ML19347F183

Control Room Design Review/Audit Rept

ML19347F183
Person / Time
Site:	Zimmer
Issue date:	04/09/1981
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML19347F181	List: ML19347F180 ML19347F183
References
NUDOCS 8105150425
Download: ML19347F183 (27)

Text

.

l (3

HUMA* FACTORS ENGINEERING CONTROL ROOM DESIGN REVIEW / AUDIT REPORT W. H. Zimmer CINCINNATI GAS a ELECTRIC COMPANY A human factors engineering preliminary design review of the W. H. Zimmer control room was performed at the siteduring the week of February 23-27, 1951. This design review was carried out by a team from the Human Factors Er;ineering Branch, Division of Human Factors Safety. This report was prepared on the basis of the HFEB's review of the applicant's Preliminary Design Assessment and the human factors engineering preliminary design review performed at the site. Thereview team was assisted by human factors consultants from Biotechnology, Inc. (Falls Church, Virginia) and from Lawrence Livermore National Laboratory (University of California, Livermore, California).

Observed human factor design deficiencies were given a priority rating or one to three, (high, moderate, low), based on the increased potential for operator error.

The following sections are numbered to conform to the guidelines of the draft version of NUREG-0700 and sumarize the team's observations of the control room design and layout and of the control room operator interfaces with that environment.

6.1 CONTROL ROOM WORKSPACE CATEGORY 1.

A seated operator has difficulty reading the benchboard displays.

Example: RBM and APRM indicators are difficult to read while seated.

3 2.

Annunciators and status displays are difficult to reach for maintenance.

Operators cannot change bulbs without stand-ing on the benchboard.

1 3.

Annunciator bulbs are difficult to remov6 without a special " rubber socket" tooi, @ich is sometimes ineffective and can melt around the bulb.

3 4.

Reportedly, there have been some fires associated with short circuits occurring during annunciator bulb replacenent.

1 5.

Bulb replacenent of some Fisher controllers is reported to throw calibration out of tolerance.

1 6.

None of the annunciator panel windows are angled forward for better readability.

The bezels around each window are angled to 8105150/85-Prevent glare from ceiling light sources, l

giving the impression that the win 6)w is angled.

3

a:

6.1 CONTROL ROOM k'ORKSPACE (cont.)

CATECORY 7.

On all annunciator panels, the top two rows of annunciator windows are more than 86" above the floor.

3 8.

There are several. indicators (in addition to the annunciators) which' are more than 7 feet above the floor.

These are readable by an average male operator, but not by all of the 5th to 95th percentile work force.

Exampigs:

synchroscope, system status board, radiation monitor panel recorders.

3 9.

Some of the controls and indicators on PM08 and PM07 are located too close to the floor for easy observation or actuation.

These also might be inadvertently actuated.

I

10. J-handle switches are located close to the apron of the benchboards and are subject to accidental actuation by operators leaning against panels.

Example:

feedwater controllers on PM03J.

1

11. Telephones are not consistently color-coded.

3

12. Telephones can be easily knocked off their stands by operators standing at the panels..

2

13. Incoming telephone calls to the plant are

.1 transferred to the control room at night.

14. There are no procedures for communications control during an emergency.

1

.A

15. There is no NRC operations center phone (NRC hotline) in the control room.

1

16. There are no sound-powered communications at the MSIV-LCS back panel.-

1

17. David Clark H5020 sound powered phones are available, but are difficult for the operator to use while performing work tasks because they require the operator to use one hand to operate them.

The operators report that they also slip off easily.

3 s

V 6.1 CONTROL ROOM WORKSPACE (cont.)

CATECORY

18. There are no paging system loud-speakers at 2

the remote shutdown panels.

19. Adequacy of communications while using fat e mask emergency breathi6g equipment could n t

.I be determined.

20. The procedures books are not easily accessible.

2 4

4 e

O -

i l

1 i

6.2 WORKPLACE ENVIRONMENT CATECORY 1.

The control room HVAC system is not in'its final configuration.

Climate control should be checked when complete and normal heat sources are operating.

Control room air temperature indicators read 70 to 80 degrees (measured at the exhaust ducts).

Temperature appeared comfortable, but the operators said that the control room is often tco cold.

1 2.

Filtering systems, including those needed to satisfy standard HVAC requirements, are not presently installed and could not be evaluated.

