ML20078P122

Human Factors Review of Safety Parameter Display Sys

ML20078P122
Person / Time
Site:	Clinton
Issue date:	10/28/1983
From:	ILLINOIS POWER CO.
To:
Shared Package
ML20078P098	List: ML20078P094 ML20078P110 ML20078P113 ML20078P122 ML20078P126
References
RTR-NUREG-0737, RTR-NUREG-0835, RTR-NUREG-737, RTR-NUREG-835 SLA15, NUDOCS 8311030204
Download: ML20078P122 (10)

Text

.-

4 '

, , . HUMAN FACTORS REVIEW OF THE SAFETY PARAMETER DISPLAY SYSTEM

-l 8311030204 831028 PDR ADDCK 05000461"

. F PDRr

'a

• HUMAN' FACTORS REVIEW OF THE SAFETY PARAMETER DISPLAY' SYSTEM l

l The Safety Parameter Display System (SPDS) design was reviewed '

using the guidance of_NUREG 083.5, Human Factor Acceptance Criteria for the Safety Parameter Display System",.and'NUREG-0700, " Guideline  ;

for Control Room Design. Review . The. evaluation criteria from these two documents were assembled in checklist format in the Emergency Response Program Review Plan, Appendix B. The findings are tabulated in a format relating to sections of NUREG-0835 or NUREG-0700. The review was limited to the. formats in the SPDS' Design Document.

"Certain aspects of the control room such~as lighting are not complete yet, which. prohibited performing an analysis o,n the color, glare, and luminescence on the displays.

The assessment of the parameters selected will be covered by the SPDS Verification &. Validation (V&V) Team when they perform the Parameter Set Validation.

4

, 1 The Review Team was composed of:

t Human Factor Specialist .

Plant Training Staff (SRO certified)

Plant Operating Staff (SRO certified) 1 Plant Technical Staff Computer Specialist Electrical Engineer (specialist in the Plant Process Computer)

The report is broken down into four sections.

A. Significant Concerns Significant concerns involve items that meet the intent but not the letter of the acceptance criteria.

B. Minor Concerns -  !

l.

Minor concerns that meet the intent but not the letter l of the acceptance criteria, and are of lesser significance thanfthe items in A.

C. Recommendations Recommendations to enhance the displays based on a review of the acceptance criteria SLA15 1

r- -i D. Unreviewed Items Checklist items that were not reviewed because they exceeded the scope of the review or the review could not be made until after equipment installations A. .Significant Concerns The most significant items of concern involve data validation and the accessibility of the Area Radiation Monitoring (ARM)/ Process Radiation Monitoring (PRM) display cathode ray tube (CRT). The ARM /PRM which displays plant radioactivity data is on a separate CRT from the SPDS CRT.

This CRT is on a panel just behind the SPDS CRT and is visible to the operator.

1. Acceptance Criteria Data Validation. Real Time Validation.

Display data shall be validated on a real time basis where practicable.

a. Data validation can be accomplished by comparing redundant sensor readings prior to the display of the parameters.

or

b. Using analytical. redundancy among different parameters and using models and equations that have been documented and validated. Operating regimes where the equations used are not valid should be identified and documented.

(NUREG-0835, Section 4.3.1)

Concern '

The automatic real time data validation of SPDS information is provided by the host Display Control System / Performance Monitoring System (DCS/PMS). The methods used do not rely on redundant sensor outputs and make a validity determination based on signal characteristics and system status.

SLA15 1

4

• Section 3.6.1 of the SPDS Design Document addresses data validation. A general outline of the data validation to be performed on SPDS signals from the (DCS/PMS) is provided below:

Analog Signals Hardwa.re checking Offset correction Gain compensation Digital filtering Reasonable Limit Check Data compression Calibration correction Drift testing Conversion to engineering units Digital Signals Input status change Group failure Change of state .

In addition to online data validation, the DCS GRT display , adjacent to the SPDS Display can be used to compare SPDS information to the routine control room displays. This is a manual backup that can be used with minimal inconvenience. Therefore, although the data validation methods of DCS/PMS do not explicitly meet the acceptance criteria of NUREG-0835, the intent of providing real time validation and redundant indication is satisfied.

2. Acceptance Criteria Displayed parameters must be grouped so that all are visible to the operator within one field of view.

, (NUREG-0835, Section 4.4.3.1.b)

Concern Radioactivity Control data is displayed on a separate CRT from the SPDS CRT. CRT #5 on the P680 Nucienet panel is dedicated to SPDS and displays information on:

- Reactivity Control

- Reactor Core Cooling and Heat Removal from the Primary System

- Containment Conditions

- Reactor Coolant System Integrity SLA15 3

_- - . . = .. .

