NSD-NRC-97-5334, Forwards Markup of Ssar Chapter 18 Page Changes Resulting Primarily from Resolution of NRC Human Factors Engineering ITAAC Review Comments Discussed During 970825 Telcon

Forwards Markup of Ssar Chapter 18 Page Changes Resulting Primarily from Resolution of NRC Human Factors Engineering ITAAC Review Comments Discussed During 970825 Telcon

ML20211F630
Person / Time
Site:	05200003
Issue date:	09/23/1997
From:	Mcintyre B WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:	Quay T NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
NSD-NRC-97-5334, NUDOCS 9710010142
Download: ML20211F630 (12)

Text

'

b 4 ..

,. (m N

- Westinghouse Energy Systems Ba 355 Pmsbu@ Pemsylvania 15230-0355 Electric Corporation DCP/NRC1043 NSD-NRC-97 5334 Docket No.: 52 003 September 23,1997 l

Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555 ATTENTION: T. R. QUAY

UBJECT: CilANGES TO SSAR CHAPTER 18 TO RESOLVE NRC COMMENTS

Reference:

Letter from NRC to Westinghouse (Roe to Liparulo), "lluman Factors Engineering issues Related to'AP600 Operator Workstations and Computerized Procedure System,"

dated September 16,1997.

Dear Mr. Quay:

Attached is a markp of SSAR Chapter 18 page changes resulting primarily from resolution of NRC lluman Factors Engineering (HFE) lYAAC review comments discussed during a telecon on August 25, 1997. Also, there are two changes in addition to those resulting from ITAAC review comment resolution:

1. Based on NRC feedback received during a telecon today, the text suggested to NRC by telefax on September 9,1997, is modif'ied as marked on the attached SSAR pages 18.8-2 and 13-2. This text clarifies that the computerized procedure system is not part of t'ae AP600 design scope that the NRC is being asked to approve.

2. On page 18.8-18, reference to a " single-step" safety system actuation is deleted to reflect ongoing resolution of fire protection issues.

With this submittal, the Westinghouse status for Open item Tracking System (OITS) item 5752 is

" Confirm-W" for Westinghouse to confinn incorporation of the attached SSAR changes into Revision j 17 of the SSAR. /

While not affecting SSAR Chapter 18, there are two remaining actions related to life: ,

)

I. During the telecon today, NRC requested that Westinghouse provide a formal response to the referenced letter; that response is forthcoming and is assigned OITS number 5790, p.D

-- - 2. NRC has the action to advise Westinghouse if changes related to the computerized procedure _

system, as discussed above, as required in SSAR Chapter 1.8. This is assigned OITS number

'5791.

~

9710010142 970923

_{DR

- ne. .,g ADOCK 052 3

{kk

. .. _ - - . . ._ m ._ . . ___ . _ _ __ _ . _ . _ . . _ . . _ . - .

_ . . _ - . . _ . . ~ . -

l  :. DCP/NRC1043 - l

. NSD-NRC-97 5334:- 2 September 23,1997 1

If you have any questions regarding this transmittal, please contact Robin K. Nydes at 412-374-4125.

A/s9kanager Brian A. McIntyre, h

, Advanced Plant Safety and Licensing

jml Attachment

cc

J. M. Sebrosky, NRC (w/ Attachment) 4 J. P. Bongarra, NRC (w/ Attachment) i N. J. Liparulo, Westinghouse (w/o Attachment) i S. Rubin, NRC (w/ Attachment) ~

