ML20094L155
| ML20094L155 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 07/20/1984 |
| From: | SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY |
| To: | |
| Shared Package | |
| ML20094L125 | List: |
| References | |
| CON-NRC-03-82-096, CON-NRC-3-82-96 1-263-07-557-48, 1-263-7-557-48, TAC-51185, NUDOCS 8408150275 | |
| Download: ML20094L155 (35) | |
Text
-
ATTACHMENT 4
s.
\\
J ATTACHt1ENT TO SER INPUT EVALUATION OF THE DETAILED CONTROL ROOM DESIGN REVIEW i.-
SUMMARY
REPORT FOR OYSTER CREEK NUCLEAR GENERATING STATION Technical Evaluation Report Final i
July 20,1984 4
Prepared for:
U.S. Nuclear Regulatory Commission Washington, D.C.
Contract NRC-03-82-096
s FOREWARD This Technical Evaluation Report (TER) was prepared by Science Technical Assistance Applications, Inc. (SAI) under Contract NRC-03-82-096,The evaluation was Program III.
in support of NRC Licensing Actions:
performed in support of the Division of Human Factors Safety. H
' Engineering Branch (HFEB). plan submitted for the Detailed Contro Results of that for Oyster Creek Nuclear Generating Station (Reference 1).
R evaluation are described in a memorandum prepared by HFEB the licensee (Reference 2).
(Reference 3) and considers DCROR activity licensee's summary report information presented in the program plan (Reference 1).
d D
i i
i l
i
r o
TABLE OF CONTENTS Page Section 1
BACKGROUND........................
3 PLAulING PHASE......................
3 1.
Prcparation and Submission of a Program Plan..
2.
Structure and Qualificatior.s of a 4
Multidisciplinary Review Team 3.
Coordination of the DCRDR With Other 5
Improvement Programs..............
5 REVIEW PHASE.......................
6 1.
Review of Operating Experience.........
7
-2.
System Fonction and Task Analysis 11 3.
Control Room Inventory.............
11 4.
The Control Room Survey 13 ASSESSMENT AND IMPLEMENTATION PHASE...........
13 1.
HED Assessment Methodology...........
14 2.
Seiection of Design Improvements........
3&4.
Verification that Selected Design Improvements will Provide the Necessary Correction and Verification that Improvements can be Introduced in the Control Room Without Creating.Any 15 Unacceptable Human Engineering Discrepancies..
ANALYSIS OF PROPOSED DESIGN CHANGES AND JUSTIFICATION FOR HEDs TO BE LEFT UNCORRECTED FROM THE RESULTS OF OYSTER 16 CREEK NUCLEAR GENERATING STATION.............
27 CONCLUSIONS AND RECOMMENDATIONS 30 REFERENCES........................
i e
11
s Evaluation of the Detailed Control Room Design Review Summary Report for Oyster Creek Nuclear Generating Station Inc. (SAI) documents the Science Applications, This report evaluation of the summary report of the Detailed Control Room Design Review (DCRDR) submitted to the Nuclear Regulatory Commission (NRC) by GPU N Corporation (GPUN) for the Oyster Creek Nuclear Generating Station This evaluation also considers information (Reference 3) on 30 April 1984.
fbtained from the previously submitted program plan (Reference 1).
Results of the SAI evaluation follow a brief overview of the background leading up to preparation and submission of the summary report by the licensee.
BACKGROUND Licensees and applicants for operating licenses are required to conduct a Detailed Control Room Design Review.
The objective of the review is to "... improve the ability of nuclear power plant control room operators to prevent accidents or cope with accidents if they occur by improving the information provided to them" (NUREG-0660, item I.0.1 (Reference 4). The need to conduct a DCRDR was confirmed in NUREG-0737 (Referen requirements to be met in such a review were contained in Supplement 1 to NUREG-0737 (Reference 6).
Guidelines for conducting a DCROR are provided in NUREG-0700 (Reference 7) while NUREG-0801 (Reference 8) presents the assess-ment processes for use by the NRC.
The DCROR requirements' as stated in Supplement 1 to NUREG-0737 can be summarized in terms of nine specific issues, a list of which provides a The convenient outline of the areas covered in this technical evaluation.
nine issues include:
Establishment of a qualified multidisciplinary review team; 1.
I
.e
- n
'2 i
e' a
s Use of function and task analyses to identify control rous 2.
operator tasks and information and control requirements during emergency operations; y
A comparison of display and control requirements with a 3..
control room inventory; l'
A control room survey to identify deviations from accepted 4.
human factors *.rinciples; Assessment of human engineering discrepancies (HEDs) to S.
l determine which HEDs are significant and should be corrected; Selection of design improvements that will correct these 6.
I discrepancies; Verification that selected design improvements will provide l
7.
the necessary correction; Verification that improvements can be introduced in the 8.
control room without creating any unacceptable human I
engineering discrepancies; and Coordination of control room improvements with changes t
9.
resulting from other improvement programs such as SPOS, l
operator training, new instrumentation (Reg. Guide 1.97, Rev.
I
- 2) and upgraded emergency operating procedures.
s A DCRDR is to be conducted according to the licensee's own program I
i plan (which must be submitted to the NRC); according to NUREG 0700 it sho address the previously stated requirements and be conducted in accordance
- 1) planning, 2) review, 3) assessment, and
[
with the following four phases:
The product of the last phase is a summary report which must l
j
- 4) reporting.
include an outline of proposed control room changes, their proposed schedules for implementation, and summary justification of human engineering
~
discrepancies with safety significance to be left uncorrected or partially Upon receipt of the licensee's summary report and prior to corrected.
implementation of proposed changes, the NRC must prepare a Safety Evaluat l
i 2
Report (SER) indicating the acceptability of the OCRDR (not just t The NRC's evaluation encompasses all documentation as wel report).
briefings, discussions, and audits if any were conducted.
