ML17269A001: Difference between revisions
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
||
Line 16: | Line 16: | ||
=Text= | =Text= | ||
{{#Wiki_filter:NEI 96-07, Appendix D | {{#Wiki_filter:NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 Example 4-4. Digital Modification that Satisfies Dependability, causing NO ADVERSE IMPACT on a UFSAR-described Design Function An analog recorder is to be replaced with a new microprocessor-based recorder. The recorder is used for various purposes including Post Accident Monitoring, which is a UFSAR-described design function. | ||
451 4.2.1.2 Screening of Changes to Procedures as Described in the UFSAR | Dependability Assessment: An engineering evaluation performed as part of the technical assessment supporting the digital modification concluded that the new recorder will be highly dependable (based on a quality development process, testability, and successful operating history) and therefore, the risk of failure of the recorder due to software is considered very low. | ||
." | The change will have NO ADVERSE IMPACT on any design function due to the dependability assessment. | ||
451 452 4.2.1.2 Screening of Changes to Procedures as Described in the UFSAR Comment [A42]: Comments on HSI Screening Guidance were previously provided in: | |||
453 SCOPE (1) ML17068A092 Comment Nos. 18-26 (2) ML17170A089 Comment Nos. A17-A27 454 If the digital modification does not include or affect a Human-System 455 Interface (e.g., the replacement of a stand-alone analog relay with a digital 456 relay that has no features involving personnel interaction and does not feed 457 signals into any other analog or digital device), then this section does not 458 apply and may be excluded from the Screen assessment. | |||
459 In NEI 96-07, Section 3.11 defines procedures as follows: | |||
460 "...Procedures include UFSAR descriptions of how actions related to 461 system operation are to be performed and controls over the performance 462 of design functions. This includes UFSAR descriptions of operator 463 action sequencing or response times, certain descriptions...of SSC 464 operation and operating modes, operational...controls, and similar 465 information." | |||
466 Although UFSARs do not typically describe the details of a specific Human-467 System Interface, UFSARs will describe any design functions associated with 468 the HSI. | |||
469 Because the human-system interface (HSI) involves system/component 470 operation, this portion of a digital modification is assessed in this Screen 471 consideration. The focus of the Screen assessment is on potential adverse 472 effects due to modifications of the interface between the human user and the 473 technical device. | |||
D-22 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 474 There are 3 "basic HSI elements" ( | |||
==Reference:== | ==Reference:== | ||
NUREG-0700): | NUREG-0700): | ||
475 Displays: the visual representation of the information operators need 476 to monitor and control the plant. | |||
477 Controls: the devices through which personnel interact with the HSI 478 and the plant. | |||
479 User-interface interaction and management: the means by which 480 personnel provide inputs to an interface, receive information from it, 481 and manage the tasks associated with access and control of 482 information. Comment [DA43]: Clarification: Thnk of these elements as a way to define the entirety 483 Operators must be able to accurately perceive, comprehend and respond to of what comprises and HSI. Some modifications may not fall neatly into one 484 system information via the HSI to successfully complete their tasks. category, but if it falls within any or all of 485 Specifically, nuclear power plant personnel perform "four generic primary these categories, it is HSI related. | |||
486 tasks" ( | |||
==Reference:== | ==Reference:== | ||
XXXNUREG/CR 6947 | XXXNUREG/CR 6947): | ||
): | 487 (1) monitoring and detection (extracting information from the 488 environment and recognizing when something changes), | ||
). Examples of Examples of nnegative impacts on operator | 489 (2) situation assessment (evaluation of conditions), | ||
490 (3) response planning (deciding upon actions to resolve the situation) and 491 (4) response implementation (performing an action). | |||
492 To determine potential adverse impacts of HSI modifications on design 493 functions, a two-step analysis must be performed. Step one is assessing if 494 and in what way how the modification impacts (i.e., positively, negatively or 495 no impact) the operators' abilities to perform each of the four primary types of 496 tasks described above. If there are negative impacts, stepStep two of the 497 analysis consists of determining if and how the impacts, identified in step 498 one, affects the pertinent UFSAR-described design function(s) (i.e., adversely 499 or not adversely). Examples of Examples of nnegative impacts on operator 500 performance of tasks that may result in adverse effects on a design function 501 include but are not limited to: | |||
502 increased possibility of mis-operation, 503 increased difficulty in evaluating conditions, 504 increased difficulty in performing an action, 505 increased time to respond, 506 creation of new potential failure modes. | |||
507 508 Table 1 contains examples of modifications to HSI elements that should be 509 addressed in the response to this Screen consideration. | |||
-Described Design Function Description of the Proposed Activity Involving the Control ElementModification | 510 511 [INSERT TABLE 1 FROM HSI COMMENTS FILE HERE.] | ||
512 513 In NEI 96-07, Section 3.11 defines procedures as follows: | |||
514 D-23 | |||
NOT INVOLVED (2)situation assessment (evaluation of conditions) - NOT INVOLVED (3)response planning (deciding upon actions to resolve the situation) - NOT INVOLVED (4)response implementation (performing an action) - NOT INVOLVED | NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 515 "...Procedures include UFSAR descriptions of how actions related 516 to system operation are to be performed and controls over the 517 performance of design functions. This includes UFSAR 518 descriptions of operator action sequencing or response times, 519 certain descriptions...of SSC operation and operating modes, 520 operational...controls, and similar information." | ||
521 Because the HumanSystem Interface involves system/component operation, operator 522 actions, response times, etc., this portion of a digital modification is assessed in this Screen 523 consideration. | |||
524 If the digital modification does not include or affect a Human-System 525 Interface (e.g., the replacement of a stand-alone analog relay with a digital 526 relay that has no features involving personnel interaction and does not feed 527 signals into any other analog or digital device), then this section does not 528 apply and may be excluded from the Screen assessment. | |||
529 The focus of the Screen assessment is on potential adverse effects due to 530 modifications of the interface between the human user and the technical 531 device [e.g., equipment manipulations, actions taken, options available, 532 decision-making, manipulation sequences or operator response times 533 (including the impact of errors of a cognitive nature in which the information 534 being provided is unclear or incorrect)], not the written procedure 535 modifications that may accompany a physical design modification (which are 536 addressed in the guidance provided in NEI 96-07, Section 4.2.1.2). | |||
537 PHYSICAL INTERFACE WITH THE HUMAN-SYSTEM INTERFACE 538 In the determination of potential adverse impacts, the following aspects 539 should be addressed in the response to this Screen consideration: | |||
540 (a) Physical Interaction with the Human-System Interface (HSI) 541 (b) Number/Type of Parameters 542 (c) Information Presentation 543 (d) Operator Response Time 544 Physical Interaction with the Human-System Interface 545 A typical physical interaction modification might involve the use of a touch 546 screen in place of push-buttons, switches or knobs, including sensory-based 547 aspects such as auditory or tactile feedback. | |||
D-24 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 548 To determine if the HSI aspects of a digital modification have an adverse 549 impact on UFSAR-described design functions, potential impacts due to the 550 physical interaction with the HSI should be addressed in the Screen. | |||