1-3.

Ambient illumination is well below recommended levels (see Appendix B).

1 4.

Illumination levels vary excessively throughout the control room (see Appendix B).

1 5.

Illumination levels are not controllable in areas of the control room where close work must be done.

1 6.

Portable lights are not provided in work spaces where supplementary lighting is required (for repair work, etc.).

1 7.

The emergency backup lighting system does not provide the recommended illumination levels (see Chart 1, Appendix B).

1 8.

Emergency lighting is not provided in the immediate area of the remote shutdown panels.

1 9.

Periodic illumination surveys are not conducted.

3

10. Integral instrument lighting of displays, controls, printers, and plotters has not been used to compensate for inadequate lighting j

conditions.

3

]

11. There is excessive glare on the labels throughout the control room.

I l

i 6.2 WORKPLACE ENVIRONMENT (cont. )

CATICORY

12. The red statu s panel on PM03J has a luminance ratio (LR) of 25:1 to the adjacent area (20:1 recom= ended max).

2 i

13. Scram group system.A & B indicator lights have a LR of 37:1 to the' adjacent area i

(20:1 recommended max).

2

14. The white status pan,el on PM02J has a LR of 420:1 to the adjacent area (20:1 recommended max).

2

15. The "C" annunciator audio signal (measured at the horn) was 8 db below the~ average ambient noise level of the surrounding area and was inaudible to control room personnel.

I I

16. The " Reset Chime" vas measured to be only approximattly 3 db above the average ambient noise level.

2

17. The computer system audible alarm has a variable level control which was turned down during the audit.

When the intensity of this alarm is adjusted down, it is detectable only in the immediate vicinity of the computer console as a.

60 cycle /second hum.

1

18. The #2 paging system was only approximately 5 db above the average ambient noise level.

2 (should be at least 10 db).

19. It was extremely difficult to discriminate messages over both paging systems.

This was confirmed during the procedures,4 valkthrough.

2

20. The reverberation in the control room appeared to be rather high, although no formal measurements were made.

This was especially noticable when m.any people were working in the room.

~

2 21.There is no lamp test capability and no use made of dual filament bulbs for failure indication (except for the annunciators).

1

..h

6.2 WORKPLACE ENVIRONMENT (cont.)

CATECORY

22. The digital indicators for the process computer located on the control panels cannot be accessed for maintenance from inside the control room.

3

23. Tag-outs obscure labels, legends,, indicator lights, and annunicator windows.

I

24. Tag-outs are not securely attached to some of l

the vertical push-buttons.

1 4

e 9

'o 8

s 6.3 ANNUNCIATORS AND ALARMS CATEGORY 1.

While most visual annunciators are located above their related controls and displays, there are some exceptions.

2 2.

Some related annunciator' tiles are located on different panels.

2 3.

Annunciator window covers are not keyed or matrix-coded to prevent accidental interchange when they are removed for bulb replacement.

1 4.

The grid coordinate system is not labeled on the annunciator panels.

This requires the operator to count the row and position-in-row.

Error potential is increased since not all annunciator panels have the sta,dard 4x8 3

matrix.

5.

Some annunciator tiles are constantly illuminar.ed during normal plant operation.

2 6.

There are no formal procedural requirements for testing and inspection of visual annunciators.

(Reportedly, this is an informal part of the shift change procedure.)

1 7.

No provisions have been made to permit the operator to determine which of several alarms initiated a sequence (no "first-out" panel or indicator).

1' 8.

There is presently ao system of prioritization of visual annunciators according to severity.

(Reportedly, this is beir.g studied, and will involve both color-coding and location-coding.)

1

~

9.

Annunciator / alarm response :ontrols are inconsistently located from panel to panel, and in several instances have arrangements which differ from the control room convention.

EL spies: Controls on PM07J and PM08J have differe.

arrangements.

3

, j l

i

6.3 ANNUNCIATORS AND ALARMS (cont.)

CATEGORY

10. On many annunciator windows, the characters are too small (less than 3/8") for easy reading at the required distances.

2

11. Diffetent print styles are sometimes used on adjacent annunciator windows.

2

12. On many annunciator windows, messages are crowded with inadequate spacing between characters and between lines, making reading difficult.