The summary report submitted for evaluation by GPU Nuclear completed tasks and findings from a control room design revie 1980 at Oyster Creek prior to the issuance of descrioes which was initiated in late the DCROR requirements stated in Supplement 1 to NUREG-0737 d
A mothodology suggested f.n NUREG-0700 or other appropriate gui ance.
control room mockup was constructed and in early 1981 guidelin objectives were formulated to provide a framework for the control A major review of the alarm systerr was undertaken and other d
planned modifications effecting plant controls and displays were design review.
Review of the control room as a whole was to human f actors evaluation.and included preparation of a program plan and 1982-1983 conducted between analysis of tasks associated with executing symptom-oriented emerge operating procedures.
Pl.ANNING PHASE Preparation and Submission of a Program Plan
.1.
1 The program plan submitted for Oyster Creek showed that GPUN i
many of the basic objectives for conducting a control room design rev Many of the elements of a review specified in NUREG-0737 ha However, specific areas of the work were not described in sufficien to provide assurance that the licensee understood the processes The results of the complete the tasks and therefore meet the requirements.
evaluation of the GPU Nuclear program plan are detailed in Referenc The licensee's program plan included a brief description of the staffing and management that were established to conduct the con From additional information provided by GPUN in the summary design review.
report, it appears that the structure and management of the DCRO Overall direction of flexible enough to permit a inultidisciplinary effort.More specific the review was provided by GPUN.
was the responsibility of GPUN's Director of Systems Engineering and of Plant Analysis.
L u
Structure and Qualifications of a Multidisciplinary Review Team 2.
l A competent and relevant multidisciplinary team was established to The team included GPUN staf f, conduct the control room design review.
The resumes personnel from MPR Associates, and human factors consultants.
provided indicate that the expertise of the review team included:
e System Engineering Reliability and Risk Analysis e
Human Factors Engineering e
Operations Analysis e
Instrumentation and Control e
o Chemical Engineering Electrical Engineering e
Mechanical Engineering e
o Nuclear Engineering Although GPU Nuclear has not provided actual personnel assignments and levels of effort for comple'ted activities, it outi,ined the degree of involvement of MPR and consultants. It appears that participating or,1aniza-tions and individuals were qualified for DCROR tasks for which they were GPUN was responsible for overall direction of the review.
responsible.
l GPUN staff participated in almost all review activities to some extent.
l GPUN acted as contract manager for MPR and the human factors consultants, set the review schedule, integrated the review and corrective actions with MPR developed plant activities, and scheduled correction of discrepancies.
the review's framework, coordinated review phases and draf ted report The human factors consultants participated in development of findings.
review guidelines, engaged in walkthroughs, and assisted in the evaluation GPUN, however, has not specified if the same individuals of deficiencies.
who participated in the 1980-1981 review also were involved in the 1983 effort.
Although no details are provided, the review team, as estabitshed, appears to have had freedom to carry out the review and access records.
information and facilities as needed. The team apparently also had the ability to acquire support from other administrative staff and specialists as needed.
Other staf f involved in the review are mentioned by name or 4
s analysis staff, shift technical speciality (systems engineer /safetyHowever, as resumes for these individuals advisors, operating staff, etc.).
were not provided, it is impossible to evaluate their qualifications or Additional information their suitability in terms of task assignments.
have facilitated regarding' supplemental staff needed for the review would the evaluation of the teams capability to conduct the review.
Coordination of the OCRDR With Other Improvement Programs 3.
The licensee's program plan indicated an intent to comply with the coordination requirements of the NRC and awareness of the potential disrup-tion of the control room and complications to operator training that may In result from an uncoordinated implementation plan of corrective actions.
order to ensure that the high standards established during the OCRDR are maintained, future modifications to the control room such as the Safety Parameter Display System and instrument modifications for compliance to Regulatory Guide 1.97, will be subject to procedures which integrate human factors reviews into the design process. The procedures are supported by a full time human factors staff.
Such procedure have been applied to design of the Remote Shutdown Panel.
The licensee mentions in the summary report that methods used and standards established during the DCRDR will be applied to other improvement However, the licensee has not described how it specifically plans programs.
Therefore, it is not possible to coordinate the DCROR with other programs.
to evaluate this aspect of the DCRDR.
Note that a specific timetable would have been extremely valuable in assuring that this important coordination function was implemented.
REVIEW PHASE GPU Nuclear Review Phase plans and activities included:
l 1.
Review of operating experience; Review of operator functions and responsibilities; 2.
Review based on plant procedures and walkthroughs; 3.
4 Function and task analysis; 5
w 5.
Control room inventory; and 6.
Control room survey.
To some extent, the above activities are those recommendeu by NUREG-0700 guidelines as contributing to the review phase objectives.
Activities 4,5, and 6 contribute to the accomplishment of specific OCROR Activities 2 and 3 requirements contained in Supplement 1 to NUREG-0737.
permitted a review and validation of operating procedures and provided data Activities 2, 3, and 4 are relevant to the assessment phase of the project.
discussed together in the System Function and Task Analysis section to follow.
1.
Review of Operating Experience A review of operating experience is not explicitly required by Supplement 1 to NUREG-0737.
However, it is an activity recommended by NUREG-0700 guidelines as co'ntributing to the accomplishment of review phase objectives.
As described by Gpu Nuclear in the program plan, its review of operating experience included: 1) a review of Licensee Event Reports and internal plant records on reactor trips and other events to ensure that problems actually encountered in Oyster Creek's operation were identified and factored into the control room review; 2) a review of Nuclear Power Experience summaries; 3) conduct of a formal opinion survey of control room operators to identify strengths and weaknesses of the control room; and 4) the acquisition of solicited and unsolicited information from operators during walkthroughs.
GpVN performed its operating experience review using methods consistent with guidelines provided by NUREG-0700. However, it is difficult to assess the adequacy of the review due to lack of detail concerning For example, no information has been provided on the procedures employed.
number of operators formally surveyed (NUREG-0700 suggests surveying 50". of the control room operators). There is.no description of analyses performed Furthermore, there is no information on how and to what on data collected.
extent industry-wide reports were reviewed and documented.
