ML20080E071

Evaluations of Detailed Control Room Design Reviews for St Lucie Units 1 & 2 & Turkey Point Units 3 & 4, Technical Evaluation Rept

ML20080E071
Person / Time
Site:	Saint Lucie, Turkey Point, 05000000
Issue date:	01/13/1984
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML17346A197	List: ML20080E071
References
CON-NRC-03-82-096, CON-NRC-3-82-96 SAI-186-351-68, NUDOCS 8402090330
Download: ML20080E071 (23)

Text

. .

ENCLOSURE A 4

SAI-186-351-68 EVALUATIONS OF DETAILED CONTROL ROOM DESIGN REVIEWS FOR ST. LUCIE 1, ST. LUCIE 2, AND TURKEY POINT 3 & 4 Technical Evaluation Report January 13, 1984 Preoared for: -

U.S. Nuclear Regugory Comission Washington, D.C.

Contract NRC-03-82-096

~

XfCopy HaTBeeis Se'nt to PDR

~

N 9; % m w 3s o f

/1/ -

FOREWORD This Technical Evaluation Report (TER) was prepared by Science Applications, Inc. (SAI) under Contract NRC-03-82-096, Technical Assistance ,

In Support of NRC Licensing Actions: Program III. The enluation was performed in support of the Division of Human Factors Safety, Human Factors Engineering Branch (HFEB). SAI previously evaluated Florida Power and Light Company's program plan for conducting Detailed Control Room Design Reviews (DCRDRs) at the St. Lucie and Turkey Point plants. An evaluation report

. (Reference 5) was submitted to HFEB for use in preparing its own comments on the program plan (Reference 4) for ultimate transmittal to the licensee.

No in-progress audits have been conducted at these plants between evalua-tions of the program plan and the evaluation of the summary reports as described herein. .

The SAI evaluation team held extensive discussions with.the HFEB staff in the course of the evatuations of the Summary Reports and prepara' tion of this TER.

9 8

esumum 9

, ,% _.,_.,__,w . -- _ _ _ _ . < . _ _ - _ _ _ _ _ . _ , _ _ -_ _

TABLE OF CONTENTS EVALUATIONS OF DETAILED CONTROL ROOM DESIGN REVIEWS FOR ST. LUCIE 1. ST. LUCIE 2, AND TURKEY POINT 3 & 4 Section Page Background . . . . . . . . . . . . . . . . . . . . . . . . 1 Review Phase . . . . . . . ., . . . . . . . . . . . . . . . 4 Assessment and Imple. mentation Phase. . . . . . . . . . . 10

1. HED Assessment Methodology. . . . . . . . . . . . .

10 -

2. Selection of Design improyements. . . . . . . . . 11

3. Proposed Schedules for Implementation . . . . . . 13

4. Justification for HEDs with Safety Significance that are to be Left Uncorr449ed or Partially Corrected . . . . . . . .............13 Conclusion . . . . . . . . . . . . . . . . . . . . . . . 15 Append i x A - HED Pro bl ems . . . . . . . . . . . . . . . . 17 l References . . . . . . . . . . . . . . . . . . . . . . . 20 i

l '

I 9

4

- - , , - - . - . - , , , . , , , , . , , . --,,----r

l .

\'

EVALUATIONS OF '

DETAILED CONTROL ROOM DESIGN REVIEWS FOR ST. LUCIE 1, ST. LUCIE 2, AND TURKEY POINT 3 AND 4 l

This report documents the Science Applications, Inc. (SAI) evaluations Of three summary reports of Detailed Contrcl Room Design Reviews (DCRDRs)

. submitted to the Nuclear Regulatory Commission (NRC) on November 1,1983. by Florida Power and Light Company (FP&L) for St. Lucie 1 (Reference 1), St.

i Lucie 2 (Reference 2) and Turkey Point 3 and 4 (Reference 3). These DCRDRs were conducted by FP&L in accordance with common program plans (Reference 4). FP&L submitted Program Plans for St. Lucie 1, St. Lucie 2, and Turkey Point 3 and 4 (combined) by letters dated May 14,1983, June 30,1983, and May 20,1983, respectively. SAI also evaluated the FP&L program plans (Reference 5) for the NRC staff. As of January 12, the NRC sta ff comments had not been . transmitted to the licensee. Therefore the licensee did not have the benefit of these comments in the course of their reviews.

t Results of the SAI eva'luations. follow a brtef ov'erview of the back-ground , leading up to the DCRDR summary reports.

BACKGROUND Licensees and applicants for operati.ng licenses are required to conduct a Detailed Control Room Design review (DCRDR). The objective is to

... improve the ability of nuclear power plant control rcom operators to prevent accidents or cope with accidents if they occur by improving the information provided to them" -(NUREG-0660, Item I.D.1). The need to cond;ct a DCRDR was confirmed in NUREG-0737 ar.d in Supplement 1 to NUREG-0737.

