ML19340C098
| ML19340C098 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 11/07/1980 |
| From: | Hukill H METROPOLITAN EDISON CO. |
| To: | Reid R Office of Nuclear Reactor Regulation |
| References | |
| TLL-559, NUDOCS 8011130395 | |
| Download: ML19340C098 (95) | |
Text
e 1
Metropolitan Edison Company g
F Post Office Box 480 Middletown, Pennsylvania 17057 717 944 4041 wnter's Direct Diai Nurnoer November 7, 1980 TLL 559 Office of Nuclear Reactor Regulation Attn:
R. W. Reid, Chief f!
s; Operating Reactors Branch No. 4
[]
U. S. Nuclear Regulatory Commission Washington, D.C.
20555
[
~!
Dear Sir:
u.
f{
e-
~ :
Three Mile Island Nuclear Station, Unit 1 (TMI-1)
[
N Operating License No. DPR-50 C?
L:
m Docket No. 50-289 Human Factors Engineering In February, 1980 GPU commenced a human engineering review of the TMI-l control room for the purpose of identifying and correcting conditions which could contribute to operator error. A summary of this program was provided in reference (a).
The GPU control room evaluation team consisted of:
(1) Members of the GPU engineering staff; (ii) TMI Unit 1 operating personnel; (iii)
Engineers from MPR Associates, Inc., a firm with a broad background in the design and operation of power plants; and (iv) Two well-known experts in the human engineering field, Dr.
J. M. Christensen and Dr. T. B. Sheridan.
The team used a full scale mock-up of the control room to assist in the evaluation of the current layout, including control display relationship and the control room alarm system. A variety of plant operating, abnormal, and emergency procedures were walked through and " talked" through with licensed plant operators.
The actual control room was used to evaluate environmental conditions.
The CPU control room review found significant strengths in the current control room design. These lie in the uncluttered and logical arrangement of extremely reliable controls and displays, the main alarm panel which'is essentially " dark" during power operation and which has the alarms for a system located above the control for that system.
The logical arrangement of the control room consistant with the divisions of responsibilities of the control room operators is also a strength.
Some areas where improvement can be achieved, were identified:
labeling and lack of demarcating, the arrangement of controls in the emergency feedwater system, and the readability of the ESAS panel.
These findings were presented to GPU management in June, 1930 and the review team was instructed to develop proposed changes to address the weaknesses.
This work has been in progress since that time.
All proposed changes developed
(((7![
by the GPU review team to correct identified control room deficiencies, are being evalueted to insure that the changes taeet basic human factors criteria.
1 l
8031130 395~
Metropohtan Ec ser Cer car.y :s a Mer-cer of me Gen al Puc ic Lt.wes S/s:em
R. W. Reid TLL 559 I
It is important that a change be a real improvement, and not just a change.
Change for the sake of change would be detrimental to the man-machine interaction I
in the control room. The proposed design changes for the TMI-1 control room are evaluated on the full scale mock-up and " talked through" with the operators.
Operator feedback is used to further develop the modification, resulting in a change that is of optimum use to the operator. We are confident that the resulting changes made in the control room will be a real improvement, j
GPU has applied these same techniques to other plant modifications currently being made.
This process ensures that modifications will be properly integrated with the existing control room and will not produce an adverse impact.
Examples of these modifications include the saturation margin monitor, emergency feedwater l
manual regulating valve, controllers and flow indicators, power operated j
relief valve control, primary relief valve flow indicator and the instrument l
power supply manual transfer switch. A similar review was also performed on the Remote Shutdown Panel.
During the week of July 21, 1980, the NRC performed an audit of the TMI-1 control room.
This letter responds to the findings of that audit as recorted in reference (b). For each finding a response is provided which includes the schedule for resolution. In addition, the findings which will be corrected i
prior to the restart of TMI-1 are listed in table 1 and those scheduled for completion after restart are listedin table 2.
GPU agrees with the NRC's review team that their findings can be categorized.
It is useful to identify the most important deficiencies so that they may receive j
the greatest consideration and evaluation. We strongly disagree, however, with the definitions of categories used in reference (a).
We note that many of these elements have a reared, in one form or another, in c
rating systems used by the Commission to review other power plant control rooms (see table 3).
They are also present, to a degree, in the Commission's draft guide for control room evaluations (NUREC/CR-1580).
But in our case, a different ar.d potentially misleading and less useful categorization of findings has been used. We have been presented with thirty-seven " serious concerns" - defined as findings of deficiencies which result in " human / system performance degradation 4
with serious potential safety consequence." We take strong exception to this choice of words.
There is no finding, either in the Commission's audit or of~
our own, more extensive review, which constitutes a deficiency whereby the safety of the plant itself or of the systems which insure this safety is seriously compromised. We frankly do not think it plausible that inconsistent coloring of a label plate will lead to a degradation of human / system performance with serious safety consequences. Yet in the Commission's report, such a finding is placed in this category.
The Commission's report cites 26 deficiencies in a second category - defined as
" human system performance degradation with moderate potential safety consequence".
Again, we consider this definition to be totally inappropriate. For example, the absence of a lighted exit sign in the control room cannot in a reasonable manner be placed in such a category.
Of those in table 3 we believe that definitions of categories used for Indian Plant 2, North kana 2 and NUREG CR-1580 to be appropriate for TMI-l given the nature of the hRC findings.
In summary, while we agree that the NRC's findings can be attegorized, we disagree that they can be assigned to categories based upon assumed safety related consequences of the probability of operator erzor i
for a given system component.
l.
D-
R. W. Reid TLL 559 We believe that this opportunity to exchange ideas and techniques in the area of human factors is beneficial to both of our organizations, and we look forward to future exchanges. We vill be happy to discuss your comments or questions on our proposed design modifications. Please refer all comments or questions to Mr. R. W. Keaton at (201) 263-6297.
Sincerely, 4
. D. Hukill Director, TMI-l HDH:RWK:lma Enclosures cc:
D. DiIanni H. Silver S. S. Hanauer V. A. Moore Ecferences:
(a)
J. G. Herbein's letter to R. W. Reid, dated 7/14/80, TLL 346 Subj ect : TMI-l Control Room Human Engineering Review (b)
R. W. Reid's letter to R. C. Arnold, dated 9/16/80, Docket No. 50-289
Subject:
Human Factors Engineering Control Room Design Review of TMI-l
TABLE 1 Comments to be acted upon prior to restart:
1.0 Annunciators / Alarms System lacks a separate, audible alarm acknowledge / silence control.
This in combination with the one acknowledge signal permits a.
reading alarm operators to acknowledge alarms without windows. (Category 1).
There is a minimal annunciator prioritization (Reactor Trip /
b.
Turbine Trip) and tiles with blue corners associated with Other sys tem Engineered Safeguards Actuation System (ESAS).
Some annunciators with safety significance have no priority.
blue markings on ESAS alarm tiles are readily identifiable.
Some annunciators tiles have busy legends.
(Category 2) c.
2.0 Process Cc=puter CRT display of poor quality and could increase t,he a.
probability of reading error.
(Category 1)
Process computer capability is limited and its vintage raises b.
question of reliability of information presented to operators.
(Category 1)
Neither the CRT display nor the alarm printer utilize color c.
coded displays. (Category 3) d.
Computer backup control panel is not used by operators.
(Category 3) 3.0 Controls (General)
Controls (J handle, etc.) located near front edge of console a.
could be inadvertently activated.
(Category 1)
Violation of plant convention for auto / manual positions on some c.
multiple position rotary controls (Sync. Scope and Voltage Regulator).
(Category 1) d.
Legend switch covers are interchangeable.
(Category 1)
Legend indicators contain numerous burned out bulbs.
(Category 2) e.
f.
Many illuminated legend switches are dif ficult to read.
(Category 1) 4.0 Displays (General)
Panel legend lights do not provide positive indication because a.
of poor contrast with panel background, especially for certain creen colored tiles.
(Category 1) b.
Clare is present on all vertical indicators resulting in reduced readability.
(Category 2) i l
l l
i -
I indicated on Normal operating ranges or set points are not c.
vertical meters.
(Category 2) d.
Normal or desired position in strings of meters does not line up for easy monitoring.
(Category 3)
Most meters fall at mid-scale position.
(Category 1) e.
Bailey meter scales do not meet basic human engineering g.
standards (scale internal were poor).
(Category 3) h.
Backlighted legends are difficult to read. Room lighting is dim, contrast is minimal, lettering is crewded and busy and discoloration on scratched surf aces 12 frequent.
(Category 2) 1.
No lamp test capability on control boards or panels.
(Category 2) 5.0 Labeling (General) a.
Color meaning is not consistent. (Category 1) b.
Mimicing is used minimally.
(Category 3)
In general, labels are used only at the component level, c.
not at the group, function, system or panel level. (Category 1) d.
The use of colors labels is not consistent, for example, black /
white background and print.
(Category 2) e.
Makeshif t labeling was observed on many components including penciled on switch nomenclature, hand letters labeled and vertical meter scale value and the use of dyno tape.