551 Consideration of a digital modification's impact due to the physical 552 interaction with the HSI involves an examination of the actual physical 553 interface and how it could impact the performance and/or satisfaction of 554 UFSAR-described design functions. For example, if a new malfunction is 555 created as a result of the physical interaction, then the HSI portion of the 556 digital modification would be adverse. Such a new malfunction may be 557 created by the interface requiring the human user to choose which of multiple 558 components is to be controlled, creating the possibility of selecting the wrong 559 component (which could not occur with an analog system that did not need 560 the human user to "make a selection"). | |||
561 Characteristics of HSI changes that could lead to potential adverse effects 562 may include, but are not limited to: | |||
563 Changes from manual to automatic initiation (or vice versa) of 564 functions, 565 Changes in the data acquisition process (such as replacing an edgewise 566 analog meter with a numeric display or a multipurpose CRT in which 567 access to the data requires operator interaction to display), | |||
568 Changes that create new potential failure modes in the interaction of 569 operators with the system (e.g., new interrelationships or 570 interdependencies of operator actions and/or plant response, or new 571 ways the operator assimilates plant status information), | |||
572 Increased possibility of mis-operation related to performing a design 573 function, 574 Increased difficulty for an operator to perform a design function, or 575 Increased complexity or duration in diagnosing or responding to an 576 accident [e.g., Time-Critical Operation Actions (TCOAs) identified in 577 the UFSAR]. | |||
578 If the HSI changes do not exhibit characteristics such as those listed above, 579 then it may be reasonable to conclude that the method of performing or 580 controlling a design function is not adversely affected. | |||
581 Examples 4-5 through 4-7 illustrate the application of the Physical 582 Interaction aspect illustrates how to apply the assessment process to ONLY 583 the "controls" element of an HSI.is process to an HISHSI modification Example 4-5. Physical Interaction Assessment of Modification with D-25 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 NO ADVERSE IMPACT on a UFSAR-Described Design Function Description of the Proposed Activity Involving the Control ElementModification: | |||
Currently, a knob is rotated clock-wise to increase a control function open a flow control valve in 1% increments and counter clock-wise to decrease the control functionclose a flow control valve in 1% increments. This knob will be replaced with a touch screen that has two separate arrows, each in its own function block. Using the touch screen, touching the "up" arrow will increase the control function open the flow control valve in 1% increments and touching the "down" arrow will decrease the control functionclose the flow control valve in 1% increments. | |||
Identification and Assessment of the Four Generic Primary Tasks Potentially ImpactedInvolved: | |||
(1) monitoring and detection (extracting information from the environment and recognizing when something changes) - NOT INVOLVED (2) situation assessment (evaluation of conditions) - NOT INVOLVED (3) response planning (deciding upon actions to resolve the situation) - NOT INVOLVED (4) response implementation (performing an action) - NOT INVOLVED Comment [DA44]: Response implementation is the only task that would be pertinent here as it changes the Design Function Identification: | |||
The UFSAR-described design function states the operator can "increase and decrease the control functions using manual controls located in the Main Control Room." Thus, this UFSAR description implicitly identifies the SSC (i.e., the knob) and the design function of the SSC (i.e., its ability to allow the operator to manually adjust the control function). | |||
Identification and Assessment of Modification Impacts on the Four Generic Primary Tasks INVOLVED: | Identification and Assessment of Modification Impacts on the Four Generic Primary Tasks INVOLVED: | ||
As part of the technical evaluation supporting the proposed activitymodification, a Human Factors Evaluation (HFE) was performed. | As part of the technical evaluation supporting the proposed activitymodification, a Human Factors Evaluation (HFE) was performed. | ||
Tasks 1,2 and 3 are not involved therefore they do not have negative impacts. Task 4 is involved, but the HFE determined that the change from knob to touch screen was not going to have a negative impact on the operator because ...there was no change to the ability of the operator to perform the response implementation task . The HFE concluded that no new failures or malfunctions have been introduced as a result of the replacement from a knob to a touch screen. | |||
). Assessment of Impact(s) on | D-26 | ||
Also, due to the increased precision of the digital equipment, the increment of presentation on the HSI will be improved from 10 gpm to 1 gpm. Furthermore, the HSI will now present the information layout "by channel/train." The UFSAR identifies the existing presentation method as consisting of the physical layout as being "by flow path" to allow the operator to determine system performance.Although the UFSAR identifies the existing presentation method as consisting of a physical layout "by flow path" to allow the operator to determine system performance and the new display method (i.e., "by channel/train") will require additional steps by the operator to determine system performance, requiring more time, there is no adverse impact on satisfaction of the design function to ascertain system performance because no response time requirements are applicable to the design function of the operator being able "to determine system performance. | NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 possibility of mis-operation - NO IMPACT difficulty in evaluating conditions - N/A difficulty in performing an action - NO IMPACT time to respond - N/A new potential failure modes - NO IMPACT Comment [DA45]: These are only some of the possible negative impacts , thus, listing Identification of the Relevant Design Function(s): them here makes it appear that these are the ONLY outcomes that should be considered, Again, we do not want to get in a situation The UFSAR design function states the operator can "increase and decrease where we are trying to list all the possibilities. | ||
666 COMPREHENSIVE HUMAN-SYSTEM INTERFACE EXAMPLE | the control functions open and close the flow control valve using manual controls located in the Main Control Room." Thus, this UFSAR description implicitly identifies the SSC (i.e., the knob) and the design function of the SSC (i.e., its ability to allow the operator to manually adjust the control functionposition of the flow control valve). | ||
NEI 96-07, Appendix D | Assessment of Impact(s) on Design Function Impact(s) | ||
Using the results from the HFE and examining only the physical interaction aspect "controls" element of an HSI (e.g., ignoring the impact on operator response time or the number and/or sequence of steps necessary to access the new digital controlsthe other three HSI elements), the replacement of the "knob" with a "touch screen" is not adverse since it does not impact the ability of the operator to "increase and decrease the control functions open and close the flow control valve using manual controls located in the Main Control Room," maintaining satisfaction of the UFSAR-described design function. | |||
584 Using the same proposed activity provided in Example 4-5, Example 4-6 585 illustrates how a variation in the UFSAR description would cause an adverse 586 impact. | |||
Example 4-6. Physical Interaction with an ADVERSE IMPACT on a UFSAR-Described Design Function The UFSAR states not only that the operator can "increase and decrease the control functions using manual controls located in the Main Control Room," | |||
but also that "the control mechanism provides tactile feedback to the operator as the mechanism is rotated through each setting increment." | |||
Since a touch screen cannot provide (or duplicate) the "tactile feedback" of a mechanical device, replacing the "knob" with a "touch screen" is adverse because it adversely impacts the ability of the operator to obtain tactile feedback from the device. | |||
D-27 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 587 Using the same proposed activity provided in Example 4-5 and the same 588 UFSAR descriptions from Example 4-6, Example 4-7 illustrates how a 589 variation in the proposed activity would also cause an adverse impact. | |||
Example 4-7. Physical Interaction with an ADVERSE IMPACT on a UFSAR-Described Design Function In addition to the touch screen control "arrows" themselves, a sound feature and associated components will be added to the digital design that will emit a clearly audible and distinct "tone" each time the control setting passes through the same setting increment that the tactile feature provided with the mechanical device. | |||