Such infor,mation and -examples of checklists or questionnaires employed for data collection 6
-Q.-
._m.y
would provide greater confidence in the review of operating experience performed by the licensee.-
System Function and Task Analysis 2.
Supplement l' to NUREG-0737 states that the licensee is r'equir for perform a " function and task analysis (that had been used as the developing emergency operating procedures) to identify control room op tasks and information and control requirements during emergency opera In other words, the objective of the task analysis is to establish the inpu These information and output requirements of control room operator tasks.
requirements are then to serve as benchmarks for examination of the 4
of control room instrumentation, controls, and other equipment.
For licensees choosing to use the 8 oiling Water Reactor Owners' Group (8WROG) control room survey program, the NRC has issued G A further 83-18, clarifying some task analysis requirements (Reference 11).
14, 1984, has defined the requirements memoradum issued by the NRC on May for performing a task analysis when the licensee uses the BWROG emerge This review has examined the procedure guidelines (EPGs) (Reference 12).
summary report in light of these clarifications of the NRC requirements.
GPU Nuclear's methodology for performing the function and task analysis was described in their program plan and summary report su 30, 1984 respectively.
GPUN started their of July 1,1983, and April original systems function and task analysis (SF&TA) activities in 198 walkthroughs of 1980 off-normal and normal procedures conducted in GPUN has also recently completed a SF&TA based scale cor. trol room mockup.
This review concen-on walkthroughs using the new symptom-oriented E0Ps.
trates on the latter effort because Supplement 1 to NUREG-0737 specifie that the new E0Ps shall be used as a bas.is for performing the SF&TA.
GPUN started the process of implementing the symptom-oriented E0P In order to comply with Generic Letter 83-18, they converted the generic guidelines to plant specific guidelines and then to "first-cu in 1983.
GPUN states that these "first-cut" procedures were not tailored to.the displays and controls installed in the Oyster Creek control roo procedures.
Presumably this would help to establish information and control requirem l
,/
7
The process involved defining functions independent of the control room.
In order to and tasks required of operators during emergency conditions.
define tasks, GPUN performed a " desk-top" review of the procedures a I
constructed logic diagrams of tasks to preclude dead end or infinite "d GPUN then devoted two days to walkthroughs of the loop" situations.
The walkthroughs were used to analyze the ability procedures on the mockup.
of the operators to understand and perform the operations.
The above process was basically a verification that the controls and displays in the control room supported the tasks required by the E0P In order to validate the procedures, GPUN walked through mechanistic u on a mockup and evaluated operator responses in training exercises on t The fact that the controls and displays at the Dresden Dresden simulator.
simulatoc are substantially different from those at Oyster Creek (Reference doubt as to the usefulness of this step.
- 3) casts GPUN has not fully documented several specific areas regarding GPUN it's SF&TA~, and therefore it is not possible to completely assess it.
stated that they translated the BWROG generic guidelines into "first-cut" There remains the question as to whether finished procedures procedures.
were ultimately developed, and if and how they differ from the "first-cut" If there are differences then Generic Letter 83-18 wou procedures.
require resolution.
14, 1984 Of the four points discussed in the NRC Memo of May (Reference 12), it appears that GPUN has partially complied with the fi two points and has not adequately descriped the second two points well enough to assess.
With regard to the first' two points, the memo refers to Rev. 3 of GPUN did not state which the BWROG EPGs as providing a function analysis.
However it is clear from page III.4 of the revision of the EPGs they used.
Thus two emergency procedures summary report that they did not use Rev. 3.
have been omitted from the SF&TA process, namely secondary containment I
control and radioactivity release control.
1 l
l l
l l
8
e With regard to the second two points in the NRC memo, the follow-ing inadequacies were found in the GPUN submittal:
GPUN has not described the process used to identify plant-1.
specific parameters and other plant-specific infor.mation and control capability needs nor has it described how the characteristics of needed instruments and controls were determined.
GPUN has not described nor provided an example of an 2.
auditable record which defines the necessary characteristics of each instrument and control used to implement the E0Ps and basis for that determination.
The process described by GPUN emphasizes the verification that controls and displays in the control room will allow the operators to the tasks in the E0Ps.
The process described by GPUN also execute emphasizes the validation of the compatibility of the procedures, manning, Although GPUN has stated, training, and control room for emergency tasks.
for example, that "if th'e operator's execution of a step was conditioned on specific values of process variables, the information..on those variables was displayed to him in appropriate terms, with appropriate precision, and at a location where he would be able to see it," (Reference 3) it has not described the process used to evaluate the suitability of characteristics of the needed instruments and controls.
Even though the SF&TA as described by the Oyster Creek review team appears to fall short of satisfying the NRC requirement the GPUN team did A critical review of the findings which were presented identify many HEOs.
in Sections IV.2, IV.3, IV.4, V.A, V.B as well as Table V-1 (pp.1-26) reveals that GPUN has discovered numerous control room inadequacies in a number of categories including: 1) missing information, controls and/or instrumentation; 2) inadequate controls and instrumentation; 3) inadequate warnings; and 4) inappropriate clusters of controls and/or instruments for It is important to note that some of the discrepancies plant functions.
s 9
were discovered during the walkthroughs of the 1980 normal and 'off-normal There procedures and some of them were discovered when using the new E0Ps.
is also evidence in Groups 2 and 3 of Table V-1, that the SF&TA may not have been performed in great enough detail to establish the information and control requirements and characteristics.
In conclusion, GPUN has performed a SF&TA which partially complies It used an unidentified version of the BWROG EPGs with the NRC requirement.
A subset of the required E0Ps were used to to develop plant-specific E0Ps.
