ML17256A746
| ML17256A746 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 06/02/1983 |
| From: | Dick G Office of Nuclear Reactor Regulation |
| To: | Crutchfield D Office of Nuclear Reactor Regulation |
| References | |
| LSO5-83-06-007, LSO5-83-6-7, NUDOCS 8306060174 | |
| Download: ML17256A746 (19) | |
Text
DISTRIBUTION June 2, 1983 oc et NRC PDR Local PDR ORB Reading NSIC DCrutchfield HSmith GDick OELD ELJordan JNTaylor ACRS (10)
SEPB Docket No. 50-244 LS05-83-06-007 NEHORANDUH FOR:
Dennis th. Crutchfield, Chief'perating Reactors Branch 85 Division of Licensing FROf1:
SUBJECT:
George F. Dick, Jr., Project Manager Operating Reactors Branch 85 Division of Licensing f!EETING SUfffRARY, WESTINGHOUSE REPORT MCAP-10170, EffERGENCY RESPONSE FACILITY'DESIGN AND VGV PROCESS SVarga DVassallo RClark JStolz RSchemel LBeltracci SWeiss The meeting was requested by Westinghouse to discuss the staff review of the Westinghouse Generic Safety Parameter Display System (SPDS).
The major topic of discussion was the manner in which man-in-the-loop testing was factored into the development of the design basis and functional requirements for the SPDS.
The attendance list (Enclosure 1) and a copy of the handouts presented by Mestinghouse (Enclosure
- 2) are enclosed.
ltestinghouse conducted operator performance tests in simulated accidents with two prototype safety panels.
Analysis of the test data was based on decision process
- analysis, which in turn was derived from Ra'smussen:-'-sI model of operator behavior.
The results of the analysis were incorporated into the development of the Westinghouse SPDS.
Westinghouse maint'ains that the man-in-the-loop testing requirements have been satisfied and no further. such testing is needed prior to the qualification of their system.
on 1s expected by meed-June 19S3.
~
Original signed by/
- (Cba George F. Dick, Jr., Project ffanager Operating Reactors Branch 85 Division of Licensing 8306060174 830602 PDR ADOCK 05000244 F
Enclosures:
During the meeting Mestinghouse answered staff questions regarding how the tests were conducted and the results included in the Westinghouse SPDS.
The preliminary conclusion of the staff was that early man-in-the-loop testing was adequate for the design basis of'he display but may not eliminate the need for some additional testing of the fihal display ~'system.
Westinghouse will append the man-in-the-loop testing results, analysis and application of the results to MCAP-10170 and send it in for formal staff review.
Receipt of the informati DL OR 06/ya/83 DATE 0 OFFICEI SURNAMEP
~ ~ ~ ~ ~ o ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
~ ~ ~ ~ ~ ~
D SCru..c OS+'.i el d
/83 NRC FORM 318 (10.80) NRCM 0240 0 F FI CIAL R EGO R D CO PY USGPO: 1931~9.960
\\
0
~ '
CC Harry H. Voigt, Esquire
- LeBoeuf, Lamb, Leiby and MacRae 1333 New Hampshire Avenue, N.
W.
Suite 1100 Washington, D. C.
20036 Mr. Michael Slade 12 Trailwood Circle Rochester, New York 14618 Ezra Bialik Assistant Attorney General Environmental Protection Bureau New York State Department of Law 2 World Trade Center New York, New York 10047 Resident Inspector R. E. Ginna Plant c/o U. S.
NRC 1503 Lake Road
- Ontario, New York 14519 Director, Bureau of Nuclear Operations State of New York Energy Office Agency Building 2 Empire State Plaza
- Albany, New York 12223 Dr. Emmeth A. Luebke Atomic Safety and Licensing Board U. S. Nuclear Regulatory Commission Washington, D. C.
20555 Dr. Richard F. Cole Atomic Safety and Licensing Boar d U. S. Nuclear Regulatory Commission Washington, D. C.
20555 Dr. Thomas E. Hurley, Regional Administrator Nuclear Regulatory Commission, Region I 631 Park Avenue King of Prussia, Pennsylvania 19406 U. S. Environmental Protection Agency Region II Office ATTN:
Regional Radiation Representative 26 Federal Plaza New York, New York 10007 Herbert Grossman, Esq.,
Chairman Atomic Safety and Licensing Board U. S. Nuclear Regulatory Comnission Washington, D. C.