Although the operator will now receive auditory "feedback" during the operation of the digital device, the means by which this feedback is provided has been altered. Since the means of controlling the design function has changed, new malfunctions can be postulated (e.g., high ambient sound levels that prevent the operator from hearing the feedback). Therefore, the modification of the feedback feature (i.e., from tactile to auditory) has an adverse impact on the ability of the design function to be performed. | |||
590 591 Number and/or Type of Parameters Displayed By and/or Available 592 From the Human-System Interface 593 One advantage of a digital system is the amount of information that can be 594 monitored, stored and presented to the user. However, the possibility exists 595 that the amount of such information may lead to an over-abundance that is 596 not necessarily beneficial in all cases. | |||
597 To determine if the HSI aspects of a digital modification have an adverse 598 effect on UFSAR-described design functions, potential impacts due to the 599 number and/or type of parameters displayed by and/or available from the 600 HSI should be addressed in the Screen. | |||
601 Consideration of a digital modification's impact due to the number and/or 602 type of parameters displayed by and/or available from the HSI involves an 603 examination of the actual number and/or type of parameters displayed by 604 and/or available from the HSI and how they could impact the performance 605 and/or satisfaction of UFSAR-described design functions. Potential causes for 606 an adverse impact on a UFSAR-described design function could include a 607 reduction in the number of parameters monitored (which could make the 608 diagnosis of a problem or determination of the proper action more challenging 609 or time-consuming for the operator), the absence of a previously available 610 parameter (i.e., a type of parameter), a difference in how the loss or failure of D-28 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 611 parameters occurs (e.g., as the result of combining parameters), or an 612 increase in the amount of information that is provided such that the amount 613 of available information has a detrimental impact on the operator's ability to 614 discern a particular plant condition or to perform a specific task. | |||
615 Example 4-8 illustrates the application of the Number and/or Type of 616 Parameters aspect. | |||
Example 4-8. Number and Type of Parameters with NO ADVERSE IMPACT on a UFSAR-Described Design Function Currently, all controls and indications for a single safety-related pump are analog. There are two redundant channels of indications, either of which can be used to monitor pump performance, but only one control device. For direct monitoring of pump performance, redundant motor electrical current indicators exist. For indirect monitoring of pump performance, redundant discharge pressure and flow rate indicators exist. Furthermore, at the destination of the pump's flow, redundant temperature indicators exist to allow indirect monitoring of pump performance to validate proper pump operation by determination of an increasing temperature trend (i.e., | |||
indicating insufficient flow) or a stable/decreasing temperature trend (i.e., | |||
indicating sufficient flow). All of these features are described in the UFSAR. | |||
The UFSAR also states that the operator will "examine pump performance and utilize the information from at least one of the redundant plant channels to verify performance" and "the information necessary to perform this task is one parameter directly associated with the pump (motor electrical current) and three parameters indirectly associated with pump performance (discharge pressure, flow rate, and response of redundant temperature indications)." | |||
A digital system will replace all of the analog controls and indicators. Two monitoring stations will be provided, either of which can be used to monitor the pump. Each monitoring station will display the information from one of the two redundant channels. The new digital system does not contain features to automatically control the pump, but does contain the ability to monitor each of the performance indications and inform/alert the operator of the need to take action. Therefore, all pump manipulations will still be manually controlled. | |||
Since the new digital system presents the same number (one) and type (motor electrical current) of pump parameters to directly ascertain pump performance and the same number (three) and type (discharge pressure, flow rate and redundant temperature) of system parameters to indirectly ascertain pump performance, there is no adverse impact on the UFSAR-D-29 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 described design function to perform direct monitoring of pump performance and no adverse impact on the UFSAR-described design function to perform indirect monitoring of pump performance. | |||
617 618 Information Presentation on the Human-System Interface 619 620 A typical change in data presentation might result from the replacement of 621 an edgewise analog meter with a numeric display or a multipurpose CRT. | |||
622 To determine if the HSI aspects of a digital modification have an adverse 623 effect on UFSAR-described design functions, potential impacts due to how 624 the information is presented should be addressed in the Screen. | |||
625 Consideration of a digital modification's impact due to how the information is 626 presented involves an examination of how the actual information 627 presentation method could impact the performance and/or satisfaction of 628 UFSAR-described design functions. To determine possible impacts, the 629 UFSAR should be reviewed to identify descriptions regarding how 630 information is presented, organized (e.g., how the information is physically 631 presented) or accessed, and if that presentation, organization or access 632 relates to the performance and/or satisfaction of a UFSAR-described design 633 function. | |||
634 Examples of activities that have the potential to cause an adverse effect 635 include the following activities: | |||
636 Addition or removal of a dead-band, or 637 Replacement of instantaneous readings with time-averaged readings 638 (or vice-versa). | |||
639 If the HSI changes do not exhibit characteristics such as those listed above, 640 then it may be reasonable to conclude that the method of performing or 641 controlling a design function is not adversely affected. | |||
642 Example 4-9 illustrates the application of the Information Presentation 643 aspect. | |||
Example 4-9. Information Presentation with an ADVERSE IMPACT on a UFSAR-Described Design Function A digital modification consolidates system information onto two flat panel displays (one for each redundant channel/train). Also, due to the increased precision of the digital equipment, the increment of presentation on the HSI will be improved from 10 gpm to 1 gpm. Furthermore, the HSI will now D-30 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 present the information layout "by channel/train." | |||
The UFSAR identifies the existing presentation method as consisting of "indicators with a 10 gpm increment" to satisfy safety analysis assumptions and the physical layout as being "by flow path" to allow the operator to determine system performance. | |||
The increase in the display increment is not adverse since the operator will continue to be able to distinguish the minimum increment of 10 gpm UFSAR-described design function. | |||
The new display method (i.e., "by channel/train") adversely affects the ability of the operator to satisfy the design function to ascertain system performance "by flow path." | |||
644 645 Operator Response Time 646 647 Typically, an increase in the operator response time might result from the 648 need for the operator to perform additional actions (e.g., due to the additional 649 steps necessary to call up or retrieve the appropriate display and operate the 650 soft control rather than merely reading an indicator on the Main Control 651 Board). | |||
652 To determine if the HSI aspects of a digital modification have an adverse 653 effect on UFSAR-described design functions, potential impacts on the 654 operator response time should be addressed in the Screen. | |||
