ML17054A167

Summary Rept & Program Plan for Control Room Design Review.

ML17054A167
Person / Time
Site:	Nine Mile Point
Issue date:	09/30/1983
From:	NIAGARA MOHAWK POWER CORP.
To:
Shared Package
ML17054A166	List: ML17054A165 ML17054A167
References
RTR-NUREG-0737, RTR-NUREG-737, TASK-1.D.1, TASK-TM NUDOCS 8310180102
Download: ML17054A167 (46)

Text

NIAGARA MOHAWK POWER CORPORATION NINE MILE POINT UNIT 1 DOCKET 50-220 DPR-63

SUMMARY

REPORT AND PROGRAM PLAN FOR THE CONTROL ROOM DESIGN REVIEW E 'DR~

8310180102 830930 PDR ADGCK 05000220

C r

\ I I '.'" I>4Jli, -' Jy

'I k

l

TABLE OF CONTENTS Subject ~Pa e 1.0 Introduction 2.0 Executive Summary 3.0 Definitions 4.0 Summary of Completed Activities 4, 4.1 General Layout and Environment 4.2 Control Panels 4.3 Instrumentation and Hardware 4.4 Annunciators 4.5 Computers 4.6 Procedures 4.7 Training 10 4.8 Licensee Event Report Analysis 10 4.9 Operator Interview 10 4.10 Emergency Procedure Task Analysis 5.0 Outstanding Activities 12 5.1 Supplemental Check 1 i st 12 5.2 Update Operating Experience Review 12 5.3 Task Analysis 13 5.4 Shutdown Panel 14 5.5 Assessment of'Human Engineering Oiscrepancies 14 6.0 Management and Staffing 18 7.0 Documentation 20.

Resumes Attachment A Task Analysis Review Form Attachment B HED Review Form Attachment C

C 1.0 Introduction Investigations into the accident at Three Mile Island Unit 2 identified human error as one of the contributors. Human errors were attributed, in part, to a lack of application of human engineering principles and practices. Following the investigations the Nuclear Regulatory Commission suggested that licensees perform a human factors review of

, control rooms. Details for performing this review were documented in NUREG 0660 and NUREG 0737. Guidance was also published as NUREG 0700 and NUREG 0801.

As indicated in the referenced documents, the objective of the control room design review, is to ensure consideration of human factors in the design and operation of nuclear power plants. The review evaluates the control'room work space, instrumentation, controls and other equipment from the human factors viewpoint. The review process includes identification and assessment of potential inadequacies and takes into account system demands and operator capabilities. The end product of the review will be potential improvements to aid the operator in preventing and mitigating accidents.

Contained herein is Niagara Mohawk's Summary Report and Program Plan to address the requirements of the control room design review. This document discusses activities which have been completed and the additional remaining activities.

4

)C>

), ',",1 ~ "( f;rqflf .f 'P 4rg r tl ) Vgy( 34 $ lr'!

f' ,f

" p r '* gpt[

N4 C,I)

I'l <<()8 f ~ ~

lt', ', '-" tf)r I) it 'gg ) I

';'l (l ',) f >fIIQ ) I[) I) ")t

~ l 1> I '" *)ill g(< Itl lg ) *'I) t (

4 4 l (,"(, tt

'-p )ry" 4 r f 4P'k ~ . $

I,lt) . f1/

~.J'f') tt)) ~

I, I 4( ))P 4)),P I PP(,t I '

1( "4 pjt t)'j, f,j f

~ I)

2.0 Executive Summar This document provides a description of tasks which have been completed and those remaining to fully address Item I.D.1 of NUREG 0737, Control Room Design Review. The program plan as described herein is not intended to provide step by step instructions of how control room design review activities were or will be implemented. Instead, it is intended to provide an overview of the process which has been used or which will be used by Niagara Mohawk in performing the review for Nine Mile Point Unit 1.

Section 4.0 of this document provides an overview of control room design review activities which have been completed. These activities were undertaken under the auspices of the Boiling Water Reactor Owners Group and were performed in accordance with the methodology contained in the Boiling Water Reactor Owners Group Program Plan for control room design review. This summary is being provided pursuant to our April 15, 1983 and July 7, 1983 submittals. The summary highlights the findings of completed activities and demonstrates general compliance with accepted human engineering principles. As noted in Section 5.5.3 of this document, a detailed report identifying human engineering discrepancies and outlining the method for resolving them will be submitted to the Nuclear Regulatory Commission by January 1, 1985.

Section 5.0 discusses additional activities to complete the control room design review. These activities were identified in Generic Letter 83-18 dated April 19, 1983, which summarizes the Nuclear Regulatory Commission staff review of the Boiling Water Reactor Owners Group program.

Generally, the remaining review activities will also utilize the methodology delineated in the Owners Group plan. Completion of these tasks as an Owners Group activity is still pending. Therefore, some deviation may occur if other consultants are used. Notification of significant changes to the approach presented herein will be provided.

~ I ~

',I

'(

I l' ti Id f Ii {I, "

I il dt(l llt II+ NP ~ 0 4 i'i I I tt I

'i'rf" f d II lt 'i, (ll tdt ~ ~

~ I dk I I. i "dtf ~ = ~ 1 ~

f (p,i.d {iit fk'...d((df. C'f)ft {)." I' ~

I

• I( (It~

~

Ifidt "

I

. if t

fptl I I, 'o l(,k it' (NN, g t/r IPN'1 1

I it 4 1 N

'I

~

,d ~ >> I, d ~ il f t d* 4 I,, pl Itt I

't c.'td tf)tf II ~

I I N

'ti J I{Nd 3 dJIL I" C I "i till I I ll>>k Ir: ~" C.

nfl I, d A ld d l,jj{ I

{N tl

~ I

{k, N '~ ~ t,;N, f ',. k 4 II ,f{ ~ i

't Iii

~ d

{lf

~

'll'I

~ I t, fd t,

i d.'I' I ~ lt N

I ti 1 tk

~ f d fat II',

1 f I I f f'> Nil 1 d fi,t

.3.0 Definitions The following terms as used in this document are defined to reduce ambiguity:

Assessment Team- A group of individuals responsible for assessing human engineering discrepancies identified during the review process of the control room design review. This group performs the assessment and implementation functions of the control room design review.

Control Room- A static verification of the control room Survey performed by comparing the existing control room instrumentation and layout with selected human engineering design criteria, i.e. the Boiling Water Reactor Owners Group checklist.

