Text

Supplement to License Amendment Request to Revise the Licensing and Design Basis to Incorporate the Replacement of Existing Safety-Related Analog Control Systems with a Single Digital Plant Protection .
	ML23177A224
Person / Time
Site:	Limerick
Issue date:	06/26/2023
From:	David Helker; Constellation Energy Generation
To:	; Office of Nuclear Reactor Regulation, Document Control Desk
Shared Package
ML23177A223	List: ML23177A224;
References
	INL/RPT-23-71903, Rev 1
	Download: ML23177A224 (1)
	v • d • e

200 Exelon Way Kennett Square, PA 19348 www.ConstellationEnergy.com ATTACHMENT 1 TRANSMITTED HEREWITH MAY CONTAIN INFORMATION CONTROLLED BY THE DEPARTMENT OF ENERGY UNDER ITS REGULATIONS at 10 CFR PART 810.

ATTACHMENT 1 TRANSMITTED HEREWITH CONTAINS PROPRIETARY INFORMATION - WITHHOLD UNDER 10 CFR 2.390 10 CFR 50.90 June 26, 2023 U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 ATTN: Document Control Desk Limerick Generating Station, Units 1 and 2 Renewed Facility Operating License Nos. NPF-39 and NPF-85 NRC Docket Nos. 50-352 and 50-353

Subject:

Supplement to License Amendment Request to Revise the Licensing and Design Basis to Incorporate the Replacement of Existing Safety-Related Analog Control Systems with a Single Digital Plant Protection System (PPS)-

Human Factors Engineering Preliminary Validation Results Summary Report

References:

1. Constellation Energy Generation, LLC (CEG) letter to the U.S. Nuclear Regulatory Commission (NRC), "License Amendment Request to Revise the Licensing and Design Basis to Incorporate the Replacement of Existing Safety-Related Analog Control Systems with a Single Digital Plant Protection System (PPS)," dated September 26, 2022 (NRC Agencywide Documents Access and Management System (ADAMS) Accession No. ML22269A5690).

2. U.S. Nuclear Regulatory Commission (NRC) letter to Constellation Energy Generation, LLC (CEG), Limerick Generation Station, Unit Nos. 1 and 2 -

Acceptance of Requested Licensing Action Re: Replacement of Existing Safety Related Analog Control Systems with a Single Digital Plant Protection System (EPID L-2022-LLA-0140), dated December 9, 2022 (ADAMS Accession No. ML22339A064).

ATTACHMENT 1 TRANSMITTED HEREWITH MAY CONTAIN INFORMATION CONTROLLED BY THE DEPARTMENT OF ENERGY UNDER ITS REGULATIONS at 10 CFR PART 810, and PROPRIETARY INFORMATION -

WITHHOLD UNDER 10 CFR 2.390.

When separated, the cover letter is decontrolled.

Supplemental HFE PV RSR Docket Nos. 50-352 and 50-353 June 26, 2023 Page 2 ATTACHMENT 1 TRANSMITTED HEREWITH MAY CONTAIN INFORMATION CONTROLLED BY THE DEPARTMENT OF ENERGY UNDER ITS REGULATIONS at 10 CFR PART 810.

ATTACHMENT 1 TRANSMITTED HEREWITH CONTAINS PROPRIETARY INFORMATION - WITHHOLD UNDER 10 CFR 2.390

3. Constellation Energy Generation, LLC letter to U.S. Nuclear Regulatory Commission, Supplement to License Amendment Request to Revise the Licensing and Design Basis to Incorporate the Replacement of Existing Safety-Related Analog Control Systems with a Single Digital Plant Protection System (PPS)-Human Factors Engineering Preliminary Validation Results Summary Report, dated March 30, 2023 (ADAMS Accession No. ML23089A324)

In accordance with 10 CFR 50.90, Constellation Energy Generation, LLC (CEG) requested a License Amendment Request (LAR) to replace the Limerick Generating Station, Units 1 and 2 existing safety-related analog control systems with a single digital Plant Protection System (PPS) (Reference 1). NRC accepted the LAR for review on December 9, 2022 (Reference 2).

In Reference 1, CEG described supplemental information that needed to be updated at a later time. In Reference 2, NRC acknowledged a schedule for required supplemental information. In Reference 3, CEG provided the proprietary version of the Human Factors Engineering Preliminary Validation Results Summary Report (HFE PV RSR). The HFE PV RSR was classified by the Department of Energy (DOE) as Official Use Only (OUO),

Exemption Class 3, Export-Controlled Information, and Exemption Class 4, Commercial/Proprietary and may be considered exempt from public release under the Freedom of Information Act (5 U.S.C. 552(b)).

As noted in Reference 3, the preparation of the redacted non-proprietary version of the HFE PV RSR had been delayed and would be submitted at a later date.

This supplemental letter contains the original HFE PV RSR proprietary report submitted in Reference 3 (Attachment 1), the redacted non-proprietary HFE PV RSR, Revision 1 (Attachment 2), and the CEG affidavit (Attachment 3). Note that this report does not contain any WEC proprietary information.

The HFE PV RSR provided in Attachment 1 contains information proprietary to CEG. includes an affidavit signed by CEG, the owner of the proprietary information.

The affidavit sets forth the basis upon which the information may be withheld from public disclosure by the NRC, and it addresses with specificity the considerations listed in paragraph (b)(4) of 10 CFR 2.390 of the NRCs regulations. CEG requests that the CEG proprietary information in Attachment 1 be withheld from public disclosure in accordance with 10 CFR 2.390. Future correspondence with respect to the proprietary aspects of the application for withholding related to CEG proprietary information or the CEG affidavit provided in Attachment 3 should reference this request letter.

Supplemental HFE PV RSR Docket Nos. 50-352 and 50-353 June 26, 2023 Page 3 ATTACHMENT 1 TRANSMITTED HEREWITH MAY CONTAIN INFORMATION CONTROLLED BY THE DEPARTMENT OF ENERGY UNDER ITS REGULATIONS at 10 CFR PART 810.

ATTACHMENT 1 TRANSMITTED HEREWITH CONTAINS PROPRIETARY INFORMATION - WITHHOLD UNDER 10 CFR 2.390 may also contain information controlled by the Department of Energy under its regulations at 10 CFR Part 810. This information is bounded by the proprietary withholding redactions and does not appear in the non-proprietary Attachment 2.

CEG has reviewed the information supporting a finding of no significant hazards consideration, and the environmental consideration, which was previously provided to the NRC in the Reference 1 letter. CEG has concluded that the information provided in this supplemental letter does not affect the bases for concluding that the proposed license amendments do not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92. In addition, CEG has concluded that the information in this supplemental letter does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with the proposed amendments.

This supplemental letter contains no regulatory commitments.

In accordance with 10 CFR 50.91, "Notice for public comment; State consultation,"

paragraph (b), CEG is notifying the Commonwealth of Pennsylvania of this supplemental letter by transmitting a copy of this letter to the designated State Official.

If you have any questions regarding this submittal, then please contact Frank Mascitelli at Francis.Mascitelli@constellation.com.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 26th day of June 2023.

Respectfully, David P. Helker Sr. Manager - Licensing Constellation Energy Generation, LLC Attachments: 1. INL/RPT-23-710903, Revision 0, Limerick Safety-Related Instrumentation and Controls Upgrade, Human Factors Engineering Preliminary Validation Verification Report, dated March 2023 (proprietary)

2. INL/RPT-23-71903, Revision 1, Limerick Safety-Related Instrumentation

Supplemental HFE PV RSR Docket Nos. 50-352 and 50-353 June 26, 2023 Page 4 ATTACHMENT 1 TRANSMITTED HEREWITH MAY CONTAIN INFORMATION CONTROLLED BY THE DEPARTMENT OF ENERGY UNDER ITS REGULATIONS at 10 CFR PART 810.

ATTACHMENT 1 TRANSMITTED HEREWITH CONTAINS PROPRIETARY INFORMATION - WITHHOLD UNDER 10 CFR 2.390 and Controls Upgrade, Human Factors Engineering Preliminary Validation Report, dated April 27, 2023 (non-proprietary)

3. CEG Affidavit for INL/RPT-23-71903 Revision 0 cc: USNRC Region I, Regional Administrator w/ attachments USNRC Project Manager, LGS "

USNRC Senior Resident Inspector, LGS "

Director, Bureau of Radiation Protection - Pennsylvania Department of Environmental Protection w/o attachment 1

Attachment 1 License Amendment Request Supplement Limerick Generating Station, Units 1 and 2 Docket Nos. 50-352 and 50-353 INL/RPT-23-710903, Revision 0, Limerick Safety-Related Instrumentation and Controls Upgrade, Human Factors Engineering Preliminary Validation Verification Report, dated March 2023 (proprietary)

Attachment 2 License Amendment Request Supplement Limerick Generating Station, Units 1 and 2 Docket Nos. 50-352 and 50-353 INL/RPT-23-71903, Revision 1, Limerick Safety-Related Instrumentation and Controls Upgrade, Human Factors Engineering Preliminary Validation Report, dated April 27, 2023 (non-proprietary)

INL/RPT-23-71903 Limerick Safety-Related Instrumentation and Control Upgrade Human Factors Engineering Preliminary Validation Report April 2023 Paul J. Hunton Senior Research Scientist Casey R. Kovesdi Human Factors Scientist Jeffrey C. Joe Senior Human Factors Scientist Jeremy D. Mohon Human Factors Scientist This document redacts proprietary information as identified by Constellation. Redactions of Constellation proprietary information are presented in the text using brackets with a superscript (C). This document contains no Idaho National Laboratory proprietary information.

DISCLAIMER This information was prepared as an account of work sponsored by an agency of the U.S. Government. Neither the U.S. Government nor any agency thereof, nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness, of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. References herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the U.S. Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the U.S. Government or any agency thereof.

INL/RPT-23-71903 Limerick Safety-Related Instrumentation and Control Upgrade Human Factors Engineering Preliminary Validation Report Idaho National Laboratory Paul J. Hunton Senior Research Scientist Casey R. Kovesdi Human Factors Scientist Jeffrey C. Joe Senior Human Factors Scientist Jeremy D. Mohon Human Factors Scientist Constellation Energy Scott Schumacher Paul Krueger Brian Devine April 2023 Idaho National Laboratory Nuclear Science and Technology Idaho Falls, Idaho 83415 http://www.inl.gov Prepared for Constellation Energy Generation Under Cooperative Research and Development Agreement 21CRA5

REVISION LOG Rev. Date Affected Pages Revision Description 1 04/27/2023 All Proprietary information was removed. No further changes were made to the document and pagination was preserved.

CONTENTS 1 PURPOSE AND SCOPE .................................................................................................................... 1 2 INDEPENDENT TEAMS TO ENABLE HUMAN-SYSTEM INTERFACE DEVELOPMENT ............................................................................................................................... 3 2.1 Human-System Interface Design and Procedure Modification Team...................................... 3 2.1.1 Role ............................................................................................................................. 3 2.1.2 Team Members ........................................................................................................... 3 2.2 Human Factors Engineering Process Team ............................................................................. 3 2.2.1 Role ............................................................................................................................. 3 2.2.2 Team Members ........................................................................................................... 3 2.3 Human-System Interface and Procedure Validation Team ...................................................... 3 2.3.1 Role ............................................................................................................................. 3 2.3.2 Team Members ........................................................................................................... 4 2.4 Simulator Team ........................................................................................................................ 4 2.4.1 Role ............................................................................................................................. 4 2.4.2 Team Members ........................................................................................................... 4 3 INPUTS TO ENABLE PRELIMINARY VALIDATION .................................................................. 5 3.1 Human-System Interface Display Design ................................................................................ 5 3.1.1 Overall Process ........................................................................................................... 5 3.1.2 Human-System Interface Design for Preliminary Validation ..................................... 6 3.2 Modification of and Creation of Procedures ............................................................................ 7 3.3 Use of the Limerick Upgrade Project Limited Scope Simulator.............................................. 7 3.4 Refined Control Room Layout and Preliminary Validation .................................................... 7 3.5 Simulation Environment .......................................................................................................... 9 3.5.1 Limerick Upgrade Project Limited Scope Simulator .................................................. 9 3.5.2 The Human-Systems Simulation Laboratory .............................................................. 9 3.6 Other Considerations.............................................................................................................. 13 4 PRELIMINARY VALIDATION PERFORMANCE ....................................................................... 13 4.1 Objectives............................................................................................................................... 13 4.2 Overview of the Method to Perform Preliminary Validation ................................................ 14 4.3 Manual Actions Evaluated by Preliminary Validation .......................................................... 14 4.3.1 Task Analysis Workshop Scope as it Relates to Preliminary Validation.................. 14 4.3.2 Bounding of Conceptual Verification and Preliminary Validation Efforts............... 14 4.4 Inputs to Preliminary Validation ............................................................................................ 17 4.4.1 Scenario Identification and Simulator Exercise Guide Development ....................... 17 4.4.2 Operational Sequence Diagrams ............................................................................... 17 4.4.3 Timeline Analysis Method ........................................................................................ 18 4.4.4 Acceptance Criteria for Conceptual Verification and Preliminary Validation ......... 21 iii

4.5 Protocol to Ensure Readiness for Preliminary Validation ..................................................... 21 4.5.1 Review and Confirm Impacted Manual Operator Actions to be Evaluated .............. 22 4.5.2 Review and Confirm Scenarios................................................................................. 22 4.5.3 Confirm Completeness of Type and Number of Plant Protection System and Ovation Displays ....................................................................................................... 22 4.5.4 Confirm Completeness of Procedure Changes ......................................................... 22 4.5.5 Establish Time Available for Manual Actions identified in Section 4.3.2 as Applicable ................................................................................................................. 22 4.5.6 Identify and Document the Task Sequences for Manual Actions Identified in Section 4.3.2.............................................................................................................. 22 4.5.7 Perform Dry Run....................................................................................................... 22 4.5.8 Prepare HSI and Procedure Validation Team Surveys (new section) ....................... 23 5 PRELIMINARY VALIDATION EXECUTION AND RESULTS .................................................. 26 5.1 Execution of Scenarios........................................................................................................... 26 5.2 General PV Results Against Review Criteria ........................................................................ 27 5.3 Preliminary Validation Summary of Results ......................................................................... 28 5.3.1 Credited Manual Actions in the Limerick Generating Station Licensing Basis .......................................................................................................................... 28 5.3.2 Additional Manual Operator Actions Evaluated ....................................................... 30 5.3.3 Operations Feedback ................................................................................................. 32 5.4 General Human-System Interface Style Guide Comments .................................................... 47 5.5 Human-System Interface and Procedure Items Identified During Preliminary Validation and Item Tracking ................................................................................................ 47 6 REFERENCES.................................................................................................................................. 49 Appendix A Key HSI Style Guide Attributes for Preliminary Validation HSI Development ................... 51 Appendix B Human-System Interface Displays Developed for Preliminary Validation........................... 53 Appendix C Simulator Exercise Guides .................................................................................................. 155 Appendix D Scenario Operational Sequence Diagrams and Results for Preliminary Validation Manual Actions ............................................................................................................................... 321 Appendix E Comments to Displays and Procedures Developed for Conceptual Verification and Preliminary Validation .................................................................................................................... 341 Appendix F Navigation Click Structure for PPS and DCS ...................................................................... 359 iv

FIGURES Figure 1. HFE phases covered in NUREG-0711, HFE Program Review Model, Revision 3 [4]................. 2 Figure 2. Required information for display development. ............................................................................ 5 Figure 3. Flow diagram for developing new HSI displays (and procedure modifications). ......................... 5 Figure 4. Current MCR layout used as an input for PV. ............................................................................... 8 Figure 5. NUREG-0700 based viewing angles and functional reach for CRS and RO MCR work locations. ....................................................................................................................................... 8 Figure 6. Simulation environment for CV compared to the current MCR layout. ..................................... 10 Figure 7. NUREG-1852 timeline guidance for evaluating manual operator actions. ................................. 18 Figure 8. Rasmussen decision ladder model as applied to Type 1 and Type 2 manual actions under study. ................................................................................................................................ 20 Figure 9. NRC timeline template used for evaluating manual operator actions. ........................................ 21 Figure 10. NASA-TLX standardized survey instrument. ........................................................................... 24 Figure 11. SART standardized survey instrument. ..................................................................................... 25 Figure 12. B-NUM standardized survey instrument. .................................................................................. 26 Figure 13. Contributors to observed difficulties, perceived workload, and perceived situation awareness. ................................................................................................................................... 32 Figure 14. Summary averages from NASA-TLX, SEQ, and SART........................................................... 33 Figure 15. NASA-TLX, SEQ, and SART results for Scenario #1. ............................................................. 33 Figure 16. NASA-TLX, SEQ, and SART results for Scenario #2. ............................................................. 35 Figure 17. NASA-TLX, SEQ, and SART results for Scenario #3. ............................................................. 37 Figure 18. NASA-TLX, SEQ, and SART results for Scenario #4. ............................................................. 38 Figure 19. NASA-TLX, SEQ, and SART results for Scenario #5. ............................................................. 40 Figure 20. NASA-TLX, SEQ, and SART results for Scenario #6. ............................................................. 42 Figure 21. NASA-TLX, SEQ, and SART results for Scenario #7. ............................................................. 43 Figure 22. NASA-TLX, SEQ, and SART results for Scenario #8. ............................................................. 45 Figure 23. NASA-TLX, SEQ, and SART results for Scenario #9. ............................................................. 46 TABLES Table 1. Manual operator actions credited in the LGS Licensing Basis impacted by the modification. ............................................................................................................................... 14 Table 2. Additional manual operator actions impacted the modification that were evaluated. .................. 16 Table 3. PV observed times for manual operator actions credited in the LGS Licensing Basis impacted by the modification. .................................................................................................... 29 Table 4. PV observed times for additional manual operator actions impacted the modification that were evaluated. ........................................................................................................................... 30 Table 5. Human-system interface and procedure items identified during PV. ........................................... 47 v