20555 Super visor of the Town of Ontario 107 Ridge Road West
- Ontario, New York 14519 Jay Dunkleberger New York State Energy Office Agency Building 2 Empire State Plaza
- Albany, New York 12223 Stanley B. Klimberg, Esquire General Counsel New York State Energy Office Agency Building 2 Empire State Plaza
- Albany, New York 12223 Mr. John E. Maier Vice President Electric and Steam Production Rochester Gas and Electric Corporation 89 East Avenue Rochester, New York 14649
0 ENCLOSURE 1
MAY 18, 1983 l1EETING JJESTINGHOUSE SPDS ATTENDANCE LIST Name George Dick Robert Schemel Leo Beltracci Vickie Koch John Gallagher Sy l<eiss Dave Hoods Or anization NRC/DL NRG/DHFS NRC/DHFS W NTD Nuclear Safety W NTD NRC/DHFS
APPENIO E
{TO NCAP -10170)
{NON-PROPRliRY)
APPLICATION OF SAFETY PARAt<TER DISPLAY EVALUATION PROJECT TO DESIGN OF M SPDS ENCLOSURE 2
Prepared By:
D. D. Woods -
M RSD Center, April 7, 1983 The Safety Parameter Display Evaluation project examined operator performance in simulated accidents with 2 prototype safety panels (i.e.,
man-in-the-loop testing).
Two kinds of results were derived from this study:
the study showed that analysis of operator decision making was a
useful tool to understand operator behavior; there were findings with respect to the concept of safety panels in general and the specific prototypes
- used, in particular.
The study was done during the time when Mestinghouse was in the process of developing a Safety Parameter Display System design (1980-1981).
A statistical comparison of crew performance with and without a safety panel available was not performed because of limitations imposed by the retraining program on the experimental design and because of variations in crew response strategies.
To date there has been no quantitative evaluations of a control room modification on a full scale simulator.
Instead the analysis of the data was based on decision process analysis.
This technique reveals not just what actions a crew takes but also the decisio'n process or context that led to the action.
It is important to know why and how a cr ew action was ultimate'1y successful or not successful in order to identify the useful features of a new operator aid, design deficiencies,'nd boundary conditions (e.g.,
where will a new concept help and where is it unable to help the user's decision process).
The particular decision analysis performed in th is study was derived from Rasmussen's (1979) model of operator behavior (Figure 1).
The different stages of this model were grouped into four categor ies:
- detect, interpret, control, and feedback.
The detect stage included 4232Q
KEY:
DATA PROCESSING ACTIVITIES RESULTING STATES OF KNOWLEDGE EVALUATION OF ALTERNATIVES INTERPRETATION OF SITUATION IMPLICATIONS OF PROBLEM
/y
"/O
/y GENERAL STRATEGY SYSTEM STATE P~
TASK DEFINITION
/t/p~k
~p SELECTION OF 7'pp ~~Cq~
gg GOAL S A
+S O
~Op lq TASK OR GOAL STATE IDENTIFICATION OF SYSTEM STATE 0
/
OBSERVATIONS gal@
qS 4'p Og q< q gP O~+r~
e C'P/
~cgV<O~ PS<
+g/4rg V<
+SOF J
p Pp P~RCEPT, fe.g. VP~~N T OBSERVATION 5
DATACOLLECTION PROCEDURE SELECTION ALERT STATE PROCEDURE PROCEDURE
'XECUTION ACTIVATION RELEASE OF PRESET RESPONSE R PREL
<Ryg O 0 g ED CUE)
~ON qie qP'<EO S<
O+
9 ~qg e
Fig 2.
Decision-Haking Model (Adapted from Rasmussen)
Including Feedback
a'lert, observation, ghition a'nd identification avities; the interpretation stage concerned how the crew understood plant status including the implications of system status, relevant goals and strategy planning; the control category included action selection and execution, and the feedback. stage concerned observation/data collection, recognition and identificatiqn as follow up to an operator action as opposed to the detect stage where these activities occur as a follow up to an alert.
These categories were used to chart the decision process in each test event.
The decision model provided a mechanism to generalize operator behavior and operator SPDS usage across particular tasks,
- events, and crews.
The decision analysis revealed, in the area of crew decision making, that operator problems did riot occur in the detection of initial system failures, rather they occurred with subsequent problems, either operator error/miscontrol or subsequent system failures.
These problems were associated with poor feedback about the results of control actions with respect to system state and recovery goals.
The usefulness of the SPDS in alleviating problems with poor feedback is included in the attachment, which gives a detailed discussion of results from the Safety Parameter Display Evaluation pr ojeci.
This result confirms part of the Westinghouse SPDS design basis (cf.,
Little 8 Moods, I98I, pg. 7), in particular, that displays should support operator roles in detection (both initial and subsequent detections) "is there a problem?
where?
what kind of problem?
is the problem deer easing or increasing in severity? and feedback "are the actions taken successful?
is the problem receding or expanding?"
Furthermore, the safety panel usage data (in particular, the data from the prototype that was based on Westinghouse SPDS concepts) showed that an SPDS can serve as the source of improved feedback to operators.
"Safety panels were successfully used to aid in the problem recognition activity and for feedback during the control activity. (p.S-6).