Emergency Operating - Plant procedures based on symptoms which provide Procedure guidance on operator actions to mitigate transients and accidents.

Enhancement- Surface modifications that do not involve major physical changes, i.e. paint, tape and labeling.

Human Engineering- A characteristic of the control room which does not Discrepancy fully comply with the human engineering criteria used as a benchmark for design suitability considering the roles and capabilities of the operator.

Review Team- A group of individuals responsible for performing the review portion of the control room design review.

This includes completing survey checklists, operating experience review, operator interviews and task analysis.

Task Analysis- The process of identifying and examining operator tasks in order to identify conditions, instruments, skills, etc. necessary to perform that task. In the control room design review context, task analysis is used to determine individual tasks that must be completed to allow successful emergency response operations.

Validation- The process of determining whether the control room operating crew can perform their tasks effectively given the control room instrumentation, procedures and training. In the control room design review context, validation implies a dynamic performance evaluation.

Verification- The process of determining whether instrumentation, controls and other equipment exists to meet the specific requirements of the emergency tasks performed by operators. In the control room design review context, verification implies a static check of instrumentation against human engineering criteria.

I U

lt it, l

ii I~

~ I

4.0 Summar of Com leted Activities Niagara Mohawk Power Corporation has participated in the Boiling Water Reactor Owners Group control room design review program. The Nuclear Regulatory Commission has reviewed that program and concluded that it provides an acceptable approach to the planning and review phases of the control room design review. However, additional tasks were identified by the Nuclear Regulatory Commission as being necessary in order to fully respond to Item I.D.l of NUREG 0737. Those tasks are addressed in Section 5.0 of this document. Provided below is a synopsis of the efforts which have been completed at Nine Mile Point Unit l.

During July 1981, a human factors engineering review of the Nine Mile Point Unit 1 control room was performed. The review was performed in conjunction with representatives of other utilities and under the auspices of the Boiling Water Reactor Owners Group Subcommittee on Control Room Design Review. All aspects of the review were conducted in accordance with procedural and evaluation guidelines contained in the Boiling Water Reactor Owners Group Program Plan. The review utilized a multi-disciplinary team of individuals. Resumes for the participants in the review are provided as Attachment A. As can be seen from the resumes, the team members provided a cross section of engineering, operating and human factors experience.

The review consisted of an evaluation of panel layout and design, instrumentation and hardware, annunciators, computers, procedures, environment and training. Additionally, the review encompassed an analysis of Licensee Event Reports, operator interviews and task analysis. General findings, which are discussed below, were that the Nine Mile Point Unit 1 control room is of a relatively superior design and layout. The specific findings, i.e. the individual checklists and interview results, are not contained in this document. However, they are available for review. Where appropriate, outstanding (i.e. not yet corrected) survey checklist items with an evaluation product, as determined by the methodology discussed in the program plan, equal to or greater than nine are listed. Briefly, this evaluation product provides a numerical rating from 1 to 12 and is found by multiplying numerical ratings indicating degree of compliance with the checklist item and the potential for contributing to operator error. The higher the rating, the more severe the potential deficiency. This abbreviated listing provides a summary of the potential human engineering discrepancies deemed most likely to lead to operator error. The potential deficiencies identified below wi 11 be evaluated during the assessment phase, as discussed in Section 5.5. However, our preliminary judgment is that none of these potential deficiencies pose an immediate safety concern.

4.1 General Layout and Environment The control room arrangement for Nine Mile Point Unit 1 is shown in Figure 1. The control room was found to be quiet, spacious and calm. The room was well lit and uncluttered. The operator lines of site to panels for control of essential systems were found to be excellent, although certain indicators on far panels would be difficult to read. However, this deficiency is somewhat offset by the use of CRT displays adjacent to the operator work station which may be used to call up certain plant variables.

'N,<<6 V

I 6 "<> ='ai W

<<6'li ~ >>

a "V,r I "I Ml hi I l I

'I'/

a I

a a << a ~ I fl Vi a" I 66 I Cg" r l ',',, f,fh';ja

."6: CV M aa 6'., i 64 Cll, v

'"6'I a ~ Ia ia F" a

6 a - 4 6 ril r

a<<

i w "a- w<<6 6 I, a ir M W M 1

If J 'J>> Jf, w I iI l I 4 I' lff <<

i'l,,

I >> J 6,"f "'Nffb N>>N

, 6.I,, W,

(,I ll a

<< c a I I I

~ I Ca

~

<< la",>>

I" '"' I > I C" v M f M a l i 4 I I~ I 6, M" I I i 6,,

O ~ a h M 4 4 a <<6, af IN

'I (' 6 I 'll I i a MN I I h'I Dh 4 a W II,'i' I

g ail <<

Il a ~

6'a 6 ~

I ~ ilf I' a>>,6 '>>) lf I l a Ni . 66."ah >

I N N'I I a J>><<

I INM 6'.6 ~i l, ~ i>>,'I ) 6

~ W I'N l I N,I

'. ll '.',." li ~ I <<ff M

a A M

~

a If M' i

Il laf. I 1J fl 6 4 r N ~ e ala ~ r a

I' I<< I W

a ~

V I 'll, i I 4 a M, >>I

4.0 Summar of Com leted Activities (cont'd) 4.1 General Layout and Environment (cont'd)

The style of the main panels and selection of devices were found to be unique. Boards are well organized and not totally filled.

Essential safety control switches, as well as load following and isolation functions are at the operators work console. Annunciators can be acknowledged from this console.

The evaluation of the control room environment included a review of communications systems, audible alarms, lighting and noise levels, heating and air conditioning, and housekeeping.

Half of the operators interviewed felt that the present communications system could be improved. An innerplant communications line dedicated to operations was suggested.

The present volume of the audible alarms may be below the level of optimum detectability. The checklist specifies a value of 20dB over background. The survey results of level measurement indicate that alarm levels may not be sufficiently louder than background noise.

Presently, there is no prioritization of audible alarms (except the fire alarmm) nor is there a distinguishing mechanism. This was suggested as a possible improvement.

Lighting, heating and air conditioning, and housekeeping were found to be adequate. Noise level surveys indicate that nominal background is within acceptable limits (65 dbA) most of the time.

This portion of the review did not identify any deficiencies with an evaluation product equal to or greater than nine.

