ML19331B438
| ML19331B438 | |
| Person / Time | |
|---|---|
| Site: | Summer  |
| Issue date: | 08/06/1980 |
| From: | Baker C, Mallory K, Shields N ESSEX CORP. |
| To: | |
| Shared Package | |
| ML19331B437 | List: |
| References | |
| NUDOCS 8008120179 | |
| Download: ML19331B438 (18) | |
Text
.
O HFE REVIEW OF THE V.C. SUMMER NUCLEAR POWER STATION CONTROL ROOM Prepared For:
V.C. Summer Powea Facility Prepared By:
Kenneth Mallory Clifford Baker Nicholas Shields Valerie Neal Essex Corporation 333 North Fairfax Street Alexandria, Virginia 22314 August 6,1980 8008120/79
4 INTRODUCTION
Background
The Essex Corporation has performed a preliminary assessment of the V.C. Summer control room for the purpose of identifying conspicuous human factors engineering (HFE) design problems in the Summer control room.
The evaluation consisted of:
o Operator interviews e Surveys of the physical characteristics of the control room Comparison of Summer design features with generic nuclear control e
room HFE discrepancies Videotaping and analyzing walk-throughs of Summer emergency pro-e cedures e Application of human factors engineering design checklists.
The control room was evaluated as is, without regard to planned changes in layout,.
ventilation, etc.
This was the case since:
(1) as changes in the control area are implemented, they may introduce different HFE design problems which will not have been evaluated; (2) all changes may not be completed prior to plant operation, and V.C.
Summer personnel should otherwise contend with the temporary provisions having HFE design problems; and (3) evaluation of existing conditions can aid Summer engineers in implementing planned changes without introducting the HFE problems found in the current, temporary provisions.
Data collection and evaluation spanned approximately 12 days and involved eight Essex personnel and numerous Summer operators and engineering staff members.
Evaluation Plan / Approach The evaluation was ccnducted in three phases, as follows.
1 - Documentation Collection and Control Room Survey 2 - Data Collection 3 - Analysis, Verification, and Reporting.
Each phase is discussed more fully bebw.
s e
i Documentation Collection and Control Room Surveys. This phase of the HFE evaluation plan / approach was directed towards: (1) assembling control system documen-tation to be used as data references during data collection; (2) familiarizing evaluation team members with the V.C. Summer control room; and (3) initiating data collection.
Activities during this initial phase entailed:
o Collection and review of plant documentation. Emergency and normal operating procedures, control room drawings and f;oor plans, systems descriptions, and piping and instrumentation diagrams were collected or made immediately accessible to the evaluation team for review. Office space was set aside for documentation storage and meetings.
e Conduct of control room surveys. Contro! room layout and operation were initially reviewed via direct observation and discussions with V.C. Summer operations staff members. Descriptive data, regarding:
ambient noise (measured of various points using a sound intensity level meter, A and C scales) control and display design conventions, in terms of standard modes of information presentation and control usage conven-tions presence and design of emergency and safety equipment (e.g.,
fire extinguishers, etc.)
levels of uniformity and design of lighting systems, and
- control room layout (board profiles and dimensions, etc.)
were gathered for evaluation and comparison with HFE evaluation criteria.
e Distribution of operator questionnaires. Control room operators were provided with questionnaires to be completed and returned for review and subsequent debriefing.
e Identification of generic problems.
V.C. Summer control room design features were compared with a ' list of generic control room HFE design discrepancies in order to help quickly identify HFE problem areas.
Data Collection. During this phase more detailed data were collected and compared to HFE evaluation criteria.
The basis for the evaluation criteria was a preliminary evaluation guidebook developed by Essex for the Nuclear Regulatory Commission. Throughout this phase, V.C. Summer personnel and documentation were required to address specific design areas and issues. Individual activities during this phase included:
e Analysis of procedures. Emergency operating procedures were walked-through and videotaped in the control room.
The walk-throughs consisted of an operator simulating an emergency condition, and simulating performance of procedural step sequences.
Throughout the walk-throughs, human factors analysts noted
potential problem areas and participated by asking specific questions and for more detailed task information for individual procedural steps and sequences.
e Application of control room checklists. Checklists containing human factors evaluation criteria were applied to the V.C. Summer control room. These checklists addressed the design of:
emergency gear / protective equipment procedure documents control room layout panel layout computer systems communications.
