ML17269A001

NEI 96-07, Appendix_D with Hsi Edits from 9/19/2017 - 9/21/2017 Meeting

ML17269A001
Person / Time
Site:	Nuclear Energy Institute
Issue date:	05/16/2017
From:	Nuclear Energy Institute
To:	Joseph Holonich Licensing Processes Branch (DPR)
Holonich J, NRR/DPR, 415-7297
Shared Package
ML17269A001	List: ML17269A001
References
Download: ML17269A001 (13)

Text

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 Example 4-4. Digital Modification that Satisfies Dependability, causing NO ADVERSE IMPACT on a UFSAR-described Design Function An analog recorder is to be replaced with a new microprocessor-based recorder. The recorder is used for various purposes including Post Accident Monitoring, which is a UFSAR-described design function. Dependability Assessment: An engineering evaluation performed as part of the technical assessment supporting the digital modification concluded that the new recorder will be highly dependable (based on a quality development process, testability, and successful operating history) and therefore, the risk of failure of the recorder due to software is considered very low. The change will have NO ADVERSE IMPACT on any design function due to the dependability assessment.

451 4.2.1.2 Screening of Changes to Procedures as Described in the UFSAR 452 SCOPE 453 If the digital modification does not include or affect a Human-System 454 Interface (e.g., the replacement of a stand-alone analog relay with a digital 455 relay that has no features involving personnel interaction and does not feed 456 signals into any other analog or digital device), then this section does not 457 apply and may be excluded from the Screen assessment. 458 In NEI 96-07, Section 3.11 defines procedures as follows: 459 "...Procedures include UFSAR descriptions of how actions related to 460 system operation are to be performed and controls over the performance 461 of design functions. This includes UFSAR descriptions of operator 462 action sequencing or response times, certain descriptions...of SSC 463 operation and operating modes, operational...controls, and similar 464 information

." 465 Although UFSARs do not typically describe the details of a specific Human-466 System Interface, UFSARs will describe any design functions associated with 467 the HSI. 468 Because the human-system interface (HSI) involves system/component 469 operation , this portion of a digital modification is assessed in this Screen 470 consideration. The focus of the Screen assessment is on potential adverse 471 effects due to modifications of the interface between the human user and the 472 technical device. 473 Comments on HSI Screening Guidance were previously provided in: (1) ML17068A092 Comment Nos. 18-26 (2) ML17170A089 Comment Nos. A17-A27 NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 There are 3 "basic HSI elements" (

Reference:

NUREG-0700): 474 Displays: the visual representation of the information operators need 475 to monitor and control the plant. 476 Controls: the devices through which personnel interact with the HSI 477 and the plant. 478 User-interface interaction and management: the means by which 479 personnel provide inputs to an interface, receive information from it, 480 and manage the tasks associated with access and control of 481 information. 482 Operators must be able to accurately perceive, comprehend and respond to 483 system information via the HSI to successfully complete their tasks. 484 Specifically, nuclear power plant personnel perform "four generic primary 485 tasks" (

Reference:

XXXNUREG/CR 6947

): 486 (1)monitoring and detection (extracting information from the 487 environment and recognizing when something changes), 488 (2)situation assessment (evaluation of conditions), 489 (3)response planning (deciding upon actions to resolve the situation) and 490 (4)response implementation (performing an action). 491 To determine potential adverse impacts of HSI modifications on design 492 functions, a two-step analysis must be performed. Step one is assessing if 493 and in what way how the modification impacts (i.e., positively , negatively or 494 no impact) the operators' abilities to perform each of the four primary types of 495 tasks described above. If there are negative impacts, stepStep two of the 496 analysis consists of determining if and how the impacts , identified in step 497 one, affect s the pertinent UFSAR-described design function(s) (i.e., adversely 498 or not adversely

). Examples of Examples of nnegative impacts on operator 499 performance of tasks that may result in adverse effects on a design function 500 include but are not limited to

501 increased possibility of mis-operation, 502 increased difficulty in evaluating conditions, 503 increased difficulty in performing an action, 504 increased time to respond, 505 creation of new potential failure modes. 506 507 Table 1 contains examples of modifications to HSI elements that should be 508 addressed in the response to this Screen consideration.

