ML20106A525

Technical Evaluation Rept of Detailed Control Room Design Review for Limerick Generating Station

ML20106A525
Person / Time
Site:	Limerick
Issue date:	08/10/1984
From:	Banks W, Harmon K LAWRENCE LIVERMORE NATIONAL LABORATORY
To:	NRC
Shared Package
ML20106A529	List: ML20106A525
References
NUDOCS 8409260607
Download: ML20106A525 (71)

Text

.

- +:___- .- _

=

~. '

% ~*

o o -

/ ...

! APPENDIX A i

i, TECHNICAL EVALUATION REPORT _

i 0F THE l DETAILED CONTROL ROOM DESIGN REVIEW i FOR PHILADELPHIA ELECTRIC COMPANY'S LIMERICK GENERATING STATION j August 10, 1984 William W. Banks -

Kenneth 0. Harmon - -

Lawrence Livermore National Laboratory for the United States Nuclear Regulatory Comission 5

['/d 4'A 06 0 7 y/P

/

A _ _ ._-7 _ a +

.1 v- +-- -

W We nm O D TECHNICAL EVALUATION REPORT OF THE I

DETAILED CONTROL ROOM DESIGN REVIEW i FOR PHILADELPHIA ELECTRIC COMPANY'S j LIMERICK GENERATING STATION ,

l

! TABLE OF CONTENTS

.i i

l-Section Page I 1. Background........................................................... 1 .

l

2. Discussion........................................................... 3 g

3. Review Team Selection................................................ 5 i ..

i

4. Management Responsibility............................................ 6

~

l 5. Data Management...................................................... 6 I

6. DCRDR Schedule....................................................... 8 i

7. Equipment and Workspace.............................................. 9 a

8. Review of Operating Experience....................................... 9

9. Systems Functi on and Task An alysi s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

10. Control Room Inventory.............................................. 12

11. Control Room Survey................................................. 12

12. Assessment of HEDs.................................................. 13

13. Selection of Design Improvements.................................... 15

14. Implementation...................................................... 15

, 15. Verification of Desiga Improvements................................. 16

16. Verification No New HEDs Created.................................... 16

17. Coordination of Control Room Improvements with Other Programs....... 17

18. Conclusions......................................................... 18

19. Conclusion Supplement and Modification.............................. 20

20. Appendix A.......................................................... 23

21. Appendix B.......................................................... 27 l l l

l i

l 1

l l

-iii-l l

. adb ._ . . .- .-- 2 ^ '

2 -

1~~ UK: *M e .

~

TECHNICAL EVALUATION REPORT

! 0F THE DETAILED CONTROL ROOM DESIGN REVIEW i

i FOR

~

PHILADELPHIA ELECTRIC COMPANY'S

, LIMERICK GENERATING STATION.

I

-f

^

1. BACKGROUND l

i Licensees and applicants for operating licenses shall conduct a Detailed Control Room Design Review (DCRDR). The objective is to " improve the ability .

of nuclear power plant control room operators to prevent accidents or cope

with accidents if they occur by improving the information provided to them" ,_

l (NUREG-0660, Item I.D). Supplement 1 to NUREG-0737 requires each applicant or l licensee to conduct a DCRDR on a schedule negotiated with the Nuclear

{ Regulatory Comission (NRC).

NUREG-0700 describes four phases of the DCRDR and provides applicants and a

licensees with guidelines for its conduct.

~ ~

The phases are:

1. Planning i

2. Review

3. Assessment and Implementation

4. Reporting.

l Guidelines for evaluating each phase are contained in draft NUREG-0801.

A Program Plan is to be submitted within two months of the start of the DCRDR. Cunsistent with the requirements of Supplement 1 to NUREG-0737, the Program Plan shall describe how the following elements of the DCRDR will be accomplished:

l l 1. Establishment of a qualified multidisciplinary review team l

l

- = K e :.L .? D:" ~ J' ' M .' _ -. -: J' _: :13M : :WWM

. .. l

)

e q

2. Function and task analyses to identify control room operator tasks  ;

and information and control requirements during emergency operations  !

l'

3. A comparison of dispicy and control requirements with a control room ,

inventory i -

j 4. A control room survey to identify deviations from accepted human l

factors principles q

1

5. Assessment of-human engineering discrepancies (HEDs) to determine -

4 which HEDs are sigt..ficant and should be corrected .

i

6. Selection of design improvements , , ,

i

7. Verification that selected design improvements will provide the necessary correction

8. Verification that improvements will not introduce new HEDs

9. Coordination of control room improvements with changes from other _ _

programs such as SPDS, operator training, Reg. Guide 1.97 instrumentation, and upgraded emergency operating procedures.

A Sumary Report is to be submitted at the end of the DCRDR. As a minimum, it shall:

1. Outline proposed control room changes

2. Outline proposed schedules for implementation

3. Provide summary justification for HEDs with safety significance to be left uncorrected or partially corrected.

The NRC will evaluate the organization, process, and results of the DCRDR.

Evaluation will include review of required documentation (Program Plan and Summary Report) and may also include reviews of additional documentation, l

2 ._ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ - _ _ _ _ . - _ _ _ . - . - _ - . _ . - - . _ _ _ _ - -

a. ' .:: , Mw + gge.n

- ~ .a l

briefings, discussions, and on-site audits. In-progress audits may be a conducted after submission of the Program Plan but prior to submission of the j Sunnary Report. Preimplementation audits may be conducted after submission of the Sumary Report. Evaluation will be in accordance with the requirements of .

Supplement 1 to NUREG-0737. Additional guidance for the evaluation is provided by NUREG-0700 and draft NUREG-0801. Results of the NRC evaluation of a DCRDR will be documented in a Safety Evaluation Report (SER) or SER Supplement. Significant HEDs should be corrected. Improvements which can be accomplished with an enhancement program should be done promptly.

2. DISCUSSION ,

i The Limerick Generating Station, operated by Philadelphia Electric Company ,

(PECo), is now under construction. Plant construction completion is scheduled

] for August 1,1984, at which time PEco desires a low-power operating license

{ for Limerick. As required by Supplement I to NUREG-0737, a complete DCRDR is j required before a license can be issued. The Limerick DCRDR process is in-i progress.

t.

PECo submitted a DCRDR program plan for Limerick and Peach Bottom (Ref. 1) to

~ -

the NRC on August 31, 1983. As part of the Limerick DCRDR, PECo is using a i control room survey conducted at Limerick in 1981-82 by a Boiling Water Reactor Owners' Group.(BWROG) survey team. The NRC staff had reviewed and 1

accepted the generic BWROG control room survey program (Refs. 4 and 5) for use in the planning and review phases of a DCRDR with limiting conditions that are documented in Generic Letter 83-18 (Ref. 6). These conditions require utilities using the BWROG survey program as part of their DCRDR to:

'> 1. Submit an individual program plan to the NRC referencing the BWROG Control Room Survey Program. The plant-specific submittal should:

l

{

a. Document the qualifications of survey team members, including l the number of plant personnel participating and the extent of their participation, l

b. Identify portions of the DCRDR not performed in accordance with the methodology specified in the BWROG Program Plan,

c. Discuss the program for prioritization of HEDs, reporting of

~

DCRDR results, and implementation of control room enhancements.

. 2. Complete the BWROG Control Room Survey Checklist Supplement.

3. Prioritize HEDs, determine corrective actions, develop an implementation schedule, and report the results of the DCRDR to the f

NRC. ,

i4

4. Repeat portions of the task analysis using updated plant-specific

. energency operating procedures to account for differences in the new j procedures.

1 i

5. Update the operating experience review.

The BWROG survey conducted at Limerick was designed to partially fulfill the _

' ~

planning and review phases of the DCRDR. The results of the BWROG survey of

~ ~

the Limerick 1 and 2 control rooms were documented in a report that was submitted to PECo by the BWROG Control Room Improvements Committee on April 6, 1982 (Ref. 3).

The PECo DCRDR program plan for Limerick was reviewed by the NRC staff as the applicant's response to the requirements of Supplement 1 to NUREG-0737 and the guidance in NUREG-0700 and NUREG-0801. NRC staff currnents on the Limerick DCRDR program plan were issued November 16,1983(Ref.2).

