ML19325C158
| ML19325C158 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 02/22/1988 |
| From: | Johari Moore LAWRENCE LIVERMORE NATIONAL LABORATORY |
| To: | NRC |
| Shared Package | |
| ML19325C159 | List: |
| References | |
| CON-FIN-A-0450, CON-FIN-A-450 UCID-21133, NUDOCS 8908280116 | |
| Download: ML19325C158 (25) | |
Text
_ _ _ _ _ _.
s l
j l
1 UCID 21133
)
)
l l
i Grand Gulf Nuclear Station, Unit I i
Terchnical Evaluation of l
Detailed Control Room Design Review l
6 i
l t
James W. Moore l
t t
I l
i l
i i
r February 22, 1988 4.
h-
[
hb E M
N v.
n
~
- t
+;as;;r :;
. v; j
f,p RF
?
Ihis is an informal report intended primaril) for internal or limited esternal distri-l, bution. I he opinions and conclusions stated are those of the sother and ma) or me) l
.f i
not be those of the laborator).
+
l This unrL was supported by the L!nited States. Nuclear Reevletor, Commission on-der a \\lemorandum of Linderstanding with the L nited States Department of Eners).
NRC FIN No. A0450 f
i l
l
(
t
- }O9 [ib JT pp I
q
i I
DISCLAIMER This darumset see propeted on se acesses of *wk opensored by en ageney of the United States Government. Neither the t noted Steeen Governeses ser any agency thereof. not may of their emp6eyees, mobes say omtreaty espreemd of in94ied, or seemmes any legal 16ebi44ty et reopeamsbility for the seestery. comp 6steeses. or esefolases of any
[
informeteen, appetetes. protect, or process dieeleeed. et reptoesnes that 6te see oesid met 6aftinge pre,etely owned ryghts. Reference herem to say specifle comewee6el presset, pretees, or eertite by trade name. treesmerh. monofee.
I turer et otherwete. esse not secoseer6ly coaststote or 6seply its endernement. recommentet6en. et feversas by the United States Govermaeont et any agency thereof. The *W and opniens of nothers emptemmed heteen de not seeeenerity seese er refleet these of the Laited Stases Goveteneet et say agency thetoef.
I t
I
?
t l
l i
e i
i I
I t
l l
l I
b 8
1 i
l
pap; J,;
)
[
~
I i
t CONTENTS L
1.0 Introduction...........................................................4 5
L 2.0 Evaluation.............................................................4 r
2.1 Establishnent of a Qualified Multidisciplinary Review Team........
4 2.1.1 Criteria...................................................
4 e
t 2.1.2 Discussion.................................................
4 l
{
2.1.3 Conclusion.................................................
5' f
2.2 Function and Task Analyses to Identify Control Room.0perator Tasks l
and Information ana Control Requirements Durin
-0perations....................................g Emergency r",
.................... 5 L
N i
2.2.1 Criteria...................................................
5 2.2.2 Discussion.................................................
6 s
2.2.3 Conclusion.................................................
7 2.3 Comparison of Display and Control Requirements with a Control Room Inventory.........................................................
7 2.3.1 Cr4ter4a....................................................r i
2.3.2 Discussion.................................................
7
- i
\\
2.3.3 Conclusion..................................................B j
2.4 Control Room Survey to Identify Deviations from Accepted Human
[
Factors Principles.................................................S 1
2.4.1 Criteria...................................................
8 1
r 2.4.2 Discussion.................................................
8 l
i 2.4.3 Conclusion.................................................8
.l 2.5 Assessment of HE0r to Determine which are Significant and Should Be Corrected......................................................
9 i
. I 2.5.1 Criteria...................................................
9
]
r k
t ame:21133 toc:02/22/88 !
b f
u
y_m o u.g i
, ~.
}t 11 t
'g
- L i,., d ;.'
i i'
- 2. 5. 2 - D i s c u s s i on................................................. 9 2.5.3 C o n c l u s i o n................................................ 10 e
L 1
L'
- 2. 6 L Sel ec t i on o f Des ign I mprovement s................................. 10 h
2.6.1 Criter1a..................................................
10 l
2.6.2 Discussion................................................ 10 1
2.6.3 Conclusion.................................................
12 P
2.7 Verification that Selected Improvements will Provide the decessary Correction and will not Introduce New dEDs.......................
12
[
2.7.1 Criteria..........................................'........
12 L
2.7.2 Discussion................................................ 13 p
P 2.7.3 C o n c l u s i o n................................................ 13 2.8 Coordination of Control Room Improvements with Changes from Other R
Programs suen as the Safety Parameter Display System, Operator i
Training, Reg. Guide 1.97. Instrumentation, and Upgraced Emergency f
Operating Procedures.............................................
13 u
(
2.8.1 Criter4a..................................................
13
[
2.8.2 Discussion................................................
14 I
2.8.3 Conclusion................................................
14 2.9 Other DCROR Activities...........................................
15 i
2.9.1 Criteria................................................... 15 il' 2.9.2 01scussion................................................
15 2.10 Summary Report..................................................
15 e
2.10.1 Criteria.................................................
15 2.10.2 Discussion...............................................
16 I
I 2.10.3 Conclusion............................
.................. 17
?
f:
3. 0. S u mm a r y............................................................... 1 7 r!.
