ML19305C711

Draft Human Engineering Evaluation Re Control Room.Control Room Exhibited Design Features That Are Inconsistent W/Human Engineering Stds & Practices.Engineering Problems Identified in Emergency Procedures

ML19305C711
Person / Time
Site:	North Anna
Issue date:	03/27/1980
From:	Mallory K ESSEX CORP.
To:	Beltracchi L Office of Nuclear Reactor Regulation
References
800307, NUDOCS 8003310293
Download: ML19305C711 (11)

Text

'9 ..

7, 3 r  ?=, :

-] $. '

March 27,19S0

.To: Leo Beltracchi From: Ken Mallory

Subject:

Findings of the Evaluation on North Ar.na - Unit 2 From March 17 to March 21, 1980, the Essex Corporation performed a human

. engineering evaluation of the Control Room at VEPCO's North Anna - Unit 2 Nuclear Power Plant. The procedures and guidelines used by Essex were the latest generation of those to be included in the guidebook for the human engineering review of Nuclear Power Plant Control Room design and operability.

Essex objectives for this review:

1. To identify features in the control room design that were contrary to human engineering principles and practices and would contribute to operator error.

2. To evaluate, based on human engineering criteria, the general operability of North Anna-2 during emergency operations.

1.0

SUMMARY

CONCLUSIONS 1.1 The North Anna - Unit 2 control room exhibited a number of design features (controls, displays, panel markings, etc.) that are inconsistent with human engineering standards and practices. These features will induce operator error.

1.2 A number of human engineering prob! cms were identified in the content and format of North Anna-2 cmergency procedures. Information accessibility, readability, and usability will be compromised by these problems.

1.3 A number of CR administrative and maintenance problems were identified.

i 2.0 OBSERVATIONS Each of the observations described below is given a Subjective Risk Assessment Weight based on the likelihood that a particular aspect of control room design will lead to  ;

an operator error in a critical activity. The likelihood is based on the opinion (s) of the .

Essex human engineer (s) reviewing the control room. l l

Category 1 - High Risk of Operator Error in Critical Activities I Category 2 - Moderate Risk of Operator Error in Critical Activities j l Category 3 - Risk of Operator Error 5 h ' ()

I Category X - Additional Evaluation Required. ,

ESS EX COR L'O RATION 333 North Fairfax Sireet, Alexandria. Virginia 22314. (703) 548-1500 800331g. M

1. Control-Display and General Control Room Organization The control room in general appears to lack any real organization. The various controls and displays have poor functional grouping. The colored tape retrofitted on the panels is a good indication of this. The tape, especially on the vertical meters, indicates a lack of symmetrical, orderly grouping. The controls on the benchboard frequently have systems embedded within systems. This lack of a logical grouping requires that the operator use visual scan patterns that are unnatural, possibly causing substitution or temporal error.

In addition, the benchboard, which should contain only primt.ry or priority systems, contains nonpriority systems. Examples of these systems are the flash evaporator and the reheater steam feed purge controls and displays. These controls and displays could be relocated without compromising panel operability. The space taken up by these systems could be given over to more important controls and displays, thereby enhancing visual scan of important displays and perhaps lowering the manpower requirements during emergency procedures. This would reduce dif ficulty in locating and operating critical controls and displays. (Category 1)

2. Vertical Meters Vertical meters, particularly those located on the vertical panel behind the benchboard, are difficult to locate and read from the primary benchboard panel.

Problems include:

e In strings, difficult to discrirninate/ locate e Not physically associated with related controls e Vertical integral labels are difficult to read from controls / normal operating position e Labeling font size on horizontal labels well below human engineering recommendeo practices e Inconsistency in numerical coding on labels for controls and asso-ciated meters impedes quick location and ldentification e Limit / range markings are needed to enable accurate interpretation of displayed information e Lack of pattern in some display layouts lends to confusion in location of meters.

_The problems with location and readability of vertical meters could result in misreadmg critical displayed information. (Category 1)

3. Annunciators There is no prioritization of the annunciators other than first out. The primary emergency annunciators are intermingled with the nonpriority annunciators and are characterized by the same size and color. The operator's having to visually search for the priority annunciators could lead to temporal errors. A good example of this is the green permissive board. The pre-alarm conditions are intermingled with the status and test annunciators.

