ML18046B368

Human Factors Review Program Plan.

ML18046B368
Person / Time
Site:	Palisades
Issue date:	03/16/1982
From:	CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:
Shared Package
ML18046B367	List: ML18046B366 ML18046B368
References
PROC-820316, NUDOCS 8203220349
Download: ML18046B368 (91)

Text

PAL!C:"',...l<'S

..,ni.;....., NTTl""L HUMAN FAOT~~EAR PLANT PROGRAM ~ LAN REVIEW

,. REGULATORY DOCKET FILE COPY

\. ~5~

p ..

3-~~gg~9 e20816 0 5000255

. PDR

~* . ,

• • PALISADES NUCLEAR PLANT HUMAN FACTORS REVIEW PROGRAM PLAN TABLE OF CONTENTS I. INTRODUCTION II. MANAGEMENT AND STAFFING III. INFORMATION SOURCES IV. REVIEW PROCESSES A. Review of Operating Experience B. Inventory of Control Room Instrumentation and*

Equipment

c. Detailed Review of Control Room Components and Environmental Survey o* Review Based on Operator Responsibilities

• • • E. Review Based on Existing Plant Procedures and Walkthrough of Expected Operational Evolutions and Postulated Off Normal Events F. Documentation of Review Data V. CORRECTIVE ACTION A. Assessment of the Need f.or Corrective Action B. Establishing Corrective Action Co Evaluating Corrective Action D. .Implementing Corrective Action VI. APPENDICES A. Palisades Human Factors Guidelines For Control Room Review B. Palisades Control Room Review Team Resumes

'\

• I. INTRODUCTION The program to review the human factors of the Palisades Nuclear Plant Control Room was initiated in late 1980. A substantial amount of the work has already been completed.

The control room configuration has been documented, a full scale mockup has been constructed, procedures have been walked-through in that mockup, and much of the control room has been evaluated against human factors guidelines. Some further work in these areas remains to be completed.

Assessment of the findings and the formulation, evaluation,

.. ,. and implementation of corrective action has begun. The basic objectives are identical to those in NUREG-0700, but because the review was initiated far in advance of that document's issue, there are some diff erence.s in methodology. However, we believe they are differences in form and not in substance and that the end result of the Palisades human factor review will be consistent with the guidance provided by NUREG-0700 guidelines.

The human factors review will make use of information from NRC mandated updating programs - such as the updating of emergency procedures. Consumers Power, however, does not plan to delay the control room review effort at Palisades until these other programs are complete. Because the

"window" to do significant work in the control* room is constrained in practice to planned refueling shutdowns, delaying the control room review would jeopardize the ability to do any significant improvements in the next shutdown, (early 1983). As information from these programs becomes available, they will be factored into the review -

for example, new walk-throughs will be conducted, if necessary, and corrective action implemented as appropriate during plant shutdowns.

The schedule for completion of the control room review at Palisades is summarized in Table I-1 *

• I - 2

• TABLE I-1 ESTIMATED SCHEDULE FOR PALISADES CONTROL ROOM REVIEW TASK ESTIMATED COMPLETION DATE Submit Program Plan to NRC MARCH l982 - -

Complete ongoing review of June 1982 control room Assess need for corrective action Septe-mber 1982 Implement short-term improvements Early 1983 Outage Submit Control Room Review April 1983 Report to NRC

• Implement Long-Term Improvements Subsequent Outages

• I - 3

• II. MANAGEMENT AND STAFFING The performance of the human factors review is the responsibility of a team made up of personnel from Consumers Power (both engineering and operations), MPR Associates, and an independent outside consultant, Dr. T. B. Sheridan of MIT. The responsibility and functions of the members of the team are described below; resumes are included in Appendix B of this plane MPR Associates, Inc.

MPR is responsible to provide the major portiori of the detail management and review effort. This includes provid-ing the full scale mockup and control room drawings, con-

• ducting the procedure walk-throughs, comparing the control room to the detail guidelines, and establishing potential modifications. For this purpose MPR has assembled a working group consisting of Messrs. H. Estrada, D~ H. Harrison, J*.

Hibbard and A. Zarechnak, with supporting services such as drafting. It may be augmented by other MPR staff personnel where special skills or experience are tequired.

Consumers Power Company Plant operations is represented on the review team by Mr. W.

S. Skibitsky, Operations Superintendent and holder of a senior reactor operators license at the Palisades Plant. He

participates in planning, reviews results, and assures that

• plant oper~tors' input is provided.

operators participate in several aspects of the review including for example the procedure walk-throughs, Individual licensed environmental survey, and review of operating experience.

Engineering is represented on the review team by three individuals: Mr. R. L. Muzzi from the plant engineering staff and Messrs. R. R. Biggs and K. A. Toner from the general office engineering staff. They participate in the planning, review results, and assure that engineering input from various sources is incorpo~ated. This includes other ongoing plant modifications and obtaining necessary information from the architect-engineer and other contractors to Consumers Power *

• Outside Consultant Dr. T. B. Sheridan, professor of engineering and applied psychology at the Massachusetts Institute of Technology provides the review team with assistance and an overview of the human factors aspects of the review: methodology, in-terpretation of guidelines, assessment of error potentials, and evaluation of potential improvements.

II - 2

• • --*--*-- -- - *-- ---- *-------:....... **-------~

l

• III. INFORMATION SOURCES The Palisades Nuclear Plant has been operating since 1971.

Consequently its operating procedures are considered to be a relatively accurate representation of how the plant is operated. These operating procedures are, therefore, the primary source of information for control room operator activities.

In addition to these procedures, other sources of information which have been or will be used in the control room review include:

0

• plant piping and instrumentation drawings and electrical diagrams, 0

operator training manuals and other training material, 0

the Final Safety Analysis Report and the plant technical specifications, 0

drawings of the control room and the control panels, 0

licensee event reports and internal plant reports on reactor trips and other events, and 0

plant maintenance records and procedures.

In addition the review team has access to the plant operators through interviews and participation in the walkthroughs. Access is also provided to other members of the plant staff - operations, maintenance, and

engineering. The review team also is provided access to the

• actual con~rol room as appropriate for photographs of control panels, surveys, special observations, and specific questions subject to the normal constraints on control room access exercised by the Shift Supervisor *

• III - 2

• IV. REVIEW PROCESSES The objectives of the Palisades control room review are the same as those stated in NUREG-0700:

"To determine whether the control room provides the system status information, control capabil-ities, feedback, and perfor~ance aids necessary for control room operators to accomplish their functions and tasks effectively" and "To identify characteristics of the existing con-trol room instrumentation, controls, other equip-ment, and physical arrangements that may detract from operator performance."

The review processes being used in the review of the Palisades' control room, are described below. The method-ology differs somewhat in its organization from the method-ology described in NUREG-0700i but each element of a thorough human factors review is covered. Figure IV-1 shows how the review processes described in NUREG-0700 are covered by the Palisades review processes described below.

It should be noted that the separate items described below are not in a time sequence and portions of the various processes take place in parallel.

A. Review of Operating Experience The objective of the review of operating experience is to make sure that problems actually encountered in

operation of the Palisades plant are identified and factored into the review of the control room.

A most useful source of information on operating expe-rience is the detailed comments, solicited as well as unsolicited, from the operating staff in the course of the walk-throughs and talk-throughs on the control-room mockup.

A formal survey of control room operators will also be conducted. The objective of this survey is to identify problems and strengths of the control room that have been noted by the control room operators in the course of operations. Additional walk-throughs may be conducted to investigate further any significant problems which are identified during these interviews and which have not already been walked through.

Operations staff with a range of experience will be involved and at least half of the licensed operators will be surveyed. The interviews will be conducted by personnel on the *review team who are not members of Consumers Power Company.

• IV - 2

v The review of experience will also include a review of

• the Licensee Event Reports, the Nuclear Power Expe-rience summaries, as well as a review of plant mainte-nance records and discussions with plant maintenance personnel.

B. Inventory of Control Room Instrumentation and Equipment The objective of the control room inventory is to iden-tify all instrumentation, controls and equipment within the* control room. All components with which the opera-tors interface are included in the inventory.

In the Palisades control room review, the construction .

of a full-scale mock-up of all main control room pane.ls (including annunciator alarms) used by the operators-is part of the inventory process. The displays and con-trols for the mockup panels were reproduced by a combi-nation of photographic and Xerox reproductions of a grid work of high quality photographs. Figures IV-2 and IV-3 depict typical mock-up control consoles.

The actual inventory is contained in a complete set of reproducible drawings of the control panels based on the same photographs used for the mock-up. The drawings and the mock-up have allowed identification and review of the panel components without disruption of control room activities.

IV - 3

On the basis of the drawings and mock-up, some special

• tabular listings of controls and displays have been generated and used in the process of the making compar-isons of specific detailed human factors guidelines.These special listings were used, for example, for verification of the adequacy of the scale ranges of meters.

C. Detailed Review of Control Room Components and Environmental Survey The objective of the control room component review is to identify any characteristics of instruments, equip-ment, layout and ambient conditions that do not conform.

to good human engineering practice. The review is being performed in three stages: the detailed control panel review, the alarm review, and the environmental

. ' survey, as described below:

1. Panel review This includes review of the following:

0 controls, 0

displays, 0

process computers, 0

panel layout including anthropometric considerations, and 0

control/display relations.

IV - 4

2. Alarm System review This includes review of the following:

0 selection of alarms and 0

presentation (human factors) of alarms.

3. Environmental survey This includes review of the following:

0 overall ambient conditions including tempera-ture, humidity, and ventilation; 0

lighting levels; 0

sound levels; 0

control room workspace; 0

communications; 0

emergency equipment and clothing; and 0

administrative practices such as transfer of information during operator shift changes, control of key-lock switches, etc.

The control panel, alarm system and environmental con-ditions surveyed are being compared to detailed human engineering guidelines prepared for the Palisades con-trol room. These guidelines were developed before the guidelines of NUREG-0700 were available and are presented in Appendix A. After corrective actions have been defined, the control room as it will be with those improvements will be compared to the detailed human factors guidelines in Section 6 of NUREG-0700. This

• IV - 5

will provide a cross check that all important factors have been addressed and that no significant human fac-tors problems have been overlooked.

D. Review Based on Operator Responsibilities The responsibilities of the control room operators at Palisades, divorced from any specific event, have been identified. These responsibilities include:

1. Maintain control of the reactivity of the reactor core and m6nitor the shape of the neutron flux profile in the core.

2e Maintain control of the energy production and transfer, including:

0 production of energy in the reactor core, 0

transfer of energy to the reactor coolant

• 0 0

system, transfer of energy through the steam genera-tors to the steam system, conversion of some energy to electricity in the turbine generator, and 0

rejection of the remainder through the con-denser and circulating water system.

3. Maintain an adequate inventory of chemically suitable water at the proper pressure and temperature in the primary (reactor coolant) system.

4. Maintain an adequate inventory of and chemically suitable water at the proper pressure and temperature in the secondary (steam) system .

5. . Distribute electrical power and other necessary services. (such as air and cooling water) to the plant auxiliaries and control the production and the distribution of emergency electric power .

• IV - 6

6. Maintain control o~ radioactive material which may

• be* contained in any of the systems which are the control room operators' responsibility. This includes the responsibility to maintain the leak-tight integrity and pressure of the reactor con-tainment. In addition, monitor radioactivity of all streams which have the potential for release to the environment. [Ir.eluded is monitoring and isolation, if necessary, of the off-gas and liquid discharge.]

7. Maintain control of the inventory and location of fissionable material during. refueling.

S. Maintain control of and complete entries in the operators' logs, procedures, and checklists.

9o Maintain administrative control by such means as tagging and switching orders of the maintenance, repair, testing, calibration, etc. of installed plant systems.

10. Initiate those fire fighting actions which are controlled from the control room, e.g.t starting pumps and obtaining help in fire fighting. In addition, the control room operators are responsible to initiate those actions in the systems under their control which may be needed to compensate for fire damage.

11. Recognize symptoms requiring activation of the site emergency plan, declare the appropriate ac-tion level and initiate appropriate corrective actions and communications.