DCRDR requirements in Supplement 1 to NUREG-0737 replaced those in earlier documents. Supplement 1 to NUREG-0737 requires each applicant or licensee to conduct their DCRDR on a schedule negotiated with the NRC. Guidelines -

for conducting a DCRDR are provided in NUREG-0700 while the assessment processes for NRC are contained in NUREG-0801. (The NUREG documents. cited are listed as References 7-11).

- , . . , , - - - - - ,,,----,,,,,,.-------,.,--.,---,-,-,,-_,,--n.--,-r - _. -.-,,--,-w , , , - - , ,,y ----,-.

t A DCRDR is to be conducted according to the licensee's own program plan (which must be submitted to the NRC); acco'rding to NUREG-0700 it should include fou r phases: (1) planning, (2) review, (3) assessment, and -

(4) reporting. The product of the last phase is a summary report which must include an outline of proposed control room changes, their proposed sched-ules for implementation, and summary justification for human engineering discrepancies with safety significance to be left uncorrected or partially corrected. Upon receipt of the licensee's summary report and prior to implementation of proposed changes, the NRC must prepare a Safety Evaluation Report (SER) indicating the acceptabil'ity of the DCRDR (not just the summary report). The NRC's evaluation encompasses all documentation as well as briefings, discussions, and audits if any were conducted.

The purpose of this Technical Evaluation Report is to assist the NRC in the technical evaluation process by providing an evaluation of the FP&L summary reports.

The DCRDR requirements as stated in Supplement 1 to NUREG-0737 can be summarized in terms of nine specific issues, a list of which provides a convenient outline of the ' areas covered. in this technical evaluation. The nine issues are: -

1. Establi,shment of a qualified multidisciplinary review team.

2. Use of function and task analyses to identify control room opera-l tor tasks and information and control requirements during emer-l gency operations.

3. A comparisen of display and control requirements with a control room inventory.

4 A control room survey to identify deviations from accepted human factors principles.

5. Assessment of human engineering discrepancies (HEDs) to determine which HEDs are sigr.ificant and should be corrected.

en m , .,e , . - . , . , - , . - -. . - - - , - , . - n , . . . , , , , . - , . . - - - . . - . - - - . _ . ._-

6. Selection of design improvements that will correct those discrep-ancies.

7. Verification that selected design improvements will provide the necessary correction,

8. Verification that improvements can be introduced in the control room without creating any unacceptable human engineering discrep-ancies. ,

9. Coordination of control room improvements with changes resulting from other improvement programs such as SPDS, operator training, new instrumentation (Reg. Guide 1.97, Rev. 2) and upgraded emer-gency operating procedures.

PLANNING PHASE

, The FP&L Program Plans addressed most of the DCRDR requirements stated

in Supplement I to NUREG-0737. The requirements that were not addressed

! ' included verification that improver will provide necessary correction, verification that improvements will not introduce new HEDs, and coordination l

of the DCRDR with other programs. Although other requirements were l addressed, there was very little description as to how they would be satis-fied. The detailed results of the evaluation of the FP&L program plan are l described in Reference '5. The summary reports add no significant informa-tion regarding the planning phase.

The FP&L Program Plan described the multidisciplinary review team job

. categories to be used for each of the DCRDRs. Each of the DCRDR Summary reports indicate that the multidisciplined job categories were used during the DCRDR activities. For example, "several operations personnel, four human factors specialists, and plant instrumentation and control engineers" were used for the system function and task analysis. As a result, we believe that FP&L has conformed to the supplement 1 to NUREG-0737 require-ment for a qualified multidisciplinary review team.

REVIEW PHASE .

FP&L review phase plans and activities include:

1. Review of operating experience.

2. Systems function and task analysis.

3. C3ntrol room inventory.

4 Control room survey which included the following surveys:

- Noise - Labels

- Lighting -

Annunciators Environment - Anthropometry

- Controls and Displays - Force / Torque Conventions - Communications

- Process Computer - Maintainability Emergency Garments The above activities are those recommended by NUREG-0700 guidelines as contributing to the ac'complishment o'f review phase ' objectives. Activities two through four contribute to the accomplishment of specific DCRDR require-

~

ments contained in Supplement 1 to NUREG-0737.

1 7 Review of Operating Experience.

A review of operating experience is not explicitly required by NUREG-0737 Supplement 1. However, the FP&L program plans indicated that such reviews would be performed. The comments below are made with reference to the methodology described in the program plans.

The Program Plan stated that subtask 1 of the Operating Experience Review would consist of operator interviews. The St. Lucie 1 and Turkey Point 3 and 4 summary reports described the operator interview methodology in more detail than the program plans. The description of the operator interview methodology includes: an objective, review team responsibilities, criteria, task definitions / methodology and results. In addition, samples of most frequent interview responses were included in the summary report. This l

l appropriately conforms to the Review Phase guidance provided in NUREG-0700.

l .

o .