The control and verify and validate the tasks in the emergency procedures.
display requirements for the tasks were evaluated by the DCROR team relying 1) on its experience and knowledge rather than a systematic process which:
first identified plant-specific parameters and information and; 2) then described the characteristics of the needed instruments and controls and; 3) lastly verified the task performance capabilities.
In order to complete the requirements of Supplement I to NUREG-0737 and.the NRC Memo of May 14, 1984, GPUN should:
Write E0Ps for the two remaining emergency procedures namely:
1.
secondary containment control and radioactivity release After the plant-specific E0Ps are written GPUN can control.
then carry out a SF&TA for these procedures.
State whether their "first-cut" procedures are differenct 2.
from their finalized E0Ps and if any differences would affect the SF&TA.
/
Describe the process used to identify plant-specific para-3.
meters and other plant-specific information and control Describe how the characteristics of needed capability needs.
instruments and controls were determined.
Describe and provide an example of an auditable record which 4.
defines the necessary characteristics and bases for that determination of each instrument and control used to implement the E0Ps.
10
3.
Control Room Inventory The licensee's stated objective for this task was to identify all GPUN's instrumentation, controls, and equipment within the control room.
inventory is based on photographs used for a mockup which include all This includes all main components with which the operator interfaces.
The actual inventory is control panels and visual annunciators for alarms. The compilation of the included in a set of reproducible drawings.
inventory appears to be complete.
Other than this information, there is little discussion in either of Oyster Creek's submittals as to how the capabilities represented by the inventory were compared to the requirements identified through the analysis identify Although a comparison was conducted to of operator tasks.
discrepancies, there is little information as to whether the inventory provided an indication of component use and characteristics (i.e., para-meters, unit of measure, range of display, etc.) for comparison to require-There is no discussion of data ments identified in the task analysis.
for cataloguing existing controls and displays and their management characteristics to ensure that verification of control and di s pl ay Further discussion of these availability and suitability were addressed.
issues and a description of the method used to identify missing and/or inappropriate controls and displays would have permitted a full evaluation of GPUN's understanding of the requirement.
4.
The Control Room Survey GPUN conducted a survey of control room components to identify any characteristics of instruments, equipment, layout and ambient conditions
(
that did not conform to good human engineering practice.
The survey
[
- 1) a panel review (controls, displays, panel layout, process included:
computer displays); 2) survey of alarm systems; 3) survey of control room environment (ambient conditions, lighting, sound, workspace, communications, etc.).
Survey resul ts were obtained by reviewing photographs of panel l
Although never mentioned, it is assumed that components from the inventory.
measurements and observations were made in the control room itself, as 11
~ ~ ' '
,,w
These results were then compared to detailed human engineering necessary.
These guidelines, guidelines prepared for the Oyster Creek control room.
shown in Appendix A of the program plan, were developed from guidelines contained in MIL-STD-1472B (Reference 10) and human engineering references such as VanCott and Kinkade (Reference 13) and Woodson and Conover The development of such guidelines was necessary as GPUN (Reference 14).
conducted its survey of Oyster Creek prior to the issurance of the NRC DCRDR guidelines (NUREG-0700).
Both the objectives of this effort and areas of survey considera-tion are consistent with the requirements described in Supplement I to Whether the requirement has been met completely is difficult to NUREG-0737.
because information necessary for a valid assessment has assess, however, For example, although the survey did not been provided by the licensee.
include panel layout, it is unclear as to whether all primary control panels It appears that the Remote Shutdown Panel was not surveyed were included.
A drawing of the as it is currently under construction and evaluation.
contro17oom layout, including all panels surveyed, would be valuable to the Furthermore, there is no indication that a thorough set of items review.
and indicators was included in the survey.
GpVN has described neither the methodology nor the procedure used to conduct the survey task and has provided no examples of checklists or other data gathering instruments used The licensee's report could be enhanced by inclusion to complete the task.
of such documentation and information and would have facilitated our evaluation.
The fact that there may be differences between the specific guide-lines used by the licensee to conduct its survey and NUREG-0700 guidelines There are, in fact, differences between MIL-STD-is of particular concern.
1472B and NUREG-0700 guidelines in scope and breath.
Thus, although it is clear that a control room survey was conducted basically in accordance with the requirements of Supplement i to NUREG-0737, the completeness of the effort cannot be assessed until the licensee provides documentation to show a comparison between guidelines it developed and used and those in NUREG-0700.
12
l.
~ ASSESSMENT AND IMPi.EMENTATION PHASE GPUN's assessment and implementation phase is addressed in Section Section IV of the summary report provides a summary V of the program plan.
of conclusions and Section V describes the corrective action plan to resolve A summary of review findings is discrepancies uncovered by the review.
included in Tables V-I and V-II of the summary report.
HED Assessment Methodology 1.
Overall, GPUN's control room review resulted in the identification Some 20 deficiencies related to the control room of roughly 1000 HEDs.
One hundred sixty eight deficiencies were generated by the environmentally.
Over 800 deficiencies were uncovered by the review of operator tasks.
detailed review of the control room hardware.
HEDs identified during the review were assessed to determine The fundamental criteria were whether corrective action needed to be taken.
- 1) the likelihood that a deficiency would lead to an operator error and 2)
These the impact that such error on the plant would be significant.
The criteria are appropriate and imply consideration of operation safety.
licensee also included plant availability and potential for equipment damagd as secondary criteria.
HEDs were prioritized individually or generically by review team consensus into one of three categories based on likelihood of operator error and impact of such error on the plant.
Categories were defined as follows:
Importance Category A - a deficiency that may impair an operator's performance under off-normal conditions; Importance Category B - a deficiency that is unlikely to lead to situation or can an irreversible operator error in an off-normal lead to operator error und.er normal conditions and/or generic' deficiencies that individually are not likely to degrade perform-ance seriously, but taken together can be significant; and r--,
,-.,-.---ewr----
Importance Category 3 - deficiency which is unlikely to affect operator performance under any condition or a deficiency for which solutions are not readily apparent.