Page intentionally left blank vi

ACRONYMS AND DEFINITIONS ADS Automatic Depressurization System ADDIE Analyze, Design, Develop, Implement, and Evaluate AER Auxiliary Equipment Room AOA Automated Operator Aid ATWS Anticipated Transient Without Scram B-NUM Brief Nuclear Usability Measure BWR Boiling Water Reactor CCF Common-Cause Failure CEG Constellation Energy Generation CMA Credited Manual Action CRS Control Room Supervisor (also called a Senior Reactor Operator in industry)

CV Conceptual Verification D3 Defense in Depth and Diversity DBA Design-Basis Accident DCS Distributed Control System (non-safety) which is implemented using the Emerson Ovation platform Design Team HSI Design and Procedure Modification Team DPS Diverse Protection System ECCS Emergency Core Cooling System EOP Emergency Operating Procedure HFE Human Factors Engineering HPCI High Pressure Coolant Injection HSI Human-System Interface HSSL Human Systems Simulation Laboratory HUD Heads-Up Display I&C Instrumentation and Control INL Idaho National Laboratory ISV Integrated System Validation LGS Limerick Generating Station Units 1 and 2 LOCA Loss of Coolant Accident LOOP Loss of Off-site Power LSS Limited Scope Simulator MCR Main Control Room NASA-TLX National Aeronautics and Space Administration - Task Load Index NRC Nuclear Regulatory Commission (United States)

NSSSS Nuclear Steam Supply Shutoff System OSD Operational Sequence Diagram PAMS Post-Accident Monitoring System vii

PPS Plant Protection System (safety-related which is implemented using the Westinghouse Common Qualified [Common Q] platform)

PRA Probabilistic Risk Assessment PRO Plant Reactor Operator PV Preliminary Validation PWR Pressurized Water Reactor RCIC Reactor Core Isolation Cooling RHR Residual Heat Removal RO Reactor Operator RPS Reactor Protection System RPV Reactor Pressure Vessel SA Situation Awareness SART Situation Awareness Rating Technique SAT Systematic Approach to Training SBO Station Blackout SEG Simulator Exercise Guide SEQ Single Ease Question SR Safety-Related SLC Standby Liquid Control SRO Senior Reactor Operator (identified as the CRS in this report)

SRV Safety Relief Valve STA Shift Technical Advisor TA Task Analysis TCA Time-Critical Action Time Available The total time identified for operators to complete an identified action in:

Licensing commitments as listed in Table 1 of this document

Other documents (which are not licensing commitments)

Time to Perform The time necessary to perform the specific manual action once it is determined by operators that the action needs to be performed TSA Time Sensitive Action UFSAR Updated Final Safety Analysis Report V&V Verification and Validation Validation Team HSI and Procedure Validation Team VDU Video Display Unit (a hardware device to present software displays) viii

Limerick Safety-Related Instrumentation and Control Upgrade Human-System Interface Preliminary Validation Report 1 PURPOSE AND SCOPE This document is a results summary report for the human factors engineering (HFE) preliminary validation (PV) performed for the Limerick Generating Station (LGS) Safety-Related (SR)

Instrumentation and Control (I&C) Upgrade Project at the Idaho National Laboratory (INL) Human-Systems Simulation Laboratory (HSSL). This occurred during the week of February 20, 2023. The purpose of the PV workshop was to provide high confidence that the time required for credited manual operator actions impacted by this upgrade satisfy the success criteria for integrated systems validation (ISV) using human-system interfaces (HSIs) developed for the Project, along with associated procedure changes. Preliminary Validation (PV) was performed in accordance with:

INL/RPT-22-68693, Human Factors Engineering Program Plan for Constellation Safety-Related Instrumentation and Control Upgrades [2], Section 6.12.1, Human-System Interface Design.

INL/RPT-22-68995, Human Factors Engineering Combined Functional Requirements Analysis, Function Allocation, and Task Analysis for the Limerick Control Room Upgrade: Results Summary Report, [4] Section 7.1, Static Workshop - Conceptual Verification.

INL/RPT-23-71063, Limerick Safety-Related Instrumentation and Control Upgrade Human Factors Engineering Conceptual Verification Report [3].

NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, [1] Attachment A, Guidance for Evaluating Credited Manual Operator Actions of Revision 3 of Chapter 18, was also leveraged to support PV.

PV was performed as part of the HSI Design Phase as well as part of the Verification and Validation Phase of the Human Factors Engineering (HFE) Program as highlighted in Figure 1.

As with Conceptual Verification (CV), the scope of the evaluation for PV goes beyond the direct purpose stated in the first paragraph of this section. The scope of PV also included a more comprehensive evaluation of human actions beyond those credited manual actions impacted by the upgrade as captured in the LGS licensing basis. As described in Section 4.3.2.2 of the CV report (as repeated in Section 4.3.2.2 of this report), additional manual actions of interest impacted by the upgrade were also studied.

Furthermore, the scenarios created to evaluate all of the manual actions studied in CV and PV were not written simply to evaluate the specific manual actions under evaluation in isolation. Such a formulation would be contrived and not necessarily representative of how operators are trained and evaluated. Efforts were made to make the scenarios described in the simulator exercise guides (SEGs) more challenging.

This was done to better represent situations that operators are presented with during training and evaluation simulator drills where multiple, unlikely, and potentially challenging failures occur. The intent of this effort was to evaluate the operators ability to perform the manual actions under study in circumstances with increased scenario complexity to frame the specific manual action under evaluation in that context. This was done as good engineering practice. It is not intended that the study of additional manual actions identified outside the licensing basis or the use of these more challenging scenarios alter the licensing basis for LGS in any way.

The methods and techniques used to perform PV are very similar to those used for Conceptual Verification (CV) as documented in the CV report [3]. This document highly leverages and is deliberately structured to mirror the CV report. This document endeavors to minimize duplication of 1

information contained in the CV report. It is recommended that a reviewer of this PV report be familiar with the CV report to facilitate cross referencing.

Figure 1. HFE phases covered in NUREG-0711, HFE Program Review Model, Revision 3 [4].

The prototype displays and navigation strategy created for the CV as captured in Appendix B and Appendix F of the CV report [3], along with comments to HSI displays and procedures developed for CV as captured in Appendix E of Reference 3 were used as the basis to iterate the development of both for Preliminary Validation (PV). CV display and procedure refinement efforts for PV were prioritized to address comments that were viewed as having the most impact on crew performance when performing PV. The HSI Design and Procedure Modification Team (Section 2.1) continued to utilize INL/RPT 68558, Human-System Interface Style Guide for Limerick Generating Station [6], to develop these more refined displays.

PV occurred during a dynamic HSI workshop held at the INL during the week of February 20, 2023.

The HSI and Procedure Validation Team (Section 2.3) performed scenarios were performed using updated HSI displays that were dynamically linked to the simulator computer models used to drive the Limerick training simulator. The HSI displays and simulator models were loaded into the HSSL to facilitate PV performance. The PV workshop allowed operators to navigate through and dynamically operate the updated HSIs, using modified and new procedures, in the context of a near full scope main control room (MCR) for one LGS unit. The HSSL was arranged to provide (as much as practicable) the proper relative arrangement of new and existing HSIs so that the MCR modifications provided by this upgrade could be evaluated in the proper operational context to include integration of primary and secondary event diagnosis indications and alarms.

HSI physical layouts, display attributes, the HSI design navigation strategy, as well as dynamic operator interactions with physical interfaces (VDUs) and displays presented on them were evaluated along with updated procedures. This was done using a series of scenarios focused on important human actions identified as requiring credited manual actions (CMA). Credited manual operator actions in the LGS Licensing Basis as impacted by the LGS SR I&C Upgrade Project were identified by Constellation Energy Generation (CEG) personnel. CEG personnel also identified additional manual operator actions to be evaluated for a more comprehensive evaluation of impacts of the LGS SR I&C Upgrade Project. These additional items are not being added to the LGS Licensing Basis by their inclusion in PV.

2

PV workshop outputs include:

PV timing results, as captured in Appendix D. These are presented with the associated operational sequence diagrams (OSD)s that were used for CV. For PV, a more detailed and formalized set of timelines are also captured in Appendix D.

PV timing results, as summarized in Section 5.3. This summary captures the estimated time to perform and time to implement for CMA and additional manual actions being evaluated using the HSIs with related procedure changes developed for this upgrade. This output satisfies the PV review criteria described in Section 5.2. It also provides high confidence that a dynamic execution of the same scenarios and OSDs in ISV will produce timing results that meet the specific acceptance criteria as presented in Section 4.4.4.

The identification of issues associated with the HSI design or procedures during PV, including those that may challenge the ability of operators to perform the actions correctly and reliably within the time available. These issues are provided in Appendix E. These have been added to the configuration-controlled version of the file used by CEG for this purpose which was created as describe in Section 5.5 of the CV report [3].

These outputs further extend the results of the Task Analysis (TA) as captured in [5] and CV [3] into the HSI design and Task Support Verification. PV results as captured in this report provide CEG with high confidence that the times observed for credited manual operator actions have satisfied the success criteria for ISV.

2 INDEPENDENT TEAMS TO ENABLE HUMAN-SYSTEM INTERFACE DEVELOPMENT 2.1 Human-System Interface Design and Procedure Modification Team 2.1.1 Role The role of the HSI Design and Procedure Modification Team (identified as the Design Team in the rest of this document) is unchanged and defined in Section 2.1.1 of the CV report [3].

2.1.2 Team Members Design Team Members and their qualifications are unchanged and listed in Section 2.1.2 of the CV report [3].

2.2 Human Factors Engineering Process Team 2.2.1 Role The role of the HFE Process Team is unchanged and defined in Section 2.2.1 of the CV report [3].

2.2.2 Team Members HFE Process Team Members and their qualifications are unchanged and listed in Section 2.2.2 of the CV report [3].

2.3 Human-System Interface and Procedure Validation Team 2.3.1 Role The role of the HSI and Procedure Validation Team (identified as the Validation Team in the rest of this document) is unchanged and defined in Section 2.3.1 of the CV report [3].

3

2.3.2 Team Members In addition to those listed in Section 2.3.2 of the CV report [3] the following additional personnel from the LGS Operations Department participated in PV:

Jeff Weaver, Senior Reactor Operator and Shift Manager

- US Navy Naval Nuclear Power Training and Nuclear Plant Operator 04/93 - 04/99

- Equipment Operator, Limerick Generating Station, 04/99 - 10/06

- Licensed Reactor Operator, Limerick Generating Station, 10/06 - 11/10

- Licensed Senior Reactor Operator, 11/10 - present

- Operations Shift Manager, 09/16 - present

- Other qualifications and positions o Training instructor, Limerick Generating Station, 01/03 - 06/05 o Operations Clearance and Tagging Supervisor and Outage Specialist, 05/12 - 05/15 o Operations Services Manager, 05/20 - 01/23

Brian DevineSenior Manager, Digital Modernization Project

- Williamson Free School of Mechanical Trades, A.A.S. Power Plant Technology

- Operations Maintenance Technician, Power Generation Group 1997- 1999

- Limerick Generating Station o Nuclear Equipment Operator, Operations Department 1999- 2005 o Nuclear Reactor Operator, Limerick Generating Station- 2005 - 2008 o Limerick Nuclear Senior Reactor Operator License - Limerick Generating Station - 2008 -

2021 Shift Supervisor Fix it Now Senior Reactor Operator Shift Manager Manager Operations Services Manager Electrical Maintenance o Shift Operations Superintendent (Senior Operating License) - 2018 -2021 o Senior Manager of Maintenance Execution - 2021 -2023 Jeff Weaver performed Shift Manager and Shift Technical Advisor (STA) roles for PV in place of Kris Strausser, who fulfilled this role for CV.

2.4 Simulator Team 2.4.1 Role The role of the Simulator Team is unchanged and defined in Section 2.4.1 of the CV report [3].

2.4.2 Team Members Simulator Team Members and their qualifications are unchanged and listed in Section 2.1.2 of the CV report [3].

4

3 INPUTS TO ENABLE PRELIMINARY VALIDATION 3.1 Human-System Interface Display Design 3.1.1 Overall Process Members of the Design Team are uniquely familiar with how the relationship between operator and system inputs, I&C system program logic, and operator and system outputs, as shown in Figure 2, are impacted by the LGS SR I&C Upgrade Project.

Figure 2. Required information for display development.

The process for HSI display design for the LGS SR I&C Upgrade Project is shown in Figure 3.

Figure 3. Flow diagram for developing new HSI displays (and procedure modifications).

5

A detailed explanation of each step shown in Figure 3 is provided in Section 3.1.1 of the CV report

[3]. PV was the Pass 2 iteration shown in the blue shaded area of Figure 3.

3.1.2 Human-System Interface Design for Preliminary Validation 3.1.2.1 Development of Graphics Displays Plant Protection System (PPS) and Distributed Control System (DCS) HSI graphics displays were developed for CV as presented in Section 3.1.2.1 of the CV report [3]. When preparing this PV report, it was noted that several of the displays used for CV were inadvertently omitted from Appendix B the CV report. These have been added to and identified in Appendix B of this report to correct this omission.

For PV, these HSIs were further refined and functionally enabled. These activities included:

Select HSI items identified during CV that were determined to have an operational impact on operator performance were prioritized and dispositioned. This included both specific and generic overall modifications to displays based on the items identified throughout the development process. This was accomplished by Constellation identifying the necessary display changes to CORYS and CORYS then implementing the displays for use during PV.

New displays were created for PV for both PPS and DCS. For PPS, the new screens were additional trends, minor systems, tagout demonstration screens, and screens required to evaluate scram status and perform emergency operating procedures. These screens were generated to eliminate dead end clicks and expound on concepts presented and evaluated at CV. For DCS, the remaining mechanical system mimics and Automated Operator Aids not expected to be used in PV were developed. This eliminated dead end clicks on the interface. This provided the Verification Team additional monitoring capabilities for parameters and component status if desired.

HSIs created for the Project for use during PV were made sufficiently dynamic to enable their use during PV to enable accomplishment of PV objectives. The necessary dynamic capabilities were identified by CEG and implemented by CORYS.

The dynamic displays provided as discussed above were evaluated at LGS through the use of the Limerick Upgrade Project Limited Scope Simulator (LSS) as described in Section 3.5.1.

HSI graphics displays developed and used for PV are captured in Appendix B. The dynamic displays created for PV, within the envelope of the HSSL environment as described in Section 3.5.2 demonstrated the ability of the upgrade to support the performance of the manual actions evaluated as described in Section 4.3.2 and to promote the overall situational awareness of the systems impacted by the upgrade.

Attributes of these displays as modified through dispositioning of remaining CV items as well as new PV identified items will be incorporated into the displays implemented by Westinghouse and used for ISV.

They will also be incorporated into the remainder of the PPS and DCS displays as applicable when they are developed. Similar task verification as described in Section 3.5.1 will be performed on these displays and evaluated during ISV and Design Verification.

3.1.2.2 Graphics Display Navigation and Operation Strategy.

The navigation and operations strategy for both PPS and DCS as described in Section 3.1.2.2. of the CV report [3] are largely unchanged for PV. Based upon input obtained during the CV workshop, the following modification is made to one particular item provided in this section when compared to the CV report [3] as highlighted below.

1. It takes no more than two actions (pointing device clicks on display icons or touchscreen interactions with the same display icons) to navigate to a system, function-specific, or diagnostic 6

display. For PPS instrument and logic displays (which are not used when performing procedural actions for plant operation) it may take more than two actions to reach these displays.

3.2 Modification of and Creation of Procedures In order to support the use of the new PPS and DCS HSIs and control features provided by the LGS SR I&C upgrade, impacted procedures also required revision. Several new procedures also needed to be created. The LGS Design Team has the responsibility to identify the procedures that need to be revised/created in accordance with the LGS procedures program. This generally follows a similar iterative process as that described in Section 3.1.1 for HSIs.

For CV, draft procedure revisions were produced along with necessary new procedures to enable the performance of the scenarios provided in Appendix D of the CV report. During CV, issues associated with the draft procedures (revised and new) were identified and captured in the same configuration-controlled repository for HSI comments as described in Section 5.5 and recorded in Appendix E.

Procedure items identified from CV as potentially impacting the PV were prioritized and dispositioned prior to PV. These dispositions are captured in Appendix E as updated for this report.

