatment of Important Human Actions.

ITAAC: SDAA Part 8, Section 3.15, Table 3.15-1, ITAAC No. 03.15.01 is associated with this HFE element.

Technical Specifications: There are no TS are associated with this HFE element.

Topical Reports: No topical reports are associated with this HFE element.

Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18.6.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

18-29

  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.

SRP Chapter 18,Section III, lists the accept ance criteria deemed adequate to meet the above requirements, as well as review interfaces with other SRP sections. NUREG-0711 provides the acceptance criteria for HFE design methodology:

  • NUREG-0711, Revision 3, Human Factors Engineering Program Review Model, Chapter 7, Treatment of Important Human Actions, Section 7.4, Review Criteria (NUREG-0711 references NUREG-0700, which provides detailed acceptance criteria for HFE design attributes)

Additionally, NUREG/CR-7202 provides guidance in support of the SRP acceptance criteria to meet the above requirements.

18.6.4 Technical Evaluation

NUREG-0711, criteria 7.4(1) and (2), descri be the various analyses considered for this element. This includes identifying important operator actions by reviewing Chapters 7, 15, and 19 of the applicants FSAR. The NRCs human factors staff ensures that any actions identified in those FSAR chapters are adequately addressed in FSAR Chapter 18. The NRC staff review adhered to the process and its outcomes, as described in Chapters 7, 15, and 19. Section 18.6.3 of the FSAR summarizes the results of these analyses. It indicates that no HAs meet the thresholds for risk significance identified in NuScale TR-0515-13952-NP-A, Risk Significance Determination, issued October 2016. The staff notes that these outcomes for the TIHA element differ from those of the US600 DC, which identified two IHAs. The staff learned during an audit (ML23067A300) that changes made to the US460 design altered the risk-significance level of those actions so that they are not risk significant for the SDA.

NUREG-0711, criterion 7.4(3), ensures that the applicant specifies how other human factors program elements are used appropriately to evaluate all IHAs. Section 18.6.2.3 describes how the HFE process will be used to identify and evaluate IHAs. Section 3.3 of the TIHA RSR describes how other HFE program elements will address TIHA. This typically considers potential IHAs for ear ly elements (completed before Chapters 15-19 are final) and involves generating HEDs for any issues associated with the IHAs in that element. However, as indicated in Section 18.6.3 of the FSAR, no actions meet the approved thresholds for identifying IHAs. Despite the absence of IHAs, the human factors program is scoped in such a way that it includes assessments of other HAs that are not technically considered IHAs. For inst ance, the TIHA RSR, Section 3.1, Risk-Important Human Action Identification, describes the process for identifying risk-important human actions (RIHAs) and indicates that although there were no RIHAs identified in the final analysis, a preliminary set of potential RIHAs was considered during the TA. The staff finds that this treatment helped ensure that state-of-the-art human factors principles were applied to HSIs for a wide range of tasks, not just those tasks associated with IHAs. Moreover, this provides some assurance in the case that new IHAs are identified later in the process (such as through design changes or iterations of Chapters 15-19).

Criterion 4 of NUREG-0711 applies only to modifications and was not considered.

18-30 18.6.5 Combined License Information Items

N/A

18.6.6 Conclusion

The staff reviewed the TIHA RSR and found that the methodology for addressing IHAs is consistent with NUREG-0711. However, no IHAs we re identified for the design. Any IHAs that NuScale identifies will be addressed using the methodology described in the TIHA RSR and will be evaluated when closing the HFE ITAAC. Additi onally, the DI IP has conditions designed to ensure that any IHAs that are not identified in time for ISV will be assessed during the DI testing. This will be confirmed by ITAAC 03.15.01.

Therefore, the staff finds the treatment of the IHA element sufficient to inform the HFE process.

Accordingly, the staff finds that this program element is consistent with application of state-of-the-art HFE principles to the MCR design as required by 10 CFR 50.34(f)(2)(iii).

18.7 Human-System Interface Design

18.7.1 Introduction

The human system interface (HSI) design element in volves the translation of function and task requirements into HSI design specifications. The objective of the staffs review, as stated in NUREG-0711, Chapter 8, Human-System Interface Design, Section 8.2, Objective, is to verify that the applicant has a process to translate functional and task requirements into HSI design requirements and into the detailed design of alarms, displays, controls, and other aspects of the HSI. This process should include a systematic application of HFE principles and criteria.

NUREG-0711, Chapter 8, Human-System Interface Design, Section 8.3, Applicant Products and Submittals, states that the product of the applicants HSI design is a complete suite of HSIs that personnel use to safely operate and maintain the plant. The applicant should provide an IP or a completed RSR. If the applicant submits an IP, it should include a completed HSI style guide and a description of the methodology for designing the HSIs. The applicant provided an IP and a style guide. The staff evaluated the HSI Design IP using the criteria in Section 8.4, Review Criteria, of NUREG-0711. The applicant will submit the RSR when the work in the IP is completed. Section 18.7.4 of this report discusses the results of the staffs evaluation.

ITAAC 03.15.01 confirms the completion of these activities.

18.7.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.7, Human-System Interface Design.

ITAAC: SDAA Part 8, Section 3.15, Table 3.15-1, ITAAC No. 03.15.01 is associated with this HFE element.

Technical Specifications: There are no TS associated with this HFE element.

Topical Reports: There are no topical reports associated with this HFE element.

18-31 Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18.7.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.
  • 10 CFR 50.34(f)(2)(xix), with regard to instrumentation for monitoring post-accident conditions that include core damage.

SRP Chapter 18,Section II, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections.

  • NUREG-0711, Revision 3, Chapter 8, Section 8.4, Review Criteria

The following documents provide additional criteria or guidance in support of the SRP acceptance criteria to meet the above requirements:

18-32

  • NUREG-0737, Clarification of TMI Action Plan Requirements, Supplement 1, Clarification of TMI Action Plan RequirementsRequirements for Emergency Response Capability, issued January 1983
  • NUREG/CR-7202, NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to the Design and Operation of Small Modular Reactors, issued June 2015
  • RG 1.97, Criteria for Accident Monitoring Instrumentation for Nuclear Power Plants, with regard to instrumentation for light-water-cooled nuclear power plants to assess plant and environmental conditions during and following an accident.
  • NUREG-0696, Functional Criteria for Emergency Response Facilities, with regard to functional criteria for emergency response facilities

18.7.4 Technical Evaluation

The staff reviewed FSAR, Revision 1, Section 18.7, Human-System Interface Design; HSI Design IP; portions of the FSAR, Revision 1, Chapter 7, Instrumentation and Controls; and portions of the FSAR, Revision 1, Chapter 9, Auxiliary Systems, related to communication systems. The staff also reviewed the NuScale US460 Human-System Interface Style Guide, ES 122317, Revision 0 (US460 HSI Style Guide), and the communication system design description (CSDD) during audits in August and September 2023 (ML23067A300). The staff finds that the information in these documents is consistent with the guidelines and criteria of NUREG-0711, Chapter 8.

The descriptions below focus primarily on content in the FSAR, US460 HSI Style Guide, and CSDD. The information in these documents describes the following aspects of the application of HFE principles to the NuScale US460 HSI design process:

  • inputs to the HSI design process
  • the concept of how HSIs are used and an overview of the HSI.
  • the methodology and guidance used in developing the HSI.
  • the HSI description of the MCR, TSC, EOF, and local control stations (LCSs), covering their form, function, and performance characteristics.
  • how the design minimizes the effects of degraded instrumentation and controls (I&C) and HSI conditions on personnel performance
  • the commitment regarding the outcomes of tests and evaluations undertaken to support the HSI design through ITAAC.

The OER IP, TIHA IP, TA IP, and ConOps provide additional details. These TRs support the primary documents by providing specific details on the aspects of the HSI design listed above.

Although this level of detail is helpful to the st aff in evaluating the consistency of the analysis and the methods with the guidance, it will not be described here for the sake of brevity unless there is a special circumstance, such as a deviation from the guidance or an unusual approach that warrants additional discussion.

18-33 Human-System Interface Design Inputs

Section 18.7.2.1 of the FSAR describes the process for identifying HSI design inputs, which include the analyses of personnel task requirements, system requirements, and the NuScale US460 HSI Style Guide. The applicant described the personnel task requirements found in OER, FRA, FA, TA, and S&Q analysis and TIHA to establish design requirements for the HSIs.

The OER includes operational experience from predecessor and related plants and systems, recognized industry HFE issues, related HSI technology, issues identified by nuclear and nonnuclear plant personnel, and results from the TIHAs. The applicant stated that the allocation of functions to the operator, the machine (automated), or the combination of the two largely provides the scope of the HSI design. The applicant described how TA results establish HSI inventory requirements and alarm logic, display and control designs, procedure step acceptance criteria, and a grouping of HSI inventory. The FSAR states that the S&Q analyses influence the HSI hierarchy and navigation concepts, allocation of controls and indications to individual video display units (VDUs), and overall MCR layout. The staff finds that the personnel task requirements analysis provided in the FSAR conforms to NUREG-0711, criterion 8.4.1(1).