4.2 Control Panels Control panels were evaluated against checklist standards covering anthropometrics, panel arrangements, mimic and demarcation lines, control/display grouping, color codes and labeling systems.

The majority of the controls and displays were found to be located within the recommended limits on benchboards and vertical panels.

Some controls and displays were found outside these limits. Certain displays and controls which were higher/lower than recommended heights were identified on the benchboards. Additionally, annunciators were determined to exceed the recommended height.

Although controls and displays were found to be generally grouped by position function, the use of demarcation lines and hierarchial system summary labels was identified as a potential improvement.

Additionally, the use of mimics and color coding for system identification was suggested.

Checklist items with an evaluation product equal to or greater than nine are listed below.

I 4

(

¹

¹f 4¹t),/) H,H 'r'.4 'i, ~ h ~

ff'f v

4.'V ~ ti I r 4 I E r fi)' 4' 4'44, 4

)*II = 4 I III 4 e ~ " '

¹'4 1

~ ~44

<<1

"~ .' <<4 4 4 ~

¹I I,

HH Ii I. ¹" '! ff '. Cl) 4 ¹<<f 4

' h I,iffp¹.h,)

'l A

~ h Ii t h,i hh'F, HC 4, t¹H q¹!I ~ 4 .

II

' II F 4 j

hi rh C>>, I

) ~

¹f vr

~4¹t))H¹W 1 I 4 4'r>> ~ 1 VH ff'I ~ ", )WI ~ 4 4

<<¹ 4 ¹ ' f!4

~ .<< C 4'<<<<, 4'4

'I I << I'

~ 4 I C) tl

~ f, C

~,

¹HIHI C 'i ')C

'I<<'I

)ff 4

i <<)III)4

'ih hr 11 4'C l 4 "4

¹

" C tv C,P'LVHI, l, v.

4 ~

.4, Ci ",H. iv;)

)4¹ r ). ."f Ci 4¹') ') '.)Cf¹h 4 4 C g

),'4 i

'<< IHifli¹ fi V "4¹) 4 vt )!, H~ 4 C-. m "CP- 'f I',

4 4li 4 l. 4 r Itr)l ~ ) 4.. 4 I<<AC 4

V H 4 il 4 fl 44 4 a)if l )

4 4 ¹ ) ' C fi 4 4 4 4 v fi)C . ~

I Ch *'l i I 3

4.0 Summar of Com leted Activities (cont'd) 4.2 Control Panels (cont'd)

Demarcation lines should be used to clear ly define system operating areas.

Demarcation lines could be used to separate subsystems and subgroups.

Undivided strings or matrices of components of related function should be differentiated with demarcation lines, hierarchial labeling, spacing or color coding.

Certain controls and displays are outside recommended limits on benchboards F, H, K, L, Al-A8 and vertical panels J, Bl-B8 and G.

No plant color standard exists.

Some panels contain indicating lights which may have dual meanings, or meanings not explicitly noted by additional information.

Panel labels generally are not used to specify pertinent operational limits and warnings.

Vertical scale indicators utilize a top-to-bottom lettering of labeling words adjacent to scales.

The location of labels with respect to their associated displays is not entirely consistent.

No administrative procedure is in effect to incorporate changes and modifications into operating procedures.

4.3 Instrumentation and Hardware Control room instrumentation and hardware were evaluated against checklist criteria addressing controllers, indicators, recorders, indicating lights and switches. In general, the hardware was found to comply with recommended standards. Instrumentation scales were clear and precise. Percentile scales and sealer divisions were unambiguous or immediately recognizable, although deviations from accepted criteria were identified. Interference from glare was not present.

'I N INN) tt'I I, lNIi C

II II <<I I I, Ilf ti N 'I IIOE ..

I'l ~i "

tli,'t ) 't t 'l ',<' Nl ti tttt Ntm c II II Nl ,I It,t y li It ~

'-ll IJI.N N ) /I c 't IC tht,aw(',NNIII "'tttg " l'>> -

fi tt,>>'NN N>

~ g't' C. t 4,)N I, NII K

. NNyC..I "  ! It C" I It ~ '

I tN'$., ~ I, I'INhtt If t' I It II It,t'N ,

) t f I tt III \ I tl N i c"II I '>a l II;t l d I /I" Ii et it N v N( f'l.lf I

I'NN t

N ~ Ij \ N NtrtI g,tIN I AN le C

I 4.0 Suranar of Com leted Activities (cont'd) 4.3 Instrumentation and Hardware (cont'd)

Some of the controllers were found to be located at low levels on the panels and the raise/lower functions opposite to convention.

However, the operators did not find this arrangement difficult to work with.

The use of extinguished indicating lights to indicate normal system status was identified as a potential deficiency, especially in cases where a lamp test feature is not provided. The use of labels to specify units of measurement for some recorders and color coding for normal/abnormal readings was also suggested.

Listed below are the items found to have an evaluation product equal to or greater than nine.

In general, indicator scales do not have markings showing normal/abnormal ranges.

Some indicators were identified where the scaled units did not relate to system operation.

Calibration stickers were not always present on indicators.

Printed channel numbers are not easily read on panel B recorders.

Printing devices were not always aligned such that printed values correspond to scale values.

Alarm points are not generally identified on recorders.

Dual pen recorder markings on the kV recorder, panel A3, are not distinctive - both use red ink.

Recorders do not generally indicate normal/abnormal ranges.

Single indicating lights are used in some instances where a failed bulb cannot be distinguished from a "normal" condition.

Guards to prevent inadvertent operation of handles located near the edge of control panels were not provided.

The key-lock switches on panels use common keys. The keys, however, are located in the operators desk and are not distinguished from other keys.

Some indicators possess greater than nine intermediate graduations between numbered scale divisions.

lh I k

~ lh fl .R kn "f

Rf i

'h.

k.)

ii""

Rf

'"'<<': )(Pk k

=-

k

"'.h I

hhkr,.f. RJ.[)

, t ))...