3.3 Use of the Limerick Upgrade Project Limited Scope Simulator HSIs and procedures used for PV were validated at LGS using the simulator tool described in Section 3.5.1 prior to PV. This represented a task support verification activity for those HSIs and procedures to ensure both supported accomplishment of the manual actions evaluated during PV as captured in Section 4.3.2.

While this activity was primarily intended for the specific purpose identified above, the scope of procedures involved in performing the scenarios for PV was broader as described in Section 4.4.1. All the actions performed by operators to successfully perform all the activities required to address the full scope of each SEG are governed by procedures. Because of this, the set of procedures used to perform each SEG was identified and updated to reflect operations with the upgraded systems. These procedures were also validated at LGS using the simulator tool described in Section 3.5.1 prior to PV.

Procedure issues identified during PV were captured in Section 5.5 and will be dispositioned prior to ISV as described in Section 5.5.

Procedures impacted by the installation of PPS and DCS but not exercised by CV and PV will be revised in accordance with the LGS procedures program.

3.4 Refined Control Room Layout and Preliminary Validation Refinement of the MCR layout through CV is described in CV report [3], Section 3.3. The MCR layout used as a baseline for Preliminary Validation is shown in Figure 4.

7

Relocated HSIs RO PPS/DCS Interface Figure 4. Current MCR layout used as an input for PV.

Minor modifications to the arrangement were made based upon constructability issues in some cases conflicting with NUREG-0700 [10] such as for the example noted below.

The arrangement in Figure 4 was developed by INL in collaboration with CEG. As with earlier INL-developed MCR arrangement versions, Figure 4 conforms to the HSI design interface guidelines provided by NUREG-0700 [10] as much as practicable based on the current LGS MCR layout. Considerations, such as reach, sight angles, and distance readability for the 5th percentile female and the 95th percentile male (shown in Figure 5), were taken into account when placing new touchscreen VDUs and associated peripheral interfaces as well when relocating indications and controls that were moved to accommodate these new devices. Standardization of the relative location of PPS and DCS displays and physical interfaces for the reactor operator (RO) and plant reactor operator (PRO) workstations was supported as much as possible. Example snapshots from the current MCR layout showing viewing angles and functional reach for the control room supervisor (CRS) and RO work locations in the MCR are shown in Figure 5.

Figure 5. NUREG-0700 based viewing angles and functional reach for CRS and RO MCR work locations.

8

3.5 Simulation Environment Two simulation environments were created to evaluate HSIs in the workup to and the execution of PV. Each is discussed in the subsections below 3.5.1 Limerick Upgrade Project Limited Scope Simulator In order to continue HSI development and accomplish associated procedure modifications, the HSI Development and Procedure Modification Team worked with the Simulator Team to assemble the Limerick Upgrade Project LSS. This device was assembled in the LGS training facility. It is composed of a master/slave simulator tower, two commercial wall monitor VDUs, four commercial touch screen VDUs used to provide a simulated PPS interface, and a fifth commercial touch screen used to provide a simulated DCS interface. The VDUs are arranged with correct relative position and spacing from the Reactor Operator at the controls location. The LSS was used as a testbed for HSI updates and patches to validate and test functionality. As a HSI testbed, when issues identified during HSI development they were routed in the standard bug reporting system (Mantis).

As a procedure development platform, the LSS was used first to resolve procedure changes identified during CV, and then iteratively as procedure creation progressed. The author and HSI designer would review intent and methods of performing procedures, sometimes with procedure driving HSI design, and sometimes with HSI driving procedure design, whichever solved the problem most intuitively from the operator point of view. Procedures were tested by the Design Team within the simulated environment, then passed on to the Validation Team for review, comment, and execution, with the operating environment and navigation made available. Questions and comments were resolved in real time and retested.

The process of HSI and procedure refinement described above using the LSS represents an iteration of task support verification as is specifically discussed in Section 7.2 of the Combined HFE Workshop report [5].

3.5.2 The Human-Systems Simulation Laboratory 3.5.2.1 Overview To best support the goals and to meet the review criteria for PV as captured in Section 5.1, a near full scope, single unit MCR simulator was used. This simulator was assembled leveraging the INL Human-Systems Simulation Laboratory (HSSL) located in Idaho Falls, Idaho. This hybrid simulator environment was used to observe Validation Team operator performance when performing challenging scenarios involving the manual operator actions evaluated as described in Section 4.3.2. As part of this effort, the time to implement and the total time to perform" these manual actions were measured.

In preparation for PV, HSIs and plant operating procedures used for CV were revised to address CV comments. These revised HSIs and procedures were exercised as task support verification activities using updated HSIs connected to a dynamic model located at LGS as described in Section 3.5.1. Deficiencies in the HSIs and procedures that could impact PV performance were rectified.

In parallel with the activities described in the paragraph above, the HSSL facility was prepared to support PV. This involved obtaining and arranging sufficient VDUs and configuring the computer network to accept the software provided by Constellation that is used to drive the operations training simulator at LGS. HSIs were loaded into the HSSL computer network and their functionally verified.

This included both the new HSIs created for the upgrade and digital representation of legacy HSIs that remain. The resultant modified procedures were also printed and made available in the HSSL for PV.

As with CV, relative locations of the new HSIs with adjacent remaining legacy HSIs in the MCR were established. The size of the HSSL also permitted the presentation of much more of the MCR for PV than was available for CV. The relative PPS and DCS VDU locations in the room used for PV and the 9

latest MCR control room arrangement are provided in Figure 6. In addition to the panels shown, the fire alarm panel and a large portion of the electrical distribution system were dynamically represented in the HSSL. This was particularly important for scenarios which included activities that impacted electrical realignments and/or malfunctions.

Both the PPS and DCS platforms to be deployed in the plant and in the simulation environment are designed to accommodate the speed to which operators are able to provide inputs to the system. The PPS and DCS by design have specific design requirements that govern properties such as data input capacities and scan time, network latency, determinism, and HSI update times. The increased speed of operator actions due to the benefits achieved from the modifications will not adversely impact control system performance of these in-plant systems. This concern has been reviewed and no new safety concerns due to the increased speed of operator actions have been identified. The Operators will continue to ensure proper Human performance fundamentals are used to ensure proper plant operations and configuration.

Plant MCR simulators are designed to provide a high-fidelity facsimile of actual plant performance as described above. The necessary capabilities for a MCR simulator are provided in ANSI 3.5, Nuclear Power Plant Simulators For Use In Operator Training And Examination, [17]. While the HSSL is not certified in accordance with reference 17, it leverages the models used in the LGS simulator. Details with regard to the capabilities and discussion of the detailed use of the HSSL are presented in Section 3.5.2.2.

Key:

1 - Upgraded Ovation DCS Annunciator Panels 2 - New Ovation DCS Group View Display VDUs (also referred to as HUDs) 3 - RO 5-Pack, including four divisionalized Common Q PPS VDUs and one Ovation DCS VDU 4 - PRO 5-Pack 5 - Existing benchboard indications and controls in close proximity to new HSIs Figure 6. Simulation environment for CV compared to the current MCR layout.

10

3.5.2.2 Capabilities of the HSSL Near-Full Simulator Used for Preliminary Validation The following is a list of general HSSL simulator capabilities for PV. This list is not intended to describe every differing detail from the actual plant or plant reference simulator, rather the differences that are relevant when comparing the HSSL used for PV to the reference plant simulator are described.

Logic and model o Same thermohydraulic model as used in the LGS reference unit simulator.

o The PV simulation load (DMP_PV-2023) is based off the reference simulators load 2022-01. DPV_PV-2023 was tested according to the LGS standard to test a simulator load for release to training. This included:

Steady-state stability testing Transient performance tests baselined to the 2022-01 load, performed on the DMP_PV_2023 in standalone (as utilized for the Limerick Upgrade Project Limited Scope Simulator (Section 3.5.1)) and in the HSSL Simulation real-time testing performed in standalone and in the HSSL Testing of each new intervention added to the DMP_PV-2023 load to support PV scenarios Component and parameter functional testing.

o The reference simulator retained 1 out of 2 taken twice actuation logic currently employed at LGS as opposed to 2 out of 4 initiation logic for system level actuations provided by the upgrade. This had no impact on PV because low level instrument diagnostic scenarios were not performed.

The reference simulator used does not have prioritization modules modeled. In other words, the simulator was only able to take component commands from the modeled safety-related system, and not the non-safety system. The effect of this simulator limitation was to require operators to inform simulator drivers what actions they were taking on the non-safety platform, and the simulator driver would perform the actions instead. This method of performing these control actions by its nature always introduces a conservative, negative time bias in execution of these control actions. The impact of this is to provide a conservative result when measuring both time to perform and time to implement for manual actions under study as identified in Section 4.3.2.

o For a finite set of recurring manual override actions, successful implementation of the override on the non-safety platform was visually indicated however it created no changes in logic.

o Manual override actions on the safety platform that were unlikely to be chosen but were part of a possible success strategy were not simulated. None of these unlikely actions were attempted by the Validation Team operators during PV.

o Non-safety automation features were not functional. For PV, operators would navigate to the control to initiate advanced operator aid (AOA) features and think aloud as it was activated on their HSI. Simulator Team personnel then manipulated the plant model to present the operators with the appearance of the automation feature performing its function as being implemented in the I&C design.

o Similarly, non-safety platform individual component control was not available to operators. Providing this function would have allowed overrides of components under a safety command due to the existing logic limitations, which would have been confusing and of negative value. Non-safety component control was affected by the operators navigating to the proper HSI display, accessing the proper control feature, and then communicating its actuation by thinking aloud as it was accomplished on their HSI.

11

Simulator Team personnel then accomplished the commanded actuation, which was then observed by the Validation Team.

Annunciator limitations o The HSSL was not able to receive an alarm acknowledge command from any operator screen. Palm actuated pushbuttons with battery powered audio and visual cues were provided to operators in correct locations relative to associated displays. When depressed, simulator drivers were briefed to acknowledge (silence) annunciators without the need for operators to repeatedly request the action from the simulator drivers.

o Not all annunciators and balance of plant equipment were simulated in the HSSL due to limitation on number of VDUs, however all primary and secondary alarms and equipment used to diagnose relevant events were presented. In some instances, this caused annunciators to come in that the operators could not locate visually. Simulator drivers called out these alarms as not the operators alarm and acknowledged them as required. Further, some scenarios would cause a long cascade of alarm events that were no longer meaningful or providing value to the operators for decision making or plant stabilization. When this situation occurred, the simulator driver performed a crew update that all alarms were silenced and remained so until the end of the scenario.

o Annunciator audible localization was not possible in the HSSL. In the plant reference simulator, the audio cue comes from a spot logical to the lit annunciator. In the HSSL, running several dozen instances of simulator graphics caused alarms to sound like they were coming from all panels simultaneously. This had the conservative effect of marginally slowing down operator diagnosis of each event.

Hardware controls o Legacy analog controls outside the modification boundary were presented on glass top displays. Operators were not evaluated on their ability to operate these simulated controls, instead operators would stand at any equipment they wanted to operate, announce their intended action and wait for simulator divers to perform the actions, which were then observed by the operators on the provided HSIs. This had the effect of integrating slight delays in operator responses in order to eliminate the risk of impacting the software screen performance when attempting to manipulate a digitized control device. This method of performing these control actions by its nature always introduces a conservative, negative time bias in execution of these control actions. The impact of this is to provide a conservative result when measuring both time to perform and time to implement for manual actions under study as identified in Section 4.3.2 .

o System level actuations in the upgraded system require a manual hardware confirmatory switch as the second action to execute. This function was represented by visual diagrams of where the buttons will be installed relative to their safety visual display unit.

When a system level actuation was needed, the simulator driver was notified by the operator (thinking aloud while actuating) to perform the action on the operators behalf. This limitation existed because these buttons, while similar to manual buttons already in place on a train-by-train basis, could not be made functional in the HSSL for PV. This had the result of producing the same conservative, negative time bias as described above for implementing legacy analog manual control actions.

o Scale and spacing of panels was as close as could be achieved within the HSSL. For indications that were vital to be legible despite scaling limitations, a zoomed in view was provided in a logical space on an otherwise unused HSSL VDU.

12

Indications o The existing reference simulator does not currently provide a one-for-one representation of information that could be found outside the control room, that is being brought into the control room as part of this modification. As such, for live displays where accurate information did not exist yet, XXX was displayed in the HSSL. This option was chosen to avoid potentially misleading information on an otherwise accurate screen. This will be addressed for ISV.

Plant Process Computer o Operators and supervisors were provided two plant process computer (PPC) workstations in total. This provided accurate and updated information from the plant simulation, but at a reduced number of locations. Specifically:

Three PPC workstations at the RO controls were not provided Several PPC monitors mounted in various locations throughout the existing control room were not provided.

o Consistent with the existing plant design, PPC information is helpful, but not required to stabilize or operate the plant. This deviation was acceptable because the net effect was to force more PPC navigation if operators chose to obtain plant information from the system.

o PPC audio alarms were not available. This function is an operator aid only.

These differences were evaluated and accepted due to the limited, conservative impact of overall performance of the manual actions under study for PV as captured in Section 4.3.2 and had minimal to no overall impact on the operators ability to diagnose and respond to the events simulated in the workshop.

3.6 Other Considerations The PV report adds no additional other considerations other than those provided in Section 3.5 of the CV report [3].

4 PRELIMINARY VALIDATION PERFORMANCE 4.1 Objectives As adapted from Reference 1, the objectives of the PV workshop were to demonstrate for CMA in the Licensing Basis impacted by the upgrade as identified in Section 4.3.2.1 that:

The total observed time to perform the required manual actions is less than the specific time available captured in the Licensing Basis.

That operators can implement the specific actions correctly within the established time to implement them as captured in the Licensing Basis.

Additionally, a more comprehensive set of acceptance criteria were established by Constellation as captured in Section 4.4.4. These were applied not only to the CMA in the Licensing Basis impacted by the upgrade, but also to additional manual operator actions that are identified in Section 4.3.2.2. This additional scope and more comprehensive acceptance criteria were established as good engineering practice.

Finally, as described in Section 4.4.1, SEGs were developed to envelope the manual actions under study from both Section 4.3.2.1 and Section 4.3.2.2 in a way that was consistent with how operators are trained and evaluated. Efforts were made to make the scenarios described in the SEGs more challenging.

This was done to better represent situations that operators are presented with during training and evaluation simulator drills where multiple, unlikely, and potentially challenging failures occur. This was done to more generally evaluate whether the HSIs created for and procedures modified by the upgrade supported these operational activities. This was also done as good engineering practice.

13

4.2 Overview of the Method to Perform Preliminary Validation The methodology to perform both CV and PV is captured in Section 4.2 of the CV report [3]. PV used revised HSIs and procedures as described in Section 3.1.2 and 3.2 above. PV leveraged a near full scope simulator for one LGS unit as described in Section 3.5.2.

4.3 Manual Actions Evaluated by Preliminary Validation The manual actions evaluated for PV were identical to those evaluated during CV. These are identified in Section 4.3.2 of the CV report [3].

4.3.1 Task Analysis Workshop Scope as it Relates to Preliminary Validation This section is not applicable to PV as explained in Section 4.3.2 of the CV Report [3]

4.3.2 Bounding of Conceptual Verification and Preliminary Validation Efforts The process to perform CV and PV generally leveraged the process outlined in Attachment A, Guideline for Evaluating Credited Manual Operator Actions of Reference [1]. CV leveraged the discussion in Section 1, Analysis, in Attachment A of Reference 1, while PV leveraged Section 2, Preliminary Validation.

The remainder of this section is repeated from the corresponding sections of the CV report [3] to facilitate ease of review for this report.

4.3.2.1 Credited Manual Actions in the LGS Licensing Basis Through the review of LGS licensing documents impacted by the scope of the SR I&C Upgrade Project at LGS by the Design Team (as assisted by LGS Licensing), manual operations actions credited in the LGS Licensing Basis (CMAs) were identified and are listed in Table 1.

Table 1. Manual operator actions credited in the LGS Licensing Basis impacted by the modification.

Action Credited Manual Licensing Source Addressed Time Time to

Operator Action by CV/PV Available Perform Scenario Acceptance Existing Number(s) Criteria Design CV1 Place both loops OP-LG-102-106, Operator 1 [ ](C) [ ](C)

Suppression Pool Response Time Program at LGS, Cooling in service time critical action (TCA) #64 following an UFSAR Chapter 15.1.4.2.1 inadvertent safety relief valve (SRV) opening to maintain suppression pool temperatures below TS limits CV2 Open S, H, M, E, K OP-LG-102-106, Operator 2 [ ](C) [ ](C)

SRVs using Response Time Program at LGS, Division 3 power TCA #16 from Auxiliary NE-294, Specification for Post-Equipment Room Fire Safe Shutdown Program (AER) (note new Requirements for LGS, Rev 5 task will be from 14

Action Credited Manual Licensing Source Addressed Time Time to

Operator Action by CV/PV Available Perform Scenario Acceptance Existing Number(s) Criteria Design MCR using Division 3 PPS or Ovation display)

CV3 Inject Standby UFSAR Chapter 15.6.5 3 [ ](C) [ ](C)

Liquid Control RAI Response for Limerick AST (SLC) following implementation-T04602 DBA LOCA for pH control CV4 Station blackout OP-LG-102-106, Operator 5 [ ](C) [ ](C) action - if HPCI Response Time Program at LGS, auto started then TCA #62 secure HPCI within UFSAR Chapter 15.12 10 minutes of SBO event (1) The procedure directs this action not be performed until [ ](C) after and before [ ](C) after the initiating event. Actual time to implement within this [ ](C) time window will be short.