4.0 R e f e r e n t e s............................................................ 19
- ame:21133 toc:02/22/SS i I
h
['
f '.
e y
)
r
1.0 INTRODUCTION
l System Energy Resources, Inc. (SERI)* submitted the Sumary Report for the i
Grand G.llf Nuclear Station (GGNS-1) Detailed Control Room Design Review i
(DCRDR) to the Nuclear Regulatory Comission (NRC) on July 31, 1986. That report was reviewed by Lawrence Livermore Nctional Laboratory (LLNL) personnel
+
l who then recomended to NRC a preimplementatien audit of the DCRDR for l
GGNS-1.
The preimplementation audit was conducted by the NRC and LLNL on March 3-6, 1987
)'
2.0 EVALUAT!0N LLNL reviewed all information on the GGNS-1 DCRDR available to date [1, 2, 3) in order to evaluate whether DCRDR requirements in Supplement I to NUREG-0737
[5))hadbeensatisfied.
[4 The guidance contained in Section 18.1 of NUREG-0800 (the Stancard Review Plan) and NUREG-0700 [6] were used in the performance y
of the LLNL evaluation.
This report presents the LLNL evaluation of the DCRDR for GGNS-l.
2.1 ESTABLISHMENT OF A QUALIFIED MULT!DISCIPL! NARY REVIEW TEAM 2.1.1 Criteria Although the organization for conduct of a succestful DCRDR can vary widely:
[
it is expected to conform to some general criteria.
Overall administrative leadership should De provided by a utility employee.
A core group of specialists in the fields of human factors engineering, plant operations, instrument and control engineering, and nuclear engineering are expected to participate, with assistance as required from other disciplines.
Statfing to accomolish each DCRDR element should include appropriate experts.
Human i
factors expertise should be included in the staffing for accomplishment of most, if not all, DCRDR elements.
(The Stancard Review Plan describes criteria for the multidisciplinary review team in more detail.)
The DCRDR team should receive an orientation, and they should be given sufficient authority to carry out their mission.
2.1.2 Discussion The DCRDR review team at GGNS-1 consisted of a core team of specialists and i
I supporting team members (used only on an as-needed basis).
Overall administrative and technical direction was provided by the SERI DCRDR review team leader, who also provided the primary interface of the DCRDR review team witn ant management.
Through this interface the DCRDR review team was able to ac; ass necessary information, facilities, people, and materials.
}
t
- Formerly Mississippi Power and Light Comoany, ame:21133:02/22/88.
?l r
L-('
The core team consiste'd of representatives from the following areas:
Operations, Instrument and Control Engineering, Human Factors, and Nuclear
[
Engineering.
Human Factors Engineering support and direction for the core team were provided by consultants from General Physics Corporation (GP).
The r
l Qualifications and level of task involvement of the present SERI DCRDR review team are adequate, The GP review team memoers received a one-day orientation from the SERI engineering staff on the plsnt-specific technical aspects of GGNS-1. All of L
the other SERI core review team members received a two-day orientation on general Humen Factors (HF) methods and practices provided by GP.
i-During audit discussions SERI agreed to place a complete record of the DCRDR team members presently involved, including their disciplines and assignments,
- n the permanent DCRDR files.
SERI provided the NRC cudit team with a sample i
of this information, and the audit team deemed it acceptable.
In addition, SERI should, in a Supplemental Summary report, provide information concerning the continued involvement of HF and Operations team members in the ongoing implementation phase of the DCRDR.
Included should be names of team memoers, their disciplines, and their team assignments.
SERI provided an explanation of a proposed Task Team concept for the implementation activities of tne DCRDR.
That concept appears acceptable; however, SERI should assure participation of HF and Operations personnel.
If SERI decides to use the team i
concept, the concept should be thoroughly documented in a Supplemental Sunrnary Report.
Documentation of the Task Team concept should include:
a description of all team memoers, their disciplines, and their assignments.
r 2.1.3 Conclusion To date, SERI has satisfied the requirement for establishment of a qualified multidisciplinary review team.
However, in order to fully satisfy this reouirement, SERI must maintain an appropriate team through the remainder of the DCRDR activities.
SERI should describe team-memoer qualifications and assignments in a Supplemental Summary report.
l 2.2 FUNCTION AND TASK ANALYSES TO IDENTIFY CONTROL ROOM OPERATOR TASKS AND INFORMATION AND CONTROL REQUIREMENTS DURING EMERGENCY OPERATIONS 2.2.1 Criteria The purpose of the function and task analyses is to identify the control room operator's tasks during emergency operations and to determine the information and control capabilities the operators need to perform those tasks.
The following process is acceptable for conducting the function and task analyses.
1.
To identify and describe those tasks operators are expected to perform, analyze the functions performed by systems in responding to transients and 3
accidents.
i L
ame:21133:02/22/88 l l
l
{n L
2.
For each task identified in Item 1 above, determine the information (e.g.,
l parameter, value, status) that signals (1) the need to perform the task, (2).the control capabilities needed to perform the task, and (3) the o
feedback information needed to monitor task performance.
Displays and controls are 'not identified at this stage.
However, operator tasks have been identified and described, and the information and control capabilities necessary to perform those tasks are being determined.
tp 3.
To determine those characteristics essential to adequate task performance, analyze the information and control capabilities determined in Item 2 above.