(Category 1) f.
Labels are not all permanently attached.
(Category 1)
Little or no use of demarcation lines to separate systems, g.
subsystems, functional grouping, etc. (Category 1) h.
Labels are wordy, because the function of a system is repeated on each switch of a group. (Category 2) 6.0 Control Display Relationship 6.1 General - Related controls and displays do not consistently have both nomenclature and component designation.
(Category 1) 6.2 Makeup and Purification System Makeup pumps are not grouped together.
(Category 2) a.
b.
Lacks positive indication of flow when makeup pu=p is running. Indication by an A= meter only that pump is running.
(Category 2)
~
- **eo
,j.' *
{
w- - - -.
m y
P and Lab Seal DP has Dual purpose meter for RC pump seal d.
dif f erent scales which could be confusing.
(Category 3)
Letdown flow meter is in gpm while scale on controller is in (Category 2) g.
percent and must be converted before setting.
There is no Engineered Safeguards / Safety Injection annunciator h.
window.
(Category 1)
Engineer Safeguards Actuation Facel has blue status lights which 1.
are difficult to interpret as being "on".
(Category 1)
CHR temp and DHR cooler temp indicators are side by side but 1.
have different scale multipliers.
(Category 2) sequentially organized or grouped m.
LPI valve alignment is not on paeni.
(Category 3)
(Category 2)
DH, 5, 6, 7 valve controls are not included in mimic.
n.
1 6.3 HVAC Sys tem No separation or demarcation of grouped J handle centrol b.
switches (9 in a row).
(Category 2) 7.0 Scund Level Reading The IBM - Selectric printer is 65 dbA while typing. This a.
level is 5 to 6 dbA above ambient and 4 to 5 dbA above most alarm levels.
(Category 2) b.
Main control board alarm is below ambient noise level.
(Category 1) c.
Panel Left (PL) alarm is only 1 dbA above ambient noise level.
(Category 1).
d.
Right Panel Front (PRF) alarm is only idbA above ambient noise level (Category
)
Liquid Waste System alarm is below ambient noise level.
(Category 1) e.
8.0 Other Observations Diesel Generator Governor has no indication on J handle switch a.
for f ast/ slow speed control which is incorsistent with other
- ~ ~ ~ ~
speed controls.
(Category 2)_
Unrelated " Reactor Building E=ergency Cooler B&C" displays are b.
located in the center of the diesel panel. (Category 3)
On DHR system, controls for loop A and B were not associated with c.
their displays which are located approximately 8 feet away.
(Category 2).
i One DHR indicator and control switch which are located on loop d.
B panel actually belong to loop A panel.
(Category 2) j 1
-4_
rimin.veen systems and subsystems is dif ficult 1
se al ".e of demarcation lines and color tg.
< 1) liary:r system lacks a flow meter.
(Category 1)
ICS s spread out over 3 panels.
(Category 3) rol/drangements fot ICS (f eedwater, s team level) not a (Category 2) 9,t utdo(RSP) h oc in of the Control Room - some actions are
. ired il rcom.
(Category 1) mergeing.
(Category 1) unicay sound powered mike with no mike in area.
- unicalso by equipment in technical support.
er (kn CR).
(Category 1)
- 10. ervis mergzLng is provided in this of fice. (Category 3) ll.catiool Room inopse telephones in the plant area.
t 1 are are not reschable by phone.
- egory 14.ty Pr a procerence control and display labels names f rom the names actually used or the els.
2) 15.g htingpecifically designed for reading labels, playss.
(Category 2) ect ghverhead lights on both controls and displays e reaif ficult.
(Category 2)
Ceents a.1 sys' for providing operators feedback about
.ons a b..ing ition is not in place and operating.
- c. thermte ) have been connected to the process computer, s
) ring ) been written and the system is in the proc (C team will review the functionability of the from xors engineering point-of-view before restart.
,_m.
TNBLE 2 Comments to be acted upon at a future date:
6.3 HVAC Sys tem Train "A" centrols are on right and train "B" controls are a.
on left cide.
(Category 3) c.
Five trend recorders (air flow) are at top of panel (6'6") with excessive glare which requires standing on a stool and lifting covers to be read.
(Category 3) d.
Labeling does not contain information which indicates time required for depressing ar.d holding manual fan start control to start fan (varies by fan, 30 to 90 sec.).
(Category 3).
11.0 Communication in Control Room Page system unintelligible in some areas of plant due to e.
ambient noise levels.
(Category 3).
14.0 Emergency Procedures Immediate action steps are too detailed some with an excessive a.
number of steps required to be completed immediately.
(Category 3) c.
Some steps which require 2 operators to implement are not noted.
(Category 3) d.
Sca.c procedures, have notes before symptoms which are actually actice steps.
>bny notes in procedures are actually steps.
(Categot; 3) l
- b Ull._,
O d
b J m yy_
TABLE 3
..iki;/CR-15a0.H 37.N DIABLO LA;.YGN ENathEEMENG GUIDE INDIAN POINT tJNIT 2 ZION UNIT 1 NORTH ANNA UNIT 2 DRESDEN tFNIT 2 S ALEM t' NIT 2 t%1T 2 TO CR ATAITATIO1 TMI LNIT 1 rt5 N TO w/o DFM. 19, 1940 MANCH 2, 1980 MARCH 1 AND 4, 1980 w/o MARCH 3-7, 1980.*tARCH 19-2%, 1940 APMIL 21-23 1980
%)ULY, 1990 JULY 21-2%. 1993 CaTE-l-HICH RISE or l~ HICH m!SK OF 1--HICH klSF CF 1--HIGH RISE OF 1--THE DESIGN DIS-1--HIGH RISK OF 1--SAFLTf FILATLD, 1--S E R I O'JS CC'.Cf P'; -l CCFy GPriGTOR ERROR IN IRROR IN CkITICAL OEthATOR EbFON !!4 0FthATOR LDROR CkLPANCY kFSULTS IN OPLkATON E Flc)M Nf MIML M 66 Puk1Util14 b t**15 7* 4;." L '8 ftF.
SAFETY-PELATED ACTIVITY.
SAILTV-RELATLD (CHING A CNETICAL A HICH RISK OF Ci t.R-DURIf;G A CMITICAL TO CORRLCT.
g.'%"LCE OLUi;i!!J3 ACTIVITY.
ACTIVITY.
ACTIVITY.
ATOR ERROR DURING ACTIVITY.
. 1T't SE R!O%S P:!E';- '
CRITICAL ACTIVITIES.
TI AL SAFEM CZ.iE.
% L?.CC.
2 -POCLkATE RISK OF 2~tbDElmTE RISK OF 2-MOOLkATE R!asF OF 2--MODEPATE PISE OF 2--THE DESIL.N DIS-2--M0t t.kAT E R IS F OF 2--SAFLTY ltLATED, 2--?%! U TE COW h'e-OPEPJTOR ERACH IN LRROR IN CRITICAL uPLkATOR E k HO R IN OPERATOR EPROk ChEPA?.CY REa0LTS IN OPEWATOR ERROM ME OPEORTUNITY TO
!1'.A;;,5 V d TE M I' L R.
S Al'LTV-R LIA TE D ACTIVITT.
GAtETY-RELATED DURING A CRITICAL A MOblRATE PISK OF dup!NG A CPITICAL 3FFECT ERh0R.
F0F?.V.CE O!! MOA*1J.
CITIVITT.
ACTIVITV.
ACTIVITY.
OPEMTOk EkPOR DUR-ACTIVITY.
).!TA.,47ATL P,T L !;-
!!;G Cp!TICAt. ACTIVE-
?! AL $ 71 LTY C; :. S !-
TIES.
Lt E!.C E.
1--RISE OF OPERATOR J - 11M RISK OF 3--plSk OF OPLRATOM
)~HISK OF OPERATOR 3--THE DESIGN DIS-3--RISK OF OPEFATOR
)--kELIABILITV l--CTai t D CC'-C! P!4 3 -
FSPOR IN SAFETY-LHkOR.
Ekkuk IN SAILTV-EkROR.
ChEPA*fCY RE S ULTS IN LakOh.
P* LATED, MINIMUM THL5E Pi.'%3FL A'.
kE1ATLD ACTIVITr.
kLLATED ACTIVITY.
LOME RISK OF OPil<A-k,i PORTU:41TY To tJ/ALL ATIU; b't T.it TOM E S P-)R DUkING COFFECT.
LICL:.5L L T OR tLTLyr CPITICAL ACTIVIT3ES.
BESOttTION.
4--79E FESIGN DIS-4 -- REl.I ABILITY C31PA9CY IMiACTS
.si.LAT ED. SGMZ CPPCR-
. AI LT t UF ci L PAT I NG TONITY TO CLRhECT.
STAFF.
5 --NO 1*'F Af. f ON
'iAI LT7 CR FI LI-AitI LITY.
X~ ADDITIONAI.
X--FURTilER X-- Ft;RTH E R t;VALUAT ION REQUIkED.