A NRC human factors engineering in-progress audit of the Limerick DCRDR was performed at the plant site near Pottstown, Pennsylvania, on December 5 through December 9, 1983. The audit was carried out by a team of NRC personnel from the Human Factors Engineering Branch (HFEB) and the Procedures and Systems Review Branch (PSRB) of the Division of Human Factors Safety and consultants from Lawrence Livermore National Laboratory, Livermore, California.

.p _ _ :. 3 - u , ~. m nwe ._ . .r 9

The Sumary Report for the Limerick DCRDR was submitted June 25, 1984, by

, letter from J. S. Kemper to A. Schwencer. Information in the Sumary Report, I

along with information obtained earlier, was used to evaluate the organization, process, and results of the DCRDR. The NRC was assisted in the ,

evaluation by its consultants from Lawrence Livermore National Laboratory.

Results of the evaluation are sumarized below. _

i i

3. REVIEW TEAM SELECTION l

1 Supplement 1 to NUREG-0737 requires the establishment of a qualified l

! multidisciplinary review team. Guidelines in team selection are found in .

NUREG-0700 and NUREG-0801.

f ..

l The Limerick DCRDR Summary Report states that the review team selected for the l supplemental review of the Limerick DCRDR functioned, in general, as presented i in the Program Plan. This Limerick team consisted of the following:

o One Nuclear /IC Systems Engineer o One IC/ Systems Engineer o One Operations Engineer /SRO , _

o Two Human Factors Consultants This core DCRDR team was supplemented as required by:

o One IC Systems / Power Generation Engineer o One Asst. Operations Engineer /SR0 o Two Shift Superintendents /SR0s The resumes for members of the Limerick team that were not included in the Program Plan were included in Appendix C of the Limerick DCRDR Summary Report.

The position of nuclear engineer was being filled by Team Leader, T. Cabrey.

Limerick feels hat his combined experience and training are appropriate for this position.

7 The Limerick DCRDR Sumary Report states that all team members "were extensively involved in team deliberations and review of solution designs."

The team met to develop criteria, establish procedures, and to review each phase of the supplementary DCRDR. Guidance was provided by the Interlock Group of human factors consultants.

Although details of the specific roles and contributions of each team member are vague in the Limerick Final Report, we conclude that each team member contributed to the DCRDR in their field of expertise.

]

Based upon this review of the Limerick DCRDR supplemental review team's ,

qualifications, the LLNL review concludes that the proposed review team satisfies the requirement of Supplement 1 to NUREG-0737 to establish a

~~

. multidisciplinary review team to conduct a DCRDR.

4. MANAGEMENT RESPONSIBILITY NUREG-0700 guidelines state that support of the applicant's management is

, needed to ensure to the DCRDR team that information, equipment, and all categories of manpower needed to conduct a control room design review.

Although this support was not specified in the Limerick Sumary Report, it appeared to the NRC audit team that Limerick management does support the DCRDR process.

5. DATA MANAGEMENT liUREG-0700 guidelines recomend that methods of data management should be established before the DCRDR is commenced.

Information and data management involves:

o Providing the review team members with reference material such as panel layout drawings, control room floor plans, and piping and instrumentation drawings.

+ _ ~. . a.=. ...a..  ;--,-___w  :: -

M%% ~

o Developing standard forms to be used for recording the results of the control room review, o Establishing a system for recording, storing, and retrieving data ,,

I during the control room review.

The Limerick Sununary Report refers to all reference material required to conduct the supplementary review of the DCRDR as input data. This includes twelve categories such as systems descriptions, lists of acronyms and abbreviations, piping and instrumentation drawings, and panel arrangement drawings. .

~

~

During the course of the DCRDR review process, documentation of findings, ,_

analysis, and results were developed. This documentation is referred to as output data. The standard forms that were developed are discussed and samples were provided in the Summary Report and are described below.

o HED Assessment forms were used to record the discrepancy items, panel locations, problem descriptions, possible solutions,

[ resolution, priority by safety significance, schedule for , _

implementation, and training / procedure requirements. Those forms that were partially filled out by the BWROG Survey Team were completed by an " analysis of each BWROG HED to ensure the nature of the discrepancy was understood."

o HED Significance Checklist forms were used for all HEDs not to be corrected prior to fuel load. "This form was completed by the assembled team, with each team member discussing his perspective of the factors on the checklist." Checks were placed after items considered significant, and finally, a " consensus of significance",

with respect to the probability of the HED causing an operator error, was obtained and recorded.

o HED Verification forms, as included in the Program Plan, were used to review all resolved HEDs. The team used this form to concentrate on the adequacy of the resolution recorded on the HED Assessment a e _ . _

=.  : ' GmunaW .

form. This review considered human factors, engineering design, and safety requirements. It also considered the possibility of the resolution causing another problem either singly or in combination 3

with another resolution. .

o A sample of a Supplementary Operator Experience Questionnaire that _

was developed for the supplementary review was provided.

The Limerick DCRDR team made the decision not to implement the plan to cross reference HEDs by computer matching, as described in the NRC In-Progress Audit Report. Their justification for this change was that relationships between .

HEDs could be determined by the integrated nature of the redesign.

i We conclude that the scope and depth of the data management system, as

! described in the Limerick Sumary Report, demonstrates that the intent of NUREG-0700 guidelines have been met.

6. DCRDR SCHEDULE NUREG-0700 recommends that the planning of the control room review include the

~ ~

development of a detailed schedule of review tasks.

Figure 1 in the PECo DCRDR Program Plan (Ref.1) shows the relative timing of sequences of major activities in the Limerick BWROG control room survey and the Limerick DCRDR process, but does not include a detailed schedule of all review tasks. PECo stated to the NRC Audit Team that there has been no formal Limerick DCRDR Review Team activity since the BWROG survey. PECo also stated that implementation of design improvements to panel HEDs will be scheduled based upon priorities assigned by the Limerick DCRDR Review Team during the HED assessment step. Implementation will be reviewed during the verification step to ensure that modi'ications will correct discrepancies without l

unacceptable side effects.

The Limerick DCRDR Review Team will be responsible for planning, scheduling, and coordinating the total integrated DCRDR. The Review Team plans to do this on an informal day-to-day besis in a manner that will accomplish the required w c _ 2 ~

. , _ . _ . _ ~ ~ ' =n wM _a b 4 c

p i ,

5 tasks within a predetermined time period. Attendance at the Review Team meetings will be determined by the needs of the agenda at each particular -

meeting. j We recomend that the team leader anticipate and schedule the Limerick DCRDR

tasks so that they may be executed in a way which will ensure the timely _

completion of the DCRDR.

7. EQUIPMENT AND WORKSPACE .;

NUREG-0700 recomends'that: .

Workspace requirements and equipment needs for the Review Team need to be , , _

{

considered during the planning phase. Office, storage, and meeting space I

should be provided for the Review Team and for any part-time consultants and specialists. Equipment needs (e.g., sound-level meters, light 3,i meters, and photographic equipment) should be determined, and plans made to obtain all necessary equipment before the design review is initiated. Thought should be given to the means by which alternative i design improvements are evaluated. Where space is available, the use of ~ ~

mockups to accomplish this evaluation process should be considered.

, Although not specifically described in the Limerick Summary Report, the NRC Audit Team observed that adequate clerical, reproduction, and other peripheral j support services have been available to the DCRDR Review Team. We conclude that Limerick management has made the decision to meet the guidelines of

]

NUREG-0700 for equipment and workspace throughout the complete DCRDR process.

4 8. REVIEW OF DPERATING EXPERIENCE I

The NUREG-0700 guidelines recomend that a review of operating experience be performed that includes the examination of available operating experience documents and a survey of control room operating personnel.

As recomended by the NRC Audit Team, the Limerick Sumary Report contains a description of the Supplemental Operator Experience Review and the Licensee Event Report Review.

4

_i

- "s.