'e l

'Although the radioactivity control data is displayed l separately this will not hamper the operator in assessing the overall plant status because Area and Process Radiation Monitoring display is easily visible

, from the operator's position at the P680 Nuclenet panel. Separation of this data permits uncluttered i display of radioactivity. control data on a simple floor plan mimic. This will enhance the operator's ability to quickly assess the information.

4

3. Acceptance Criteria The design shall contain a primary display format for each mode of plant operation defined by the technical specifications of operation.  :

A common display format composed of the same parameters.nay be used for several modes of plant operation. However, for any one mode, the display must contain'that minimum set of parameter needed to assess the safety status of the plant.

Typical modes of plant operation are:

1. Power Operation

-2. Startup

3. Hot Standby

4. Hot Shutdown l 5. Cold Shutdown

6. Refueling (NUREG-0835, Section 4.4.5.1.a)

Concern The SPDS design does not segregate the specific j parameters needed for each mode of plant operation.

Instead a common display is used for all modes. The selection rationale.for the SPDS parameters are addressed in-the SPDS Safety Analysis Report, and the

, validity.of selection will be documented in the SPDS l Parameter Set Validation Report (PSVR). When the PSVR is available the recommendations in it must be l addressed to ensure the validity of the SPDS p parameters.

B. Minor Concerns b ' Items that were not in strict compliance with the checklist, but of lesser significance are:

SLA15 4

. . _ . _ . , _ . _ _ _ ~ . . . - . _ _ . _ _ . . .- ~ _ _ _ _ _ . _ . .

o

1. Acceptance Criteria Color. The use of color to help identify and differentiate between elements of the display and indicate a change in functional or operating status of a plant parameter should conform to guidelines in NUREG-0700.

(NUREG-0835, Section 3.3.4.1)

Once colors are. assigned a specific use-or meaning, no other color should be used for the same purpose.

(NUREG-0700, Section-6.7.2.7. (2))

Yellow /Amb,er - hazard, potentially unsafe, caution, attention required, marginal parameter value exists.

(NUREG-0700, Section 6.7.2.7.(3))

Concern The bar graphs on the SPDS displays and EOP displays are yellow for normal plant parameter values. The yellow bar turns to red when a setpoint is exceeded.

Yellow bar graph values are standard throughout the DCS/PMS displays.

On.the ARM /PRM displays, yellow indicates a trend alarm alerting the operator of the potential problem.

The use of yellow is'not used consistently between the

-ARM /PRM displays and the SPDS display. However, the physical separation of the ARM /PRM and #5 CRT will eliminate operator confusion since the use of colors is consistent within each display.

2. Acceptance Criteria If symbols and mimics are used they must conform with the guideline of NUREG-0700.

(NUREG-0835, Section 3.3.4.2).

a. Flow paths should be color coded. Colors should be selected in conformance with Guideline 6.5.1.6.

.(NUREG-0700, Section 6.6.6.4.a.(1))

[ b. Mimic Colors should be discriminably different r from each other.

p (NUREG-0700, Section 6.6.6.4.a.(2))

L

{.

- SLA15 5 j

s _ _ _ - - .

. . ', i

c. Mimic line depicting flow of the same contents (e.g. steam, water, electricity) should be colored  ;

the same throughout the control room. l (NUREG-0700, Section 6.6.6.4.a.(4)) j

d. No more than 4 mimic lines of the same color i should run in parallel if the operator must quickly identify anyone of the lines. l (NUREG-0700,' Section 6.6.6.4.a.(5))

Concern The SPDS display has no mimics and therefore this item does not apply. E0P mimics are all blue regardless of system.or content. This assists the operator in rapidly distinguishing the static elements of the CRT display form the dynamic information.

3. Acceptance Criteria Flow directions should be clearly indicated by distinctive arrowheads.

(NUREG-0700, Section 6.6.6.4.b.(3))

Concern E0P displays IS Reactor Core Cooling Display and 4A Reactor Recire Flow do not have direction of flow on the mimic. However the mimics are simple and include centrifugal pump symbols which make the flow direction readily obvious. The addition of flow arrows would unnecessarily clutter these displays.

4. Acceptance Criteria The design must conform to display guidelines in NUREG-0700, Section 6.7.2.

(NUREG-0835, Section 4.4.la)

Use of Error Messages - Whenever an operator error or invalid input is detected, an error message should be displayed.

(NUREG-0700, Section 6.7.2.6.f.)

SLA15 6

[* .

' Concern When an invalid inputLis detected by the computer the parameter changes from its normal color of blue or green to white. This scheme prevents cluttering the display with error messages. It also eliminates the possibility of an operator erroneously ignoring the wrong indication.after reading a separate error message since the color. change draws the operators direct attention to the displayed value. Thus the color change is in itself a pictorial " error message".