Scheduling of the corrective action for each deficiency was accomplished by placing each deficiency into one of five categories.
1 Scheduling ranged from corrective actions to be taken at the earliest opportunity (Category 1) to accomplishing the correction as convenient as HEDs for which no possible or after the 1987 refueling outage (Category 4).
corrective action was considered necessary were placed in Category 4 as HEDs corrected during the course of the review process were placed in well.
Category 5. "already corrected."
Overall, GPUN'S HED assessment activity somewhat satisfies the requirements of NUREG-0737, Supplement 1 to determine which HEDs are HE')s were assessed individually and in significant and should be corrected.
The output of this aggregate, for their potential plant sa';ty consequences.
evaluation was safety-significan,t HEDs to be analyzed for design improve-Consistent with NUREG-0700 guidelines, several groups of HEDs, ments.
including HEDs considered to warrant no corrective action were subjected to The licensee, however, has failed to describe this a detailed evaluation.
Importance categories are poorly defined assessment process or its purpose.
and do not appear mutually exclusive.
Category 3 places HEDs "for which The apparent solutions are not clear cut" in a low importance position.
ease of correction is not an appropriate criteria for assessing the In addition, GPUN has not documented whether or significance of the HED.
not known operator errors that had occurred were placed in scheduling Category 1 and importance Category A consistent with NUREG-0801 guidance.
In fact, a few examples are provided in the results which indicate placement of such errors in Category B.
Selection of Design Improvements 2.
A brief description of the process to select design improvements Although additional informa-was provided in the licensee's program plan.
tion provided in the summary report was limited, it appears that a number of factors were considered by the review team in selecting design improvements.
Examples of those factors include:
- 1) relative effectiveness of the action u
~ ~ ~ - -.
to. correct the problems; and 2) relative practicality of implementing the Possible alternative design improvements examined by the action promptly.
licensee were changes' or additions to control room hardware and administra-As a result of the tive actions such as procedural changes or training.
selection process, the licensee states that the vast majority of identified About 15% of the HEDs were considered correctible through hardware change.
deficiencies warranted procedural change while about 7% required further study or no action at all.
A review of the proposed corrective actions indicates that the licensee has not corrected the vast majority of HEDs through hardware changes, rather, reliance has already been placed on corrections through Therefore it is difficult to enhancer ants and the addition of a computer.
determine whether the process to select design improvements was conducted with full consideration of alternative solutions that would provide the optimum human factors design.
~
Although it appears that the selection of design improvements was an integral part of the DCRDR performed at Oyster Creek, the licensee's submittals provide limited information describing the actual processes that Little information is were used to select improvements for identified HEDs.
provided on the processes that were used to examine various alternative solutions, their integrated effects on operator performance, and the arrival Therefore, this task within GPUN's Assessment and at a final solution.
Implementation phase is found incomplete until such information is made available.
Verification that Selected Design Improvements will Provide the i
3 and 4.
Necessary Correction and Verification that Improvements can be Introduced in the Control Room Without Creating Any Unacceptable i
Human Engineering Discrepancies Although described brie, fly, it appears that the licensee did implement a process to verify that design improvements would provide the As indicated in the necessary correction without introducing new problems.
{
summary report indicates that all corrective actions were subjected to a i
human factors review and normal plant approval requirements for any changes to the existing configuration, documentation, and training.
It is 15
noteworthy that the licensee has developed a program that requires human factors review for both the conceptual and final designs of all control room modifications.
All corrective actions which involved changes in con' figuration Often, some abbreviated were incorporated on the full scale mockup.
walkthroughs were conducted with operating staff to confirm that the operator's response had been improved and that no new problems had been Apparently not all of. the suggested improvements were walked-introduced.Furthermore, there is no justification or rationale provided for through.
the conduct of " abbreviated" evaluations.
Although the licensee appears to have implemented a verification process, (conduct of walk-throughs), it is unclear from the summary report For example, the if the process adequately satisfies the requirement.
licensee has provided no indicat. ion that design improvements were properly The integrated with all other functions and systems in the control room.
process'by which effects on task performance were examined has not been Therefore, it is impossible to assess whether GPUN's method is elaborated.
a sufficient substitute for the rigorous verification process suggested in
.NUREG-070_0. Sections 4.7.2.1 and 4.2.2.2.
1 Also, tne licensee has indicated awareness of the need to insure introduce new HEDs.
that modifiestions to the control room would not analytical procedure has been provided to demonstrate how this However, n':
Without this information, the effectiveness of the was accomplished.
verification process cannot be evaluated.
ANALYSIS OF PROPOSED DESIGN CHANGES AND JUSTIFICATION F UNCORRECTED FROM THE RESULTS OF OYSTER CREEK NUCLEAR GENERAT Licensees are required by Supplement 1 to NUREG-0737 to submit an outline of proposed design changes, including their proposed schedules for implementation and a summary justification for HEDs with safety significance to be left uncorrected or partially corrected.
The Oyster Creek submittal for the DCRDR has a summary of review This review will retain that organi-findings organized into seven groups.
16
Thus zation, numbering each discrepancy sequentially within each group.
group I has discrepancies numbered 1 through 16, and group 2 has discrep-ancies numbered I through 75, etc..
The following are the results of a SAI evaluation o'f proposed corrections and justifications for no correction.
Group 1: Further Evaluation Required HED Nos. 1-15 i
In many All of the items in this group require futher evaluation.
cases no proposed solution is given. Supplement I to NUREG-0737 requires that evaluation of the HED and a' proposed solution be submitted in the GpVN has not done this, thus all of these items will summary report.
require additional effort before final NRC assessment can be made.
In addition to the above general comments on this category, the following is a listing of the HED number with reasons for concluding that a specific portion of the summary is inadequate.
The description of the proposed problem, recommendation and/
e or implementation is too brief, general or ambiguous to allow a valid assessment.