Information characteristics include, for example, parameter type, dynamic ' range, setpoints, resolution / accuracy, speed of response, units and need for crending, and alarming.
Control characteristics include:
type (discrete or continuous), rate, gain, response requirements, locking functions, and feedback information associated with control use.
The described process is prescriptive.
It should identify, in detail, what operators need to do in order to control systems that mitigate the consequences of transients and accidents.
The process should also identify an appropriate functional interface-between the operators and those systems.
In addition to their use in the DCRDR, the function and task anaiyses should provide the basis for complete and technically adequate Emergency Operations Pro:edures (EOPs).
Identification of tasks and necessary information and control capabilities should be based on engineering ano analyses that are independent of displays and controls in the control room.
2.2.2 Discussion The description of the Function and Task Analyses (FTA) provided in the SERI's DCRDR Sunnary Report for GGNS-1 is identical to that in the Program Plan. The process was found to be adequate by the NRC in a June 27, 1985 meeting with SERI [3, 7].
During the Maren 1987 preimplementation audit, the audit team reviewed the FTA working documents and database management system outputs in order te verify implementation and auditability of the FTA process. We founo the process SE.9I followed is that described in the Program Plan and Summary Report.
I We agree with the NRC's previous finding of acceptability of the FTA l
process.
The GGNS-1 FTA process adequetely identifies the operator tasks that enable operators to respond to transients and accidents.
In addition, the FTA process has adequately determined and identified the necessary instruments and controls (including the specific characteristics and information requirement) i that enable the operator to perform the identified tasks in responding to i
The GGNS-1 documentation for the FTA is well organi:ed and
.provides a comprehensive and auditable trail through the process.
b ame:21133:02/22/88 t
f.
[
t; S
2.2.3 Conclusion e
To date, SERI has satisfied this element.
However, SERI should review for impact on the FTA, any changes to the GGNS-1 Emergency Procedures that result from the NRC's review of the Procedure Generation Package.
The FTA and subsequent DCRDR elements should be reiterated to address any such impacts.
2.3 COMPARISON OF DISPLAY AND CONTROL REQUIREMENTS WITH A CONTROL ROOM INVENTORY 2.3.1 Criteria A comparison of display and control requirements with a control room inventory determines the availability and suitability of displays and controls required for performance of the E0Ps.
The quality of the function and task analyses and the. control room inventory determines the success of this element.
Display and control requirements should be derived from analyses which are sufficiently detailed to support development of complete and technically adequate E0Ps.
Characteristics appropriate to the task should be described for each display and control need identified by the function.and task analyses. The contr;l room inventory should be a complete representation of displays and controls currently in the control room.
The inventory should include characteristics of current displays and controls necessary for meaningful comparison with the results of the function and task analyses.
Once an adequate control room inventory is developed, a systematic comparison should be made of information and control capability requirements with existing controls and displays.
Displays and controls determined to be i
unavailaylo or unsuitable should result in documented Human Engineering Discrepancies (HEDs).
2.3.2 Discussion The GGNS-1 control room inventory used panel layeut drawings of the "as built" configuration of the control room.
SERI's minutes of a June 27, 1985 meeting with.the llRC state that GGNS-1 also used color photographs and the GGNS-1 Instrument Index.
The inventary identified all-existing displays and controls.
SERI stated that in cases where necessary information could not be i
obtained from the initial sources, it was obtained directly from the control room.
The DCRDR Summary Report gives an example of the Equipment Characteristics Form used to record inventory data.
Recorded information was transferred from this form to a computerized database for comparison with results of the FTA.
The availability of necessary instrumentation and controls was determined by comparing information and control capaDility needs identified by the FTA with the control room inventory data in the computerized database.
Differences were noted as HEDs by the SERI DCDR review team.
ame:21133:02/22/88 t
f.
t-SERI described the methodology used for determining the suitability of instruments and controls in a flowchart form in the summary report.
All instruments and controls were compared to the criteria to determine if the equipment was suitable to meet the demands of emergency contingencies.
Instruments and controls determined to be unsuitable were identified as HEDs.
SERI 'also conducted a validation effort.
Walk throughs of GGNS-1 E0Ps were c'
used'to_ evaluate the dynamic operational aspects of the control room.
Real-time simulator runs were also used.
This validation effort consisted of taping scenarios being run on the simulator.
The operators involved and DCROR review team members reviewed tapes and identified possible errors or problems.
These problems or errors were then documented as potential HEDs.
2.3.3 Conclusion SERI satisfies the requirement of Supplement I to NUREG-0737, comparison of display and control requirements with a control room inventory.
However, it may be necessary.to compare results from any revised portions of tne FTA (e.g., changes due to NRC comments on the Procedure Generation Package) with the control room inventory.
'2. 4 CONTROL ROOM SURVEY TO IDENTIFY DEVIATIONS FROM ACCEPTED HUMAN FACTORS PRINCIPLES e
2.4.1 Criteria The key to a successful control room survey is a systematic comparison of the control room with accepted human engineering guidelines.
One eccepted set of guidelines is provided by Section 6 of NUREG-0700.
Discrepancies between the control room and human engineering guidelines should be documented as HEDs.
2.4.2 Discussion The GGNS-1 Control Room Survey was conducted by the DCROR review team HF specialists, with assistance from the SERI operations staff.