C. Recommendations The following recommendations are made.to enhance the SPDS.

and EOP displays. While the displays were found to meet or

. exceed the acceptance criteria, the following improvements are recommended based on the review of the acceptance criteria.

1. If setpoints are used for display changes and overlays, they must be established using appropriate technical considerations.

(NUREG-0835, Section 3.3.4.4)

The SPDS 5S display utilizes bar graphs that indicate

.. _the percent of instrument range.' The bar is normally

-yellow, and it turns to red when a setpoint is reached.. The following par 'ters do not have setpoints assigned to the:-

- Source Range Monitor ,

t,

- Reactor Steam Flow

- Reactor Feed Flow

- Total Core Flow

- Drywell Floor Drain Sump Flow

- Containment Pressure Setpoints should be assigned as soon as the technical data is available.

y9 r 8

SLA15 7

n

,!_...I 6 f --

For two parameters, Average Power Range Meter (APRM)

_ .- and Reactor Recire Flow, the set?cint is beyond the normal allowed maximum value. Tae-alarm and the color shift of the bar from yellow to red occurs at the reactor protection setpoint. In_these cases the alert to the operator is after the protective action has occurred.

The.b~ar graph dis' play change from yellow to red should occur at an-alarm-point before a reactor protection setpoint is reached, such as the APRM rod block setpoint.

The SPDS 5S display bar graphs are indicative of 0 to 100% of meter. range. This is not. indicated under the

- bar. This item although not clear by observing the display should be taught to the operators during SPDS-training.

The trend information to the right of the bar graphs on the SPDS 5S display is not labeled at the top of the display. The Rate of Change is in units per

. minute.- he units are indicated to -the right of the digital readout. .The trend information may be confusing, but this item too should be taught during SPDS training. The trend information is uniformly displayed as units per minute on the DCS/PMS.

. 2. Display formats must be designed so that specific elements in the display correspond directly and unambiguously with-each parameter.

(NUREG-0835,-Section 3.2.s SPDS Checklist Item 3.2.b)

On'the SPDS SS Display'the Containment Isolation Groups 1 through 11- are on one line. The letters I -

(for inboard valves) and 0 (for outboard valves) follow each group; number.

i.e. CNMT ISOL 1 10 2 IO 3 10 ....... i

~The display would be easier to read if the group l position indication.IO were below each group number i.e'. CNMT ISOL l- 2 3 .......

I 10 10 10 )

ThisLchange is recommended.

4 A F

SLA15 8

, . - - , --.w---,ry e-r.vrr b, ,w,. ,<,,,my. -,.n,---e ov--+m-,

' g i] f f '

3. A time history display of safety parameters for 30 minutes immediately preceeding carrent.real time is required. Availability of Lime history data displays on either the primary SPDS display format or on a secondary SPDS display format is acceptable.

(NUREG-0835, Section 3.2: SPDS Checklist Item 3.2.f)

Time history is not available on SPDS or E0P displays ~

for 30 minutes immediately preceeding current real time, however, it can be called up on a separate PMS/DCS format. Although the time history data displays are not part of the SPDS, the capability to retrieve this data exists.

.D. Unreviewed Items The items that were not reviewed as part of the checklist

~ I because inadequate information was available include...

]

1. The SPDS display design must assist operators to i rapidly defeat an abnormal condition and assist in initiating diagnosis to localize the source of ,

abnormality at the function or system level. l (NUREG-0835, Section 3.1; SPDS Checklist Item 3.1.d) l The SPDS Display must contain in a single primary {

display format the minimum set of parameters needed to assess the safety status of the plant for each mode of  !

plant operation.

(NUREG-0835, Section 3.2: SPDS Checklist Item 3.2.a)

The selection of parameters necessary to determine an abnormal condition was not analyzed by the Human Factors Review Team. This task is being handled by the SPDS V&V Team and documented in its SPDS Parameter Set Validation Report.

2. Color and lighting.

(NUREG-0835, Section 3.3.4.1; SPDS Checklist item 3.3.4.1.a) and (NUREG-0700 Section 6.5.1.6.(3) and 6.7.2.1).

Permanent lighting has not been installed. The effect of ambient lighting on the color of the CRT displays can not be determined.

3. Display Formal Section (NUREG-0835, Section 4.4.5.2) and Software Security (NUREG-0700, Section 6.7.1.1)

Software security procedures have not yet been  !

written.

SLA15~ 9 '

- .,_. _.._-, _ _ ; ,_ . . . . _ . . _ _ . . _ , _ _ . - , . - , . _ , , _ , - _ . . . . _ . , - . _ , , , _ _ _ _ _ .