These checklists required asking specific design questions in terms of compliance with evaluation criteria, thereby immediately identifying discrepancies.
e Application of control and display checklists. Another set of check-lists containing evaluation criteria applicable to controls and displays design were applied in the control room. These addressed:
annunciators pushbuttons levers process controllers
- CRTs meters simple indicator lights, etc.
These checklists also immediately identified discrepancies.
Analysis, Verification, and Reporting. This final phase of the evaluation plan /
approach entailed: (1) review of data collected; (2) verification of the data; (3) further identification of discrepancies; (4) prioritization of HFE discrepancies; and (5) reporting of results. Specific activities conducted during this final phase include:
l e Data reviews. Specific discrepancies where checked for accuracy, by further operator interviews, references to documentation, and so j
forth.
Further, descriptive type data were reviewed (e.g., board layout in terms of procedural step sequences, ambient light, etc.) and compared to evaluation criteria to further identify discrepancies.
Finally, all discrepancies identified were consolidated into groups:
control room environment controls
- displays annunciators communications labels
- procedures 1
operator / computer interface j
panellayout.
l e Prioritization of HFE discrepancies. Discrepancies were prioritized according to the following l
Category 1 - Induced error in safety related activity Category 2 - Induced errors in potentially safety related activity Category 3 - Induced errors in critical activity Category 4 - Further analysis required.
Assessments of safety related activities, potentially safety related activities, and critical activities were performed by engineering and human factors personnel. Determinations of errors and error types induced by design discrepancies were performed by human factors engineering personnel, o Reporting. The evaluation plan / approach and results were documented and outlined for the present report.
RESULTS Following are summarized general problem areas identified in the Summer control room. These briefly state:
e The problem areas dealing with:
- control room controls displays annunciators
- communications labels procedures operator / computer interface panel layout e Examples of the problems e Operational effects (performance decrement) or anticipated operational errors contributed to or caused by the HFE design problem areas Control Room Problem Areas 1.
Safety Gear - CR does not presently provide personal protective equipment (e.g., air pack, fire extinguishers, etc.). Fire Fighting equipment is not easily accessible; only three portable fire extinguishers are available. (Category 1) 2.
Ambient Noise - Temporary CR ventilation presents white noise, which could degrade communications, masks alarms and communication signals.
(Category 4) r-
-y
3.
Visual Search Aid - CR panels (system level) not demarcated, but rather run together. Subsystems and components are not demarcated. Sometimes Bezels around two controls associate unrelated components.
Performance can be degraded by increasing search time with the probability of control and display substitution errors increased. (Category 1) 4.
Visual Obstructions - Control room (CR) has several structures, notably a support column, bookshelf, and drawing layout table, which visually obscure portions of the control boards'. Performance from 1 chind these obstructions can be degraded by: increased time to visually access controls, displays; increasing traffic in CR to attain visual access; and disrupting a task sequence to attain visual access. (Category 3) 5.
Position of Heating, Ventilation, and Air Conditioning Panel (HVAC)- As information or control capability is required during normal and emergency operatio 2, a reactor operator (RO) or senior reactor operator (SRO) must exit the main control area, thereby temporarily reducing manning. Furthermore, monitoring of HVAC status is not possible without leaving the CR rendering positive monitoring and status checking to a " catch as catch can" situation.
(Category 2) 6.
Safety - CR mats are a hazard in that personnel may trip over edges. Page phone cords are also a traffic hazard. Potential exists for personnel to injure themselves or actuate controls as a result of tripping. (Category 4)
Positive Design Features 1.
Control Board Profile - The general control panel profile employed enhances:
- 1) readability of annunciator tiles; 2) display readability and control access (with exceptions - see controls), decreasing probability of reading, and control and display selection errors.
2.
Systems Layout - With the exception of the HVAC panel, controls and displays are physically located in the main operating area. Especially positive is the availability of radiation monitoring equipment in the CR. Layout of boards in a dogleg type arrangement promotes the reduction of traffic and facilitates visual access to controls and displays.
3.