4232Q
The operators used ti+afety panels to obtain feedb about plant conditions following operator decisions or actions.
Examples range from cases where operators used the safety panel prototypes to discover that the faulted steam generator had not been successfully isolated to cases where operators discovered that conditions in a hypothesized faulted steam generator did not match. their diagnosis."
(p. 4-25, 4-26).
The above example of results from the Safety Parameter Display Evlauation project shows that the decision analysis method derived from Rasmussen's model proved to be a useful tool to analyze operator behavior and to link that behavior to general and specific characteristics of potential SPDS designs.
As such, the study provided one basis, derived from the analysis of operator performance during transient testing rather than opinion, for the operator behavior concepts used in the Westinghouse SPDS design basis.
In addition to confirming,design basis
- concepts, the Safety Parameter Display Evaluation study provided data on the two specific prototypes used in the test.
The prototype based on Westinghouse SPDS concepts accounted for 63% of the total number of SPDS consultations (including both safety panel prototypes),
over 80% of the total number of successful SPDS consultations, but only 6W of the unsuccessful ones (almost 30% of total SPDS consultations were unsuccessful).
In other
- words, an SPDS prototype based on Westinghouse concepts did provide operators with information needed during decision making.
The specific deficiency related to the unsuccessful consultations were identified and the displays modified.
In addition, display deficiencies identified for the other prototype were noted and the information used to avoid similar problems in Westinghouse SPDS displays that were not part of the Safety Parameter Display Evaluation test (Section 4.3.3 of the final report contains the particular deficiencies found).
4232(
in terms of the part1ar dispiays that made up thestinghouse prototype safety panel (cf., p. S-8, S-9), the polargraphic display helped detect the onset of a problem; it was consulted to obtain an overview of plant status; the lack of operator familiar ity r educed its usage; and the plant status display was the most frequently and effectively used display (prmarily due to its data integration role) and was used by some SROs to carry out their system manager role.
There is a trade-off that occurs in tests of user performance with new aids:
on one hand, the test can occur late in the design process when a
rather refined design is available to test but where changes, especially fundamental ones may be difficult to make; on the other hand, the test can occur early in the design process when there is the greatest opportunity for results to affect the design but where the test must be done with relatively cruder prototype systems.
In this case, the Safety Parameter Display Evaluation project was performed early in the process of the Westinghouse SPDS design process and served to help confirm (a1ong with demonstrations of the concepts to operators) the Westinghouse design basis approach and provide guidance to the detailed design.
4232(
ATTACHHENT Results With the Specific Safety Panel Prototypes Human factors deficiencies in the Panel A concept greatly impaired the usability of the displays (Table 1).
Some of these deficiencies were the result of implementation compromises rather than design features.
Nevertheless, the low usage rate produced by these deficiencies obscured the potential usefulness of an SPDS designed along the Panel A concept.
In particular, the trend displays on Panel A, as implemented, did not meet the operators'nformation needs (i.e.,
low usage rate),
because these displays were not an effective real time monitoring tool (cf., pg 5-8).
Sources of this result include:
Data update (30 seconds) was too slow (cf., pg I-9 for an example of unsuccessful usage due to this deficiency);
Data averaging time window was too large (30 seconds);
Display response time was too slow (10 seconds; implementation compromise);
The plots could have helped an operator identify past causes for a
current plant conditions (for example, is pressure dropping because a relief valve opened?)
but did not because logarithmic obscured
- maxima, minima and rates of change information for examples);
4412q scales (cf., pg I-3
'TABLE 1
Safety Panel Prototype Usage (Each prototype was available in test events)
Success ful Unsuccessfu1 TotaI Panel A Concept 15 Westinghouse Concept 36 40 Total 19 4412Q
In gener+operators'rarel'y used the tr portions of the disp'lays, relying instead on the digita'I most recent value readout (cf.,
pg I-8 for an examp'Ie).
NSAC has used the results of~this evaluation to significantly modify their SPDS concepts, for example, by adding a top level display.
The Westinghouse prototype was used more frequently.
Table 2 shows the frequency of successful/unsuccessful consultations as a function of crew.
Only the Westinghouse prototype was used as an integrated part of the crew's recovery response.
For example, in one trial (TR'I-H). the shift supervisor effectively utilized the Westinghouse safety panel by stationing himself at the unit for virtually the entire first 18 minutes of the event.
In two other trials (TR2-H and TR3-H),
a different supervisor made use of the Westinghouse safety panel by referring to it frequently as he moved around the control room.
When a safety panel had a major impact on the evolution of a trial, the prototype was used to support the shift supervisor's system manager role.
s For example, in TR2-H the supervisor used the Westinghouse safety panel to monitor and modify the BOP's control of the secondary system.