In the FSAR, the applicant stated that the NuScale US460 HSI design incorporates the regulatory requirements and guidance listed in the applicable elements of NUREG-0711 and NUREG-0700. The applicant stated that there are no known I&C system constraints related to the MCR layout or HSI design for monitoring and controlling multiple units. The applicant identified other requirements, such as inputs from vendor-supplied LCSs and COL-generated procedures, as inputs to the HSI design. Accordingly, the staff finds that the information in the FSAR describing the HSI inputs conforms to NUREG-0711, criteria 8.4.1(2)- (4).

Concept of Use and Human-System Interface Design Overview

Sections 18.7.2.3.1 and 18.7.2.3.2 of the FSAR describe the roles and responsibilities of operations personnel based on anticipated staffing levels and an HSI overview, respectively.

This includes the high-level description of what is automated and the operators duties to monitor and evaluate these automated functions. The applicant also describes how the control room layout facilitates the operation and contro l of multiple units and common plant systems from a single control room. The ConOps describes the roles and responsibilities of operations personnel for the US460 design. Section 2.2.3 of the HSI design IP provides details on the technical bases and the iterative HSI design process. As requested during the audit, the applicant provided the CSDD to further illustrate the technologies supporting teamwork and communication within the MCR and between the MCR and the TSC, and the EOF. The US460 design does not include a remote shutdown facility, and such a facility is not required by GDC

19. Nonetheless, as discussed below, consistent with GDC 19, the SDA provides for shutdown capability outside the MCR in the event of an MCR evacuation.

Accordingly, the staff finds that the information in the FSAR adequately describes the concept of use and the overview of the HSI design in acco rdance with NUREG-0711, criteria 8.4.2(1)- (2).

Human Factors Engineering Design Guidance for Human-System Interfaces

Section 18.7.2.3.3 of the FSAR describes how the HSI design uses a style guide that applies to the MCR, the emergency response facilities, and other HSIs throughout the plant, including the waste management control room, the module ma intenance center, and other LCSs. The FSAR states that NUREG-0700, Revision 3, serves as the initial source for the development of the style guide, and as the HSI design progresses, the style guide details increase and use precise, easily observable guidance statements for cons istency and supplemental graphical examples, 18-34 as needed. This includes specific definition of colors in the color palette, equipment symbols, and size and type of text font.

During the audit process, the staff used the five criteria in NUREG-0711, Section 8.4.3, HFE Design Guidance for HSIs, in conjuncti on with NUREG-0700 to review the US460 HSI Style Guide. This document describes the details of the HSI design process, HSI attributes for labels and fonts, colors, navigation, icons, control of equipment, process library, and notifications. The US460 HSI Style Guide describes the display page design, workstation design, alarm systems, and control room environment. During the audit period, the staff requested clarifying information to supplement the information in the style guide. The applicant presented the staff with a virtual demonstration of the workstation and workplace design, including the displays that make up the SPDS and the group-view display system and the soft control system. The staff was also provided with the CSDD to demonstrate how the communication system supports crew communication. The staff finds that the application and the supplemental information provided are consistent with NUREG-0711, criteria 8.4.3(1)- (5).

General Human-System Interface Design and Integration

FSAR Section 18.7.2.4 provides information on how the performance-based tests and outputs from the planning and analysis phase of the HFE program are used to validate that the integrated system design supports the safe operation of the plant. The HSI detailed design and integration are performed using outputs from the planning and analysis described in sections 18.2 through 18.6 of the FSAR, which include the HFE program elements of OER, FRA and FA, TA, S&Q, and the treatment of IHAs. Additionally, the design features from sections 8.4.4.2-8.4.4.6 of NUREG-0711 are also considered in the HSI design and integration.

FSAR Section 18.7.2.4.1 describes the general considerations for HSI design and integration.

As indicated in the staff review of TIHA in Section 18.6 of this report, no actions are identified as IHAs; thus, criterion 8.4.4.1(1) of NUREG-0711 is not applicable.

The staff reviewed Section 18.7.2.4.1 to determine the basis for the HSI layout and finds that the number and location of displays in the MCR, the hierarchy of the individual HSI screens for each workstation, and the arrangement of the workstations within the MCR are based on job analysis, an understanding of the frequency and sequence of use (e.g., startup, shutdown, normal operating, abnormal operating, and accident situations), and the roles defined for operators during S&Q analysis. Because NuScale based the layout of HSIs in the MCR on analyses of personnel roles and systematic strategies for organization, the staff finds that criterion 8.4.4.1(2) of NUREG-0711 is met.

The staff reviewed FSAR Section 18.7.2.4.1 to evaluate how the HSI design supports inspections, maintenance activities, and testing activities. The FSAR states that the HSI design supports monitoring and management of automat ed actions and sequences by the operator, including administrative tasks integrated into an electronic information and records management system that is available to operators. The in formation records management system is used to control work and manage component tagging for out-o f-service conditions. This system is used to communicate status information with the plant HSI, which uses shading and a color scheme to alert the operators of equipment status conditions on the system VDU. Operators access the information and records management system to review technical documents, reports, test results, and other work documents to confirm the readiness of structures, systems, and components for operations. Because of the capabilities of the IRM system, the staff concludes 18-35 that the operators can manage maintenance activities to prevent interference with other plant control activities, and the HSI design supports maintenance and testing of both plant equipment and the HSIs. Therefore, the staff concludes that criterion 8.4.4.1(3) of NUREG-0711 is met.

The staff reviewed FSAR Section 18.7.2.4.1 and the ConOps to evaluate how the HSI design supports personnel task performance considering staffing levels and shift duration. The FSAR states that the NuScale US460 design incorporates passive features, modular design, and a high degree of automation. This combination of design attributes reduces the number of alarms, controls, indications, and procedures, which decreases the task burden for operators. The arrangement or hierarchy of individual screens is based on job analysis, the frequency and sequence of use, and operator role to increase the simplicity of navigation. Task-based displays are incorporated to reduce navigation steps during procedure use. The features incorporated into the HSI design enhance the ability of operators to maintain situational awareness of overall plant conditions and reduce operator fatigue. The ConOps, Section 3.2.5, states that the HSI layout in the MCR is specifically designed to support minimum, nominal, and enhanced staffing during crew meetings, shift turnover, and additional staffing during various operating conditions such as refueling and accident conditions. In addition, the detailed design of the MCR facility optimizes facility attributes that are known to affect fatigue, such as lighting, ergonomics, and physical layout. The MCR has a concave layout, wh ich provides control room personnel with a panoramic view of each of the unit overview displays and the common systems overview display. Because the HSI design supports personnel task performance for all modes of operation and incorporates methods such as automation, task-based displays, and reduced screen navigation, the staff finds that criteria 8.4.4.1(4)- (5) of NUREG-0711 are met.

Section 18.7.2.4.1 of the FSAR states that the environmental conditions in the MCR, including temperature, humidity, air quality, and radiation protection, are controlled using RG 1.196, Control Room Habitability at Light-Water Nuclear Power Reactors. The applicant further states that the design of auxiliary systems such as heating, ventilation, and air conditioning systems, and lighting systems incorporates inputs from the HFE team. The staff also reviewed the US460 HSI Style Guide, Section 6.0, which includes guidance for general workplace considerations, including thermal comfort, illumination, and auditory environment. The staff finds that the applicant considered a full range of environmental conditions, such as temperature, humidity, lighting, noise levels, and radiation, during HSI design and thus meets criterion 8.4.4.1(6) of NUREG-0711.

Section 18.7.2.4.1 of the FSAR states that HSI modifications in the operating plant are a COL responsibility to be addressed by the COL holders design change control processes. The Human Performance Monitoring Program in Section 18.12 of the FSAR provides the COL item, which states that an applicant that references the NuScale Power Plant US460 standard design will provide a description of the Human Perfor mance Monitoring Program in accordance with applicable NUREG-0711 or equivalent criteria. Regarding temporary HSI changes, such as setpoints and personnel-defined HSIs, Section 7.2.14.4 of the FSAR states that operator workstation displays provide a manual and automatic control station interface to process controls. The FSAR states that displays are provided for operator adjustment of setpoints, bias, output, and manual and automatic control switchi ng and indication of the associated equipment status and process. The ConOps states that the operator may intervene and adjust appropriate setpoints within allowable limits as a part of an HSI feature associated with automated operation to enable performance monitoring. The staff finds that the applicant meets criterion 8.4.4.1(7) of NUREG-0711.

18-36 Criterion 8.4.4.1(8) of NUREG-0711 applies on ly to modifications and was therefore not considered.