~n I

The supplemental experience review was performed in a manner similar to the BWROG methodology. Fifteen operators of various experience levels were given updated questionnaires. Analysis of the questionnaire results has not been completed. Limerick stated in the Sumary Report that they would supply a

~

sumary of the findings as a future supplement to the Sumary Report.

Plant specific LER data from the Peach Bottom plant were reviewed for their applicability to the Limerick DCRDR effort. Emphasis was placed on LERs resulting from plant procedural / operational deficiencies such as updates in plant technical specifications; inadequacies in operator training; and I inadequate or improper instrumentation. Of the 195 LERs reviewed, only 32 ,

fell into one or more of the above categories. Included in the Limerick Sumary Report is a one page LER sumary.

I LLNL recommends that the limerick supplement to the Sumary Report should

! include a sumary of the major results from tne document review and operator I

interviews that states how the results were applied to the DCRDR. The NRC should also be apprised of how the results of the operating experience review have been recorded, interpreted, and factored into the function and task i analyses and the identification of HEDs. ,

9. SYSTEMS FUNCTION AND TASK ANALYSIS Supplement 1 to NUREG-0737 requires the applicant to perform systems function and task analyses to identify control room operator tasks and information and control requirements during emergency operations. Furthermore, Supplement 1 to NUREG-0737 recomends the use of function and task analyses that had been

used as the basis for developing emergency operating procedures technical guidelines and plant-specific emergency operating procedures to define these requirements.

The following steps for a top-down systems function and task analysis are identified in the NUREG-0700 guidelines:

1. Identification of Systems and Subsystems,

2. Identification of Operating Events for Analysis,

..u ~ m g

3. Function Identification,

4. Operator Task Identification and Analysis.

Operator information and control needs must be determined independently from existing CR design, and not be influenced by existing equipment.

~

The Limerick Sumary Report states that an " undocumented" task analysis was used to verify that emergency operating procedures could be implemented from the control room. They do not report any general or specific method or data collection technique to be employed or specific variables to be included. The

! report states that a follow-up task analysis will be performed. However, PECo .

i does not specify a time, date or milestone plan for execution. Furthermore, their statements that a " team approach" will be utilized tells us absolutely ,_

nothing about the method they will use.

I f Based upon this review and critique, the utility should be asked to provide a 4

satisfactory response to a request for a detailed implementation plan of execution for the task analysis which includes the following: .

A. Method to be used (step-by-step and complete)

B. Start and completion dates C. Data (detailed) to be collected and rationale for each data element D. Qualifications of the HFE or Task Analysis Expert performing the analysis E. Provide a definition (operational) for "their" task analysis.

i l

This minimum response would allow NRC to assess the scope, depth, utility, and degree of safety related importance or quality of the analysis. It would also ensure that the analysis could be examined from the point of view that it is independent and unbiased with respect to hardware already in place, e.g., that the hardware does not create the mission objectives and functional requirements.

~

m _cu -

.__ _ . _ % av Am s

10. CONTROL ROOM INVENTORY l

Supplement 1 to NUREG-0737 requires the applicant to make a control room

~

inventory and to compare the operator display and control req'uirements e

determined from the task analyses with the control room inventory to determine missing controls and displays.

Since the Limerick Summary Report so indicated that the task analysis has not been completed, it is unlikely that a top down analysis of sufficient depth i and scope was developed to determine the extent of missing controls / displays. .

The performance / execution of the task / systems functions analysis, which is specific to Limerick, should generate control requirements needed for the

'~

inventory comparisons which have not been made. The Limerick Sumary Report is presently deficient in meeting the requirements of NUREG-0737, dealing with these inventory comparisons.

11. CONTROL ROOM SURVEY Supplement 1 to NUREG-0737 requires that a control room survey be conducted to

~ -

identify deviations from accepted human factors principles. NUREG-0700 provides guidelines and criteria for conducting a control room survey.

The objective of the control room survey is to identify, for assessment and possible correction, characteristics of displays, controls, equipment, panel layout, annunciators and alarms, control room layout, and control room ambient conditions that do not conform to good human engineering practices.

As stated in the Limerick Sumary Report, a supplemental CRS was done using checklists developed by the BWROG in order to update and complete the existing survey data generated during the initial CRS. The survey process included the following:

o Panels installed after the BWROG survey were evaluated against the initial and supplemental BWROG checklists.

l l

y _ . .. -__. . ;;. _

. a,_ g y ;; w y ,

y .. .

l l

c Panels which had undergone design changes since the initial survey 1

were reviewed to determine if the changes affected any of the initial HED results.

o All panels were evaluated using the BWROG supplemental checklists.  !

All HEDs from the BWROG CRS and from the supplementary review were recorded on the HED Assessment forms. These forms provided accountability and format for managing each HED. The total number of HED Assessment sheets in the Sumary i Report is 163.

An independent review of human engineering suitability of the control room l panels was performed by the 'anterlock human factors personnel. Items not conforming to general human suitability guidelines were identified as discrepancies and transferred to the HED Assessment forms.

It was stated in the Limerick Sumary Report that a full-scale Unit 1 and Comon Panel plant specific mockup was constructed. In evaluating the report, it was difficult to determine if this was in fact done. If so, was the mockup used to test and evaluate HED corrections and to verify that no new HEDs will

~ ~

be introduced by the design changes?

The Audit Team concluded that the Limerick control room survey is incomplete, but appears to have been executed with reasonable diligence and was adequately documented. The CRS has defined HEDs, and thus will meet the intent of NUREG-0700 guidelines and respond to the requirements of Supplement 1 to NUREG-0737.

12. ASSESSMENT OF HEDs Supplement 1 to NUREG-0737 requires that HEDs be assessed to determine which HEDs are significant and should be corrected. NUR G-0700 and NUREG-0801 contain guidelines for the assessment process.

Selection of Corrective Actions and Significance located on page 1-16 of the Limerick Plant CRDR Sumary Report states that "HEDs not to be corrected prior

L __ w . __ . : .x _. __

=_- . . __ _ _

w : ., w ww . .

to fuel load were subjected to an assessment of significance and safety implications and were assigned a priority as defined in the program plan."

Unfortunately, there is no adequate description of the method used to assess i the significance and safety implications of the HEDs unless the document is referring to a checklist found on page 1-17 and a rating purporting to subjectively measure the probability of a particular HED causing an operator

~

error (page 1-18). If this checklist constitutes the " method" and the rating scale constitutes the " metric", we have the following consnents to make:

1. While a checklist approach is fine, the specific checklist used is intaequate in terms of its total specific content and indicates a ,

lack of knowledge concerning the development, utilization and limitations of this device (checklist) and method.

2. The checklist statements themselves are ambiguous, not behaviorally anchored and are, at best, oblique. For example, under the heading

" Reduction of Effectiveness of the Operator's Body and Mind," they present categories of rating such as undue fatigue and discomfort.

These items are inadequately defined. What is needed is a great deal more specificity in content and definition, and fewer generic

~

high level statements which create inadequate specificity. To amplify and illustrate; How do they operationally define " undue" or

" fatigue"1, the rater would have to read the mind of the individual who constructed the checklist to find out.

3. The approach taken by the Limerick document defines an HED priority based more upon difficulty / cost of implementation rather than on safety significance. This approach is unacceptable and ine.ongruent with Element 5 of NUREG-0737. Safety significance potential should first be determined for categories of HEDs and then be followed with implementation considerations such as time cost, scheduling, feasibility, difficulty. We conclude that more detail is needed to describe the step by step process used to assess HEDs in nroer to determine if the intent of NUREG-0737 is being met.

l t

+ - -

13. SELECTION OF DESIGN IMPROVEMENTS Supplement 1 to NUREG-0737 requires the selection of control room design improvements that will correct significant HEDs. It also states that improvements that can be accomplished with an enhancement program should be l done promptly. l l

The Limerick Sumary Report has failed to provide an ample description of any

" method" employed in the selection of improvements. It would be sufficient to ask for a series of stepped examples of how they accomplished this facet of 0737, and describe the criteria they employed in making or arriving at their conclusions. A simple description which provides a clear picture of the method and criteria would be sufficient. It is further suggested that any and ..g all safety related HEDs delayed for corrective action until after fuel loading be justified in writing by the utility stating the reason for the delay and providing a specific date as to when the HED will be corrected and the milestone schedule.