Furthermore, when an alarm condition clears, the operator receives no annunciator alarm audible indication. The only indications are the offset of the annunciator light and a printout on the computer printer. As the operator should always be immediately aware of any changes in plunt system status, positive indication of alarm conditions cleared should be available. (Category 1)

4. Noise Level in Control Room Ambient noise ranges around 6SdB(A) in the main operating area and as high as 73dB(A) at the meterological panel. With the CR door open, noise level increases to approximately 78dB(A). The Unit 2 annunciator alarm horn registers about 83dB(A),

the computer bell,86+, and the P.A.,88+ at times.

According to MIL-STD-1472B, " areas requiring frequent telephone use or frequent direct communication at distances up to five feet shall not exceed 65dB(A)."

Emergency procedures walkthroughs demonstrated a need for direct communications among four operators stationed at different panels during emergency operations.

For example, the response to safety injection requires one operator to operate Charging Pump controls on the primary benchboard panel while communicating with another operator monitoring flow meters located on the Engineered Safeguards panel. Because of the noise level and distance between panels, communications will

. require shouting and essential messages could easily go unheard or be misinter-preted. (Category 1)

5. Inability to Monitor Safety Injection (SI) Status at System Level There is no integrated indication of SI status prior to its initiation. 51 status must be determined by checking various display locations, which requires either leaving the primary panel or communicating with another operator stationed at the vertical

panel. Critical time could be lost in initiating 51. Additionally, there is no integrated indication that - 51 is functioning appropriately following automatic initiation, again requiring checking displays at stations away from the primary benchboard. As a safety-related system, status monitoring information should be readily available to the operator. (Category 1)

6. , Core Cooling Monitors (T sat)

The Core Cooling Monitors on the primary vertical panel, which monitor pressure of the core cooling system, read out on horizontal scales that have significant parallax problems. This is compounded by the scale increments which are not readable from the benchboard. During an event, the operator may misinterpret the pressure level and reach saturation before he suspects it, thereby degrading the existing event significantly by losing positive control. The problem is further compounded by the lack of an indication of failure in one of the redundant systems. If each indicator is

• reading at a different poi,st on the scale, the operator has no way of recognizing which indicator is correct. For a precise reading, the operator must go back to the area on the right wing of the CR, climb a ladder, and read the T sat monitors. This takes him away from the primary area of the CR, possibly leading to temporal, interpretation, and reading errors. (Category 1)

7. Strip Charts Strip chart recorders have been used frequently in the control room. These recorders are characterized by the following problems: ,

e The third scale on the three pen recorders obscures pen position and trend lines e The chart recorders lack system labeling, making quick identification difficult. The pen labeling is often too long for easy identification and the pen color designation is faded or nonexistent (for example, -

- T-AVE, T-REF) e Some strip charts are mounted so low as to make easy reading and interpretation impossible e The scaling increments do not always agree with the increments on the paper.

e The strip chart recorders that are computer-controlled fail in the last

. position if the computer goes down. Once the computer comes on-line again, the strip charts must be reenergized

e Multi-channel impact recorders print indiscriminable numbers which overlap; trends are often impossible to identif y.

All of these problems contribute to human error. The 'oerator can make substitution errors, reading errors, interpretation errors, and temporo: arrors. All of these can lead to a degradation or even precipitation of an event. (Category 2)

8. Lamp Test The vertical panel, the back panel, and most of the benchboard have numerous transilluminated displays. There is no mechanism, procedural or electrical / mechanical, to test the lamps for burned out bulbs. If he suspects a bulb is out, the operator must replace it with a known good bulb. During normal operational procedures and emergency procedures, the operator may be relying on false information (a valve that is cycling with only one indicator on, giving the impression of being open or closed) or may be forced to make assumptions / decisions based on no positive indication of valve, breaker, pump condition. An erroneous decision, based on the lack of positive indication, could degrade the existing condition or precipitate a'new condition by making one of the following error types:

temporal, interpretation, reading (leading to activation error or substitution error).

(Category 1)

9. Procedures The emergency procedures in the procedures bench file are fairly easy to access by the operator. They have identifying tabs, by title, with one exception. The abnormal procedures have no tabs for identification and would be more difficult and time consuming to locate. " Working copies" of procedures are readily avai'able but are indexed in file cabinets by number.