}

i i

+

3 a

+

d 1

i 4

7 i ~

D924 wpf

. . , - - , , . . -.. . _ , . - - - . - , , _ - ~

==

18. H: man Fact:rs Engineerizg Figure 18.2 3 provides an overview of the Westinghouse human factors engineering process.

The figure summarizes the major activities of the human factors engineering program, their relative order, and the inputs and outputs for the major activities. The boxes in the diagram indicate major human factors engineering activities. The activities are presented in approximate chronological order, with the outputs of each activity ser ing as inputs to subsequent activities. The items listed below the activity boxes are the document outputs 1 J

from that human factors engineering activity. The human factors engineering process includes iterations considering the outcomes of subsequent analysis and design activities, design reviews, and testing. In this approach, design issues are addressed and resolved through the iterative stages of the human factors engineering process. Potential points of iteration are indicated in Figure 18.2-3. Further details on the activities, inputs, and output documents l

associated with the vnious elements of the human factors engineering program are provided in the sections corresponding to each human factors engineering element. ,

Figure 18.2 3 provides a program milestone schedule of human factors engineering tasks showing relationships between human factors engineering elements and activities, products, and reviews. Internal design reviews are performed at various points throughout the design process.

18.2.6 Combined License Information l The Combined License applicant referencing the AP600 certified design is responsible for the i execution of the NRC approved human factors engineering program as presented by I Section 18.2.

The Combined License applicant referencing the AP600 certified design is responsible for i designing the emergency operations facility, including specification of the location, in I accordance with the AP600 human factors engineering program.

18.2,7 References

1. NUREG-0711. " Human Factors Engineering Program Review Model," U.S. NRC,

2. WCAP 14645, " Human Factors Engineering Operating Experience Review Report For The AP600 Nuclear Power Plant." Med54n f 4 neder /ff6,

3. WCAP-.14694, " Designers Input to Determination of the AP600 Main Control Room Staffing Level." DAM ( M j (, ,

4. WCAP-14644, "AP600 Functional Requirements Analysis and Allocation."y Re554 j d Seff & er l11b,

5. Reason, J.T., " Human Error," Cambridge, U.K., Cambridge University Press,1990.

6. WCAP-14822, "AP600 Quality Assurance Procedures Supporting NRC Review of AP600 SSAR Sections 18.2 and 18.8," Revision 0, February 1997.

l Revision: 13

[ W85tillgh0US8 18.2-19 May 30,1997

, 18. Human Factors EEgineering

+

The process " state identification" activity, which aids the user in understanding the abnormal conditions and provides corrective action guidance. It guides the operating crew into the information display system.

He plant information system presents plant process information for use by the operators. The plant information system provides dynamic display of plant parameters and alarm information so that an understanding of current plant conditions and status is readily ascertained. He plant information system uses color graphic video display units located on the operations and control centers workstations to display plant process data. These displays provide information important to monitoring, planning, and controlling the operation of plant systems and obtaining feedback on control actions.

he computerized procedure system has a mission to assist plam operators in monitoring and controlling the execution of plant procedures. He computerized procedures system is a software system. It runs on the hardware selected for the operations control centers. The computerized procedure system is accessible from the operator workstations in the main control room. Procedure development, as stated in Section 13.5 and 18.9,is the responsibility of the Combined License applicant. A procedure writer's guide is developed as part of the human system interface design implementation plan for the computerized procedure system.

He writeri guide is the design guidelines document for the computerized procedure system.

Information on the writer's guide and on the computerized procedure system is found in Reference 31. Man-in-the-loop concept tests (Reference 9) are planned as part of the human syrtem interface design implementation plan. Rese tests determine how effectively computerized procedures handle plant situations and whether computer-based procedures adequately support operator performance, he design of a backup to the computerized procedure system, to handle the unlikely event of a loss of the computerized procedure system, is developed as part of the human system interface design process. Design options include the use of a paper backup. The acceptability of the backup is evaluated through concept testing or by executing a walk through using the full scale mockup of the AP600 main control room.-na-sor=W' pad = symm i its balup - s Loui es pc.:

of.the integrated system validation phase-oRL. ir- iactuu mA.ew rd =M@ -

, y (Refee24)-

he mission of the controls in the main control room is to allow the operator to operate the plant safely under normal conditions, and to maintain it in a safe condition under accident j conditions. The types of controls in the main control room include both discrete (dedicated) control switches and soft controls. The discrete control switches are controls dedicated to a

/ single function, with each switch having a single action. As shown in Figure 18.;-1, the soft

/ control units are control devices whose resulting actions are selectable by the operator. De instrumentation and control architecture uses both discrete control switches and soft control units. De soft control units are used to provide a compact altemative to the traditional control board switches by substituting virtual switches in the place of the discrete switches.