509 510 [INSERT TABLE 1 FROM HSI COMMENTS FILE HERE.] 511 512 In NEI 96-07, Section 3.11 defines procedures as follows: 513 514 Clarification: Thnk of these elements as a way to define the entirety of what comprises and HSI. Some modifications may not fall neatly into one category, but if it falls within any or all of these categories, it is HSI related.

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 "...Procedures include UFSAR descriptions of how actions related 515 to system operation are to be performed and controls over the 516 performance of design functions. This includes UFSAR 517 descriptions of operator action sequencing or response times, 518 certain descriptions...of SSC operation and operating modes, 519 operational...controls, and similar information." 520 521 522 523 If the digital modification does not include or affect a Human-System 524 Interface (e.g., the replacement of a stand-alone analog relay with a digital 525 relay that has no features involving personnel interaction and does not feed 526 signals into any other analog or digital device), then this section does not 527 apply and may be excluded from the Screen assessment. 528 The focus of the Screen assessment is on potential adverse effects due to 529 modifications of the interface between the human user and the technical 530 device [e.g., equipment manipulations, actions taken, options available, 531 decision-making, manipulation sequences or operator response times 532 (including the impact of errors of a cognitive nature in which the information 533 being provided is unclear or incorrect)], not the written procedure 534 modifications that may accompany a physical design modification (which are 535 addressed in the guidance provided in NEI 96-07, Section 4.2.1.2). 536 PHYSICAL INTERFACE WITH THE HUMAN-SYSTEM INTERFACE 537 In the determination of potential adverse impacts, the following aspects 538 should be addressed in the response to this Screen consideration: 539 (a) Physical Interaction with the Human-System Interface (HSI) 540 (b) Number/Type of Parameters 541 (c) Information Presentation 542 (d) Operator Response Time 543 Physical Interaction with the Human-System Interface 544 A typical physical interaction modification might involve the use of a touch 545 screen in place of push-buttons, switches or knobs, including sensory-based 546 aspects such as auditory or tactile feedback. 547 NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 To determine if the HSI aspects of a digital modification have an adverse 548 impact on UFSAR-described design functions, potential impacts due to the 549 physical interaction with the HSI should be addressed in the Screen. 550 Consideration of a digital modification's impact due to the physical 551 interaction with the HSI involves an examination of the actual physical 552 interface and how it could impact the performance and/or satisfaction of 553 UFSAR-described design functions. For example, if a new malfunction is 554 created as a result of the physical interaction, then the HSI portion of the 555 digital modification would be adverse. Such a new malfunction may be 556 created by the interface requiring the human user to choose which of multiple 557 components is to be controlled, creating the possibility of selecting the wrong 558 component (which could not occur with an analog system that did not need 559 the human user to "make a selection").

560 Characteristics of HSI changes that could lead to potential adverse effects 561 may include, but are not limited to: 562 Changes from manual to automatic initiation (or vice versa) of 563 functions, 564 Changes in the data acquisition process (such as replacing an edgewise 565 analog meter with a numeric display or a multipurpose CRT in which 566 access to the data requires operator interaction to display), 567 Changes that create new potential failure modes in the interaction of 568 operators with the system (e.g., new interrelationships or 569 interdependencies of operator actions and/or plant response, or new 570 ways the operator assimilates plant status information), 571 Increased possibility of mis-operatio n related to performing a design 572 function, 573 Increased difficulty for an operator to perform a design function, or 574 Increased complexity or duration in diagnosing or responding to an 575 accident [e.g., Time-Critical Operation Actions (TCOAs) identified in 576 the UFSAR]. 577 If the HSI changes do not exhibit characteristics such as those listed above, 578 then it may be reasonable to conclude that the "method of performing or 579 controlling" a design function is not adversely affected. 580 Example s 4-5 through 4-7 illustrate the application of the Physical 581 Interaction aspect illustrates how to apply the assessment process to ONLY 582 the "controls" element of an HSI.is process to an HISHSI modification 583 Example 4-5. Physical Interaction Assessment of Modification with NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 NO ADVERSE IMPACT on a UFSAR