655 Consideration of a digital modification's impact on the operator response time 656 due to the modification of the number and/or type of decisions made, and/or 657 the modification of the number and/or type of actions taken, involves an 658 examination of the actual decisions made/actions taken and how they could 659 impact the performance and/or satisfaction of UFSAR-described design 660 functions. To determine possible impacts, the UFSAR must be reviewed to 661 identify descriptions relating to operator response time requirements and if 662 those timing requirements are related to the performance and/or satisfaction 663 of a UFSAR-described design function. | |||
664 Example 4-10 is the same as Example 4-9, but illustrates the application of 665 the Operator Response Time aspect. | |||
Example 4-10. Operator Response Time with NO ADVERSE IMPACT on a UFSAR-Described Design Function A digital modification consolidates system information onto two flat panel D-31 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 displays (one for each redundant channel/train). Also, due to the increased precision of the digital equipment, the increment of presentation on the HSI will be improved from 10 gpm to 1 gpm. Furthermore, the HSI will now present the information layout "by channel/train." | |||
The UFSAR identifies the existing presentation method as consisting of the physical layout as being "by flow path" to allow the operator to determine system performance. | |||
Although the UFSAR identifies the existing presentation method as consisting of a physical layout "by flow path" to allow the operator to determine system performance and the new display method (i.e., "by channel/train") will require additional steps by the operator to determine system performance, requiring more time, there is no adverse impact on satisfaction of the design function to ascertain system performance because no response time requirements are applicable to the design function of the operator being able "to determine system performance. | |||
666 667 COMPREHENSIVE HUMAN-SYSTEM INTERFACE EXAMPLE 668 Although no additional guidance is provided in this section, Example 4-11 669 illustrates how each of the aspects identified above would be addressed. | |||
Example 4-11. Digital Modification involving Extensive HSI Considerations with NO ADVERSE IMPACTS on a UFSAR-Described Design Function Component controls for a redundant safety-related system are to be replaced with PLCs. The existing HSI for these components is made up of redundant hard-wired switches, indicator lights, and analog meters. The new system consolidates the information and controls onto two flat panel displays (one per redundant train), each with a touch screen providing soft control capability. | |||
The existing number and type of parameters remains the same, which can be displayed in a manner similar to the existing presentations (e.g., by train). | |||
However, the information can be also presented in different configurations that did not previously exist (e.g., by path or by parameter type to allow for easier comparison of like parameters), using several selectable displays. | |||
The flat panel display can also present any of several selectable pages depending on the activity being performed by the operator (e.g., | |||
starting/initiating the system, monitoring the system during operation, or D-32 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 changing the system line-up). | |||
To operate a control, the operator must (via the touch screen) select the appropriate activity (e.g., starting/initiating the system, monitoring the system during operation, or changing the system line-up), select the desired page (e.g., train presentation, path presentation, or parameter comparison), | |||
select the component to be controlled (e.g., pump or valve), select the control action (e.g., start/stop or open/close), and execute it. | |||
The display remains on the last page selected, but each page contains a "menu" of each possible option to allow direct access to any page without having to return to the "main menu." | |||
The two new HSIs (one per redundant train) will provide better support of operator tasks and reduced risk of errors due to: | |||
Consolidation of needed information onto a single display (within the family of available displays) that provides a much more effective view of system operation when it is called into action. | |||
Elimination of the need for the operator to seek out meter readings or indications, saving time and minimizing errors. | |||
Integration of cautions and warnings within the displays to help detect and prevent potential errors in operation (e.g., warnings about incorrect system lineups during a test or maintenance activity). | |||
The design was developed using a human factors engineering design, with a verification and validation process consistent with current industry and regulatory standards and guidelines. As part of the technical evaluation supporting the proposed activity, a Human Factors Evaluation (HFE) was performed. Based on the conclusions from the HFE, the design provides a more effective HSI that is less prone to human error than the existing design. | |||
The UFSAR-described design functions applicable to this proposed activity include descriptions of how the existing controls, including the physical switches, indicator lights and meters, and how each of these SSCs is used during normal and abnormal (including accident) operating conditions. The UFSAR identifies the current physical arrangement (i.e., two physically separate locations) as providing a provides assurance that the design function is satisfied by preventing the operator that prevents the operator from operating the "wrong" component. There are no UFSAR-described design functions related to the operator response times associated with using the existing controls. | |||
The impacts on design functions are identified below: | |||
D-33 | |||
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 Physical Interaction - NOT ADVERSE because the new HSI consists of two physically separate displays. | |||
Number and Type of Parameters - NOT ADVERSE because the same number and type of parameters exist with the new HSI. | |||
Information Presentation - NOT ADVERSE because all of the existing features (e.g., individual controls, indicator lights and parameters displays that mimic the analog meters) continue to exist with the new HSI. | |||
Operator Response Time - NOT ADVERSE because no response time requirements were applicable to any of the design functions and there were no indirect adverse affects on any other design function. | |||
670 671 4.2.1.3 Screening Changes to UFSAR Methods of Evaluation 672 By definition, a proposed activity involving a digital modification involves 673 SSCs and how SSCs are operated and controlled, not a method of evaluation 674 described in the UFSAR (see NEI 96-07, Section 3.10). | |||
675 Methods of evaluation are analytical or numerical computer models used to 676 determine and/or justify conclusions in the UFSAR (e.g., accident analyses 677 that demonstrate the ability to safely shut down the reactor or prevent/limit 678 radiological releases). These models also use "software." However, the 679 software used in these models is separate and distinct from the software 680 installed in the facility. The response to this Screen consideration should 681 reflect this distinction. | |||
682 A necessary revision or replacement of a method of evaluation (see NEI 96-683 07, Section 3.10) resulting from a digital modification is separate from the 684 digital modification itself and the guidance in NEI 96-07, Section 4.2.1.3 685 applies. | |||
686 4.2.2 Is the Activity a Test or Experiment Not Described in the UFSAR? | |||
687 By definition, a proposed activity involving a digital modification involves 688 SSCs and how SSCs are operated and controlled, not a test or experiment 689 (see NEI 96-07, Section 4.2.2). The response to this Screen consideration 690 should reflect this characterization. | |||
691 A necessary test or experiment (see NEI 96-07, Section 3.14) involving a 692 digital modification is separate from the digital modification itself and the 693 guidance in NEI 96-07, Section 4.2.2 applies. | |||
D-34}} |
Latest revision as of 17:16, 29 October 2019
ML17269A001 | |
Person / Time | |
---|---|
Site: | Nuclear Energy Institute |
Issue date: | 05/16/2017 |
From: | Nuclear Energy Institute |
To: | Joseph Holonich Licensing Processes Branch (DPR) |
Holonich J, NRR/DPR, 415-7297 | |
Shared Package | |
ML17269A001 | List: |
References | |
Download: ML17269A001 (13) | |
Text
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 Example 4-4. Digital Modification that Satisfies Dependability, causing NO ADVERSE IMPACT on a UFSAR-described Design Function An analog recorder is to be replaced with a new microprocessor-based recorder. The recorder is used for various purposes including Post Accident Monitoring, which is a UFSAR-described design function.