The source documents that the Design Team reviewed to identify these impacted CMA include:

The LGS UFSAR [7], Chapter 15. The specific sections of the UFSAR from which individual items (CV1, CV3, and CV4) in Table 1 were identified are captured in the licensing source column of the table.

NE-294, Revision 5, Specification for Post-Fire Safe Shutdown Program Requirements for LGS, Rev 5 [11] from which CV2 in Table 1 was identified as captured in the licensing source column of the table.

Supporting documentation used to identify the time available and the time to perform for the existing plant prior to the modification for the credited manual tasks as listed in Table 1 include:

OP-LG-102-106, Operator Response Time Program at Limerick Generating Station [12]. Time-Critical Actions (TCAs) are those actions in the UFSAR LGS Licensing Basis that require CMA in specified time periods for specific casualties. Reference 12 provided this information for Items CV1, CV2, and CV 4 in Table 1. OSDs were created and evaluated for these for CV.

RAI Response for Limerick AST implementationT04602 [13]. This document established the Licensing Basis for CV3 during a design basis accident (DBA) loss of coolant accident (LOCA).

4.3.2.2 Additional Manual Operator Actions Being Evaluated In an effort to provide a more comprehensive coverage of impacts of the LGS SR I&C Upgrade Project on manual operator actions beyond the LGS Licensing Basis, the LGS Design Team expanded the review of Reference 12 to impacted items identified in that document as Time Sensitive Actions (TCAs).

As a result, CV5, CV6, and CV7 in Table 2 below were identified.

15

Table 2. Additional manual operator actions impacted the modification that were evaluated.

Action Additional Manual Source Addressed Time Time to

Operator Actions by CV/PV Available Perform Identified for Scenario Acceptance Existing Evaluation Number(s) Criteria Design CV5 Inhibit automatic OP-LG-102-106, Operator 2, 4, 7 [ ](C) [ ](C) depressurization Response Time Program at LGS, system (ADS) (non- Time Sensitive Action (TSA) #7 ATWS) Probabilistic risk assessment (PRA) - AHU600DXI CV6 Initiate Emergency OP-LG-102-106, Operator 2, 9 [ ](C) [ ](C)

Depressurization if Response Time Program at LGS, RPV level cannot be TSA #9 restored and PRA - AHUWS1DXI maintained above -

186" CV7 Inhibit ADS OP-LG-102-106, Operator 6 [ ](C) [ ](C)

(ATWS) Response Time Program at LGS, TSA #13 PRA - AHUINXDXI The values for time available and time to perform in Table 2 are taken from Reference 12. These manual actions are identified in Reference 12 as being sourced from the LGS PRA [8]. If these actions are not performed by operators within the time available and time to perform listed in Table 2, this can negatively impact margins captured in the PRA. CV5, CV6, and CV7 from Table 2 are not part of the LGS Licensing Basis and are not being added to the LGS Licensing Basis by this analysis. OSDs were also created and evaluated for these for CV and PV to provide a more comprehensive evaluation of human actions beyond those in the Licensing Basis as captured in Table 1.

In addition to the items identified in Table 2, the Design Team identified two additional operator interactions with the HSIs that would be prudent to evaluate. These address operator interactions for plant conditions outside of 100% power and address new failure modes assumed for the new system. Each is discussed in more detail below.

Operation of the Residual Heat Removal (RHR) system in the shutdown cooling mode was also identified as an additional manual action of interest as being impacted by the modification. This manual action is one of the few control functions impacted by the modification needed during shutdown operations. This action enables the removal of decay heat. A separate scenario with an associated SEG #8 were created to demonstrate that operators could effectively operate the RHR system in the shutdown cooling mode. There is no specific time available requirement to operate the RHR system in the shutdown cooling mode. Consequently, there was no OSD developed for this scenario. This scenario demonstrates that operators could operate the RHR system in the shutdown cooling mode with the new I&C systems and HSIs. Examination of the task to operate the RHR system in the shutdown cooling mode is not being added to the LGS Licensing Basis as part of this modification. The performance of this scenario as part of CV and PV does not modify the LGS Licensing Basis as part of this modification.

A separate scenario and associated SEG #9 were created to demonstrate that operators could effectively cope with a significant representative DBA (a steamline rupture inside the drywell) with a 16

simultaneous PPS failure that disables all Reactor Protection System (RPS), Nuclear Steam Supply Shutoff System (NSSSS), and Emergency Core Cooling System (ECCS) functions. This PPS failure results from a common mode failure of the Common Q platform due to an unknown cause. There is no time available requirement to recover from the beyond design basis event of a complete loss of the Common Q platform. This scenario is to show that operators can use the Diverse Protection System (DPS) segment of the non-safety DCS in a timely manner to perform the necessary action (CV6) to address a significant DBA and establish a safe shutdown condition. A complete loss of the Common Q platform is a beyond design basis event that is not being added to the LGS Licensing Basis as part of this modification.

4.4 Inputs to Preliminary Validation 4.4.1 Scenario Identification and Simulator Exercise Guide Development The nine scenarios used for PV are nearly identical to those used during CV as described in Section 4.4.1 of the CV report [3]. Minor modifications were made to address administrative errors identified during and after CV, adding and/or removing assessment items to improve the clarity of the SEGS, and revising of the script based on learnings from CV. These type of changes were made to support improved execution of the scenario from the Simulator Team point of view. These type of changes had no impact on the scope, technical content, or execution of the of the SEGS as viewed by the Validation Team operators.

The only functional difference in the SEGS between CV and PV occurs in SEG/scenario #9. The inadvertent Division 2 LOCA signal provided at the start of the scenario for CV was removed for PV.

This was removed because the simulated plant failure (a leak in an instrument line leading to the actuation of an excess flow check valve) only leads to a single vote whereas it would cause an inadvertent Division 2 LOCA signal. Because this failure would be insignificant in the new system design, this malfunction was removed. Also, to enhance the scenario for PV, frozen PPS displays were presented at the RO and PRO workstations to better simulate a loss of PPS functionality without pre-alerting the operators to loss of functionality simultaneously affecting all four divisions of the PPS.

SEGs were not written simply to evaluate the specific manual action under evaluation in isolation.

Such a formulation would be contrived and not necessarily representative of how operators are trained and evaluated. Efforts were made to make the scenarios described in the SEGs more challenging. This was done to better represent situations that operators are presented with during training and evaluation simulator drills where multiple, unlikely, and potentially challenging failures occur. The intent of this effort was to evaluate the operators ability to perform the manual actions under study in circumstances with increased scenario complexity to frame the specific manual action under evaluation in that context. It is not intended that these more challenging scenarios alter the Licensing Basis for LGS in any way.

Specific SEGs used for PV, are captured in Appendix C of this report.

4.4.2 Operational Sequence Diagrams The OSDs for each scenario as captured in Appendix D are identical to those captured in Appendix D of the CV report [3]. They are repeated in Appendix D of this report so they can be related to the timelines produced for PV scenario execution.

Observing scenario execution and recording times using the OSDs enabled the HFE Process Team to verify that manual actions under study were properly performed during PV. This enabled timeline analyses (Section 4.4.3) to ensure that those manual actions meet the necessary PV acceptance criteria (Section 4.4.4).

17

4.4.3 Timeline Analysis Method The timeline analysis for PV followed the same methodology as captured in Section 4.4.3 of the CV report [3]. This information is repeated here for completeness.

This analysis followed the Guidelines for Using Timelines to Demonstrate Sufficient Time to Perform the Actions, provided in Appendix A of NUREG-1852, Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire [14].

Figure 7. NUREG-1852 timeline guidance for evaluating manual operator actions.

NUREG-1852, Section 3.2.2, Analysis Showing Adequate Time Available to Ensure Reliability provides the following generic criterion to address the reliability of operator manual actions:

For a feasible action to be performed reliably, it should be shown that there is adequate time available to account for uncertainties not only in estimates of the time available, but also in estimates of how long it takes to diagnose and execute the operator manual actions It should be shown that there is extra time available to account for such uncertainties. This extra time is a surrogate for directly accounting for sources of uncertainty in estimating the time available for the action and the time required.

For the CV (and PV) analysis:

Time Available

- Time Available to perform manual actions is defined in Figure 7.

Time Available = TAvailable = Tdiagnosis + TImplementation + TMargin

- For CMA:

- TAvailable for CMA impacted by the upgrade in the Licensing Basis are identified in Table 1 along with the source for that commitment.

- Additional Manual Actions Demonstrating Being Evaluated:

- TAvailable for these manual actions impacted by the upgrade are identified in Table 2.

- Evaluation of these actions is being demonstrated by LGS as good engineering practice and does not establish any additional licensing commitments.

Time Required:

- The term time required as defined in NUREG -1852 as provided above is less than TAvailable.

For a manual action to be successfully accomplished, it must be shown that the action can be completed prior to TAvailable.

18

- The term time required as defined in the references provided in Table 1and Table 2 identifies the time to implement (TImplementation) for the existing design in NUREG-1852 as shown in Figure 7.

- For CV and PV:

- The term time required (TRequired) is not used in the balance of this report. This is done to eliminate confusion between the two definitions provided directly above.

- The term time to perform (TPerform) equals TDiagnosis + TImplementation. TPerform is what is compared to TAvailable in Section 4.3.2 to assess the overall successful performance of a credited manual action using the acceptance criteria provided in Section 4.4.4.

- The term time to implement (TImplementation) is used to measure the specific time to perform the specific manual actions identified in Section 4.3.2 once it is determined by operators that those actions must be performed. Acceptance criteria for observed time to implement are provided in Section 4.4.4.

Taking into account the discussion above, there are two types of manual actions under study by CV and PV:

- Type 1 Events: Events that present the operator with a direct indication (e.g., an inadvertent opening of a SRV, loss of off-site power)

- There is very little or no early/undetected period for these (before T0)

- Diagnosis Time = TDiagnosis= (T1 - T0 in Figure 7) is expected to be very short, on the order of a few seconds (Type 1 events are self-revealing with regard to cause and severity).

- Implementation Time = TImplementation = (T2 - T1 in Figure 7) is of primary interest for evaluation.

- For this type of event, implementation is explicit and linear. A specific procedure (or set of procedures) are identified to combat such events (with a short TAvailable).

- Tmargin is recognized to be short for Type 1 events in existing design as shown in Table 1.

- For Type 1 events, TPerform = TDiagnosis + TImplementation.

- Type 2 Events: Where event identification reveals itself over time.

- An event occurs prior to T0: (e.g., a drywell leak of unknown size). There may be an early undetected period before T0 is reached. This time is variable based on the nature of the event.

- At T0, the event is detected by operators: indications are variable based upon the size of the leak.

- While operators know an event is in progress at T0, operators likely do not know exactly what the event is or its severity.

- Operators start taking generic actions at T0 to combat the event based on indications as they present themselves to the operators: to identify the leak location, to isolate the leak (if possible), and to make up reactor pressure vessel (RPV) volume lost through the leak. Plant response to those actions ultimately reveal whether the leak is isolable and its size. This is the time to diagnose the event. Note:

- These generic actions are variable based on the trends of all indications presented to and analyzed by operators. Operators may choose one procedure over an another or work procedures in parallel based on the interpretation of indications.

- The time to perform these generic actions is therefore also variable depending upon how the operators chose to address the event in accordance with procedure. As stated in Attachment A to Chapter 18 of NUREG-0800, The estimated Time Available for operators to complete the credited action is sufficient to allow successful use of all applicable procedure(s).

19

- These generic actions identify the specific nature of the casualty. At this point, T1 is reached. TDiagnosis is established (T1 - T0). This time is by its nature variable.

- Once T1 is reached, TImplementation can be discretely measured.

- For Type 2 events, TPerform = TDiagnosis + TImplementation.

Timelines were constructed for PV for each identified manual action in Section 4.3.2. These timelines are informed by the OSDs and developed for each manual action under study. For PV, these timelines capture the time to perform and time to implement values through observation of the Validation Team using navigable, dynamic PPS and DCS displays. For PV, TPerform is compared to TAvailable as shown in Table 1 and Table 2 to determine if the manual action under study can be completed to meet the acceptance criteria identified in Section 4.4.4.

To provide additional clarity in this PV report with regard the difference between Type 1 and Type 2 manual actions under study as presented in Section 4.3.3 of the CV report [3], the Rasmussen decision ladder is leveraged as shown in Figure 8.

Figure 8. Rasmussen decision ladder model as applied to Type 1 and Type 2 manual actions under study.

Type 1 events are pictorially presented on the left side of Figure 8. For a Type 1 event, monitoring and detection activities present information to the operator that allow them to directly diagnose the event and establish the system state. This allows the higher levels of the situation assessment shown at the top of the decision ladder to be bypassed and for the execution of pre-determined procedural task driven by the system state.

Type 2 events are pictorially presented on the right side of Figure 8. For a Type 2 event, monitoring and detection activities present information to the operator that allow them to identify that an event is in progress, but the nature and severity of the even has not been fully revealed. To establish the nature and severity of the event takes time. This is accomplished by operators processing through the higher levels of the situation assessment shown at the top of the decision ladder. The operators iterate as shown while taking generic actions that both begin to address and establish the true nature of the event which then reveals the goal state. The time to accomplish this is variable. Once the goal state is identified, operators identify the tasks necessary to achieve that goal state and begin implementation to achieve the goal state.

20

4.4.4 Acceptance Criteria for Conceptual Verification and Preliminary Validation The acceptance criteria for PV are identical to those described in Section 4.4.4 of the CV report [3]

and are repeated here for completeness.

The acceptance criteria for CV and PV for either type of event with a defined TAvailable are below:

IF: MCR operators demonstrate:

- That TPerform = TDiagnosis + TImplementation as estimated in CV and shown in PV Does not exceed TAvailable for Type 1 events (Criterion A)

Does not exceed 50% of TAvailable for Type 2 events as estimated in CV and shown in PV (Criterion B)

This establishes a 50% TMargin for Type 2 events for this upgrade. This criterion is being applied by CEG as a good engineering practice to address potential TDiagnosis uncertainties consistent with the discussion in NUREG-1852 [14], Section B 2.2.4. Application of this criteria is applicable to this upgrade only.

- TImplementation for the new design does not exceed the TImplementation for the existing design (conservatively self-imposed by CEG) (Criterion C)

- TDiagnossis is not degraded based upon the expert judgment the Validation Team. (Note: it is expected that over time, TDiagnosis will improve through training and operator familiarization).

(Criterion D)

THEN: the HSIs and procedures used in the scenarios for the event under study are satisfactory.

If any criteria from #1 directly above is exceeded, this must either be specifically justified as being acceptable or the HSIs. Or the HSIs and procedures revised as necessary to address the issue. Revised HSIs and procedures must then be regression tested prior to or during ISV.

Timelines generated for each manual action under evaluation for CV as identified in Section 4.3.2 are captured in Appendix D along with the associated OSD for each scenario where a manual action performance was observed. A template for these timelines is provided in Figure 9.

Figure 9. NRC timeline template used for evaluating manual operator actions.

4.5 Protocol to Ensure Readiness for Preliminary Validation The subsections below outline the protocol developed by the HFE Process Team to guide the execution of PV.

21

4.5.1 Review and Confirm Impacted Manual Operator Actions to be Evaluated If new actions were identified between CV and PV, perform the following:

Design Team: Identify the source of any new credited or new additional manual operator actions for evaluation for PV whether they be from the defense in depth and diversity (D3), UFSAR, PRA, or other. (Completed. There were no additional manual operator actions identified for PV).

4.5.2 Review and Confirm Scenarios If new actions were identified between CV and PV, perform the following:

INL (HFE Process Team): Verify with the Design Team that any new scenarios contain a SEG and the SEG is provided to INL prior to the workshop (Completed. There were no new scenarios for PV.

However, Scenario 9 [SEG #9] was modified from CV. As summarized in Section 4.4.1, the inadvertent Division 2 LOCA signal provided at the start of the scenario for CV was removed for PV.).

4.5.3 Confirm Completeness of Type and Number of Plant Protection System and Ovation Displays If new actions were identified between CV and PV, perform the following:

HFE Process Team: Verify with the Design Team that any new displays were identified, designed, and rendered prior to the PV workshop. (Completed. All necessary PPS and DCS dynamic and navigable displays were available for PV. These displays are presented in Appendix B: Human-System Interface Displays Developed for Preliminary Validation).

4.5.4 Confirm Completeness of Procedure Changes If new actions were identified between CV and PV, perform the following:

HFE Process Team: Verify with the Design Team that any new procedures are identified, revised, and sent to INL prior to the PV workshop. (Completed. A summary of changes are described in Section 3.2 of this report.).