-Described Design Function Description of the Proposed Activity Involving the Control ElementModification

Currently, a knob is rotated clock-wise to increase a control function open a flow control valve in 1% increments and counter clock-wise to decrease the control functionclose a flow control valve in 1% increments. This knob will be replaced with a touch screen that has two separate arrows, each in its own function block. Using the touch screen, touching the "up" arrow will increase the control function open the flow control valve in 1% increments and touching the "down" arrow will decrease the control functionclose the flow control valve in 1% increments

. Identification and Assessment of the Four Generic Primary Tasks Potentially ImpactedInvolved

(1)monitoring and detection (extracting information from the environment and recognizing when something changes) -

NOT INVOLVED (2)situation assessment (evaluation of conditions) - NOT INVOLVED (3)response planning (deciding upon actions to resolve the situation) - NOT INVOLVED (4)response implementation (performing an action) - NOT INVOLVED Design Function Identification: The UFSAR-described design function states the operator can "increase and decrease the control functions using manual controls located in the Main Control Room." Thus, this UFSAR description implicitly identifies the SSC (i.e., the knob) and the design function of the SSC (i.e., its ability to allow the operator to manually adjust the control function).

Identification and Assessment of Modification Impacts on the Four Generic Primary Tasks INVOLVED:

As part of the technical evaluation supporting the proposed activitymodification, a Human Factors Evaluation (HFE) was performed. The HFE concluded that no new failures or malfunctions have been introduced as a result of the replacement from a knob to a touch screen.

Response implementation is the only task that would be pertinent here as it changes the NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 possibility of mis-operation - NO IMPACT difficulty in evaluating conditions - N/A difficulty in performing an action - NO IMPACT time to respond - N/A new potential failure modes - NO IMPACT Identification of the Relevant Design Function(s): The UFSAR design function states the operator can "increase and decrease the control functions open and close the flow control valve using manual controls located in the Main Control Room." Thus, this UFSAR description implicitly identifies the SSC (i.e., the knob) and the design function of the SSC (i.e., its ability to allow the operator to manually adjust the control functionposition of the flow control valve

). Assessment of Impact(s) on Design Function Impact(s) Using the results from the HFE and examining only the physical interaction aspect "controls" element of an HSI (e.g., ignoring the impact on operator response time or the number and/or sequence of steps necessary to access the new digital controlsthe other three HSI elements), the replacement of the "knob" with a "touch screen" is not adverse since it does not impact the ability of the operator to "increase and decrease the control functions open and close the flow control valve using manual controls located in the Main Control Room," maintaining satisfaction of the UFSAR-described design function.Using the same proposed activity provided in Example 4-5, Example 4-6 584 illustrates how a variation in the UFSAR description would cause an adverse 585 impact. 586 Example 4-6. Physical Interaction with an ADVERSE IMPACT on a UFSAR-Described Design Function The UFSAR states not only that the operator can "increase and decrease the control functions using manual controls located in the Main Control Room," but also that "the control mechanism provides tactile feedback to the operator as the mechanism is rotated through each setting increment." Since a touch screen cannot provide (or duplicate) the "tactile feedback" of a mechanical device, replacing the "knob" with a "touch screen" is adverse because it adversely impacts the ability of the operator to obtain tactile feedback from the device.These are only some of the possible negative impacts , thus, listing them here makes it appear that these are the ONLY outcomes that should be considered, Again, we do not want to get in a situation where we are trying to list all the possibilities.