Illumination - Ambient illumination levels complement display and control illumination without generally increasing display glare. The diffused lighting thereby does not induce excessive glare (although some glare problems exist).
e y
n,
Controls Problem Areas 1.
Contrast - Low concrast exists on:
e Syncroscope handles and position indicating arrows (" SYN Main Transformer #1" on panel 18)(Category 3)
Pistol grip controllers and position indicating arrows (e.g., recorder e
channel selectors) (Category 3)
Target (control set flag) on pistol-grip controls and control back-e ground (e.g., FW Booster pumps and Transformer controls on panel 16)(Category 3) maroon on black, or deep red on black, or.
black on black (locked out).
Performance decrement can include difficulty in determining control position.
2.
Legends, Labels, and Position Indicators - Legend plates of discrete controls ~
with transilluminated labels (all CMC type switches) are interchangeable; transiliuminated pushbutton legends are also interchangeable. (Category 3) 3.
Control Access - Some controls on vertical portion of control boards are not easily accessed by 5 percent of operators (examples, Rx Trip, PRZR level record SW, and steam dump mode select).
Potential performance decrement or operational errors are: (1) increased time to access control; (2) selecting the incorrect control; or (3) actuating another control while reaching for a distant control.
(Category 1 for accidentially actuating another control, Category 3 for increased time and control selection.)
4.
Control Effect Consistency - Process controllers can have opposite system effects, e.g., control setting increase can either open or close a valve, increase or decrease pump output, etc. Examples include FW Pumps A, B, & C speed controls, PRZR press. and level controls.
Effects on operator performance can include system setting errors (opening a valve instead of closing it, etc.), temporal errors (excessive time to determine appropriate control setting), and failure to determine that a control is inappropriately positioned. (Category 1) 7
_. ~,... -, _. _,
i 5.
Control Feedback - Process controls present immediate control setting feed-back in terms of percent of signal sent to controlled systems and components, rather than actual system response (e.g., FW pump speed controls, PZR Jevel controls). Other system feedback should be immediately available: where not, errors include failure to accurately set controls and failure to determine incorrect control setting. (Category 1 or 2 depending on system response rate and availability of alternate system feedback.)
6.
Control Use Coding-Rotary controls with transilluminated legends not conspicuous as to method of operation, that is, whether control is:
Momentary contact closure to fully cicse or open valve, g e
e Continuous contact to throttle valves.
For example, Chg Pump discharge valves, RHR sump pump, and steam seal feed valves anticipated operation error is a failure to set a throttle valve to correct position. (Category 4)
Positive Design Features 1.
Direction of control use conventions consistent with population stereotypes.
2.
Highly consistent application of control motion conventions (in terms of direction of control use, not' system response).
3.
Most controls accessible by 95 percent of operators.
Displays Problem Areas l.
Display Readability - Scale increments and numbers are often too small, resulting in very small readability envelopes (examples: source range counts, SG Levels, SG Control Signal). (Category 1)
Legends on permissive lights - particularly the black print on green background with green portion backlighting extinguished (e.g., Bank 1-3 Main Steam Lines and Headers on panel 14) (Category 1).
Feedback displays on process controllers located on lower portion of board have a moderate glare problem (e.g., SG Level set point, Turb Oil Res temp).
i (Category 4) i I
--.4
,.,,.,w-o,,e,--
,,,,,.,,,n--...e
,.,a,.-,.,-..-,,,-,,,,,.,,.y,.e-me, no,,,,,,,.,.mn,_,,,w,-,. -, - - -,,,,,,,
-,p,.,r,-4,
2.
Visual Access - Displays totally or partially obscured include:
e Trend recorders by labels placed over windows (turbine temp.
expansion) and permanent scales (Category 3)
Radiation monitors, by drawing table, support column, and bookcase e
(Category 2) e HVAC status mimic and displays are obscured by control room boards. (Category 2) 3.
Information Displayed - Information which is not displayed in control room includes:
EHC Temperature / closed cycle temperature (Category 3) e Reactor building dewpoint (Category 4) e Cire water valve positions. (Category 4) e 4.
Color Coding - Color of ink in trend recorders (e.g., Loop A&B temps on panel 6, containment pressure on panel 4) not consistent with labeled colors.
(Category 4) 5.