HED Nos. 4, 5, 13, 14, 15, 16 The description indicates that the SF&TA portion of the DCRDR e
may not have been c'.rried out in great enough detail to For this determine the information and control requirements.
reason it is not possible to evaluate the partial solution proposed.
HED Nos. 6, 10 i
4 17
~ - -
~.
. Relabeling, Demarcating and Other Improvements Group 2:
In general we concur with the surface enhancement techniques
~
chosen by the licensee'to correct _ or improve the stated design deficiencie However, some of the proposed relabeling solutions could not be' completely assessed due to general or vague description of the problem and/or the solution.
Of the 75 HEDs in group 2, we concur with the proposed solutions for the following HEOs.
1, 6, 8, 9, 10. 11, 12, 13, 14, 15, 16, 17, 18, 23, 24, HED Nos.
25, 26, 27, 28, 29, 30, 31, 33, 34, 38, 39, 40, 41, 43, 44, 45, 46, 47, 48, 50, 51, 52, 53, 54, 57, 58, 59, 62 The following is a listing of the HED number and reason for concluding that the descriptions for the solutions are inadequate.
There are many groups of two or more HEDs which appear to be e
related to each other. NUREG-0700 states that if two or more HEDs have a potential effect on the same system, then the cumulative effects could be great enough to justify changing The the importance category from a medium to high level.
following are groups which GPUN does not appear to have considered in this light.
HED Nos. 2, 3, 4, 5, 7; 25 and 26; 27 and 28; 61, 63, 64 and 65; 60 and 66 The importance category appears to be too low.
e i
HED Nos. 2 and 3 are important because if the operator were to be confused about the rod display and the rod selector, possible power shape imbalances could arise.
(
18 f
HED No. 20 - this is a safety-system.
HE'D No. 32 - NUREG-0801 requires that HEOs which have cau operator errors in the past shall be corrected as soon as possible.
The solution does not appear to correct the HEO, or only partially corrects the HED, or is in contradiction to NUREG-e 0700 guidelines.
HED Nos. 19, 21, 49, 56, 68, 69, 72 The description of the problem and/or solution is too brief, e
general or ambiguous to permit a valid assessment.
21, 22, 35, 3C, 42, 55, 60, 66, 67, 70, 71, 74, 75 HED Nos.
The description indicates that the SF&TA portion of the DCROR may not have bee'n carried out in great. enough detail to e
For this determine the information and control requirements.
reason it is not possible to evaluate the incomplete solution proposed.
HED Hos. 37, 42 The justification for not correcting the HED is inadequate.
e HED No. 73 Group 3:
Administrative Of the 27 HEDs in group 3, we concur with the proposed solutions for the following HEDs.
3, 5, 10, 13, 14, 16, 17, 18, 19, 20, 22, 24, 25, 26, 27 HED Nos.
The following is a listing of the HED numbers and reason for t
concluding that the descriptions for the solutions are inadequate.
19
The description indicates that the SF&TA portion of the DCRDR e
may not have been carried out in great enough detail to determine the information and control requirements.
For thi,s reason it is not possible to evaluate the incomplete solution proposed.
HED Nos. 1, 2, 4, 6, 9, 15, 21, 23 (Note on 21 - This should be category A, safety significant, because any reading of water in dry well could indicate a pipe break.)
The description indicates that the validation and verifica-e tion of the new E0ps is not complete on the following HEDs.
HED Nos. 6, 7, 8, 11 The description of the problem and/or solution is too brief, e
general or ambiguous to permit a valid assessment.
HED No. 12 Group 4:
Hardware The licensee has identified a proportionally large number of HEDs related to information that is needed by the operators and is either not The corrective actions provided on the panels. or is not suitably presented.
in this group of findings include removal of unnecessary components, rearrangements, replacement and modifications of existing hardware, and the addition of components.
The evaluation of the proposed corrective actions in this e
group has resulted in a major concern with the use of the
" Integrated Consolidated Display" to provide the information Because displays identified as missing in the control room.
this display has not been described in enough detail we are unable to fully assess its adequacy to correct the HEO.
This concern effects the following HEDs.
HED Nos. 8, 9, 10, 16, 18, 41, 42, 44, 48, 56, 66
/
In general most of the proposed hardware changes outlined in e
The follow-this section appear appropriate and reasonable.
ing is a listing of those HEDs and the proposed solutions which appear to correct the HED.
Note that the limited description of both the HEC and corrective action' limits the In some instances the capabilities of our assessment.
corrective action was not found acceptable due to its scheduling /importance category.
(A discussion of those instances where the correcti te action was found to be inadequate will follow below.)
1, 2, 3, 5, 6, 7, 13, 14, 15, 20, 22, 25, 26, 27, HED Nos.
28, 30, 32, 33, 36, 47, 49, 50, 52, 53, 54, 55 The following is a listing of the HED and corrective action e
number and either a generic or specific reasor, for concluding that the corrective action descriptions are inadequate.
The description of the deficiency and/or corrective action is too brief, general or ambiguous to allow a Also the descriptions for corrective valid assessment.
actions sometimes call for further evaluation to determine the solution and therefore we are unable to fully assess them.
HED Nos. 17, 21, 29, 31, 35, 37, 39, 40, 43, 46, 48, 50, 51, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66 The description of the corrective action only partially corrects the discrepancy.
HED 34:
The need to protect controls has not been addressed by the corrective action.
21
j
\\
The identification of burned 'out indicator HED 45:
light bulbs has not been addressed = by the corrective action.
HED 56:
The need for containment purge 1 and vent controls on front panels has not been addressed by the corrective action.
Due to the safety significance of these findings they were e
found to warrant higher importance and schedule categories than those proposed.
HEDs 19 and 20.
The isolation of the recirculation pump during an accident such as a 1.0CA is important and those HEDs associated with its control therefore warrants a more immediate correction than that indicated in the summary report.
HED 23 and 24. The emergency diesel generators are extremely Therefore the important in case of a loss of AC power.
correction of the arrangement and design of the _. ontrols and c
displays for this operation should be considered of fiigh importance and implemented in tihe earliest possible time-frame.