2

13. Annunciator messages are frequently too long and wordy, contributing to message crowding.

Some messages are non-specific and ambiguous.

2

14. Many annunciator windows have temporary titles printed on tape.

These are especially difficult to read when the window is illuminated.

I

15. Many abbreviations are used, but abbreviations are not consistent from one window to the next.

Some contain misspelled abbreviations.

2

16. While most annunciators flash at approximately 3 flashes per second, some flash at rate of 1 or 2 flashes per second.

(Reportedly, some new flashers are being tested.)

. Example:

H13-P601 annunciator panel.

3

17. All annunciator windows presently:

o flash red-white to announce, o are steady red after acknowledgment, and o are steady green when cleared.

Red color for all ann'2nciator tile windo'ws is poor usage.

There also are significant differences in shading from tile to tile.

2

18. No annunciator panel localization is provided

~

by the auditory alert horns or clear signal chimes.

The operator must locate alarm indications by scanning visual annunciators.

2 um-

.-- - - ~

.qe

6.3 ANNUNCIATORS AND ALARMS (cont.)

CATECORY

19. Auditory signals are not differentiable between critical and non-critical alarms, or between warnings, cautions, or alerts.

2

20. There is no distinctive, audio evacuation signal availablu.

Presently, an evacuation announcement is made over the P.A, system by the Shift Supervisor.

1 e

e 9

O _

CATECORY 6.4 CONTROLS 1.

Some bar switches on the remote shutdown panels have to be held actuated for up to two minutes.

This is reported to be very dif ficult and 2

fatiguing.

2.

Bar switches cannot be r'eadily operated while wearing gloves.

These switches are used on the remote shutdown panels, as well as several other locations where personnel may be required to wear 2

emergency protective clothing, including gloves.

3.

Rod control push buttons require excessive pressure to operate which produces fatigue in the operator's hand af ter several minutes of operation.

This problem is amplified when the operator 2

is seated.

4.

Pushbuttons on the Bailey and General Electric controllers are too small to operate comfortably.

These pushbuttons also are flush with the 2

controller surface.

5.

The pushbuttons on the remote shutdown panel do not have activation feedback such as an audible click or the activation of an indicator 2

li ght.

6.

The ADS Manual Initiation ARM / DISARM switch on the remote shutdown panel selector position 2

indication is barely visible.

7.

Two J-handles on the remote shutdown panel have poorly visible selection indicators.

3 (red arrow on dark background).

8.

Some switch handles cover control labels.

Example:

PM03J.

3 9.

Both of two transfer switches must be activated to take over control at the remote shutdown panel.

2 This should be indicated on the panel.

10. No consistent shape-coding color-coding, or 3

size-coding of controls is used.

,;m-

s 6.4 CONTROLS (cont.)

eg73ge77 -

i

11. Controls located side by side for the same function have differently shaped handels.

3

12. Rod Control push buttons have caps which are clear, yellow, and black,.but there is no functional reason for the color differentiation.

3

13. Some controls that are identical in size, shape, and markings are momentary contact, 3

while others are continuous contact.

14. Throttle valve switches are of the same shape, size, and color as ordinary valve switches.

There are generally only tape tags to indicate that the operator must continuously hold these throttle valve switches to open the valve to the throttled position.

3

15. Panel P603 has a mode switch key that can be broken off when the reactor control rod selection matrix panel is lifted.

3

16. Control movements for on/off actuation on panels PM07J and PM08J violate plant 2

convention.

17. The T-handle controls for Feedwater Inlet Shut Off valves B21-F065B and F065A are i

located on the bench board and the vertical display panel.

In~ addition, these two valves are located about 15 feet from their mimic location on 3

feedwater panel PM03J.

18. A " moving scale - fixed index" rotary control knob was found in the control room that did not have an index pointer.

4 1

19. The suppression pool selector on PM07J is q'uite low on the panel and the "both" position cannot be read under the handle.

3

20. The " purge" position on the post-LOCA selector on PM07J is the "both" position but is not indicated.

2 l - - - - - - - - - - -

}

s 6.5 VISUAL DISPLAYS CATEC:?Y 1.

Dirt and damage on the plastic cover of a remote shutdown panel meter obscures the scale.

2 2.

Some displays on the remote shutdown panel have glare that causes degradation of readability.

2 3.