Dependability Assessment: An engineering evaluation performed as part of the technical assessment supporting the digital modification concluded that the new recorder will be highly dependable (based on a quality development process, testability, and successful operating history) and therefore, the risk of failure of the recorder due to software is considered very low.
The change will have NO ADVERSE IMPACT on any design function due to the dependability assessment.
451 452 4.2.1.2 Screening of Changes to Procedures as Described in the UFSAR Comment [A42]: Comments on HSI Screening Guidance were previously provided in:
453 SCOPE (1) ML17068A092 Comment Nos. 18-26 (2) ML17170A089 Comment Nos. A17-A27 454 If the digital modification does not include or affect a Human-System 455 Interface (e.g., the replacement of a stand-alone analog relay with a digital 456 relay that has no features involving personnel interaction and does not feed 457 signals into any other analog or digital device), then this section does not 458 apply and may be excluded from the Screen assessment.
459 In NEI 96-07, Section 3.11 defines procedures as follows:
460 "...Procedures include UFSAR descriptions of how actions related to 461 system operation are to be performed and controls over the performance 462 of design functions. This includes UFSAR descriptions of operator 463 action sequencing or response times, certain descriptions...of SSC 464 operation and operating modes, operational...controls, and similar 465 information."
466 Although UFSARs do not typically describe the details of a specific Human-467 System Interface, UFSARs will describe any design functions associated with 468 the HSI.
469 Because the human-system interface (HSI) involves system/component 470 operation, this portion of a digital modification is assessed in this Screen 471 consideration. The focus of the Screen assessment is on potential adverse 472 effects due to modifications of the interface between the human user and the 473 technical device.
D-22
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 474 There are 3 "basic HSI elements" (
Reference:
475 Displays: the visual representation of the information operators need 476 to monitor and control the plant.
477 Controls: the devices through which personnel interact with the HSI 478 and the plant.
479 User-interface interaction and management: the means by which 480 personnel provide inputs to an interface, receive information from it, 481 and manage the tasks associated with access and control of 482 information. Comment [DA43]: Clarification: Thnk of these elements as a way to define the entirety 483 Operators must be able to accurately perceive, comprehend and respond to of what comprises and HSI. Some modifications may not fall neatly into one 484 system information via the HSI to successfully complete their tasks. category, but if it falls within any or all of 485 Specifically, nuclear power plant personnel perform "four generic primary these categories, it is HSI related.
486 tasks" (
Reference:
XXXNUREG/CR 6947):
487 (1) monitoring and detection (extracting information from the 488 environment and recognizing when something changes),
489 (2) situation assessment (evaluation of conditions),
490 (3) response planning (deciding upon actions to resolve the situation) and 491 (4) response implementation (performing an action).
492 To determine potential adverse impacts of HSI modifications on design 493 functions, a two-step analysis must be performed. Step one is assessing if 494 and in what way how the modification impacts (i.e., positively, negatively or 495 no impact) the operators' abilities to perform each of the four primary types of 496 tasks described above. If there are negative impacts, stepStep two of the 497 analysis consists of determining if and how the impacts, identified in step 498 one, affects the pertinent UFSAR-described design function(s) (i.e., adversely 499 or not adversely). Examples of Examples of nnegative impacts on operator 500 performance of tasks that may result in adverse effects on a design function 501 include but are not limited to:
502 increased possibility of mis-operation, 503 increased difficulty in evaluating conditions, 504 increased difficulty in performing an action, 505 increased time to respond, 506 creation of new potential failure modes.
507 508 Table 1 contains examples of modifications to HSI elements that should be 509 addressed in the response to this Screen consideration.
510 511 [INSERT TABLE 1 FROM HSI COMMENTS FILE HERE.]
512 513 In NEI 96-07, Section 3.11 defines procedures as follows:
514 D-23
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 515 "...Procedures include UFSAR descriptions of how actions related 516 to system operation are to be performed and controls over the 517 performance of design functions. This includes UFSAR 518 descriptions of operator action sequencing or response times, 519 certain descriptions...of SSC operation and operating modes, 520 operational...controls, and similar information."
521 Because the HumanSystem Interface involves system/component operation, operator 522 actions, response times, etc., this portion of a digital modification is assessed in this Screen 523 consideration.
524 If the digital modification does not include or affect a Human-System 525 Interface (e.g., the replacement of a stand-alone analog relay with a digital 526 relay that has no features involving personnel interaction and does not feed 527 signals into any other analog or digital device), then this section does not 528 apply and may be excluded from the Screen assessment.