Lamp Test - Except for annunciators and system monitor lights, there are no provisions for direct testing of indicator bulbs. (Category 4 - more data is required to evaluate operator performance using the V.C. Summer lamp test logic system.)
6.
Display Failures - Scales fail on scale (not below zero or lowest point). When failed, displays may not be detected as such, and any control actions taken as a result of displayed value will most likely be incorrect. (Category 4) 7.
Information Presentation - Displayed information is often such that high level information processing is required. For example condensate flow is 6
displayed in GPM, while Feed Flow is displayed in Ibs/hr (X10 ). (Category 4)
System monitor lights require difficult pattern recognitions for different system lineups. (Category 1)
Positive Design Features 1.
Displays are designed to avoid parallax 2.
Display glare generally is low due to placement of units and board profile.
3.
Displays for control feedback are provided from system responses, not control settings (except process controllers).
.---,--w.
w
-w
-r
.y.
y--
,,-y
4.
Information displayed (ranges of values, etc.) is consistent with system and operational requirements.
Annunciation System Problem Areas 1.
Placements - Several annunciator tiles are located away from relevant system controls and related displays.
e RCP bearing e RCP cooling e Train A&B SI sequence complete.
Performance decrement includes time loss due to excess traffic, inhibits performance of diagnostic procedures and high probability of failing to respond to annunciation. (Category 1) 2.
Auditory Signals - Although different auditory signals are provided for Trains A, B, & X, they do not localize or prioritize.
Operational effects anticipated include: increased visual search requirements and increased probability of failing to respond to all annunciators.
(Category 1) 3.
Prioritization - Alarms are not visually or audibly prioritized; further the first-out panel is not distinctively marked (by means of label, bezel color, etc.)
from other annunciator panels. (Category 1)
Cperationa' effects include: failure to respond to alarms within time con-straints, failure to respond to alarms, failure to respond to urgent alarms while l
attending to low priority alarms.
4.
Readability - Titles small, excess printing:
1.
BATCHING TANK HIGH/ LOW TEMPERATURE 2.
LOW PRESSURE LETDOWN HIGH FLOW HIGH PRESSURE
-,,-_.7
.y
3.
BORON THERMAL REGENERATIVE SYSTEM HEADER TEMPERATUR E Low contrast when not back-light. (Category 1) j 5.
Related Controls - Dedicated acknowledge and resets are not provided (by i
system or location). Anticipated operational error is the likelihood of alarms being acknowledged prior to detection. (Category 1) 6.
Test Functions - The three (3) separate test functions (for Trains A, B, & X) do not coincide. That is, when all tiles are being tested, tiles alternately flash without being in sync. There is a high probability of failing to detect spent bulbs. (Category 4)
Positive Design Features 1.
Tiles directed down towards operators.
2.
First-out panel provided.
3.
Black bezels provide good figure / ground contrast.
4.
Annunciators "reflash."
5.
Annunciators inform operator of problem conditions being cleared.
Communications Problem Areas 1.
Control Room - Inadequate provisions for communications between HVAC and main control room. Presently operators must either: 1) shout over panels; or 2) hook up to phone jacks at both locations. (Category 2)
Errors anticipated include: failure to accurately communicate between HVAC l
and CR, temporal errors in accessing phones, errors of omission due to operators being restricted to two relatively broad areas. (Category 3)
Relatively high ambient noise levels exist and will mask and garble voice l
communications. (Category 2)
No page phone provided on panels 5 through 9, requiring operator to walk to phone on panel 10 to access communications. No page phone provided at PRODAC or operator's desk. (Category 4)
.v-.
--m.p._
2.
Plant - Page phone channels shared, possibly leading to competition for communications. Major potential error is failure to send / receive communi-cated messages. (Category 4)
Radio systems do not penetrate areas of plant, limiting communications.
(Category 4) 3.
Policy - Operators serve as switchboard operators during off-hours.
Per-formance decrement / errors include:
e Failure to monitor plant e Failure to detect plant anomalies e Temporal errors in detecting / responding to abnormal plant conditions. (Category 4)
Labels Problem Areas 1.
Consistency - Multiple abbreviations for 1 term, e.g.,
HX - HT. EXCH.
RB - R.B. - Reactor Bid. - Reactor Bldg.