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 Using the same proposed activity provided in Example 4-5 and the same 587 UFSAR descriptions from Example 4-6, Example 4-7 illustrates how a 588 variation in the proposed activity would also cause an adverse impact. 589 Example 4-7. Physical Interaction with an ADVERSE IMPACT on a UFSAR-Described Design Function In addition to the touch screen control "arrows" themselves, a sound feature and associated components will be added to the digital design that will emit a clearly audible and distinct "tone" each time the control setting passes through the same setting increment that the tactile feature provided with the mechanical device. Although the operator will now receive auditory "feedback" during the operation of the digital device, the means by which this feedback is provided has been altered. Since the means of controlling the design function has changed, new malfunctions can be postulated (e.g., high ambient sound levels that prevent the operator from hearing the feedback). Therefore, the modification of the feedback feature (i.e., from tactile to auditory) has an adverse impact on the ability of the design function to be performed. 590 Number and/or Type of Parameters Displayed By and/or Available 591 From the Human-System Interface 592 One advantage of a digital system is the amount of information that can be 593 monitored, stored and presented to the user. However, the possibility exists 594 that the amount of such information may lead to an over-abundance that is 595 not necessarily beneficial in all cases. 596 To determine if the HSI aspects of a digital modification have an adverse 597 effect on UFSAR-described design functions, potential impacts due to the 598 number and/or type of parameters displayed by and/or available from the 599 HSI should be addressed in the Screen. 600 Consideration of a digital modification's impact due to the number and/or 601 type of parameters displayed by and/or available from the HSI involves an 602 examination of the actual number and/or type of parameters displayed by 603 and/or available from the HSI and how they could impact the performance 604 and/or satisfaction of UFSAR-described design functions. Potential causes for 605 an adverse impact on a UFSAR-described design function could include a 606 reduction in the number of parameters monitored (which could make the 607 diagnosis of a problem or determination of the proper action more challenging 608 or time-consuming for the operator), the absence of a previously available 609 parameter (i.e., a type of parameter), a difference in how the loss or failure of 610 NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 parameters occurs (e.g., as the result of combining parameters), or an 611 increase in the amount of information that is provided such that the amount 612 of available information has a detrimental impact on the operator's ability to 613 discern a particular plant condition or to perform a specific task. 614 Example 4-8 illustrates the application of the Number and/or Type of 615 Parameters aspect. 616 Example 4-8. Number and Type of Parameters with NO ADVERSE IMPACT on a UFSAR-Described Design Function Currently, all controls and indications for a single safety-related pump are analog. There are two redundant channels of indications, either of which can be used to monitor pump performance, but only one control device. For direct monitoring of pump performance, redundant motor electrical current indicators exist. For indirect monitoring of pump performance, redundant discharge pressure and flow rate indicators exist. Furthermore, at the destination of the pump's flow, redundant temperature indicators exist to allow indirect monitoring of pump performance to validate proper pump operation by determination of an increasing temperature trend (i.e., indicating insufficient flow) or a stable/decreasing temperature trend (i.e., indicating sufficient flow). All of these features are described in the UFSAR. The UFSAR also states that the operator will "examine pump performance and utilize the information from at least one of the redundant plant channels to verify performance" and "the information necessary to perform this task is one parameter directly associated with the pump (motor electrical current) and three parameters indirectly associated with pump performance (discharge pressure, flow rate, and response of redundant temperature indications)." A digital system will replace all of the analog controls and indicators. Two monitoring stations will be provided, either of which can be used to monitor the pump. Each monitoring station will display the information from one of the two redundant channels. The new digital system does not contain features to automatically control the pump, but does contain the ability to monitor each of the performance indications and inform/alert the operator of the need to take action. Therefore, all pump manipulations will still be manually controlled. Since the new digital system presents the same number (one) and type (motor electrical current) of pump parameters to directly ascertain pump performance and the same number (three) and type (discharge pressure, flow rate and redundant temperature) of system parameters to indirectly ascertain pump performance, there is no adverse impact on the UFSAR-NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 described design function to perform direct monitoring of pump performance and no adverse impact on the UFSAR-described design function to perform indirect monitoring of pump performance. 