The general systems status board is located 8-11 feet above the floor and does not have a function label.

3 4.

Some display information required during normal operation is currently located on back panels, while some unnecessary displays are located in the main control area.

2

5. 'The placement of the meters on the remote shutdown panel introduces parallax error.

2 6.

The Process Radiation Monitor inverter had one missing indicator light and one light was burned out.

1

7. Normal operating limits are not generally marked with permanent markings on indicator scales.

3 8.

No operating limit markings or trip set points were present on displays on the remote shutdown panel.

3 9.

Meter failure is n'ot always positively indicated.

I

10. A white indicator light i= f t:ed for a trip condition on the remote shutdown panel.

Plant convention is yellow / amber for trip, and white for a general alarm.

3

11. Remote shutdown panels laci any mimics, demarcation lines, or functional group labeling to enhance recognition and identification.

3 e

12.

1 6.5 VISUAL DISPLAYS (cont.)

,CA_._u_ ;Y sa

12. Groups of meters in horizontal strings of 5 or more on FM07J are not broken up into smaller 3

groups.

13. Some meter peinters move right to left, violating plant conventio'n, and causing operator confusion.

Example:

Main Turbine Vacuum on PM02J.

2

14. The set points of a few meters are too precise for the meter scale.

Example:

Off Cas C.C. Diff. Process Controller on PM03J.

3

15. Bailey controllers and some Fisher controllers have scales that do not indicate units.

Example:

Dump Valve Manual Control 2

Indicator.,

16. Some meters give information that must be converted to different units before use.

2 6.6 PANEL LAYOUT 1.

Reactor temperature indications are 10 feet from reactor pressure indications and reactor level indications.

2 i

4 f

. 4

6.7 CONTROL-DISPLAY INTEGRATION (cont.)

CATECORY 9.

Controls / displays on the remote shutdown panels were not grouped by functional use.

3

10. Demarcation of associated controls and displays was not used sufficiently.

2 l'..

The purge selectors on PM07J are inconsistent in their use of "both" red light indicators relative to the actual position of the selector.

3 b

e g.--

l 6.7 CONTROL-DISPLAY INTEGRATION CATECORY 1.

The RER FLOW A display is on the upper right side of the remote shutdown panel.

The RHR controls are on lower left part of the 3

panel.

2.

Condensate storage tank' valves E22-F011 and E22-F010 have reversed control / display 3

relationships.

3.

Swirch E12-F014A affects the indication of Switch'E12-F105A/IWS073A, but they are 3

separated by other controls.

4.

A status panel horn bypass switch on PM03J controls the alarm for the status panel on 3

H13-P603.

5.

Controls and displays for the containment isolation system are physically separated.

They presently exist on three panels -- H13-P632, H13-P601, and PM07J.

(Plans now exist to correct this dif ficulty by arranging indication and isolation on H13-P601 with secondary valves on H13-632.

In addition, new mimic diagrams are to be constructed.)

1 6.

The arrangement of controls and displays does not always follow the lef t to right convention.

Example; PM08J, Service Water Pump Motor and IB, IA, IC, ID.

3 7.

The Condensate Discharge Pressure control operates two Heat Exchanger Shell Level and Pressure controllers indications which are 4

separated by approximately twelve feet.,4 It is difficult to read both controller indications from the location of the Condensate Discharge Pressure controller.

2 8.

Controls and displays on PM16J that are grouped together are not always functionally related.

The ammeter switch and load control switch on PM16J should be located with the other electrical distribution controls / displays.

3

CATEGCRY 6.8 LABELS AND LOCATION AIDS 2

1, No panel designation labeling is provided.

2.

The location of labels on some panels is not 2

consistent.

3.

There are no labels on t'he outsides of either 2

remote shutdown panel.

4.

There are no warning labels on the fronts of the remote shutdown panel doors to warn that 2

the doors are alarmed.

5.

There are no indications on the bar switches on the remote shutdown panels to indicate which switches latch or which make contact only, when held in position.

3_

6.

There are missing labels on the Indicator Transfer switches on the remote shutdown panel.

I 7.

System tabels for individual systems are located between displays and controls on P601 and P602.

The labels should be above the displays.

2 8.

Labels for the alarm lights on the remote shutdown panel should be located below the lights (rather than above) and closer than 2

they are presently.