14. IMPLEMENTATION l

~

NUREG-0700 describes guidelines for determining the implementation schedule for design improvements.

An implementation schedule that includes each verified improvement should be prepared. The schedule should address completed improvements (generally, surface enhancements), improvements which can be made without interference with plant operations, and improvements which can only be made when the plant is not operating. Delays in accomplishing the imple:nentation of any design improvement should be justified. Provision should be made to obtain feedback on how the improvements are working out in practice. Procedures should be established to ensure that the documentation of implemented design improvements extends to the updating of operating procedures, drawings, and training programs.

This component was omitted. Specific dates and schedules were not listed in the Limerick Sumary Report.

i 1

The Audit Team expected that PEco will generally follow the guidelines in NUREG-0700 and NUREG-0801. PECo should correct as many Limerick HEDs as --

possible prior to loading fuel. An implementation schedule acceptable to the NRC should be provided for all noncompleted HED corrective actions. PECo should provide justifications for all HEDs not corrected or partially corrected. It is recomended that the Limerick DCRDR Sumary Report include sufficient descriptions of the implementation methodology and of the audit trail of records so that the NRC staff can accurately evaluate the HED correction process.

15. VERIFICATION OF DESIGN IMPROVEMENTS Supplement 1 to NUREG-0737 requires verification that selected design ,,

improvements will provide the necessary corrections of HEDs.

For all of the HEDs listed and identified in the Limerick Summary Report, no section was provided to explain or delineate the verification of

" improvements" or corrective action. Specifically, the report does not comply with NUREG-0737 in providing verification that selected design improvements will provide the necessary or adequate correction needed. In addition, there ,

was no formally documented method as to how or when the utility will verify that the " improvements" will be examined to prevent the unintentional introduction of new HEDs. Perhaps they plan to use the " walk-through" method. If this is the case, they need to specify what criteria and or trade-off considerations they will use, the way they are using these criteria, and how and when they will use them. As the report stands now on this issue, we find it to be inadequate technically, and vague to the point of raising more questions then it was supposed to answer originally.

16. VERIFICATION NO NEW HEDs CREATED Supplement 1 to NUREG-0737 requires verification that control room design improvements will not introduce new HEDs into the control room.

The HED Verification form (page 1-24) has two checklist elements which read:

1. Causes another discrepancy?

2. Adversely combines with other resolutions?

The Limerick Summary Report does not map out, in sufficient detail, how or what method was used to determine an adequate response to these and other items. What criteria was used? How did they go about making this decision?

What factors were included in this " analysis"? How was the decision made to determine that the corrective solution to one HED did not itself infuse another, perhaps more serious HED7 The text does not elaborate to the degree necessary to track what was actually done or the method actually employed. As presently written, the Summary Report does not meet the intent of NUREG-0737, Supplement 1.

17. COORDINATION OF CONTROL ROOM IMPROVEMENTS WITH OTHER PROGRAMS Supplement 1 to NUREG-0737 requires that control roo*m improvements be coordinated with changes from other programs; e.g., safety parameter display system (SPDS), operator training, Regulatory Guide 1.97 (R.G.1.97), and emergency operating procedures (EOPs).

The Limerick Summary Report does not provide an adequate description of the method used to coordinate changes from other programs. Hence, it is impossible to state whether this item was satisfactorily addressed.

PECo states in Section 2.4 of the DCRDR program plan that integration and coordination of other post-TMI initiative activities as required by Supplement 1 to NUREG-0737 will be completed prior to the completion of the DCRDR. The results of the designs and requirements from these post-TMI initiatives are to j be made available to the DCRDR Review Team for coordination with the enhancements and corrections of other HEDs. PECo plans to refer any difficulties found in integrating control room improvements to the PEco design group for resolution and coordination with the DCRDR team. After control room l improvements are installed, they will be followed by walk-throughs for validation purposes.

i

o -

The PEco program plan acknowledges that the following initiatives must be coordinated: ..

o Emergency Operating Procedures, o Accident Monitoring Instrumentation - R.G. 1.97, o Safety Parameter Display System, o Emergency Response Facilities,

. o Detailed Control Room Design Review.

The NRC Audit Team noted that operator training is not mentioned and recomended that PECo address this issue in the Limerick DCRDR Sumary Report.

The PECo Sumary Report does not describe the specific details or methodology

~

of how the coordination was accomplished. PECo stated to the NRC Audit Team that, up until now, the PECo Review Team Leader has done the coordination of all initiatives, except procedures, using the part of the BWROG Committee responsible for R.G. 1.97 instrumentation. This coordination was done informally in meetings without documentation or letters of transmittal. PECo

~

intends to implement design improvements thrdugh Bechtel Corporation via

~ '

sormal construction and installation processes.

18. CONCLUSIONS The following items in the Limerick Sumary Report have been reviewed and found to be inadequate with the intent of Supplement 1 to NUREG-0737:

l 1. Limerick committed to perform a detailed task analysis. The plant specific task analysis proposed to identify control room operator tasks and information/ control requirements for emergency operations should contain a complete description of the method, data, and documentation.

2. Since the plant specific task analysis was not performed, an adequate comparison of display / control requirements with existing control room inventory was not made.

t- . - _ - _ _ .. . __ - _ _ . .

\

3.- The method utilized to assess HED significance was insufficiently l detailed and explained. The checklist of significance was found to --  !

be inadequate in content for use on a plant specific basis. In many i instances, HEDs identified as highly significant by the BWROG method  ;

were considered to be relatively unimportant /significant in the Limerick Sumary Report. ,

4. The specific process used to verify that selected design - -

improvements will provide necessary correction was inadequately explained in the Limerick Summary Report. In this regard, the report lacks specificity and detail.

5. That portion of the Limerick Sumary Report which was supposed to

'~~

6ddress the process whereby new design improvements would be verified not to introduce new HEDs was inadequate.' To say that this will be accomplished via " walk-throughs" is sufficiently vague to require more information. We cannot determine whether the requirements of NUREG-0737 are being met.

6. Supplement 1 to NUREG-0737 requires that control room improvements

~ ~

be coordinated with changes from other programs; e.g., safety parameter display system (SPDS), operator training, Regulatory Guide 1.97 (R.G. 1.97), and emergency operating procedures (EOPs).

The Limerick Sumary Report does not provide an adequate description of the method used to coordinate changes from other programs. Hence, it is impossible to state whether this item was satisfactorily addressed.

j The following items have been reviewed and found to be consistent and compliant with the intent and content of Supplement 1 to NUREG-0737.

.1. Tne Limerick Sumary Report adequately establishes the multidisciplinary Review Team members.

2. The Limerick Sumary Report indicates that the control room survey I

utilized to identify deviations from accepted human factors 1

l principles was satisfactorily executed, but was incomplete. (See Appendix A, Parts A and B.) -

19. CONCLUSION SUPPLEMENT AND MODIFICATION l As a direct result of the initial findings (Sections 9-17) and subsequent  ;

conclusions (Scc'. ion 18), a meeting was scheduled and held on August 7-9, 1984. The objective of the meeting and subsequent audit was to resolve issues based upon the TER conclusions generated by LLNL concerning the Limerick Summary Report. Representatives fro;n PECo, LLNL, NRC, and Interlock initially

met in Bethesda on August 7, 1984, and the audit took place at Limerick on August 8 and 9, 1984. The following issues were addressed with the corresponding resolution

,,

1. Systems Function and Task Analysis (Section 9)

PECo and Interlock representatives verbally agreed and committed to supply a detailed task analysis method, operational definition, data to be collected and rationale for each data element inclusion to NRC along with the completed analysis no later than June 30, 1985. , _

2. Control Room Inventory (Section 10)

At the present time, the control room inventory and comparisons between functions and equipment had not been completed. PECo and Interlock representatives verbally agreed and committed to successfully execute this task as stated in NUREG-0737 and in a manner described in NUREG-0700 by June 30, 1985.