617 Information Presentation on the Human-System Interface 618 619 A typical change in data presentation might result from the replacement of 620 an edgewise analog meter with a numeric display or a multipurpose CRT. 621 To determine if the HSI aspects of a digital modification have an adverse 622 effect on UFSAR-described design functions, potential impacts due to how 623 the information is presented should be addressed in the Screen. 624 Consideration of a digital modification's impact due to how the information is 625 presented involves an examination of how the actual information 626 presentation method could impact the performance and/or satisfaction of 627 UFSAR-described design functions. To determine possible impacts, the 628 UFSAR should be reviewed to identify descriptions regarding how 629 information is presented, organized (e.g., how the information is physically 630 presented) or accessed, and if that presentation, organization or access 631 relates to the performance and/or satisfaction of a UFSAR-described design 632 function. 633 Examples of activities that have the potential to cause an adverse effect 634 include the following activities: 635 Addition or removal of a dead-band, or 636 Replacement of instantaneous readings with time-averaged readings 637 (or vice-versa). 638 If the HSI changes do not exhibit characteristics such as those listed above, 639 then it may be reasonable to conclude that the "method of performing or 640 controlling" a design function is not adversely affected. 641 Example 4-9 illustrates the application of the Information Presentation 642 aspect. 643 Example 4-9. Information Presentation with an ADVERSE IMPACT on a UFSAR-Described Design Function A digital modification consolidates system information onto two flat panel displays (one for each redundant channel/train). Also, due to the increased precision of the digital equipment, the increment of presentation on the HSI will be improved from 10 gpm to 1 gpm. Furthermore, the HSI will now NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 present the information layout "by channel/train." The UFSAR identifies the existing presentation method as consisting of "indicators with a 10 gpm increment" to satisfy safety analysis assumptions and the physical layout as being "by flow path" to allow the operator to determine system performance.The increase in the display increment is not adverse since the operator will continue to be able to distinguish the minimum increment of 10 gpm UFSAR-described design function. The new display method (i.e., "by channel/train") adversely affects the ability of the operator to satisfy the design function to ascertain system performance "by flow path." 644 Operator Response Time 645 646 Typically, an increase in the operator response time might result from the 647 need for the operator to perform additional actions (e.g., due to the additional 648 steps necessary to call up or retrieve the appropriate display and operate the 649 "soft" control rather than merely reading an indicator on the Main Control 650 Board). 651 To determine if the HSI aspects of a digital modification have an adverse 652 effect on UFSAR-described design functions, potential impacts on the 653 operator response time should be addressed in the Screen. 654 Consideration of a digital modification's impact on the operator response time 655 due to the modification of the number and/or type of decisions made, and/or 656 the modification of the number and/or type of actions taken, involves an 657 examination of the actual decisions made/actions taken and how they could 658 impact the performance and/or satisfaction of UFSAR-described design 659 functions. To determine possible impacts, the UFSAR must be reviewed to 660 identify descriptions relating to operator response time requirements and if 661 those timing requirements are related to the performance and/or satisfaction 662 of a UFSAR-described design function. 663 Example 4-10 is the same as Example 4-9, but illustrates the application of 664 the Operator Response Time aspect. 665 Example 4-10. Operator Response Time with NO ADVERSE IMPACT on a UFSAR-Described Design Function A digital modification consolidates system information onto two flat panel NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 displays (one for each redundant channel/train).