Temporary tape t.imic labels do not adhere well I

to the benchboard.

10. The lettering has rubbed off of the Bailey Feedwater level controller because the painted letters were not covered by plasgic.

2 j

11. The label on the Steam Line Inboard Drain <

switch on P602 is handwritten.

1

12. Label content on the remote shutdown panel is not clear and uses inconsistent terminology (e.g. " Suppression Chamber" on one.,

"Supp Chbr" on another).

2

13. The labels for the Reactor Water Cleanup j

System Conductivity recorders are inconsistent since the outlet is on the left and inlet on the right.

This is in conflict with the mimic flow indication below it.

1.

6.8 LABELS AND LOC /. TION AIDS (cont.)

CATEGORY

14. Label abbreviations are not standardized and some label abbreviations are used for different mear.ings at different locations.

2

15. Saveral adjacent bypass channel selectors have 3

inconsistent labeling

16. Some controls are identified by both G.E. and 2

S&L numbers.

17. A label was found that read " Turning Gear 2

Engaged" rather than " Turbine Zero Speed".

18. Wording on labels is not always brief and 2-concise.

19. Some labels do not have at least one stroke 2

width between characters.

20. Color-coding of labels is used inconsistently 2

where any attempt is made to use it at all.

21. Bailey controllers have color-coding that is inconsistent with the overall plant color 2

scheme.

22. The color scheme used on the radiation monitoring panel does not appear to be consistent with the overall plant color scheme.

2 l

23. All Division 1 labels shculd be yellow to be consistent with the control room color scheme.

2

24. Both " drift" lights and " full-out" lights on 2

the Rod Display Indication panel are red.

25. The RHR Shutdown Cooling Injection Valve #

(E12-F053B) has a yellow label (meaning Division 1) but has a tape label above I

(in blue) which reads Division 2.

26. Mimics do not have primary and secondary paths indicated.

I

27. Not all mimics indicate direction of flow and those that do are often confusing.

Examples: Off Gas System mimic, Feedwater 2

System mimic. -

.. - =. _.

_- - =

r 1

t-i

+

l 6.8 IABELS AND LOCATION AIDS (cont.)

CATECORY t

i

28. Color-coding of mimics is inconsistent and incomplete.

2

{

1.).

I

?

[

l 2

r j

i i

h I

i i

f e

I 1

f i

k' i

1 i

4 1

I f

3 i

e f

l s

I F

t f

i I

I t

[

• 6 u

t J

s i

l l

6 r

I i

i I

e i

i.

i l

. 1 l

_... _.., _ _.. _.. _.. _ _. - - -. _ _ _. ~, _ -.... _ -....,.

CATECORY 6.9 PROCESS COMPUTER 1.

The system has very limited output capability, and is awkward for any general purpose 3

operator use.

2.

All process parameter addresses must be referenced in an index list kept near the console.

These points are not cross-indexed by name, 2

system / subsystem, or functional group.

3.

The process computer in the control room lacks 3

graphic trending capability.

4.

Trending capability is limited to four operator-selectable parameters on two strip-chart recorders which do not provide parameter identification or readout units

~

3 capability.

5.

The six analog indicators driven by the process computer do not have any parameter 2

identification.

6.

The computer accessable displays on the control boards do not have any parameter identification 2

capability.

7.

The speed of the alarm logger / printer is limited to 30 characters /second.

2 8.

The printouts are difficult to read.

The printing is too light and lines are too 2

closely spaced.

9.

There is no spacing between some display messages on the CRT.

j Example:

RH:MM:SS 062232 2

10. The lettering is too small on both the 2

pushbuttons and the function map on the conscle.

11. The alarm acknowledge and the action buttons are next to each other and have no coding to 2

distinguish between them.

12. Abbreviations used are not always consistent with the master list.

2

! \\

CATECORY 6.10 DATA RECORDING AND RETRIEVAL 1.

The twenty-four point attip chart data recorder has too high an information density to separate 2

individual parameters.

2.

Recorders on the Radiati,on Monitor panels have 2

no scale parameter names.

3.

Calibration stickers obstruct the view of some 1

recorder faces.

Many recorder charts do not have tine 4.

references.

They do not give sufficient information to 2

ensure correct interpretation.

5.

Some strip chart recorders indicate at sidscale 1

when failure occurs.