12. Monitor effluent temperature and chemistry and initiate dilution as required.

13. Maintain communication with power controller concerning changes in power and switchyard operations.

It should be noted that each operator responsibility involves a number of tasks and each task in turn may require the operator to take a number of specific ac-tions.

IV - 7

The detailed manner, i.e., the specific actions by which.each of these operator responsibilities. is discharged in the Palisades control room, is being reviewed. This process establishes the display and control requirements for each general operator responsibility (e.g. control of secondary water inventory) which may not be obvious from analysis of particular operating events or f tom existing plant procedures. These requirements are compared to the existing instrumentation. All discrepancies for each identified responsibility are being documented.

E. Review Based on Existing Plant Procedures and Walkthrough of Expected Operational Evolutions and Postulated Off Normal Events

• A preliminary set of operational evolutions has been selected for analysis of operator actions.

include:

These Normal Operational Evolutions 0

heatup and startup, 0

shutdown and cooldown, 0

operation at power (including automatic and manual operations of reactor, steam generator and main

. turbine) ,

0 refueling,

• IV - 8 l_

Transient and Emergency 0

reactor and turbine trips from a variety of me-chanistic causes, 0

primary coolant leaks small enough so that the charging system can maintain coolant inventory, 0

primary coolant leaks too large for normal charg-ing system makeup (including transients leading to core conditions with inadequate core cooling or core degradation),

0 various size secondary system leaks within the makeup capability and exceeding the makeup capability, 0

loss of feedwater flow, O*

various losses of off-site and on-s.i te power (including losses of instrumentation power sources),

0 loss of instrumentation air, and 0

postulated failures of systems and components

• (such as the main steam isolation valves, steam generator tube ruptures, safety valves, etc).

For each of the normal evolutions qualified Palisad~s operating personnel perform the simulated operations on the mockup using the appropriate plant operating procedures with the evaluations being performed by the review team. A talk-through technique is generally used in these procedure walk-throughs. On the basis of the information obtained from the walk-throughs, operator tasks are identified for each of the evolutions considered .

• IV - 9 l_

A similar approach is being followed for the emergency and abnormal events with the following exceptions: The analysis of these events is initiated by postulating a set of symptoms consistent with a possible plant condi-tion, including system or component malfunctions. The symptoms are in the nature of specific meter readings, alarms, noises, etc. and are presented (described) to the operators. The operator then makes a determination of what specific event is in progress, and which (if any) plant procedures are applicable to the perceived event. The operator, if he wishes, asks for informa-tion on the readings of other meters and the status of other indicators. For some events, additional symptoms

• are presented to the operator, consistent with the postulated event. In this way, information is elicited regarding the actual operator tasks including the displays which the operator uses to diagnose a problem, initiate a course of action and confirm the results of his action.

The plant normal and emergency procedures define a set of control and display requirements. These control and display requirements are compared to existing instru-mentation and any discrepancies are documented, utiliz-ing appropriate criteria. These criteria include con-sideration of questions such as:

• IV - 10

-* Is required input* information available?

0 0

Is required equipment, e.g., controls, tools, charts, lists, communication links, etc.

available'?

0 Is this task physically and mentally practical to perform? For example, is control too high to reach easily or does operator need to have memorized too much information'?

0 Is required system response indication available?

0 Is required component response indication avail-able?

0 Does this task conflict with other control room operations in progress?

0 Are there potential errors in this task which have serious consequences?

• 0 Would a simultaneous fire or medical emergency have a serioµs impact on this task?

0 Do controls and displays used in this task meet

• 0 appropriate human factors guidelines, e.g.,

control/display relationships, display units, .

label/procedure nomenclature consistency?

res.ponsibili ties for this task?

Is manning level consistent with the assignment of As a result of the walkthroughs, those tasks which are difficult to perform are ide~tified. The review team then determines the course of.action for further more detailed evaluation of the particular task involved.

An additional function of* the walk-throughs is to compare the nomenclature of control console and panel labeling with that of plant procedures and appropriate

• • IV - 11

piping and instrumentation schematic diagrams. Where

• discrepancies are found, appropriate changes to console labeling, diagrams, or procedures are recommended.

F. Documentation of Review Data During each phase of the control room review, data are recorded in the form most convenient to the particular task to minimize the fraction of the review effort which is devoted to assembling, programming, recording, and storing data on deficiencies. Emphasis is placed on using existing documents, for example, copies of the guidelines or procedures, marked up to record problems as they are observed. Special forms are used, however, in some* instances to record data. These initial notes

• and ra~ data are further consolidated so that generic problems are identified.

Examples of specific types of documentation which have been or are expected to be used are as follows:

0 NUREG-0700 :f!um.a~_f§.~!;Q.!:S Guideli_ri~s _a~~.1l~~d to determine compliance.

0 Tables will be prepared for findings that are generic, i.e. for those differences from a guide-line which occurred for several control room com-ponents.

• IV - 12

0 Tabular listings of controls or displays are used

e to evaluate certain attributes such as units and ranges on displays and position indications for valve switches~

0 Drawings of the control room panels are produced from detailed photographs of the existing control room and are used as part of the record of the control room inventory.

0 Copies of procedures are marked up to keep notes on walk-through observations. These are augmented by collected notes after a walk-through session.

These data are further reviewed and evaluated to identify particular pioblems.

0 Forms for recording control room light measure-ments and sound measurements were prepared .to plan the data taking, minimize the disruption of the control room, and used to document these measure-ments.

0 Control roo~ operator survey forms will be prepar-ed and used in conducting interviews with the control room operating staff.

0 Results of detailed analyses, for those tasks which present particular difficulties (as identified by the.walk-throughs) will be prepared.

0 Lists of operator tasks identified from the walk-throughs, and check-off lists of their review for the availability and adequacy of controls and displays will be prepared.

• IV - 13

I NUREG-0700 REVIEW PROCESSES

1. 2. 3. 4. 5. 6.

REVIEW OF REVIEW OF CONTROL CONTROL VERIFICATION VALIDATION OF OPERATING SYSTEM ROOM ROOM OF TASK CONTROL ROOM PALISADES EXPERIENCE FUNCTIONS INVENTORY SURVEY PERFORMANCE FUNCTIONS REVIEW & OPERATOR PROCESSES TASKS A.

REVIEW OF OPERATIUG x

EXPERIENCE B.

CONTROL ROOM INVENTORY MOCK UP x

DRAWINGS c.

DETAIL REVIEW PANEL ALARMS x

ENVIRONMENT D.

REVIEW BASED ON OPERATOR x x RESPONSIBILITIES

. E *..

REVIEW BASED ON PLANT PROCEDURES AND WALK-THROUGHS x x x F.

DOCUMENTATION OF REVIEW DATA x x x x x x

~

FIGURE IV-1 COMPARISON OF PALISADES REVIEW PROCESSES TO NUREG-0700 REVIEW PROCESSES

Figure IV-2 Figure IV-3

~I IV-15

• Vo CORRECTIVE ACTION The most important objective of the Palisades control room human factors review program is to identify and validate improvements in the control room configuration and operating practices, which will mitigate or eliminate deficiencies uncovered by the review process. The f indi_ngs and observa-_

tions, i.e., items where the control room review has estab-lished that there are departures from the guidelines, ate assessed by the review team to determine whether action needs to be taken. If action is required, specific recommendations will be established. Establishing the

• recommended action will include evaluation to ensure that it corrects the original problem and does not introduce others.*

A. Assessment of the Need for Corrective Action The fundamental criterion used in the assessment is whether the deficiency would likely lead to an operator error. Each deficiency item is addressed by the best collective judgement of the review team (and others that they may call upon).

Generic groupings of deficiency items are used wherever applicable. This addresses the concern that the cumu-lative effect of numerous minor human factors problems

can have a major negative impact even though no one of them would appear serious. The review does not rely on "safety" or "non-safety" as a classification scheme.

Obviously, a human factors problem which has a credible impact on the safety of the plant staff or the public must be resblved. However, human factors problems which impact most directly on plant availability or which could lead to damaging plant equipment are also important.

Where there is a consensus of the review team that hardware changes should be made to bring the control room into agreement with the guidelines, detailed assessment of errors and consequences of a particular

• departure from the guidelines is not needed except as would be useful in establishing and evaluating.

corrective action. Detailed assessments wil1*be made for those items for which the review team concludes:

0 no corrective action is needed, 0

no hardware changes are needed, or 0

the action has to be deferred beyond the next plant refueling outage.

B. Establishing Corrective Action For those human factors findings for which the consen-sus of the review team is that some action is needed, a

• v - 2

basic approach or approaches will be identified. The action to resolve a particular human factors problem may or may not involve physical changes to the existing configuration. Some hardware changes may be desirable and practical; however, in some instances the most practical way to meet the concern that a human factors guideline addresses is through the use of modified procedures and training which is specifically directed at compensating for the existing configuration.

In selecting a corrective action the review team will consider a number of factors. The most important of these are:

0 the relative effectiveness of the action in cor-recting the problem; 0

the relative practicality and ability to implement the action promptly; 0

the potential for the action to introduce other:

human factors problems; 0

the impact of the action on the operator's train-ing, practices, and habits; and 0

the compatibility of the action with other requirements, e.g., fire protection and separa-tion *

• • v - 3

c. Evaluating Corrective Action

• All corrective actions are evaluated by the review team and are, of course, subject to the normal plant approval requirements for changes to the existing con-figuration, documentation, and training. All those corrective actions which involve changes in conf igura-tion will be incorporated on the. full scale mockup. In most cases, some abbreviated procedure walk-throughs will be conducted to confirm that the operator's re-sponse has been improved and new problems have not been introduced. Procedure changes may also be evaluated by the walk-through technique.

D* Implementing Corrective Action

• Corrective action, after evaluation and appropriate approval, will be implemented as promptly as practical consistent with:*

0 not disrupting the control room and 0

not complicating operator training by performing piecemeal changes to the control room conf igura-tion.

• v - 4

• APPENDIX A PALISADES HUMAN FACTORS GUIDELINES F.OR CONTROL ROOM REVIEW

PALISADES HUMAN FACTORS GUIDELINES FOR CONTROL ROOM REVIEW TABLE OF CONTENTS SUBJECT PAGE I. PURPOSE e e

• e

• e e e e e e e 8 8 e e 8 e e e e e e e e 8 e e e e 8 e e e 8 e e e e e e 8 G II. OPERATIONAL GUIDELINES .. . ..... .. ....... ... .... .... .4 A. Functions Performed in Control Room . . . .. . . ...

• 4 B. Controls and Displays Provided to Operators in the Control Room ...... . .. . ... . .. . . .6

c. Availability of Personnel . . . . ..... .7 D. Arrangement Priority . ... .... ... ..... ** .7.8 E. Key Process Variables .... .... ..... ..... .

III. HUMAN ENGINEERING GUIDELINES .. ....... .. . .. . . .... * .10 A. General Guidelines .. . .... .. .. .. ... . .... . .10 B. Guidelines for Controls

1. Location . . . .

. . . ... .14

.14 2.

3.

Operation . . . . . . . . . .

Type ***** . . .. . ....... ..***......*.. . 16

. . . . .. ...... . 15

• 4. Protection ***********

5.

6.

Identification *******

Maintenance *********

........ ..... ......* .16 .16

. 18 c .. Guidelines for Displays ************* . .*.. . 18

1. Location .**......*..*...**.. ..... . . *..

• 18 **

2. Scales. . . . .. . .. ... .. . ... .. .. . . ****. 18

3. Identification . .*.*.*......*..*..**....* . 19

4. Type . . . .... . . ....... .... . ..... . . ***** 21

s. Maintenance **.***.**.***.*.****..**** * ** 21 Recorders *** ......

6. *** 21 7e CRT Dis plays *** 2 2 D .. Process Computer Guidelines e e e e e G *

• e e e e e e **** 23 Overall Control Room Environment ** 24 F. Guidelines for Alarms . .. ... *** 28 1.

2.