ISO - ISOL - ISOLAT CONT - CNTRL - CONTRL (Category 2)
Variable pattern for presentation of information; same order should be followed consistently, e.g.,
FLOW LOW... LOW FLOW (Category 2)
Dynatape additions, operators' markings in pen, e.g.,
VCT TEMP operators' note VCT TEMP engraving (Category 3) 2.
Accuracy - Many labels misspelled; result = confusion, e.g.,
e BWST should be RWST e MINIMUN should be MINIMUM e RH MU WTR should be RX MU WTR e LTON should be LTDN
e % A FLUX should be % a FLUX l
INLET TD LP HTR should be INLET TO LP HTR (Category 2) e l
3.
Meaning - Several abbreviations have multiple meanings:
e CONT = containment, control or controller e COND = condenser and condensate (CO also means condensate)
Many labels describe engineering features primarily (for example, RB cooling fan controls). (Category 2) 4.
Spacing - within labels causes confusion, e.g.,
LOOP A - LOOPA - LP A - LPA RCP A - RL JA (Category 2) 5.
Presence - Summary labels not provided at panel or functional group level increases visual search times. (Category 1)
Symbols on mimics (electrical distribution) are not labeled, e.g., transformer numbers, switch numbers. (Category 3)
Many labels not provided, e.g, EHC. Errors include control substitutions, display substitutes, and temporal errors in locating components. (Category 2) 6.
Visibility and Readability - Many labels obscured by controls and displays (e.g., PRODAC recorders, rod control banks election). Operational perform-ance decreased in terms of:
time to locate, manipulate and verify.
(Category 2) 7.
Association - Many labels can be associated with incorrect controls and displays, for example:
e Generator Varmeter e Generator Wattmeter e Unit Aux XFMR Ameter.
(Category 3, a high likelihood of display substitution errors exists) e DA storage tank level.
y e.
y w-
Procedures Problem Areas 1.
' Control Room Compatibility - Procedure nomenclature often does not agree with CR labels (e.g., procedure statement " Loss of Containment Integrity,"
boards use RB (= reactor building) as reference to containment). Potential for control and display selection errors exist (procedural reference to controls and displays with different board labels). (Category 1)
Procedures specify control room operator actions that are plant operator activities, communications commands are actually required. (Category 1)
Plant operator activities require communications with plant operators instead of direct control room indication (circ. water valve position for example).
Errors nf omission are likely. (Category 1)
Procedural steps are sequenced without regard to CR layout and traffic.
Performance decrement (time, step performance reliability) due to excess traffic will be observed. (Category 1) 2.
Information Presentation - Procedures used are in column format with notes and cautions embedded between steps. There is a high likelihood of procedural steps being omitted. (Category 1)
Procedures are not highly accessible, bound in three-ring binders and stored on bookshelf. (Category 1)
Cross referencing to other procedures (See EOP-1, Step 1.1 and EOP-6, Step 3.1.3 for examples) reduces accessibility. (Category 1)
Cross-referencing to other procedures and tech specs requiring an operator to simultaneously perform steps from several sources, results in a high prob-ability of omitting steps. (Category 1)
Steps frequently unclear ("If for some reason..." and " verify SG level, if not off scale..." as examples).
Probability of misinterpretation of steps.
(Category 1)
Notes and cautions contain operational steps (See EOP-8, Step 1.2.B.2 and EOP-12, Step 3.2.3 for examples), which increase probability of step omission.
(Category 1)
Steps embedded in narratives and lengthy sentences, " Observe that only the misaligned control rod of the affected Control Bank will start to move as verified on the Digital Rod Position Indication display and will continue to move as long as the Control Rod In-Hold-Out lever is held in either the rod Out or rod In position" from EOP-10, page 7, step 7. (Category 1)
Diagnostic aids, graphics, charts, etc., are not presented with referencing text but in the back of procedures or in other references, e.g., Attachments I & II EOP-10. Performance decrement includes: time loss, step omission, memory errors, and reading / interpretation errors.
Information is incomplete, e.g., EOP-5, page 3, step 3.3.1.A.3 says to de-energize rod drive MG sets, and not that this is performed by tripping breakers IBl and ICl. (Category 1)
Operator-Computer Interf ace While the computer in the V.C. Summer control room is not a safety related system, it can be used to display information about safety systems which is in addition to safety instruments in the control room.