De final configuration of these elements is dependent upon the results of the human system interface design process described in subsection 18.8.1 below.

I i

The computerized procedure system is not part of the AP600 design scope that the Nuclear Regulatory Commission is being asked to approve. The acceptability of the computerized procedure system, and its backup, for application to the AP600 design will be d :rmined during the implementation of the AP600 verification and validation program (Reference 24) and reviewed as a part of an application for a combined license.

nghouse

[D}. 1884

18. H; man Factors Engineering room supports the operator's decision making process, and promotes the interaction with other plant personnel, while preventing distractions by non-operating personnel. De main control room provides the interfacing resources between the operation of the plant and the maintenance of the plant. Its areas include the main control area, the switching and tagging area, the shift supervisor's office, the shift supervisor's clerk's office, and the operations staff's area (see Figure 1.2 8). Habitability systems are described in Sections 6.4 and 9.4 18.8.3.2 Main Control Area Mission and Major Tasks ne mission of the main control area is to provide the support facilities necessary for the operators to monitor and control the AP600 efficiently and reliably. Figure 6.41 provides a view of the main control area. The main control area includes the reactor operator I workstations, the supervisort workstation, the dedicated safety panel and the wall panel 1

information system. De layout, size and ergonomics of the operator workstations and the wall panel information system depicted in this figure does not reflect the results of :he human system interface design implementation plan described in subsection 18.8.1, De actual size, shape, ergonomics and layout of the operator workstations and the wall panel information system is an output of the implementation plan.

He major task of the main control area is to provide the human system interface resources that determine the plant state and implement the desired changes to the plant state during both normal and emergency plant operations. De main control area provides alarms to alert the operator to the need for further investigation. Plant process data displays permit the operatur to observe abnormal conditions and identify the plant state. De controls enable the operator to execute actions. De process data displays and the alarms provide feedback to enable the operator to observe the effects of the control actions.

l Each reactor operator workstation contains the displays and controls to start up the plant, maneuver the plant, and shut down the plant. Reference 44 presents input from the designer to the Combined License applicant for the determination of the staffing level of the operating crew in the main control room. Each workstation is designed to be manned by one operator.

Here is sufficient space and operator interface devices for two operators. The physical 1- makeup of the# reactor operator workstations is identical. De human system interface resources available at each workstation are:

Plant information system displays a

Control displays (soft controls)

Alarm system support displays Computerized procedure displays

. Screen and component selector controls I ne supervisor workstation is identical to the reactor operator workstations, except that its controls are lockedeut. The supervisor workstation contains both intemal plant and extemal plant communications systems.

Revision: 13

{ Westinghouse 18.8-17 May 30,1997 l

l

- . . - _ _ _ . _ . - - . - - - . - - . . - _ - - _ - = _ -

.[ ]j

18. Husman Factors Engineering 4

l Upon failure of a reactor operator workstation, the failed workstation is locked out, and the supervisor workstation controls are unlocked. This modified wortstation configuration maintains independent, redundant workstations.

A dedicated safety panel is located in the main control area. De qualified data processing system visual display units and the dedicated safety system controls are provided in this panel.

4 Dese visual display ur.its are the only monitoring display devices in the main control room j tat are seismically qualified and provide the post. accident mot.itoring capabilities in accordance with Regulatory Guide 1.97. Dedicated system. level safety system control switches are located on the dedicated safety panel to provide the operators with' ;!: q -

' safety system actuation capabilities. A minimum inventory of these de e' sted displays and controls are presented in Section 18.12.

Deri is storage space for supplies, protective clothing and some spare parts. Cabinets are provided for necessary documents, and a drawing laydown area is providui for the operators' use, Restroom and kitchen facilities are provided for the main control room operations crew.