'i Rf Rf',)<k".)f; ) ff, I

I k kl h

'f k' "kJ r ) <<, )0. 1

~

r h'

') fl

'I'4 I rh, hk'.kf" I 'r fl h M

'I

s. h lt

" k r I 'h R~

rll" k',, 'X').k k, I'l,k r

" " k>>f i,

R r f k Rrkrk

~ Rf f;" h g I. 'lhr~ r tl r.l h,r hl I,R hl

~ S Rr IR'rr)rh

~ S Iii* h "I Il"', ll h'l ~ + Ri hei<

~ If C )h hhh>>'I, '"

skiff $ Il, t ~ 'h hl k h

'llh'Rl, QC hlk f IR $

) , f r I >>) k k f 'iffy,l . h) hfh Rl," kk ' 'k h ',hh 'ifhk r R Pfk h J lli)

)>> i I

f)

~ ff'f i, hl rhk R hc-

'> ~

"<<r

4.0 Summar -of-Com leted-Activities (cont'd) 4.4 Annunciators The annunciator matrices, located at the top of each panel, are generally grouped above the appropriate controls. Some cases where seemingly unrelated annunciators are mixed within the matrix were identified. Recommendations for improvement include tone discrimination and the possibility of directional audible signals.

Checklist items with an evaluation product equal to or greater than nine are listed below.

Some windows encompass two alarms. Other windows contain the multiplicity of high/low or level/pressure/temperature. Other windows do not specify systems, i.e. Ll-7 "Instrument Air Comp 11-12-13 Trip".

High priority alarm windows on panel F have both a red border around the window and illuminate by a red bulb. This practice has not been applied elsewhere in the control room.

Silence buttons for alarm response are not on control panels.

Only E console has a silence button.

No acknowledge buttons are provided. The E console silence buttons act as acknowledgement.

Alarm windows do not reflash for second alarm input.

Exit or entrance conditions per annunciator are not always provided.

Sensor identities or setpoints are not always given in the procedures for annunciator response.

References to obtain additional information with respect to annunciated conditions are not always provided.

No method is provided to assure window plate replacement in the correct location during annunciator maintenance.

No administrative procedure exists to allow prompt recognition of an out of service annunciator.

4.5 Computers The computer design and operability were evaluated against selected human factors aspects. In general, good compliance was found.

Highlights of the computer system included capability for color graphic CRT displays. These displays were found to meet human factors criteria for an operator seated directly in front of the CRTs. There were no checklist items identified with an evaluation product equal to or higher than nine. However, the following concerns were noted:

c 4

~

"I

~,I,h h't R

N R

'h Itk Nt tk')l, NR

~

R R 1" ,

'R t I

,h

~ I I hht I,

~ N I Nh

)1 1, Jl kk 1 I ~

lt F I ~ I

',,ht I ~ ll l)

N I h

4.0 Summar of Com leted Activities (cont'd) 4.5 Computers (cont'd)

The computer system is vulnerable to power interruptions.

A general lack of color standards for the displays.

4.6 Procedures Plant procedures were reviewed and evaluated in terms of availability, access, format, content, reference material and method of revision. The review was aimed at determining the effectiveness of the procedures as an aid to the operator.

Normal and emergency operating procedures were found to be readily available. However, additional space may be necessary for storing these procedures and lay down space within the area of the procedures was suggested. Technical Specifications, as-built diagrams and schematics are available to the operator. Procedural instructions for the use of individual controllers are not provided. The operator must consult either the Technical Specifications or the operating procedures for controller instructions. Annunciator response procedures are available in the operating procedures and in a separate binder. As suggested by the operator interviews, there is an apparent need to revise the method for updating the procedures in a timely fashion. However, the use of a revision summary and an expiration date on the title page of the procedures is seen as a favorable aspect.

The procedure format was found to be consistently applied, although the administrative procedure detailing procedure writing requirements does not specifically address format. This has led to some inconsistencies with respect to specifying panel locations, setpoints and expected actions.

Items with an evaluation product rated equal to or greater. than nine are listed below.

Procedural instructions for operating manual and automatic controllers do not exist.

Operator cautions and references are not effectively delineated from other steps.

Physical panel locations of referenced instrumentation and hardware are not provided.

Setpoints and sensor identities for annunciator response are not consistently given within the text.

I'I

'4)J<< 4 'I I 44,)

rl

~ ~

if) ~ )l -I" >>r, I '

li I )<<I II l

4. 4 k I 44 ' circ f 4 4 ) ~ 4 " ~ 'MI4

~ 4 44 I( I <<4 ) i 4 4 iii ',

4>> 4

'I 4

4 <<4

~ J)>>I Illa '4 I* 4 f MI<<>>',1 4 c 'c 4 44 4

, I,

~ 4)

<<f'.43,

>>M 4

- f<< c I I <<ll<<P l ~ ).I l.r <<re))444<<44 b "Ik "4 4", l)ll 4 il>>MII ~

4

. 4 C"'4 ljl)

)) i, '.r,.'l) f'll k l l ffrl,>>

)i/I )4 '

~

4 I

444.)

f )b

! I l)l I 44

= F,I ( 4

)I l 'l

<<>>fr I I

'l i" 'l it 4

~ 4 ~ I I 4

'4 l4 I I) ". )44 Il'4 4 '<<i,',."'II)"lc I( ~ . I ()

• jI

~ I4 '

• I 4 kki l ". f ." ' "bIII')-"'" '444 I I<< l -) 4)4 4

'I< ~<<l' MI,>>c, """ " ' )c F'4 . Il M

",. ))',", I') 'I ', . rffi

"'ill<< 4 I '

'r f<<fk I l<<lb

)4, 4

4 I)",4.,'I .

4)$ 4 4

II f,

c 4 l,>> )

)fI

~4 ll

) 3) <<l

<<)"'I J.IM

)b) F Ml 4

'4

~

l, abi,

<<I I'i r<<g 4 >

M<<

"r )I<<4

~

i,

'l 4

.ilk 4$ i )44 I>>>>,

\)III, ) I i pl

>>'4

)", 4

4.0 Summar of Com leted Activities (cont'd) 4.6 Procedures (cont'd)

Contingency actions or conditional instructions are not always given should expected results not be achieved.

Identification is not always given as to when or how emergency systems or automatic controls may be manually overridden.

Walkthroughs of revised procedures are not used to verify correctness, understanding and the operators ability to use the procedure.

4.7 Training Only one item was found to have an evaluation product above nine.

This was the absence of guidelines to evaluate the physical and mental condition of the oncoming shift operators on a daily basis.

Additional comments pertaining to training are contained under oper ator interviews.