St. Lucie 2, which, according to their summary report had "no actual operating experience and no licensed operators," conducted no formal 6pera-tor interviews. However, their summary report methodology states that "throughout the course of the review, operations personnel were queried concerning the design and operation of the control room, and their responses were factored into the evaluation." This appropriately conforms to the Review Phase guidance provided in NUREG-0700.

The program plan states that subtask 2 of the Review of Operating Experience consists of a " review of plant operational experience through Licensing Event. Reports, technical specification modifications, etc." The program plan also states that " Category 1 HEDs are those which have been noted from documented operational errors." St. Lucie 1 performed this activity appropriately by reviewing LERs covering 5 years of operation.

This resulted in 4 Category 1 HEDs. St. Lucie 2 provided no indications

~

that they reviewed LERs and industry wide experience. With no operating experience of their,own, they might have reviewed St. Lucie 1 LERs and experience with similar plants; appar,ently* ttiey 'did not do so. Turkey Point 3 and 4, which have considerable oper:ating experience, did ngt indicate that they reviewed ttieir LERs. The fact tha:t. no operational errors attributable to human error were assessed to be in Category 1 sugge'sts that this devia-tion from the program plan by Turkey Point 3 and 4 could have resulted in missed identification of Category 1 HEDs.

l In summary, St. Lucie 1 performed their review of operating experience appropriately. St. Lucie 2 failed to take advantage of St. Lucie 1 and industry experience to compensate for having no ' operating experience of their own. Turkey Point 3 and 4 performed their operator interviews appropriately but failed to review their LERs. Turkey Point 3 and 4 should perform a review of their LERs and use that information to verify the appropriate HED categorization.

2. System Function and Task Analysis.

Supplement 1 to NUREG-0737 states that the licensee is required to perform a " function and task analysis (that had been used as the basis for

. developing emergency operating procedures, Technical Guidelines and plant specific emergency operating procedures) to identify control room operator

^

tasks and information and control requirements during emergency operations."

In other words, the object of the task analysis activity is to establish the input and output requirements of control room operator tasks. These input and output requirements are to serve as benchmarks for examinations of the adequacy of control room instrumentation, controls, and' other equipment.

The Summary Reports indicate that the same Systems Function and Tasks Analysis was conducted for each of the FP&L DCRDRs. It was conducted in four basic steps, as follows:

o , Identify / review systems, functions, and tasks

- identify system functions develop task lists and Response Selection Diagrams ident.ify event sequences to be analyzed o Analyze tasks analyze tasks for each function

- develop Spatial-Qperational Sequence Diagv;;ms o Verify task performance cap' ability'/ human engineering suitability

=

o Validate control room functions.

t The identification / review of systems, functions and tasks fo,llows the

" top-down approach" recommended in NUREG-0700, section 3.4.2. First, Fp&L identified system units using Final Safety Analysis Reports, techn'ical specifications, system descriptions and other documentation. Control room photomosaics were used to verify / revise the systems a d subsystem divisions for major. plant systems. The'se system units included: reactor control, safety systems., secondary systems and others. In summary, this activity ,

l identified the major plant systems, the functions which they govern and the subsystems for each major system. Next, FP&L developed task lists and Response Selection Diagrams. The objectives of this activity were to:

(1) identify and describe motor, perceptual, and information processing tasks associated with the performance of system and subsystem functions,

~

i

_ (2) to identify task sequences and dependencies, and (3) to graphically depict task sequences in Response Selection Diagrams. These diagrams were then used as " initializing information" for detailed analysis of tasks.

- +, - - e,.m - -i- ,rr- +w - - - t=- g-w'-'-=w- w ---"----;7--+vs'- %qy - T=--m g-v--w -

Then FP&L proceeded to the identification of event sequences. The specific list of event sequences selected for analysis were:

o Plant Startup/ Shutdown / Change in Power o Loss of Coolant Accident o Inadequate Core Cooling o Multiple Steam Generator Tube Ruptures o Failure of Auxiliary and Main Feedwater o Failure of High Pressure Reactor Coolant Make Up

o Anticipated Transients Without Scrams

- Loss of offsite power

- ' Stuck Power-Operated Relief Valve.