529 The focus of the Screen assessment is on potential adverse effects due to 530 modifications of the interface between the human user and the technical 531 device [e.g., equipment manipulations, actions taken, options available, 532 decision-making, manipulation sequences or operator response times 533 (including the impact of errors of a cognitive nature in which the information 534 being provided is unclear or incorrect)], not the written procedure 535 modifications that may accompany a physical design modification (which are 536 addressed in the guidance provided in NEI 96-07, Section 4.2.1.2).
537 PHYSICAL INTERFACE WITH THE HUMAN-SYSTEM INTERFACE 538 In the determination of potential adverse impacts, the following aspects 539 should be addressed in the response to this Screen consideration:
540 (a) Physical Interaction with the Human-System Interface (HSI) 541 (b) Number/Type of Parameters 542 (c) Information Presentation 543 (d) Operator Response Time 544 Physical Interaction with the Human-System Interface 545 A typical physical interaction modification might involve the use of a touch 546 screen in place of push-buttons, switches or knobs, including sensory-based 547 aspects such as auditory or tactile feedback.
D-24
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 548 To determine if the HSI aspects of a digital modification have an adverse 549 impact on UFSAR-described design functions, potential impacts due to the 550 physical interaction with the HSI should be addressed in the Screen.
551 Consideration of a digital modification's impact due to the physical 552 interaction with the HSI involves an examination of the actual physical 553 interface and how it could impact the performance and/or satisfaction of 554 UFSAR-described design functions. For example, if a new malfunction is 555 created as a result of the physical interaction, then the HSI portion of the 556 digital modification would be adverse. Such a new malfunction may be 557 created by the interface requiring the human user to choose which of multiple 558 components is to be controlled, creating the possibility of selecting the wrong 559 component (which could not occur with an analog system that did not need 560 the human user to "make a selection").
561 Characteristics of HSI changes that could lead to potential adverse effects 562 may include, but are not limited to:
563 Changes from manual to automatic initiation (or vice versa) of 564 functions, 565 Changes in the data acquisition process (such as replacing an edgewise 566 analog meter with a numeric display or a multipurpose CRT in which 567 access to the data requires operator interaction to display),
568 Changes that create new potential failure modes in the interaction of 569 operators with the system (e.g., new interrelationships or 570 interdependencies of operator actions and/or plant response, or new 571 ways the operator assimilates plant status information),
572 Increased possibility of mis-operation related to performing a design 573 function, 574 Increased difficulty for an operator to perform a design function, or 575 Increased complexity or duration in diagnosing or responding to an 576 accident [e.g., Time-Critical Operation Actions (TCOAs) identified in 577 the UFSAR].
578 If the HSI changes do not exhibit characteristics such as those listed above, 579 then it may be reasonable to conclude that the method of performing or 580 controlling a design function is not adversely affected.
581 Examples 4-5 through 4-7 illustrate the application of the Physical 582 Interaction aspect illustrates how to apply the assessment process to ONLY 583 the "controls" element of an HSI.is process to an HISHSI modification Example 4-5. Physical Interaction Assessment of Modification with D-25
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 NO ADVERSE IMPACT on a UFSAR-Described Design Function Description of the Proposed Activity Involving the Control ElementModification:
Currently, a knob is rotated clock-wise to increase a control function open a flow control valve in 1% increments and counter clock-wise to decrease the control functionclose a flow control valve in 1% increments. This knob will be replaced with a touch screen that has two separate arrows, each in its own function block. Using the touch screen, touching the "up" arrow will increase the control function open the flow control valve in 1% increments and touching the "down" arrow will decrease the control functionclose the flow control valve in 1% increments.
Identification and Assessment of the Four Generic Primary Tasks Potentially ImpactedInvolved:
(1) monitoring and detection (extracting information from the environment and recognizing when something changes) - NOT INVOLVED (2) situation assessment (evaluation of conditions) - NOT INVOLVED (3) response planning (deciding upon actions to resolve the situation) - NOT INVOLVED (4) response implementation (performing an action) - NOT INVOLVED Comment [DA44]: Response implementation is the only task that would be pertinent here as it changes the Design Function Identification:
The UFSAR-described design function states the operator can "increase and decrease the control functions using manual controls located in the Main Control Room." Thus, this UFSAR description implicitly identifies the SSC (i.e., the knob) and the design function of the SSC (i.e., its ability to allow the operator to manually adjust the control function).
Identification and Assessment of Modification Impacts on the Four Generic Primary Tasks INVOLVED:
As part of the technical evaluation supporting the proposed activitymodification, a Human Factors Evaluation (HFE) was performed.
Tasks 1,2 and 3 are not involved therefore they do not have negative impacts. Task 4 is involved, but the HFE determined that the change from knob to touch screen was not going to have a negative impact on the operator because ...there was no change to the ability of the operator to perform the response implementation task . The HFE concluded that no new failures or malfunctions have been introduced as a result of the replacement from a knob to a touch screen.
D-26
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 possibility of mis-operation - NO IMPACT difficulty in evaluating conditions - N/A difficulty in performing an action - NO IMPACT time to respond - N/A new potential failure modes - NO IMPACT Comment [DA45]: These are only some of the possible negative impacts , thus, listing Identification of the Relevant Design Function(s): them here makes it appear that these are the ONLY outcomes that should be considered, Again, we do not want to get in a situation The UFSAR design function states the operator can "increase and decrease where we are trying to list all the possibilities.
the control functions open and close the flow control valve using manual controls located in the Main Control Room." Thus, this UFSAR description implicitly identifies the SSC (i.e., the knob) and the design function of the SSC (i.e., its ability to allow the operator to manually adjust the control functionposition of the flow control valve).
Assessment of Impact(s) on Design Function Impact(s)
Using the results from the HFE and examining only the physical interaction aspect "controls" element of an HSI (e.g., ignoring the impact on operator response time or the number and/or sequence of steps necessary to access the new digital controlsthe other three HSI elements), the replacement of the "knob" with a "touch screen" is not adverse since it does not impact the ability of the operator to "increase and decrease the control functions open and close the flow control valve using manual controls located in the Main Control Room," maintaining satisfaction of the UFSAR-described design function.
584 Using the same proposed activity provided in Example 4-5, Example 4-6 585 illustrates how a variation in the UFSAR description would cause an adverse 586 impact.
Example 4-6. Physical Interaction with an ADVERSE IMPACT on a UFSAR-Described Design Function The UFSAR states not only that the operator can "increase and decrease the control functions using manual controls located in the Main Control Room,"
but also that "the control mechanism provides tactile feedback to the operator as the mechanism is rotated through each setting increment."