EVALUATION REQUIPED.
EVALUATION PLQUIPFD.
DaTE iUBLISHED JULY 1980.
OF MARCH 12, 1980
- A RCH 14, 1980 atA PCH 10, 1980 APMIL 17, 1980 APRIL 12, 1940 APRIL 29, 1980
- EIEASED BY NRC
' EPTE*'asER 16, 1983 RLPONT
1.a.
System lacks a separate, audible alarm acknowledge / silence control.
This in combination with the one knowledge signal permits operators to acknowledge alarms without reading alarm windown.
(Category 1)
RESPONSE
In the present process alarm system, the occurrence of a condition outside normal limits is " fast" indicated visually by a flashing light (or tile) appropriately labeled, and an audible (warbling) tone.
This annunciation can be acknowledged by depressing any of four acknowledge buttons located on main console left, main console center, main console right and back panel PLF. The acknowledgement action silences the audible tone and causes the flashing tile to glow steadily. When the signal which has caused the alarm returns to its normal range, the tile commences to flash at a slow rate and the audible tone again occurs.
Pressing a second button - the " reset button" - silences the tone and extinguishes the tile.
Finding 1.a is factually correct.
That is, (1) There is no separate audible tone acknowledge feature with the present system, and (2)
It is possible to acknowledge an alarm, appearing say, above panel PLF, by depressing the acknowledge button on CL.
With regard to the latter finding, GPU concurs that the present situa-tion is undesirable.
On a long-term basis, we are in the process of making an in-depth review of our alarm systems, and testing possible changes.
In v'ev of the careful evalartions needed to ensure that any such changes are in fact real improveuents, and dc not introduce new problems, we do not anticipate that the evaluation and resulting modi-fications will be completed prior to restart.
In the interim, until the longer term modifications have been defined, we will make changes prior to restart to ensure that alarms not read-able by a console operator will not be acknowledged by him. We are evaluating several alternatives, and will inform you of our suggested short-term change (s) as soon as possible.
We are currently evaluating a system which has separate horn and tile acknowledge buttons, the horn acknowledge button silencing all horns, while the time acknowledge button " silencing" only those alarms above that button. The desirability of this feature depends in part on the frequency and nature of multiple and cascading alarm situations when repeated tone communications can interfere with communications, but a continuing flash may be desirable to segregate a newly arrived alarm from other, previously acknowledged alarms. Further evaluations must be performed on this, and other possible changes, before a decision as to which system results in optimum operator performance can be made.
1.b.
There is a minimal annunciator prioritization (Reactor Trip / Turbine Trip) and tiles with blue corners associated with Engineered Safeguards Actuation System (ESAS). Other system annunciators with safety signi-fieance have no priority.
Some blue markings on ESAS alarm tiles are readily identifiable.
(Category l)
RESPONSE
The present alarm system accords highest pricrity to those alarms which require operators in addition to the duty control room operator to as-sume stations in the console area.
These additional operators include the licensed operator assigned to blocking and tagging, normally at a desk about 15 to 20 feet f rom the console), and the shift f o reman (SRO). The prioritizing is done by coloring tiles; tiles currently colored include reactor trip, turbine trip, and certain engineered safety functions.
We are currently in the process of reviewing each alarm in the system (including the responses thereto). As a res' ult of this review, we anticipate that a few additional alarms (such as ESAS actuation) which require prioritization in the above sense will be identified. Those alarms as identified will be prioritized prior to restart.
On a long term basis, we are evaluating alternative prioritization approaches. We believe it is essential to avoid apparent
)
" improvement" wnich, in fact, would degrade what is at present a good system.
w N
[
1.c.
Some annunicators tiles have busy legends.
(Catego ry 2)
RESPONSE
We concur with this finding. One goal o f our long-term review program is to improve the readaoility of all the annunciators tile s.
Prior to re s t a rt, the tiles for those alarms with particularly small font will be replaced. Where simplifications to legends can be affected without introducing confusion, the legend simplifications will also be done prior to restart.
I r
i i
2.a.
CRT dis ['av of poor quality and could increase the probability of reading error.
(Category 1)
RESPONSE
A new Aydin 8025 display monitor is being installed in the control room. The CRT has color capability and will be driven from the new FDD COMP computer system.
If the MOD COMP computer system is not available prior to restart, a new CRT display driven from the Bailey 855 computer will be provided.
2.b.
Process computer capability is limited and its Vintage raises question of reliability of information presented to operators.
(Category 1)
RESPONSE
The existing railey 855 computer system has proven very reliable, although detailed quantative data is not available.
A new TI printer that is being installed in the control room will increase the output capability of the process computer. The new printer is three times as fast as the old IBM selectric, allowing the operators to receive current, relevent infcrmation.
In addition to the Bailey 855, a new MOD COMP :omputer system is being installed.
The MOD COMP system has been under development for several years.
2 i
(
l 4
2.c.
Neither the CRT display nor the alarci printer utilize color coded displays.
(Categorf 3)
RESPONSE
f See the reply to coment 2.a.
e 3
.,m
2.d.
Computer hackup control panet is not used by operators.
(Category 3)
J
RESPONSE
The future use of the panel.snd the place of the panel in the control
~
room is being studied considering the changes being made in the l
computer system.tnd the instrumentation being added to the control room. The results of this study will be reflected in procedures and i
training as appropriate.
i
)
4 1
e 4
s
)
l 4
t 4
- f I
y r-1-,
. =-
e
3.a.
Controls (J handle, etc.) located near front edge of console could be inadvertently activated.
(Category 1)
RESPO!!SE The center Lines of the control handles are & inches from the bottom edge of the panel.
The handle extends 2-7/16 inches from the center line. This leaves the extreme end of the handle about an inch horizon-tally inside the extreme edge of the panel. We know o f no incident s of accidental actuation of any of these controls.
We have evaluated in the control room, with photographs, and on a spe-e ial full-scale mock up, the potential for accidential actuation. We agree that the current setback of about an inch horizontally is mini-mal.
There is, however, another human f actor constraint in increasing the setback.
In particular, it appears that increasing the setback inevitably involves some increase in the distance the operator has to resen, especially to the controls on the bac.kboa rd.
We consider in-creasing the reach requirements over the console is undesireable.
Our initial conclusion, however, is that providing a guard to double the
- setback, i.e.,
to about 2 inches, would not involve an unacceptable reach increase. We pisn to evaluate a guard of this nature.
If, however, we find thst in some areas the operators have trouble with the inc reased reach, it may be necessary to pursue alternate approac h-es, such as smaller handles on the controls. We plan to complete the necessary modifications on this item by restart.
3.b.
Set points knobs on Bailey controllers do not lock, and can be accidently rotated.
(Category 2)
RESPONSE
The finding is correct, but we do not concur that tais finding consti-tutes a shortcoming. Our basis is:
(1) None of the controllers on which set point knobs are provided control safety related variables.
(2) The position o f the knobs, their size, and resistance to turning makes accidental rotation extemely unlikely.
(3) The set points are adjusted during operation; different set points may be employed at low power or temperature than at high power or temperature.
(a) We know of no incidents where accidentak rotation has caused a significant upset.
Fu rth e r, this type of controller is widely used in the power industry.
(5) Should a lock be installed, and freeze, a desired change in set point would become impossible to accomplish.
Excessive physical force in attempting to unfreeze the lock could damage the controller.
The consequences of this could be a good deal more disruptive than accidental rotation.
For these reasons, we do not propose to install locks on the set point knobs.
WW m
3.e.
Violation of plant convention for auto / manual positions on some multi-i ple position rotary controls (Syne. Scope and Voltage Regulator).
(Category 1)
RESPONSE
For the main generator synchroscopes the "AUT0" position is to the left, "0FF" is in the center, and " MAN" is to the right.
Except for the addition of an "AUT0" position to the lef t, these controls operate in the same manner the synchroscope controls for the diesel genera-tors which do not have the automatic synchronization f eature.
These controls are, therefore, consistent with plant convention for all other "0N-0FF" switches on the console. The positioning of "AUT0" (which will be more precisely labeled " AUTO SYNC") is also consistent with the normal "AUT0" " MANUAL" positions.
The main generator voltage regulator selector, as well as the diesel generator voltage regulatory selectors, have the " MAN" position to the left and the "AUT0" to the right.
This is opposite to the AUTO-MAN positions tor the main generator synchroscopes.
However, we feel that the probability of error during the operation of these switches is low, since people function on expected. as well as actual, feedback from a control.
If the operator tries to rotate the control the wrong way it will not turn.
The lack of expected f eedback (the movement of the control handle) would indicate to the user that something was wrong.
Ir the relabeling program, all selector switch position labels will be reviewed and modified or expanded where necessary.
The relabeling program, to be completed prior to restart, will resolve this concern.
i l
1 t
3.d.
Legend switch covers are interchangeable.
(Category 1)
RESPONSE
The light capsule and legend assemblies on the Master Specialty T i
10E push button switches can be interchanged among the switches ype i
There are, however, a number of reasons that this is highly unlik l e y:
The legends are removed only to change the bulbs.
the legends are almost Consequently, invariably handled one at a time.