The events selected for task analysis represent an appropriate list of emergency operations. While we cannot verify for certain that all tasks in all emergency procedures are encompassed by this set of sequences, we believe it is reasonable ta conclude that step 1 of this. activity conforms to the requirements in Supplement 1 to NUREG-0737 and guidance provided in NUREG-0700 Sections 3.4.2.1 through 3.4.2.3. However, FP&L did not indicate that they used the vendor generic tecMcal guidelines for the development of emergency operating sequences. FP&L should provide further clarifica-tion on this issue.

f The second step in this activity is " Analyze Tasks." FP&L states that the " basic objective of this System Function and Task Analysis activity was to use the data previously generated in the first step to analy::e, in detail, operator-allocated tasks for each of the functional sequences selected for analy. sis." This conforms to the guidance of NUREG-0700, Section 3.4.2.4.

NUREG-0700 Section 3.4.2.4 states that "Particular attention should be given to decision making tasks. It is important to define all data needed for the decisions." The FP&L Summary Report Section 2.4.2.1 states that the analysis of tasks for' each function is intended "to determine the informa-l tion requirements, control requirements, communication requirements, constraints (time, etc.) on task performance, and decisions and skills /

knowledge requirements" for each task and task sequence. If performed i according to the objectives stated by FP&L, this activity would fulfill most

, . . . - .- - = _ - .-. -_ -_ - _ , .- . - . - -

aspects of .the requirement set forth .in Supplement 1 to NUREG-0737 for the identification of information and control requirements during emergency operations, and would be consistent with NUREG-0700 guidance. However, without more detailed task analysis info *mation such as samples of interme- ,

diate results, we cannt. verify that the requirements are met. We suggest that definition of information and control requirements be included as an 7

important topic in a meeting or audit.

(

The next subtask in the analysis of tasks was the development of Spatial-Operational Sequence Diagrams. The outpu.ts and results of this subtask were identification and verification of instrumentation and design requirements for performance of tasks, operator skills and knowledge i required for task performance, and workload assessment. This is an appropriate activity to follow the development of information and control ,

l requirements. -

i l

l The third step of the Function and Task Ana-lysis was to verify task l

-pe'rformance capability and human engineering suitability.

In order to do this, this subtask focused on fou.r main design issues: (1) grouping of components, (2) control display integra*en, (3) component discrimination; l and (4) panel layout. This is an appropriate method of analyzing control i room features which can only be evaluated systematically through task analy-sis. The results of the task analysis efforts for St.1.ucie 1 and 2 reflect ,

this concentration on the four design issues. Turkey Point 3 and 4 did not provide task analysis HED results. However, it is our judgment based on thei.r methodology that the third step (the verification of performance capabilities and human engineering suitability) was performed appropriately. -

The fourth step in the task analysis was the validation of control room functions. The output of this subtask is a list of discrepancies based on a l

comparison of the -equipment re'quirements as revealed by task analysis and

, the present control room inventory.

I In summary, we believe the Function and Task Analysis generally con-l forms to the requirements of Supplement 1 to NUREG-0737 and guidance pro '

l

! vided'in'NUREG-0700, but suggest this be verified for at least one of the plants in a meeting or audit. The HED results from the task analysis y --. e--- - - - r-- i m 4 --- ,,+--,, . , , , - - - . , , , , , - - - _ . - - - - , ,,m.,, ___ . - - _ _ - , , , - - - . - - , , - ,,,,,m----, --.----

P 1 .

e

. indicate that the task analysis was appropriately used to complement, rather than repeat, the survey efforts. ,

l

3. Control Room Inventory.

This activity w&s not described in the program plan. However, FP&L has ,

~

included this activity in each of their DCRDRs in accordance with the requirements of Supplement 1 to NUREE-0737. The inventory section of each summary report describes an objective, review tecm responsibilities, criteria, task definition and results. All three summary reports indicate

.that "The objective of the Equipment Inventory was to identify and reference i all instrumentation controls and equipment within the control rocm for: 1) assessment of task equipment demands, 2) Component-level Human Engineering Discrepancy documentation, and 3) priority assessment. The inventory in-cluded all components and major assemblies with which operators interface in the main control room." Photomosaics of the control rooms were used as the basis for the inventories in each of the DCI'DRs. The results of this activity were " intended for use in task analysis" and the identi,fication of human engineering discrepancies. " The output of this task is. a filing system containing a data form for ea6Fromponent in the control room. The data form contains information describing the component and a list of asso-ciated Human Engineering Discrepancies" for each control room. As a result, we conclude that the-control room inventory activity conforms to the requirement of Supplement 1 to NUREG-0737 and Review Phase guidance in .

NUREG-0700.

4. Coittrol Room Survey.

I Each of the fourteen surveys described in the program plans were performed in all DCRDRs. The summarj report descriptions for each survey contain sections on objectives, review team responsibilities, criteria, task definition / methodology, and results. The stated objective of each of the surveys conducted in all three DCRDks was to identify deviations from accepted human factors principles. This conforms to the control room survey requirement described in Supplement 1 to NUREG-0737.