3. Control Room Survey (Section 11)

While the present control room survey of Limerick is incomplete; l

both PEco and Interlock representatives agreed to complete the l survey and implement all improvements of safety related HEDs before October 31, 1984, with the exception of the HFE evaluation of the SPOS. The SPDS evaluation will be conducted before fuel loading.

4. Assessment of HEDs 4

Because of our findings listed on page 14 of this report and the conclusions generated (page 18, item 3), we asked Interlock and PECo to verbally describe the method and process used to assess each HED. They executed this verbal description to us in a manner which indicated minimal compliance with NUREG-0737 and additionally provided written documentation to support their verbal descriptions. This evidence is to be found in Appendix B of this report.

5. Selection and Verification of Design Improvements (Sections 13 and ,,,

15) i Since the Limerick Summary Report was initially found to be deficient in providing a traceable method utilized to identify design improvements, PECo was asked to provide verbal stepped examples of this process and a written general methodology which they did to our satisfaction. Mockups were used to test and , ,

evaluate HED corrections and verify no new HEDs. We now conclude that the materials included in Appendix B along with the audit / evaluation and verbal explanations we received indicate adequate compliance with NUREG-0737, Supplement 1, regarding the selection and verification of design improvements.

6. Verification that No New HED Created Originally, the Limerick Sumary Report did not adequately detail the method or process used to verify that design enhancements used to correct one HED would not itself create or infuse a new or ,

different HED. As a result of discussions held on August 7-9 and I

the review of additional supplementary information provided in Appendix B, LLNL concludes that adequate verification was obtained to meet the intent of NUREG-0737, Supplement 1.

I

7. Coordination of Coctrol Room Improvements with Other Programs _._ _ _ _ _ _ _

(Section 17) -

No significant change in status (see page 17, Section 17 and page 18, item 6). LLNL recomends that PECo provide NRC with a detailed description of how the coordination process and method will be executed.

4 N -___ - _ _ _ _ _ _ _

20. APPENDIX A Part A This part contains HEDs identified by the NRC Audit Team during the in-progress audit that have not been resolved due to the construction in the control room. The applicant should assess these HEDs and should be required to submit the resolutions and propose a schedule for implementing the corrective actions in sufficient time prior to licensing to permit the staff to conduct a review and document its evaluation. The applicant should.be required to acceptably justify and report any discrepancy which is not corrected.

1.0 CONTROL ROOM WORKSPACE l.1 Since the control room at Limerick is not completed, the arrangement could not be evaluated according to Subsection 1 in Section 6 of i NUREG-0700.

1.3 ~No procedures'or place to store emergency shutdown procedures is provided at the remote shutdown panels. (B110) 2.0 COMMUNICATIONS 2.1 Since the control room at Limerick is not completed, the comunications system could not be evaluated according to Subsection 2 in Section 6 of NUREG-0700.

7.0 PROCESS COMPUTERS 7.1 Since the computer system is not fully installed at Limerick, it could not be completely evaluated according to Subsection 7 in '

Section 6 of NUREG-0700.

7.2 There is excessive glare on the concave keys which make the engraving difficult to read, and there are many unneeded keys among the 70 keys over and above the QWERTY board. (B201)

I 1

. 7.3 Contrast of engraved printing on keys is not very good, using white

~

on gray QWERTY keys. This is due partly to dirt in engraving.

(B202) 7.4 On the printers, the guide on the paper drive covers part of the printing of approximately 16 lines (covers 4 to 5 characters near margin of paper). (B203) 7.5 Printouts are subject to dust cover glare from overhead lights on both front and top - especially from a sitting position. (B204) 7.6 Physical access to printer copy is difficult inside the bottom compartment in front of the printer. (B205)

• 4 Part B -

This part contains a list of HEDs taken from Limerick's Summary Report. It is arranged in HED number order and is made up of 38 HEDs that needed some clarification of the proposed schedule. In general, LLNL agrees with the resolution of these HEDs, but any schedule for implementing the corrective ,

~

actions after fuel load should be justified in sufficient time prior to

~

licensing to permit the NRC staff to conduct a review and document its evaluation. The applicant should be required to acceptably justify and report to the NRC any discrepancy which is not corrected.

HED No. P

_E_P, Schedule Remarks Al-01 4 F.L. Will the resolution as stated be done on all annunciator panels by fuel load?

Al-02 4 2nd R.0. What is the justification for the 2nd R.O. and what is the interim proposal?

Al-03 4 Coord. with The general discussion is vague Ann. Impr. and seem to imply that this schedule can mean from F.L. to not at all. Any delay after F.L.

should be justified to the NRC.

l l

l l

HED No. E Schedule __ Remarks .__ ;_. . _ .

Al-04 4 Coord. with See Al-03 Ann. Impr.

Al-06 6 Coord. with See Al-03 Ann. Impr.

Al-07 6 Coord. with See Al-03 Ann. Impr.

Al-08 6 Coord. with See Al-03 Ann. Impr.

Al-13 12 1st R.O. Licensee should justify to the NRC any delay after F.L.

SA2-02 6 Coord. with See Al-03 Ann. Impr. --=

D2-05 6 Before Criticality The staff agrees with the resolution, but licensee should justify why not by F.L.

03-05 6 Various There are five parts to this HED. Any delay after F.L. should be justified.

D3-06 9 1st R.O. See D3-05d _ _

SD2-03 None 1st R.O. See D3-05d SD3-04 None 1st R.0. See Al-13 SD3-06 None N/A See Al-13 SD3-07 None 1st R.0. Is there any interim schedule?

Any delay after F.L. should be

justified to NRC.

SD3-14 6 N/A When will the HED be scheduled?

Any delay after F.L. should be justified to NRC.

SD3-16 6 N/A See Al-13 SD4-03 6 1st R.0. See Al-13 I2-04 6 N/A See Al-13 I2-06 4 1st R.O. See Al-13 12-08 4 Various See D3-05

3:j . : .

HED No. EP Schedule __ Remarks __ _ _ _ _ . . _ _

I2-12 6 Various See D3-05 15-01 6 Various See D3-05 15-03 6 Various See D3-05

15-06 6 1st R.O. See Al-13 15-10 8 1st R.O. See Al-13 15-11 4 1st R.O. See Al-13 SIl-01 6 1st R.O. See Al-13 SI2-10 8 1st R.O. See Al-13 SI4-04 6 1st R.O. See Al-13 ~ ~ "

SIS-08 6 1st R.O. See Al-13 SI6-01 9 1st R.O. See Al-13 Al-11 3 None Resolution and schedule needs to be approved by NRC.

15-04 9 None See Al-11

~ ~

SI2-04 6 None See Al-11 SD3-15 9 None See Al-11 i

iis , - ,_ . .

Dog

- 4

21. APPENDIX 8 I .

I I

1 s

THE INTERL&K (215)296-7850 P.'O. BOX I44

.\tAL\'ERN. PA.19355 GROUP 14 August 1984 Mr. William W. Banks Human Factors Engineering L-97 Lawrence Livermore National Laboratory University of California - - -

Livermore, California 94550

Subject:

Methodology used in Performing the Limerick Nuclear Power Station CRDR

Reference:

NRC visit to Limerick, 9 August 1984

Dear Bill:

Again, let me express our appreciation for the professional _ ,

manner in which you carried out your assigned task in the referenced meeting.

As promised, I am forwarding the subject documentation for your files.

Sincerely, n / '

u~L. / $ ts & - -

Jo h A. Breslin President l

JAB /jrb '

Enclosure l

l l

1

METHODOLOGY USED IN PERFORMING THE LIMERICK CRDR i ..

Review Phase This portion of the CRDR continued the Control Roon Survey that was performed tur the Boiling Water Reactor Owner's Group as described in the Program Plan. This amplifies ,the (BWROG)

Final Report to describe in more detail the methodology used in completing the CRDR.

The attached flow diagram (Attachment' l) illustrates the sequence of events as tney were . conducted and the more significant interrelationships among those events. The following paragraphs describe the methodology used in each of the activities shown on the flow diagram.