The review team used checklists based upon NUREG-0700 (Section 6).
They conducted a systematic, panel-by-panel comparison of the control room against the checklists. The actual control room was used only in specific cases.
For the major portion of the survey process, the team used panel layout arawings, panel pnotos, and the simulator.
All deviations from the checklists were recorded as HEDs.
- 2. 4. 3 - Conclusion SERI conducted a rigorous and systematic control room survey. They have satisfied this requirement of Supplement 1 to NUREG-0737.
ame:21133:02/22/88
$~
f i
2.5 ASSESSMENT
OF HEDS TO DETERMINE WHICH ARE SIGNIFICANT AND SHOULD BE CORRECTED.
L
- 2. 5. '1 Criteria L
HEDs should be assessed for significance.
The potential for operator error L
and the consequence of that error in terms of plant safety should be considered systematically.
Consideration of the combined effects of HEDs on operator performance should be included specifically in the assessment process.
For example, the control room survey identifies a number of HEDs f.-
related'to a particular display.
All of those HEDs may affect the operator's ability to read that display. While the impact of one of those HEDs may not L
be very great, the combined effect may be that readability is unacceptably bad.
t The result of the assessment process is a determination of which HEDs should be corrected because of their potential impact on plant safety.
Decisions f
about whether or not HEDs are significant in terms of potential impact on plant safety should not be compromised by cost considerations of corrections.
2.5.2 Discussion The assessment process at GGNS-1 started with each DCRDR team member individually assessing each of the HEDs identified during the DCRDR process.
t The team members assessed and categorized the HEDs based on criteria provided in NUREG-0800.
The primary criteria were:
(1) whether or not the HED had resulted in a documented error and (2) what impact the HED had on plant safety. The DCRDR team reviewers used the above criteria to place the HEDs in one of the four following categories:
- Category I HEDs associated with documented errors that resulted in unsafe conditions or Technical Specification violations.
- Category II HEDs associated with hign potential for errors tnat may result in unsafe conditions or Technical Specification violations.
4
- Category III HEDs associated with low potential for errors that result l
in unsafe conditions or Technical Specification i,
violations.
- Category IV HEDs not important to safety.
After the individual assessment of each HED the DCRDR review team met as a whole to discuss each HED.
Upon reaching a consensus, the review team took one of the following actions:
Document and close out HEDs determined to be invalid.
Combine HEDs determined to be generic.
ame:21133:02/22/88,,
k' r'
[
L j
3 Place each HED in the final and proper category.
3 The DCRDR review team then evaluated all Category IV HEDs for potential l
interactive and accumulative effects.
This evaluation was accomplished by sorting all Category IV HEDs on the basis of panel / system.
The DCRDR team then reviewed the HEDs in order to determine the number of Category IV HEDs that' existed on or within a panel / system.
At the same time, HEDs were evaluated to determine to n. hat extent they would increase the potential for error on that particular panel or system.
In any case, where more than three Category I/ HEDs occurred per panel, the DCRDR team leader and lead human tactor specialists assessed the similarity of these HEDs.
If the HEDs were determined to be similar in operation of the system, checklist area. or in human performance modality, the HED was considered to have the potential for interactive effect.
HEDs identified as having such potential were then upgraded to the next higher priority.
However, only HEDs that had been previously designated as "no action" were upgraded. If a HED had already been identified for correction, no upgrading of prioritization was done.
As part of. the DCRDR process. SERI stated that all remaining unresolved HEDs from 9 e Preliminary Design Assessment (PDA) were subjected to the same assessment process as DCRDR HEDs.
2.5.3 Conclusion The process used by SERI for assessment of HEDs to determine which are significant and should be corrected is acceptable. GGNS-1 satisfies this requirement of Supplement 1 to NUREG-0737, 2.6 SELECTION OF DESIGN IMPROVEMENTS 2.6.1 Criteria The basic purpose of selecting design improvements is to correct safety-significant HEDs.
Selection of design improvements should include a i
systematic process for development and comparison of alternative means for i
resolving HEDs.
Both enhancemert and design modification may be considered.
The selection of design improvements should work to bring the control room into agreement with acceptable human factors engineering guidelines.
Existing control room conventions (explicit or implicit) should be documented and reviewed for ccmpleteness of application and for conflicts with each other and with accepted human factors engineering guidelines.
HEDs may be resolved by application of existing or revised control roons conventions.
HEDs may also be resolved by explicit new control room conventions, which should be developed and documented as part of the DCRDR process.
]
2.6.2 Discussion The GGNS-1 Summary Report states that after HEDs were categorized, the DCRDR team met and reviewed them all in order to provide tentative resolutions.
The amc:21133:02/22/88.
J
y s..
g, 3.
H HEDs, with their tentative resolutions, were then distributed to the p
appropriate OCRDR team members.
The individual HED resolutions were reviewed by the team members who also solicited input from appropriate subject matter experts (i.e., operations, engineering, and licensing). The HED resolutions (which were, in some cases, revised) were then tabulated and distributed to the entire DCRDR review team for approval, if there was any disagreement over a specific HED at this time, the DCRDR review team leader made a final determ' nation.
To aid the review team's response to human factors concerns, all HED resolutions were compared against GGNS-l's Human Factors Criteria document (ES-17). In addition, all HED resolutiont were examined for effects on operator task performance.