Selection *******

Presentation **** .. . .. * ** 28

• 30 IV. REFERENCES **********************.******* c * * *. c * * * * ** 35

PALISADES HUMAN FACTORS

• GUIDELINES FOR CONTROL ROOM REVIEW I. PURPOSE The purpose of these guidelines is to provide a: basis upon which to evaluate the Palisades Control Room. They are intended to assist in the identification of those aspects of the current control room which may need improvement from a human factors viewpoint and to provide guidance for a~y modifications

• II. OPERATIONAL GUIDELINES A. Functions Performed in Control Room The control room operators who mari the main control room should be provided with appropriate controls and displays to perform a set of defined functions.

Controls and displays, including annunciators, which are not needed to perform those defined functions tend.

to divert the control room operators' attention and should not normally be provided .to theme It should be an objective to move out or keep out of the control room itself those personnel, controls, and displays which are not related directly to the defined functions. In any case, those other functions which may be done in the control room should be arranged so that they can be done by personnel other than those manning the main console and panels without causing interference or distractions.

• The functions of the control room operators manning the main console are defined to be the following:

1. *Maintairi control of the reactivity of the reactor

• 2.

core and monitor the shape of the neutron flux profile in the core.

Maintain control of the energy production and transfer, including:

0 production of energy in the reactor core, 0

transfer of energy to the react9r coolant system, 0

transfer of energy through the steam generators to the steam system, 0

conversion of some energy to electricity in the turbine generator, and 0

rejection of the remainder through the condenser and circulating water system

3. Maintain an adequate inventory of chemically suitable water at the proper pressure and temperature in the primary (reactor coolant) system

• 4* Maintain an adequate inventory of chemically suitable water at the proper pressure and temperature in the secondary (steam) system.

5. Distribute electrical power and other necessary services (such as air and cooling water) to the plant auxiliaries and control the production and the distribution of emergency electri~ power.

6. Maintain control of radioactive material which may be contained in any of the systems which are the control room operators' responsibility. This includes the responsibility to maintain the leaktight integrity and pressure of the reactor containment. Monitor radioactivity of all streams with potential release to the environment. (Also included is monitoring and isolation, if .

necessary, of the off-gas and liquid disch~rge.)

7. Maintain control of the inventory and location of fissionable material during refueling.

8. Maintain control of and complete entries in the operators' logs, procedures, and checklists.

Maintain administrative control by such means as tagging and switching orders of the maintenance, repair, testing, calibration, etc. of installed plant systems.

10. Initiate those fire fighting actions which are controlled from the control room, e.g., starting pumps and* obtaining help in fire fighting. In addition, the operators are responsible to initiate those actions in the systems under their control which may be needed to compensate for fire damage.

11. Recognize symptoms requiring activation of the site emergency plan, declare the appropriate action level and initiate appropriate corrective actions and communications.

12. Monitor effluent temperature and chemistry and initiate dilution as required~

13. Maintain communication with power controller concerning changes in power and switchyard operations.

• I~

The following are examples of items which should not be the responsibility of the control room operators manning the main console or panels:

0 security or access control, except access which may affect the leaktight integrity of the reactor containment; 0 communications not directly related to their responsibilities, e.g. routine plant telephone calls; 0 routine operation of the liquid waste disposal system; and

-0 routine chemical control in support systems.

B. Controls and Displays Provided in the Control Room The controls and displays presented directly to the control room operators manning the main control room, ieee those controls and displays directly visible to them when they are at their normal stations, should be limited to those for which a clearly defined need can be established. Additional guidelines which may be applicable to the location of controls and displays in the control room are:

1. A control or display may be located in the control room if its location elsewhere would not permit its use in a timely manner. *

2. A control may have to be located in the control room if the only location for the displays needed to operate the control is also in the control room.

3. A control or display used only for test purposes or only for certain planned plant evolutions may be located in the control room if it involves the use of other controls or displays which are located only in the control room.

Note that these guidelines do not necessarily require controls and displays to be directly visible to the operators stationed at the console.

• Availability of Personnel The control room arrangement should be such that any anticipated off-normal operational evolution can be effectively carried out in the short term with the personnel complement present for the normal evolution then underway. Specifically, the response to off-normal conditions may not assume that any more personnel are available in the short term than would normally be present in the control room when the initiating event occurs. -Other on-site personnel can be assumed to be available in a time period consistent with the travel time from their normal location if they have no other duties in the event. Off-site personnel who are on call can be assumed to be available, as defined in the Palisades emergency plan.

D. Arrangement Priority The control room and panel *arrangements should provide, in convenient locations, those controls and displays which are needed for normal planned plant evolutions and steady state operation (plant startup and planned shutdown, power generation, hot standby, and

• _

refueling); however, higher priority for arrangement

• should be given to the controls and displays which are involved with the operators*carrying out their assigned responsibilities under those off-normal conditions which are both likely and which require timely action. Such off-normal conditions include:

0 reactor and turbine trip, 0

partial or complete loss of feedwater, 0

loss of coolant accidents (particularly those from valve openings or major seal failures),

e loss of various sources of control or instrumentation power or air, 0

overcooling accidents (particularly those from steam system valves stuck open or excessive feed),

0 control rod motion accidents, 0

electrical power upsets, (including those -in the site AC system or in the site DC system)

• The operators desk should give the operator a clear

• E.

unobstructed view of the main control.boards. Operator movement and communication should be unobstructed.

Key Process Variables It should be an objective to provide the operators with the means necessary qualitatively to confirm the reasonableness of the information they are presented on certain key process variables. Preferably these means should be diverse from the normally used displays.

These key process variables fall" into the follow!ng catagories:

1. Reactivity 0

When critical, the operators should have the process variables necessary to assess whether the reactivity contributions of the following are in the expected relationship: rod .

position, boron concentration, power level, power (flux) shapes, coolant temperature, and prior operating history.

• 0 When subcritical, the operators should have the pr6cess variables necessary to assess the-shutdown margin of the reactor and whether the following are in the expected relationship: rod position, boron concentration, coolant temperature, prior operating history, and neutron level.

2. Reactor Coolant Conditions 0

Inventory of reactor coolant (pressurizer level) 0 Thermodynamic state of coolant (temperature and pressure) 0 Coolant flow rate 0

Radioactivity in coolant 3* Stearn System Conditions

.o Inventory of secondary coolant (hotwell, steam generator, heater shell, and drain tank levels) 0 Stearn pressure 0

Feedwater flow and temperature 0

Radioactivity in steam

4. Reactor Thermal Power Se Off-gas Radiation Levels and Concentrations

6. Availability of Electric Power III. HUMAN ENGINEERING GUIDELINES The guidelines for the human engineering review of the Palisades Control Room are based on those in MIL-STD~l472B, Human Engineering Design Criteria for Military Systems, Equipment and Facilities. 5 ince the military s_tandard is directed toward military applications and covers types of equipment which are not in the control room, some parts of it are inappropriate. The guidelines listed below are those*

which are particularly important to the .control room review, amplified and clarified for direct application to the control room. It is recognized that 1n the course of the review, situations may be encountered which are not adequately addressed by MIL-STD-1472B and the gtiidelines included below. . In such cases other human engineering references may be consulted, for example:

0 Van Cott, H.P. and Kinkade, R.G., Human Engineering Guide to Equipment Design, (reference 3) .*

0 Woodson, W. E., and Conover, D. W., Human Engineering Guide for Equipment Designers, (reference 4).

A* General Guidelines

• 1. The controls and displays should have compatible locations, that is:

0 Where timely operator action may be needed, the sources of information from which the operator concludes that he needs to take action, and that action is permissible, should be located close to where the control action is taken.

0 When a control action is taken, the operator who takes the action should have immediate feedback that the controlled element has responded and, if practical, that the plant or system itself has responded. This usually involves the location of the related displays close to where the control action is taken.

0 Functionally related controls and displays should have an apparent and consistent relationship. Preferably, functionally related controls and displays should be located in close proximity, yet far enough apart that operation of the control does not interfere with observation of the display.

0 Location of recurring functional groups should be* similar from panel to panel.

0 Related controls and displays should be easily distinguishable by the operator. The following relationships should be immediately apparent to the operator:

the display(s) associated with each control, the anticipated direction of movement of the control and display, and the functional results of activating the control.

2. Consistent and unambiguous methods should be provided to inform the operators of the operational status, e.g., open or closed valve position, and of the conditions, e~g.,

temperatures or flows, in those systems under

• 3.

their control. Likewise, status and conditions in other systems in the plant which could affect the action the operators may take should be provided in a consistent and unambiguous manner.

Where a control or display is intended to provide*

information to the operators as to whether conditions are "off-normal," this should be done in a consistent and unambiguous manner. This should include consideration of what conditions are to be defined as "n~rmal" in a particular system as well as avoiding confusion between indicating status (see item A.2, above) and indicating "normal" or "off-normal." In general, the extinguishing of a light should not be used to convey important normal or off normal information

• feedback to the operator. (Under certain circumstances, for example, "power off" conditions, an extinguished light, in combination with other, active indications may be used effectively to convey information).

4. Th.ere should be some means for the operator to know that a control or display is not functioning properly. It is particularly important to know when a display or control has lost power. The most desirable situation would be to have the malfunction evident to the operators without any action on their part, e.g., by having a unique "power lost position" for a meter. This may be impractical. If so, other ways to make the operator aware of failures may have to be used, such as:

0 providing means for periodic testing of a control or display (including status lights),

0 providing the operator with inimediate feedback (see A. L above), or 0 providing redundant or diverse displays which allo~ cross checking.

For some critical items it may be appropriate to utilize several ways to make the operators aware of malfunctions and to provide them with special training and guidance in the procedures.

s. Communication of a control room operator with an auxiliary operator either within or outside the control room shall be. considered the same as operating a control or reading a display. These communications should not require the use o.f.

communication links which may involve interference or may be unavailable because of other

• activities. The communications should consider the potential for unusual environmental.

conditions: noise, respirators, etc. Voice communications should provide for repetition and confirmation of each transmission, when required to assure accuracy.

60 Tag-out of a control or display should:

0 be unambiguous as to which control or display is tagged, o* not obscure the identification of the control or display which is tagged, and 0

not obscure any other controls or displays or interfere with operations.

7* For any changes to the console and panels, replacement and servicing should be considered.

In that case guidelines on maintainability such as the following should be applied:

0 Replacement and servicing should not require the removal bf other items on the panel.

0 Replacement or servicing of an item should not involve operations which preclude proper operator response to a plausible off-normal event. This includes putting an excessive number of other items out of service in order to perform the maintenance.

0 Replacement should involve a minimum risk of improper reconnection.

0 Replacement or servicing should involve a minimum risk to personnel.

0 Replacement or servicing should involve a minimum risk of inadvertent actuation of other controls.

. 0 Displays (lights, etc.) used only for maintenance and servicing should not be visible, e.g., they should be covered during normal operations.

If some specific problems with maintenance have been experienced in the Palisades control room, these should be considered in the control. room.

review.

a. The capabilities required of the operators to perform the assigned functions should be reasonable in terms of work load, span of mental concentration, physical endurance, amount of memorization, and time and space available to perform a function. The assigned functions should be consistent with the physical capabilities required of the operators.

9. Changes to existing arrangements should be sufficiently distinct that when an operator uses the new control or display it is unlikely that previous training and habits will caus~ errors .

Consideration should be given to using completely different types of controls in such applications, for example, using pushbuttons in place of a rotary switch rather than changing the direction of rotation of the rotary switch.

lOc Cdntrol panel sections containing functionally related controls and/or displays should be prominently labeled.

B. Guidelines for Controls

1. Location

a. The most often used controls should be given priority in location, except where this would conflict with the use -0f controls or displays for off-normal conditionsc Control placement should comply with the anthropometric standards 15 - 95th percentil~ male and female stature and arm reach) given in Van Cott and Kinkade, reference 3.

Controls for off-normal conditions should be placed in a readily.accessible location but clearly distinguished from controls used for normal conditions.

c. The progression of controls, numerically or alphabetically, should be consistent throughout the panel. It is preferred that they progress lef t.;,.,to-right and top-to-bottom.

d *. All controls for multiple elements should have the same arrangement, that is, either horizontal or vertical.

e. If controls are operated in sequence, they should be located in a consistent left-to-right or top.;..to-bottom progression.

Where multiple controls affect the same element, e.g., valve control pushbuttons, their relationship should be consistent and readily ~pparent to the operator without detail comparison of the legends *

• .:.. 14 -

g* Mirror image groups of controls should not be

• • • • 2.

used.