BWROG HEDs An initial Control Room Survey -(CRS) was conducted by the " " "

Boiling Water Reactor Owner's Group (BWROG) in 1982. The methodology used and extent of the coverage was discussed in the Program Plan.

TOP-DOWN ANALYSIS

, In order to maintain continuity between the BWROG Control j Room Survey and the completion process, it was necessary _to investigate each listed HED f rom the BWROG survey. In addition, it was desired to provide an overall check that the initial survey was complete in coverage. Therefore, a top-down analysis _ <

of the control room panels was performed. A panel-by-panel analysis was conducted by identifying instruments by functional groups and blocking in the groups using -arbitrary color codes so that group relationships could be clearly understood. Where the groups were difficult to relate, or were spread out and

intermixed, additional analyses were performed to show functional

flow among controls and indicators. In the process of performing these analyses, it was necessary to consult piping and j instrumentation diagrams (P&ID), and in many cases develop schematic diagrams in order to understand the purpose of installed controls and indicators. The top-down analysis was i

performed by. human factors specialists'who also have experience

in operation of nuclear power plants and have experience in

' conducting previous CRDRs on other plpnts.

l This process provided the ideal vehicle for identifying most of the BWROG discrepancies. This information was used to further j identify and in some cases expand on the initial identification of the discrepancy. The analysis served to place the discrepancies in context and allowed a better understanding of the- interrelational problems that existed on the panels. In a dd i t ion ,. it revealed additional discrepancies.

I i

1 i

SUPPLEMENTAL SURVEY The BWROG Control Room Survey (CRS) was conducted in 1982, _

and some changes had been made to the panels since that time. In addition, because of the state of construction of the Limerick plant, some aspects could not be surveyed in 1982. Therefore, supplemental surveys were conducted to fill these gaps. The methodology used is discussed in the Final Report. This survey resulted in additional HEDs. .

SUPPLEMENTAL EXPERIENCE REVIEW Again, the period of time that had elapsed between the initial survey and the completion of the CRDR resulted in additional experience by operators with the control room as well as operating experience on similar plants, particularly on the Peach Bottom plant. The methodology used in performing these supplemental experience surveys is discussed in the final report.

I HED ASSESSMENT FORMS , , , ,

The results of the owner's group survey of the Limerick plant, conducted in 1982, was a report containing a summary of discrepancies. These were generally listed in single sentence descriptions of each discrepancy or, in some cases, groups of discrepancies. In many cases the exact nature of the discrepancy was not clear without further investigation. Therefore, it was necessary to elaborate on the nature of the discrepancy and to put each in a format that would allow further processing and analysis. Therefore, each BWROG discrepancy was converted to a HED Assessment form as shown in the Final Report, Figure 1-1. _ _

Additional information developed in the Top-Down Analysis was added to the information provided by the owner's group survey.

Discrepancies discovered during Supplemental Surveys and Supplemenal Experience Reviews was recorded directly on the HED Assessment forms. A complete accounting of all discrepancies was then compiled in the HED Assessment format. Most important, these HEDs were understood in the context of the existing panel arrangements as well as being individually understood.

The initial intention was to correct most of the discrepancies, without regard to priority, prior to fuel load on this NTOL plant. For this reason, actual determination of priority of HEDs was delayed and the design of corrections was started immediately. With this exception of the order in which the determination of HED significance and assignment of Priority with respect to safety significance was determined, the methodology described in NUREG 0700, sections 4.2 and 4.3 were followed exactly. Further description of the methodology of assessment of priority is provided later in this explanation.

Until this point, most of the work was performed by the human factors consultants who have expertise in both nuclear plant operation and human factors. l l

2  !

ASSIGNMENT OF HEDS Experience in conducting CRDRs on other plants made it clear that initial HED assignment to correction catagories can be inaccurate because it is difficult in many cases to predict how the discrepancy will finally be corrected. Therefore, HEDs were divided into only three catagories: (1) those that would be corrected by enhancements, (2) those that represented a class of problems that would have corrections designed as a group, and (3) those that represented seemingly unique problems that must be resolved individually. The HEDs were then assigned to catagories labeled: Enhancements, Class, and Indivdual.

Assessment and Implementation Phase HF BRIEF With the commencement of the assessment and correction phase, the CRDR core team was assembled for the first time. The ==

first session provided a human factors briefing for the team.

This briefing was conducted by the human factors consultants and provided for discussion and interaction with the team.

Discussions were encouraged and the team discussed specific examples of principles being presented that related to the Limerick and Peach Bottom plants. The reactions of the team to this briefing were considered to be very satisfactory and provided a sound basis for continued cooperative efforts.

Attachment 2 is a copy of the briefing outline as actually given.

CRITERIA The first step in the entire correction process was to have the team define the criteria for the redesign of the control room. This criteria was developed interactively with the team, led by the human factors consultants, and was agreed to by the whole team. The attached summary of criteria (Attachment 3) is labeled Enhancement Criteria because it was first discussed with the team in relation to commencing the enhancement effort.

Neverthelacs, the criteria represented the basis for the entire correction effort for Class and Individual HEDs as well as enhancements.

PANEL DESIGN AND IMPROVEMENT Because the enhancement effort commenced first, and consisted of a major revision to the layout and appearance of the control room, it set the context in which all other changes in response to HEDs would be made. The redesign of the control room proceeded directly f rom the Top-down Analysis conducted in the first step described in this discussion.

After the team agreed on the design criteria as just described, it was agreed to develop a sample design for one section of control panels. This design was developed by the human 3

. factors consultants. It was based upon the human factors criteria provided by NUREG 9788_ and conformed to the criteria developed by the team. The process of design included.an.indepth analysis of -

the purpose of each control and indication on the panel as. well as the system configuration.

In order to prepare for this detailed effort, the human f actors design team was given a two day tutorial by the Limerick training department. This served to ground the designers very well. in the operating and systems design philosophy of the Limerick plant. The personnel used in this redesigned effort are persons experienced in human factors design and in nuclear power plant operation.

In the process of training instruction, it was found that the overall system diagrams used in training had system layouts that, although correct, did not conform well to the arrangement of systems on.the control room panels. Therefore, the first step of redesign was to develop an overall system arrangement schematic that conformed with the actual panel layouts. of the ..

control room. It included the valves and machinery controlled from the control room. This served as a basis for grouping

~

controls and instruments and for the development and redesign of mimics on the panels. By redesTgning, using an approach that was integrated by the overall system layout, there is an understandable continuity of mimics and control layouts throughout the control room. Attachments 4 and 5 are copies of the before and after integrated system diagrams.

The initial panel enhancement redesign consisted of not only enhancements, but suggested physical changes that involved moving controls and indicators as necessary to better group functions and allow the addition of effective mimics. The redesign also included a complete revision of all labels on the panels to provide reduced wording by the use of hierarchial labeling and a consistent set of terminology. The terminology was prepared from a list of standard names and abbreviations developed by Limerick operations for use in emergency procedures, and was modified to include additional terms and suggest revisions to some entries.

The new terminology list (Attachment 6) was prepared as a manual entitled Nomenclature for Control Room (Proposed). This manual was kept updated through the redesign effort.

Extensive use was made of available reference data such as original panel prints, label data, and P& ids. This data was augmented by a photo mosaic prepared to support analysis and preparation of the full scale mockup. In addition to available data, it was necessary to visit the control room to make additional lists of instrument identification and nomenclature.

The CRDR team, augmented by additional operationally l experience personnel, reviewed the initial redesign in great detail. Each control and indication label was reviewed as well as the grouping and relationships. Colors were assigned by general systems and were used to help related functions on the panels.

4

- . . - - ,. . -_. -.. . - .~ - -

$ ' *^

• j The team- made on - the spot revisions, and talked through the-

.conventior.s .used in order to set the methods to be used for. all -

panels. To ensure acceptance at all levels of Philadelphia 4 Electric Company, the panel redesign for the initial panels was

, implemented on a. full scale mockup being constructed.by the human factors consultants for review by higher management. Approval was obtained, from the company president. Redesign drawings in color were then prepared for all pertinent control room panels.