In addition to the color coding o f the indicator lights "0 PEN" is always to the top or the right;a consistent positio
, there is "CLOSE" is always below or to the lef t.
Variations would be immediately obvious to the operators.
4 the valve push button legends will be revised to red cIn t r,
Virtually all of them will simply state "0 PEN" or "CLOSE" ness.
u e the ir wo rdi-name and number of the valve will be on a permanent The cent to the button.
label plate adja-for "CLOSE"; this in turn would violate the positional stere tThi would be quickly spotted by the operators.
o ype and changeability. planned relabeling will eliminate errors due to switch cover in We believe, then, that the T
1 P
l I
i l
3.e.
Legend indicators contain numerous burned out bulbs.
(Category 2)
- 4.i.
No lamp test espability on control boards or panels.
(Category 1)
RESPONSE
The main annunciator panels, as well as all other (auxiliary) annunei-ator panels, and rod control and turbine control panels incorporate light test features.
Many legend indicators have multiple lights and adequate indication is obtained with a burned-out bulb.
Those indicators without lamp test espability will be incorporated into a formal surveillance program whi-h wil_1 deteet, and have removed and replaced, burned out bulbs.
Fu t u re,s_1_a rg e s e a lA re v i n i o n s t o t h e control room panels will be given consideration to include controls with lamp test capability.
e e
4 e
h i
1 3.f.
Many Uluminated legend switches are dif ficult to read.
(Category 1) j 4.h.
Backlighted legends are dif ficult to read. Room lighting is dim, i
contrast is minimal, lettering is crowded and busy and discoloration on scratched surfaces if frequent. (Category 2) i 3.h.
Labels are wordy, because the function of a system is repeated on each switch of a group.
(Ca tegory 2)
RESPONSE
The small lettering and crowded legends are a result of lack of demar-
's cation (See 5.g) and group labels (See 5.c) which make is necessary l
that the legends repeat a great deal.of information to avoid ambiguity.
We recognize these shortcomings, and as a result of the overall relabeling and demarcation we are undertaking prior to restart, it is practical to greatly simplify the legends. This, will be done. After modification, legends on push buttons will usual-ly indicate only either "0 PEN or "CLOSE"; the other information (name and alphanumeric designator) will be on permanent lable plates. Similarly, much of the information which is currently crowded on the lighted indicators is being replaced by permanent label plates where larger, more visiole letters can be used and the legends on the lights greatly simplified.
~
To enhance readability, low-reflective material will be used for the new label plates.
Observation 4.h states that room lighting is dim, we disagree. Ou r measurements indicate that the normal illumination levels are consis-tent with recommended standards D IL-STD-1472B and IES Lighting Hand-
)
' book). The measured illumination on the console benchboard averaged about 98 foot-candles (fe), about 60 fc on the inclined backboard, and approximately 109 fc on the desks and primary work stations.
If anything, our measurements and the comments o f the operators indicate the room is " bright" and not " dim".
4 4
4 i
k y 9.
= 9mt-oh'*
y p
3.g.
"J" handle switches are frequently in a position contrary t indicator color.
(Category 3) o the flag
RESPONSE
All such switches are Panel (where operation of automatic temperature controlle in position contrary to flag).
re su l t in this; a labal plate will be added to reinforce this tThe operating staf f has raining.
x__
's.,
O
,,,,eg N -M
3.h.
Bailey controllers indicate demand signal rather than valve position.
(Category 2)
RESP 0NSE All but one of the 23 Bailey controllers on the TMI-1 control console are equipped with small meters. Wha t the meters indicate is controlled by a small, two position, selsetor switch, also on the controller.
When the meter selector is in its normal ("p0S) position, the meter indicates controller output. For the ten controllers which provide signals directly to valve positioners, the meter indication amounts to position demand. The questions which must be addressed in assessing the adequacy of displays associated with these controllers are as follows:
(1)
Is the operator provided with sufficient information to e f fect smooth transfer from manual to automatic control (and vice versa)?
(2)
Is the operator provided with sufficient information to monitor the operation of the controller when it is in automatic and to troubleshoot it when it malfuncti.ons?
(3) Is the operator provided with adequate anticipatory feedback when he is manually controlling the process variable affected by the controller (e.g. when he is controlling water level or steam pressure - by controlling feedwater flow to a steam generator via the feedwater regulating valve).
(4) Can ene operator detect a malfunctioning valve positioner a
failure of the positioner to respond to the demand signal fed to it?
On all controllers, the miniature meter in its present electrical configuration, provides optimum answers to questions (1) and (2).
As long as the valve controlled by the controller responds correctly, the present arrangement provides a dynamically satisfactory answer to question (3).
It is the concern of question (4) which we presume underlies the NRC staf f's findings.
Our evaluation, for each of the valve positiori controllers is as follows:
(a) Pressurizer Level (makeup flow) Controller (which positions valve MU-V-17 ). Failure of the salve to respond to a change in position demand will result, essentially instantaneously, in a failure of makeup flow to change, when the position demand changes.
This flow is displayed to the operator by an indicator in the immediate vicinity of the controller. We note that the flow display also covers for other problems, such as improper makeup system valve lineup.
(b ) Total Reactor Coolant Pump Seal In jection Flow Controller - (for valve MU-V-32).
Again, failure of the valve to respond is satis-factorily fed back by a failure to change of the total seal flow.
i displayed to the operator by a total seal flow indication, in the immediate vicinity of the display.
(c) Emergency Feedwater Flow (S. G. level) controllers.
(2 control-1ers, positioning emergency feed valves EF-V-30A and B).
Prior to the shut down of Unit I a failure of the valve to re-spond, or a misalignment of the emergency f eedwater system valves, i
would not have been straight forward to detect. However, before re start ing the unit, emergency feedwater flowmeters will be in-stalled in the immediate vicinity of the Bailey controllers, as well as near the backup manual controllers which are to be added.
A failure of a valve to respond will be immediately evident from the failure of the associated flow indication to change. We consider this arrangement to be satisfactory.
(d) Main Feedwater Valve (FMV 17A and B) Controllers (2) and Startup Feed Valve (FWV 16A and B) Controllers (2).
The response of the main feedwater valves is satisfactorily fed-back via the displays of individual feedwater flows, located in the immediate vicinity of the controllers.
Low load flow displays provide feedback when the startup valves are used.
(at low power)
(e) Main Turbine Bypass and Atmospheric Steam Dump (MS-V-4 A and B, MS-V-3 A, B, C, D, E, and F Controllers (2).
The open-closed position of these valves is indicated by red /
green indicator lights on the console, directly beside the appropriate controllers. When the valves are in the middle of their travel (as they are when controlling) both read and green lamps are lit.
Small changes in valve position, responding to small changes in demand are evidenced by the response of the ultimately controlled process variable (steam pressure). This response is monotonic and immediate. There is virtually no time delay, though there is a time constant (the rise or fall of the pressure response to a sudden change in valve position is described by an exponential function).
In summary, we consider all of the above controller arrangements to be satisfactory with respect to fulfilling the requirement implied by question (4). However, we belteve that the labeling of the control-1ers, and of the meter selector switch, and of the controller meter scale itself is in some cases misleading and requires improvement. We intend to make appropriate labeling improvements prior to restart.
Furthermore, substitution of actual valve position for position demand provides an unsatisfactory answer to question (2) above and, in our opinion, would degrade the man-machine interface.
i
)
4.a.
Panel legend lights do not provide positive indication because of poor contrast with panel background, especially for certain green colored t ile s.
(Category 1)
RESPONSE
Our measurements and observations indicated that some green push but-ton indicator lights are dimmer than others; however, even those that are relatively dim had a substantial dif ference in measured luminance from an unlighted push button. Fo r example, gree n "o n" wa s 12 foo t-Lamberts (fL) while a green "o ff" was 7 fL.
Also, although the panel itself is green, all the pushbuttons have bezels which set of f the button from the panel and the hue of the light is dif ferent f rom the panel color.
It should be noted that the operator does not "s we e p-the-panel" looking at valve lights, but looks at particular valves and determines their status in a relatively deliberate manner.
It is not intended that the valve indicator lights catch his attention, as in the case of an annunciator window.
Dim indicators and variability in the brightness o f the indicators are not desirable.
In order to correct this and make the luminance consistent. prior to restart, we will systematically investigate the source o f the variability and readjust dropping resistors, clean lenses, and check for correct bulbs were appropriate.
1 a
f h
4.b. Glare is present on all vertical indicators resulting in reduced readability. (Category 2) 15.b. Direct glare from overnead lights on both controls and displays made readability dif ficult.
(Category 2)
RESPONSE
Some glare is present on the console meters, particularly those with curved faces. These curved-face meters (GE) are predominately in the electrical systems. The flat-f aced console meters (Bailey), which are used for the bulk of the meters, have much less glare.
Since the operator's position is not fixed, i.e., he can shif t his head or body, in a practical sense he can always read the meter.