As a final check, operations personnel reviewed all HED resolutions. and provided feedback on the acceptability of the resolutions.
At this point a final decision on HED resolutions was made by the DCRDR review team, and the tabulated results were forwarded to management for approval.
A justification was provided for all HEDs that were determined as "no action" items and for items that would be only partially resolved.
GGNS-1 stated in the Summary Report and during March 1987 audit discussions that all unresolved HEDs from the earlier PDA will be subjected to the same selection-of-design process as HEDs identified in the DCRDR.
While the organization and process for SERI's selection of design improvements process appears to be acceptable, the overall process was not complete at the time of the Maren 1987 preimplementation audit.
The following items need to be completed or addressed:
To resolve some HEDs, the Summary Report contains commitments for i
ongoing review activity.
Plans for resolutions of these HEDs must be complete before this element is fully satisfied.
SERI snould provide, for NRC review, final reso
- ions to HEDs with a priority rating of 1, 2, and 3.
l All single indicator lights should be reviewed to determine whether, for examole, they should be modified in accordance with accepted human factors engineering criteria or receive special attention during panel walk downs.
Specifically, this applies to HED 3S2; however, it also relates to all similar HEDs and conditions.
SERI should continue upgrade and refinement of ES-17.
During our review of the document, coverage of some important areas appeared to be incomplete or lacking (e.g., control handle shape ; ode, mimic symbol code).
ES-17 is a DCRDR product which is used as a survey tool and guide to selection and verification of design improvements.
It is expected that design of future changes to the control room will conform to ES-17 guidelines.
Althougn ES-17 has been tailored from existing human factors engineering guidelines, it needs to be augmented and further tailored to specify exactly how those guidelines have been implemented at GGNS-1.
As part of the preimplementation audit, the NRC audit team toured the GGNS-1 control room.
It was apparent during the tour that SERI had implemented dmc:21133:02/2:/88 E,,
g C
I' enhancements and improvements in the control room as a result of the earlier 1
PDA portion of the DCRDR However, examination of the control room panels h
indicated that the control boards have not been well maintained since GGNS-1
[
noted by the NRC audit team, has become operational.
The following short list gives specific examples f.
Loose pieces of mimics laying at.the bottom of control' panels throughout control room.
Mimics on the RHR A board are pulling up and have loose pieces.
Smeared scale on tracking recorder on P870 STM/TURB/ AUX panel.
Excessive dirt on switches and keypads.
At GGNS-1 general housekeeping and maintenance of the operator interfaces with the control' room appeared to be poor.
We recommend this finding be treated as I
' a generic ~ HED and that it receive a progransnatic, rather than example-by-example, response.
SERI should review the proposed implementation schedule for correcting HEDs.
l and provide a firm consnitment for category 2 and 3 HEDs.
SERI has' committed to. implementing all category 1 HED resolutions by the end of refueling
' outage i..
2.6.3.
Conclusion The SERI organization and process for selection of design improvements is acceptable.
However, the process is not complete.
This element will not be satisfied until the activities identified in 2.6.2, above, are complete.
2.7 VERIFICATION'THAT SELECTED IMPROVEMENTS WILL PROVIDE THE NECESSARY CORRECTION AND WILL NOT INTRODUCE NEW HEDS 2.7.1 Criteria A key criterion of DCRDR success is a consistent, coherent, and effective interface between the operator and the control room. One good way to satisfy i
that criterion is through (1) iteration of the selection processes for design i
improvements, (2) verification that selected design improvements will provide 1
the necessary correction, and (3) verification that improvements will not introduce new HEDs.
The verification processes should be completed prior to implementation of design improvements in the control room.
Exceptions might i
be workspace/ environmental HEDs for which " final verification" (i.e., final j
adjustment) may have to wait upon implementation of the design improvement in i
the control rcom.
Techniques for the verification process might include-partial resurveys on mocked-up panels, applied experiments, engineering
[
analyses, environmental surveys, and operator interviews.
Each iteration of i
the selection and verification processes should reduce inconsistencies in the operator-control room interface, while increasirig the coherence and
)
ame.:21133:02/22/88 <
Il
7:
y L,
n
[
effectiveness' of that interface.
The consistency, coherence, and offectiveness of the entire operator-control room interface is important to operator performance.
Thus, evaluation of both the changed and unchanged portions of the control room is necessary during the verification processes.
L 2.7.2 Discussion SERI stated in the Summery Report and during the March 1987 audit that the t
verification was performeo as part of the selection-of-design-improvements process. As SERI explained to the audit team, the verification process, up to this point in time, has consisted of comparisons of proposed fixes against l
SERI presented a brief description of a proposed expanded verification i
process during the audit.
While the initial portion of the verification process in which SERI compares proposed design changes against ES-17 is appropriate, it is not sufficient to fully satisfy the verification element.
In the expansion of the verification process, proposed fixes should not only be compared with guidelines, they should also be reviewed in a manner which takes into account their relatio m.ip with'other fixes throughout the control room.
The perspective should go beyond HED specific concerns to functional concerns (e.g., not "is label lettering the acceptable minimum size," but "can the operator find and' associate with the proper control or display, and read labels from all appropriate location (s) given label size and location, viewing angle, letter size, stroke width, letter color, color contrast between letter and label plate, color contrast between label plate and panel, and lighting").