4.8 Licensee Event Report Analysis Plant Licensee Event Reports and scr am reports for the preceding two years were examined to identify human factor considerations which may have contributed to operator error. The review identified two such instances. One revolved around the failure of the mechanical pressure regulator controller to follow conventional standards. The controller in question uses a lower-to-right, raise-to-left configuration, which is also opposite to the mechanical pressure regulator meter readings. The other instance (which has been corrected) identifed the lack of an alarm for plant discharge/inlet delta temperature to identify approaching Technical Specification limits.

4.9 Operator Interview Two licensed reactor operators and two licensed senior reactor operators, one of which was a shift supervisor, were interviewed.

The interviewers identified the following concerns which were discussed by more than one oper ator.

Training should emphasize daily operations as well as causes of transients and accidents and their symptoms. Too much theoretical information is presented now.

An innerplant communications system for use by operations only was suggested.

Testing should be spread out over the shifts and not concentrated into one shift.

Better information flow from management was requested.

4

~ vg f

ir

%>> Vr I ri W

"<< 'i'- I t <<

'r,W..

II WV It 4

I '4 ' ~ 4>> W 4 WE

'WA) r/',f <<rlr I W I 4, I v 4 f I-rl; A<< I WI WC" )WW ll I

', "I"' ~444 Vi f A ll fl '

~

v'l,>A>>I 4

Ii Ai'W il II I>>l )W>> '

WW>>,', Wv V, ~,

"'li II

~ , , I ,4 II W ~,

.ir 'W 'I >>~

I

',vr', Ir "W, I

,I II W << f I >>

W l 444 ~ >> il

'I'A WW If<<.,I' W 4

<<I I

~ $ II v<<=4<<vw I I I ll) ~v "I y'IV>>,l. VA<<"..

W Av N,, I C k M AV il 4 I W),rk >"'"

A) 4 ~l ~ 4 Vv 4'44 ' vl '1)>> I W l << ~ W) WW>>, v. 4 Wl II

~ gI, 4 I )W i>>" IIIW) I j )'3I, v 3 LV-I 4'I l"

~

}, iI l "I <<WI.4, '" " 'Wg', ~

'V'" W

.>>4 ~ )W c W, )V'14 A

4.0 Summar of Com leted Activities (cont'd) 4.9 Operator Interview (cont'd)

Mimics should be applied where panels contain different systems with controls located close together.

Procedures should be updated as system changes occur.

Panel L is confusing, i.e. more experience is required to learn the layout and operation of the nitrogen system.

4.10 Emergency Procedure Task Analysis The Boiling Water Reactor Owners Group performed a limited task analysis using the emergency procedure guidelines available at that time. The review was used to determine the availability of instrumentation required within the frame work of the procedures.

Additionally, task analyses and walk-through were performed for three plant procedures, "Reactor Scram", "Solenoid Activated Pressure Relief Valve Opening", and "Combined LOCA and Loss of ll5 kV". The instrumentation was reviewed to verify that entry conditions into the emergency procedures would be indicated to the operator. The review showed that parameters associated with entry into the emergency procedures are annunciated, but in some cases, more than one parameter may be represented by a single annunciator.

The review indicated that most important indications can be seen from console E and most immediate actions can be performed from the same console. Color bands on level instrumentation to indicate normal and abnormal ranges, grouping of system indicators and controls, and cautionary restraints added to the panels were identifed as positive aspects which aid the operator. The following concerns were identified.

Information on coolant temperature and therefore cooldown rate, is available only on a trend recorder fed by the process computer.

Lack of average drywell temperature and bulk suppression pool water temperature as referenced in the Emergency Procedure Guidelines.

Uncertainty in relative location of drywell temperature to reference leg .for level instrumentation could inhibit completion of Emergency Procedure Guideline actions.

The ability to correlate actual conditions to those depicted by graphical means in the Emergency Procedure Guidelines i.e.

limiting conditions determined by the relationship of two or more parameters.

Triple low level instruments are unlabeled and not graduated over the entire length of the scale.

~ ft Ih

f ff

<< ~

I* '4 fk c

f I",tf,)I I 44 I I f

~

' ~,

)I 41 ~

e I, ..

v ~

JX. w Il

,4

( I

<<f ilk

'I'g,f.";II ff"KI"Ih',I ' ll Ijff,. I() IIK.Ilh. ff,

'hl a II II I l .I 4 fflt 4 4 f Ch

'4'I AI flwwc '

' I I t

<<I 4'f"'II ",, ',Kk f ~ 'f! I,' t h,

I'

,,II If' I, 'I lh v I fr.'X ~ I,I 'why XWK I,'<< 4)

II I I 4

' Jfc,<<", c..c

' 'I f ;!

tf v I ~ ! "<<I If f;"' "'

Cww f g,l <<<<I 'Kl '.Izl 4

' f

~ "I'.. 'Pf.,l,

~

v *II

~ I gh fcc' 4

.'I O'I

".'lf lf

'ffi f""I i (Ih I I K)I Il, 4

I f f=

i,I 44 ~

KII' 4 II'ti'

"'4= 4II,

. I "

I

'h'fv 4

lI

'.'w r.')

f w

l=,wfhflh ifh I I'r, 4

cw fflj I I IX(X f '4" II '

t '

4 h I 'I v I I lh h

If 1

I I ill

~ w t,f

4.0 Summar of Com leted Activities (cont'd) 4.10 Emergency Procedure Task Analysis (cont'd)

The review also identified several modifications which may be beneficial. These modifications typically involve changing the use of extinguished lights for status indication and improvement of visual distinction capabilities.

Additional task analyses will be performed using the site specific emergency operating procedures. The results of these analyses may identify additional potential human engineering discrepancies. As noted in Section 5.5.3, these human engineering discrepancies wi 11 be submitted in a separate report.

5.0 Outstandin Activities The Boiling Water Reactor Owners Group control room design review progr am plan has been reviewed and approved by the Nuclear Regulatory Commission, pending completion of several additional tasks as outlined in Generic Letter 83-18. These tasks include completion of the Boiling Water Reactor Owner s Group Supplemental checklist, resolution of human engineering discrepancies, task analysis using updated emergency operating procedures, updating operating experience review and inclusion of the shutdown panel in the survey. Niagara Mohawk intends to complete each of these tasks in as timely a manner as possible. Where appropriate the methodology developed by the Boiling Water Reactor Owners Group will be adhered to. Additional information regarding these tasks is provided below.