Operation

a. The control should be capable of operation without special aids for the operator, e.g.,

a stool, screw driver, or special tools, except where required to prevent inadvertent actuation. *

b.

• The forces and motions required to actuate the control must be within the capabilities of all the plant operators. This applies under normal operating conditions and when emergency clothing is being worn.

c. The direction of operation should follow a consistent set of conventions,. for example:

0 Pushbutton valve operators should have the "open" button on top, if vertically arranged~ if horizontally arranged, the "open" button should be on the right.

• o.

Rotary controls for circuit breakers and electrical motors should rotate clockwise to turn the item "on" i.e., close a breaker or start a motor.

0 The "Auto" position of a rotary control should be in a consistent di~ection of rotation.

0 "On" or "start" pushbuttons should be above "off" or*"stop" pushbuttons.

0 Rotary controilers should rotate clockwise to increase the controlled quantity.

d. The direction of motion of the controller should be consistent with the direction of motion of the display which responds to the control.

e* Key operated controls should follow a standard set of conventions, e.g., detents ori~nted upward.

f. Control position should be easily identifiable.

3. Type

a. Each control type should be easily identifiable. Control coding, e.g. size, shape and color should be consistent throughout.

b. Consistent types of controls should be used for similar functions.

4. Protection

a. Adequate distance between controls and between groups. of controls to *allow the operator easily to recognize the controls and to avoid inadvertent actuation should be provided. MIL-STD-1472B (reference 1) guidelines for separation distance should be utilized *

• b .. Controls which may be confused and which have serious consequences if actuated should be protected or special steps taken to highlight or distinguish them. This may include such means as color coding, covers, separate handles, the use of two hands to operate, or key operated controls.

c. Controls which would otherwise be subject to inadvertent actuation by clothing, cleaning operations, etc., should be relocated or protected. Prote.ctive measures should not interfere with control operation.

S. Identification a .. Each control should be positively identified with both a descriptive name and a par ticula.r identifying number for the controlled element.

b. Nomenclature should be consistent with that used in the procedures and system diagrams

e Ce and that on related displays and controls.

The use of abbreviations should be minimized.

Legend plates should be located over the control to which they apply. If this cannot be done, some special visual clue of the unusual relation should be provided to the operator. In no case should a location convention be the only means of telling to which control a label applies. Legend plates should be readily visible from the station at which they must be read.

d. Where special precautions apply to the operation of a control, this should be clearly stated and it should be clear to which control(s) they apply.

e. Legend plates on controls should meet consistent standards of letter size (Van Cott and Kinkade, reference 3).

f. Legend plates on controls should meet consistent standards of durability.

Temporary label plates should not be used.

• g. The color of legend plates should conform to a consistent code, for example:

0 Identification labels should be black letters on a white background.

0 Information of a reference nature for the assistance of the operator should be white letters on a black background.

0 Precaution labels should be red with.white letters.

h. Identification techniques in addition to label plates, e.g. size, shape, location, color, texture, should be used for similar controls, where necessary to avoid improper actuation *

... 6 .. Maintenance All light bulbs should be commonly stocked types and should be replaceable from the front of the panel without special tools and without risk of inadvertent actuation or damage of the control.

C. Guidelines for Displays

1. Location a.. The display should be iocated properly with respect to its related controls. (See Criterion II.A.l.). Display placement should comply with appropriate visibility standards of Woodson and Conover, reference 4. *

b. The orientation of multiple displays should be consistent with normal conventions for pr_ogression of numerical or alphabetical quantities, i.e., top-to-bottom or left-to-right.

c. The orientation (horizontal or vertical) of an array of displays should be consistent with the orientation of related controls.

d. The operation of the control related to a display should not obscure the* display.

e. Mirror image groups of displays should not be used.

2. Scales

a. The graduations on a scale should be consistent with the resolution required by the operator. Woodson and Conover, reference 4, guidelines should be followed.

b. The scale range should be adequate for all normal and off-normal conditions under which the display is required.

c. The major scale divisions should be a usual numerical progression. Scale multipliers should be avoided, but where used should be in a consistent location and easily read.

Only multiples of 10 shoul~ be used

• d* The units for all scales should be identified and located in such a manner that it is clear to which display the units apply.

e. The units of the scales should be consistent between rate and integral displays for related items. For example, all the flows into or out of a tank should be provided in consistent units of volume and time and the tank contents should be displayed in units which are consistent with the units of the flows.

f. Where multiple displays are provided of the same parameter, e.g., wide and narrow ranges, these instruments should have consistent scale units and consistent zero points. For example, steam generator start-up, operating and wide-range level instruments could all be referenced from t~e top of the lower tube sheet as "zero". *

g. The arrangement and scale design of multiple displays should involve a minimum risk of confusing the readings, e.g., erroneously matching the pointer on one instrument *with

• 3.

a.

the sc~le on anotherc Identification Each display should be identified with both a descriptive name and, where applicable, an identifying number which*relates the indication unambiguously to a particular instrument or sensor.

b. The nomenclature should be consistent with that used in the procedures and system diagrams and that on related controls and displays. The use of abbreviations should be minimized.

. c. Legend plates should normally be located over the display to which they apply. If this cannot be done, some special visual clue of the unusual relation should be provided to the operator. In no case should a location convention be the only means of telling to which display the label applies

• If the limits or set points of the displ~yed d.

variable are needed by the operator when the display is used, then they should be presented in a clear and unambiguous manner. It is particularly important that memorization.of numbers by the operators be minimized. The method of identifying set points and limits should be consistent among the displays.

e. Legend plates on displays should meet consistent standards (Van Cott and Kinkade, referenc~ 3} of letter. size. Legend plates should be readable from the station at which they must be read.

f. Temporary label plates should not be used.

g. The color of the legend plates used on displays should follow the same general rules as for controls (see B.5.g.). *

h. Where colors are used as an integral part of*

the information displayed, a consistent coding should be used. Color *codes may include: *

• 0 0

red to show that a component, usually a motor, or breaker is "on" or.energized; green to show that a component, usually a motor or breaker, is "off" or de-energizedi 0

a yellow display to indicate that a system is in a transitional condition or that a "bypassed" condition exists; 0

a white display to indicate a status condition.

i. If special information labels are used it should be clear to which display(s} they apply.

j. Redundant identification techniques, e.g.

size, shape, location, should be used for similar displays where necessary to avoid improper actuation.

4. Type

a. Display type, e.g. quantitative, qualititative, analog or digital, should be suitable for its intended application. For example, digital displays minimize time and error in reading an exact numerical value, but provide limited rate information.

b. Consistent types of displays should be used for similar functions.

5. Maintenance

a. Replacement of bulbs should take place from the front of the panels and all light bulbs should be commonly stocked types. Special tools should not be required.

b. The risk that a display will be reassembled in such a manner that it gives erroneous information, for example, by switching lighted legend lens caps, should be mi.nimi zed.

• 6 .. Recorders

a. A recorder should meet the same requirements for visibility, scales, units, etc., as any other display.

b. Where multipoint or multi-pen recorders are used, the recorded data should be unambiguous.

c. When different inputs can be selected for the same recorder, switching transients should not be such that they can be mistaken for signal changes.

d. When different inputs can be selected for presentation there should be some positive way to determine what specific input the trace represents.

e. The amount of the recorded trace which is visible should be adequately long to. cover the time span of interest to the operators.

Reference to portions of the trace which are

• • f.

not visible should not involve blocking other critical displays or controls or risking inadvertent actuation of controls.

The recorder should provide for a tolerance on the timing for changing paper or ink of at least two hours. That is~ chart paper and ink should be replenished when there is at least two hours of recording left. This is to insure that if an emergency evolution takes place there will be at least a two hour capability to follow it without servicing the.

recorder.

g. It is preferable for charts to have time as the horizontal coordinate increasing to the right.

h. Changing chart paper or ink should require a minimum of time and should not block other critical controls or displays.* There should be little possibility of the inadvertent actuation or damage of nearby controls.

7. CRT Displays a *. The loss of any CRT display or other single*

failure in the associated hardware (power supplies, computer, keyboards, etc.) should not preclude the performance of an emergency procedure.

b. Information orientation and zones, titles, label locations and parameter locations should be standardized. Standard sets of characters, symbols, and abbreviations should be used.

c. Color assignments should be consistent from display-to-display and should be consistent with color conventions used on the console and panels.

d *. Mimic displays should. be oriented from left-to-right or top-to-bottom unless this conflicts with existing panel mimics, P&IDs or the arrangements ~f items on the panels.

Procedures steps or decision "trees" should be oriented from top-to-bottom. Time should be displayed from left-to-right.

e. Each display should have a descriptive

• f.

title. This title should be in a consistent location and have a consistent color and format.

Display characters should be selected from a standard set (such as ASCII). The letter size should meet consistent standards (Van Cott and Kinkade, reference 3) for the distance at which they are used. Capital letters should be used.

g. The refresh rate of the displays should be 60 Hz or more.

D. Process Computer Guidelines

1. Only authorized personnel should be able to alter the computer data base.

2. Data base changes should require a positive command action by the operator. The operator should be automatically provided with information describing the implications of the data base

• change before he makes the change. The system -

should then require him to acknowledge this information before the data base change is executed. The system should provide confirmatory feedback when the data base change has been accomplished.

.3. The process computer command language should be logical and consistent. Language words and abbreviations should be consistent with operating procedures and system diagram terminology.

4. Command entries should require a minimum number of keystrokes. Single keystroke function keys should be used for important control inputs. *

s. The process computer operating system should aid the operator by providing prompting and assistance in recovering from an error.

6. Command entry keyboards should be standardized and readily usable under all operating conditions.

The operator should receive positive feedback of each keyed entry.

• • 7. Computer output devices, e.g., line printers and typewriters should present information in a readily usable and readable format. Output devices used to list alarm messages should have adequate output speed to list alarm messages in real time with no significant backlog or loss of information.

E. Overall Control Room Environment

1. Temperature and humidity should be controlled to provide operator comfort and to allow proper functioning of control room equipment. One means of demonstrating that the temperature and humidity levels are adequate is to show that they meet the following recommendations: *

a. An effective temperature (ET) range of 65°F to 85°F is recommended in MIL-STD-1472B.

The effective temperature can be determined from Figure 32 of MIL-STD-1472B or from the following approximate formula:

. ET where WB DB x

=

=

=

=

xWB +(1-x)DB wet bulb temperature (OF) '

dry bulb temperature (OF) ' and (DB-4 5) I ( 6 4+DB-WB) *

b. A relative humidity of approximately 45% at 70°F is recommended in MIL-STD-1472B.

Control of relative humidity may also be required to reduce problems with static electricity, especially for computer components. A minimum value of 45% is recommended in reference 8.

2. Adequate ventilation must be provided in the control roomo

a. The control room air should be free of excessive dirt, noxious fumes and odors.

b. Air should be introduced at a m1n1mum rate of 30 cubic feet per man per minute *

• .:.. 24

c* Air velocity in the control room should be low enough to avoid distracting the operators, e.g. by blowing paper off operator's desk.

3. Adequate illumination should be provided to allow all required operator seeing tasks to be performed comfortably, and without likelihood of error.

Examples of required seeing tasks are: reading labels on panel faces and annunciator windows, reading gauge divisions on meter faces, reading type-written material such as operating procedures at the operator's desk and writing entries into the operator's logs.

• a .. Normal illumination levels are considered adequate if they meet the minimum illumination levels given in MIL-STD-1472B:

30 f ootcandles at console and panel surf aces and 50 footcandles for general off ice work including reading of small type or data recording. If illumination levels are lower in particular locations, the nature of the seeing tasks at these locations should be evaluated to determine whether the identified seeing tasks can be accomplished without

• • b ..

difficulty or likelihood of error

• Emergency Lighting The control room illumination when powered by the diesel generators should meet all the requirements of the normal illumination.