Main Control Room Design

Section 18.7.2.4.2 of the FSAR states that the MCR HSI design addresses specified parameters in accordance with the guidance in Section 8.4.4.2 of NUREG-0711, Revision 3. The staff reviewed sections of the HSI IP; the ConOps, Chapter 7, Instrumentation and Controls; and the US460 HSI Style Guide to ensure consistency with the guidance. The safety display and indication system (SDIS), which is the NuScale equivalent of the SPDS, includes a spatially dedicated, continuously visible display panel for each unit in the MCR. In Section 7.1.1.2.2 of the FSAR, the applicant identified three critical safety functions (CSFs) for the NuScale designcontainment integrity, reactivity control, and core heat removalthat can be monitored for each unit on the SDIS consoles. FSAR Table 7.1-7, Summary of Post-accident Monitoring Variables, lists the parameters that the applicant has identified for the purpose of monitoring the CSFs. The staff reviewed the US460 HSI Style Guide, Sections 3.2 and 3.3 of the ConOps, and the description of the SDIS VDUs in Section 7.2.13 of the FSAR and finds that they reflect the applicable guidance for SPDS in NUREG-0700, Section 5. The staff finds that the application and the supplemental information provided are consistent with NUREG-0711, criterion 8.4.4.2(1).

The staff reviewed Sections 7.2.13, Display s and Monitoring, and 7.2.14, Human Factors Considerations, and subsections of the FSAR and the HSI design IP regarding how information is presented in the MCR. The SD IS, module control system (MCS), and plant control system (PCS) provide information for monitoring, indications, alarms, and the capability to manually manipulate the display parameters in accordance with the criteria in Section 8.4.4.2 of NUREG-0711 as applicable.

Section 7.2.13.4 of the FSAR describes how the HSI provides automatic indication of bypassed or deliberately rendered inoperable safety systems. This section of the FSAR also states that NuScale evaluated bypassed and inoperable status indication functions as part of the module protection system (MPS) failure modes and effect s analysis. The FSAR states that the primary purpose of the MPS is to monitor process variables and provide automatic initiating signals in response to out-of-normal conditions, ensuring protection against unsafe NuScale Power Module (NPM) operation during steady-state and transient power operation. The MCS provides continuous indication of the MPS protective actions that are bypassed or deliberately rendered inoperable. The display of the status information allows the operator to identify the specific bypassed functions and to determine system status and operability. Section 7.2.13.5 states that an independent monitoring system monitors the status of the MCS and PCS to detect and alert the operator to a loss of the overall I&C system. Section 4.4.12 of the US460 HSI Style Guide contains an HSI requirement that each NuScale HSI display page contains a heartbeat indication to quickly alert operators that the data on the HSI have stopped operating or updating.

Alarms associated directly with the SDIS are for failures of a communication module or a display. The FSAR states that the SDIS displays the status of the actuation devices controlled by the MPS and PPS. The operators use this information to verify the completion of protective actions. The MCS provides the alarms, alarm history, and trending information to the plant operators through the HSIs. The staff found that the applicant described how the HSI ensures the automatic indication of the bypassed and inoperable status of a safety function and the systems actuated or controlled by the safety function. Accordingly, the staff finds that the application and the supplemental information provided are consistent with NUREG-0711, criterion 8.4.4.2(2).

18-37 FSAR Section 7.2.13.6 states that the SDIS provides the capability to monitor containment pressure, containment water level, noble gas effluents, and the reactor containment atmosphere for radioactivity released from postulated accidents. This section also states that the safety valve position indication is processed by the MPS and then sent to the SDIS and the MCS for display in the MCR. The applicant stated that alarms alert the operators to deviations from setpoints, excessive rates of change, high or low process values, and contact changes of state from normal. Additionally, the radiation monitor under the bioshield provides radiation levels, core exit temperatures, wide-range reactor coolant system pressure, reactor coolant system hot temperature, and reactor pressure vessel. The SDIS displays these parameters, which indicate inadequate core cooling. Section 12.3.4.3 of the FSAR states that NuScale area radiation monitors provide both indication and alarm functions to the local plant area, the MCR, and, for selected areas, the waste management control room. Thus, the staff concludes that visual and audible indications of containment abnormal conditions, including high radioactivity, are provided to operators in the MCR through the SDIS HSIs. Therefore, the staff finds that the application is consistent with NUREG-0711, criteria 8.4.4.2(3), (5)- (7), and (10)- (11).

Section 7.2.2.1 of the FSAR states that the MPS manual trip/actuate, operating bypass, and enable nonsafety control switches are in the MCR. Section 7.2.12.2 of the FSAR states that MCR operators can use the safety-related enable non-safety control switch for manual component-level control of engineered safety f eature equipment. This control is overridden by any automatic or manual safety-related signal within the actuation priority logic. DCA Part 2, Tier 2, Section 7.1.5.3, Diversity and Def ense-in-Depth Assessment Regulatory Conformance, states that the SDIS provides independent and diverse display of CSFs. During the US460 SDA audit, NuScale provided the staff with a virtual demonstration of the simulator, including the process library which contains the computer-based procedures. The staff finds that the design guidance and the example of the HSI for computer-based procedures provided in the US460 HSI Style Guide is consistent with the guidance in NUREG-0700. Therefore, the staff finds that the application is consistent with NUREG-0711, criteria 8.4.4.2(12), (13), and (15).

Criterion 8.4.4.2(4) is not applicable as the NuScale US460 design does not include an auxiliary or emergency feedwater system. The portion of crit erion 8.4.4.2(5) that requires the monitoring of containment hydrogen concentration is not applicable as the NuScale US460 containment does not include equipment for hydrogen monitoring. In SDAA Revision 1 Part 7, Exemptions, NuScale requests an exemption from 10 CFR 50.34(f)(2)(xvii)(C) which requires the capability for monitoring containment hydrogen concentration in the control room. The staff evaluates this exemption requests in section 6.2.5 of this SE. The staff did not evaluate NUREG-0711, criteria 8.4.4.2(8)-(9), because they apply to boiling-water reactors only, and the NuScale design is a pressurized-water reactor. As indicated in the staffs review of TIHA in Section 18.6 of this report, no actions are identified as IHAs, and thus criterion 8.4.4.2(14) of NUREG-0711 is not applicable.

Technical Support Center and Emergency Operations Facility Human-System Interface Design

Sections 13.3, Emergency Planning, 18.7.2.4.3, Technical Support Center (TSC), Emergency Operating Facility (EOF), Waste Management Control Room, and Module Maintenance Center, and 18.7.2.4.4, Local Control Stations, of the FSAR describe how the HSI presents information in these plant locations. The HSIs in these locations are derivatives of the MCR HSIs. The SDAA states that TSC and EOF HSIs comply with both the US460 HSI Style Guide and NUREG-0696. SRP Chapter 18, Revision 3, states the following:

18-38 NUREG-0696, Functional Criteria for Emergency Response Facilities, also includes general HFE criteria for these facilities and the staff has accepted a commitment to implement these criteria as an alternative to the NUREG-0711 criteria.

As a result, the staff used the NUREG-0696 criteria to review TSC and EOF HSI design.

Section 13.3 of the FSAR describes how the HSIs in the TSC provide personnel with the information needed to analyze the plants steady-state and dynamic behavior before and during an accident, including environmental and radiological conditions, and communication capabilities for the purpose of understanding the accident sequence, deciding mitigation actions, and evaluating the extent of damage for recovery operations. Section 2.2.3 of the PMP states that the TSC is equipped with voice communica tions systems that provide connections between the TSC and plant, local, and offsite emergency response facilities, the NRC, and local and State operations centers. FSAR Section 9.5.2, Communication System, provides additional information on communications equipment and power sources. Section 7.2.13.7 of the FSAR states that the MCS and PCS provide monitoring data through one-way communication interfaces to the plant network that provides data recording, trending, and historical retention that can be retrieved on EOF and TSC engineering workstations.

Post-accident monitoring variables that are displayed in the MCR on the SDIS are also displayed on the MCS or PCS, and some post-accident monitoring variables are displayed only on the MCS and PCS. Section 13.3 of the FSAR states that the TSC is equipped with voice communications systems that provide connection s between the TSC and plant, local, and offsite emergency response facilities; the NRC; and local and State operations centers. Because HSIs in the TSC are designed using HFE design criteria in the US460 HSI Style Guide, which is based on accepted HFE principles, and the TSC contains equipment for voice communication between the TSC and onsite and offsite locations, the staff finds that the TSC HSI design complies with the general HFE design criteria in NUREG-0696 and that the design of the TSC includes appropriate parameter displays for accident conditions. Section 13.3 of the FSAR includes a commitment for the COL applicant to design the EOF in accordance with NUREG-0696, which is appropriate. Accordingly, the st aff finds that the application is consistent with the acceptable alternative to criteria in NUREG-0711, criteria 8.4.4.3 and 8.4.4.4, as it provides for compliance with NUREG-0696.