5.1 Supplemental Checklist The supplemental checklist will be completed using the methodology described in the Boiling Water Reactor Owners Group plan for the initial checklist. The supplement provides additional information to address NUREG 0700 items not covered in the original survey checklist. A human factors specialist as well as personnel with operating and instrument and control design experience will be involved in completion of the checklist. Additional personnel will be provided as necessary.

5.2 Update Operating Experience Review Scram reports and Licensee Event Reports issued since July 1981 wi 11 be reviewed to identify potential deficiencies which may have led to or contributed to operator error. The review team background will be as discussed above for the supplemental checklist. The methodology developed by the Owners Group will be followed.

I/IIW(rt "p if Ei f f.t

'I I

I rfe

'I:, 'I','I i f.

I I', l I Nr I<wf INtw f I 'l lf ttr.,

Iwf I.",

~ I, f "'"

f./I I

'I IN'l',

I'l I I f I I .I ill t,kJK I, /'w EIN II/

I t I I C l NI I '

c. I'"'i Cl II IIK6 I I'WI, W

r I II ',,"ffwf .',"

I f

~ . 3 fr I,'

f.'fI I

~

I I I w

,'I NC, lt, t,t l r'it,",,I I I I t I

'iaaf I / r C,rt l'l'I or I 1 c e' l ,/C I I KW it la 'll I II ~ -f tl ce f

I 1 ~ W'Wi

~ 'I. 'I Il't I I,'I lt re I W/

f f

Wi ll 'l I I' l Wtt(KIE

< F I

NW ~

N

5.0 Outstandin Activities (cont'd) 5.3 Task Analysis The purpose of the task analysis, as it relates to control room design review, is to evaluate operational aspects of the control room design. The task analysis will identify the tasks operators must perform during emergency operations and determine whether the instrumentation, controls, and equipment are available to perform those tasks. The analysis will validate that emergency tasks identified in the procedure can be accomplished. The basis for performing the task analysis will be the site specific symptom based emergency operating procedures or in lieu of these, the site specific emergency procedure guidelines. The methodology for performing the emergency operating procedures task analysis will generally follow that developed by the Boiling Water Reactor Owners Group. That methodology was described in the Boiling Water Reactor Owners Group program plan and clarified during the September 16, 1982 meeting between the Nuclear Regulatory Commission and the Owners Group. The methodology consists of the following:

a. Operator tasks are defined

b. Control and instrumentation requirements are specified for each operator task

c. Completeness of control room inventory is verified through comparison with instrumentation requirements established in the task analysis

d. Task sequences are validated with walk-through/

talk-throughs. Traffic patterns, communications and panel arrangements are considered.

e. Each task is analyzed in terms of the following considerations:

l. Is the sequence valid and complete2

2. Is sufficient information immediately available to the operator to complete the tasks

3. Do critical controls and displays identified for each task conform to checklist evaluation criteria.

4. Oo control/display relationships meet checklist criterial

5. Is manpower adequate to perform the tasks

6. Are traffic patterns unobstructive7

7. Is direct feedback used to verify control functions2

~

"" I Jf h" Ii -5 ',v ), h '

h h, 5)-

~ I I )U4'll hl"h.

h W>>5) ) .".h ';~, kP h l>> 5 = II C!'.

h(I h."I 5(ilt).I e' ""'-W'

• ll .. r.

~

l .,-

h . l W ht II 5>>', i)>>II, W

Ih l >>II,." W W W I II,.>>4 If f l W

~ l

~

I II )If ~

l ) )J ~"

J fh lf ~w q', C fii.'f

~ *= h ~ V h

l hl I uh ff.,

gl I' 5 )~ 5>>CIW>> Wfl I h 4 I >>. hi>> h tl II ~

'l I

~

f f f '" h:I "( h ."I"."I ~ "I " 'W I ~ f~ - W'5" 'h.!li'i' f' W h,,hl If) 'v t' ','II,I 'vrh' h I liv) l I )I f lgfh'v l>>l w l.

I ..'>>h L Ihh f,=, hil)v>> 'l W g~.11I'WLW <<, W 5 "55 ~ h f'I'f>>'I h' . 5>>

Jt>>5 " >>*I* 'h

'h I I I

hi>> Q il W ff I -II>>

W..35>>fl '. f '

~ ~

'"5 l)l'"

h h

ffi

'f Ih<f)") 5

"~ lI' 5'.,v I',v>>

S I" Ov II '>> .5.,>>,>h.vl q' h,v

~ I i>> h w,l QI5>>)>>f'I Hv, Il h I >>5 i ll I')>>J)'>>

l. E "tg>> Ãlh P( i If>>

(,I i.5 I I wl I>> 5)[ ~ 'wv w l'>> I>> hl '), ll if >>5 *>>I

5.0 Outstandin Activities (cont'd) 5.3 Task Analysis (cont'd)

A form similar to Attachment 8 will be used to tabulate the results of the task analysis. Steps a, b and c will be completed prior to the acutal walk-through/talk-through and comprise the verification portion of the task analysis. Step d represents the validation portion.

Niagara Mohawk is currently evaluating several approaches for performing the task analysis. These include using a control room mock-up, a site specific simulator or the Nine Mile Point Unit 1 control room for completing the task analysis. The final decision regarding the approach used will be based on consideration of effectiveness, cost and scheduling.

5.4 Shutdown Panel The remote shutdown panels will be reviewed against sections A, 8 and C of the initial checklist and Sections SA, SB and SC of the supplemental checklist. Personnel qualifications will be as discusssed in Section 5.1.

5.5 Assessment of Human Engineering Discrepancies The objectives of this phase are to evaluate the significance of potential human engineering discrepancies identified during the review phase and provide a technical and operational basis for resolving the human engineering discrepancy. Resolution of specific human engineering discrepancies could range from doing nothing, based on analysis, to implementation of a corrective modification.

When a decision is made to take corrective action prior to doing a detailed consequence analysis, such an analysis need not be performed. Evaluation and resolution will be the responsibility of a team of Niagara Mohawk personnel supplemented by a human factors specialist. The team members will provide experience from instrument and control design, operations, licensing and human factors engineering.