18.8.3.3 Switching and Tagging Area Mission and Major Tasks De mission of the switching and tagging sea is to provide an interface between plant maintenance and plant operations personnel. Figures 1.2 8 and 6.41 provide the layout of the switching and tagging area. De operations staff monitors and approves the state of systems, major components, and equipment. De maintenance snff is informed of

, maintenance required by the operations staff. De means for initiating, tracking, and logging maintenance work orders is provided.

De major task of the switching and tagging area is to ease the management and -

implementation of the switching and tagging operations. The switching and tagging area generates notifications that equipment is not available due to testing, maintenance, or equipment failure. Dese notifications alert plant operating personnel to the unavailability of equipment. Notifications are provided to plant maintenance personnel, alerting them that operating personnel are aware of the equipment status. De switching and tagging area facihtates a systematic and organized approach to removing equipment from senice as well as returning it to service.

18.8.3.4 Remote Shutdown Workstation Mission and Major Tasks De mission of the remote shutdown workstation is to prcvide the resources to bring the plant to a safe shutdown condition after an evacurion of the main control room. De remote shutdown workstation resources are based on an assumed evacuation of the main control room without an opportunity to accomplish tasks involved in the shutdown except reactor trip.

Subsection 7.4.3 discusses safe shutdown using the remote shutdown workstation, including design bases infermation.

Revision: 13 May 30,1997 18.8 18 T Westinghouse

6 lii H:3 E

18. Iluman Fact:rs Engineering 18.8.3.7 Radwaste Control Area Mission and Major Tasks The mission of the radwaste control area is to provide a habitable area and the appropriate resources for the operation of the radwaste processing systems. These resources include alanns, displays, controls, and procedures. Dese resources are located in a control area outside of the main control room.

I 18.8.3.8 Local Control Mission and Major Taske gskhh D

. I The mission of local controlhs to provide the resources, outside of the main control room the remote shutdown room, and the radwaste control area for operations personnel to perform I monitoring and control activities. De capability to access displays and controls (controls as I

assigned by the main control room operaton) for local control and monitoring, from selected I

locations throughout the plant, is provided. Activities that are implemented through local contro are reviewed to verify that their removal from the main control room is consistent with the o. rator staffing and performance considerations. Human system interface locations are provi ed for single task operations such as the operation of a manual valve.

i 18.8.3.9 h tknd Emergency uperations Facility l

I As stated in subsection 18.2.6, the Combined License applicant is responsible for designing 1 the emerpncy operations facility, including specification of the location, in accordance with I the AP600 human factors engineering program.

18.8.4 Human Factors Design for the Non. Human System Interface Portion of the Plant 18.8.4.1 General Plant Layout and Design ne AP600 design process incorpo ates a human engineering approach to operations ar<t maintenance. Maintainability design guidelines and human factors and as low as reasonably-achievable (ALARA) checklists are used to meet the requirements of a human engineered environment. The design objectives include reducing worker exposure and eliminating unnecessary inspection and maintenance tasks.

18.8.4.1.1 Maintainability Design features such as component selection, layout and standardization increase the probability that targeted repair times are achieved. nese features coupled with a preventative maintenance prognm help the AP600 meet its objectives for operation and maintenance.

Design requirements from the utility industry and industry design pixtices establish criteria for layout, changeout, and replacement for parts and components; access for major pieces of equipment; and vehicle passage.

Critical path outage models are prepared for the AP600. A typical refueling and maintenance outage schedule is used by design engineen. The modelindicates maintenance windows for Revisiont 13 May 30,1997 18.8 20 3 W85tingh00S8

g. t.

=

18. II: man Factors Enginnring 18.8.6 References

1. American National Standards Institute, ANSI HFS-1001988, "American Standard for Human Factors Engineerins of Visual Display Terminal Workstations," Santa Monica.

Califomia.1988.

2. CEl/IEC 964, Design for Control Rooms of Nuclear Power Plants," Intemational Electrotechnical Commission, Geneva, Switzerland,1989.