Remote Shutdown Facility and Local Control Station Human-System Interface Design

The US460 design does not include a remote shutdown facility. As described in Section 7.1.1.1 of the FSAR, and consistent with NuScales Prin cipal Design Criterion 19, the MCR is designed with the ability to place the reactors in safe shutdown in case of a fire requiring an MCR evacuation and for safe shutdown to be maintained without operator action thereafter. Before evacuating the MCR, operators trip the reactors, initiate decay heat removal, and initiate containment isolation. These actions result in passive cooling that achieves safe shutdown of the reactors. Operators can also achieve safe s hutdown of the reactors from outside the MCR in the I&C equipment rooms within the reactor building. FSAR Section 9.5.1.2.8, Post-Fire Design Functions, states that a redundant safe shutdown capability exists at controls in the equipment I&C rooms. Operators can confirm safe shutdown conditions and monitor the NPMs at alternate operator workstations in various locations, as stated in Section 7.1.1.2. of the FSAR. In the event of a fire in the MCR, two switches for each NPM are available outside the MCR to isolate the MPS manual actuation switches and to enabl e non-safety switches for each NPM's module protection system in the MCR to prevent spurious actuation of equipment due to fire damage.

18-39 In Section 7.1.1.1 of the FSAR, the applicant states that no remote displays, alarms, or controls are necessary to monitor or maintain the modules in a safe shutdown condition. However, the staff notes that Section 7.2.13 of the FSAR states that if the MCR is evacuated, the alternate operator workstations at various locations allow the operators to monitor the NPMs in a safe-shutdown condition with the Decay Heat Removal System (DHRS) in service for each NPM. Controls are available outside the M CR in the associated I&C equipment rooms that provide the capability to trip the reactors, to initiate DHRS, and to initiate containment isolation, which initiates passive cooling, and places and maintains the NPMs in safe shutdown. The alternate operator workstations provide non-safety-related HSIs and direct readings of the process variables necessary to monitor safe shutdown of each NPM. The alternate operator workstation controls and monitoring have an identical set of MCS and PCS displays located at various locations throughout the plant for the operator to monitor the plant operation if evacuation of the MCR is required. Therefore, the staff finds that the application meets criterion 8.4.4.5(1) and (2) of NUREG-0711, because the applicant has described how the HSI provides shutdown and monitoring capabilities outside the MCR equipment in the event of an MCR evacuation.

Section 3.3.5 of the TIHA RSR states that when an LCS is required for conducting an IHA, LCS HSIs are designed using the same HSI style guide as the MCR HSIs. The ConOps specifies division of tasks and supporting HSIs between the MCR and LCSs. The ConOps informs and guides the design and engineering effort as it relates to the HSI and supporting equipment.

Section 18.7.2.3.3 of the FSAR states that the style guide section for VDU-based HSIs is used for the MCR, facilities that use HSIs derived from the MCR, and LCS HSIs. For vendor-supplied LCSs, the HFE program scope is limited to ensuri ng that those interfaces adhere as closely as possible to applicable guidelines from NUREG- 0700. As such, the applicants plan to design LCSs used for IHAs according to the US460 HSI Style Guide is acceptable because the guidelines will help to ensure that errors are minimized during the performance of operator actions at these LCSs. Therefore, the staff concludes that the application conforms to criterion 8.4.4.6(1)- (2).

Instrumentation and Control Degradations, Automation Failures, and Human-System Interface Conditions

Sections 7.1, 9.5, and 18.7.2.4.5 of the FSAR provide information about how the HSI is designed to accommodate I&C and HSI system failures. The applicant stated that procedures govern operator identification of and response to the various failure modes. The FSAR describes the accommodations in place for VDU failures. The failures of individual VDUs are accommodated by use of other VDUs at the workstation for the affected unit. The loss of all VDUs at a workstation is accommodated by monitoring redundant MCR workstations. If all MCR workstations are lost, all units can be shut down either from hardwired controls in the MCR or at the MPS cabinets. The HSI design facilitates monitoring automation for expected plant response and detection of automation failures when plant response is not as anticipated. Section 7.2.13.2 of the FSAR describes the fault detection and alarming functions of the SDIS. Annunciators and alarms are used to inform operators about deviations from normal operating conditions for MPS and PPS variables. Failures of automation sequences are alarmed in the MCR. Because the applicant specified the alarms and information that personnel need to detect degraded I&C and HSI conditions in a timely manner, the staff finds that the application is consistent with NUREG-0711, criteria 8.4.5(1)- (4).

18-40 The staff reviewed Section 18.7.2.5 of the FSAR for information on the tests and evaluations of concepts and detailed design features. The applicant stated that the HSI design tests and evaluations include tradeoff evaluations and performance-based tests. Tradeoff evaluations pertain to comparing HSI design approaches and consideration of alternatives. In comparing HSI design approaches, consideration is given to techniques that enhance human performance of tasks, including IHAs. Performance-based tests are used to validate that the integrated system design (e.g., hardware, software, procedures, and personnel elements) supports the safe operation of the plant. Section 3.7.1 of the HSI Design IP states that, before performing tests on a hardware or software implementation, the design is subject to review. This review identifies HFE issues to be addressed before experimental evaluation and ensures that the design maturity is commensurate with the current design phase. Review of the design may also generate HFE questions or identify design tradeoffs that cannot be resolved by static analysis and should be considered for inclusion in subsequent tests. The staff finds that the methodology used by NuScale includes conducting both tradeoff evaluations and performance-based tests during iterative HSI design stages and thus meets NUREG-0711, criteria 8.4.6.1(1)- (2) and 8.4.6.2(1)- (3).

Section 18.7 of the FSAR states that the results of HSI activities are compiled in an RSR that is consistent with the methodology described in the HSI IP and the guidance in the applicable portion of NUREG-0711, Revision 3. The exact details of how the HSI presents the information in the MCR and TSC are aligned with the HSI IP in an RSR. As discussed in Section 18.1 of this SE, SDA applicants may defer the submittal of an RSR for HSI design, until the COL stage. The staff has not received the RSR for HSI design from the applicant. The applicant has adopted a strategy of completing certain HFE elements and submitting RSRs at a later date.

Section 18.1.2 of this SE describes this strategy. The staff can review the results when the work is complete as part of the closure verification of ITAAC 03.15.01. In SDAA Part 8, Section 3.15.1, ITAAC Design Description, the ITAAC system description for the HFE program scope includes the layout requirements of the control rooms, the basic concepts and detailed design requirements for HSI control stations, the HFE design requirements and guidelines for the screen-based HSI, and corporate policies and procedures for the V&V of the design of HSI. As described in ITAAC 03.15.01, the as-built MCR HSI will be inspected, and a subsequent report prepared to confirm that the MCR HSI is consistent with the design verified and validated by the ISV in accordance with the DI IP. The staff finds that this approach provides an opportunity for the staff to confirm, at the COL stage, that HSI design methods are employed in accordance with the HSI IP and the US460 HSI Style Guide to verify that the results support a conclusion that the HSI design will support safe operation.

18.7.5 Combined License Information Items

No COL information items are associated with Section 18.7 of the NuScale US460 FSAR.

18.7.6 Conclusion

The staff finds that the applicants description addresses the objectives of an HSI design process, to translate the functional and task requirements into HSI design requirements and into the detailed design of alarms, displays, controls, and other aspects of the HSI. The staff reviewed the applicants HSI design process and finds that it conforms to the applicable criteria and process described in NUREG-0711, Section 8. 4. The applicants HSI design process is based on systematically applying HFE principles. Acco rdingly, the staff finds that this program element supports compliance with the relevant HSI design regulations as described in 10 CFR 50.34(f)(2)(iii); 10 CFR 52.137(a)(8); 10 CFR Part 50, Appendix A, GDC 19; and the applicable 18-41 MCR display requirements of 10 CFR 50.34(f)(2) related to this element. The results of the HSI design process will be documented in an RSR that will allow the staff to audit the results when the activity is complete, if necessary to verify closure of HFE ITAAC.

18.8 Procedure Development

NUREG-0711 includes procedure development bec ause HFE attributes are associated with the procedures., The staff reviews procedure development as an operating program. The staffs conclusions regarding the applicants proposed process for developing plant procedures are set forth above in Section 13.5, Plant Procedures of this SE.

18.9 Training Program Development

NUREG-0711 includes training program development because of the interfaces between the HFE design, procedures, and training. However, as an operating program, the staff reviews training program development and documents its conclusions in SER Section 13.2, Training of this SE.

18.10 Verification and Validation

18.10.1 Introduction

V&V evaluations comprehensively determine whether the HFE design conforms to HFE design principles and enables plant personnel to successfully perform their tasks to ensure plant safety and operational goals. The V&V element consists of four major activities: sampling of operational conditions (SOC), design verification, integrated system validation (ISV), and HED resolution. The staff reviewed the V&V element in accordance with the objectives of NUREG-0711, Chapter 11, Human Factors Verification and Validation, Section 11.2, and using the review criteria in Section 11.4.

NUREG-0711, Section 11.3, Applicant Products and Submittals, states that the applicant should provide either an IP or a completed RSR. The applicant has submitted an IP, which is evaluated in Section 18.10.4 of this report. ITAAC 03.15.02 verifies that an ISV test is performed in accordance with the V&V IP.