Evaluation The criteria for evaluating the human engineering discrepancies are based on the potential to adversely affect emergency operations. Human engineering discrepancies will be categorized to aid in assessing their significance and pr ioritizing corrective actions. The specific categorization will be developed from a consensus of the assessment team. The categorization process will be that developed by the Nuclear Utility Task Action Committee on control room design review. These categories are defined as follows:

) 4 .)VIW 4'w w <<

"I Il)OJ 'll il 4

.'k 4 4 ~

~ )'>> ~ 4, 'I

'I )'I

'll 4" 4 I li 'L ~ 4.'

) fw 4 f

)4 ~ 'r I'i 4<< t 4 VP 4<<I I )

MI'I Ii IW fl 4 WI 4

" V w

= 4 oil. 4 if ww<<444'44 w II" <<4 4 I 4 I, I VII N <<Iiifii 4,'1 <<4<<f 4

'.'" I'4 ') I 4I 4 4, '44

,VI ~

I II 4 4 w 4 J f ' II IV tw <<4 )4 l

. VV f.fi

~ I;.)4 viw w Il L'"

li ww 'l,,V,

>)>.4,w IV) 4 ~

l.<<Pft 4

NV '

~

liw w

)"

I II w

ww,

,Ii J '

gwl II g'>>

Vw lil 4 4

I 4 4 J 4

, i. I MLN 4, VM I <<w,'I ',wl VV i Vi.. ',,

')f MN w = ii

<<Vw) fV ~VI 4

)4) (. Mw kv 4 iw 4' MV lVVM I' 4 IV w I 4 wli w gt NL Ii 4

'I l)I= 4

~ " ~ '

4 "I<<

I 4 ~ Ilifi,lo 4 4 'lw 44'w.,

'l,)IIM f $ Ii. I F 4 Il I, '4 VV 44 4 VVV I ) f' F'4

) ,f,w J Ifi'4 4 4 4 4 I ~ o VII 4

5.0 Outstandin -Activities (cont'd) 5.5.1 Evaluation (cont'd)

Category 1 (highest priority) - Human engineering discrepancies that are judged likely to adversely affect the management of emergency conditions by control room operators. Most of the human engineering discrepancies placed in this category probably will be found during the task analysis and may be supported by the results of the survey and operating experience review.

Category 2 - Human engineering discrepancies that are known to have caused problems during normal operation. The human engineering discrepancies placed in this category will emerge during operator interviews and reviews of incident reports. Some support may come from the control room survey.

Category 3 - Human engineering discrepancies that can be "fixed" with simple and inexpensive enhancements. This may seem to be an implementation rather than an assessment category. However, there probably will be human engineering discrepancies that the assessment team feels are very easy to fix but difficult to assess as to their affect on emergency operation.

Category 4 - Human engineering discrepancies that do not fit into categories 1-3. These human engineering discrepancies are judged by the review team as unlikely to affect emergency operation, not documented as causing problems during normal operation, and not simple or easy to fix.

This particular scheme was chosen because of its simplicity and practicality. It is possible that a human engineering discrepancy may fit into more than one category. For instance, a human engineering discrepancy may be identified during the task analysis (Category 1 ranking) which can be fixed by a simple labeling effort (Category 3 ranking). In such cases the human engineering discrepancy will be placed in the higher ranking category, i.e. Category 1, where it would receive more immediate attention.

As noted in the Boiling Water Reactor Owners Group program plan, the methodology for completing the survey checklist provides a preliminary ranking"of those human engineering discrepancies identified during checklist completion.

Following the categorization process as outlined above, this Owners Group ranking will serve to prioritize human engineering discrepancies within a specific category. This tier approach will provide a method for quickly prioritizing human engineering discrepancies identified during the survey.

II I'

~

l" C

j I

(

<k II

5.0 Outstandin -Activities (cont'd) 5.5.2 Resolution One of the responsibilities of the Niagara Mohawk Assessment Team will be to recommend a solution to human engineering discrepancies which have been identified and categorized (a consensus approach will be used again). The particular solution will be based on the team's assessment as to the significance of the human engineering discrepancy. In some cases, this assessment may conclude that a "fix" is not warranted. In other cases, extensive measures may be recommended. In either case, the assessment of the human engineering discrepancy will be documented and forwarded to appropriate management personnel for review (see Attachment C). During this phase, dissenting opinions will also be documented. A detailed specification will then be prepared by the Niagara Mohawk Assessment Team for approved recommendations to ensure an organized transition to the implementation phase. Modifications will take place in accordance with existing Niagara Mohawk engineering and administrative procedures.

Several criteria will be considered when developing/

proposing human engineering discrepancy corrections. This includes but is not limited to:

Conformance to applicable precepts of human engineering practice Potential for introducing a new human engineering discrepancy Impact on operating effectiveness and impact on plant availability Consistency with existing features Impact on operator training Impact on staffing levels Recommended changes will be evaluated by the assessment team to determine effectiveness. Operations personnel will be afforded a review of proposed corrective measures.

g I C

I

~ ll L

II H

6 H

1 I 5.0 Outstandin Activities (cont'd) 5.5.3 Schedule Niagara Mohawk intends to complete the remaining tasks of the control room design review within the same time frame, i.e. during a single 10 to 14 day span. Therefore, scheduling must consider dependency on other factors, as discussed below. Completion of the task analysis is dependent on availability of site emergency operating procedures. In lieu of the emergency operating procedur es, plant specific technical guidelines or draft emergency operating procedures can be used to identify specific operator tasks. Niagara Mohawk's goal is to have the final technical guidelines and a first draft of the emergency operating procedures completed by February 1, 1984 and April 1, 1984, respectively.

Based on the above information and our current outage schedule, we are planning to complete the remaining tasks required for the review phase of the control room design review by June 1984. Review and evaluation of the control room design review data accumulated as a result of this program will then begin. Our tentative shedule for completing this review and developing corrective actions is November 1, 1984. Following completion of this review, a detailed summary report will be prepared and submitted to the Nuclear Regulatory Commission. This submittal should take place by January 1, 1985 and will provide our schedule for implementing proposed modifications.

~ ~ t

,t"rt 4', 'hl' M r I I 'it h [ I t 4lt," jt, 4 lt 4

~ 4th

't'.t

+

'ti f' ~

I III

"'4." 4

'ttt 11 I ff t

II, fr 4

'lt l If I ~ t rhett j t It 4il 4. 4 lkr. 4

,4 . f'i 1 hflt,t 4'l 4 4If.4 t irf C

$ )f I 'lf 4 t I 44

• jf4.) "4 .,i .', Ii," Ig '

t II I tl h J I h I f C it444.3';~", 4 f' 44,'.~h

~

'I' >>ii'8 ttll Itt f t Ift, tl 4, ~ tt I 4 fI 4 ~

t ~,

l*t lt iit) 4 fI f) I 4 'f <, 1'+ ~

' t ",I. I

~

I ft. I y,t t(."C' t tt ft

",." V<.