REVIEW / APPROVE

^

Panel designs were submitted serially for review by team members. These designs were submitted to team members individually with time to carefully review all details and make

!. written. comments. Additional reviews of these drawings were made by design engineers and plant operators, where considered necessary, to ensure accuracy and acceptability. These efforts were coordinated by the CRDR. team leader and comments' were

! provided in detail to the human factors consultants for review

-==

and implementation. These comments were given to the . consultants as suggested changes to be implemented based upon good human fcctors practices. Where the consultants considered the suggested change to be inappropriate, the item was discussed with the team l leader and acceptable solutions were agreed upon. Where j necessary, the person originating the comment, as well as other i experts. were consulted. All agreed upon changes were then incorporated into the redesign.

$ CbASSIMPROVEMENTDESIGN All HEDs assigned to class improvements were further

arranged in improvement groups so that similar improvements could be designed as a class. The methodology for analysis of design i alternatives described in section 4.2.2.2 of NUREG 0700 was used.

As suggested in that methodology, the human factors consultants analyzed all HEDs and prepared recommended resolutions to

. discrepancies. Each resolution was reviewed for compliance with i the human factors criteria in NUREG 0700. Designs were integrated l

with the panel redesigns being developed under the enhancement effort. Not all recommended resolutions conformed to all human i f actors criteria because compromises sometimes had to be made to fit with other design requirements as well as the correction of other HEDs. Very of ten separation criteria for safety systems prevented full compliance with all human factors criteria. Where all criteria could not be met, the 4pctors were pointed out to the team during the review of resolutions discussed later. Where

the ideal resolutions for different HEDs resulted in conflict, i the best overall arrangement was developed based upon the panel

design- revision drawings in a manner that best suited the needs of the operator. .In such cases, the needs of the operator were verified with team members having actual operating experience.

l

! The panel redesign drawings thus became much more than enhancement drawings. They represented the integrating factor for

! all design improvements. This was true whether or not the actual 5

O 8 proposed solution to a HED discrepancy appeared on the improvement drawing. The drawing still set the context and standards for the design. -

The design of HED resolutions usually required extensive technical investigation and team analysis. This was accomplished by many visits to the control room to identify design details, and referral to the engineering staff for additional design information and review. Often, a functional analysis was conducted by members of the team using operational experience to analyze the specific use and sequence of events in the use of the discrepancies being investigated. To coordinate these investigations, an action item tickler system was developed and maintained on the computer by the consultants to ensure timely follow-up and resolution of technical questions.

Extensive status lists and cross-refarence lists were maintained on the computer to keep track of HEO resolutions and to coordinate their completion. A cross-reference list tied HEDs in correction catagories to panels so that all HEDs pertaining to .

each panel could be reviewed for consistency.

The overall effect of this integrated approach to HED resolution design was an effective method of ensuring that the resolution of any HED did not conflict with other resolutions, and that they did not create new discrepancies.-

INDIVIDUAL IMPROVEMENT DESIGN The design of resolution to HEDs that represented a unique ~

4 problem, not directly related to other HEDs, was performed in -

exactly the same way as for Class designs. All design changes from both individual HEDs and Class HEDs that could be represented on the mockup were (are being) included on the mockup.

REVIEW HED RESOLUTIONS When proposed resolutions had been developed, the CRDR team met to review resolution and to designate the approved resolution. This was by no means a perfunctory approval. Each HED was thoroughly reviewed and discussed. At this time the relationship of the proposed resolution was considered with respect to other resolutions and the overall panel design.

l Members were by this time thoroughly familiar with the panel redesign plans and most HED resolution efforts. This enabled design consideration to be discussed from many points of view. In many cases, the resolution was revised to meet new requirements that were not known to the consultants when designing the proposed resolution. In some cases, the proposed resolution was l found to cause new problems and was revised to ensure compatibility. For some, additional technical information was required. These discussions were led by the human factors

! consultants, but were by no means dominated by them. All members l

of the team represented decision making levels in their area of

! 6 l

b' .

expertise so that decisions by the team could be considered to be grounds for proceeding with preparation for implementation. -

i A technique of assigning resolution codes imposed a discipline on the team. These ensured that the degree of compliance with the human factors guidelines in NUREG 8700 was understood by all members. These codes are defined in the Final Report, Table 1-3. Codes suggested by the consultants were reviewed for each. HED, and for each item within a HED where required, and verified or changed. Changes were frequently made to mora accurately identify the. degree of compliance. Where compliance was not complete, the rational for~ deviation was addressed in the. resolution. This ensured that the team was completely aware of any deviations from human factors guidelines and understood the reasons for deviation.

The main emphasis of this review was to ensure that. the HED resolution solved the identified problem and that it did not create a new HED. During this review, the team also identified any special additional requirements that existed for training or listed

..c operational procedures. Only special requirements were since it was initially presented that all changes to the panels i and components must be identified to the operators through a special training session. This review resulted in being 4 major I

step toward the verifiction required by Supplement 1 to NUREG 0737.

SIGNIFICANCE / PRIORITY / SCHEDULE s

The team then met to determine the significance of the HEDs, ~

• and to assign a priority with respect to safety, and finally, to assign a schedule for completion. All HEDs that would be implemented in the control room prior to fuel load were exempted from this process. The methodology described in NUREG 0801, section 4.2 was followed. Exhibits 4-1 and 4-2 in that document were reorganized for better team understanding and a discription of the process to be used by the team was given to the team prior to starting the process. Attachment 7 is a copy of this

instruction The items were discussed among team members and the procedure explained. Then a trial use of the HED significance list was used and the process was further discussed until all members understood the methodology.

The HED Significance list is shown in the final report as Figure 1-2. It is a condensation of the explanation provided to L the team and was used as a reminder list. Team members referred to the more detailed list as necessary. The method used was to have each member review the statement of the HED discrepancy, and then independently review the significance list to identify which factors applied to that discrepancy. Each member presented his own point of view. Then the team discussed the items suggested by each member in turn. The reasons for selecting the applicable items from the list were explained and discussed by the team.

Much give and take was involved in these discussions. The recorder completed a list by checking those items that were 7

agreed upon by the team, however, no items were omitted that any member felt should be included. With this agreement on the human factors involved, the team then discussed and agreed by consensus as to an overall statement of the significance of the HED. This was indicated on a significance scale of 1 to 5. This was an agreed upon subjective estimation by the team of experts. The term probablity was meant in the normal English sense, not as a statistical probability.

The owner's group provided an Evaluation Product (EP) in their survey format. This EP is noted on the HED Assessment sheet for each HED that was originated by the BWROG. The methodology for development of the EP is explained in the BWROG Development and Methodology description and the appropriate part is Attachment 8. The method used to get the EP was generic in nature and did not necessarily apply to the specific HED discrepancies found at the Limerick plant. The team noted when the EP differed from _it's own estimation of the significance level and discussed the difference. The assigned significance " " "

level in all cases considered the EP. At the time the significance level was determined the team had a great deal of knowledge of each HED and therefore was qualified to determine the level for that specific discrepancy.

Then, refering to a list of safety related systems and other criteria, again used as a reference list, the team considered the safety significance of that HED. This list is Attachment 9.

Finally, the team considered the definitions of priorities with respect to safety as listed in Table 1-2 of the Final Report

( Attachment 10) . The first two priorities are safety related and - .

are taken from section 4.2.2 of NUREG 0801. The Priority 1 definition is a summary of catagories IA,B,C, IIA, AND III. This catagory pertains to HEDs that should be corrected as soon as possible. Priority 2 summarizes catagories ID, IIB,C and pertains to HEDs that should be corrected by the next refueling outage.

Priority 3 are HEDs that are not safety significant, but could result in reduced operational reliability. Priority 4 are HEDs that would not result in significant improvement and may or may not be corrected. The selection of a priority was first done in the same manner as the selection of the significance levels. Each member made his own decision based upon his particular expertise, then the team discussed the selections thoroughly and arrived at a Consensus.