18.10.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.10, Verification and Validation.

ITAAC: SDAA Part 8, Section 3.15, Table 3.15-1, ITAAC No. 03.15.02 is associated with this HFE element.

Technical Specifications: There are no TS associated with this HFE element.

Topical Reports: There are no topical reports associated with this HFE element.

Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18.10.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

18-42

  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.

18.10.4 Technical Evaluation

The staff reviewed Section 18.10, Human Factors Verification and Validation, of NuScale US460 FSAR, Revision 1, and noted that it is generally consistent with the criteria in NUREG-0711, Section 11.4. The review objectives are accomplished through verification that four activities have been carried out properly by the applicant: SOC, design verification, ISV, and HED resolution.

Descriptions of how these objectives will be met are provided below. Note that these descriptions focus primarily on content in the FSAR. The V&V IP contains additional detail in each of these areas. The V&V IP is helpful in de termining specific details of factors like the scope of the operational conditions sampling strategy. Although this level of detail is helpful to the staff in determining the consistency of the V&V process with the guidance, it is not described here for the sake of brevity unless there is a circumstance that warrants additional detail, such as a deviation from the guidance, or an unusual treatment that warrants additional discussion.

Sampling of Operational Conditions

FSAR Revision 1, Section 18.10.2.1 and the associated subsections, along with various sections of the V&V IP, describe a systematic process for sampling operational conditions, including defining the sampling dimensions and scenarios. This includes, but is not limited to, identifying a range of plant operating conditions, personnel tasks, and situational factors known to challenge personnel performance. The process also emphasizes the selection of scenarios with I&C and HSI failures, as well as degraded conditions due to the increased use of digital technology in the NuScale control room. The staff compared the list of plant operating conditions, personnel tasks, and situations in NUREG-0711, criteria 11.4.1.1(1-3), to that proposed by the applicant and found that the scope of this program is consistent with the NUREG-0711 criteria. In the V&V IP, Sections 2.2 and 2.3, the applicant described the systematic process that will be used to ident ify and develop scenarios based on the previously mentioned sampling dimensions. The staff noted that the V&V IP does not contain specific scenarios. This is not unusual as the scenarios are not typically shared at this point but rather are developed closer to the time when ISV will be executed. The IP provides the methodology for developing detailed scenarios for ISV. The st aff compared this process to the NUREG-0711, criteria 11.4.1.2(1)- (2) and 11.4.1.3(1)- (3) and found the process acceptable. A complete set of scenarios will be included in the V&V RSR; the staff can confirm this as part of closure verification for ITAAC 3.15.02.

Design Verification

FSAR Revision 1, Section 18.10.2.2 and the associated subsections, along with various sections of the V&V IP, describe a systematic process for (1) verifying that the HSI inventory and characterization accurately describe all HSI displays, controls, and related equipment within the scope defined by the SOC, (2) ensuring ava ilability of the items needed to support task 18-43 requirements including alarms, information, controls, and task support for personnel to perform their tasks, as defined by the TA, and (3) verifying the suitability of the HSI with regard to consideration of human strengths and limitations.

Specifically, the V&V IP, Section 3.1.1, Human-System Interface Inventory, describes how an inventory is generated during TA. The TA results define the inventory and characterization for alarms, controls, indications, and procedures needed to execute all operator tasks. This inventory is then compared to the HSIs needed for the tasks included in the applicants SOC, which are a subset of all operator tasks. The staff reviewed the V&V IP, Section 3.1.2, in which the applicant listed the minimum set of information provided for HSI scope and characterization and the process for HSI inventory verification. The staff compared the list in the V&V IP, Section 3.1.2, to the list in NUREG-0711, criteria 11.4.2.1(1-2), and found the lists to be consistent. Thus, the staff finds that the verification process meets NUREG-0711, criterion 11.4.2.1(3).

The staff reviewed FSAR Section 18.10.2.2.2, Human-System Interface Task Support Verification. The staff compared Section 18.10.2.2.2 to criterion 11.4.2.2(1), which states that the HSI task support verification criteria should be based on the HSI identified by the applicants TA. Section 18.10.2.2.2 states that the verification criteria are based on the TA results that define the inventory and characterization for the alarms, controls, indications, procedures, automation, and task support needed to execute operator tasks, including manual tasks, automation support tasks, and automation monitoring tasks. Criteria 11.4.2.2(2)- (5) state that the applicant should compare the HSIs and their characteristics to the needs of personnel identified in the TA for the defined SOC, and discrepancies should be identified and documented for resolution. The V&V IP, Section 3.3.2, HSI Task S upport Evaluation Methodology, provides a five-step HSI task support evaluation method. The method includes ensuring that a subject matter expert (SME) is performing the process, verifying that the appropriate task or procedure is ready for performance, performing the selected task using the HSI, and confirming that the HSI supports all the steps necessary to complete the task and any discrepancies are noted during task performance. The staff finds that the application is consistent with the guidance in NUREG-0711, criteria 11.4.2.2 (2)- (5).

The staff compared FSAR Section 18.10.2.2.3, Human Factors Design Verification, to criteria 11.4.2.3(1)- (5), which addresses the applicants process for confirming that HSI characteristics conform to HFE guidelines as represented in NUREG-0700 and the NuScale HSI Style Guide.

The staff also reviewed the V&V IP, Section 3.2.2, which further details the applicants process, which includes having an SME perform the process, selecting the sample of HSI displays and components to test, comparing the HSI design to the design guide, and documenting discrepancies noted during verification. The staff finds that the application is consistent with the guidance in NUREG-0711, criteria 11.4.2.3(1)- (5).

Integrated System Validation

The objective of the ISV review is to verify that the applicant validated, using performance-based tests, that the integrated system design (i.e., hardware, software, procedures, and personnel elements) supports the safe operation of the plant. FSAR Revision 0, Section 18.10.2.3 and the associated subsections, along with various sections of the V&V IP, describe a systematic process for conducting an ISV. As noted above, the actual ISV scenarios are not shared at this time, but the staff will have a chance to review them for the COL before the ISV is conducted in accordance with ITAAC (03.15.02), which ensures that the ISV test is performed in compliance with the V&V IP.

18-44 Validation Team

NUREG-0711, Section 11.4.3.1, Validation Team, states that the applicant should describe how the team performing the validation has independence from the personnel responsible for the actual design. Criterion 11.4.3.1(1) also states that members of the validation team should have no responsibility for the design, i.e., they should never have been part of the design team.

The main intent is to ensure that bias is adequately controlled during ISV data collection (e.g.,

using observer notes and evaluations) and during the analysis and evaluation of ISV results performed to determine whether design changes are necessary.

NuScales proposed Validation Team includes some individuals who were part of the design team, and it thus does not meet the requirement of Criterion 11.4.3.1(1), that members of the validation team should have had no responsibility for the design, i.e., they should never have been part of the design team. During the August 2023 audit (ML23067A300), the staff asked for a description of the methods used to avoid bias. NuScale responded that, as stated in the V&V IP, Section 4.1, the validation team will consist of a test lead, plant operations experts, HFE experts, one lead testbed engineer, and testbed support staff as needed. Validation activities are performed using a blend of both validation observers with independence from involvement with the actual design and those without. NuScale stated that this provides detailed knowledge of how the HSI is expected to work so deviations can be more easily recognized. Through previous validation testing efforts and lessons learned, the applicant stated that pure independence yields observations and comments that do not provide valuable insights because the knowledge of observers is commonly based on existing plant experience with concepts of operation that do not align with those of new reactors. Other mitigation methods are used to ensure that test conclusions are unbiased:

  • The validation uses both objective perform ance measures to demonstrate safety and subjective measures that include observer comments that support interpretation of data and provide insight on dispositive failures.
  • The method, including the detailed scenarios and the validation test plan, is available for internal or external audit in advance of the formal validation.
  • Formal validation activities intended for regulatory review are scheduled such that all, or any portion, is available for internal or external audit during the validation performance.
  • The observation team members are trained and qualified to conduct validation objectively.
  • At least half of the observers must have independence from the HFE design team.

The applicant provided a multifaceted strategy for controlling the potential for bias within the validation team, which includes the following: 1) use of both objective and subjective measures as part of a holistic approach to data interpretation, and 2) training validation team members to conduct the ISV in an objective manner which includes training on the importance of independent observer input. Given the aforementioned strategies, the staff finds that the applicants approach in the V&V IP meets the intent of NUREG-0711, criterion 11.4.3.1(1). The V&V RSR, in addition to ITAAC 03.15.02, allows the staff to verify later that bias is being mitigated in accordance with the V&V IP.

18-45 Test Objectives

NUREG-0711, Section 11.4.3.2, Test Objectives, includes two criteria for this topic.

Criterion 11.4.3.2(1) states that the applicant should develop detailed test objectives to provide evidence that the integrated system adequately suppor ts plant personnel in safely operating the plant and includes a list of considerations. The staff compared the list in the V&V IP, Section 4.2, Test Objectives, to the list in criterion 11.4.3.2(1) and finds the list to be consistent with this criterion. The second criterion addresses plant modifications and is not applicable to the NuScale FSAR; thus, the staff evaluated only the first criterion, as discussed above.