Serious problems exist with procedures documents: -

e Steps are nested within other steps or stated in notes e Warnings and cautionary statements are listed as notes e Some instructions are ambiguous and extremely long, up to 57 words in one sentence e Some instructions require overly precise control processor settings, such as 71.73 = 1005 psig e The procedures give little information on what the system response is to a given operator action

e The procedures do not give the location of infrequently used controls or displays e The procedures are incomplete with steps missing e At least one abnormal procedure could not be performed to com-pletion by an operator (did not understand instructions) e Emergency procedures have not been verified by walkthroughs using a full complement of operators. Some abnormal procedures have not been verified at all.

e Certain procedures require the operator to time actions without timers available e There are instances where the terminology used in the procedures is dif ferent from that used on control panel labeling.

These problems were all identified in emergency procedures. Given the criticality of complete, accurate, and timely operator response under emergency conditions, emergency procedures should be of high fidelity to operational requirements and highly usable to the operator.

10. Violation of Design Conventions Conventions of switch position and color meaning are easily learned and useful to the operator. Where these conventions are violated or inverted, the likelihood of human error is greatly increased. There are a number of instances of violations of design convention in the North Anna-2 CR:

e Emergency generator exciter voltage switch operates with lef t being the " lower" and right being the " raise" position. This is contrary to the convention established on the secondary benchboard, which is the reverse. (Although the raise - lower convention is contrary to stereotype, human error is more likely to result from an inversion of a plant's established convention). (Category 2) e Feedwater heater switcha s.olate the close - open convention.

Instead, position is open - stop - close. (Category 2) e Boric acid transfer switch position 's contrary to stereotype (fast - -

- slow - off - auto) and is the reverse of the indicator light sequence.

An operator-induced error could result in switching to " fast" rather than "off" or to " auto" rather than " fast." (Category 2) e Four sump pump pushbutton switches violate a color meaning con-vention by having the " start" button green and the "stop" button red.

(Category 3) e Pressurizer safety valve temperature indicators are arranged on the panel C-B-A, contrary to stereotypical and conventional arrange-ment, A-B-C. (Category 3)

e Adjacent Foxboro meters for bearing cooling have contradictory meanings for scale indication. On one, the scale is upper end, "open,"

lower, "close." The other meter scale meaning is reversed.

(Category 3) e Meanirig for the color red in the North Anna-2 CR has an established convention of " start" or " running" condition. This convention is violated, particularly in back panels, and could induce a misinter-pretation of system or component status. (Category 2)

11. Computer The computer system has several problems. First is the sensor address point index.

These sensors are indexed by address point rather than by sensor name. if an operator wants to call up a specific sensor value, a list of address points must be scanned. The s.ensor address points should be indexed by three methods; 1) sensor name, 2) address, and 3) by system. Some progress towards this has been made as a partial system index is available.

i Second, the operators, when changing computer alarm setpoints, have no formal procedure for logging these changes. If an operator makes changes and goes off shif t without informing the next shif t of changes, the new operator may be making incorrect assumptions about system status. A formal log should. be kept for all changes made in sensor setpoints.

Third, the computer printer paper tends to jam because of an inadequate take-up mechanism. If the paper jams, all printing will be done on one line. The operator may lose information. A more positive take-up mechanism should be included.

(Category 3)

12. Hagan Process Controllers The Hagan process controllers do not give the operator a positive indication of valve

, operation. The indication received by the operator only reflects the control signal being sent. Without this positive indication of valve operation an operator may be acting on erroneous information, assuming that because an input has been made with the hagan, the valve is operating according to that input. As this could be false, a situation could be degraded or precipitated. (Category 3)

There are some specific problem Hagan controllers. The nonregulated heat exchange outlet temperature control reduces temperature by increasing the meter

- ~

value. The Master Pressuri: Controller increases to decrease pressure. Both of these are violations of stereotype and convention. If a control is increased, the display being effected by the control should also increase. In moments of stress, this inverse relationship could induce operator error. (Category 1)

13. Pressurizer Relief Valve The only indication of flow in the pressurizer relief line is temperature, which has a very slow response. Without a positive reading of flow (e.g., valve position), th'e

. primary plant can depressurize. (Category 1)

14. General Maintenance General maintenance of the CR is inadequate, as evidenced by the fo!!owing:

e Mismatched scales on the paper in at least one strip chart recorder (Category 3) e ink differing from pen color noted in two strip chart recorders (Category 3) e Incorrect labeling noted on primary panel (Category 2) e Unlabeled vertical meter with penciled-in scale (Category 2) e Several lamps out in emergency lighting system (Category 2) e Numerous labels becoming unglued f rom panels (Category 3) e Air pack (breathing apparatus) demonstrated by operator not func-tioning correctly (Category 2) a Bulbs burned out in several indicator lights (Category 2) e Step ladders, cables, and other maintenance equipment obstructing passage around control panels (Category 3) e Five alarm panel legend lights with bulb covers difficult to remove and requiring pocket knife or similar instrument to remove for bulb changing. Bulb size making bulbs difficult to remove from : ncket.