Since a touch screen cannot provide (or duplicate) the "tactile feedback" of a mechanical device, replacing the "knob" with a "touch screen" is adverse because it adversely impacts the ability of the operator to obtain tactile feedback from the device.
D-27
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 587 Using the same proposed activity provided in Example 4-5 and the same 588 UFSAR descriptions from Example 4-6, Example 4-7 illustrates how a 589 variation in the proposed activity would also cause an adverse impact.
Example 4-7. Physical Interaction with an ADVERSE IMPACT on a UFSAR-Described Design Function In addition to the touch screen control "arrows" themselves, a sound feature and associated components will be added to the digital design that will emit a clearly audible and distinct "tone" each time the control setting passes through the same setting increment that the tactile feature provided with the mechanical device.
Although the operator will now receive auditory "feedback" during the operation of the digital device, the means by which this feedback is provided has been altered. Since the means of controlling the design function has changed, new malfunctions can be postulated (e.g., high ambient sound levels that prevent the operator from hearing the feedback). Therefore, the modification of the feedback feature (i.e., from tactile to auditory) has an adverse impact on the ability of the design function to be performed.
590 591 Number and/or Type of Parameters Displayed By and/or Available 592 From the Human-System Interface 593 One advantage of a digital system is the amount of information that can be 594 monitored, stored and presented to the user. However, the possibility exists 595 that the amount of such information may lead to an over-abundance that is 596 not necessarily beneficial in all cases.
597 To determine if the HSI aspects of a digital modification have an adverse 598 effect on UFSAR-described design functions, potential impacts due to the 599 number and/or type of parameters displayed by and/or available from the 600 HSI should be addressed in the Screen.
601 Consideration of a digital modification's impact due to the number and/or 602 type of parameters displayed by and/or available from the HSI involves an 603 examination of the actual number and/or type of parameters displayed by 604 and/or available from the HSI and how they could impact the performance 605 and/or satisfaction of UFSAR-described design functions. Potential causes for 606 an adverse impact on a UFSAR-described design function could include a 607 reduction in the number of parameters monitored (which could make the 608 diagnosis of a problem or determination of the proper action more challenging 609 or time-consuming for the operator), the absence of a previously available 610 parameter (i.e., a type of parameter), a difference in how the loss or failure of D-28
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 611 parameters occurs (e.g., as the result of combining parameters), or an 612 increase in the amount of information that is provided such that the amount 613 of available information has a detrimental impact on the operator's ability to 614 discern a particular plant condition or to perform a specific task.
615 Example 4-8 illustrates the application of the Number and/or Type of 616 Parameters aspect.
Example 4-8. Number and Type of Parameters with NO ADVERSE IMPACT on a UFSAR-Described Design Function Currently, all controls and indications for a single safety-related pump are analog. There are two redundant channels of indications, either of which can be used to monitor pump performance, but only one control device. For direct monitoring of pump performance, redundant motor electrical current indicators exist. For indirect monitoring of pump performance, redundant discharge pressure and flow rate indicators exist. Furthermore, at the destination of the pump's flow, redundant temperature indicators exist to allow indirect monitoring of pump performance to validate proper pump operation by determination of an increasing temperature trend (i.e.,
indicating insufficient flow) or a stable/decreasing temperature trend (i.e.,
indicating sufficient flow). All of these features are described in the UFSAR.
The UFSAR also states that the operator will "examine pump performance and utilize the information from at least one of the redundant plant channels to verify performance" and "the information necessary to perform this task is one parameter directly associated with the pump (motor electrical current) and three parameters indirectly associated with pump performance (discharge pressure, flow rate, and response of redundant temperature indications)."
A digital system will replace all of the analog controls and indicators. Two monitoring stations will be provided, either of which can be used to monitor the pump. Each monitoring station will display the information from one of the two redundant channels. The new digital system does not contain features to automatically control the pump, but does contain the ability to monitor each of the performance indications and inform/alert the operator of the need to take action. Therefore, all pump manipulations will still be manually controlled.
Since the new digital system presents the same number (one) and type (motor electrical current) of pump parameters to directly ascertain pump performance and the same number (three) and type (discharge pressure, flow rate and redundant temperature) of system parameters to indirectly ascertain pump performance, there is no adverse impact on the UFSAR-D-29
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 described design function to perform direct monitoring of pump performance and no adverse impact on the UFSAR-described design function to perform indirect monitoring of pump performance.
617 618 Information Presentation on the Human-System Interface 619 620 A typical change in data presentation might result from the replacement of 621 an edgewise analog meter with a numeric display or a multipurpose CRT.
622 To determine if the HSI aspects of a digital modification have an adverse 623 effect on UFSAR-described design functions, potential impacts due to how 624 the information is presented should be addressed in the Screen.
625 Consideration of a digital modification's impact due to how the information is 626 presented involves an examination of how the actual information 627 presentation method could impact the performance and/or satisfaction of 628 UFSAR-described design functions. To determine possible impacts, the 629 UFSAR should be reviewed to identify descriptions regarding how 630 information is presented, organized (e.g., how the information is physically 631 presented) or accessed, and if that presentation, organization or access 632 relates to the performance and/or satisfaction of a UFSAR-described design 633 function.
634 Examples of activities that have the potential to cause an adverse effect 635 include the following activities:
636 Addition or removal of a dead-band, or 637 Replacement of instantaneous readings with time-averaged readings 638 (or vice-versa).
639 If the HSI changes do not exhibit characteristics such as those listed above, 640 then it may be reasonable to conclude that the method of performing or 641 controlling a design function is not adversely affected.
642 Example 4-9 illustrates the application of the Information Presentation 643 aspect.
Example 4-9. Information Presentation with an ADVERSE IMPACT on a UFSAR-Described Design Function A digital modification consolidates system information onto two flat panel displays (one for each redundant channel/train). Also, due to the increased precision of the digital equipment, the increment of presentation on the HSI will be improved from 10 gpm to 1 gpm. Furthermore, the HSI will now D-30
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 present the information layout "by channel/train."
The UFSAR identifies the existing presentation method as consisting of "indicators with a 10 gpm increment" to satisfy safety analysis assumptions and the physical layout as being "by flow path" to allow the operator to determine system performance.
The increase in the display increment is not adverse since the operator will continue to be able to distinguish the minimum increment of 10 gpm UFSAR-described design function.
The new display method (i.e., "by channel/train") adversely affects the ability of the operator to satisfy the design function to ascertain system performance "by flow path."