In addition, tables listing all Human Engineering Discrepancies for each plant were provided. The tables provided descriptions of the HEDs, n - - _

NUREG-0700 guidelines which were violated, locations of the HEDs and Fp&L file numbers. The use of the HED tables was very helpful in evaluating the impact of the survey activities.

In summary, it is our evaluation that the survey activities performed at St. Lucie 1 and 2 and Turkey Point 3 and 4 comply with the requirements  ;

of Supplement 1 to NUREG-0737 and the survey guidance provided in the Review Phase section of NUREG-0700. In addition, the Survey results from St. Lucie  ;

I and 2 indicate that they performed a human factors engineering review of their Reinote Shutdown capability. It could not be verified that Turkey i Point 3 and 4 performed a human factor engineering review of their remote shutdowns capability. Although this is not explicitly identified in Supple-ment I to NUREG-0737, it is a recommended activity.

ASSESSMENT AND IMPLEMENTATION PHASE.

1. HED Assessment Methodology The HED Assessment Methodology is the same for all three DCRDR summary reports and is unchanged from the pro _Aram plan description. The summary reports describe the basic assessment process as being divided into fo0r steps, as follows:

o Assess extent of deviation from NUREG-0700 guidelines o Assess Human Engineering Discrepancy impact on error occurrence l

o Assess potential consequences of error occurrence

! o Assign Human Engineering Discrepancy scheduling priority.

These four steps are described in detail in the summary reports along with Figure 1-5 (References 1-3) which illustrates the assessment process.

i The FP&L assessment conforms to guidance provided in NUREG-0700 and NUREG-0801.

In addition, the results of the assessment methodology were provided by FP&L in complete listings of all HEDs identified during the DCRDRs along with categorization (1, 2, or 3) numbers.

It is our conclusion that the assessment methodology and results des- ,

cribed in each of the Summary Reports appropriately assessed human engineering discrepancies identified during the DCRDRs.

2. S_ election of Design Improvements -

The method for selection of design improvements is the same in all three summary reports and is unchanged from the program plans. This method-ology reflects an understanding of the guidance provided in the Selection of Design Improvements section of MUREG-0700. In fact, summary report Figure, 3.1, " Assessment: Selection of Design Improvements" is identical to NUREG-0700 Exhibit 4-2. Furthermore, the FP&L selection of design improvements methodology took into account plant safety, design restrictions, operator performance, and cost effectiveness. The acceptability of design alterna-tives was verified by further evaluation using the following:

.o Functional analysis *

, o Task analysi.s ,

o Reapplication of appropriate human factors engineering checklists.

This indicates that the methodology was designed to introduce correc-tions in the control room with due consideration given to avoiding creation

of unacceptable human engineering discrepancies.

t Each of the FP&L summary reports contains an outline of their programs for proposed control room changes. The FP&L HED solution programs are divided into 2 broad categories, (a) enhancement solutions, and (b) design alternative solutions. These categories are consistent with NUREG-0700, Section 4, Assessment and Implementation Guidelines.

The FP&L summary report section, Analysis of Correction by Enhancement, describes their general procedure for screening the HEDs selected for cor-rection by enhancement, which is consistent with NUREG-0700 Section 4.2.2 Selection of Design Improvements Guidelines. The enhancement solutions were divided into four programs: labeling, demarcation, annunciator review, and coding convention. The Summary Reports' Figure 3.2, " Flow for Correction of i

HEDs by Enhancement" describes the precess followed in the design and evaluation of enhancement solutions. This process describes the use of

photomosaics, available literature (NUREG-0700 and 0801), verification that the solution corrects the HED and detailed documentation. This process is consistent with NUREG-0700 Section 4.2.2.1, " Analysis for Correction by Enhancement Guidelines."

In addition to describing their enhancement programs, FP&L provided a list of HEDs to be corrected in each of the programs. This list was cross-referenced to their computerized listing of the HEDs which described the individual problems and enhancement solutions. This satisfies the Supple-ment 1 NUREG-0737 requirement for an outline of proposed control room changes for the enhancement solution programs. ,

The summary report section, Analysis of Correction by Design Alterna-tive, describes a process for the design and evaluation of control room engineering changes. The first step in this process is examination of the HED using task analysis data and identification of potential constraints.

The second step is the identification of design alternatives, or proposed

• . - engineering changes. The third step is evaluation of these changes. The fourth step is the verification that 'the design solution will not introduca new HEDs. This process. is consist'ait with NUREG-0700, Section 4.2.2.2, Analysis of Design Alternatives Guidelines.

In addition, FP&L provided a list of HEDs to be corrected by design alternatives. This list is cross-referenced to their computer listing of the HEDs which described the individual HEDs and de~ sign solutions. This

, conforms to the Supplement 1 to NUREG-0737 requirement for an outline of proposed control room changes.