6.

A strip chart recorder was found that had paper with a different printed scale than the scale I

on the recorder.

t

.d l

r I

I l

. ~

E e

en e

O APPENDIX A 4

r s

PANEL IDENTIFICATION NU.4BER TITLE H13 - P601 REACTOR CORE C00LINC PANEL R13 - P602 REACTOR WATER CLEANUP AND RECIRCULATION PANEL H13 - P603 REACTOR CONTROL PANEL PM0lJ CENERATOR AND STATION AUXILIARY PM02J TURBINE-CONDENSOR AND AUXILIARIES EM03J FEEDWATER HEATER AND AUXILIARIES PM04J FIRE PROTECTION PANEL PM07J HVAC AND STANDBY CAS TREATMENT PM08J STATION SERVICE PANEL PM16J ELECTRICAL DISTRIBUTION PANEL C91 - P604 COMPUTER / PRINTER DESK ID21 - P600 RADIATION MONITOR H13 - P600 RADIATION MONITOR R13 - P632 CONTAINMENT ISOLATION IPL67JA REMOTE SHUTDOWN IPL67JB REMOTE SHUTDOWN C91-P606 COMPUTER CONSOLE / PRINTER DESK e

O 9

22 -

O

-,m-

a w.

m, w....,

a e.

5 l

I a

t I

)

U

)

)'.

G APPENDIX B

.J M

9 9

B a a 2

---e w.-,

CHART 1 o

LIGHTING SURVEY Incident (footeandles)

Normal Normal Normal DC Emerg.

AC + DC Average Benchboard Vertical Ave Emerg Ave R13-P601 19.6 23.0

, 11.8 1.4 13.0 H13-P601 25.7 30.4 12.5 H13-P602 22.1 23.0 11.7 H13-P603 23.8 22.6 12.6 1.8 9.9 PM03J 27.1 27.7 13.3 PM02J 21.9 24.1 13.3 PM02J 25.2 27.7 13.6 2.6 14.4 PM01J 32.2 35.2 14.7 11.6 PM07J 12.2 PM07J 12.1 PM08J 9.0 0

0 PM08J 4.6

.19 2.2 H13-P655 3.8

.19 2.2 T49-P865

.71 8.3 Near T49-P865 14.0 3.4 PM18J 13.2 PM09J 2.7 17.1 Center 1 44.8 2.9 16.3 Center 2 45.7 Interior 1 5.7 Interior 2 14.3 Interior 3 10.8 65.8

.6 39.4 PH10J 107.0 58.5

.25 26.5 H13-P604 Reflected (Footcandles)

Reflectance (%)

R LR H13-P601 8.9 39%

e H13-P603 7.3 32 PM02J 7.6 27 PM07J 3.8 32 PM08J 4.0 33~

PM09J 4.9 37 Cancer 1 7.7 17 Center 2 5.6 12 l

~

j

' V

+

CHART 2 LIGHTING LEVELS (foot candles)_

Recommended Actual Work Area or Task 50 25 Console Surface 50 13 Dials Gauges

' 50 13 50 13 Meters 50 13 Scales Panels (ftont) 50 23 Panels (rear) 30 10 30 14-107 Passage ways Reading (pen, small print) 70 40 Repair work (panel back) 50-100 3.9-24.6 70 37 Writing and Data Recording e

b i

9

. i b

s s

i

)

APPENDIX C 1

9

f i

i l

s NOISE MEASUREMENTS (db)

Facing Back To Location Panels Panels Obvious Noise Source

5 '. j.,

'#~~~~~

A 65 64 66 65 65.5 ceiling

- D'"'

B 63.5 64

+4-C 63 64 D

62.5 63 E

67 63.5 67.5 64 65 ceiling,68 drilling, 64.5 ceiling 74 alarm (H130-P601)

F 64 63.5 G

55 56 H

58 59 I

64 63.5 63.5 63.5 66 J

66 65 65 K

62 L

62 Left Column: 2/24 - 9:00 AM - 23 + people in CR Right Column: 2/25 - 1:00 PM - 7 people in CR i

Annunciators A - 76 B - 70 C - 56.5 - had to get next to horn to measure over ambient noise:.

B&K sound level meter type 2205 calibrated 2/19/81 e

O e

. %w.

-