Howeter, because glare is annoying and tends to increase operator f a-tigue, we consider it undesirable. We plan to evaluate various types of lighc baffles on the overhead fixtures which are directly over the central region of the room.
Our observations haIve identified these as the major glare sources.
If these baf fles prove to be beneficial and can be practically attached, they will be incorporated.
In addition, the material for the new label plates has been selected for its lack o f glare.
-t e
l
-n w-
1 i
I 4.c.
Normal operating ranges or set points are not indicated on vertical meters.
(Category 2) f
RESPONSE
As part of the upgrading of the meter scales (part of the general relabeling, demarcation, upgrading effort) chose meters with a clearly i
and unambigous " normal" range will be marked. This will be done on a case-by-case basis with the operator's concurrence.
i e
i i
d f
'I y
a i
?
l l
i 4
4 4
1 1
. j
i i
4.d.
Normal or desired position in strings of meters does not line up for easy monitoring.
(Category 3) i 1
RESPONSE
This finding is f actually correct. Meter scales are, however, con-strained by other, overriding range and zero requirements. To assist the operator in quickly scanning vertical indicators, we intend to add normal variable ranges and maximum and minimum limits as appropriate (see our response to Findings 4.c. and 4.e. ).
4 4
O E
i I
d i
f 1
i 1
i l
l
-T" 3'"
+--u y
4.e.
Most meters fail at mid-scale position.
(Category l).
RESPONSE
This finding is correct relative to vertical Bailey meter. A system of annunciators and indications to highligh upsets in the power supplies to the ICS and NNI control systems is being implemented.
This system will allow the operator to determine which ICS/NNI power supply has been lost.
The operators will be trained to respond to ICS/NNI power failures.
To provide indication of a power loss to single instruments, vertical Bailey meters will be marked with a distinctive black dot to indicate the mid-scale point. Since the normal indications of most variables are not at mid-scale, the operator will be trained to check other indications of the specific variable when he observes a meter indication at the black dot.
Both systems will be completed prior to restart.
i
4sgme motor dn valves, an open circuit breaker inhibits valve tion indicat (i.e. valve position cannot be determined).
egory 1)
.F geding of Poi to valve position indication circuits through the uit breaker fohe motor operator is common practice for Limitor-operators (to es t complete deenergization of all circuits when e
pgerator is wore on).
As a result of this feature, opening of
- trgutt b reaker 41 re sult in loss of the normally used position
$, o r p(ow.e. the isition indication adjoining the operating n i h
ering ti valve operating push buttons). However, all d}eered Safeguards alves are provided with a second, independently
.d, position indiction circuit. Tats position indication circuit
.ates valve positin on the Emergency Safeguards status panel.
It rs are aware of this feature.
O he ee
=we e
l 1-4.g.
Bailey meter scales do not meet basic human engineering standards (scale internal were poor). (Category 3)
RES PONSE Because of the basic construction of the Bailey meters, the scales are i
somewhat dif ficult to read, particularly those which have unusual intervals. All scales are being revi 3wed and those with particularly unusual and dif ficult-to-read scale divisions will be modified prior to restart. In addition, scale factors and units appear on the Bailey scales in very small letters. These will be placed on the new perma-nent label platt at the bottom of each meter in larger, easier to l
read fo rma t.
aecause of the relatively reliable performance of these l
meters in service and because the operators and maintenance personnel j
are very familiar with them, wholesale replacement with new meters is
]
not considered necessary and is not being planned.
O k
1 4
4 i
I e
3 i
1 l
4 s
er>,,-r-a-,
,,,r--
--~,,w--,,-e-
--e,-,,g- - - -,,-,- --
--g--
4.h.
Backlighted legends are difficult to read.
Room lighting is dim, constrast is minimal, lettering is crowded and busy and discoloration on scratched surfaces is frequent.
(Catego ry 2).
RESPONSE
See reply to comment 3. f.
P e
.--.am 4....
4.i.
No lamp test capabilty on control boards or panels.
(Catego ry 1)
RESP 0tiSE See reply to comment 3.e.
9
h 5.a.
Color meaning is not consistant.
(Category 1) 5.d.
The use of colors labels is not consistent, for example, black / white background'and print.
(Category 2)
RESPONSE
i The major lack of consistency in the meaning of label colors on the 1
existing panel is in the names of controls and displays which can be either white letters on a black background or the opposite, black letters on white.
It is difficult to postulate a serious operator error directly from this source.
However, the lack of color consistency is undesirable. Consequently,
in the general re-labeling, the labels of the name of controls and disptays are being changed to be black lecters on a white backgound to l
assure maximum readability. On the existing panels, general informa-tion and instructions for the operators are usually presented as white letters on a black background except for caution's which have a red background.
These color meanings are being retained and will be used for any added or revised labels.
l l
4 i
I h
a f
1 i
i i
l
5.b.
Mimicing is used minimally.
(category 3) i
RESPONSE
The existing panel include mimics for the make up system (on CC), the I
electrical distribution systems (on CL, CR, and PR), and the liquid waste disposal system (LWDS). These existing mimics are being review-ed and modified as appropriate, as part of the relabeling, to improve their presentations and consistency where necessary. It is planned, on a long term basis, to rearrange the controls / displays for the emergency feedwater (EFW) on the lef t end of CC in the form of a nimic of the system similar to the makeup system mimic. Also as part of relabeling and demarking of the console and panels, some mimics, or segments of mimics, will be added where existing component arrangements permit and where walkthoughs with the operators show the mimicing is useful.
e
)
4 a
s
}
}
l I-i
- _ =. _ _ -.
5.c-tal, labels are used only at the component level, not at the function, system or panel level.
(Category 1)
RESPONS
'e a few general panel labels. For example, each of the back includes a large label plate with the appropriate designation C, PC, LWDS, etc.) and the Engineered Safeguards Actuation Sanel (PCR) also has a large identifying label.
Trols and displays on the panels are generally grouped logically.
Te use of group labels is practical and they will be incorporated a:of the panel relabeling.
5.d.
The use of color labels is not consistent, for example, black / white background and print.
(Category 2)
RESPONSE
See reply to Comment 5.a.
)
l i
l 4
i l
5.e.
Makeshif t labeling was observed on many components including penciled l
on switch nomenclature, hand letters labeled and vertical meter scale
]
value and the use of dyno tape.
(Category 1) 5.f.
Labels are not all permanently attached.
(Category 1)
RESPONSE
j i
Some temporary labels' have been added by the operators to clarify or expand the existing labels. ' In general, they will be replaced with permanent label plates which are consistent in color, letter size, nomenclature, etc. with the other label plate s.
Each of these new labels will, of course, be reviewed as part of walkthroughs of modifi-cations and must have a clear utility for the operators. All labels will be permanently attached.
a I
i a
i 1
1 4
d d
7 t
i j
i i
i i.
4
- - +
cr v
<-e---
w-e ewser u-
-s mr-s.
- - - - - + <. -, - -
-..-e.
e
- r.m*
,-e-.-e
i i
5.g.
Little or no use o f demarcation lines to separate systems, subsystems, functional grouping, etc.
(Category 1) 8.e.
Discrimination between systems and subsystems is difficult because o f lack of use o f demarcation lines and color coding.
(Category 1)
RESPONSE
1 The functional groupings of the controls and displays on the existing panels are not highlighted by outlines which set of f these various groups and subgroups. However, the control and displays are generally arranged in logical and workable groups.
The outlining technique appears to be a valuable adjunct to labeling to provide visual clues for the operator to locate specific instruments quickly by breaking up similar looking arrays o f controls and displays.
It also provides some help to the operator where electrical separation requirements have broken up groups of controls and displays.
It also is needed in some cases to allow the use group labels and, the re f o re,
reduce the number o f wordy, repetitious labels.
Prior to restart, outlines will be added to a large number o f areas as part o f the relabeling program.
Ir. all cases, these outlines will first be added to the full-scale mock-up and evaluated to be sure that they do not detract from other features such as flow and electrical mimics.
4 f
f i
L i
f f
5.h.
Labels are wordy, because the function of a system is repeated on each switch o f a group.
(Category 2)
RESPONSE
See reply to coment 3. f.
1
d 6.l' General - Related contrels and displays do not consistently have both nomenclature and couponent designation.
(Category 1)
RESPONSE
Except for a few cases, une existing panel labeling for all valves, motor controls, and breakers indicates the alpha-numeric designator used on the related system d iagram, e.g. RC-P-1B, MU-V-3, TI-C2.
Because the system diagrams include specific alpha-numeric designators for the instruments, procedures of ten refer to a display by this designator as well as by a descriptive name.
The relabeling program, which will be completed prior to restart, will add the alpha-nu=eric designation on a permanent label plates to those valves, motor contro ls, and breakers that require it.
]
It should be noted that valve controls which are placed in a mimic, as j
in the existing make-up system presentation, usually include only the alpha-numeric designator and do not give the valve a name. This is
~
l because the location in the mimic provides more -information with less potential ambiguity than attempting to describe the valve's function 4
by a name.