HED 43.
The water level in the torus is an important safety related parameter for operators and because a failure of the common standpipe would result in a loss of all indication for this parameter this deficiency is considered important enough to warrant a more immediate corrective action schedule, i
e General Comment Removal of this indicator should be postponed until HED 48.
full consideration has been given to the operators needs during any affected tasks.
22
e Group 5:
Computer System Addition The discrepancies listed in this group primarily address the absence and poor lccation/ arrangement of information or feedback required The corrective action des'cribed for the operator to conduct operations.
these deficiencies requires the providing of needed parameter information on.
the plant computer CRT display which apparently is planned for implementa-Several concerns have surfaced as a result of the evalua tion in 1987.
They of these deficiencies and the suitability of the corrective action.
Because of the number of concerns raised with regard are discussed below.
to this action we are not able to find the corrective actions fully adequate at this time.
The extraordinary amount of information that appears to be e
to be corrected by soft-missing from the display panels is ware rather than hardware additions.
It appears that there is an extensive reliance on the computer CRT display for A
correction of seemingly important information needs.
concern with the use of software additions is the failure to provide more basic hardware changes to the control boards with which the operators are considerably more accustomed to
- using, The provision of needed information on the computer system e
The will clearly require some delay before implementation.
schedule category for this is 3, the refueling outage of This appears to be a long delay before providing these 1987.
In addition, considering information needs to the operator.
e.g.,
- meters, the operators' prior habits (use of hardware:
recorders) some further time will ce required to familiarize and train the operators to use the computer as a source of i nformation, A related concern with the use of the CRT display to provide e
missing or poorly arranged information is whether it would indeed correct the deficiency and not create any additional An obvious concern may be that the operator who p robl ems.
has relied on a poor display arrangement to monitor a system 23
~
'l for many years may continue to do so if the arrangement itself is not corrected. See 1ED No.1.
Additionally, it is not clear if consideration has been given e
to the reduction of the computer capability for displaying other operator information needs for which it was initially required.
The following is a listing of the HED and corrective action e
number with either a generic or specific reason for conclud-ing that the corrective action descriptions are inadequate.
The description of the deficiency and/or corrective action is too brief, general or indefinite to allow a valid assessment.
HED Nos. 2, 7, 8, 19, 20 The description of the corrective action only partially corrects the deficiency.
HED Nos. 2, 3, 4, 13, 19 Recorders that are unreadable should be removed when replaced with an improved display.-
Due to the safety significance of this finding it is found to e
warrant higher importance and schedule categories than those proposed.
HED 1.
The states of the torus and drywell variables are safety related parameters necessary to monitor important operations.
The HED associated with the layout of these controls and displays should be addressed in a closer time frame than that proposed.
r 24
s l
~ :
~
Group 6:
Control Room Environment The discrepancies listed in this group contain findings relative The corrective actions for these to the operators working environment.
However, given discrepancies have been evaluated to the extent possible.
our unfamiliarity with the control room and limited information in the several corrective actions can not be fully assessed.
- report, The following descriptions of corrective actions for identi-e fied discrepancies were found to be adequate.
HED Nos. 5, 6, 8 The following HEDs and corrective actions could not be e
assessed with any validity due to our unfamiliarity with the control room and the limited information submitted by the licensee.
HED Nos'. 1, 2, 7, 8, 9,.12, 13 The following HEDs all relate to a poor HVAC system which e
The appears to need extensive modification or maintenance.
proposed corrections fall considerably short of full maintenance or lack a definite planned correction.
HED Nos. 3, 4, 10, 11 The HED description (No. 9) states that "some controls can be i
o jarred by walking by."
It is unclear how the rearrangement The of the traffic pattern will fully correct this HED.
licensee should evaluate the need for a guard-rail to protect vulnerable controls from inadvertent actuation.
Group 7: No Action Required or Deficiency Corrected
)
l This group contains both HEDs that have been corrected and those HEDs that were assessed as requiring no action.
Although the corrective 25
e actions already completed were found to be adequate, _the justifications for not-correcting HEDs were sometimes found inadequate as described below.
The adequacy of the following justifications for not requir-e ing corrective action cannot be fully evaluated yue to the limited description of the deficiency.
HED Nos. 10, 13, 15, 16, 18, 19, 20, 24 The following justifications for not requiring corrective e
action is inadequate for spe:ific reasons as described.
Inconsistent color codes used for the position HED 11.
displays and positions of air operated scram valves for each This display is considered of high importance as the rod.
operation of the air operated scram is crucial for correct Additionally, a operation and shutdown of the reactor.
justification for not correcting a discrepancy should not rest upon the fact that the operator has adapted to a poor design feature (as the licensee has indicated).
A design discrepancy may prove to be hard (to adapt to) for an operator under duress (during an accident).
The isolation condenser control switch is on SF/6F HED 13.
tr. stead of 1F/2F. The licensee states that this is not a serious problem:
no corrective action recommended.
Two concerns related to this finding lead us to conclude that the justification is inadequate.
Firstly, it is unclear as to why this discrepancy was initially flagged as a problem.
Secondly, the isolation condenser control switch is consider-ed to be of safety importance and it does not appear to have received the appropriate importance category.
The licensee indicates there are controls on HED 14 and 16.
the board that are never used but does not propose to remove them.
26
A surplus of electrical displays could confuse HED 15.
Licensee states that there is no evidence of operations.
The need for these displays should have operator confusion.
been confirmed by a task analysis and verification, and a justification then provided.
The justification that operators have adapted to a HED 22.
deficiency is inadequate for an HED that may cause significant problems for an operator during emergency operations (under stress).
The following justifications were found to be adequate.