When neither the normal nor emergency diesel generator power is available, battery-powered illumination must be provided at the locations to be used under these conditions, e.g. the diesel generator panels, the associated power distribution sections, areas for reading procedures, etc. The illumination levels at these locations should be evaluated to determine their adequacy to accomplish the required tasks. A minimum illumination level of 3 footcandles is recommended for emergency lighting in MIL-STD-1472B.

c* Glare should not interfere with the readability of displays, labels or indications and should not produce operator discomfort.

d.. The luminance of surfaces in the control room should be sufficiently uniform to allow the operator to perform all seeing tasks comfortably.

e. Shadows which distract the operator should be avoided under normal illumination.

4. The ambient noise level in the control room should be sufficiently low to allow easy direct voice communication in the control room as well as communication by telephone or radio to personnel outside the control room.

A maximum ambient noise level of 65 db(A) (A-weighted scale) is recommended for areas similar to control rooms in MIL-STD-1472B.

5. There should be adequate provision for the control of traffic in the control room and accommodating

• visitors or observers without adversely affecting

• 6..

7.

operations

• There should be adequate provision for the storage of personal items and emergency equipment.

There should be adequate workspace for the operators to use reference material and to support any on-the job training.

8. There should be adequate provisions for storage and use of the following without blocking access to any controls or displays:

a. procedures,

b. manuals,

c. diagrams and drawings,

d. logs,

e. personnel rosters,

f. other files. *

9. There should be direct and defined access to the supervisor's office. Good visual and voice contact should exist with the control room

• 10 * . There should be adequate rest room and kitchen facilities.

11. There should be adequate and defined access for maintenance of the control room equipment including availability of technicians, tools, and spares. Such maintenance should not interfere with normal operation.

l2o There should be adequate access from the control room to the remainder of the plant.

13. The control room and its associated spaces should contain adequate provisions for communications.

This includes particular consideration of the following:

a. means for paging in the rest rooms, kitchen and any other associated spaces, and

b. communication facilities for the shift supervisor, shift foreman, and other personnel in the control room so that they do not interfere with or confuse the communication links used by the operators on the main console and panels .

• 14. The control room should be free of personnel hazards such as items which could trip the operators, sources of electric shocks, etc.

There should be adequate safeguards on the systems which control temperature and ventilation so that, in case of failures in these systems, proper working conditions can be re-established before they deteriorate excessively.

16. Emergency equipment including operator protective equipment, fire extinguishers suitable for electric fires, radiation equipment and rescue equipment as required should be readily available.

17. *Access openings normally used by the control room operator should be clearly and consistently labeled. Labels should contain prominent warnings if access possesses a danger, e.g., high voltage .

F* Guidelines for Alarms

1. Selection The following guidelines and criteria should be used in evaluating alarm selection.

a. Candidate *alarm conditions include: (1) conditions within a system which cause, or may cause, the system or its components to malfunction, or to function in a manner different from that intended for the existing mode of plant operation, and (2) conditions which cause, or may cause damage to plant equipment. Candidate alarm conditions should be chosen based on knowledge of the operation and intended function of the system or component. In determining what is "normal" or "intended" operation for a given system, Guideline b., below, should be applied.

Wfth respect to the different types of systems in the plant, the following guidelines should be applied on a system-by-syste~ basis in order to identify candidate alarm conditions:

• (1) Candidate alarm conditions for fluid systems are values of the thermodynamic ..

parameters in the mass, momentum and energy equations which indicate the system is not functioning as intended.

In particular, inventory, flow rate, temperature and pressure usually are candidate alarm conditions.

(2) Candidate alarm conditions for electrical distribution systems are breaker trips, improper paralleling of generators, batteries or inverters, and inverter failure or malfunction.

Candidate alarm conditions for transformers are high temperature, high gas pressure, presence of combustible gas, and other conditions for their support systems which are determined by

<:~pplication of the appropriate system-specific guidelines (e.g., the

• guidelines above for fluid systems).

Candidate alarm conditions for batteries

• ~ 28 -

and diesel generators should be determined by reference to the guidelines below for protection systems and large machines.

(3) Candidate alarm conditions for control systems are loss of power, automatic transfer to manual control, automatically initiated changes in automatic control mode and symptoms of control loop malfunctions.

(4) Candidate alarm conditions for protection systems are a lack of readiness, actuation of the system, problems in actuation and problems in operation. Candidate alarm conditions for problems in operation should be chosen by application of the appropriate system-specific guidelines (e.g., the guidelines above for a fluid system).

(5) Candidate alarm conditions for large machines are trips, and trip causes that may alter the operator's response to a trip. Alarms for supporting subsystems

• b.

should be chosen by application of appropriate system-specific guidelines.

Candidate alarm conditions should be chosen so that the process annunciator panels are dark when the plant is operating normally at power. "Normal" means full power operation with all systems operating as intended.in their most typical lineup for this condition.

c. In order to warrant an alarm in the control room, each candidate alarm condition must satisfy the following criteria:

(1) The condition requires operator action as defined below, and

.(2) The operator's normal surveillance activities cannot be relied on to alert him to the condition, and (3) It is considered plausible that.the condition could occur'during the life of the plant

• For the purpose of this guideline, operator action may take any of the following for~s:

0 direct manual action, 0

backup of an automatic action, and 0

other modification of surveillance activities.

Any qondition not meeting these criteria should be eliminated from the list of candidate alarms.

d. After a set of alarms has been defined, these alarms should be reviewed to ensure that each alarm requires unique operator action, in order to minimize the number of annunciators in the control room. Alarms which require identical operator action may be candidates for combination.

2. Presentation

a. In order to minimize the number of annunciators within the control room, several types of alarms should be considered for combination into a single annunciator,

• whenever doing so would not interfere with timely operator response to the alarm. If alarms are combined, a reflash* capability should be provided. The following types of alarms should be considered for combination (subject to the restrictions listed in the next paragraph):

0 alarms for the same parameter on the same component, e.g., tank level high/low; 0

alarms for the same condition on redundant components, or logic trains, when each has a separate indicator and

• "Reflash" is the capability to cause an annun~iator combining a number of alarm conditions to recoiiunence flashing and sound a tone on the existence of a second alarm condition occurring after a first has been received and acknowledged (but has not cleared).*

the indicators are placed in closed proximity on the console, e .* g., pump A/B trip, safeguards actuation A/B; 0

alarms for several conditions relating to one component or several redundant components, which require the operator to obtain further diagnostic information either by sending an auxiliary operator out to the component(s) or checking the computer (if applicable), e.g., pump A/B trouble.

Candidates for combination should not be combined if:

(1) different actions are to be taken depending on which constituent is al~rming and information is no~

available to the operator to identify which constituent is alarming; (2) the required response time is so short that taking time to consult the control panel or the computer (if applicable) to determine which constituent is alarming

• (3) would risk an inadequate operator response; information or protection for the other alarm.constituents after any one has activated the combined annunciator is not available to the operator;

( 4) operator understanding is improved by annunciating the conditions separately because of similarity to the layout of the associated controls; or

( 5) the constituents and/or significance are not of a similar nature and are not of the same order of importance.

b. Alarms should be grouped according to plant system or function. Within each group, the alarms should be arranged to maximize the operator's ability to assimilate multiple alarm occurrences. Alarms should be organized to indicate relationships among alarms within the same system.

c., Alarm groups should be placed in close proximity to the corresponding controls.

Annunciator windows should be designed and lettered according to the following guidelines:

(1) Nomenclature and abbreviations should be consistent with those used for the corresponding controls and indicators.

(2) If no precedent has been set on the controls and indicators or by other commonly accepted usage, abbreviations should be in accordance with MIL-STD-12C.

(3) Lettering size, type font and viewing , -I" angle must be such that the alarm legends are readable by the operators when standing at their primary control stations. In addition, it is highly

• desirable that the legends be readable by the operator who is acting in a supervisory capacity (e.g., shift supervisor). The standard in Van Cott and Kinkade, reference 3, should be used in making these evaluations.

(4) Annunciator panels should be positively identified. Label plates used for panel identification should meet standards for letter size that are consistent with those used for similar labels on the control panels (Van Cott and Kinkade, reference 3).

e. An operator should be able to acknowledge only those alarms within his field of vision.

f. An operator should be able to acknowledge an alarm only from a station near the controls which are operated in response to the alarm *

---

~---

g* Audible tones signifying an alarm should satisfy the following requirements:

(1) The combination of tone volu~e, frequency and construction (e.g., warble or other var iatio.n) must be chosen such that the.operator is alerted to the alarm under the most adverse anticipated conditions of background noise.

(2) The tone must not be so loud that the operator is startled or disoriented, or is unable to effectively communicate with others in the control room.

(3) The audible tones used for the various annunciator panels should be chosen and directed such that the operator can distinguish which annunciator panel or panels require his attention.

h. Flash rates used for annunciator lights should be within the range of 1 to 5 flashes per second. Equal amounts of on and off time should be used. Flash rates which must be distinguished one from another should differ

• i.

in rate by at least a factor of two.*

Annunciator lights should be bright enough to stand out clearly against the panel on which they appear under all expected lighting conditions, but they should not be so bright as to be annoying or distracting.

j. The capability to reconstruct the sequence of events in a multiple alarm situation should be provided. In particular, the operator should have a means of identifying the first alarm that occurred.

k. Annunciator ringback* should be provided whenever the operator requires information on

• "Ringback" in an annunciator sequence provides a second visual and auditory indication that an alarm which was previously received and acknowledged has now cleared--gone back to normal. A separate "reset" control is typically provided

• clearing of an alarm, particularly if he must take action (or stop the action he took in response to the alarm) when the condition returns to normal. Ringback should not be used if the operator does not require the information (and takes no action) and therefore the ringback becomes a distraction. Where ringback is used, a separate control should be provided to "reset" the annunciator -- acknowledging the ringback.

1. The annunciator system should be designed to minimize the nuisance associated with leaving an audible signal sounding continuously until alarms can be assimilated and acknowledged in a multiple alarm situation. One means of addressing this is the provision of a silence control for the audible signal, separate from the acknowledge control for the visual tiles. Other means may also be acceptable.

m. Annunciators should meet the requirements of paragraphs III.A.4 and III.A.6 for indicating malfunction or tag-out of annunciators

• IV. REFERENCES

1. Military Standard MIL-STD-1472B, Human Engineering Design Criteria for Military Systems, Equipment and Facilities, 31 December.1974, Department of Defense, Washington, D.C. 20301.

2. T. B. Malone, M. Kirkpatrick, K. Mallory, D. Elke, J.

H. Johnson, and R. W. Walker (The Essex Corporation),

Human Factors Evaluation of Control Room Design and Operator Performance at Three Mile Island-2, NUREG/CR-1270, January 1980, U.S. Nuclear Regulatory Commission,*

Washington, D.C. 20555~

3.. H. P. Van Cott and R. G. Kinkade, Editors, Human Engineering Guide to Equipment Design, Revised Edition, 1972, Superintendent of Documents, U.S. Government Printing Off ice, Washington, D.c. 20402, Stock Number 008-051-00050..;..0/Catalog Number D 4 .10 :EN3.

4. w.. E. Woodson and D. w. Conover, Human Engineering Guide for Equipment Designers, 2d.ed., Berkeley, California: University o.f California Press, 1964.

s. E. J. McCormick, Human Factors in Engineering and

• 6.

_Design, New York: McGraw-Hill, Inc. 1976

• NUREG-0659 Draft Report, Staff Supplement to the Draft Report on Human Engineering Guide Due to Control Room*

Evaluation, March 1981, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555.

7. K. Mallory, s. Fleger, J. Johnson, L. Avery, R. Walker, ..**'

C. Baker, T. Malone (The Essex Corporation), Human Engineering Guide to Control Room Evaluation, Draft Report NUREG/CR-1580 July 1980, U.S. Nuclear Regulatory Commission, Washington, D. C. 20555.

8.

• Charle*s Daugherty, Humidity Control Provides Subtle Savings of Energy", Specifying Engineer, Vol .. 42, No.

6, November 1979, p. 108. "

• . APPENDIX B PALISADES CONTROL ROOM REVIEW TEAM RESUMES

• • • • ~- .. _., ..... ,-.,**-*-~-.**-**-***-:*--** ..