The verification process should be largely complete before implementation of fixes in the control room.
However, verification of some fixes can, and probably should, extend beyond implementation (e.g., environmental HEDs--lighting, noise, etc.--may require " fine tuning" of corrections after implementation).
2.7.3 Conclusion l
This element will not be satisfied until plans for verification are completed l
and imolemented.
Verification plans snould take into account coments in 2.7.2 above, and the plans should be provided to the NRC for review.
2.8.
COORDINATION OF CONTROL ROOM IMPROVEMENTS WITH CHANGES FROM OTHER PROGRAMS SUCH AS THE SAFETY PARAMETER DISPLAY SYSTEM, OPERATOR TRAINING, i
REG. GUIDE 1.97 INSTRUMENTATION, AND UPGRADED EMERGENCY OPERATING PROCEDURES I
2.8.1 Criteria Improvement of emergency response capability requires coordination of the OCRDR with other activities.
Satisfaction of Reg. Guide 1.97 [8] requirements and addition of the SPOS will require modification and additions to the control room.
Those modifications and additions should be specifically i
addressed by the DCRDR.
Exactly how they are addressed will depend on a j
number of factors, including the relative timing of various emergency response capability upgrades.
Regardless of the means for coordination, the result amc:21133:02/22/88.
i t
i-
[.7,
l should be an integration of Reg. Guide 1.97 instrumentation and SPDS equipment L
into a consistent, coherent, and effective control room interface with the operators.
Ideally, coordination of the DCRDR with upgrade of the EDPs should begin with a detciled task analysis which sJpports both.
It is also possible to coordinate the DCRDR and upgrade of the E0Ps, which begins with the generic emergency response guidelines developed by the owners groups.
The result of coordinating the DCRDR with upgrade of the E0Ps should be a control room which supports complete and technically adequate E0Ps.
There are two aspects to coordination of the DCRDR with training.
One is the l
use of training to resolve HEDs.
The other is familiarization of operators with control room modifications and enhancement, and these may be fairly extensive.
The result should be operators w? o are thoroughly familiar with their revised control room interface and who have the specific knowledge necessary to deal with HEDs which are being resolved by training.
2.8.2 Discussion On June 27, 1985, SERI responded to concerns identified in the NRC Review of the GGNS-1 DCRDR Program Plan (9] for GGNS-1 during a meeting with NRC.
At-that time the NRC found the explanation of the DCRDR coordination effort to be adequate. During the March 1987 preimplementation audit SERI provided the NRC review team with the following additional information concerning the coordination effort at GGNS-1:
The DCRDR team leader meets frequently with the GGNS-1 R.G.1.97 coordinator to discuss and ensure the integration of applicable on-going R.G. 1.97 with DCRDR activities.
Coordination between the DCRDR effort and the upgraded E0Ps is accomplished by having the DCRDR team leader also function as the GGNS-1 upgrade manager.
Integration of the SPDS and Training is well documented and maintained by frequent meetings with Training and SPDS personnel.
SERI will rieed to ensure that all HEDs identified on the SPDS are subjected to l
the same assessment, implementation, and tracking process as HEDs identified during the DCRDR.
Careful coordination will ensure consistent operator l
interfaces with the SPDS and the control room as a whole.
2.8.3 Conclusion To date, coordination of the DCRDR with other related programs at GGNS-1 is I
acceptable.
This element will be satisfied if SERI continues present coordination efforts through completion of the DCRDR.
However, coordination with SPDS activities should receive special attention (as noted in 2.8.2 above).
amc:21133 :02/22/88 j
r; c
V,.
^'
b(..
y p
2,9~ OTHER DCRDR ACTIVITIES y
2.9.1 Criteria b
As part of the DCRDR. licensees and applicants may perform activities in addition to those required by Supplement I to NUREG-0737, Criteria for several such activities can be found in NUREG-0700.
Results of any additional
{
DCRDR activities should be used to augment or extend the benefits of the-t DCRDR.
l 2.9.2 Discussion Although it is not a DCRDR requirement, SERI conducted an.0perating Experience p
Review (OER).
The OER consisted of two phases. The first phase of the OER was l.
a historical document-review of Licensee Event Reports'(LERs) for GGNS-1 and two similar plants (LaSalle and Susquehanna).
The LERs for these specific plants 'were studied to identify documented occurrences of human-factors-i related problems.
The DCRDR review team compiled the results of this review'
.l on i.ER Review Results-forms.
All' identified problems that were deemed applicable to GGNS-1 by the DCRDR review team were documented as HEDs.
The second phase of the OER was interviews with operators.
Human Factors Specialists from the DCRDR review team distributed confidential questionnaires
+
l to operations personnel and training instructors and tabulated the results, t
Upon complet#on of the initial review the HF members conducted follow-up operator interviews using the control room and simulator.
After completing the follow-up interviews, the Human Factors Specialists reviewed all the collected data and determined which identified areas of concern were HEDs. -
1 Those HEDs were then subjected to the normdl HED assessment and implementation o
process.
As part of the DCRDR activities, SERI also included the Remote Shutdown Panel (RSP).
The RSP was evaluated in the same manner as the control room panels.
HEDs were generated and subjected to the same evaluation and implementation process as HEDs from the control room.
2.10
SUMMARY
REPORT 2.10.1 Criteria A Summary Report is to be submitted at the end of the DCRDR.