Validation Testbeds

NUREG-0711, Section 11.4.3.3, Validation Testbeds, includes nine criteria for this topic including interface completeness; interface physical and functional fidelity; environmental fidelity; and data completeness, content, and dynamics fidelity. The principal validation testbed for the ISV is the control room simulator. The staff reviewed FSAR Section 18.10.2.3.3, along with the V&V IP, Section 4.3, which details the applicants validation testbed and the control room simulator and describes the fidelity of the validation testbeds models and HSI as verified to represent the current, as-designed NuScale Power Plant before use for the validation. The staff finds that the applicants description of the testbeds HSI functionality and data fidelity and completeness is consistent with NUREG-0711, Section 11.4.3.3, criteria (1)- (7).

In Section 4.3.8 of the V&V IP, the applicant explained that no IHAs conducted outside of the MCR have been identified. If an IHA outside of the control room is identified in a later design stage, the testbed will use mockups to verify human performance requirements for IHAs conducted at HSIs remote from the MCR. In addition, in Section 4.3.9, the applicant stated that the testbed will be verified to conform to required characteristics before validation tests are conducted. FSAR Section 18.1.3.5 states that an RSR is prepared for the following elements upon completion of the associated HFE activities: OER, FRA/FA, TA, HSI design, and human factors V&V. The V&V RSR, in addition to ITAAC 03.15.02, allows the staff to verify at the COL stage that an ISV test is performed in accor dance with the V&V IP and ensures the conformity of the testbed to the required characteristics, thus satisfying criteria 11.4.3.3 (8)-(9).

Plant Personnel

NUREG-0711, Section 11.4.3.4, Plant Personnel, includes four criteria for this topic to ensure that participants are representative of plant personnel, to properly account for human variability, to ensure that various types of staffing levels are considered, and to prevent bias in participants by avoiding selection of those that may skew the sample (e.g., members of the design team). The staff reviewed FSAR, Section 18.10.2.3.4, along with the V&V IP, Section 4.4, which details the applicants plan for the individuals participating in operating crews for the ISV.

Specifically, Section 4.4 of the V&V IP notes that operators participating in the ISV are previously licensed ROs or SROs, operators with Navy nuclear experience, design engineering staff members familiar with the NuScale Power Plant design, previously non-licensed operators at a nuclear plant, or personnel with a technical degree. Crews are distributed with consideration of age, gender, education, and experience level to control bias. Although the participants in the crews may be design engineering staff members familiar with the NuScale design, they are not part of the Human Factors Engineering Validation Team or HFE Design Team and, therefore, bias is not a concern. The categories of participants proposed by the

18-46 applicant are representative of the pool of plant personnel expected to operate in a control room.

18.10.4.1 Performance Measurement

Types of Performance Measures

NUREG-0711, Section 11.4.3.5.1, Types of Performance Measures, includes six criteria for this topic. Criteria 11.4.3.5.1(1)- (6) state that the applicant should identify plant performance measures, primary task measures, secondary task measures, measures of situation awareness, workload measures, and anthropometric and physiological measures for each ISV scenario.

The staff reviewed FSAR Section 18.10.2.3.5, along with the V&V IP, Section 4.5, which details the applicants plan for measuring performance during ISV. Performance measures included in the applicants proposed approach for ISV include measures of plant performance, personnel task performance, SA, cognitive and physical workload, and anthropometric or physiological factors. Test acceptance criteria are associated with clear and objective measures, whereas diagnostic measures are associated with supporting details or additional insight into observations and conclusions. The staff finds the proposed performance measures are acceptable to meet the criteria listed above.

Performance Measure Information and Validation Criteria

NUREG-0711, Section 11.4.3.5.2, Performance Measure Information and Validation Criteria, includes five criteria for this topic. Criteria 11.4.3.5.2(1)- (5) state that, for each performance measure, the applicant should describe how and when it is obtained, describe its characteristics, identify the criteria used to judge its acceptability and the basis for the criteria, and identify whether it is a pass/fail or diagnostic measure.

The staff reviewed FSAR Section 18.10.2.3.5, along with the V&V IP, Section 4.5, which details the applicants plan for collecting performance measures, describing the characteristics of the measure, and identifying appropriate criteria on which to judge performance. Subjective assessments are collected using post-scenario debriefs and questionnaires. Operator feedback includes scale rating questions and open feedback (long answer) questions. Objective data (e.g., video recording, administrator observations) are collected during test scenarios to assess the impacts of operator actions on plant processes and equipment states. Test observers and administrators document individual assessment s of crew performance on a post-scenario observer form after the scenario (e.g., errors of omission and commission). The bases for the performance criteria vary by measure and incl ude benchmarking, norm, requirement, and expert judgment. The staff finds that the application is consistent with the guidance in NUREG-0711, criteria 11.4.3.5.2(1)- (5).

18.10.4.2 Test Design

Test design is a process of developing scenarios, test planning, and conducting ISV with a goal of permitting the observation of integrated system performance while minimizing bias. The test design characteristics that are important to support ISV validity include scenario sequencing, test procedures, test personnel training, participant training, and pilot testing.

18-47 Scenario Sequencing

NUREG-0711, Section 11.4.3.6.1, includes two criteria for this topic. The criteria state that the applicant should balance (1) scenarios across crew s to provide each crew with a similar, representative range of scenarios and (2) the order of presentation of scenarios to crews to provide reasonable assurance that the scenarios are not always presented in the same sequence (e.g., the easy scenario is not always used first). The V&V IP, Section 4.6.1, Scenario Sequencing, discusses the applicants sequencing for validation testing and states the following about sequencing:

  • A minimum of two operating crews performs each scenario.
  • Crews perform a grouping of scenarios in a different order than other crews.
  • When running individual scenarios across multiple crews, the order of the crews is varied when the scenario is changed.
  • Scenarios also contain variable normal operation time before introducing events to ensure that operating crews are not pre-tuned to immediate events and actions at the beginning of each scenario or at the same time during each scenario.

Based on the variation in the grouping of the scenarios and the types of scenarios within the grouping the staff concludes that the applicants method is consistent with criteria 11.4.3.6.1(1)-

(2).

Test Procedures (Criteria 11.4.3.6.2 (1)- (2))

The staff reviewed Section 18.10.2.3.6.2 of the FSAR and Section 4.6.2 of the V&V IP. The staff compared the list in the V&V IP, Section 4.6, that details what is included in the applicants test procedures and how bias is controlled and finds the list to be consistent with NUREG-0711, criteria 11.4.3.6.2 (1)- (2). Additionally, ITAAC Section 3.15 includes ISV and ensures that it is performed in accordance with the V&V IP, allowing staff the opportunity to review the ISV test procedures before ISV is conducted.

Training Test Personnel (Criterion 11.4.3.6.3(1) and Training Participants (Criteria 11.4.3.6.4(1-2))

The staff reviewed Section 18.10.2.3.6.4 of the FSAR, which conveys the training for both the test personnel and participants. The test team is trained on plant systems, the HSI, and ISV test procedures. The training consists of both classroom and simulator time with well-defined training goals, emphasis on the use of test pr ocedures, documenting the problems identified during testing, and the bias and errors that test personnel may introduce into the data.

Participants training includes plant systems, HSI, plant events, and operating procedures.

Participants are not privy to the test scenarios before the scenarios begin. Only participants who have successfully completed the training program and reached an acceptable level of proficiency are qualified for operating crew assignment. Therefore, the staff concludes that the applicants method for training test personnel and participants is acceptable and meets NUREG-0711, criteria 11.4.3.6.3(1) and 11.4.3.6.4(1)- (2).

18-48 Pilot Testing (Criteria 11.4.3.6.5(1)- (2))

The staff reviewed Section 18.10.2.3.6.5 of the FSAR. The applicant proposed a pilot test that is conducted by a test crew not participating in the ISV to assess the adequacy of the test design, gives personnel experience in running the test, and ensures that the ISV runs smoothly and correctly. Therefore, the staff concludes that the applicants method is consistent with criteria 11.4.3.6.5(1)- (2).

18.10.4.3 Data Analysis and Human Engineering Discrepancy Identification (Criteria 11.4.3.7(1)- (7))

The staff reviewed FSAR, Section 18.10.2.3.7, along with the V&V IP, Section 4.7, which details the applicants plan for data analysis and identification and documentation of discrepancies when the observed performance does not meet the performance criteria. Section 4.7 of the V&V IP states that data are collected from multiple sources and reviewed by HFE and operations SMEs to assess performance results to identify significant adverse issues and trends. Data from different sources, crews, and scenarios (convergent measures) are used to reinforce findings of the significance, validity, and extent of the issue.