)

• ~

ROBERT RAYMOND BIGGS Business Address: Consumers Power Company 1945 W Parnall Road Jackson, Michigan 49201 Education: Bachelor of Science USMMA Kings Point, NY - 1953 Engineering Courses University of Michigan - 1955 Graduate Study Nuclear Engineering University of Michigan - 1960

~*

Experience:* Consumers Power Company 195~ - Present Project Engineer - Nuclear Plant Projects Department-1980 Coordinating input for Palisades and Midland simulators Project Engineer - Operati~g Services Department-1979 Coordinate design reviews, etc on various fossil and nuclear plant modification projects.

Project Engineer - Operating Services Depa.z:tment-1978 Coordinate design reviews from Operations Group to Midland Project Management.

Training Administrator - Maint-enance &: Administrative Services Department-1976 Administered efforts in nuclear and fossil plants technical training. Administered efforts in plant and substation

• operating instructions.

Nuclear Training Administrator - 1973 Developed programs for nuclear plant operator training including licensing and requali.fi.cat.ion programs-.

Assistant. Plant Superintendent-Palisades - 1968 Administered day-to-day effort of plant staff during plant check out, initial testing, *fuel loading and initial plant startup.

Reactor Engineer-Big Rock Point Plant - 1965 Directed operation of reactor ensuring operation of core within operating limits, fuel accountability, fuel handling procedures *

• Robert Raymond Biggs

• Experience - continued Senior Engineer-Big Rock Point Plant - 1963 Coordinated plant and General Electric effort in operational portion of R&D program.

General Engineer-Big Rock Point Plant - 1960 Engineering support during startup of plant, primarily.

in technical areas; ie, reactor physics, fuel handling, and general engineering.

General Engineer - on* loan to Atomic Power Development Associates (APDA) - 1958 Test engineer in Test Operations Section of .APDA.

Engineering Assistant-JRWhiting Plant - 1955 Assisted Maintenance Supervisor in directing maintenance work force, 320 Mw fossil plant.

u s Navy - USS Pieter (AF-54) - 1953 Engineer officer. Administere~ Engineering Department o~ refrigerated cargo ship, Pacific SerVice Force.

• Licenses Held: Reactor Operator License (OP-1197) expired Vallecitos Boiling Water Reactor - 1962 Senior Reactor Operator License (SOP-262) - expired Big Rock Point Plant - 1963 Senior Reactor Operator License (SOP-1300) - expired Palisades Plant - 1270

• 2/82

• Kerry A~ Toner BUSINESS ADDRESS: Conswners Power Company 1945 w. Parnall Road Jackson, MI 49201 EDUCATION: B.s. in Electrical Engineering Technology from .Purdue University in 1974 (with Highest Distinction). M.S. in Industrial Engineering Technology from Western ~iichigan University in 1979*

REGISTRATION: Registered and licensed as a Professional Engineer in the State of Michigan.

EXPERIE!'TCE: 1980 - Present: Consumers Power Company.

overall responsibility is to provide general office engineering support for the Palisades and Big Rock Point Nuclear Plants.

• Generally, this support includes conceptual design and equipment *

• procurement for design modifications and the evaluation of Plant systems and operation to resolve technical issues as requested by the NRC. Specific examples include:

1. The conceptual design and procurement of materials for a plant modification which will eliminate existing single-failure mechanisms in the Big Rock Point containment isolation/vacuum *

• relief circuitry.

2. *The procurement of environmentally qualified containment air cooler and engineered safeguards room air cooler fan/motor .

assemblies for the Palisades Plant.

3. The evaluation of the ability of certain Big Rock Ibint and Palisades Plant safety-related electrical systems (such as the reactor protection system, the engineered safety features and the emergency power systems) designs to conform to

• current licensing criteria as part of the NRC's Systematic Evaluation Program.

1975 - 1980: Indiana & Michigan Electric Company, D. c. Cook Buclear Plant, Units 1 and 2.

In addition to serving as assistant section head and section start-up test coordinator, responsibilities included serving as project engineer for plant preoperational startup tests, pl.ant design modi~

fications, safety-related systems surveillance testing and plant efficiency testing. Specific projects included:

1. Performed preoperationa1 startup tests on station battery systems, emergency cooling systems, negative rate reactor trip system and various service water systems

• 2, Coordinated installation and testing of certain plant modifi-cations such as the addition of an alternate reactor shutdown system (for use during or after control room fire),the re-moval of diesel generator nonessential trips during accident conditions and the switchover to a 2-out-of-3 logic system tor diesel generator startup on emergency bus undervoltage.

3. Coordinated surveillance testing of' the reactor protection system, auxiliary feedwater system, emergency power system and the containment ice condenser system.

4. Coordinated turbine stage* pressure performance test and nu.:..

merous pump efficiency tests.

1967 to 1971: United States Navy.

Served as a weapon's Fire Control Technician. Responsibilities

.. included the operation and maintenance of gun f'ire control radar and computing elements. Served approximately 18 months in Viet-Nam.

HONORS: l. Elected as member of the Phi Kappa Phi National* Honor Society

(~due Chapter) .1974.

2. Elected as member of the Institute of Electrical and Electronics Engineers, 1974.

3.. li>norable Discharge, U. s. Navy.

... PUBLICATIONS: l..

2.

"Designs Better Method For Weighing Ice Baskets, " OPERATING IDEAS Magazine, .American Electric Power Service-Corporation, Sept/Oct 1976 Issue. **  : .

"ImprOV'es Testing of Heat Exchanger Tubes," OPERATING IDEAS Magazine, American Electric Po\rer Service Corporation, MB;y/June 1979 Issue. *

.*....... *--*******-----*---**-*-**-..,.--*-----****--****-* **'*****-**-*-**---~-.,,,...-'"'-"-----*-*---.' -*~***' _, _______________ _

ROBERT LEO MUZZI Business Address: Consumers Power Company Palisades Nuclear Plant Rt 2 Box 154 Covert, Michigan 49043 Education: BS in Electrical Engineering and Nuclear Engineering University of Michigan - 1979 Experience: Consumers Power Company 1979 - Present Responsible for plant modifications, primarily on electrical and instrumentation systems.

Some specific projects. include:

1. Plant cognizant engineer for the installation

• of Critical Function Monitor System. Sys.tem to provide data logging and CRT display of 400 important plant para.meters.

2. Technical review for automatic start and auto-matic flow control of auxiliary feedwater system, including control and display arrangement.

3. Design, document update, procedure update and control and display arrangement for numerous minor modifications.

Ford Motor Company Summer - 1978 Body and electrical engineering. Responsible for testing and design to comply with Federal safety requirements.

• 2/82

• Business Address:

WILLIAM S SKIBITSKY Consumers Power Company Palisades Nuclear Plant Rt 2, Box 154 Covert, MI 49043 Education: BA in Economics - Dartmouth College - 1971 MBA in Management - Michigan State University - 1980 Experience: Consumers Power Company 1977 - Present Operations Superintendent - Palisades - 1980 Direct activities in Operations Department.

General Supervisor - Nuclear Fuel Supply - 1978 Responsible for all budgeting, contractual, and forecasting activities associated with the nuclear fuel cycle for Palisades and B'ig Rock Point Plants.

Senior Engineer - Nuclear Licensing - 1977 Handled all licensing (NRC) activities associated with Big Rock Point, as well as some generic licensing issues.

1971 - 1977 - U S Navy Nuclear Power Program .

Division Officer on FBM submarine - 2 1/2 years Division Officer on new construction submarine (688 class) - 2 years.

Licenses Held: Reactor Operator License - Palisades - 1981 Senior Reactor Operator License - Palisades - 1981 2/82

I I

• Business Address:

THOMAS B. SHERIDAN Massachusetts Institute of Technology Room 1-110 *.

77 Massachusetts Avenue Cambridge, Massachusetts . 02139 Education: B.S., Purdue University, 1951. M.S.,

University of California, Los Angeles, 1954. Sc.D., Systems Engineering and Psychology, Massachusetts Institute of Technology, 1959.

\

Experience: Professor of Mechanical Engineering and Professor of Engineering and Applied Psychology, Massachusetts Institute of Technology, 1970 to present. Responsible for the Man-Machine Systems Laboratory; developed interdepartmental graduate degree program in Technology and Policy; teaches *a graduate course in man~machine systems and the coie Seminars in Technology and Polity; has taught control, design and other

• engineering subjects. Bas conducted research on mathematical models of human operator and socio-economic systems; on man-computer interact.ion in piloting aircraft and in supervising undersea and industrial robotic systems; and on computer graphic technology for information searching and group decision-making.

Associate Professor, Massachusetts Insti-tute of Technology, 1964 to 1970.

Assistant Professoi, Massachusetts Insti-tute of Technology, 1959 to 19~4.

Instructor, Massachusetts Institute of Technology, 1956 to 1959.

Research Assistant, Massachusetts Institute of Technology, 1954 to 1956.

Served as visiting faculty member at the University of California at Berkeley, Stanford University and the Technical University of Delft, Netherlands *

. I I

• Honors and Professional Affiliations: 1977 Recipient of the Human Factors Society's Paul M. Fritts Award for contri-butions to.education. IEEE Systems Man and Cybernetics Society (past President}. IEEE Committee on Technology Forecasting and Assessment (past Chairman). Formerly Editor, IEEE Transactions on Man-Machine Systems. Fellow, Human F~ctors Society.

National Institutes of Health, Study Sections on Accident Prevention and Injury Control. NASA Life Sciences Advisory Com-mittee. NASA Study Group on Robotics.

U.S. Congress OTA Task Force on Appropriate Technology. NSF Automation Research Council. NSF Advisory Committee on Applied Physical, Mathematical and Biological Sciences.

Publications: Sheridan, T.B., and Ferrell, w.*.R.,

Man-Machine Svster::s: Information, Control and Decision Models of Eu~an Performance, M.I.T. Press, Cambridge, Ma., 1974.

• Sheridan, T.B., "The Human Operator in Control Instrumentatioh," a chapter in R.H.

MacMillan, ed., Prooress in Control Engineering, Heywood and Co., Ltd., London, 1962.

Dupress7 J.K., and Sheridan, T.B., "Sensory Supplementation, An Introduction," chapter in Degan, Bennett, Spiegel, eds., Human Factors in Modern Techr.oloov," McGraw~Hill, New York, 1963.

Sheridan, T.B., Merel, M.G., Kreifeldt, J.G., and Ferreil, W.R., "Some Predictive Characteristics of the Buman Controller,"

Procress in Astrona~tics a~d Aeronautics, Vol. 13, Academic Press Inc., New York, 1964.

Sheridan, T.B., "Computers and Man," a section in Science, Revie~ an~ ?review published jointly by Childrens Press, Chicago, and Natl. College of Education, Evanston, Illinois, 1964

• Sheridan, T.B., "Man-Machine Systems," 1967 McGraw Bill Yearbook of Science and Technoloqv, McGraw Hill, N.Y., pp. 66-74.

Sheridan, T.B., nvehicle Handling:

Mathematical Charact~ristics of the Driver" from Soc. Autoc Engrs, Procress in Technolcav, Voi. 13: Hichwav*vehicle Safety, 1968, pp. 268-276.

Sheridan, T~B., Articles on "Man Machine Systems" (pp. 105-109) and "Hua.an Factors Engineering" (pp. 513-577) in 1970 McGra~

Bill Science Encvclooedia.

Sheridan, T.B., "Optimum Allocation of Personal Presence," Chapter IV (Vol. II) of Progress in Cvbernetics (edited by J. Rose)

Gordan and Breach, New York, pp. 803-811, also in IEEE Trans. Svsterns:science and Cybernetics, Vol. SSC-6, No. 2, April 1970, pp. 140-145.

Sheridan, T.B., nTeleooerators

. and Remote Control," "~upervisory Control of Teleoperato~s," "Externally Po~ered Limb Prostheses," Chapters in R.K. Eernstat and K.P. Gartner, Disolavs and Controls, Swets and Zeitlinger, Amsterdam, 1972.

Sheridan, T.B., "Technology for Group Dialog and Social Choice," Chapter 12 (pp.

223-236) in de Sola Pool, Ithiel, ed.,

Talkina Eack: Citizen Feedback and Cable Technolocv, M.I.T. Press, Ca~bridge, Ma.