3. NUREG 0899, " Guidelines for the Preparation of Emergency Operating Procedures,"

U.S. Nuclear Regulator Commission, Washington, D.C., August 1982.

4. NUREG 1358, " Lessons Learned from the Special Inspection Program for Emergency "

U.S. Nuclear Regulatory Commission, Washington, D.C., April 1989.

5. NUREG 0700, " Human System Interface Design Review Guideline," Rev.1. U.S.

Nuclear Regulatory Commission, Washington, D.C., February 1995. (Draft Report)

6. NUREG/CR 5908, " Advanced Human System Interface Design Guidelines," U.S.

Nuclear Regulatory Commission, Washington, D.C., July 1994.

7. NUREG/CR 6105, " Human Factors Engineering Guidelines for the Review of Advanced Alarm Systems," U.S. Nuclear Regulatory Commission, Washington, D.C., September 1994.

8. U.S. Department of Defense, ' Human Engineering Guidelines for Management Information Systems," DOD HDBK 761A, Office of Management and Budget, Washington, D.C.,1990.

9. WCAP 14396, " Man in The Loop Test Plan Description," Revision 2, January 1997,

10. AP600 Document Number OCS J1-008, " Effects of Control Lag and Interaction Mode on Operators' Use of Soft Controls," Sperb S,17.4.- Mfs g s,@cr $qq

11. Hoecker, D.G. and Roth, E. M., " Man-Machine Design and Analysis System (MIDAS)

Applied to a Computer Based Procedure Aiding System," Westinghouse STC Report ISW5- CHICR P2, May 25,1994; also in " Proceedings of the Human Factors and Ergonomics Society 35th Annual Meeting," October 1995.

12. Hoecker, D.G. and Roth, E. M., " MIDAS in the Control Room: Applying a Flight Deck Cognitive Modeling Tool to Another Doinain," Westinghouse STC Report ISWS-CHICR P3, September 26, 1994: also in RAF Institute of Research and Development, " Proceedings of the Third Intemational Workshop on Human-Computer Teamwork " Cambridge, UK, September 26,1994.

Revision: 13 May 30,1997 18.8 24 3 Westinghouse

is, iluman Facion Engineering

42. U.S. Department of Defense,1989. "htilitary Standard 1472D; Human Engineenng Design Cntena for hiilitary Systems, Equipment and Facilities," (Washington, D.C., U.S.

Department of Defense).

43. American National Stand'.rds institute,1988 " ANSI /HF 100-1988 Amencan National Standard for Human Fa: tors Engineering of Visual Display Terminal Workstations,"

(Sants hionica. CA. Human Factors Society, American National Standards Institute).

44. WCAP 14694, "D,ejigner's input To Determination of the AP600 hiain Control Room Staffing Level"y Kf 49iq ()j Ji /f16,

45. WCAP 14701, " Methodology and Results of Defining Evaluation issues for the AP600 I

Human System Interface Design Test Program." Revision 1 May 1997.

46. Reid. O. B. and Nygren T. E.,1988, "He Subjective Workload Assessment Technique:

A Scaling Procedure for Measuring Mental Workload," also in Hancock, P. A., and Meshkati. N., (eds.), " Human Mental Workload," (Amsterdam, Nonh Holland).

47. Hart, S. O., and Stavel nd, L. E.,1988, " Development of NASA TLX: Results of Empirical and neoretict Research," also in Hancock, P. A., and Meshkati, N., (eds.),

" Human Mental Workload," (Amsterdam, North Holland).