4.5.5 Establish Time Available for Manual Actions identified in Section 4.3.2 as Applicable If new actions were identified between CV and PV, perform the following:

HSI and Design and Procedure Modification Team: Update Table 1 and Table 2. (N/A) 4.5.6 Identify and Document the Task Sequences for Manual Actions Identified in Section 4.3.2

HFE Process Team: Verify the completeness and accuracy of the OSDs (i.e., developed during CV) by the Design Team (Completed. These OSDs are captured in Appendix D and are identical to those captured in Appendix D of the CV report [3]).

4.5.7 Perform Dry Run

The HSI Design and Procedure Modification, Simulator, and HFE Process Teams: Perform a dry run for PV. (Completed.)

- Logistics INL Simulator Team: Verify all hardware, software, and materials (e.g., presentations, procedures, forms, and agendas) are ready for workshop execution (Complete).

INL HFE Process Team: Verify all attendees are processed in the INL Badging System (Completed).

22

INL: Verify refreshments and lunches are prepared (Completed).

- HFE Process, Simulator, and Design Teams: Walkthrough steps to be performed at the PV workshop. (Completed. The HFE Process, Simulator, and Design Teams determined the optimal arrangement [i.e., determining relative locations of the control boards, as well as the PPS and DCS VDUs] of the LGS control room configuration when presented in the HSSL hybrid simulator environment, as seen in Figure 6. This walkthrough was also used to support in determining the choreography necessary to allow demonstration of certain features of the upgrades that were simulated by the simulator team when working with the capabilities of the HSSL, as described in Section 3.5.2.2.).

- HFE Process Team: Prepare data collection tools, including data recording, and general notes.

(Completed.)

4.5.8 Prepare HSI and Procedure Validation Team Surveys (new section) 4.5.8.1 Administer Workload and Situation Awareness Surveys Human factors staff prepared paper surveys of the National Aeronautics and Space Administration (NASA) - Task Load Index (TLX), Single Ease Question (SEQ), Situation Awareness Rating Technique (SART), and Brief-Nuclear Usability Measure (B-NUM as described in INL/CON-18-45444 [16]), to be administered to operators after each scenario. These paper surveys provided a baseline qualitative assessment of self-reported workload and situation awareness and were administered as a packet.

Operators were instructed to answer these questions as quickly and accurately as possible after completing each scenario.

This step was actually performed prior to the dry run as captured in Section 4.5.7. It is described here in this report to maintain the parallel document structure between this PV report and the CV report [3].

4.5.8.2 NASA-Task Load Index The NASA-TLX (Figure 10) is an industry-accepted tool for measuring and evaluating workload, as described in NUREG/CR-7190, Workload, Situational Awareness, and Teamwork [15]. The NASA-TLX is a post-scenario rating method to assess workload, comprising six different dimensions: mental demand, physical demand, temporal demand, performance, effort, and frustration. Each dimension (i.e.,

question) typically uses a standardized scale (e.g., 1 = low; 20 = high) where higher values denote a greater workload. A common practice is to remove the 15 pairwise comparisons and only use the rating scales for each workload dimension. Workload can be evaluated by each dimension and holistically from aggregating the individual scales.

23

Figure 10. NASA-TLX standardized survey instrument.

4.5.8.3 Single Ease Question The SEQ is a standardized single-question post-trial subjective rating method, using a 1-7 rating scale to measure perceived ease of completing a task (i.e., herein referred to as perceived difficulty). The SEQ is a widely used survey tool in usability engineering for software systems. The SEQ is generally inversely correlated with the NASA-TLX. That is, lower SEQ values (e.g., one) denote lower perceived ease of task completion whereas higher SEQ values (e.g., seven) denote higher perceived ease of task completion.

4.5.8.4 Situation Awareness Rating Technique The SART is a self-report standardized survey that measures perceived situation awareness (SA; Figure 11) with a series of standardized questions using a seven-point rating scale (1 = low; 7 = high).

These questions aggregate into three primary dimensions: Understanding, Demand, and Supply.

Understanding refers to ones general understanding of the situations and is a combination of information quantity, information quality, and familiarity. Demand refers to ones attentional demands (i.e., like workload) and is a combination of task complexity, variability, and situation instability. Finally, Supply refers to ones attentional supply and is a combination of attentional arousal, focusing of attention, spare mental capacity, and mental concentration. The relationship of these three dimensions score a common situation awareness measure from the following equation: SA = Understanding - (Demand - Supply). A composite SA score is derived from SART where a greater value denotes greater situation awareness.

SART is also cited in NUREG/CR-7190 [15] but is cautioned as a primary source to measure SA; hence, PV used SART in combination with naturalistic observation and semi-structured questions described in the post-scenario discussion.

24

Figure 11. SART standardized survey instrument.

4.5.8.5 Brief - Nuclear Usability Measure Finally, the surveys included the Brief - Nuclear Usability Measure (B-NUM), a recently developed survey tool [16], see Figure 12 for an example. The B-NUM is an aggregated survey meant to measure self-reported workload and situation awareness based on two key questions. The tool was derived from NASA-TLX and SART but adds an additional quality of collecting diagnostic information on the responses. That is, the survey responder has the capability to check performance shaping factors (i.e.,

contributors) to low ratings for self-report workload and/or situation awareness. The responder can then 25

describe the specific attributes of these contributors in more detail in an open text field. The advantage of using B-NUM in this sense is to collect early feedback on contributors to low situation awareness and/or high workload to better inform design.

Figure 12. B-NUM standardized survey instrument.

5 PRELIMINARY VALIDATION EXECUTION AND RESULTS 5.1 Execution of Scenarios PV was performed through execution of the Appendix C SEGs using the HSSL simulation facility provided by INL. Scenario execution was directed by a member of the Simulator Team. Initial conditions were set for each scenario. Operators (Shift Technical Advisor [STA], Control Room Supervisor [CRS],

Reactor Operator [RO], and Plant Reactor Operator [PRO]) making up the Validation Team were then put in role to commence scenario execution.

Each particular scenario was then performed. For each scenario, the Validation Team navigated through and used the dynamic HSIs, as captured in Appendix B: Human-System Interface Displays Developed for Preliminary Validation, along with updated procedures to demonstrate their ability to address the conditions presented to them in each of the SEGs. The PPS and DCS displays used during PV 26

were sufficiently dynamic as described in Section 3.5.2 for the Validation Team (operators) to perform necessary actions for the scenarios in real time.

Existing HSIs indications not impacted by the upgrade (including those associated with controlled equipment) were also dynamic and updated in real time as supported by the LGS simulator model as described in Section 3.5.2.

For existing HSI controls not impacted by the upgrade, these were represented in the HSSL on touch-screen interfaces. It was decided that for the purposes of PV, attempting to have operators manipulate existing, out-of-scope analog controls on these touch-screens was impractical. The small size of the controls as presented and the necessary training and familiarization that would have required for operator use of these touch controls in an efficient and repeatable manner contributed to this decision. HSI Design and Procedure Validation Team members are also fully trained to use these existing control interfaces.

The conservative, negative time bias introduced by this practice is described in Section 3.5.2.2.

While each scenario was being performed, a Simulator Team member qualified as a simulator instructor/evaluator was following the associated SEG and determining whether the necessary actions to address the problem presented to the Validation Team were being satisfactorily performed. Independently of this, the HFE Process Team was following scenario execution using the OSDs captured in Appendix D: Scenario Operational Sequence Diagrams and Results for Preliminary Validation Manual Actions. The CEG Senior Manager of Operations was also independently using the SEG to track completion of operator actions. Using the OSDs and timing results described above, the HFE Process Team created the simplified and detailed HSI and Procedure Validation Team Performance timelines captured for each scenario in Appendix D of this report.

5.2 General PV Results Against Review Criteria NUREG-0800 [1], Chapter 18, Attachment A, Phase 2 (Preliminary Validation), Section 2.B.

(Review Criteria) was leveraged by the HFE Process Team to establish the review criteria for PV. Review criteria adapted from Reference 1 and how each was generally addressed are discussed in this section.

For CMA in the LGS Licensing Basis as captured in Table 1in Section 4.3.2.1 and for the additional manual operator actions being evaluated as captured in Table 2 in Section 4.3.2.2:

1. PV is conducted as an independent confirmation of the CV analysis that compared time available and estimated time required to complete the action.

Independence, as applied during both CV and PV is addressed in Section 3.5 and Section 2 of the CV report [3]. Members of the Validation Team will be replaced for performance of ISV.

2. The PV is conducted by a multi-disciplinary team with the knowledge and skills necessary to verify the rigor and assumptions of the analysis and validate the analysis conclusion regarding the ability of the operators to perform the actions reliably within the time available.

The multi-disciplinary team used for PV is captured in Section 2 of the CV report [3] as augmented as described in Section 2.3 of this report. The qualifications of each individual involved in the HFE effort for this project culminating in PV are captured in the references provided.

3. The preliminary validation uses methods appropriate to assessing time required for the task. For complex situations and for actions with limited margin, such as less than 30 minutes between time available and time required, the primary validation uses two or more methods to validate the analysis.

As described in Section 5.1, three independent recorders were simultaneously recording times during PV to assess time required to complete the CMAs identified in Table 1 (Section 27

4.3.2.1) and for the additional manual operator actions being evaluated identified in Table 2 (Section 4.3.2.2).

4. The preliminary validation results support the conclusion that the time required, including margin, to perform individual steps and the overall documented sequence of manual operator actions is reasonable, realistic, repeatable, and bounded by the CV analysis documentation.

These three sets of recorded times for PV as described in item #3 directly above were initially compared and correlated immediately after completion of each scenario run for PV. This allowed for an immediate preliminary determination as to whether the acceptance criteria captured in Section 4.4.4 had been met. A more detailed analysis was done as captured in the timelines provided in Appendix D to show the correlation of times recorded by the three independent recorders. The final results of the required time analysis verified that all acceptance criteria were met for both the CMAs (as captured in Table 3) and the additional manual actions being evaluated (as captured in Table 4).

The SEGS captured in Appendix C and the OSDs captured in Appendix D document the steps and sequence of to perform manual operator actions under study. Performance of these actions was demonstrated to be reasonable and realistic. By successfully meeting all acceptance criteria for both CV and PV, repeatability of results was also demonstrated.

Using the same evaluation criteria for the additional manual actions being evaluated as captured in Table 2 of Section 4.3.2.2 does not imply that the Licensing Basis for CMA is being expanded to include these items.

5.3 Preliminary Validation Summary of Results 5.3.1 Credited Manual Actions in the Limerick Generating Station Licensing Basis Table 3 provides a summary of the time to perform and time to implement for CMA in the LGS Licensing Basis as observed during PV. Table 4 provides a summary of the time to perform and time to implement for the additional manual operator actions evaluated during PV.

As shown in Table 3 and Table 4, all the acceptance criteria identified in Section 4.4.4 were satisfied during PV. For both Table 3 and Table 4, Criterion B is being applied by CEG as a good engineering practice to address potential TDiagnosis uncertainties consistent with the discussion in NUREG-1852 [14],

Section B 2.2.4. Application of this criteria is applicable to this upgrade only.

28

Table 3. PV observed times for manual operator actions credited in the LGS Licensing Basis impacted by the modification.

Action Credited Manual Licensing Source Addressed Time Estimated Time to Estimated Criterion Criterion Criterion Criterion

Operator Action by CV/PV Available Time to Implement Time to A B C D and Perform Implement Event Scenario Acceptance Observed Existing Observed in Type Number(s) Criteria in PV Design PV CV1 Place both loops OP-LG-102-106, 1 [ ](C) [ ](C) [ ](C) [ ](C) Pass N/A Pass Pass Suppression Pool Operator Response [ ](C) [ ](C) No Type 1 Cooling in service Time Program at observed following an inadvertent LGS, TCA #64 difficulties SRV opening to maintain UFSAR Chapter in diagnosis suppression pool temp 15.1.4.2.1 below TS limits CV2 Open S, H, M, E, K OP-LG-102-106, 2 [ ](C) [ ](C) [ ](C) [ ](C) Pass Pass Pass Pass SRVs using Division 3 Operator Response [ ](C) [ ](C) [ ](C) No Type 2 power from AER (note Time Program at observed new task will be from LGS, TCA #16 difficulties MCR using Division 3 NE-294, Specification in diagnosis PPS or Ovation display) for Post-Fire Safe Shutdown Program Requirements for LGS, Rev 5 CV3 Inject Standby Liquid UFSAR Chapter 3 [ ](C) [ ](C)2) [ ](C) [ ](C) Pass Pass Pass Pass Type 2 Control following DBA 15.6.5 [ ](C) [ ](C) Equal time No LOCA for pH control RAI Response for to observed Limerick AST implement difficulties implementation- in diagnosis T04602 CV4 Station blackout action - OP-LG-102-106, 5 [ ](C) [ ](C) [ ](C) [ ](C) Pass N/A Pass Pass Type 1 if HPCI auto started then Operator Response [ ](C) [ ](C) No secure HPCI within 10 Time Program at observed minutes of SBO event LGS, TCA #62 difficulties UFSAR Chapter in diagnosis 15.12 (1) Time available for CV3 is specified by the licensing commitment and procedure. Procedure delays action performance to occur after [ ](C) but before [ ](C) for a DBA LOCA (2) For CV3, the need to perform this action was identified early in the scenario. The procedure directs, however, that this action not be performed until 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months after the initiating event. Time was compressed in the simulator to the 3-hour point and the time to perform the action was recorded as 11.93 minutes. The estimated time to implement was 0.88 minutes. A detailed timeline for this action was not developed.

29

5.3.2 Additional Manual Operator Actions Evaluated Table 4. PV observed times for additional manual operator actions impacted the modification that were evaluated.

Action Additional Manual Source Addressed Time Estimated Time to Estimated Criterion Criterion Criterion Criterion

Operator Actions by CV/PV Available Time to Implement Time to A B C D Identified for Perform Implement and Event Evaluation Scenario Acceptance Observed Existing Observed in Type Number(s) Criteria in PV Design PV CV5 Inhibit ADS (non- OP-LG-102-106, 2 [ ](C) 0.40 [ ](C) [ ](C) Pass Pass Pass Pass ATWS) Operator Response minutes [ ](C) [ ](C) [ ](C) No Time Program at observed Type 2 LGS, TSA #7 difficulties PRA - AHU600DXI in diagnosis 4 [ ](C) Task not [ ](C) Task not N/A N/A N/A N/A observed observed in in Scenario 4 Scenario 4

7 [ ](C) 0.37 [ ](C) [ ](C) Pass Pass Pass Pass minutes [ ](C) [ ](C) [ ](C) No observed difficulties in diagnosis CV6 Initiate Emergency OP-LG-102-106, 2 [ ](C) Captured [ ](C) Captured as N/A N/A N/A N/A Depressurization if RPV Operator Response as CV2 CV2 for this level cannot be restored Time Program at for this scenario Type 2 and maintained above - LGS, TSA #9 scenario 186" PRA - AHUWS1DXI 9 [ ](C) N/A(1) [ ](C) [ ](C) N/A N/A Pass Pass

[ ](C) No observed difficulties in diagnosis 30

Action Additional Manual Source Addressed Time Estimated Time to Estimated Criterion Criterion Criterion Criterion

Operator Actions by CV/PV Available Time to Implement Time to A B C D Identified for Perform Implement and Event Evaluation Scenario Acceptance Observed Existing Observed in Type Number(s) Criteria in PV Design PV CV7 Inhibit ADS (ATWS) OP-LG-102-106, 6 [ ](C) [ ](C) [ ](C) [ ](C) Pass Pass Pass Pass Operator Response [ ](C) [ ](C) [ ](C) No Time Program at observed Type 2 LGS, TSA #13 difficulties PRA - AHUINXDXI in diagnosis (1) For CV6, the need to perform this action was procedurally driven rather than addressing conditions of the plant. That is, the action to perform emergency depressurization by opening the five SRVs was performed per procedural direction in T-112. However, the leak presented in SEG #9 was large enough to have already depressurized the RPV at the time of performing the action of opening the five SRVs, so this command had no direct effect on the plant. Despite the observed action of CV6 being only procedurally driven, time to implement the action of opening the five SRVs was recorded to demonstrate that the operators can perform this action within the established acceptance criteria.

31

Action CV5 was not observed during the performance of Scenario 4 for PV. This same result was observed during CV. The possibility of this result is addressed in SEG 4.

A separate scenario and SEG (8) was created as described in Section 5.3.2 of the CV report [3] and performed during both CV and PV.

A separate scenario and SEG (9) was created as described in Section 5.3.2 of the CV report [3] and performed during both CV and PV.

5.3.3 Operations Feedback This section presents the results from the post-scenario surveys and discussion administered after each scenario. Specifically, the surveys captured self-report responses of perceived workload, perceived scenario difficulty (i.e., similar to workload), and perceived SA.

Standardized industry-accepted survey instruments as identified in Section 4.5.8 were used to collect perceived workload, scenario difficulty, and SA data. The surveys were administered to the Validation Team by the HFE Process Team as a packet after the completion of each of the nine scenarios. The Validation Team were instructed to answer these surveys individually and as quickly and accurately as possible. The HFE Process Team also instructed the Validation Team to perform their ratings based on the tasks demanded of them in the scenario using the new HSIs and modified procedures.