The summary reports do not describe how the results of the control room changes (Human Factors Implementation Program) are' coordinated with changes .

resulting from other improvement programs such as SPDS, operator training, new instrumentation, and upgraded emergency procedures. This should be addressed by FP&L if they are to conform to the requirements of Supplement 1 to NUREG-0737.

In summary, FP&L's HED solution programs comply with the requirements of Supplement 1 to NUREG-0737 However, the interface between these programs and other FP&L control room improvement programs was not described.

i

., --y,, --

.,---,~..--w-,. . . , . - . . . . . - . - . , , -

.' .' l

3. Proposed Schedules for Implementation All three FP&L summary reports indicated that the development of HED solutioir schedules were based on:

o Human engineering discrepancy priority o Engineering and procurment lead time requirements and constraints o Overall plant outage schedules.

Furthermore, the summary reports state that the schedules will be periodi-cally reviewed and updated as part of the implementation program. This appropriately conforms to the guidance provided in NUREG-0700, Section 4.3,'

Implementation.

In addition, each of the summary reports contains a list of currently scheduled completion dates for their standardized HED solution programs.

Each list contains dates for complbtion of labeling, demarcation, annuncia-tor review, coding conventions, engineering integration, administrative and training programs. All of the program dates for St. Lucie 1 and 2 reflect an FP&L intention. to complete them praagtly, i.e., by December 1984. Turkey Point 3 and 4 also indicate an intent to complete most programs promptly, by July 1985. However, a July 1986 completion date for their demarcation pro-gram is inconsist with their intent to complete their enhancement programs promptly. FP&L should provide a just,ification for the late demarcation l program completion date for Turkey Point 3 and 4.

In summary, the proposed schedules for implementation of control room I

changes are generally appropriate and adequately reflect the guidance pro- l vided in NUREG-070' 0 , with the exception that the scheduled completion date for the Turkey Point 3 and 4 demarcation program is not prompt. A justifi-cation for the Turkey Point 3 and 4 demarcation program schedule should be provided by FP&L.

4. Justification for HEDs With Safety Significance that are to be Left Uncorrected or Partially Corrected Licensees have the option of correcting all identified HEDs or of assessing them for significance and correcting or partially correcting only

those that are significant. Correction of HEDs determined not to be sjg-nificant is at the discretion of the utility. However, Supplement l'to NUREG-0737 requires all licensees to provide a summary justification for human engineering discrepancies with safety significance to be left uncor-rected or partially corrected. FP&L provided these justifications in the section, Written Justification /No Corrective Action Intended, of each summary report.

Our evaluation of the FP&L justifications raised a number of issues or questions. Whenever justification questions arose, we documented a single example of the justification problem in this section. The complete list, by individual plant, is located in Appendix A. The following is a list of example issues raised during our review of the FP&L justifications.

a. NUREG-0700 (Section 4.2.1.1 Assessment of Safety Consequences) states that discrepanc'ies should be assessed both individually and on an aggregate basis. Aggregate assessment (either on a system / subsystem basis, work station basis, or control room-wide) is important to,ensur,e that the patential safety consequences of multiple discrepancies.affecting the l operator . task has been considered. -

I l

It is not clear that the aggregate effects or interactions between the HEDs with low error assessment were thoroughly analyzed. For cxample, ' St.

Lucie 1 finding Section 6.3, file No. 8 states that there is no first-out annunciator panel for the reactor system. The FP&L response states that the plant is provided with a sequence-of-events computer and printer used to present the desired information. When considered as a single HED and i response, this appears to be .an adequate answer. However, finding Section 6.7, file No. 33 states that not all annunciator alarms are monitored. on the sequence 'of events recorder. Finding 6.7, file no. 25 states that the recorder prints 144 lines per minute and the back-up printer 12 lines per i minute, and finding 6.7, file no. 24 states that there are no instructions for loading paper in the sequence-of-events printer. This tends to indicate that there are aggregate problems affecting the lack of a first-out panel and the sequence-of-events printer. However, the FP&L treats each HED finding as a separate case. A detailed list of aggregate effect problems is provided in Appendix A of this report. '

1 l

l l

b. Some HEDs described in the section, "No Corrective Action l Intended," appear to have been placed in the incorrect section without an implementation schedule. For example, St. Lucie 1 Section 6.1, File Nos. I l 17,18, and 27 state that the reactor trip and the turbine trip pushbuttons  !