Revision: 13 3 Westinghouse 18.8 2; May 30,1997

, _U

"1'4:$mt

, 18. Human Facton Engineering Table 18.12.21 (Sheet 1 of 2) htINIhtUh1 INVENTORY h

• xse.hf_ficH x *.. . Control Display Alarram Neutron flus x x Neutron flux doubling x

Startup rate x x RCS pressure x x Wide range iT, x Wide range Tg x x RCS cooldown rate compared to the limit x x based on RCS pressure Wide range Tcold compared to the limit x x ba.ted on RCS pressure Change of RCS temperature by more than x

5'F in the last 10 minutes Containment water lesel x x Containment pressure x x Pressurizer water level x x Pressurizer water level trend x Pressurizer reference leg temperature x Reactor venel . Hot leg water level x x Pressuriter pressure x Core exit temperature x x RCS subcooling x x RCS cold overpressure limit x x

, IRWST water level x x PRHR flow x x PRHR outlet temperature .t x PCS storage tank water level x PCS cooli.,g flow x IRWST to RNS suction valve status x x Remotely op33ted containment isolation x valve status Containment area high range radiation level x x Containment nressure (extended range) x Containment nydrogen concentration x CMT levelm x

• Manual reactor trip (Also initiates turbine x trip Figure 7.21 sheet 19.)

Revision: 13

[ W8Stiflgh0088 18.12 9 hiny 30,1997

I

. 18. Iluman Factors Engineering Table 18.12.21 (Sheet 2 of 2) i MINIMUM INVENTORY Orseffhien \

- Prr :u.- Control Display Alarm

• Manual safeguards actuation x Manual CMT actuation x Manual main control room emergency x habitability system actuation

• I Manual ADS actuation (13 and 4) x Manual PRHR actuation x Manual containment cooling actuation x Manual IRWST injection actuation x Manual containment recirculation actuation x Manual containment isolation x Manual main steamline isolation x Manual feedwater isolation x M?mual containment hydrogen igr. iter x (nonsafety related) d21SE

1. Although this parameter does not satisfy any of the selection criteria of subsection 18.12.2 its importance to manual actuation of ADS justifies its placement on this list.

2. These parameters are used to generate visual alerts (safety related displays for the main control room; nonsafety-related displays for the remote shutdown workstation) that identify challenges to the critical safety functions.

3. "Ihese instruments are not required after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. (Subsection 7.5.4 includes more information on the class IE valve position indication signals, specified as part of the post accident monitoring instrumentation.)

4. This manual actuation capability is not needed at the remote shutdown workstation.

Revision: 13 May 30,1997 18.12 10 Y Westinghouse

I e m

13. Conduct of Operation for the high level requirements for the technical suppon center and the operauonal suppon center. See Section 7.5 for identification of plant variables that are provided for interface to the emergency planning areas.

Communication interfaces among the main control room, the technical suppon center and de l

emergency planning centers are the responsibility of the Combined License applicant.

13.3.1 Combined License Inforrr.ation item j l

Combined License applicants referenting the AP600 certified design will address emergency  !

1 planning including post.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> hetions and its communication interface.

13.4 Operational Review This section is the responsibility of the Combined License applicant.

13.4.1 Combined License Information item Combined License applicants referencing the AP600 certified design will address each operational review.

13.5 Plant Procedures Plant procedures are the responsibility of the Combined License applicant. References to applicable combined license information are included in Section 1.8. This includes, for example, reference to guidelines on inservice inspection in Chapters 3 and 6, and initial testing in Chapter 14.

Reference 2 provides input to the Combined License applicant for the development of plant operating procedures, including information on the development and design of the AP600 emergency response guidelines and emergency operating procedures. Also included in Reference 2 is information on the computerir.ed procedure system, which is the human system interface that allows the operators to execute the plant procedures.

13.5.1 Combined Lkense Information Item ,

Combmed License applicants referencing the AP600 cenified design will address plant procedures including the following: .

• Normal operation

• Abnormal operation

• Emergency opersion ne computerized procedure system is not part of the AP600 design scope that the Nuclear Regulator)

Commission is tving asked to approve. De acceptability of the computerized procedure system, and its backup, for appheation to the AP600 design will be determined during the implementation of the AP600 verification and validation program (see SSAR Section 18.8) and reviewed as a past of an g pplication for a combined license.

August 8,1997 13 2 3 W85tingh00S4