4 i
1
[
I
l 1
i j
6.2.a.
Makeup and Purification System Makeup pumps are not grouped together.
(Category 2)
RESPONSE
This finding is factual. Controls for makeup pump 1A and for the "D bus" power source for pump 13 are on panel CC; controls for makeup pump IC and for the "E Bus" power source for 1B are on panel CR.
This segmented arrangement is a consequence of electrical separation requirements in ef fect at the time the plant was built. We believe 4
effective labeling and demarking will make : lear the relationships I
between the two control segments.
4 e
l I
i J
i j
i
'l 2
I 9
5 i
e r
-w
- a+-
N
++P-m.
9 r
-mg eP e
h 3
'm-w w-gv
--T
6.2.b.
Makeup and Purification System Lacks positive indication of flow when makeup pump is running.
Indication by an Ammeter only that pump is running.
(Category 2)
RESPONSE
When the Makeup System is operating under normal conditions, makeup flow and seal injection flow are directly displayed to the operator on analog indicators in direct vicinity o f the controls normally used for makeup pumps. Normally pump 18 is operated using the D bus power source. Pump 1A is the normal backup.
A makeup pump may be started for any o f a number of reasons:
(1) To replace the operating pump to allow maintenance work on the latter.
(Manual Start)
(2) To replace the normally operating pump wh'en its trips.
(Manual Start)
(3) To provide additional makeup flow to compensate for reactor coolant volume shrink af ter a reactor trip.
(Manual Start)
(4) To provide high pressure injection flow in case of a leak.
(Automatic)
In situation 1 -
- the pump start will no rmally preicce o c-..
sient in makeu fith a subsequent return to its initia'.
'ue (the duration s..nds on the re sponse time o f the MU-V-17 cou rol).
In situation 2, makeup flow will then increase as the second pump is started. In those situations where pressurizer level is low (situa-tions (3) and (4)) the makeup flow increase will be permanent. Thus, in all situations listed above, the start of a makeup pump should produce an observable change, possibly temporarily, in flow indica-t ion. The operator should in f act look for this transient, since, if it does not occur it is clear evidence of an incorrect and abnormal valve lineup.
The one system configuration, which would allow a pump to be started without a transient on steady state effect on flow, requires startup of a pump with suction and discharge valves closed. This is unlike-ly due to the fact that suction valves are locked open and discharge valves are normally open. The positions o f these valves are checked and logged once a shif t.
The normal startup procedure for a makeup pump at TMI-l requires an auxiliary operator to visually check tbs valve lineup and the pump start itself. Discharge pressura and noise are checked locally. This is further insurance for the pump.
We consider the present arrangement o f contrais and displays for makeup pumps satisf actory. Ho w2ve r, training for console operations will include instructions to look f ar the flow transients described above for when a pump starts.
- 6. 2. c.
Cannot see seat leak strip chart recorder when using seal injection flow.
(Category 3)
RESPONSE
The setting of seal injection flows to individual coolant pumps does not involve the seal leak strip chart rec o rde r.
Seal leak of f flow for each pump is adjusted by an auxiliary operator in the reactor building. The auxiliary operator uses a throttle valve and local flow meter (1 valve and 1 flow meter for each pump) to make this adjustment. The strip chart recorder is utilizied to provide long term trends in seal performance.
(Seal failures are indicated by meters on the main console and by appropriate annunciations).
Therefore, no action is required.
6.2.d.
" Dual purpose meter for RC Pump seal P and Lab Seal has dif ferent scales which cou'.d be confusing." (Category 3)
RESPONSE
This finding is correct. We are investigating alternative meter arrangements to eliminate the problem.
4 l
6.2.e.
It is impossible to verify a required reading of 3 gpm flow on the RC Makeup Flow Meter which has Scale Values of 0 to 16 (x 10).
(Category 1)
RESP 0dSE The required reading of 3 gpm is from the makeup systems operating procedure. The reading is done locally, on a meter which has scale values of 0 to 4 gpm.
Therefore, no corrective action is required.
I l
6.2.f.
Boration capability is on the Liquid Waste System which is remote to main control console (LWS).
(Category 3)
RESPONSE
Many of the controls and displays associated with boration (and de-boration) of reactor coolant are presented on the liquid Waste Disposal System (LWDS) panel in mimic format. This panel is approx-imately 25 feet away from the operator's station in front of the main console. The Foxboro batch controller and the rest of the valves, which control the actual flow of makeup into the reactor coolant system, are incorporated in the makeup system mimic on center console (CC). Basically, the operator sets up the operation at the LWDS, but controls the actual flow into and out of the system from the center console. The controls and boration from the Sorated Water Storage Tank) are also located at the operator's normal station at Console CC.
In all cases, operations involving the LWDS ar'e deliberate and evolutionary in nature. Although this might be more convenient if the LWDS panel were closer, the current arrangement has proved to be sa t i s f ac to ry.
6.2.g.
Letdown flow meter is in gpm while scale on controller is in percent and must be converted before setting.
(Category 2)
RESPONSE
The observation is correct. The controller output is in terms of percentage position demand of the letdown flow control valve, MU-V-32.
As part of the relabeling work we will show the normal valve position and flow rate at normal operation pressure.
Howe ve r,
the operator does not use the position demand indication, but rather he relies on the correlation between the flow meter and the set point indicator to ascer ain flow demand.
In additien, the con-version between flow and valve position is dependent upon a variety of variables, including RCS pressure and valve position. The re fore,
no single conversion factor can be defined.
I
6.2.h.
There is no Engineered Safeguards / Safety Injection annunciator window.
(Category 1)
RESPONSE
The activation of Engineered Safeguards is currently indicated by the (mislabeled) "RC Pressure E.S. Actuation" Alarm. The mislabeling val be corrected prior to restart.
l 1
l i
6.2.i.
Engineer Safeguards Actuation Panel has blue status lights which are l
dif ficult to interpret as being "on."
(Category 1) f
RESPONSE
i Our measurements and observations have shown that some of the two color (blue / yellow) indicating lights on the ESAS panel are dim and difficult to distinguish as being "on" f rom the position in front o f the console (about 8 feet away) when the blua light is on.
Ho weve r, j
they are visible when the yellow light is on.
Measurements indicated i
luminances of 13 to 18 foot-Lamberts (fL) for the blue lighted indicators, while an unlighted indicator was approximately 10 fL.
4 The yellow lighted indicators had measured luminances of 34 to 54 fL.
i The function of these lights is to provide the console operator with 1
information as to the status of certain engineered safeguards compo-nents (e.g. pumps, valves, fans). The status is presented in terms of whether the component is o r is no t in the "E.S." position - that i
i is, the state the component assumes when the engineered safeguards feature is actuated.
If the indicator light is blue, the component is in the E.S. Status.
If the light is yellow, the component is not 1
in the E.S. position.
In the case of an E.S. actuation the operator expects to see a " blue board".
If he finds a light is yellow, he a
must evaluate it and may have to take some manual action to correct the status. Although it is clearly undesirable to have the blue indicator lights dim, the yellow lights are significantly more important and these are inherently brighter tnd more visible.
4 The blue lights on the ESAS panel will have reliable indications prior to restart. The indicator lights are part of a program o f systematically eliminating the observed light variability by checking dropping resistors, cleaning lenses, and checking for correc t bulbs (See re sponse to 4.g. ).
If this does not result in reliable indications on the blue lights, modification to the configuration and density of the blue filters and providing local vaffles to cut the overhead light intensity on the indicators will be evaluated.
If these are not successful, other changes will be incorporated until adequately visible blue lights are achieved.
I T
l 1
I F
I I,
.,,--,,.c
,,-.-,..--,1
i i
6.2.j.
Valve positions (containment isolation) at bottom at Engineered Safeguards Actuation Panel can't be seen from main console. Also, there appeared to be no color sequence or pattern to help check 4
f which valves should be opened or closed.
(Category 1)
RESPONSE
The valve positions on the ESAS panel (PCR) (two color, red / green, backlighted indicators) are not visible to the operator in front of j
the console; however, this valve position information is not j
intended as a presentation to the operator in front of the console.
These displays are for the use of an operator in the aisle between the console and the panel when he manually positions these valves.
l The manual positioning typically takes place during heacup and j
cooldown and is a plar.ned, deliberate action. The indication of r
i i
these and other ES valte positions are repeated on the upper section of the panel as described below.
~
There is a color coding system to aid the operator in determining
}
which valves should be open or closed.
The information needed by the control console operator is provided by the blue and yellow lights on the upper section of the panel, shich is visible to him.
These show whether the Engineered Safeguards (E.S.) position has been achieved (see 6.2.i).
These are intended to show blue for the E.S. position and yellow if not in the E.S. position.
The operator has been trained to know what the E.S. position implie s, i.e., open or closed, of f or on, etc.
The pattern or sequence of the lights on the lower section are not involved in this check of ? ?.-:
I l
i i
1 i
1
,w
,,, ? -
w
,,,,v
..~---,a-
,n,
,-n
,-v..n n. -.,
6.2.k.