No bulb puller is available. (Category 3) .

15. . La,belin g Some labels are of low contrast (particularly the purple with black print) and are of poor readability. Label coding nomenclature is inconsistent with associated L controls. (Category 3) l F

4

16. Operator Protective Equipment There is an insufficient number of air packs to accommodate the minimum number of operators needed in the CR during an emergency. During the demonstrated donning of breathing apparatus, time to don was unacceptable and the particular air pack was not functioning.

The air packs are mounted too high to be easily donned by most operators.

Communications with the breathing apparatus are unacceptable for a distance of greater than five feet.

There is no protective clothing available to the operators in the CR.

An argument was given that the need for operator protective equipment for the North Anna CR is minimal because of the CR bottled air system. This argument is questionable based on a report in Nuclear News (March 1980) stating that during a transient at North Anna-1 in September 1979 the CR bottled air system failed to initiate. (Category 3)

17. Guarding of Exposed Controls North Anna has recognized the need to guard several 3-handic switches located on

~

the backboard panels from inadvertent actuation. There are several other switches also needing protection. The circ. water 3-handle controls on the backboard are located about shoulder height and in a high traffic area where they could be easily bumped. The turning gear motor oil pump J-handle controls on the secondary benchboard are close to the edge of the panel and could also be inadvertently activated or deactivated. (Category 2)

18. Number of Personnelin the CR A large number of personnel were noted in and around primary operating areas,

.primarily during day shift operations. Unnecessary personnel in the CR present the following problems:

e Impedance of quick operator response in the event of an accident e Distraction to the operator in maintaining cognizance over system and panel status e Additional and h'e avy noise level in the CR. (Category 2)

19. Emergency Lighting A full demonstration of emergency lighting was not accomplished so an evaluation of its adequacy could not be made. However, lamps were noted to be out when the emergency system was turned on. Insufficient emergency lighting could lead to improper switch selection or operation, or incorrect assessment of system status during critical operations. (Category X)

20. Staf fing Requirements During Emergency Operations Walkthroughs revealed a necessity to monitor and control systems from at least four stations:

o Primary benchboard panel e Secondary benchboard panel e Engineered safeguards on the vertical panel e Backboard panel.

CR appears operational during emergency with a minimum complement of forr operators. Minimum staffing requirements should be further evaluated to ensure adequate personnel for emergency operations. (Category X) 3.0 HUMAN ENGINEERING STRENGTHS Several human engineering strengths which enhance plant operability were identified in the North Anna 2 CR. They are:

1. Diagnosis of system failures in enhanced by the first-out capability incorporated into the annunciator system and the channel trip annunciators. Additionally, the diagnostic chart which is an attachment to the reactor trip emergency procedure is a positive aid to the operator in identifying the cause of the emergency.

2. The convention established with the placement of simple indicator lights (green - .

red) which is strictly adhered to will prevent misplacement of caps during bulb changing. Any reversalin color would be immediately identified as a mistake.

3. North Anna has taken positive steps in guarding exposed switches on the backboard panels by adding guard railing. The few remaining exposed switches should be similarly guarded.

, . E

-4. The checklists incorporated into the emergency procedures provide a very useful job

, performance aid.

t.

j 5._ .The horizont'al placement of vertical meters on the vertical panel is generally correlated with the placement of associated controls on the benchboard panel.

6. CRT can be read from all stations at the benchboard panel.  !

7. Annunciators are generally grouped over the systems the monitor.

i 8. All filed procedures are immediately accessible to operators.

) 9. The annunciator audible alarms are loud enough to be heard over CR ambient noise l

• level, i 10. Normal lighting appears adequate.

> i I

I t

l O

4 4

i i

l

, ..s ., . _ , _ . , _ #, ., m._ , ,, . _,,_.

_ _ , - _ ,,.-,..--,- . . , . . _ . , . -,._ , y. ,