Supplement I to i
E NUREG-0737 requires that, as a minimum, the Summary Report shall:
l 1.
Outline proposed control room changes.
l 2.
Outline proposed schedules for implementation.
3.
Provide summary justification for HEDs with safety significance to be left uncorrected or partially corrected.
amc:21133:02/22/88,
l '.
F l
L *l
(
I' Control room changes should contribute to a significant reduction of risk and
[
.to enhanced safety of operation.
Long-term risk reduction should be considered, as should the potential for temporary declines in safety caused by t'
L the relearning that follows control room changes.
Means to combat temporary declines should be included as part of the implementation plan.
2.10.2 Discussion SERI has submitted a Summary Report for the GGNS-1 DCRDR.
That document does i
provide information about proposed control room changes, implementation schedules, and justifications for not correcting or partially correcting i
HEDs.
There are, however, several concerns.
With respect to control room changes, these concerns are:
Responses to some HEDs do not identify specific corrections; instead, they indicate the need for further study, f
Responses were not provided to HEDs identified during review of the SPDS.
Responses to some HEDs may need revision (e.g., "no action" HEDs which SERI has since determined require correction.)
There was also some concern with implementation schedules for HED corrections.
Here is the proposed implementation schedule for HEDs identified during the DCRDR:
1.
Implement all Category I resolutions by the end of refueling outage number 2 (RF02).
2.
Without impacting critical path of the refueling outage, implement as many Category 2 and 3 resolutions as possible by the end of RF02.
3.
As a goal, complete the remaining Category 2 and 3 modifications by the end of RF03.
i 4.
Category 4 modification will be further evaluated for implementation by the end of RF03.
The schedule for completing Category 2 and 3 HED modifications was stated as a goal.
A firm schedule commitment was not provided.
A final concern relates to use of the SPDS as the sole justification for not correcting an HED. While the SPDS is required to be highly reliable, its availability during transients and accidents can not be assured.
Thus, the SPDS should not be the sole justification for not correcting a Category 1, 2, or 3 HED.
amc:21133:02/22/88 p sq t
g Q.
L 2.10.3' Conclusion' L
1 sh '
The Summary Report requirement has not been fully satisfied.
SERI snould' l
provide information which resolves the concerns identified in 2.10.2 above.
3.0
SUMMARY
-l In LLNL's judgment, SERI must complete several activities before the GGNS-1 j
f; DCRDR satisfies the DCRDR requirements in Supplement 1 to NUREG-0737.
For the
[
following items, SERI should provide descriptions of actions taken and i
p results.
e
)
1.
Multidisciplinary review team.
t 4.-
Place. a complete. record of-team members, 'their disciplines, and their assignments in the permanent DCRDR files, b.
' Ensure' participation of human factors specialists and operations l
personnel in the ongoing DCRDR.
3
-c.
Report participants to NRC for review in the ongoing.DCRDR (including disciplines'and assignments).
d.
If the proposed team ccncept is'used, prov'ide thorough documentation for NRC review.
2.
FunctionLand task analysis.
a.
Ensure that any changes to the GGNS-1 E0Ps that result from the NRC's review of the Procedure Generation Package be reviewed.for impact on the FTA.
l b.
Reiterate the FTA as needed to address such impact.
?
1
[
3.
Control room inventory, a.
Compare results of any revised portion of the FTA (see 2 above) with
.the control room inventory, b.
Record any unavailable or unsuitable displays and controls as HEDs.
~,
4
' Assessment.
a.
Assess any new HEDs identified by comparison of modified FTA results with the control room inventory.
l' i
amc:21133 :02 /22/88,
,c-m
[,
p 4
p c1
?
- 5. - Selection of design ' improvements, a
[
a.
Complete' ongoing review activity to develop HED resolutions and report results for N!!C review.
o b.
Review single indicator lights to determine whether correction is required.
If correction is required, select appropriate correction and report results for NRC review.
I c.
Augment, update, and tailor ES-17 to indicate specifically how human j;
factors engineering standards are applied at GGNS-1.
I d.
Address maintenance of the operator interface within the control room
'in a pcogramatic manner.
[
6.
Verification, i
a.
Complete and implement plans fo" verification following guidance in 2.7.2 above.
7.
Coordination, a.
Ensure that HEDs identified on the SPDS'are assessed, and that design improvements are selected, verified, and implemented in the same manner as HEDs identified by the DCRDR.
8.
Sumary Report.
a.
. Report final proposed design improvements for HEDs whose resolution is subject.to further study, HEDs identified during review of the' SPDS, and any HED resolution that has been modified.
b.
Provide firm commitments for implementing corrections of Category 2 and 3 HEDs.
c.
Provide additional justification for HEDs that cite the SPDS as the sole justification for noncorrection.
Evaluation of the GGNS-1 DCRDR will continue through completion of the above activities.
SERI should (1) maintain an auditable record of activities l=
required to complete the GGNS-1 DCRDR and (2) provide results for NRC eview.
L i
l i
amc:21133:02/22/88 J
y f.
(~
i b
i h
4.0 REFERENCES
i 1.
Mississippi Power and Light Company, Grand Gulf Nuclear Station Unit 1 i
Program Plan, Jackson, MS (December 1984).
2.