The responses from the surveys were analyzed qualitatively and not statistically for two reasons.

First, PV data set was not large enough to support a formal statistical analysis. Second, and most importantly, the intent of the surveys was to provide diagnostic criteria for evaluating the degree to which the new HSIs and modified procedures may have affected perceived workload, scenario difficulty, and SA when performing the tasks demanded of them in each scenario. These aspects of the evaluation were not dispositive (i.e., pass/ fail) in nature and were based on expert judgment from qualified personnel from the Simulator Team. Thus, the survey responses were used in combination of expert observation from the CEG Senior Manager of Operations to decide whether any perceived difficulties or ratings indicating high perceived workload or low SA were attributed to the new HSIs, modified procedures, familiarity/ training, characteristics of the scenario (situational), or a limitation of the simulation environment (artifact), as seen in Figure 13.

Figure 13. Contributors to observed difficulties, perceived workload, and perceived situation awareness.

This qualitative analysis not only accounted for whether specific contributors negatively or positively impacted perceived workload, situation awareness, or overall system usability, but also the net effect of these contributors on overall crew performance. For example, to determine the acceptability of workload, the analysis accounted for resulting impacts to response times, SA, and general impacts to crew coordination, communication, and teamwork. In instances where workload was high but considered acceptable by the Validation Team, overall acceptability also accounted for how the upgrades improved information availability, plant control, or overall situation awareness through added plant data integration, 32

use of the HUDs, or use of added automation. There may be an increase in workload when additional information that once was previously unavailable is integrated into the MCR. However, there is a net positive if such new capabilities enabled the crew to perform their tasks more efficiently, with increased SA, and elimination of having to rely on field communications to perform the same task.

Figure 14 provides summary results of the surveys for each of the nine scenarios run during PV.

Figure 14 highlights the average rating across the NASA-TLX, SEQ, and SART for each PV scenario.

Figure 14. Summary averages from NASA-TLX, SEQ, and SART.

These results are described further in the next nine sub-sections where ratings for each scenario are provided by each crew role: the CRS, STA, PRO, and RO. Details regarding the positive contributors and potential challenges to workload, situation awareness, and overall usability identified from the post-scenario debrief discussion are listed under each summary of the survey results. Further, the observations made by the CEG Senior Manager of Operations are presented for each scenario.

5.3.3.1 Scenario #1: Stuck Open SRV / HPCI Steam Leak / T-103 Blowdown 5.3.3.1.1 Survey Operations Feedback and Discussion Figure 15. NASA-TLX, SEQ, and SART results for Scenario #1.

33

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

The HUDs offered consolidation of information that improved crew coordination and situation awareness. The HUDs immediately offered HPCI Steam Leak indications. This enabled more efficient information access and less time calling out to the field for information.

Trending information on the HUDs was preferred for monitoring and planning. For the CRS and STA, the trends supported more proactive decision making and planning.

Availability of more and consolidated information in the MCR enabled less ping ponging and having to look away to perform tasks.

The selection of variables presented on the HUDs were compatible with the task demands. For instance, the crew commented that they preferred seeing the maximum temperature rather than having to look through multiple temperature points when making key decisions.

The navigation strategy enabled quick and easy access to controls and indications to allow the PRO and RO to be more proactive.

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

Familiarity with the new HSIs contributed to the STAs workload; although, the consolidation of information on the HUDs was seen as being very beneficial for planning (i.e., better than what is currently available) and reflected in the high perceived SA score for the STA (110.7) and the CRS (125) as shown in Figure 15. This was specifically discussed with the STA in the Scenario

1 debrief. While STA cognitive workload was higher, the STA expressed that his ability to understand the nature of the casualty and to fulfill his role to support plant safety was significantly improved. Perceived difficulty survey scoring indicate that operators were not significantly challenged in performing their actions. It was also noted the design eliminated the need for an equipment operator to call in values to the MCR from the field. This eliminates potential human errors in an error likely situation.

Multi-tasking was identified as a contributor to workload (e.g., doing three or four things at once). This is the same as in the current MCR. Again, while this tended to increase workload, the more centralized availability of indications and controls at the 5-pack control locations and the close proximity of other existing legacy controls had a net positive overall impact on the response of the operators when working through this scenario.

5.3.3.1.2 Senior Manager of Operations Observations

[

] (C)

[ ](C) 34

[ ] (C) 5.3.3.2 Scenario #2: Loss of Division 1 DC / Loss of Feed / DW Leak / Low Level 5.3.3.2.1 Survey Operations Feedback and Discussion Figure 16. NASA-TLX, SEQ, and SART results for Scenario #2.

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

Availability of plant state information from the new HSIs enabled less ping ponging across the MCR to perform tasks (e.g., when verifying plant equipment status for the RO). Further, the upgrades enabled integration of indication and control into the MCR that once required calling out to the field. For instance, this significantly improved task completion time such as during manual operation of the five SRVs. Also, the HUDs provided additional information to monitor the plant when performing additional tasks within the scenario.

Automation enhancements for RHR and Drywell Spray improved workload and situation awareness by placing the RO and PRO in a more supervisory role. Rather than performing separate manual actions to operate this equipment, they just had to navigate to the screen and it did all the RHR manipulations on its own. This enabled greater control to address larger leaks.

o There was a concerned expressed by other operators in the Operational Experience Review [9] that the addition of automation and AOAs would lead to a loss of SA.

This concern has been seen in other instances where poorly designed automation aids were implemented in a manner that operators were not able to understand what, why, and how the automation was working [18]. This issue, however, was not observed in PV. Rather, the opposite was found in that the AOAs improved workload, SA, and overall plant performance.

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

Minor improvements to increase the icon sizes for the isolation matrix on heads-up display (HUD 4) was needed to enhance readability for the CRS. (Captured as Item 297 in Table 5) 35

Labeling of the AOA light indicator box referring to the HPCI pump was commented; operators suggested making the label consistent with the PPS conventions for HPCI.

(Captured as Item 298 in Table 5)

For implementation on the Ovation Transient Response Display: labeling needs to be added which synchronizes with the labeling provided on PPS displays (support of T-270).

Familiarity with the new HSIs contributed to some additional unnecessary navigation (i.e.,

extra clicking) to find the appropriate information and controls, for the PRO and RO. For example, the RO initially attempted to open the five SRVs from Division 1 instead of Division 3; he quickly corrected. He attributed this initial error to familiarization with the workstation layout and commented that the new way is way better since they can control the situation (from inside the MCR) rather than having to call out repeatedly. Unnecessary navigation in this scenario was attributed to lack of familiarization of the navigation structure, not a design issue. It was concluded that more formal training and familiarization (as is required per existing LGS procedures for implementing new modifications) will address this issue and that the design as presented during PV the design will be good in the plant.

The scenario was highly dynamic and demanded review of many changing parameters that contributed to workload. However, as discussed by the CRS, the new HSIs provided this additional information into MCR to enhance crew SA. Thus, while workload was high (i.e.,

although the CRS commented that workload was not higher than with the existing plant design), the MCR operator SA was improved with the increased availability and organization of plant information provided on the new HSIs. The new HSIs helped keep the overall picture in mind (per STA comment).

5.3.3.2.2 Senior Manager of Operations Observations

[

] (C)

[

](C)

[ ](C) 36

5.3.3.3 Scenario #3: DBA LOCA / LOOP with D13 Failure 5.3.3.3.1 Survey Operations Feedback and Discussion Figure 17. NASA-TLX, SEQ, and SART results for Scenario #3.

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

HUDs offered consolidation of information that vastly improved crew coordination and situation awareness. The HUDs immediately offered system flow indications in a consolidated format to support monitoring. For instance, the STA commented that he could see all the flows from where he was standing. These benefits were seen by the PRO and RO as well (e.g., We didnt have to move. I liked that. - RO). The LOCA alarm that has been added by the upgrade was specifically helpful.

Automation reduced workload for the PRO and RO. This freed up their availability to perform other tasks. Although, familiarity with the new automation in combination with the modified procedures is needed to better allocate resources to remove burden for the CRS and STA (see potential challenges directly below).

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

Minor improvements are needed to increase the label size for leading indications including SLC discharge pressures for readability by the CRS. (Captured as Item 299 in Table 5)

Starting SLC pumps requires operating from both Division 1 and Division 3 displays, which takes slightly longer than now. Although operators commented that there 'is not much difference from now.' There were no issues with using the improved HSIs on the PPS to perform SLC injection. It was noted by the operators that this could have been done from the DCS HSIs as well.

Note, this manual action has 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months of time available to perform this action. The current layout requires the operator to start two SLC injection pumps from two of the three available 37

Divisions (1, 2, or 3) by navigating to SLC and starting each pump. The total time to implement observed as 53 seconds, which is minimal to the 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months available.

High temporal demand in this scenario contributed to workload and frustration for the CRS.

These situational factors were no different than those presented in the existing plant design.

Workload survey feedback was driven by plant conditions presented by the scenario. Similar workload surveys, if performed on operators using the existing plant design, would have a similar result.

The AOAs are new to the operators. Additional operator training to understand the full capabilities and associated strategies is needed.

5.3.3.3.2 Senior Manager of Operations Observations

[

] (C) 5.3.3.4 Scenario #4: Group 1 MSIV Isolation / RCIC and Control Rod Drive Issues 5.3.3.4.1 Survey Operations Feedback and Discussion Figure 18. NASA-TLX, SEQ, and SART results for Scenario #4.

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

HUDs offered consolidation of information to improved crew coordination and situation awareness. The STA and CRS could monitor leading indications while the PRO and RO performed tasks at the PPS/ DCS workstations.

38

Availability of plant state information from the new HSIs enabled less ping ponging across the MCR to perform tasks. This reduced physical workload for the RO with typically having to walk across the MCR to perform the assigned tasks from the new PPS/ DCS workstations.

Automation enhancements reduced cognitive workload and increased availability for the PRO. The PRO currently is required to manually control the SRVs, leaving him stuck at the control board where these switches are for the existing design. With new features like automatic SRV pressure control provided by the new design, the PRO can now allocate his time to other tasks (as opposed to being stuck at the SRV switch location). This removes a temporal bottleneck that currently requires the PRO to be completely allocated to manual SRV manipulation when he can now be more proactive to keep up with the plant This was reflected in that the crew did not ever reach a point in the scenario to require inhibiting ADS (i.e., the manual action under study).

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

A new monitoring strategy is needed for the CRS and STA in maintaining situation awareness regarding the actions taken by the PRO and RO. In the legacy MCR, the CRS/

STA can obtain awareness based on the spatial location of the PRO/ RO; this is not possible in the new configuration since information is consolidated onto digital HSIs at designated locations. Thus, the CRS/ STA will need to a new communication strategy in obtaining this awareness. For instance, the HUDs provide information of key parameters being impacted by operator actions at the workstation. This information in combination with communication between the crew was discussed as one approach to addressing this.

The limited arrangement of the simulator did not include clear alarm indications for reactor core isolation cooling (RCIC). This is an artifact of the simulator testbed and the percentage of the MCR that could be presented at once. At any case, the PRO commented that he was able to detect and diagnose even with the simulator configuration because of the leading flow indications on the HUDs.

5.3.3.4.2 Senior Manager of Operations Observations

[

](C) 39

5.3.3.5 Scenario #5: Station Blackout 5.3.3.5.1 Survey Operations Feedback and Discussion Figure 19. NASA-TLX, SEQ, and SART results for Scenario #5.

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

HUDs offer consolidation of information to improve crew coordination and situation awareness. This was demonstrated when stabilizing HPCI and RCIC in this scenario. For instance, the PRO once was concerned about a keyhole effect when using the new HSIs.

However, the RO commented that he no longer has this concern because of the HUDs.

The navigation strategy enabled quick and easy access to controls and indications. For instance, the time required to navigate and use the soft controls when controlling HPCI was less than or equal to walking over to HPCI in the legacy MCR.

The digital upgrades offer consolidated information and automation that frees resources for the PRO. The PRO stated that he was lightly loaded during this scenario. The STA commented that with training, the upgrades will enable the PRO to help more on other tasks.

It was stated that the PRO could likely provide more support to the other unit, improving overall station response to a station blackout.

The T-200 series (i.e., emergency operating procedures [EOP] support) procedures were clear, straightforward, and directly implementable for the PRO. The new HSIs and underlying I&C design allowed the RO to perform T-200 actions in minutes instead of hours because he had all the necessary indications provided to him directly by the new design. The PRO did not have to expend cognitive effort to prioritize the implementation of T-200 series procedures based upon the availability of information provided by remote auxiliary operators.

This also eliminated error likely actions that would have to be performed in the dark by the auxiliary operator under stress. Associated personnel safety issues for the auxiliary operator are also eliminated by the design.

40

The CRS noted that establishing a stable condition when combatting a station blackout is much easier using the HSIs and underlying I&C design. The in turn allowed the CRS to direct his attention toward restoring power. This is further aided by the fact that auxiliary operators do not have to go to the auxiliary equipment room to report locally indicated values and place jumpers. This auxiliary operator is now free to direct his attention to restoring power.

An observation was made by a member of the HFE Process Team (Jeffrey Joe) with regard to the necessity to maintain the existing MCR Flat Topology as identified during the Functional Requirements Analysis and Function Allocation Workshop as described in Section 4.4.2 of reference [5]. It was observed that the HSIs produced for validation during PV had successfully transitioned HSI concepts for AP1000, which as most pressurized water reactors (PWRs), supports a more linear concept of operations for casualty response, toward the parallel processing concept of operations for a boiling water reactor (BWR) such as LGS.

The new HSIs developed as part of the project are achieving the objective of supporting/augmenting the existing LGS MCR HSI flat topology and the existing MCR BWR concept of operations for casualty response. PV demonstrated. that the new HSIs also integrate well with the existing HSIs that remain.

An observation was made by a Simulator Team Member (Eric Rosa) with regard to the visibility and interpretation of existing MCR panel and benchboard indications when compared to those provided by the new HSIs. The new VDUs and displays presented on them tend to provide data more clearly in a more context rich and more centralized environment. The new HSIs replace legacy indications that are in cases a sea of red and green lights along with presentation of parameters that are more separated and difficult to see and interpret.

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

Request for adding HPCI and RCIC mode switch indications on the HUDs to support monitoring for this task. (Captured as Item 305 in Table 5)

Labeling of the AOA light indicator box referring to the HPCI pump was commented; operators suggested making the label consistent with the PPS conventions for HPCI.

(Captured as Item 298 in Table 5) 5.3.3.5.2 Senior Manager of Operations Observations

[

](C) 41

5.3.3.6 Scenario #6: Control Rod Scram / ATWS / Generator Trip / T-217 Termination 5.3.3.6.1 Survey Operations Feedback and Discussion Figure 20. NASA-TLX, SEQ, and SART results for Scenario #6.

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

Availability of more information, including scram discharge levels, in the MCR eliminated the need to call out to the field and reliance on auxiliary equipment operators for maintaining situation awareness and performing actions in T-221 and T-270. These were performed by the PRO from the PRO 5-Pack including a DCS VDU and each of the four associated PPS divisional VDUs.

DCS HUDs offered consolidation of information to improved crew coordination and situational awareness. For instance, the STA utilized the HUD 1 for diagnosis and maintaining plant situation awareness of leading indications important to the scenario.

As a result of the two bullets listed directly above, the PRO was able to complete T-221 and T-270 in a significantly accelerated manner.

Automation enhancements such as automatic pressure control with SRVs reduced additional burden on the PRO in stabilizing reactor pressure. Automatic feedwater runback was also eliminated.

After the crew was able to insert all rods into the core, the new HSIs and the underlying I&C design made it much easier to establish pressure control (using an AOA) and reduce the plant cooldown rate.

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

The PRO commented that all the necessary information and control capability necessary to perform T-270 and T-221 actions are available from the PPS transient response displays at the PRO 5-pack. While working to accomplish these actions, however, the PRO had to 42

work with three separate procedures (T-270, T-221, and OT-200 Appendix 12) in parallel to perform his tasks. Revising and/or consolidating these procedures was proposed to reduce burden and frustration that resulted from simultaneously holding/following multiple procedures while trying to take the necessary actions. The PRO commented, "It's all right there (pointing to the PPS}. All you have to do is combine the procedural steps to say, inhibit (ADS) and perform T-221, T-270, and OT-200 Appendix 12. It is that easy." (Captured as Item 318 in Table 5)

The scenario was highly dynamic and demanded many changing parameters that globally contributed to high workload across all dimensions. The workload did not impact the ability of the crew to perform their tasks. For instance, the manual action under study (inhibit ADS ATWS) was performed in 33 seconds.

5.3.3.6.2 Senior Manager of Operations Observations

[

] (C)

[

](C) 5.3.3.7 Scenario #7: LOOP / Ovation Loss / DW Leak / Blowdown on Low Level 5.3.3.7.1 Survey Operations Feedback and Discussion Figure 21. NASA-TLX, SEQ, and SART results for Scenario #7.