No direct indication on a Decay Heat Removal (DHR) system is appa re nt.
(Category 1)
RESPONSE
It is our understanding from a phone conversation with the NRC staf f that this comment has been withdrawn.
w i
6.2.1.
DHR temp and DHR cocoler temp indicators are side by side but have different scale multipliers.
(Category 2)
RESPONSE
The observation is correct. The scale on the temperature "to the cooler" is planned to be changed to be the same as that "from the cooler" to eliminate this inconsistency. This will be completed prior to restart.
6.2.m.
LPI valve alignment is not sequentially organised or grouped on panel.
(category 3)
RESPONSE
The status of the valves involved in low pressure injection (DH-V-4 A/B, DH-V-5A/B, DH-V-6A/B, and DH-V-7A/B) a re shown on the Engi-neered Safeguards Actuation System (ESAS) Display on PCR with the blue / yellow color coding for "E.S."/"not E.S." positions (See 6.2. i and 6.2.j).
The open/ closed information and the controls, lighted push buttons, are located in virtually identical arrays as part of system control /disf ays - one on the center i
the groups of decay heat console (CC) for train A, the other on the coteole right (CR) for train B.
The completion of our relabeling and demarking program, which was discussed earlier, will aid the operator in recognizing proper LPI valve alignment.
(Also see response to 6.2.m) a i
i
i 6.2.n. DH, 5, 6, 7 valve controls are not included in mimic.
(Category 2)
RESPONSE
These valves will be shown in appropriate (decay heat removal system) mimic format. The connection of the decay heat to the makeup system via Dil-V-7A and B will be also indicated by appropriate level plates on the existing makeup system mimic. The controls for DH-V-5/6/7 will be left with the controls for the rest of the decay heat system. The mimic corrections will be completed prior to restart.
l J
~c
6.3.a.
Train "A" controls are on right and train "B" controls are on lef t s ide.
(Category 3) 6.3.b.
No separation or demarcation of grouped J handle control switches (9 in a row).
(Category 2) 6.3.c.
Five trend recorders (air flow) are at top of panel (6'6") with excessive glare which requires standing on a stool and lifting covers to be read. (Ca tegory 3) 6.3.d.
Labeling does not contain information which indicates time required for depressing and holding manual fan start control to start fan (varies by fan, 30 to 90 sec.).
(Category 3)
RES PONSE The Heating and Ventilating (H&V) panel is similar to the other con-sole and panels in that it lacks consistent labels and demarcation.
It is included in the program of relabeling and demarcation.
How-ever, the operations using that panel are less critical than those using the main console and panels, so that the (HSV) work will be given somewhat lower priority, and thus not necessarily completed prior to restart. However, prior to restart, those controls a d displays associated with control room ventilation will be highlighted if the overall relabeling and demarking program is not complete.
i i
l 7.a.
The IBM - Selectric printer is 63 dbA while typing. This level is 5 to 6 dbA above ambient and 4 to 5 dbA above most alarm levels.
(Category 2)
RESPONSE
The IBM - Selectric printer has been replaced. The new printer is a Texas Instrument printer which is 3 dB quieter than the 13M.
. _ = _.. -
= - - - -
7.b.
Main control board alarm is below ambient noise level.
(Category 1) j 7.c.
Panel Lef t (PL) alarm'is only 1 dbA above ambient noise level.
(Category 1) i i
i 7.d.
Right Panel Front (PRF) alarm is only 1 dbA above ambient noise level (Category L) i 7.e.
Liquid Waste System alarm is below ambient noise level.
(Category 1)
RESPONSE
l l
Our measurements of the sound levels of the alarms are as follows:
I Main overhead alarms - 2 to 3 dBA above ambient, PL alarms - negligible above ambient, I
PRF alarms - 1 to 3 dBA above ambient, j
i LWDS alarms - negligible to 2.5 dBA aboss ambient.
i Even though the sound level of some of these alarms does not appear to be much above the ambient noise level, this does not mean that the alarms are not audible to the operators.
Because of their distinctive tones and directionality, the alarms are much more recognizable than the measurement of the sound levels suggests and we have not found 4
... - -.. =.2tz,1,z-.::.
The control room is a relatively quiet environment in which loud alarms can have a negative ef fect - they make the operator more concerned about silencing the alarm so that he can effectively communicate than in taking corrective action.
In fact, one of the alarms in the control room (H & V panel) is very loud, 10 to 12 dBA above the ambient, and we intend to lower its volume.
I
~
It is intended to confirm the proper operation, e.g., mounting, of the existing annunciator horns and then on the basis of actual tests in the control room set the volume levels so that a consistent alaen intelligibility is perceived by the operators.
Note that because of the dif ferent character of the alarms (pitch, etc.) the measured sound levels may not be the same for all the annunciators. We believe that this approach will provide a better result than simply requiring all
~
audible alarms to be set to a particular dBA above ambient.
l t
.-m
J i
i 8.a.
Diesel Generator Governor has no indication on J handle switch for fast / slow speed control which is inconsistent with other speed cont rols.
(Category 2) i
RESPONSE
The diesel generator speed control has two yellow indicator lights which indicate " IDLE" and "RIGH".
In the control room and in most places in the plant, yellow means a condition of mismatch or that something is defeated or bypassed. Since these lights obviously do not have any character of a mismatch, they will be changed to white which is the normal, general status color convention. Appro priat e labels will also be included in the relabeling. The relabeling and demarcation of the existing console and panels includes the changing o f light colors where necessary.
i f
I a
+
i i
i
- - + - -
n
=. - - >.-
m--e-e
--w,m,-re--.w, n--
--,---r---
r.w
--r-re
-v,w
~.s---
-~<n-
l i
l 8.b.
Unrelated " Reactor Building Emergency Cooler B&C" displays are located in the center of the diesel panel.
(Category 3)
RESPONSE
The separation of the reactor building emergency cooling controls is a consequence of electric separation requirements as applied to TMI-1.
This is also discussed in connection with the responses to 3.c and 8.d.
In the existing arrangement, the operator is not provided with any group labels or demarcation lines.
The relabeling and demarcation of the console will reduce the potential for confusion from the se pa ra t ion.
4
= _ _
l i
8.c.
On DHR system, controls for loop A and B were not associated with their displays which are located approximately 8 feet away.
(Category 2) 8.d.
One DHR indicator and control switch are located on loop B panel i
actually belong to loop A panel.
(Category 2)
RESPONSE
The decay heat removal system is grouped in two segments: one on the right hand of console CC, the other in the center of console CR.
The i
requirements of electrical separation at the time TMI-l was designed, i
dictated the division of these controls into two physically separate segments.
i The specific situation is as follows:
(1) Can'trols for decay heat removal pump 1A are on console CC.
Immediately above them is a display of the flow for decay hear removal Loop A.
(2) Controls for decay heat removal pump 1B are on console CR.
Immediately above them is a display of the flow for decay heat i
removal Loep B.
(3)
Controls for makeup to Decay Heat Closed Cycle Cooling Subsystem A are on panel CR.
Subsystem A Sarge Tank level is displayed in the i-edi-*? ricinia" of t43-
---t-3'
??
(4)
Controls for makeup to Decay Heat Closed Cycle Cooling Subsystem B are on console CR.
A display of Subsystem B Surge Tank level is in the immediate vicinity of this control, sn panel CR.
l.
I Displays for A and B decay heat removal pump discharge pressures, and the A and B decay heat removal heat exchanger inlet and out-let temperstures are providad on a single cluster in console CC.
The use of these Loop A and B displays is informational.
In a loss of coolant accident situation or in a low pressure coolant
)
injection system test sequence, the pump discharge pressure indications may be used by the operator to confirm the pumps have (automatically) come on, before flow (other than recirculation
-j flow) is produced.
Temperature information is used during cooldown for setting the 4
closed cycle cooling flow into and around the decay heat removal heat exchanger.
Controls for the inlet and bypass valves are at a local station. positioning of the valves is accomplished via telephone communications between a console operator observing temperature indications and an auxiliary operator at the local station.
In both cases--discharge pump pressure and heat exchanger temper-atures--clustering of displays of CC is a convenience for the l
console operator, since this represents his normal station.
i m
m-,-
._...r
-..,,mm.m,.,,
l i
In sucanary, while the arrangement is not optimum from a human factors viewpoint, we consider it satisf actory. We expect that the labeling and demarking of these control and display groups will make their functions and relationships clearer. The controls and displays will be part of the relabeling program that is to be completed by restart.
8.d.
Que DHR indicator and control switch which are located on loop B panel actually belong to loop A panel.
(Category 2)
RESPONS2 See reply to cocusent 3.c.
1 i
i 8.e.
Discrimination between systems and subsystems is difficult because **
Lack of use o f demarcation lines and color coding. (Category 1)
RESPONSE
See reply to cocnent 5.g.
.=+
8.f.
Auxiliary Feedwater system lacks a flow meter.