Also, due to the increased precision of the digital equipment, the increment of presentation on the HSI will be improved from 10 gpm to 1 gpm. Furthermore, the HSI will now present the information layout "by channel/train." The UFSAR identifies the existing presentation method as consisting of the physical layout as being "by flow path" to allow the operator to determine system performance.Although the UFSAR identifies the existing presentation method as consisting of a physical layout "by flow path" to allow the operator to determine system performance and the new display method (i.e., "by channel/train") will require additional steps by the operator to determine system performance, requiring more time, there is no adverse impact on satisfaction of the design function to ascertain system performance because no response time requirements are applicable to the design function of the operator being able "to determine system performance.

666 COMPREHENSIVE HUMAN-SYSTEM INTERFACE EXAMPLE 667 Although no additional guidance is provided in this section, Example 4-11 668 illustrates how each of the aspects identified above would be addressed. 669 Example 4-11. Digital Modification involving Extensive HSI Considerations with NO ADVERSE IMPACTS on a UFSAR-Described Design Function Component controls for a redundant safety-related system are to be replaced with PLCs. The existing HSI for these components is made up of redundant hard-wired switches, indicator lights, and analog meters. The new system consolidates the information and controls onto two flat panel displays (one per redundant train), each with a touch screen providing "soft" control capability. The existing number and type of parameters remains the same, which can be displayed in a manner similar to the existing presentations (e.g., by train). However, the information can be also presented in different configurations that did not previously exist (e.g., by path or by parameter type to allow for easier comparison of like parameters), using several selectable displays. The flat panel display can also present any of several selectable pages depending on the activity being performed by the operator (e.g., starting/initiating the system, monitoring the system during operation, or NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 changing the system line-up). To operate a control, the operator must (via the touch screen) select the appropriate activity (e.g., starting/initiating the system, monitoring the system during operation, or changing the system line-up), select the desired page (e.g., train presentation, path presentation, or parameter comparison), select the component to be controlled (e.g., pump or valve), select the control action (e.g., start/stop or open/close), and execute it. The display remains on the last page selected, but each page contains a "menu" of each possible option to allow direct access to any page without having to return to the "main menu." The two new HSIs (one per redundant train) will provide better support of operator tasks and reduced risk of errors due to: Consolidation of needed information onto a single display (within the family of available displays) that provides a much more effective view of system operation when it is called into action. Elimination of the need for the operator to seek out meter readings or indications, saving time and minimizing errors. Integration of cautions and warnings within the displays to help detect and prevent potential errors in operation (e.g., warnings about incorrect system lineups during a test or maintenance activity). The design was developed using a human factors engineering design, with a verification and validation process consistent with current industry and regulatory standards and guidelines. As part of the technical evaluation supporting the proposed activity, a Human Factors Evaluation (HFE) was performed. Based on the conclusions from the HFE, the design provides a more effective HSI that is less prone to human error than the existing design. The UFSAR-described design functions applicable to this proposed activity include descriptions of how the existing controls, including the physical switches, indicator lights and meters, and how each of these SSCs is used during normal and abnormal (including accident) operating conditions. The UFSAR identifies the current physical arrangement (i.e., two physically separate locations) as providing a provides assurance that the design function is satisfied by preventing the operator that prevents the operator from operating the "wrong" component. There are no UFSAR-described design functions related to the operator response times associated with using the existing controls. The impacts on design functions are identified below:

NEI 96-07, Appendix D NEI Proposed Modifications: May 16, 2017 Physical Interaction - NOT ADVERSE because the new HSI consists of two physically separate displays. Number and Type of Parameters - NOT ADVERSE because the same number and type of parameters exist with the new HSI. Information Presentation - NOT ADVERSE because all of the existing features (e.g., individual controls, indicator lights and parameters displays that mimic the analog meters) continue to exist with the new HSI. Operator Response Time - NOT ADVERSE because no response time requirements were applicable to any of the design functions and there were no indirect adverse affects on any other design function

. 670 4.2.1.3 Screening Changes to UFSAR Methods of Evaluation 671 By definition, a proposed activity involving a digital modification involves 672 SSCs and how SSCs are operated and controlled, not a method of evaluation 673 described in the UFSAR (see NEI 96-07, Section 3.10). 674 Methods of evaluation are analytical or numerical computer models used to 675 determine and/or justify conclusions in the UFSAR (e.g., accident analyses 676 that demonstrate the ability to safely shut down the reactor or prevent/limit 677 radiological releases). These models also use "software." However, the 678 software used in these models is separate and distinct from the software 679 installed in the facility. The response to this Screen consideration should 680 reflect this distinction. 681 A necessary revision or replacement of a method of evaluation (see NEI 96-682 07, Section 3.10) resulting from a digital modification is separate from the 683 digital modification itself and the guidance in NEI 96-07, Section 4.2.1.3 684 applies. 685 4.2.2 Is the Activity a Test or Experiment Not Described in the UFSAR? 686 By definition, a proposed activity involving a digital modification involves 687 SSCs and how SSCs are operated and controlled, not a test or experiment 688 (see NEI 96-07, Section 4.2.2). The response to this Screen consideration 689 should reflect this characterization. 690 A necessary test or experiment (see NEI 96-07, Section 3.14) involving a 691 digital modification is separate from the digital modification itself and the 692 guidance in NEI 96-07, Section 4.2.2 applies. 693