! are going to be relocated to more accessible areas. This represents a i

l safety-significant correction by design alternative. This would be more appropriately included in the engineering integration review program. A l complete list of HEDs which appear to be inappropiately placed in the No l Corrective Action Section is provided in Appendix A of this report, i l

c. The no-corr.ective-action justification for a number of safety I significant HEDs appears to conflict with NUREG-0700 guidelines.. Fo r j example, St. Lucie 1 Section 6.5, File No.19 states that the igcator lights associated with the reactor coolant pump oil lift pump respond to l l control switch positions, not pump status. The justification describes interlocked indications and administrative procedural controls that are used by the operators to compensate for lack of status information. However, i i

more detailed in. formation is required for us to judge that the response meets the intent of guideline 6.5.1.'1.e of NUREG-0700. A detailed list of

[ no corrective-action findings whicMquire additional justification is provided in Appendix A. .

l In summary, the FP&L justifications for HEDs which are to be left uncorrected or partially corrected have raised a number of questiens. Were l the aggregate effects of low error assessment HEDs analyzed by FP&L? Should HEDs with correction descriptions have been included in the no-corrective-l l action-intended section? Are -justifications for specific HEDs adequate to  :

warrant no corrective action? FP&L should provide the answers to each of these questions.

l i

l CONCLUSION l

i We conclude that, for the most part, FP&L conducted thorough and com-l prehensive Detailed Control Room Design Reviews for St. Lucie 1, S t. Lucie 2, and Turkey Point 3 and 4. ' However, there are several open issues for l l which we need additional information from FP&L to confirm that all require- 1 l ments stated in Supplement I to NUREG-0737 have been satisfied. The information needed is as follows:  !

L

- Examples of task analysis data forms such as Response Selection Diagrams, Spatial-Operational Sequence Diagrams and other task data collection forms. This and the description of the nature of generic E0P use is needed to determine how operator information and control requirements were established.

Justification for not reviewing LERs during the review of operat-ing experience at Turkey Point 3 and 4 and for not utilizing industry experience. This is needed to verify HED categorization.

- Justification for the HED problems identified in Appendix A of this report.

Justification for a delayed July 1986 implementation date for the Turkey Point 3 and 4 demarcation program. This schedule is incon-sistently long when compared to the other FP&L implementation schedules.

- Description of how the resu'lts of the control room changes (Human Factors Implementation Progam) are coordinated with changes resulting from other improvement programs, such as SPDS, operator training, new instrumentation, and upgraded emergency procedures.

In order to resolve tnese open issues, we suggest that a meeting or audit be held with key participants of one or more of the review teams.

w e

t-

Appendix A Problems Concerning the Justifications for HEDs Left Uncorrected or Partially Corrected St. Lucie 1

1. Section 6.1, File No. 17, 18, 27. Where were the reactor trip and turbine trip pushbuttons moved and was this included in the FP&L Design 1 Solution Program?

2. Section 6.1, Fil e No.1; 6.1, Fil e No. 2; 6.1, Fil e No. 5; 6.2, Fil e No. 4; 6.4, Fil e No.19; 6.4, Fil e No. 36 ; 6.7, Fil e No. 22 ; 6.7, Fil e No. 30; 6.8, File No. 29. Were the aggregate HED effects analyzed on the radiation monitor system?

3. Section 6.3, File No. 8; 6.7, File No.10; 6.7, File No. 25; 6,7, File No. 29; 6.7, File No. 31; 6.7, Fil e No. 33. Were the aggregate effects of the sequence of events recorder HEDs analyzed with respect to the lack of a first out panel?

l 4 Se~ction 6.1, Fil e No. 26, 31; 6.4, Fil e No.1, 6.4, Fil e No. 2, 6.4, Fil e No,. 50, 6.5, Fil e No. 59; 6.5, Fil e No. 75 ; 6.5, Fil e No. 97 ; 6.5, File No.101; 6.5, File No. 208; 6.5, File No. 263; 6.8, File No. 22.

l Were the aggregate effects of the reactor protective system HEDs l analyzed with respect safety significance?

l S. Section 6.5, File No. 7; 6.5, File No. 47; 6.5, File No.122. Were the aggregate effects of cold leg temperature indication display HEDs analyzed with respect to adequate sources of information available?

6. Section 6.5, File No.17; 6.5, File No.19. Are these demand / status

!- problems corrected with all necessary alternate sources of information?

7. Section 6.1, Fil e No. 37, 6.4, Fil e Nos. 21, 22, 23, 24 and 25 ; 6.4, j File No. 36; 6.5, File No. 2; 6.5, Fil e No. 20; 6.8, File No. 7; 6.9, File Nos, 4,'5, 6, 7, 8, 9 and 10. The responses to these HEDs appears to contradict the findings. Are these invalid,HEDs?

l

[

_a

r

]

l

8. Sec tion 6.1, Fil e No. 23; 6.1, Fil e No. 24 ; 6.1, Fil e No. 29; 6.3, Fil e ,

No. '24; 6.3, Fil e No. 28; 6.5, Fil e No. 72; 6.5, File No. 257; 6.5, File No. 259; 6.5, File No. 260; 6.5, File No. 262; and 6.9, File No.  ;

21. All responses for these HEDs indicate that cont;rol room changes  !

- will be implemented to correct the HEDs. However, the schedule for ,

implementation of backfits is not provided. In addition, these solu-tions are not identified in the labeling, demarcation, annunciator review, coding conventions or engineering integration review programs.