~ C-

' 't'

6.0 Mana ement and Staffin The management and administration of the control room design review is the responsibility of the Nuclear Technology Department. A program coordinator has been appointed who reports directly to the Manager, Nuclear Technology, who in turn reports to the Manager, Nuclear Engineering. The program coordinator maintains the following responsibilities:

Planning and administration of the control room design review remaining activities.

Coordinate the control room design review activities (i.e. task analysis, supplemental checklist, update experience review) including scheduling, review and obtaining necessary approvals.

This also includes coordination between consultants and in-house personnel.

Establish and maintain a documentation system.

Integration with other Supplement 1, NUREG 0737 activities.

Develop a final report for internalt management review.

Preparation of summary report for submittal to the Nuclear Regulatory Commission.

Obtaining/maintaining project personnel for completion of activities.

Niagara Mohawk has decided to use two separate teams for completing the control room design review. One team (review team) will be responsible for completing the planning and review phases. The other team (assessment team) will be responsible for the assessment and implementation and reporting phases. The program coordinator will be involved with the activities of both of these teams. The responsibilities of each of these teams is delineated further below.

Review Team Niagara Mohawk is in the process of evaluating various approaches for completing the review phases. These approaches include participation in possible future Owners Group efforts, use of an outside independent consultant and use of internal personnel with human factors consultation. Whichever approach is chosen, a primary objective wi 11 be to provide a multi -disciplinary review team which will include expertise in instrumentation and control engineering, operating experience and human factors engineering. This core group may be supplemented by other disciplines as deemed appropriate. The review group will be responsible for I Il I, II ' I << ">> ~ >>

4

~

I

>>>> I b>> I' II N

":I'N l II b'4 N l (>>>>

4

~ I >> C I

I ~

M"'1>> I II ~

~ .>> II>> H >>.>>>>.i NNN 1V >> I,l I l.c*'clc NI fc 4 'l I i

>>N',N 4, 4 II W. NI" 4 c N . I" II

. h...' "".

I I

>>>> I 4 I ,

4 ~

>> I

~ >>'. ll N W ~ wa s h<<M >>

"" (>>,II,,4~41-144>> III I" I '*" '(,

~

>> N II 1 LNN ' >>

I >>III I

'I >>

c 4

H, I

, '.. I .J N N>> 1, 4'NN>>>>, 'Nli I ',1 J N, 1, s >>,>>4 "" I I' -I Nr" 11 I >>'N I'>>", I>>c<<H

'1 . 4" 1 H cl I ~ 1'ir, >> ,)'1. ~ I II g ,4, N w

A. >> >>sl 1 II s,' 1 II 14<>> ~ 1>>

c.'N'

,>>H>>

" >> > 4"'1J.-'

~ h>>II 4

'. Nl,' ,4) c

>>I>>4) >>I 4" I' WR 4 J'>>>>I>> I I

>> 4>>

N lc "4>> I '>>N(.N Nll 0 N>>I 4,

I I ~

4 11 <<l IIM N>>INC 4 I'I' 1 I "

N

'I" C

'f>> ~

I I>>>>>> 1 N

I

'I

>> , >>N . 41

' 'H

>> I I "II 'NN, 4 4 IN

,t>>

6. 0 Mana ement and Staf fin (cont ')

Participating in planning sessions Assisting the program coordinator and other team members in individual areas of expertise Participate in completing the task analysis, supplemental checklist, operating experience update and survey of the remote shutdown panel Documenting the control room design review findings Assessment Team The Assessment Team will consist primarily of Niagara Mohawk personnel with human factors expertise provided by an independent consultant. The Assessment Team will consist of personnel with background in instrumentation and control engineering, nuclear licensing and operating experience. The Assessment Team will be responsible for evaluating humman engineering discrepancies identified by the Review Team and preparing recommendations for resolving them. The specifics of the assessment/implementation process are discussed in Section 5.5.

I VV I

.)Jt "'

I wt>dlw, V',tfM'.4 I 'l,l I llM4 I f I "i II

~

VW I I

M Mt II X

" t. M i f'V

.. t

=',' ~ .'M, ","V w j< tI

'.Mtll M ~ w J

'< << 'M i. IMV>.MMli;. ' M M, V, I,'f "i Wt . II ) I W c I

,i MM,',, f1)

Mw l,

<.' C j, ,"

I; M.

' f: MJO:. i rJ < < i". ".> i" i

'V.. lti ',,1't, lM ( M II I ' ' '>>l I M 4

Mwg f < f.>>-': '.Vitl It I l ll't M $  : I ~ ~ t" 'J

~ W ~ I It >>

I I Vt ttt, ,l

7.0 Documentation Documentation is required for traceability, retrievability and auditability of the control room design review. Niagara Mohawk intends to maintain a file of documents generated and received during the review. Maintenance of this file will- be the responsibility of the program coordinator, who will act as a focal point for document transmittals. Documentation which will be maintained includes the following:

Survey checklist results Operator interview forms Experience review forms Summary reports prepared by the Review and Assessment Teams Meeting minutes generated by the Review and Assessment Teams Assessment forms for evaluating human engineering discrepancies The above listed documents will provide the basis for identifying and resolving human engineering discrepancies. The documentation will also provide the data base from which future control room modifications will be drawn. These documents will ultimately be placed on the Nine Mile Point Unit document control system for permanent storage.

1

~I I l i a'.

L'l 4$ lf f'y II

'~p ll 'v,hit '

lfr. ~.'f I vC>'"; i<<C f L l J(f M

' )

)" >, v~ I( l% C i el'l s q ">f "ll , ~ ~,

I'. "] "' 'V II li'<>>i J1~'l'~l H il >l, p h t fi I' lfa k

'~~V. >

KITCHEN LAVATORY Bl B2 B3-BB Al A2 A3-AS COMPUTER Fl RE CONSOLE PANEL SECURITY CONSOLE SHIFT SUPERVISORS'FFICE Figure 1 CONTROL ROOM ARRANGEMENT

J i