The data analysis compares data sources, data across crews, data across trials, and data across scenarios. The HFE and operations SMEs then collaborate on trending results and HED identification. The applicant also introduced a series of rules that guide the analysts on what constitutes a trending result (e.g., at least two individuals work independently to identify trends). Therefore, the staff concludes that the applicants method is consistent with criteria 11.4.3.7(1)- (7).

18.10.4.4 Validation Conclusions (Criteria 11.4.8(1)- (2))

The staff reviewed FSAR Section 18.10.2.3.8, along with the V&V IP, Section 4.8, which details the applicants approach to producing and documenting ISV conclusions. The ISV conclusions will be documented in the V&V RSR and will include the following:

  • the statistical and logical bases for determining that performance is acceptable.
  • the limitations in identifying possible effects on validation conclusions and consideration of the impact on the design integration HFE program element, including

- aspects of the tests that are not well controlled.

- potential differences between the test situation and actual operations

- differences between test platform design and the as-built NuScale Power Plant

Therefore, the staff concludes that the applicants method for producing and documenting ISV conclusions is consistent with criteria 11.4.8(1)- (2).

Human Engineering Discrepancy Resolution

The staff reviewed FSAR, Section 18.10.2.4, the HFE PMP, and the V&V IP to verify that the applicant has an appropriate process to (1) evaluate HEDs to determine if they require correction, (2) identify design solutions to address HEDs that must be corrected, and (3) verify the completed implementation of these HED design solutions in accordance with Section 11.4.4 of NUREG-0711, Revision 3.

18-49 In Section 5.2 of the V&V IP, the applicant stated that the HED analysis considers the principal impact on personnel tasks and functions, plant systems, HSI features, individual HSI components, and operating procedures during the HFE V&V. This analysis includes an assessment of the extent of condition, which considers cumulative or combined effects of multiple HEDs and HEDs that represent a broader issue.

FSAR Section 18.10.2.4 states that the HEDs are categorized into three principal categories (priorities 1, 2, and 3) based on their impact on personnel tasks and functions, plant systems, and cumulative effects, and as indications of broader issues. These categories are used to determine which HEDs will be corrected and when in the process they are resolved.

Sections 5.1 and 5.2 of the V&V IP describe each priority designation. Priority 1 HEDs have a potential direct or indirect impact on plant safe ty or are cross-cutting issues that have a global impact on the HSI design performance. These HEDs are resolved before ISV testing is complete. Priority 2 HEDs are those that have a direct or indirect impact on plant performance and operability. These are resolved before the plant design is complete. Priority 3 HEDs are those that do not classify as priority 1 or priority 2 HEDs and may or may not require resolution.

This is determined by an evaluation by the HFE team based on accepted HFE practices, current published HFE literature, tradeoff studies, tests, or engineering evaluations. If correction is needed for priority 3 HEDs, it is resolved during DI.

The staff concludes that the applicants HED analyses include the necessary evaluations and considerations to determine the impact of the HEDs and which HEDs should be corrected.

Accordingly, the staff finds that the HED resolution process conforms to the criteria presented in NUREG-0711, criterion 11.4.4(1)- (2).

Section 18.10.2.4 of the FSAR describes the HED resolution process. The applicant described how interrelationships of individual HEDs are considered as part of a process to identify design solutions for HEDs requiring correction. An evaluation of the design solution is conducted to ensure that no new HEDs are introduced. The SDAA states that HED resolution is performed iteratively with V&V in that an HED identified during one V&V activity may be addressed before conducting other V&V activities, depending on the HE D priority and its potential impact on the next phase of the V&V. An HFE review committee evaluates the HED resolution for final closure. HED evaluations are documented in the HFEITS database and include the following information:

  • related personnel tasks and functions
  • related plant systems
  • cumulative effects of HEDs
  • HEDs as indications of broader issues
  • design changes made for individual HEDs and their status.
  • compliance of design change with V&V evaluation criteria
  • the basis for not correcting an HED.

The staff concludes that the applicants method develops, evaluates, and documents design solutions to resolve HEDs. Accordingly, the sta ff finds that the HED resolution process conforms to the criteria in Section 11.4.4, criteria (3)- (5), of NUREG-0711, Revision 3.

18-50 18.10.5 Combined License Information Items

18.10.6 Conclusion

The staff evaluated Section 18.10, Human Factors Verification and Validation, of NuScale US460 FSAR Revision 1, and the V&V IP and finds that the process described is consistent with the criteria in Chapter 11 of NUREG-0711 and is suffi cient to properly carry out the four targeted activities: SOC, design verification, ISV, and HED resolution. As discussed in Section 18.1.2 above, the applicant uses a strategy of completion of the ISV by the COL licensee, subject to closure of ITAAC No. 03.15.02. The staff finds that this approach is acceptable, and that it will provide an opportunity for the staff to verify that the ISV was completed in accordance with the V&V IP and that the design supports safe operation of the facility.

Accordingly, the staff finds that this program element is consistent with application of state-of-the-art HFE principles to the MCR design as required by 10 CFR 50.34(f)(2)(iii).

18.11 Design Implementation

18.11.1 Introduction

Design implementation (DI) addresses the installation and testing of the HFE aspects of a plant design. The staff reviewed the DI element to verify the following:

  • The as-built design will conform to the verified and validated design resulting from the HFE design process.
  • The implementation of plant changes considers the effect on personnel performance and provides the necessary support to provide reasonable assurance of safe operations.

The staff reviewed the applicants DI implementat ion plan (DI IP) using the criteria in NUREG-0711, Chapter 12, Design Implementation, Section 12.4, Review Criteria. Section 18.11.4 of this report documents the results of this review.

NUREG-0711, Section 12.3, Applicant Products and Submittals, states that the applicant should provide an IP for HFE program management. ITAAC 03.15.01 controls completion of DI activities.

18.11.2 Summary of Application

FSAR: The applicant described this HFE element in FSAR Section 18.11, Design Implementation.

ITAAC: SDAA Part 8, Section 3.15, Table 3.15-1, ITAAC No. 03.15.01 is associated with this HFE element.

Technical Specifications: There are no TS associated with this HFE element.

Topical Reports: There are no topical reports associated with this HFE element.

Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18-51 18.11.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 50.34(f)(3)(i), as it addresses administrative procedures for evaluating operating, design, and construction experience.
  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts.

SRP Chapter 18,Section III, lists the acceptance criteria that are adequate to meet the above requirements, as well as review interfaces with other SRP sections. NUREG-0711 provides the acceptance criteria for the HFE design methodology:

  • NUREG-0711, Revision 3, Chapter 12, Design Implementation, Section 12.3, Applicant Products and Submittals, and Section 12.4, Review Criteria

18.11.4 Technical Evaluation

NUREG-0711, Section 12.4.1, Final HFE Design Verification for New Plants and Control Room Modifications, includes four applicable review criteria for this topic. The review criteria in Section 12.4.2, Additional Considerations fo r Reviewing the HFE Aspects of Control Room Modifications, of NUREG-0711 apply only to plant modifications and are therefore not applicable to this SDAA review. The staff used the criteria in NUREG-0711, Section 12.4 to evaluate the FSAR and the applicants DI IP to verify the following:

  • The as-built design will conform to the verified and validated design resulting from the HFE design process.
  • The implementation of plant changes considers the effect on personnel performance and provides the necessary support to provide reasonable assurance of safe operations.

NuScale submitted an IP for this element because it is not possible to submit an RSR to verify that the design has been implemented in accordance with the DI IP, until the plant is constructed and the as-built MCR can be evaluated to verify that it conforms to the validated design. The DI element is considered complete once ITAAC 03.15.01 is closed (i.e., the ITAAC closure notification serves as an RSR if it contai ns the level of detail necessary to comply with NUREG-0711). The ITAAC refers to the DI IP to ensure that both the applicant and NRC ITAAC inspectors understand which criteria should be considered during an ITAAC closure review.

Evaluation of Aspects of the Design Not Addressed in Verification and Validation (Criterion 12.4(1)

For this criterion, the staff reviewed the FSAR Section 18.11 and the DI IP to understand how the applicant will evaluate aspects of the design that were not addressed in V&V by an appropriate V&V method. FSAR Sections 18.11.2.1-18.11.2.4 provide high-level descriptions of how the DI activities will address the four acceptance criteria in Section 12.4 of NUREG-0711.

18-52 Among other considerations, these sections address activities that could not be addressed during the V&V, as well as any changes that will need to be made to the design, procedures, or training after the V&V is complete.

The DI IP provides details on the responsibilit ies of a COL applicant and identifies how design issues will be turned over to the COL applicant for ultimate resolution. In addition, it describes the types of evaluations to be used to close out tracked HFE issues and indicates how the COL applicants QAP description can be used to complete this objective. The staff evaluates the QAPD in SER Chapter 17. The staff considers the QAP to be an adequate means of ensuring that human factors issues are tracked until resolution thereof.