St. Lucie 2 ,

1. Section 6.3, File No.1; 6.7, Fil e No.11; 6.7, Fil e No.12; 6.7, Fil e No.13 ; 6.7, Fil e No.14; 6.7, Fil e No.15 ; 6'.7, Fil e No.16; and 6.7.

Fil e No. 18. Were the aggregate effects of sequence of events recorder HEDs analyzed with respect to the lack of a first-out panel?

2. Section 6.3, File No.11; 6.5, File No. 33; 6.6, File No. 27; 6.7, File No. 3; 6.8, Fil e No. 4; and 6.8, Fil e No. 7 9. The. responses for these HEDs contain descriptions of proposed control room changes. However, the proposed schedules -for implemgation of solutions is not provided.

In addition, these solutions .are not identified in the labeling, demar-cation, annunciator review, coding convention or engineering integra-tion review programs.

3. Section 6.1, Fil e No. 5; 6.1, Fil e No.12; 6.4, Fil e No. 4, and 6.7, Fil e No. 7. The responses to these HEDs appears to contradict the findings. Are these valid HEDs?

4. Section 6.2, File No. 7; and 6.8, File No.10. The response to these findings represents questionable justifications.

O G Turkey Point 3 and 4

1. Section 6.1, File No. 8; 6.3, File No. 21; 6.5, File No. 74; 6.6, File No. 54; 6.6, Fil e No. 58; 6.6, File No. 59; 6.6, Fil e No. 67; 6.7, File No. 2; 6.7, Fil e No. 4; 6.7, Fil e No. 5; 6.7, Fil e No.11; 6.7*, Fil e No.13; 6.7, File No.15; 6.7, Fil e No.17; 6.7, File No.18; 6.7, File No.19; 6.7, File No. 20; 6.7, File No. 21; 6.7, File No. 24; 6.8, Fil e No. 2 ; 6.8, Fil e No. 3 ; 6.8, Fil e No. 5 ; 6.9, Fil e No. 5. All responses for these HEDs indicate that control room changes will be implemented to correct the HEDs. However, the schedule for implementa-tion of solutions is not provided. In addition, these solutions are not- part of labeling, demarcation, annunciator review, coding conven-tions or engineering integration review programs. ,

- 2. Section 6.3, File No.1; 6.3, File No. 4; 6.5, File No. 25; 6.5, File No. 59; 6.5, File No. 77; 6.7, File No. 23. Thit responses to these findings represent questionable justifications.

l

3. Section 6.1, File No. 39; 6.2, File No.13.

These findings / responses -

should be incl'uded in appropriateglution programs.

I e

l

s,

~

REFERENCES

1. " Summary Report: Detailed Control Room Design Review of the Plant .St.

Lucie Unit 1 Nuclear ?ower Station'," Florida Power and Light Company, NRC Accession Number: 8311080241, October 1983.

2. " Summary Report: Detailed Control , Room Design Review of the Plant St.

Lucie Unit 2 Nuclear Power Station," Florida Power and Light Company, NRC Accession Number: 8310070250, September 1983. -

3. " Summary Report: Detailed Control Roon. Design Review of the Plant Turkey Point Units 3 & 4 Nuclear Power Station," Florida Power and Light Company, NRC dccession Number: 831 080311, Octob.er 1983.

4 "St. Lucie Units 1 and 2, Turkey Point Units 3 and 4 Detailed Control Room Design Reviews Program Plan," Florida Power and Light Company, ,

April 1983.

5. "DCRDR Program Plan Evaluation for Turkey Point Units 3 and 4 and St.

Lucie Units 1 and 2," Science Applications, Inc., August 19, 1983.

6. NUREG-0660, Vol.1, "NRC Action Plan Developed as a Result of the TMI-2 Accident," U.S. Nuclear Regulatory Commission, May 1980; Revision 1, August 1980.

7. NUREG-0700, " Guidelines for Control Room Design Reviews," U.S. Nuclear Regulatory Commission, September 1981.

8. NUREG-0737, " Clarification of TMI Ac11on Plan Requirements," U.S.

Nuclear Regulatory Commission, November 1980.

9. NUREG-0737, Supplement 1, " Clarification of TMI Action Plan Require-ments ," U.S. Nuclear Regulatory Commission, December 1982.

10. NUREG-0801 Draft, " Evaluation Criteria for Detailed Control Room Design Reviews," U.S. Nuclear Regul' .ory Commission, October 1981.

0

---,-r-m -- y - - , + , - - - - , - . - - . . , , , , . - -

- - , - - . - , , ~. - - . , . --.----,,,e. ,,,m,----,----,w e w--....,