In FW3-E he used the Panel A to monitor the evolution of his feed and bleed strategy.
In events TR1-F and TR3-H, he used the Westinghouse safety panel to monitor RCS depressurization, directing operator actions as necessary to continue the depressurization.
44'IZQ
TABLE 2 Success ful/Unsucces sful Consul tat ion s as a Function of Crew Crew Number of Safety Panel Events SP Successful
~Cence t Available Consultations Unsuccessful Consultations Panel A
Panel A
Panel A
Panel A
Panel A
Westinghouse (Panel B) 12 Westinghouse Westinghouse 17 4412Q
The Westinghouse proype safety pane'I was used suesfu11y in severa1 types of operational problems.
First, it was used in the detection=of initial problems (cf., pg I-'2).
Second, it was used to monitor plant status as an input to operator recovery decisions.
This occurred both at the level of input to strategic decisions, that is, choosing which manuevers to execute, and at the level of tactical decisions, that is, decisions about how or when to execute planned actions.
Examples include:
In two events (FW2-G, FW3-G),
a crew used Safety Panel B nar rng iconic and pit status displays to check that RCS conditions were stable and within safe bounds before it planned to establish a
feedwater path through the condensate pumps as a solution to AFW problem.
In one event (FW3-6), before beginning to execute the condensate pump path, the BOP asked the RO what the status of the RCS was.
The RO used Safety Panel B wide rng iconic to check that RCS conditions were stable and within safe bounds.
A crew (PSI-F), knowing that low RCS pressure would initiate a SI signal and that there was no RCS leak, used Safety Panel B pit status display to check plant conditions, especially RCS subcooling, before deciding to block SI.
4412q
A crew (TRI-HI rtered a power reduction fromFety Panel B pit status disp'lay and performed a manual Rx trip when they detected nuclear power 'less than 10%.
A crew (TRI-F) consulted Shfety Panel B pit status and RCS displays to check plant conditions as an input to the decision to begin to realign normal charging/letdown and to restart one RCP.
The crew' goal was to use PRZR spray as a means of RCS depressurization.
The SRO in another event (FWI-G) asked the RO to call up and consult the Safety Panel B wide rng iconic display to check plant statu's and PRZR level before the SRO decided whether or not to realign normal charging/letdown.
A third area of results on safety panel utilization is feedback about the results of control actions.
With respect to operator decision
- behavior, data on error correction reveal that operators can have problems with poor feedback about the effect of contro1 actions on 1
system state and recovery goals.
In particular, when operators misidentified plant state or had execution difficulties, they generally failed to correct their understanding of plant state or to identify and correct execution problems within the duration of the test events (Table 3).
When errors were corrected it was generally due to the intervention of external agents (i.e., the instructor) or took relatively Iong times (up to 8 minutes).
The data in Table 3 does not include cases where operator problems were corrected with help from the Westinghouse safety
- panel, although it does include cases where Panel A did not provide necessary feedback.
4412q 6
TABL'E 3 Error Correction Results (Errors corrected with Westinghouse SPDS utilization are not included)
No Corr ection External Correction Correction Problems in 0
State Identification Problems in Execution Total 4412Q
The usage data with Westinghouse prototype reve+ severai instances where this safety panel was successfully used to obtain feedback.
Examples where feedback was obtained from the Westinghouse safety panel to correct problems include."
In event TR3-H the RO detected that the faulted SG level was within wide range instrumentation from Safety Panel B pit status and wide rng iconic displays.
The BOP had reported earlier that the faulted SG was empty by misreading narrow for wide range level from the control board.
The.SRO (TR2-H) detected Iow SG levels in two unaffected SGS from Safety Panel B pit status display.
(The BOP hhd been slow in re-estab'Iishing AFM flow to the unaffected SGs after stopping all AFM to aid in the SGTR diagnosis.)
The SRO then directed the BOP to increase AFM flow to the unaffected SGs.
Safety Panel B pit status display helped the SRP detect that AFW had J'ot been isolated completely from the faulted SG (TR2-H).
The faulted SG had been isolated, but the BOP turned on the turbine driven AFW pump to increase unaffected SG levels.
4412(
Other examples where erators used the Westinghous ototype to obtain feedback on the results of control actions include:
In event TR2-.H the SRO detected that only 2 of the 3 unaffected SGs were being used to cool the RCS from Safety Panel B pit status display.
He directed the BOP to open the third SG POR.
In another event (FW3-G),
a crew detected that PRZR level was low and decreasing.
The crew isolated letdown and then consulted Safety Panel B wide rng iconic for feedback.
The iconic display showed the crew that the PRZR level decrease halted.
These results suggest that SPDS concepts like those used in the Westinghouse prototype can aid operators to obtain better feedback on the results of control actions and therefore to provide a more error cor r ective man-machine system.
4412(
ll