1973.

Weissenberger, s., and Sheridan, T.B.,

"Dynamics of Eurnan Operator Control Systems Using Tactile Feedback," J. Basic Encr.,

June 1962.

Sheridan, T.B., and Ferrell, W.R., nRerr.ote Manipulative Control with Transmission Delay," IEEE T:ansactions, P.T.G. Human Factors i~ ~lectronics, ~arc~ 1963. *-

• Sheridan, T.B., Paynter, H.M., and Coons, S.A., "Some Novel Display Techniques for Driving Simulation," IEEE Trans. on Human Factors in Electronics, Vol. EFE-5, n.l.,

• Sept. 1964.

Zeigler, B.P., and Sheridan, T.B., "Human Use of Short Term Memory in Processing Information on a Console," IEEE Trans. on Human Factors in Electronics, Sept. 1965.

Sheridan, T.B., "Three Models of Preview Control," IEEE Trans. on Human Factors in Electronics,* June 1966.

Knowles, W.B., and Sheridan T.B., "The

'Feel' of Rotary Controls: Friction and Inertia," Human Factors, June 1966, pp.

209-215.

Ferrell, ~.R., and Sheridan, T.B., "Super-visory Control of Remote Manipulation,"

IEEE Soectrum, Vol. 4, No. 10, Oct. 1967, pp. 81-88.

Sheridan, T.B., and Roland, R.D., "A Normative-Model for Control of Vehicle Trajectory in an Emergency Maneuver,"

Highway Research Record, No. 195, 1967, pp.

83-97.

Vickers, W.H. and Sheridan, T.B., "A Dynamic Model of an Agonist-Antagonist Muscle Pair," paper 38 in Proc. 4th Annual NASA-Univ. Conf. on Manual Con~rol, March 1968 (NASA SP in press), also published in IEEE Trans. on Man-Machine Svstems, March 1968.

Sheridan, T.B., "What's a ~an Machine?",

editorial in IEEE Trans. on Man-Machine Systems, Vol. l*~MS-9, No. 1, March 1968.

Sheridan, T.B., "Big Brother as Driver:

New Derr.ands and Proble~s fer tte ~an at ~he Wheel," Human Factors, 1970, 17(1), pp.95-101 *

• Sheridan, T.B., "On How Often the Supervisor Should Sample," Proc. IEEE Intl.

Symposium on Man-Machine Systems, Cambridge, England, Sept. 1969, also in IEEE Trans. Svstems, Science and Cybernetics, S.SC-6 No. 2, April, 1970, pp.

140-145.

Murphy, R.L.H. Jr., Fitzpatrick, T.B.,

Baynes, H.A., Bird, K.T. and Sheridan, T.B., "Accuracy of Dermatological Diagnosis by Television," Archives of Dermatology, June 1972, Vol. 105, pp. 833-835.

Hardin, P.A.,*whitney, D.~., and Sheridan, T.B., "And Tree" Computer Data* structures for Supervisory Control of Manipulation, Proc. 1972 Intl. Conf. on Cvbernetics and Society, IEEE/SMC (172-CB0-547-8-SMC), Oct.

1972, Washington, D.C.

Sherid~n, T.B., "Experimental Analysis of Time-Variation of the Human Operator's Transfer Function," Proc. of the First International Conaress of the International Federation of Automatic Control (Moscow),

Butterworths, London, 1960.

Sheridan, T.B., "Human Operator's Time-varying Transfer Function in the Study of Perception and Fatigue," Proceedinos of the Symposium on Recent Mechanical Engineers, Institute of Mach. Engrs.,

London, 1960.

Sheridan, ~.B., "In Flight Measu~ement of Buman Operator Alertness," Proceedinos of the National Soecialists Meetinq in Guidance of Aero-Soace Vehicles, Institute of Aeronautical Sciences, New York, 1960.

reprinted as Sheridan, T.B., "Alertness Measurement of the Human Operator of a Continudus Con£rol System, Automatic Control, March 1961.

Sheridan, T.B., "The Human Response Equation," M.I.T. Technology Review, May, 1962 *

• -s-

Sheridan, T.B., "Engineering Analysis of Cane Information Acquisition," in Linsner, J.W., ed., Proceedings of the Mobility Research Conference, (M.I.T., 1961), Amer.

Foundation for the Blind, New York, May 1962.

Mickunas, J., and Sheridan, T.B., "Use of an Obstacle Course in Evaluating Hobility of the Blind," Amer. Found. Blind, Res.

Bul., No. 3, New York, August 1963.

DeFazio, T.L., and ~heridan T.B.,

"Vibration Analysis of the Cane," Amer.

Found. Blind Res. Bul., No. 3, New York August 1963.

Sheridan, ToB., "Techniques of Information Generation: the Cane," Proceedincs of the International Conqress on Technolcav and "Blindness, Amer. Found. Blind, New York, 1963.

Sheridan, T.B.*, "On Precognition and Plan-ning Ahead in Manual Control," Proc. 4th Natl. Svmo. on Human Factors in Electronics, IEEE, May 1963.

Sheridan, T.B., Johnsori, W.M., Bell, A.C.,

and Kreifeldt, J.G., "Control Models of Creatures Which Look Ahead," Proc. 5th Natl. Svmo. on Human Factors in Electronics, IEEE, May 1964.

Sheridan, T.B., Fabis, B.F., and Roland, R.D., "Preview Control Behavior and Optimal Control Norms," Proc. Second Annual NASA-Universitv Conference on Manual Control, NASA SP-128, pp. 293~310.

Sheridan, T.B., "Preview Cc~t:ol and Super-visory Dynamics in Man-Machine Systems~"

Tri-National Symposium on Man-~achine Interactions NATO/~iDDEA, Faris, France, Sept. 1966.

Ferrell, W.R., and Sheridan, T.B.,

"Supervisory Control of Re~ote Manipulation," IEEE NEREM Record, 1966, pp.

16 I 17

• Sheridan, T.B., "Human Decision Making in High Speed Transportation," IEEE Intl

• Convention Diaest, March 1967 1 pp. 482-483.

Sheridan, T.B., and Ferrell, W.R., "Super-visory Control of Manipulation," Proc. 3rd Annual NASA-Universitv Conference on Manual Control, NASA .sP-144, 1967, pp. 315-323.

Sheridan, T.B., Ferrell, W.R., Krafchick, Jr., and Strickler, T.G., "Tactile Sensing

~or Remote Palpation and Manipulation in Telediagnosis," Proc. 20th Annual Conf. on Enar. in Medicine and Eiolcav, Nov. 1967, pp. 23.

Nevins, J.L., Johnson, I.S., and Sheridan, T.B., "Man/Machine Allocation in the Apollo Guidance, Navigation and Control System,"

Proc. Inst. of Naviaation National Scace Meeting on Sirnolified Manned Guidance, F~b.

1968, pp.71-118.

Whitney, D.E., and Sheridan, T.B., "State Space Models of Remote ~anipulation Tasks,"

Proc. 4th Annual NASA-Cniv. Conf. on Manual Control, March 1968 (~ASA SP in press).

Sheridan, T.B., Ferrell, W.R., and Whitney, D.E., "Human Control of Re~ote Computer Manipulators," IEEE NEREM Record, Vol. 10, 1968, pp. 198-199.

Sheridan, T.B., Ferrell, W.R., and Whitney, D.E., "Human Control of Re~ote Computer Manipulators," paper presented at Fall Joint Computer Conference, San Francisco, 1968.

Sheridan, T.B., and Ferrell, W.R., "Human Control of Remote Computer Manipulators,"

Proc. Intl. Joint Ccr.:~~e;.c~ cf Artificial

• Intelligence, Washington, May 1969, pp.

483-494.

Sheridan, T.B., "Supervisory Control 6f Co~puter Manipulators" i~ ~~ve~ces in External Control of Ee~:~ ~x~remities, Yugoslay Comm. for Elec. and Automation, Belgrade, 1970, pp. 353-364

• Sheridan, T.B., "Citizen Feedback: New

e Technology for Social Choice," in MIT Technology Review, Jan. 1971, pp. 47-51.

Rouse, W.B., and Sheridan, T.B., "Supervis-ory Sampling and Control: Sources of Suboptimality in a Tracking Task" in Proc.

1971 NASA- Universitv Conference on Manual Control, U. Southern California, Los Angeles, June 1971.

Sheridan, T.B., "Technology for Group Dialogue and Social.Choice," Fall Joint Computer Conference, Las Vegas, Nevada, November 1971, AFIPS Conference Proceedings, Vol. 39, pp. 327-336.

Sheridan, T.B., "On Modeling Performance of

.; Open-Loop Mechanisms, n* Proceedinas of 1st CISM-IFTOM Svmo. on Theorv and Practice of Robots and Maniculators, Udine, Italy, Sept. 1973.

Sheridan, T.B., "The Several Roles of Man as a Supervisor of RobotsA in Proc. 1974 International Conf. on Svstems, Man and Cybernetics, IEEE 74-CH0-908-4-SMC, pp.

453-457.

Sheridan, T.B., "Community Dialog Technology", Proceedinas of th~ IEEE:

Special Issue on Social Svstems, Vol. 63, No. 3, March 1975, pp. 463-474.

Sheridan, T.B., "Technology for. Citizen Participation in Planning," NRC Transoortation Research Record,.1975.

Rouse, W.B., and Sheridan, T.B., "Computer Aided Group Decision-Making: Theory and Practice," Proc. 1974 Intl. Conf. oh Systems, Man and Cv~ernetics, IEEE 74-CH0-908-4-SMC. Alsb published in Technoloaical Forecastina and Social Change, le 113-126. (1975).

Sheridan, T.B., "Several Roles of Man as a Supervisor of Robots", Proc. 6th Congress International Federation of Automatic Control, M.I.T., Carr.bridge, Mass., Aug.

• • • 1975 *

-a- .

Sheridan, T.B., non Interfacing Models and Decision Makers", IEEE Proc. International Conference on Cvbernetics and Society, San Francisco, Sept. 1975.

Sheridan, T.B., "On the Human Supervision of .Industrial Robots", Paper A4 in Third Conference on "Industrial Robot Technoloqv and 6th Interna:ional Svm~osium on Industrial Rocots, University of Nottingham, U.K., March 1976.

Sheridan, T.B., "Production Control Task Allocation to Man vs. Computer" Proc. 1976 Joint Automatic Control Conference, Purdue University, July 1976.

Sheridan, T.a., and Johannsen, G., Editors, Monitoring Behavior and Sunervisorv Control, Plenum Press, 1976.

Kiguchi, T., and Sheridan, T.B.,

nselecting Measures of Plant Information:

Some Criteria Based on Information and Decision Tteory," Proc. 1976 Intl.

Symoosiurn on Systems, Man and Cvbernetics, IEEE/SMC, ~ashington, D.C.

Sheridan, T.B., and Sicherman, A.,

"Estimation of a Group's Multi-Attribute Utility Function in Real Time by Anonymous Voting," IEEE Transactions svstems, Man end Cybernetics, Vol. SZ.1C 7, No. 5, May 1977.

Sheridan, T.B., Supervisory Control of Manipulators for Undersea Applications, 1977 Intl. Conf. Cvbernetics and Societv, IEEE/SMC.

Tulga, M.K. and Sheridan, T.B.,

"Supervision of Dynamic Decision Making in Multi-Task Monitoring ahd Control," 13th Annual Conference on Hanual Control,--

M.I.T., June 15-17, 1977.

Palgi, A., and S~eridaB T.E., "Nutrition Slide Show with Audience Particip~tion," J.

Nutrition Education, Vol. 9, No. 3, July-Sept. 1977, pp. 123-126 *

- . ****~..:

~~*

Burke, T.E., Sheridan, T.B., et al.,

"Integrating Technology Assessment Techniques," Eighth Annual Pittsburgh Conf.

on Modeling and Simulation, April 1977.

Sheridan, ~.B., and* Mann, R.W~, nDesign of Control Devices for People with Severe Motor Impairment," Human Factors, Vol.

20(3), June 1978, pp. 321-338.