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

43

Diversity in indications between PPS and the DCS enabled the crew to continue monitoring the plant during the loss of a subset of DCS displays. For instance, MSIV status and SLC status could be monitored from the PPS to maintain situation awareness.

Flexibility of the DCS also enabled the crew to continue monitoring the plant during the loss of a subset of DCS displays. With the second VDU losing power, the crew was able to use the first VDU presenting HUD 1 information (no longer needed) to present HUD 2 information to monitor the ECCS. This flexibility allowed the crew to continue monitoring key parameters in this scenario to maintain situation awareness.

HUDs offer consolidation of information to improved crew coordination and situation awareness. This helped compensate for the legacy practice of observing RO/PRO physical positions in the MCR to determine whether they are performing the correct actions. The STA commented that he was able to use the remaining HUDs to maintain situation awareness of the plant as the PRO and RO enabled auto level control for RCIC and SRV auto control.

Automation reduced increased availability for the PRO and RO to stay ahead of the plant.

As mentioned by the STA, automation features such as auto level control for RCIC and SRV auto control put the PRO/ RO ahead of the plant.

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

The observed high CRSs workload as mentioned above was discussed and established to be driven by the scenario. The workload is not increased as a result of the upgrade.

5.3.3.7.2 Senior Manager of Operations Observations

[

] (C) 44

5.3.3.8 Scenario #8: Loss of Shutdown Cooling 5.3.3.8.1 Survey Operations Feedback and Discussion Figure 22. NASA-TLX, SEQ, and SART results for Scenario #8.

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

HUDs offered consolidation of information for the CRS where he could readily monitor the actions taken by the PRO when swapping to the 1B RHR loop. For example, in the current configuration, roughly two thirds of the valves on the control panel are occluded by the benchboard for the CRS. With the HUDs being positioned in a location where they are not occluded by the benchboard, he was able to view the entire valve lineup.

Workload was generally low due to relatively low complexity of the scenario. For instance, diagnosis in this scenario 'was not much more than seeing the pump."

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

The order of valves in the table in ON-121 Attachment 6 (Step 2) was suggested by the PRO to be modified to support the task. Specifically, he commented to re-sequence longer stroking valves to come before shorter stroking for improved task efficiency. For instance, he commented that the HV-51-125(A)B valve should come before the HV-C-51-1F048A(B).

(Captured as Item 317 in Table 5)

Low familiarity with having to activate the soft controller was mentioned by the PRO. He commented that the time was slightly slower (then currently starting a pump) because he had to activate the controller. This difference was slight.

Feedback when selecting equipment on the HSIs did not provide clear indication (i.e., such as by highlighting the equipment selecting from the mimic). This was a known simulation artifact of the prototyped displays, and the actual HSIs will provide such feedback.

45

5.3.3.8.2 Senior Manager of Operations Observations

No major feedback for the performance of this scenario 5.3.3.9 Scenario #9: Steamline Rupture Inside DW / All RPS, NSSS, ECCS Fail Except Group 1 NSSSS and A CS Loop 5.3.3.9.1 Survey Operations Feedback and Discussion Figure 23. NASA-TLX, SEQ, and SART results for Scenario #9.

Positive contributors to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

The operable DCS HUDs provided very clear indication with regard to plant status during the loss of the PPS. Without this indication, the CRS would have had to rely on the RO and PRO to attempt to glean plant status by individually examining and reporting the values of remaining operable indications and verbally reporting it.

Operators were able to use the individual RO and PRO DCS displays and legacy indications and controls to establish what plant system indications and controls could be employed to place the plant in a safe condition with a loss of the PPS. These displays were then used to accomplish this.

Potential challenges to workload, situation awareness, and overall usability were summarized and immediately discussed as follows:

Familiarity and formal training with HSIs and procedures is needed to support use of the DPS and its associated HSIs. The crew globally reported increased workload and reduced situation awareness because of the sparsity of indications available across the DCS that were driven by the DPS with the loss of PPS. Comments from the CRS and RO indicated that they had difficulty identifying what indications were available on the DCS with a loss of PPS.

o What the crew did not do in this scenario was navigate to the DPS HUD that is available from the DCS (e.g., one click away on HUD 1). The DPS HUD is designed to provide a consolidated set of available indications of systems and equipment that is 46

operable from the DCS that would have reduced the crews difficulties in identifying available indications and associated controls more easily combat the loss of PPS.

o It should be noted that a failure of PPS will be included into the training program and as part of integrated system validation.

5.3.3.9.2 Senior Manager of Operations Observations

[

](C)

[

](C) 5.4 General Human-System Interface Style Guide Comments Style guide global comments as described in Section 5.4 of the CV report [3] remain valid. INL will perform a formal HSI design verification of the HSIs produced by Westinghouse using the HSI style guide for LGS [6]. Any HSI style guide issues identified on the Westinghouse developed displays will be dispositioned by LGS and Westinghouse.

5.5 Human-System Interface and Procedure Items Identified During Preliminary Validation and Item Tracking Appendix E as of the writing of this report captures a total of 319 HSI and procedure items. Twenty-six of these were identified during PV. These are listed in Table 5 below.

Table 5. Human-system interface and procedure items identified during PV.

Tracker # PPS Problems, Issues, and Discrepancies Identified during Ovation Preliminary Validation Both Procedure 294 [ ](C) [ ](C)

(C) 295 [ ] [ ](C) 296 [ ](C) [ ](C) 297 [ ](C) [ ](C) 298 [ ](C) [ ](C) 299 [ ](C) [ ](C) 300 [ ](C) [ ](C) 47

Tracker # PPS Problems, Issues, and Discrepancies Identified during Ovation Preliminary Validation Both Procedure 301 [ ](C) [ ](C) 302 [ ](C) [ ](C) 303 [ ](C) [ ](C) 304 [ ](C) [ ](C) 305 [ ](C) [ ](C) 306 [ ](C) [ ](C) 307 [ ](C) [ ](C) 308 [ ](C) [ ](C) 309 [ ](C) [ ](C) 310 [ ](C) [ ](C) 311 [ ](C) [ ](C) 312 [ ](C) [ ](C) 313 [ ](C) [ ](C) 314 [ ](C) [ ](C) 315 [ ](C) [ ](C) 316 [ ](C) [ ](C) 317 [ ](C) [ ](C) 318 [ ](C) [ ](C) 319 [ ](C) [ ](C)

Appendix E, as provided in this report, is a snapshot of a living document. It should be noted that the prioritization noted in Appendix E is used for management of the resolution of items for the execution of PV and is not intended to provide a final determination on the impact of the change as described below.

The information in the living document described above is being transferred into the CEG work management system, and where configuration control by the Design Team will continue. The Design Team will continue to identify, categorize, and prioritize items to facilitate their disposition.

48

All HSI display and procedure comments captured are to be dispositioned by the Design Team. These dispositions will be reviewed by the HSI Design and Validation Team for operational issues and by the HFE Process Team for HFE issues related to the HSI Style Guide [6].

HSIs used for PV as captured in Appendix B are being transferred to the vendor. This report documents the displays in a configuration controlled manner. These will be formally communicated to the vendor following CEG procedures.

The action tracking for each comment dispositioned to be incorporated in the HSI design will be validated for OEM implementation and closed upon design team validation during FAT. The completion of the Design Team activities will be documented in an action tracking assignment. Items in Appendix E are to be dispositioned if at all possible before ISV. Some may remain open at the time HSI design is completed. Those items remaining following design completion will be dispositioned using the criteria described below. All dispositions will be captured in the CEG work management system as described above.

Open items that exist prior to ISV are to be prioritized following the criteria in the HFE Program Plan

[2]:

Priority 1: Have direct, indirect, or potential safety or plant availability consequences and require resolution prior to modification being placed in service.

Priority 2: Potential consequences to plant performance operability or personal performance and formal disposition (resolution prior to the modification being placed in service, deferred resolution at next available opportunity, or accept as is) shall be documented.

Priority 3: Other (not meeting Priority 1 or Priority 2 criteria).

6 REFERENCES

1. NRC. 2016. Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition - Human Factors Engineering. NUREG-0800, Revision 3, Chapter 18.

2. Joe, J., Hunton, P., and Kovesdi, C., 2022. Human Factors Engineering Program Plan for Constellation Safety-Related Instrumentation and Control Upgrades. INL/RPT-22-68693, Idaho National Laboratory.

3. Hunton, P., Joe, J., Kovesdi, C., 2023. Limerick Safety-Related Instrumentation and Control Upgrade Human Factors Engineering Conceptual Verification Report. INL/RPT-23-71063, Idaho National Laboratory

4. NRC. 2012. Human Factors Engineering Program Review Model. NUREG-0711, Revision 3.

5. Kovesdi, Casey et al. 2022. Human Factors Engineering Combined Functional Requirements Analysis, Function Allocation, and Task Analysis for the Limerick Control Room Upgrade: Results Summary Report. INL/RPT-22-68995, Idaho National Laboratory.

6. Kovesdi, Casey. 2022. Human-System Interface Style Guide for Limerick Generating Station.

INL/RPT-22-68558, Idaho National Laboratory.

7. Limerick Generating Station Updated Final Safety Analysis Report (UFSAR). Revision 19.

8. Limerick Generating Station Probabilistic Risk Assessment Summary Notebook. LG-PRA-013, Revision 4.

9. Joe, J., Hunton, P., Kovesdi, C., and Mohon, J. 2022. Human Factors Engineering Operating Experience Review of the Constellation Limerick Control Room Upgrade: Results Summary Report.

INL/RPT-22-68703, Idaho National Laboratory.

49

10. 2002. Human-System Interface Design Review Guidelines. NUREG-0700, Revision 2.

11. Specification for Post-Fire Safe Shutdown Program Requirements at Limerick Generating Station.

Specification NE-294, Revision 5.

12. Operator Response Time Program at Limerick Generating Station. OP-LG-102-106, Revision 14.

13. LGS PIMS Commitment NBR-T04602, Source Document 1 - RAI Response for AST, Statement of Commitment per RAI for AST dated 10-10-05.

14. 2007. Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire. NUREG-1852.

15. U.S. Nuclear Regulatory Commission. 2015. Workload, Situation Awareness, and Teamwork.

NUREG/CR-7190, U.S. Nuclear Regulatory Commission.

https://www.nrc.gov/docs/ML1507/ML15078A397.pdf

16. Kovesdi, C. and J. Joe. 2019. Exploring the Psychometrics of Common Post-Scenario Human Factors Questionnaires of Workload, Situation Awareness, and Perceived Difficulty. INL/CON 45444, Idaho National Laboratory. https://www.osti.gov/servlets/purl/1669050.

17. ANSI/ANS-3.5, Nuclear Power Plant Simulators for Use in Operator Training and Examination.

(2009)

18. Jamieson, G., Skraaning, G., & Joe, J.C. (2022). The B737 MAX Accidents as Operational Experiences with Automation Transparency, IEEE Transactions on Human-Machine Systems, 52(4),

794-797. doi: 10.1109/THMS.2022.3164774 50

Appendix A Key HSI Style Guide Attributes for Preliminary Validation HSI Development Limerick Safety-Related Upgrade: HSI Design Review Guide Revision 2 This guide provides human factors engineering (HFE) design guidance to support CV/ PV activities, using select guidance from the HSI style guide (INL-RPT-22-68558) and associated technical guidance from NUREG-0700 (Revision 2) and APP-OCS-J1-002.

This information as captured in the CV report [3] was not changed for PV. Please see Reference 3 if it is desired to review this information.

51

Page intentionally left blank 52

Appendix B Human-System Interface Displays Developed for Preliminary Validation Plant Protection System Displays

[

] (C)

Figure B-1: PPS Navigation Menu.

53

[

] (C)

Figure B-2: System Safety Status 54

[

] (C)

Figure B-3: Bypass Menu Modification Summary when compared to CV:

Additional Functionality Added to enable dynamic control as referenced in Section 3.1.2.1.

55

[

] (C)

Figure B-4: Transient Response Modification Summary when compared to CV:

Additional Information Added as referenced in Section 3.1.2.1.

56

[

] (C)

Figure B-5: SCRAM Mechanical Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

57

[

] (C)

Figure B-6: SCRAM Instruments Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

58

[

] (C)

Figure B-7: SCRAM Logic Status Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

59

[

] (C)

Figure B8: RCIC System.

Modification Summary when compared to CV:

Additional Functionality added per Section 3.1.2.1.

60

[

] (C)

Figure B-9: RCIC Instruments Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

61

[

] (C)

Figure B-10: RCIC Logic Status Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

62

[

] (C)

Figure B-11: HPCI System Modification Summary when compared to CV:

Additional Functionality added per Section 3.1.2.1.

63

[

] (C)

Figure B-12: HPCI Instruments Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

64

[

] (C)

Figure B-13: HPCI Logic Status Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

65

[

] (C)

Figure B-14: Pressure Control Modification Summary when compared to CV:

Additional Functionality Added to enable dynamic control as referenced in Section 3.1.2.1.

66

[

] (C)

Figure B-15: ADS Instruments Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

67

[

] (C)

Figure B-16: ADS Logic Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

68

[

] (C)

Figure B-17: Core Spray Division 1 Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

69

[

] (C)

Figure B-18: Core Spray Division 2 Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

70

[

] (C)

Figure B-19: Core Spray Instruments Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

71

[

] (C)

Figure B-20: Core Spray Logic Status Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

72

[

] (C)

Figure B-21: RHR System Division 1 Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

73

[

] (C)

Figure B-22: RHR System Division 2 Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

74

[

] (C)

Figure B-23: RHR System Division 3 Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

75

[

] (C)

Figure B-24: RHR System Division 4 Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

76

[

] (C)

Figure B-25: RHR Instruments 77

[

] (C)

Figure B-26: RHR Logic Status Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

78

[

] (C)

Figure B-27: NSSS 79

[

] (C)

Figure B-28: Containment Instruments 1 80

[

] (C)

Figure B-29: Containment Logic 1 81

[

] (C)

Figure B-30: Standby Logic Control System 82

[

] (C)

Figure B-31: MSIVS ad Drains 83

[

] (C)

Figure B-32: Sample 84

[

] (C)

Figure B-33: RWCU Status 85

[

] (C)

Figure B-34: Containment Atmosphere Control Overview 86

[

] (C)

Figure B-35: Primary Containment Instrument Gas 87

[

] (C)

Figure B-36: Reactor Enclosure and Refuel Floor HVAC Logic 88

[

] (C)

Figure B-37: Trends Menu 89

[

] (C)

Figure B-38: Post Accident Monitoring System Instruments Modification Summary when compared to CV:

Additional Indications Added per Section 3.1.2.1.

90

[

] (C)

Figure B-39: PAMS Large Format Division 1 Modification Summary when compared to CV:

Additional Indications Added per Section 3.1.2.1 91

[

] (C)

Figure B-40: PAMS Large Format Division 2 Modification Summary when compared to CV:

Additional Indications Added per Section 3.1.2.1 92

[

] (C)

Figure B-41: PAMS Large Format Division 3 Modification Summary when compared to CV:

Additional Indications Added per Section 3.1.2.1 93

[

] (C)

Figure B-42: PAMS Large Format Division 4 Modification Summary when compared to CV:

Additional Indications Added per Section 3.1.2.1 94

[

] (C)

Figure B-43: ECCS Visual Status 95

[

] (C)

Figure B-44: Isolation Visual Status 96

[

] (C)

Figure B-45: Core Cooling Visual Status 97

[

] (C)

Figure B-46: Primary Containment Visual Status 98

[

] (C)

Figure B-47: Secondary Containment Visual Status 99

[

] (C)

Figure B-48: Trips Visual Status and Return to Normal 100

[

] (C)

Figure B-49: ATWS Modification Summary when compared to CV:

Additional Functionality and Information Added as referenced in Section 3.1.2.1.

101

[

] (C)

Figure B-50: T-270 Modification Summary when compared to CV:

Additional Information Added as referenced in Section 3.1.2.1.

102

[

] (C)

Figure B-51: HPCI Steam Leak Detection Trends 103

[

] (C)

Figure B-52: RCIC Steam Leak Detection Trends 104

[

] (C)

Figure B-53: Cabinet Status 105

[

] (C)

Figure B-54: Scram Instruments Trends 106

[

] (C)

Figure B-55: Event List 107

[

] (C)

Figure B-56: Pipeway Steam Leak Detection Trends 108

[

] (C)

Figure B-57: Containment Instruments Page 2 Modification Summary when compared to CV:

Omitted from CV Report inadvertently.

109

[

] (C)

Figure B-58: Containment Instruments Page 3 Modification Summary when compared to CV:

Omitted from CV Report inadvertently.

110

[

] (C)

Figure B-59: Containment Instruments Page 4 Modification Summary when compared to CV:

Omitted from CV Report inadvertently.

111

[

] (C)

Figure B-60: Containment Logic Page 2 Modification Summary when compared to CV:

Omitted from CV Report inadvertently.

112

[

] (C)

Figure B-61: Containment Logic Page 3 Modification Summary when compared to CV:

Omitted from CV Report inadvertently.

113

[

] (C)

Figure B-62: HPCI System Division 2 Modification Summary when compared to CV:

Omitted from CV Report inadvertently. Additional Functionality added per Section 3.1.2.1.