(Category 1)
RESPONSE
A flow meter for the Auxiliary Feedwater system is 'seing installed as part o f the restart modifications.
s
i 8.g.
"The ICS is spread out over two panels."
(Catego ry 3)
RESPONSE
The feed pump controllers are located in the central portion of con-sole CL, with displays and other controls associated with these compo-nents. There is no other appropriate location for these controllers.
One of the two emergency feedwater controllers is at the right hand end of console CL.
At this location it can, and will be ef fectively integrated with the balance of the emergency feedwater controls and displays which adjoin this location (at the lef t hand end of console CC).
The balance of the ICS controllers are on console CC.
Discussion of locations of these controllers is included under finding, 8.h., below.
(
l 8.h.
Control / display arrangements for ICS (feedwater, steam level) are not ap pa re nt.
(Catego ry 2)
RESPONSE
Our evaluation of the automatic controllers of the ICS and the display of variables related to these controllers has concluded that the per-tinent displays are genarally in close proximity to related control-lers. However, the finding is correct, in that the labeling o f the displays, particularly, does not make clear the pertinent control-le r/ display relationship. We intend to remedy this situation by 4
impro vementa in display and control labeling and demarkations.
i
9.a.
Is not independent of the Control Room - some actions are required in control room.
(Category 1) (RSP)
RESPONSE
A new remote shutdown panel and a revised emergency procedure for cool down outside the control room are being developed to allow the RSP to be completely independent of the control room. The new RSP and emergency procedure for cooldown outside the control is scheduled for completion by S/81.
4
1 9.b.
r a emergency lighting.
(Category 1) (RSP)
RESPO!ISE The remote shutdown panel will have emergency lighting in conjunction with the Technical Support Ce nte r.
The emergency lighting will be installed and operational prior to restart.
f i
1
9.c.
Communication is by sound poweced mikd with no mike in area.
Communi-cation is also by equipment in TSC.
(Key kept in CR) (Category 1)
RESPONSE
An outlet for a sound powered mike will be installed next to the RSP prior to restart. A sound powered mike will be kept at the RSP also.
A set of keys to tha communication equipment in the Technical Support Center will be in the control room another set will be with the shif t supervisor and -
with the person on duty responsible for the Technical Sup>
ir.
i m-em -
o-==
9.d.
No scott-air packs near RSP.
(Category 2)
RESPONSE
The habitability o f the RSP area is a ssured during emergency condi-tions by a recirculation of the air through HEPA filters and charcoal filters qualified to Regulatory Guide 1.52 for methyl iodine removal e f ficiency. No scott-air parks are required as they are to be used to gain access to an area to fight a fire and fif ty (50) Scott Air Paks 1
are statistically placed throughout the unit for that purpose. Scott Air Paks are not to be used during radiation emergencies.
d
)
e l
I
^
10.a.
No emergency lighting is provided in this of fice.
(Category 3)
RESP 0:lSE Emergency lighting will be installed in the shif t supervisors o f fice prior to restart.
i
10.b.
No scott air packs are stored in this of fice.
(Category 3)
RESPONSE
The shif t supervisors office is on the same ventilation system as the control room.
It s habitability, there f or, is assured during emer-gency conditions by a recirculation of the air through HEPA filters and charcoal filters qualified to Regulatory Guide 1.52 for methyl iodine removal e f ficiency. No Scott Air Paks are required in this of fice as they are to be used to gain access to an area to fight a fire and fif ty Scott Air Paks are statistically placed throughout the unit for that purpose.
11.0 Communication in Control Room 11.a.
Only one non-dedicated outside telephone line.
(Category 3)
REPONSS There is more than one non-dedicated outside telephone line.
11.b.
No sound powered mikes are readily available.
(Category 1)
REPONS$
Two sets o f sound powered mikes are kept in the computer cabinet in the control room.
ll.c.
Weaknesses in radio communications with technician outside the CR.
(Category 1)
RESPONSE
Radios are used for communication between the control room and opera-tors outside the plant. The radios are not used for in plant cormnu-nication, instead the paging systems is used. GPU is, howeve r, studing the overall communication system at T'il-l to determine what,
if any, improvements can be made.
=
11.d.
Some inoperable page telephones in the plant area.
Some areas in plant are not rec.chable by phone.
(Category 2)
RESPONSE
Maintenance is presently under way to fix inoperable phones. Are as of the plant that do not have phones, and should have phones, will be identified and have phones installed. The entire paging system will be included in our study of the overall communication system at TMI-1.
s
)
i i
ll.e.
Page system unintelligible in some areas of plant due to ambient noise levels.
(Category 3)
RESPONSE
The entire paging system will be part of the study o f the TMI-l cocimunications system.
)
v
i e
i 12.a.
Three Scott Air Paks are kept in the CR, but there are eleven people planned to be in the CR during emergency operations.
(Getegory 1)
RESPONSE
The.hsbitability of the Control Room is assured during emergency conditions by a recirculation of Control Room air thrugh HEPA filters and charcoal filters qualified to Regulatory Guide 1.52 for methyl iodine removal efficiency. The Scott Air Paks currently in the control room are not for radiation emergency, but are part o f a system of fif ty Scott Air Paks, statistically placed throughout the unit, used to gain access to areas to fight fires.
l i
t a
i 1
12.b.
Air rifill bottles are stored 3 floors below the CR.
Elevato r failures makes transport of airpacks dif ficult. (Category 3)
RESPONSE
See replay to Cocusent 12.a.
.- e-eene.
..-+- --+
l 13.a.
No airpacks are available.
(Category 1) (TSC)
RESPONSE
See response to cocunent 6.2k.
S
13.b.
No emergency lighting is provided.
(Category 1) (TSC)
RESPONSE
See response to comment 6. 2. K
14.a.
Immediate action steps are too detailed some with an excessive number of steps required to be completed immediately.
(Category 3)
RESPONSE
We are in the process of developing new emergency procedures, along the lines of the Abnormal Transient Operating Guidelines. Utey will by symptom oriented, to aid the operator in transient control, and evaluated to insure that they meet basic ; human factors criteria.
14.b.
Steam Line Break procedure is written as an abnomal procedure rather than an emergency procedure.
(Category )
RESPONSE
See reply to corxnents 6.2.k.
14.c.
Some steps which require 2 operators to implement are not noted.
(Category 3)
RESPONSE
See reply to comment 14.a.
)
14.d.
Some procedures, have notes before symptoms which are actually action steps. Many notes in procedures are actually steps.
(Category 3)
RESPONSE
See reply to comment 14.a.
14.e.
Some procedures reference control and display labels by names different from the names actually used on the labels.
(Category 2)
RESPONSE
Procedures will be revised to be consistent with the new labels, as part of the relabeling program. At least the emergency procedures revision, to insure consistency, will be completed by restart.
15.a.
Lighting was not specifically designed for reading labels, displays and meters.
(Category 2)
RESPONSE
Our measurements indicate that during normal operation the illumina-tion on the console is about 50 to 100 foot-candles (fe) and on the back panels it is in the 30 to 50 fc range. These values are consis-tent with recognized standards (MIL-STD-14723 and IES Lighting Hand-book), and there fore we consider the illumination is adequate.
However, we are planning to take steps to evaluate and, if practical, incorporate baf fles for glare reduction (See 4.b and 15.b).
Evaluation of the control room lighting under emergency conditions has not been completed. If necessary, emergency lighting will be increas-ed in level or relocated to assure that when the emergency lighting is in use the illumination is adequate to perform those operations which may have to be done under these emergency conditions.
In addi-tion, baf fling will be added to the emergency Eights where the lights p resent a problem in direct glare, i.e., where they could shine directly in the operators' eyes. The evaluation and any appropriate changes are planned for completion prior to restart.
5 i
r i
I I
(...
J
15.b.
Direct glare from overhead lights on both controls and displays made readability dif ficult. (Ca tego rf 2)
RESPONSE
See reply to Comment 4.b.
- 15. c. No lighted exit sign in t'-
control room.
(Category 2)
RESPONSE
No lighted exit sign is needed in the control room. Emergency light-ing is present to prevent the control room from going dark.
1 1
i
General Comments a.
No formal system exists for providing operators feedback about I
suggestions made.
General Comments t
i
RESPONSE
l l
There is a formal system by which operators receive feedback on suggestions made.
If an operator has a problem with any system, ti.en he can file a GPU Problem Report. The report is given to a GPU employee who identifies the cause of the problem and elicits comments potential solutions. The operator who filed the Problem Report l
receives acopy of the final report, which states the problem, proposed solutions, and actions to be taken.
i l
l
{
l l
i l
~ - ~.._
General Comments b.
Sub-cooling instrumentation is not in place and operating.
RESPONSE
Two margin to saturation displays, one for each loop, will be installed by restart.
4
f i
Ge ne ral Comment s In-core thermocouples (tc ) have been connected to the process c.
computer, a monitoring program has been written and the system is in the checkout process. Aa NRC team will review the functionability of the system from a human factors engineering point-o f-view be fore restart.
i
_..---e-ac-