Sheridan, T.B., ."The Changing Role of the Pilot from Manual Controller to Computer Supervisor," Proc. Svrno. on Man-Svstem Interface: Advances in Workload Study, Air Line Pilots Assn., July 31 and Aug. 1, 1978 t pp* 13.2-143

• Sheiidan, T.B., and Tulga, M.K., nA Model for Dynamic Allocation of Human Attention Among Multiple Tasks,n Proc. Intl. Conf. on Cybernetics and Societv, Tokyo, Japan, Nov.

3-7, 1978, pp. 1112-1117, IEEE 78-CH-1306-0-SMC.

Sheridun, T.B., Verplank, W.L., and Brooks,

• T.L., "Human/Computer Control 6f Undersea Teleoperators," Proc. Intl. Conf. on Cybernetics and Society, Tokyo, Japan, Nov.

3-7, 1978, IEEE 78-CH-1306-0-SMC, pp.

969-978.

Kiguchi, T., and Sher id an, T. B., n Selec.tion Measures of Plant Information with Application to Nuclear Reactors," IEEE Trans. Systems Man and Cvbernetics-;-tO be published April 1979.

Sheridan, T.B., nHuman Error in Nuclear Power Plants," Technology Review, Feb.

1980, pp. 22-33.

Tulga, M.K. and Sheridan, T.B., "Dynamic Decisions and Work Load in Multi-Task Supervisory Control," IEEE Trans. Svstems Man and Cybernetics, May 1980, 9p. 217-231.

Sheridan, T.B.,. "Mental Workload, What is it, Why Bother With It?", Human Factors Society Bulletin, 1980

• I Sheridan, T.B., *understanding Human Error and Aiding Human Diagnostic Behavior in Nuclear Power Plants," in Rasmussen, J. and Rouse, W.B. Human Detection and Diagnosis of System Failures, (Proc. of *NATO Symposium, Aug. 4-8), Plenum Press, to be published 1980 *

• -.J.1-

• HERBERT ESTRADA, JR.

Business.Address: MPR Associates, Inc.

1140 Connecticut Avenue, N. W.

Washington, D. c. 20036 Education: B.S. in Electrical Engineering, University of Pennsylvania, 1951 (With Distinction). Graduate Courses in Physics and Mathematics, University of Pittsburgh, 1952-1953.

Experience: MPR Associates, 1964-present.

Responsible *for technical coordination and direction of projects including design, analysis, testing and operation of nuclear and fossil-fueled power systems, hydraulic, pneumatic and electronic control systems, electrical systems, and fluid systems. Some specific projects include:

1. Design, analysis, installation, and testing of propulsion plant instrumentation and controls, to replace controls and instrumentation

. of questionable reliability and excessive complexity, for a class of five U.S. Navy (fossil fuel/steam powered) assault ships. This work included: analysis of manning skills and levels required for effective performance of operations manually, under both emergency and normal conditions; and, arrangement of controls, displays, valves, and the hardware for the effective performance of required tasks.

2. Design, analysis, and evaluation of instrumentation and control systems for power plants and experimental facilities.

3. Development of check and alignment procedures, and troubleshooting data, for on-line verification of the operation of automatic combustion and feedwater control systems. These procedures have been designed for use by semi-skilled personnel and have been successfully applied.

4. Analysis of steam power plant operations under cyclic load conditions, for the purpose of developing revised operating procedures and systems to accommodate cycling service. This work included the development and verification of computer codes and other analytical tools for predicting temperature response and estimating fatigue damage and crack propagation in heavy metal parts.of turbines and steam generators subjected to cycling service.

5. Development and verification of modular, general purpose computer codes for the analysis of the dynamic response of steam power plants to transients such as load rejection, loss of circulating water flow, loss (trip) of heat source, etc. Codes have been used to design turbine bypass systems, predict turbine overspeed, evaluate steam generator response, optimize combustion and reactor control system responses, size and set relief valves, etc.

6. Development of computerized heat balance codes for establishing power plant generation capability with one

or more feed heaters out of service,

• 7.

and with other steam and feed system components out of service.

Review of nuclear power plant control room human factors, and formulation and implementation of design changes to improve human factors. Work in this area has included testimony before an Atomic Safety and Licensing Board, and consulting services and other support of the EPRI development of an alarm system improvement guide.

Chief of the Nuclear Systems Engineering Section, Allison Division of the General Motors Corporation, 1963 to 1964.

Responsible for engineering and operations research activities on chemical systems for several energy conversion development projects.

Bettis Atomic Power Laboratory of Westinghouse Electric Corporation, 1951 to 1963. Responsibilities *included:

Supervisor of Advanced Surface Ship

• Control Engineering; Chief Test Engineer for acceptance testing of Bettis-designed reactors for nuclear submarines at Portsmouth Naval Shipyard; Lead Engineer for nuclear plant analysis of Skate Class Nuclear Submarines; Designer of power range instrumentation and reactor protection systems and hardware for USS Nautilus.

Honors: Bettis Distinguished Service Award -

April 1962, for outstanding contributions in engineering for submarine nuclear power plants and for technical guidance and effective coordination in the shipyard installation of propulsion systems in three classes of nuclear submarines.

Most Meritorious Patent Disclosure Award (with two others), Bettis Atomic Laboratory - 1963.

Publications: Author of numerous technical papers and

• reports, published and proprietary, on the following subjects:

Measurement of the dynamic responses and characteristics of nuclear power plants.

Transient behavior and control design for nuclear and fossil-fired steam generators.

Generalized computer codes for calculating nuciear and fossil steam plant reponses to normal and upset conditions.

Theory of operation and accuracy of flow measurement systems.

Descriptions and procedures on the theory, checkout, alignment and troubleshooting of control systems.

Evaluations of control room human factors and descriptions of measures for their improvement.

• • Evaluations of power plant alarm systems, procedures for performing such evaluations, and descriptions of alarm system improvements.

Holder of several patents, in addition to numerous patent disclosures, relating to power plant systems and controls.

., I -

• DWIGHT H. HARRISON Business Address: MPR Associates, Inc.

1140 Connecticut Avenue Washington, D. C. 20036 Education: B.S. in Mechanical Engineering University of Kansas - 1955 Graduate, Bettis Reactor Engineering School, Bettis Laboratory, Naval Reactors, U.S. AEC - 1956 M.S. in Mechanical Engineering California rnstitute of Technology -

1963 Ph.D. in Nuclear Engineering Pennsylvania State University - 1968

• Experience: Dr. Harrison has worked in nuclear engineering since* 1955, and spent seven years in the Naval Nuclear Propulsion Program headquarters. This experience has been directly related to the mechanical engineering design features of water-cooled and sodium-cooled power reactor cores and their directly associated components.

1966 - present -- MPR Associates.

Responsible for the coordination and technical direction of projects involving analysis, design, testing, O?eration, and manufacture of nuclear

. power systems and components and other mechanical equipment. Original analysis for and technical review of other in-house projects have also been performed. Some specific areas have been:

• 1.

2.

Design, manufacture, testing, field modification, and operation of reactor refueling equipment for both water and sodium cooled reactors1 Design, analysis, fabrication, assembly, installation, testing, and inservice inspection of reactor internal structures and repair of service failures in them1 3e Detailed human factors reviews of nuclear reactor control rooms,.

including preparation of guidelines, comparison of configurations to these guidelines, environmental surveys, reviews of experience, walkthroughs of procedures, the preparation of detailed plans for the human factor improvements, and the selection of materials and the field instructions to accomplish these improvements1 4e Design, analysis, fabrication, and operation of nuclear reactor control and drive mechanisms, reactor vessels, steam generators, pumps, valves and other equipment for both water-cooled and sodium-cooled reactors, and

5. Application of analytical methods to various nuclear and non-nuclear structural, fluid, and thermal problems, involving both the verification of computer analysis methods and the development of original computer programs -- both special and general purpose.

1955-1962 - Headquarters, Naval Reactors, U.S. AEC and Navy Bureau of Ships. Cognizant engineer responsible for mecnanical, thermal and hydraulic design, fabrication, and testing of reactor cores, pressure vessels, control rod mechanisms, and refueling equipment for several reactor types. These included: the Seawolf type reactors, the first Shippingport core, the

• destroyer type reactors, and the large ship type reactdor. Also directly associated with investigation of the effects of radiation on reactor pressure vessel materials, preparation of military specifications for reactor mechanical components, oper~tion and testing of prototype reactor cores, and prototype and shipboard refueling and servicing operations.

MEMBER: Society of Sigma Xi Tau Beta Pi - National Engineering Honorary Sigma Tau - National Engineering Honorary Pi Tau Sigma - National Mechanical Engineering Honorary Dr. Harrison has served on the Industrial and Professional Advisory Council for the Nuclear Engineering  !

Department at the Pennsylvania State University

• JAMES L. HIBBARD

• Business Address:

Education:

MPR Associates, Inc.

1140 Connecticut Avenue, NW Washington, DC 20036 J;3A in Chemistry Gustavus Adolphus College - May 1976 MS in Chemical Engineering Purdue University - December 1978 Experience: 1978-Present -- MPR Associates. Engineering work for nuclear and fossil power plants, and offshore loading platforms. Technical areas have included fluid flow analysis, heat transfer analysis, system and component evaluation, and stress analysis. Some specific tasks have been:

1. Engineering evaluation of sulfur removal/

recovery processes for coal gasification combined cycle power plants.

2. Determination of hydraulic loads on steam generator internals for postulated s~eam line breaks.

3. Feedwater heater evaluations, including inspection at disassembly, tube vibration analysis, and thermal performance analysis. *

4. Engineering review of the proposed hydraulic system design, and stress analysis of the crude oil piping, for an offshore oil loading platform.

5. Human factors review of a nuclear gene-rating station control room including procedure walkthroughs, panel review, and working environment evaluation.

September 1976-September 1978 -- Purdue University. Statistical analysis of chemical reactions in liquid-liquid dispersions. This work involved mass transfer, reaction kinetics, and computer simulation.

• June 1975-August 1975 -- Oak Ridge National Laboratory. Computer codes were written for deconvolution of X-ray fluorescence spectra, for identification of the spectra elements, and to simulate a proposed advanced element

.detection system (ESCA) .

• Business Address:

ALEX ZARECHNAK MPR Associates, Inc.

1140 Connecticut Avenue, N.W.

Washington, D.C. 20036 Education: B. A. in Physics Princeton University - June 1968 M. A. in Physics University of Maryland - January 1972 Experience: 1968 - present -- MPR Associates.

Computer simulation of thermal hydraulic transients involving critical.flow and waterhanuner phenomena in two-phase flow.

Participation in planning steady state and transient scale model testing of steam generators and centrifugal pumps, and evaluating test results. Thermal hydraulic analyses of steam generators and reactor internals, and ~evelopm~n~

of a computer model for design and

• performance evaluation of shell and tube heat exchangers. Development of.

recommendations to resolve manufacturing problems encountered with large nuclear.

power plant components. Evaluating feasibility of compu~er-based image enhancement of radiographs as a tool for non-intrusive examination of component internals. Developing improved techniques for maintaining LiBr* air conditioriing plants. Human factors review of nuclear power plant control room including evaluation of control panels and components* and procedure walkthroughs.

Summer 1967 -- !-1PR Associates.

Engineering Aide working on reactor shielding design *

• • Summer 1966 - Science Aide at U.S. Army Corps of Engineering, Fort Belvoir, Virginia, Georgraphic Intelligence Branch -

assisted in development of multi-spectral photographic techniques for remote sensing of the environment.~

Summers 1963-1965 -- Spectroscopic studies at Georgetown University Observatory.

Honarary Societies: Sigma Xi - National Honorary Research Society Publications: Bachelor's Thesis - "The Effect of Atmospheric Variations on Cosmic Black Body Radiation. "

• Coauthor -- "Thermodynamic Model of Centrifugal Pump Performance in Two-Phase Flow", Proceedings of ANS/ASME/NRC .

Int.ernational Topical Meeting on Nuclear Reactor Thermal Hydraulics, October 1980, ***1 NUREG/CP-0014 *

. *:.... ' .:.*_'. *," ~- "::' "*. ~*

.; : } ....

• ---*- ---- -** - -- .-*-.*-:~-----,.--*- --*-.--- -*- --- .