644 645 Operator Response Time 646 647 Typically, an increase in the operator response time might result from the 648 need for the operator to perform additional actions (e.g., due to the additional 649 steps necessary to call up or retrieve the appropriate display and operate the 650 soft control rather than merely reading an indicator on the Main Control 651 Board).
652 To determine if the HSI aspects of a digital modification have an adverse 653 effect on UFSAR-described design functions, potential impacts on the 654 operator response time should be addressed in the Screen.
655 Consideration of a digital modification's impact on the operator response time 656 due to the modification of the number and/or type of decisions made, and/or 657 the modification of the number and/or type of actions taken, involves an 658 examination of the actual decisions made/actions taken and how they could 659 impact the performance and/or satisfaction of UFSAR-described design 660 functions. To determine possible impacts, the UFSAR must be reviewed to 661 identify descriptions relating to operator response time requirements and if 662 those timing requirements are related to the performance and/or satisfaction 663 of a UFSAR-described design function.
664 Example 4-10 is the same as Example 4-9, but illustrates the application of 665 the Operator Response Time aspect.
Example 4-10. Operator Response Time with NO ADVERSE IMPACT on a UFSAR-Described Design Function A digital modification consolidates system information onto two flat panel D-31
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 displays (one for each redundant channel/train). Also, due to the increased precision of the digital equipment, the increment of presentation on the HSI will be improved from 10 gpm to 1 gpm. Furthermore, the HSI will now present the information layout "by channel/train."
The UFSAR identifies the existing presentation method as consisting of the physical layout as being "by flow path" to allow the operator to determine system performance.
Although the UFSAR identifies the existing presentation method as consisting of a physical layout "by flow path" to allow the operator to determine system performance and the new display method (i.e., "by channel/train") will require additional steps by the operator to determine system performance, requiring more time, there is no adverse impact on satisfaction of the design function to ascertain system performance because no response time requirements are applicable to the design function of the operator being able "to determine system performance.
666 667 COMPREHENSIVE HUMAN-SYSTEM INTERFACE EXAMPLE 668 Although no additional guidance is provided in this section, Example 4-11 669 illustrates how each of the aspects identified above would be addressed.
Example 4-11. Digital Modification involving Extensive HSI Considerations with NO ADVERSE IMPACTS on a UFSAR-Described Design Function Component controls for a redundant safety-related system are to be replaced with PLCs. The existing HSI for these components is made up of redundant hard-wired switches, indicator lights, and analog meters. The new system consolidates the information and controls onto two flat panel displays (one per redundant train), each with a touch screen providing soft control capability.
The existing number and type of parameters remains the same, which can be displayed in a manner similar to the existing presentations (e.g., by train).
However, the information can be also presented in different configurations that did not previously exist (e.g., by path or by parameter type to allow for easier comparison of like parameters), using several selectable displays.
The flat panel display can also present any of several selectable pages depending on the activity being performed by the operator (e.g.,
starting/initiating the system, monitoring the system during operation, or D-32
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 changing the system line-up).
To operate a control, the operator must (via the touch screen) select the appropriate activity (e.g., starting/initiating the system, monitoring the system during operation, or changing the system line-up), select the desired page (e.g., train presentation, path presentation, or parameter comparison),
select the component to be controlled (e.g., pump or valve), select the control action (e.g., start/stop or open/close), and execute it.
The display remains on the last page selected, but each page contains a "menu" of each possible option to allow direct access to any page without having to return to the "main menu."
The two new HSIs (one per redundant train) will provide better support of operator tasks and reduced risk of errors due to:
Consolidation of needed information onto a single display (within the family of available displays) that provides a much more effective view of system operation when it is called into action.
Elimination of the need for the operator to seek out meter readings or indications, saving time and minimizing errors.
Integration of cautions and warnings within the displays to help detect and prevent potential errors in operation (e.g., warnings about incorrect system lineups during a test or maintenance activity).
The design was developed using a human factors engineering design, with a verification and validation process consistent with current industry and regulatory standards and guidelines. As part of the technical evaluation supporting the proposed activity, a Human Factors Evaluation (HFE) was performed. Based on the conclusions from the HFE, the design provides a more effective HSI that is less prone to human error than the existing design.
The UFSAR-described design functions applicable to this proposed activity include descriptions of how the existing controls, including the physical switches, indicator lights and meters, and how each of these SSCs is used during normal and abnormal (including accident) operating conditions. The UFSAR identifies the current physical arrangement (i.e., two physically separate locations) as providing a provides assurance that the design function is satisfied by preventing the operator that prevents the operator from operating the "wrong" component. There are no UFSAR-described design functions related to the operator response times associated with using the existing controls.
The impacts on design functions are identified below:
D-33
NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 Physical Interaction - NOT ADVERSE because the new HSI consists of two physically separate displays.
Number and Type of Parameters - NOT ADVERSE because the same number and type of parameters exist with the new HSI.
Information Presentation - NOT ADVERSE because all of the existing features (e.g., individual controls, indicator lights and parameters displays that mimic the analog meters) continue to exist with the new HSI.
Operator Response Time - NOT ADVERSE because no response time requirements were applicable to any of the design functions and there were no indirect adverse affects on any other design function.
670 671 4.2.1.3 Screening Changes to UFSAR Methods of Evaluation 672 By definition, a proposed activity involving a digital modification involves 673 SSCs and how SSCs are operated and controlled, not a method of evaluation 674 described in the UFSAR (see NEI 96-07, Section 3.10).
675 Methods of evaluation are analytical or numerical computer models used to 676 determine and/or justify conclusions in the UFSAR (e.g., accident analyses 677 that demonstrate the ability to safely shut down the reactor or prevent/limit 678 radiological releases). These models also use "software." However, the 679 software used in these models is separate and distinct from the software 680 installed in the facility. The response to this Screen consideration should 681 reflect this distinction.
682 A necessary revision or replacement of a method of evaluation (see NEI 96-683 07, Section 3.10) resulting from a digital modification is separate from the 684 digital modification itself and the guidance in NEI 96-07, Section 4.2.1.3 685 applies.
686 4.2.2 Is the Activity a Test or Experiment Not Described in the UFSAR?
687 By definition, a proposed activity involving a digital modification involves 688 SSCs and how SSCs are operated and controlled, not a test or experiment 689 (see NEI 96-07, Section 4.2.2). The response to this Screen consideration 690 should reflect this characterization.
691 A necessary test or experiment (see NEI 96-07, Section 3.14) involving a 692 digital modification is separate from the digital modification itself and the 693 guidance in NEI 96-07, Section 4.2.2 applies.
D-34