HED Nos. 12, 17, 21, 23 CONCLUSION AND RECOMENDATIONS GPU Nuclear's Summary Report for the DCRDR demonstrates a commit-ment towards meeting many of the requirements of Supplement 1 to NUREG-0737 The summary report submitted provides documentation and discussion relevant to the Review Team Organization and Structure, the Functions and Task Analysis, a Summary of Conclusions and the Corrective Action Program or the A table attached to the manner in which deficiencies are to be resolved.
report contains a summary of the review findings classified according to the GPU Nuclear has made reference to their
' nature of corrective action.
program plan for the DCRDR for those areas of the review not discussed in the summary report.
Based upon the documentation both in the summary report and the program plan, the licensee has attempted to meet t'he requirements that a However, sparse discussion of most requirements has prevent-DCRDR entails.
Those include the j
ed a valid assessment of the licensee's efforts.
- 1) to conduct a functions and task analysis, 2) to following requirements:
conduct a control room survey, 3) assessment of HEDs', 4) the verification of improvements, and 5) the coordination of the DCRDR with other improvement Due to the brevity of discussion in the summary report and programs.
inadequacies in the proposed corrective actions, and justifications for HEDs left' uncorrected we conclude that a more definitive presentation is i
f 27
necessary to establish the degree to which the requirements of Supplement 1 to NUREG-0737 have been met. Therefore, we recommend that a pre-implementa-tion a0dit be conducted to clarif'y the points raised in this evaluation The concerns report and to provide GPU Nuclear with additional feedback.
raised as a result of this evaluation are summarized below and should be addressed by the licensee during the audit, Identification of task assignments and levels of effort for e
DCRDR team members and supplemental staff.
A description of the scope and procedures used for performing e
the operating experience review.
A description of the purpose and content' of the control room e
inventory.
Control room survey guidelines, procedures, sample checklist e
and data collection forms used.
e Identification of the scope of the function and task analysis; clarification of dif ferences between the "first-cut" procedures and finalized E0Ps.
A description of the process used to identify plant-specific information and control needs and to establish the characteristics required of needed instruments and controls.
A description of the auditable record that contains the data generated from the functions and task analysis.
A description of the HED assessment process; the manner in e
which HEDs were assigned to categories; definition of importance categories to assess HED significance; and the rationale used for including safety significant HEDs in relatively low importance and scheduling categories.
A description of the process used to select design improve-e ments and to ensure the integration of design modifications /
changes.
28
A description of the process used to verify that design
~
. e improvements will provide the necessary corrections without introducing new HEDs.'
A description of the system or the methodology used for e
coordinating the DCRDR with other improvement programs.
A description of the analysis used to develop proposed design s
changes and the justification.for HEDs to be left uncorrect-(Various inadequacies with respect to proposed correc-ed.
importance and scheduling categories for tive actions, certain HEDs, and justifications for HEDs left uncorrected have been described above.)
U 1
29
O REFERENCES
" Program Plan for the Control Room Human Factors Review at Oyster Cree 1.
Nuclear Generating Station," GPU Nuclear, June 1983.
Memo from W.T. Russell, Division of Human Factors Safety, to G.C.
2.
" Review of Oyster Creek Lainas, Division of Licensing,
Subject:
Nuclear Generating Station Detailed Control Room Design Review Program Plan Submittal," February 1, 1984.
" Summary Report on the Oyster Creek Control Room Design Review," GPU 3.
Nuclear, NRC Accession Number 8405150216, April 1984.
"NRC Action Plan Developed as a Result of the TMI-4.
NUREG-0660, Vol. 1.
U.S. Nuclear Regulatory Commission, May 1980, Revision 1, 2 Accident,"
August 1980.
NUREG-0737, " Clarification of TMI Action Plan Requirements," U.S.
5.
Nuclear Regulatory Commission, November 1980.
NUREG-0737, Supplement 1, " Clarification of TMI Action Plan Require-6.
ments," U.S. Nuclear Regulatory Commission, December 1982.
NUREG-0700, " Guidelines for Control Room Design Reviews," U.S. Nuclear 7.
Regulatory Commission, September 1981.
NUREG-0801 Draft, " Evaluation Criteria for Detailed Control Room Design 8.
Review," U.S. Nuclear Regulatory Commission October 1981.
9.
DCRDR Program Plan Acceptance Review for Oyster Creek Nuclear Generating Station, SAI, September 23, 1983.
Military Standard MIL-STD-1472B, Human Engineering Design Criteria for 10.
Military Systems Equipment and Facilities, Dept. of Defense, i
Washington, D.C., December 1974 NRC Staff Review of the BWROG Control Room Survey Program (Generic 11.
Letter 83-18), April 19, 1983.
30
w
.. 1 o
,m,I.
Memo to Voss Moore from S. Weiss, May 14, 1984.
Subject:
Meeting 12.
summary of task analysis requirements for the BWR Owners Group.
VanCott, H.P. and Kinkade, R.G., Editors, " Human Engineering Guide to 13.
Equipment Design," Revised Edition, Government Printing Office,1972.
14.
- Woodson, W.G.,
and Co n'ov e r, D.W., " Human Engineering Guide for i
Equipment Design," University of California Press,1964.
l 1
Oyster Creek TAC No. 51185 l
SAI No. 1-263-07-557-48 Contract No NRC-03-82-096 l
l 31
-,-,n--
~--
- e-i ENCLOSURE 2 HFEB SALP INPUT FOR OYSTER CREEK The DHFS/HFEB Salp Input for the Oyster Creek Nuclear Generating Station is This evaluation is based on our review of the provided for your use.
licensee's Program Plan and Sumary Report Submittals.
Our SALP ratings to date for Oyster Creek are as follows:
1.
Management Involvement and Control in Assuring Quo y - The licensee exhibited evidence of prior planning.
Rating: Category 2 N
Approach to Resolution of Technical Issues from a Safety 2.
Standpoint - The licensee has demonstrated viable approaches, but lacks thoroughness ano depth.
" Rating: Category 3 Responsiveness to NRC Initiatives - The licensee provides generally 3.
timely responses.
Rating: Category 2
.