Catego"f ', discrepancies are cited here since the computer can display information from safety related systems.
Problem Areas 1.
Job Aids - Address index is divided by P (pressure), T (temperature), and F (flow), but listings within each category are not alphabetized, requiring operator to randomly search lists to locate addresses of parameters.
(Category 2)
PRODAC trend recorders have no provisions for supplying alphabetic labels, and address valves not displayed. High likelihood exists for misinterpreting information. (Category 2)
Numeric displays on PRODAC recorder have no provisions for temporary labels. (Category 2) 2.
Information Presentation - Print speed on the printer is slow, leading to:
- 1) potential loss of information due to print buffer overload during transients, and 2) information loss due to print queue. (Category 2)
-r c
--.-,m
Page formatting of printer leads to lowered readability (column format employed, columns run together). (Category 2)
Printer prints over holes punched in paper (for binding) which lowers read-1 ability and causes information loss. (Category 2)
Nomenclature is inconsistent (e.g., " CONDENSATE PUMP" is also written as "COND PUMP," etc.). (Category 2) 3.
Physical Design - PRODAC desk not fit for 95 percentile of operators (in terms of stature), desk top too low, insufficient horizontal knee clearance.
Performance decrement of a variety of types will be evidenced due to operator discomfort. (Category 2)
Controls have low label contrast, promoting the potential for substitution and reading errors. (Category 2)
Alarm bell is sufficiently loud, but failure to acknowledge immediately will lead to failure to acknowledge for long periods of time. (Category 2)
Panel Layout Problem Areas 1.
Location Consistency - There are many inconsistencies in layout. Examples are:
RB cooling unit fans and associated motor amp meters (noncom-e patible matrices) e FF controls (horizontal) and SG level controls (vertical) e PRZR relief valves, arranged thus:
ISO A B C POR V's C A B e Seal Inj. stop valves and meters arranged:
Stop A B Valves C
Meters A B C Very high likelihood exists for control and display substitution errors.
(Category 1)
~
~.e.
-g-
-~
.n.
2.
Visual Search - Layout of components of subsystem levels can cause exces-sive visual search requirements:
e Steam dumps Charging pumps e
RHR controls and displays e
Component cooling to RHR control e
Emergency bo:ation control and indication.
e Operational errors will include control / display substitution, display reading errors, and temporal errors. (Category 1)
RECOMMENDATIONS Rased on this preliminary assessment, the following design recommendations can be made.
1.
Provide aids for visual search. This may extend to color cading of bezels,line demarcdtions of functional control and display groups on the boards, and adding sytem mimics to the boards. The approach selected should be studied in terms of current board layout, any constraints (available space, etc.) and sequential and operational task requirements.
2.
Improve communicators betwen HVAC panel and main control area by means of a permanently installed page phone or other device.
l 3.
Provide additional safety gear in the control room, including additior al fire extinguishers, and emergency breathing apparatus. Placement and design for accessibility and ease of donning (ptersonal protection gear) should be designed into the control -oom.
4.
Improve control position coding in terms of:
o Contrast of control pointers and handles Flag (or target) figure / ground contrast on pistol grip controls (e.g.,
e Sw pumps on panel 21.
5.
Design to achieve consistency of process controllers in terms of direction of use. For example, a clockwise rotation always opens valves, increases pump
--w,-
m
-m
-w v*
-r r-
-m
~*
e--
output (or better, increase flows, temps, pressures, etc.). Directional con-ventions should be consistent with other control conventions, e.g.,
SBN switches.
6.
Provide annunciator controls which are functional for specific boards, not the entire boards.
7.
Prioritize alarms by means of color, spacial locations within bezels, or other means.
8.
Develop and implement a set of plant specific guidelines for labels, which address:
o Label consistency e Patterns of information presentation e Accuracy e Font size, type, and spacing e Board placement relative to labeled components.
9.
Improve procedures in terms of:
e Format employed 2/3 column with headings placements of notes and cautions indexing and accessibility e Sentence style and length Placement of diagnostic aids, graphs and figures e
e Extent of cross-referencing.
-v,-~
w
+
e g
+ - - -
-r-
--,ee