The DI IP, Section 1.2, Scope, indicates that other aspects of the facility that were not simulated but are relevant to the overall HFE program are evaluated using an appropriate V&V method and are within the scope of the DI. Section 1.2 of the DI IP also indicates that changes to training and procedures that result from DI activities will be the responsibility of the COL applicant. These will be tracked by the QAP and resolved, as needed, by a COL applicant. The staff finds that the DI IP adds context to the information in the FSAR and is largely consistent with it. Some small apparent differences exist, such as a limitation of the scope described in Section 1.2 of the DI IP. It indicates some portions of the design (such as the EOF and TSC) are outside of the scope of DI activities, as are maintenance and most refueling activities. This is not unexpected since the regulatory basis for the review is largely scoped within the MCR except when associated IHAs take place elsewhere in the plant (scope 1.2 indicates that the refueling crane is in scope for DI activities). Moreover, the HSIs used in the EOF and TSC are largely derived from the control room HSIs, and theref ore will be tested during control room scenarios as indicated in Section 2.2.3 of the HFE PMP.

Section 3.0 of the DI IP describes licensee COL activities related to HSI design, including retesting requirements. The HSI style guide controls the HSIs in the EOF and TSC, which are for display only (no control function). The HED process controls changes.

The DI IP, Section 3.0, Design Implementation Assessments, identifies several specific methods that will be used during the DI process to ensure that the software, hardware, and facility configurations match the appropriate design drawings and specifications. In addition, it clearly indicates the types of assessments t hat the COL applicant should consider using.

Section 3.0 also provides guidance on the methods that should be used to validate any activities that were not validated during the ISV. It allows flexibility in selecting an appropriate method for validating those HEDs for which an analysis has confirmed that the ISV results will not change (such as by using walkdown and SME review). If an HED may change the results of the ISV, a more controlled approach is proposed, which may include rerunning the applicable portion of the ISV to confirm that the results remain valid.

The staff finds that the applicant proposed a methodology that covers the appropriate scope of DI activities including aspects of the design that were not addressed in the V&V. The DI methods described above are common methods for validating actions and demonstrate an increased focus on those deviations that may affect the ISV results. Therefore, the staff finds this treatment to be acceptable to meet this criterion.

18-53 Comparison of Final Products to Planned Design and Identification of Discrepancies (Criterion 12.4(2))

Section 7.0 of the DI IP describes the closure of the DI activities. Completion of DI activities is tracked by the DI ITAAC, which incorporates by reference the DI IP and addresses a scope that covers the design validated by the ISV, including any changes that occur after ISV that have been validated as part of the DI activities. The DI ITAAC provides assurance that these activities will ultimately be completed. The COL holder must submit ITAAC closure documents, which will serve as the RSR for DI. The staff finds this treatment an adequate means to ensure the final HSI design conforms to the planned design resulting from use of the HFE design process and V&V activities. As such, the staff finds this treatment is adequate to address this criterion. SER Section 14.3.9 contains a detailed analysis of the HFE ITAAC.

Verification that All Human Factors Engineering Issues Have Been Addressed (Criterion 12.4(3))

FSAR Section 18.11.2.3, Verification that Human Factors Engineering Issues in Issue Tracking System are Addressed explains that HEDs i dentified during design implementation activities are documented, evaluated, and tracked by the CO L applicants QAP. HEDs that occur during the completion of the other HFE program elements, including those generated during V&V activities are addressed as follows:

  • HEDs affecting the integrated system validation are closed before the integrated system validation.
  • priority 1 HEDs are closed before submitting the V&V results summary report.
  • priority 2 and new priority 1 HEDs are closed prior to conducting the design implementation review.

The DI IP, Section 4.0, Human Factors Engineering Issue Resolution, provides additional details about the responsibilities of the COL applicant if HEDs are identified during design implementation activities. For example, the COL applicant must resolve priority 1 and priority 2 HEDs and satisfactorily complete retests for thes e high priority HEDs. By definition, Priority 1 HEDs are the only HEDs with a potential impact on safety. Although it is unlikely, it is possible that new Priority 1 HEDs could be identified by the COL holder during DI activities before plant startup. In this case, it is the responsibility of the COL holder to resolve these HEDs before closing the DI ITAAC.

DI IP, Section 3.0, Design Implementation Assessments, provides a description of the assessments used to address HEDs. Section 3.0 of the DI IP provides a means of assessing new HEDs that is consistent with the types of analyses used and methods for justification of deviations described in NUREG-0711.

The staff finds that the methods described in the DI IP provide assurance that all HEDs that could influence safety will be addressed prior to plant startup These activities are verifiable via assessment of the HFE ITAAC. Therefore, the staff finds this treatment to be acceptable.

18-54 Description of How the Human Factors Engineering Program Addressed Important Human Actions (Criterion 12.4(4))

The DI IP, Section 5.0, Addressing Important Human Actions, states that the treatment of IHAs is described in the TIHA element of the HFE program (see Section 18.6 of this report).

FSAR section 18.6.3 states that no IHAs have been identified for the US460 design. DI IP Section 5.0 states that the V&V results summary report will include a description of how the HFE program addressed any IHAs. Because no IHAs have been identified, the staff finds that this NUREG-0711 criterion is not applicable. Howeve r, if IHAs are identified before the ISV is conducted, the V&V RSR will need to describe how the HFE program addressed each IHA.

18.11.5 Combined License Information Items

N/A

18.11.6 Conclusion

The staff finds that the applicants DI IP is consistent with the criteria in Section 12.4 of NUREG-0711. The method described in the DI IP is adequate for the evaluation of human factors issues that could not be addressed during the ISV tests. The DI IP, when paired with the associated ITAAC, provides a means of addressing human factors insights that occur after completion of the ISV test, up until the plant startup. ITAAC 03.15.01, which is described in Section 18.1.2 of this report, controls the completion of the DI process. Accordingly, the staff finds that this program element is consistent with application of state-of-the-art HFE principles to the MCR design as required by 10 CFR 50.34(f)(2)(iii), 10 CFR 52.47(b)(1), and 10 CFR 52.137(a)(8) related to this element.

18.12 Human Performance Monitoring

18.12.1 Introduction

The objective of the staffs review is to confirm that the applicant has prepared an HPM strategy for ensuring that no significant safety degradation occurs because of any changes that are made in the plant and to verify that the conclusions drawn from the human performance evaluation remain valid over the life of the plant.

The staff reviewed the HPM element to verify that the applicant has prepared an HPM program with the following objectives:

  • Ensure that the conclusions drawn from the ISV remain valid with time.
  • Ensure that no significant safety degradation occurs because of any changes made in the plant.

The staff reviewed the applicants description of HPM in the FSAR using the criteria in NUREG-0711, Chapter 13, Human Performance Monitoring, Section 13.4. Section 18.12.4 of this report documents the results of this review.

NUREG-0711, Section 13.3, Applicant Products and Submittals, states that the applicant should provide an IP for HFE program management. There is no RSR for this element for the SDA because a COL holder will be expected to continue these activities during operation of the plant.

18-55 18.12.2 Summary of Application

FSAR: The applicant identified a COL information item that will address this element in FSAR.

The applicant described this HFE element in F SAR Section 18.12, Design Implementation.

ITAAC: There are no ITAAC associated with this HFE element.

Technical Specifications: There are no TS associated with this HFE element.

Topical Reports: No topical reports are associated with this HFE element.

Technical Reports: Section 18.1.2 of this report lists the relevant TRs.

18.12.3 Regulatory Basis

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 50.34(f)(2)(iii), which requires the applicant to provide, for Commission review, a control room design that reflects state-of-the-art human factor principles before committing to the fabrication or revision of fabricated control room panels and layouts

SRP Chapter 18,Section III, lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other SRP sections. Acceptance criteria for HFE design methodology are provided in NUREG-0711:

  • NUREG-0711, Revision 3, Chapter 13, Human Performance Monitoring, Section 13.4, Review Criteria (NUREG-0711 references NUREG-0700, which provides detailed acceptance criteria for HFE design attributes)

18.12.4 Technical Evaluation

FSAR, Section 18.12, contains one COL information item pertaining to HPM, as described in Section 18.12.5 below. The staff evaluated the acceptability of the COL information item.

NuScale did not provide an HPM IP. The staff finds this acceptable because the monitoring of human performance, which includes maintaining personnel skills and ensuring no safety degradation from modifications to the design, starts after the plant becomes operational and is therefore a COL activity. The staff concluded that no additional COL information items were needed.

18.12.5 Combined License Information Items

FSAR, Section 18.12 lists the COL information item number and description related to HPM:

COL Item 18.12-1: An applicant that references the NuScale Power Plant US460 standard design will provide a description of the Human Performance Monitoring Program in accordance with applicable NUREG-0711 or equivalent criteria.

18-56 As stated in Section 18.12.4 above, the staff finds this COL information item to be acceptable.

18.12.6 Conclusion

A COL information item has been identified for this HFE element because an HPM IP was not provided. The staff will review the proposed human performance monitoring program developed by a COL applicant during the COL review.

18-57

Retrieved from "https://kanterella.com/w/index.php?title=ML24019A002&oldid=3682374"