114

[

] (C)

Figure B-63: HPCI System Division 3 Modification Summary when compared to CV:

Omitted from CV Report inadvertently. Additional Functionality added per Section 3.1.2.1.

115

[

] (C)

Figure B-64: HPCI System Division 4 Modification Summary when compared to CV:

Omitted from CV Report inadvertently. Additional Functionality added per Section 3.1.2.1.

116

[

] (C)

Figure B-65: RCIC System Division 2 Modification Summary when compared to CV:

Omitted from CV Report inadvertently. Additional Functionality added per Section 3.1.2.1.

117

[

] (C)

Figure B-66: RCIC System Division 3 Modification Summary when compared to CV:

Omitted from CV Report inadvertently. Additional Functionality added per Section 3.1.2.1.

118

[

] (C)

Figure B-67: RCIC System Division 4 Modification Summary when compared to CV:

Omitted from CV Report inadvertently. Additional Functionality added per Section 3.1.2.1.

119

[

] (C)

Figure B-68: Rack and Card Status Modification Summary when compared to CV:

Omitted from CV Report inadvertently.

120

[

] (C)

Figure B-69: Summary Alerts Modification Summary when compared to CV:

Omitted from CV Report inadvertently.

121

[

] (C)

Figure B-70: MISC PCIV/BBB&V (New to PV) 122

[

] (C)

Figure B-71: Tagout Menu (New to PV) 123

[

] (C)

Figure B-72: Scram Visual Status (New to PV) 124

[

] (C)

Figure B-73: RWCU Steam Leak Detection Trends (New to PV) 125

[

] (C)

Figure B-74: OBMSIV Room Steam Leak Detection Trends (New to PV) 126

[

] (C)

Figure B-75: Tunnel Steam Leak Detection Trends 1 (New to PV) 127

[

] (C)

Figure B-76: RHR Steam Leak Detection Trends 1 (New to PV) 128

[

] (C)

Figure B-77: Trips Return to Normal Menu 1 (New to PV) 129

[

] (C)

Figure B-78: T-227 (New to PV) 130

[

] (C)

Figure B-79: T-229 (New to PV) 131

[

] (C)

Figure B 80: Example Tagout Menu (New to PV) 132

Distributed Control System Displays

[

] (C)

Figure B-81: Ovation Graphics Navigation Menu

[

] (C)

Figure B-82: Redundant Reactivity Control System Additional Changes made to functionality referenced in section 3.2.2.1 133

[

] (C)

Figure B-83: Diverse Protection System Menu Modification Summary when compared to CV:

Additional Navigation Displays Added per Section 3.1.2.1.

134

[

](C)

Figure B-84: Diverse Protection System HUD Modification Summary when compared to CV:

Additional Information Added as referenced in Section 3.1.2.1.

135

[

] (C)

Figure B-85: DPS Level and Containment Cooling

[

] (C)

Figure B-86: DPS Pressure Control and Isolation 136

[

] (C)

Figure B-87: Transient Response Modification Summary when compared to CV:

Additional Information Added as referenced in Section 3.1.2.1.

137

[

] (C)

Figure B-88: SRV AOA Modification Summary when compared to CV:

Additional Information Added as referenced in Section 3.1.2.1.

138

[

] (C)

Figure B-89: LP ECCS 139

[

] (C)

Figure B-90: A RHR AOA Modification Summary when compared to CV:

Additional Information Modified as referenced in Section 3.1.2.1.

140

[

] (C)

Figure B-91: B RHR AOA Modification Summary when compared to CV:

Additional Information Modified as referenced in Section 3.1.2.1.

141

[

] (C)

Figure B-92: AOA Systems Menu Modification Summary when compared to CV:

Navigation Modified as referenced in Section 3.1.2.1.

142

[

] (C)

Figure B-93: Standby Liquid Control System

[

] (C)

Figure B-94: Recirc 143

[

] (C)

Figure B-95: CAC

[

] (C)

Figure B-96: Reactor HUD-1 Modification Summary when compared to CV:

Additional Information and Functionality Added as referenced in Section 3.1.2.1.

144

[

] (C)

Figure B-97: A/C ECCS HUD-2 Modification Summary when compared to CV:

Additional Information and Functionality Added as referenced in Section 3.1.2.1.

145

[

] (C)

Figure B-98: B/D ECCS HUD-3 Modification Summary when compared to CV:

Additional Information and Functionality Added as referenced in Section 3.1.2.1.

146

[

] (C)

Figure B-99: Containment HUD-4 Modification Summary when compared to CV:

Additional Navigation Function Added per Section 3.1.2.2.

147

[

] (C)

Figure B-100: Annunciator Menu

[

] (C)

Figure B-101: 107 Reactor Annunciator 148

[

] (C)

Figure B-102: 113 Cool A Annunciator

[

] (C)

Figure B-103: 114 Cool B Annunciator 149

[

] (C)

Figure B-104: 115 PRI/SEC CONT Annunciator

[

] (C)

Figure B-105: 116 AOA Annunciator Modification Summary when compared to CV:

Additional Information Added as referenced in Section 3.1.2.1.

150

[

] (C)

Figure B-106: A/C Core Spray AOA (New to PV)

[

] (C)

Figure B-107: C RHR AOA (New to PV) 151

[

] (C)

Figure B-108: RCIC AOA (New to PV)

[

] (C)

Figure B-109: B/D Core Spray AOA (New to PV) 152

Figure B-110: D RHR AOA (New to PV)

[

] (C)

Figure B-111: HPCI AOA (New to PV)

[

] (C) 153

[

] (C)

Figure B-112: PCIG (New to PV) 154

Appendix C Simulator Exercise Guides 155

[

] (C) 156

[

] (C) 157

[

] (C) 158

[

] (C) 159

[

] (C) 160

[

] (C) 161

[

] (C) 162

[

] (C) 163

[

] (C) 164

[

] (C) 165

[

] (C) 166

[

] (C) 167

[

] (C) 168

[

] (C) 169

[

] (C) 170

[

] (C) 171

[

] (C) 172

173

[

] (C) 174

[

] (C) 175

[

] (C) 176

[

] (C) 177

[

] (C) 178

[

] (C) 179

[

] (C) 180

[

] (C) 181

[

] (C) 182

[

] (C) 183

[

] (C) 184

[

] (C) 185

[

] (C) 186

[

] (C) 187

[

] (C) 188

[

] (C) 189

[

] (C) 190

[

] (C) 191

[

] (C) 192

[

] (C) 193

194

[

] (C) 195

[

] (C) 196

197

[

] (C) 198

[

] (C) 199

[

] (C) 200

[

] (C) 201

[

] (C) 202

[

] (C) 203

[

] (C) 204

[

] (C) 205

[

] (C) 206

[

] (C) 207

[

] (C) 208

[

] (C) 209

[

] (C) 210

[

] (C) 211

[

] (C) 212

[

] (C) 213

214

[

] (C) 215

[

] (C) 216

[

] (C) 217

[

] (C) 218

[

] (C) 219

[

] (C) 220

[

] (C) 221

[

] (C) 222

[

] (C) 223

[

] (C) 224

[

] (C) 225

[

] (C) 226

[

] (C) 227

[

] (C) 228

[

] (C) 229

[

] (C) 230

231

[

] (C) 232

[

] (C) 233

[

] (C) 234

[

] (C) 235

[

] (C) 236

[

] (C) 237

[

] (C) 238

[

] (C) 239

[

] (C) 240

[

] (C) 241

[

] (C) 242

[

] (C) 243

[

] (C) 244

[

] (C) 245

246

[

] (C) 247

[

] (C) 248

[

] (C) 249

[

] (C) 250

[

] (C) 251

[

] (C) 252

[

] (C) 253

[

] (C) 254

[

] (C) 255

[

] (C) 256

[

] (C) 257

[

] (C) 258

[

] (C) 259

[

] (C) 260

[

] (C) 261

[

] (C) 262

[

] (C) 263

[

] (C) 264

[

] (C) 265

[

] (C) 266

[

] (C) 267

[

] (C) 268

269

[

] (C) 270

[

] (C) 271

[

] (C) 272

[

] (C) 273

[

] (C) 274

[

] (C) 275

[

] (C) 276

[

] (C) 277

[

] (C) 278

[

] (C) 279

[

] (C) 280

[

] (C) 281

[

] (C) 282

[

] (C) 283

[

] (C) 284

[

] (C) 285

[

] (C) 286

[

] (C) 287

288

[

] (C) 289

[

] (C) 290

[

] (C) 291

[

] (C) 292

[

] (C) 293

[

] (C) 294

[

] (C) 295

[

] (C) 296

[

] (C) 297

[

] (C) 298

[

] (C) 299

[

] (C) 300

[

] (C) 301

[

] (C) 302

303

[

] (C) 304

[

] (C) 305

[

] (C) 306

[

] (C) 307

[

] (C) 308

[

] (C) 309

[

] (C) 310

[

] (C) 311

[

] (C) 312

[

] (C) 313

[

] (C) 314

[

] (C) 315

[

] (C) 316

[

] (C) 317

[

] (C) 318

319

[

] (C) 320

Appendix D Scenario Operational Sequence Diagrams and Results for Preliminary Validation Manual Actions Scenario #1: Stuck Open SRV / HPCI Steam Leak / T-103 Blowdown Operational Sequence Diagram Observed HSI and Procedure Validation Team Performance Timeline CV-1: Place RHR System in Suppression Pool Cooling

[

] (C) 321

Summary Results from Observations, Timeline, and Survey Results 322

Scenario #2: Loss of Division 1 DC / Loss of Feed / DW Leak / Low level Operational Sequence Diagram 323

HSI and Procedure Validation Team Performance Timelines CV 5: Inhibit ADS [non-ATWS]

[

] (C)

CV 2: Open S, H, M, E, K SRVs Using Division 3 Power from AER (note new task will be from the MCR using Division 3 PPS or Ovation display)

[

] (C) 324

Summary Results from Observations, Timeline, and Survey Results 325

Page intentionally left blank 326

Scenario #3: DBA LOCA/LOOP with D13 failure Operational Sequence Diagram HSI and Procedure Validation Team Performance Timeline CV3: Inject Standby Liquid Control Following a Design Basis Accident LOCA for pH Control For CV3, the need to perform this action was identified early in the scenario. Procedure directs, however, that this action not be performed until 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months after the initiating event. Time was compressed in the simulator to the three-hour point and the time to perform the action was recorded as 11.93 minutes. A detailed timeline for this action was not developed.

327

Summary Results from Observations, Timeline, and Survey Results 328

Scenario #4: Group 1 MSIV Isolation / RCIC and Control Rod Drive Issues Operational Sequence Diagram HSI and Procedure Validation Team Performance Timeline CV5: Inhibit ADS (non-ATWS)

For this scenario, operators were able to address the subject event following procedures in such a manner that manual action under study (CV5- Inhibit ADS [non-ATWS]) was not required to be performed. Consequently, no performance timeline was recorded. The action under study for this scenario as identified above was performed in scenarios 2 and 7.

329

Summary Results from Observations, Timeline, and Survey Results 330

Scenario #5: Station Blackout Operational Sequence Diagram HSI and Procedure Validation Team Performance Timeline CV4: Station blackout action - if HPCI auto started then secure HPCI within 10 minutes of SBO event

[

] (C) 331

Summary Results from Observations, Timeline, and Survey Results 332

Scenario #6: Control Rod Scram, Scram Discharge Volume Hi Level, ATWS, Turbine-Generator Trip, T-217 Termination Operational Sequence Diagram HSI and Procedure Validation Team Performance Timeline CV7: Inhibit ADS (ATWS)

[

] (C) 333

Summary Results from Observations, Timeline, and Survey Results 334

Scenario #7: LOOP / Ovation loss / DW Leak / Blowdown on Low Level Operational Sequence Diagram HSI and Procedure Validation Team Performance Timeline CV5: Inhibit ADS (non-ATWS)

[

] (C) 335

Summary Results from Observations, Timeline, and Survey Results 336

Scenario #8: Loss of Shutdown Cooling As discussed in Section 4.3.2.2, no OSD or associated HSI and Procedure Validation Team Performance Timeline was produced for this scenario.

Summary Results from Observations, Timeline, and Survey Results 337

Page intentionally left blank 338

Scenario #9: Steamline Rupture Inside DW with a Failure of PPS Operational Sequence Diagram For CV6, the need to perform this action was procedurally driven rather than addressing conditions of the plant.

That is, the action to perform emergency depressurization by opening the five SRVs was performed per procedural direction in T-112. However, the leak presented in SEG #9 was large enough to have already depressurized the RPV at the time of performing the action of opening the five SRVs, so this command had no direct effect on the plant. Despite the observed action of CV6 being only procedurally driven, time to implement the action of opening the five SRVs was recorded to demonstrate that the operators can perform this action within the established acceptance criteria.

Summary Results from Observations, Timeline, and Survey Results 339

Page intentionally left blank 340

Appendix E Comments to Displays and Procedures Developed for Conceptual Verification and Preliminary Validation 341

342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 Appendix F Navigation Click Structure for PPS and DCS This information as captured in the CV report [3] was not changed for PV. Please see Reference 3 if it is desired to review this information.

359

Attachment 3 License Amendment Request Supplement Limerick Generating Station, Units 1 and 2 Docket Nos. 50-352 and 50-353 CEG Affidavit for INL/RPT-23-71903 Revision 0

AFFIDAVIT for INL/RPT-23-71903 Page 1 of 2 Constellation Energy Generation, LLC AFFIDAVIT State of Maryland:

County of Montgomery:

(1) I, Darani Reddick, Director-Licensing, have been specifically delegated and authorized to apply for withholding and execute this Affidavit on behalf of Constellation Energy Company, LLC (CEG).

(2) I am requesting the proprietary portions of INL/RPT-23-71903, Revision 0, (HFE PV RSR) be withheld from public disclosure under 10 CFR 2.390.

(3) I have personal knowledge of the criteria and procedures utilized by CEG in designating information as a trade secret, privileged, or as confidential commercial or financial information.

(4) Pursuant to 10 CFR 2.390, the following is furnished for consideration by the Commission in determining whether the information sought to be withheld from public disclosure should be withheld:

(i) The information sought to be withheld from public disclosure is owned and has been held in confidence by CEG and is not customarily disclosed to the public.

(ii) The information sought to be withheld is being transmitted to the Commission in confidence and, to CEG knowledge, is not available in public sources.

(iii) CEG notes that a showing of substantial harm is no longer an applicable criterion for analyzing whether a document should be withheld from public disclosure.

Nevertheless, public disclosure of this proprietary information is likely to cause substantial harm to the competitive position of CEG because it would enhance the ability of competitors to provide similar technical evaluation justifications and licensing defense services for commercial power reactors without commensurate expenses. Also, public disclosure of the information would enable others to use the information to meet NRC requirements for licensing documentation without purchasing the right to use the information.

(5) CEG has policies in place to identify proprietary information. Under that system, information is held in confidence if it falls in one or more of several types, the release of which might result in the loss of an existing or potential competitive advantage, as follows:

(a) The information reveals the distinguishing aspects of a process (or component, structure, tool, method, etc.) where prevention of its use by any of CEGs competitors without license from CEG constitutes a competitive economic advantage over other companies.

(b) It consists of supporting data, including test data, relative to a process (or component, structure, tool, method, etc.), the application of which data secures a competitive economic advantage (e.g., by optimization or improved marketability).

AFFIDAVIT for INL/RPT-23-71903 Page 2 of 2 (c) Its use by a competitor would reduce their expenditure of resources or improve their competitive position in the design, manufacture, shipment, installation, assurance of quality, or licensing a similar product.

(d) It reveals cost or price information, production capacities, budget levels, or commercial strategies of CEG, its customers or suppliers.

(e) It reveals aspects of past, present, or future CEG or customer funded development plans and programs of potential commercial value to CEG.

(f) It contains patentable ideas, for which patent protection may be desirable.

(6) The attached document is bracketed, [ ]C, and marked to indicate redacted proprietary information. The bases for withholding falls under 5(a) and/or 5(b) discussed above.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 23rd day of June 2023. Digitally signed by Reddick, Reddick, Darani M.

Darani M. Date: 2023.06.23 15:28:34 -04'00' Signed electronically by: ________________________

v t e Letter Sequence Supplement
EPID:L-2022-LLA-0140, Review of Limerick Generating Station Defense in Depth and Diversity Common Cause Failure Coping Analysis, WNA-AR-01074-GLIM-P, Rev 1. Without Attachment 3 Enclosure (Open)
Initiation Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request Acceptance, Acceptance, Acceptance, Acceptance, Acceptance Supplement, Supplement, Supplement, Supplement, Supplement, Supplement, Supplement, Supplement, Supplement, Supplement, Supplement, Supplement Administration Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting, Meeting Questions 21 March 2024 26 January 2024 16 February 2024 Answers 26 February 2024 7 March 2024 18 March 2024 3 May 2024 14 June 2024 Results Approval... Other: ML22353A632, ML23032A244, ML23187A096, ML23241A945, ML24093A091, ML24208A159, ML24243A048, ML24263A003
MONTHYEAR2023-02-23 [Table View]

ML23177A224

Text

Subject:

References:

Navigation menu

Search