. Grand Gulf Nuclear Station Unit 1 Summary Report, Jackson, MS (July 31, 1986),
3.
U. S. Nuclear Regulatory Commission, Summary of June 27, 1985 Meeting with Mississippi Power and Light Company Regaroing Detaileo Control Room Design Rev1ew, Washington, DC (August 1, 1985).
4.
. NUREG-0737, Supplement 1, Clarification of TMI Action Plan Requirements Wasnington, DC (Decemoer 1982).
5.
-.'NUREG-0800. " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," Section 18.1, Control Room, Rev. O, Wasnington, DC (Septemoer 1984).
6.
. NUREG-0700, Guidelines for Control Room Design Review..
Wasnington, DC (Septemoer 1981).
7.
Mississippi Power and Light Company, Response to NRC Comments on Grand Gulf Nuclear Station Unit 1 Program Plan, Jackson, MS (June 27, 1985).
8.
V. S. Nuclear Regulatory Commission, Regulatory Guide 1.97, Instrumentation for Light-Water Cooled Nuclear Power Plants to Assess Plant ano Environs During ano Following an Accioent, Wasnington, OC (Decemoer 1980).
9.
Lawrence Livermore National Laboratory, Commen+r. on the Detailed Design Review Program Plan for Grand Gulf Nuclear Station Unit 1, Livermore, CA (Marcn 20, 1985).
\\;
sme:21133:02/22/88 J
--eJ e
+-g-6Am%h 4-JAa4.e.enp4-mi9 dK, u,1 es
--,MO'46W6m..,--Ae46Se-A 4 4h6~e-A4-A-M&
,,s,M_epabaA-o-m-e&L,.ma-mm-..sks%+A4a. A.u uk kwn,s
- -- =<- ~ ' '+w=xa,-~---
" 8 i4d n7 g
l p.'
4' r
=
i T I=
4 2m m@ b
- ' t,
==
m i
e I
8 w i
e n fee:"" E.
m 2.
i j
4 :
Dgm O w m
b M
i
i 3,
. =
N 4 2 O=
i G r r.
=
e.
,a' a
i
- 2. C t
l l
4, s
t al I
'J) a 3
F 5,
'Z C.
b t
ear
' I I '.
l 4
l-b s
9 swassmammamw magswaa.
I F
i 1
=.
r--""'+-
W M
f weww er w e-rwe mcwem wenew= w w-9 a w wr m e wwm eqwar srwm w s me -a,eiss-mw w - we
--w-w+.-. mw+- m*
g.~
A'
[,,
l..
si j.
.e.
p.
i i
r k
f' l.
ENCLOSURE 2 REQUEST FOR ADDITIONAL INFORMATION t
1<
I 1-
'l i
I' l.
l~
l.
l l'.g:
i l
p' G
k-L REQUEST FOR ADDITIONAL INFORMATION t'
In a Supplemental Summary Peport,. 3rovide the inforraation requested below as further elaborated in the Technical Evaluation Report (TER).
1.
Multidisciplinary revieb Wm.
[
a.
F Place a complete record of team members, their disciplines, and
)
their assignments in the permanent Detailed Control Room Design p
Review (DCRDR) files.
b.
Ensure participation of human factors specialists and operations personnel in the ongoing DCRDR.
Report participants in the ongoing DCRDR (including disciplines c.
and assignrents) to NRC for review.
d.
If the proposed team concept is used, provide thorough documentation l
for NRC review.
2.
Function and task analysis, control room inventory, and assessment.
For items 2 thru 4 under Section 3.0, "Sumary," in the TER provide the i
following information:
a.
Describe any standards that are in place to ensure that changes (for example, to emergency cperating procedures) are reviewed for impact on the control room.
b.
Has the application of such standaros, if any, impacted the s
function and Task Analysis, control room inventory, or identified any new Human Engineering Discrepancies (HEDs)?
3.
Selection of design improvements.
i a.
Complete ongoing review activity to develop HED resolutions and report results fur NRC review, b.
Review single indicator lights to determine whether modification is recuired.
If so, select appropriate modification and report results for NRC review.
c.
Augment, update, and tailor GGNS-l's Human Factors Criteria cocument lknown as ES-17) to inoicate specifically how human factors engineering standards are applied at GGNS-1.
d.
Address maintenance of the operator interface within the control room in a programatic manner.
L
l+
i i
(,_
e t-
-2 4.
Verification.
a.
Complete and implement plans for verification following guidance in Section 2.7.2 of the enclosed TER.
5.
Coordination, a.
Ensure that HEDs identified on the Safety Parameter Display System
.(SPDS) are assessed, and that design improvements are selected, verified, and implemented in the same manner as HEDs identified by the DCRDR.
L 6.
Supplemental Sumary Report.
a.
Report final proposed design improvements for HEDs whose resolution t
is subject to further study, HEDs identified during review of the SPDS, and any hED resolution that has been modified.=
I b.
Provice firm comitments for implementing corrections of Cate!ory 2 and 3 HEDs.
(The staff acknowledge: receipt of the licensee' letter of March 9, 1989, revising its proposed schedule for implementing DCRDR modifications.
However, the lecter indicates, "as a goal,"
l Category 2 and 3 modifications are to be completed.)
c.
Provide additional justification for safety related HEDs that cite the SPDS as the sole justification for noncorrection.
l t
l 1
1 I
~
-