VERIFICATION Finally, a verification of each HED was performed by the team. This consisted of joint discussion of each item of the HED l verification checklist shown in Figure 1-3 of the Final Report.

l Each item on the checklist was discussed individually by the

( team, using their individual expert knowledge, and then arriving

! at a decision on each item as either satisfactory, or requiring l some revision. If revision was required, revisions were made l immediately if possible. This checklist procedure resulted in l many revisions to the various aspects of HEDs considered. These 8

l

checklists were completed for all HEDs. Reference was made to supporting data and panel designs as necessary. Item 5 specifically considered compounding effects with other HEDs and -

the possibility of creating a new HED with the resolution chosen, as required by NUREG 0737, Supplement 1.

FINAL VALIDATION The final validation will be accomplished as a walkthrough by a team of operators on the completed mockup in the final intended configuration. The methodology described in NUREG 0700 for validation walkthroughs will be used. A discription of the methodology will be provided with the report of the validation results. This validation will be the last step in the process of verifying that HED resolutions satisfactorily resolve the discrepancies and that they do not conflict with other resolutions or cause new HEDs. This validation will also address the integration of other initiatives of NUREG 0737.

TASK ANALYSIS A task analysis will be performed as agreed with the NRC and the methodology will follow that described in NUREG 0700. It will be described with the report of the task analysis and verification.

l l

9

! ;l i .i - I i ,

"l . i '

l{ I

- l l LT a AN u UEN d DMG j; W i I IEI E *v ' VVS l'  ;!I LI i IOE AV d DRD TE n NP 4 R t I IM E I ME EC LN PE PI ~

Ul l ,

SE P P U - A X DK E NC A0 1 E ~

CE B3 8  :  !

d NV AO I

I R -

NP EM I

• w E

T i .

4 S E S 4 f '

E E 1 l M . :

C 4 V .

O l ]l 1I O E .

t i T R V N P S N s P O / O -S D E T t M R S E N

I E

N. M N n F A I P DN C T I DI l l . S I SS Es e E I P EO N/ n A -S H 0S S 1~. MD u I R D A l a I AYE i D Y C J 0Y ER NE e I I E N T CTL T I - AL ,

T h

. L SO Gl i I

ic +  !

! T t A T / hU IIU -h s LA t PA SF I n I EL FRD I N

C h ON A SP a F R il h IO IOE V I P rA SO h l i E G C VS NIH F -A

.  ;  : i ; ,I il(;, ,f  ;;

= 'e IlunAN FACTORS BRIEl It43 Ii4T110DUCTIOX -

k Cain Nutiny -

geniouses...................... idiots j In training -

very smart people.............. difficult Design philosophy - plant protects itself....... cookbook H0n IT iiAPPENS 140h Engineering integration -

control interface Correct problems People side -

CR designed by engineers heet systen requireraents Training - froa basic data Scheuatics - f ror.1 draftsuen ..

Operator input: Problems .. experience - op requireuents

, Personal preferance

• conflicting what they are used to Constrained input ahats possible MUNTAL '.OhKLOAD .

Collect - what, finding, reading, renenbering

( . s Collate -

organize, coupare, convert, calculate recall requirements, plot Analyze - Deduce systera status alignment

- Determine cause of probler.'.

- Determine action

4EED to be TIED TOGETHER Make the most of what we have Easy to learn -

easy to renenber -

easy to operate Thinking in patterns Schematics -

training schematics

• panel layout actial plant layout Enhance panels -

etaphasize patterns mimics as reminders relate instruments - functions Guide eye to right place

( Annunciator - patterns raany alarms 1

-ATTCH 2

e .e. --.

' SPECIFICS Labeling- - naue leap out key word _,

- distractions words nuubers

- hierarchy labeling Color - relate functions Logic - operator logic - engineer logic

- functional - syuetrical

- functional - esthetic beauty

- operation -

not - conventional appearacne Meters - easy to use secles, nuubers, bands, key points INTEGRATING Spread out no central location Teau work Second source backup whole picture ' * "

CRT really tie together not just helpful Scheuatics, patterns, labeling, CRT 5

i i

l 2

e ',

• l L.iaA.JCC iiMT CilITEasI A -

i 1

Yhis suggested criteria has been preparec for tecu review cnd conn.cnt. It is intended cs c talking paper fro:.. which the teat. can then settle upon the criteria that will be used.

DLSIGN OcJLCTIVE The object of any iuproveuent designs is to help the operator. alowever, cach operator represents a different set of characteristics in terns of knowledge, skills, 'and exterience.

Therefore it is necesssry to definc a specific operator that will be the object of design.

Criteria:

1 roi. thc point of view of scfeti, the panels .ust be cesignec- for the least experienced person ..>ho ..ill ever be perforuini operations in the control roo....

[ Application:

A s c 1..i n i ...un. , the panels nust be designeu for:

a.A licensed operctor

b. The 1 e r.s t experiences c ossible operator

c. Longest period of clapsed ti:..e bet.;een being licensed and standing first shift as operator.

It may be desirable to give some considerction to operator _ _

trainees. Since there nust be c constant flow of n e .. licensed operators, additional inforuation i..ight be included on the beard that will cid trainees. This :..ust be lin.ited in order to avoid cluttering the Loard. ]

EthiANCE.6E.? T COVERAG E V.hile no particular enhancei.ient can be said to directly effect plant safety, the total ease of operation of the control roolc. can have a significant effect on the error.= and omission of the operator, and upon his cognitive workload in high stress euergency operations. The identification and correlation of information can directly effect the cocnitive workload and therefore the operator's cecision uaking.

"riteria:

1. Safety: Those functions performed under high stress emergency conditions should be supported by panel enhancements tnat reduce the cognitive workload of the operctor.

2. Reliability: Those functions performed under less stressful conditions but could result in degraded plant performance should be enhanced.

l 1

ATTCH 3

W

. o .

3. Deliberate Oieration: Tht s- functions that ar2 performed only under no stress, as delibet<i.e actions do not need -

enhancement.

\

PANEL TERMINDLOGY T e rr..i r.o l o gy refers to the Words uaed on labels and as legends on windows on the panel. The sai.ie teruinology selected for the panels cust be used in tlue operating procedures.

Criteria:

1. Clarity: The words used i..ust clearly inficate the component and function involved.

2. v.caningful: Ync uords used ...ust be acaningful to the operator without interpretation: they should not be in code.

3. Simplicity: Use as fe. words as possible consistent - -

• with 1 and 2 above.

4. Spoken clarity: Operators must use the ter:iinology i n coraaunica tions, particularly during r.oisy, high stress periods of emer ency operations. The words selected nest not be easily confused under these conditions.

5. Operators use names rather than cor.gonent ID numbers when con;.aunicating during emergency operations.

[ Api.li ca tion: (Numbdrs correspond to criteric)

1. Tnere must be enough words to identify a unicue systen, component, and/or function.

2. The m- ning of the word should be easily understood by the operator wi' ut interpretation. This means that English words are t..uch pt. red to a;ronyms. An acronym is a code that 6ust be memorized anc recalled. An English word is native to the operator's's understanding. Abbreviations should easily suggest the English word being abbreviated.

3. To aid the operator in reading labels and legends quickly, only key words should be used so long as the-requirements for clarity and meaningfulness can be met.

Unnecessary words should be climinated. Where possible, hierarch'y labeling should be used so that individual labels.and legends can omit words that are covereo by a hierarchy label.

4 For accurate communications under stress, words should be chosen that will not be confused with other label words. This is particularly applicable to acronyms. For example, LP SI and HP SI tend to be spoken as " lip see" and " hip see". A spoken directive euring an emergency operation to stop the " lip see" punps could be misinterpreted as stop the " hip see" pumps.

. 2

I l

The tendency to phoneticly pronounce acronyt..s is a potential -

l source of cerious error.

5. 14aues on labels should stand out so that the operator can easily and quickly locate the desired instrument. This catability is enhanced by the simplicity of the nar:.c, the size of the font, and the lack of any other distractions. Fewer words 1allos.s 1crger fonts. helocation of component ID n u r..be r s on sei,arate labels, subduing ID numbers with lighter and smaller fonts eliminates distractions and allows the eye to r. tore quickly identify the name. ]

Gl.00 PING Cdril.NCCMI.;TS Detc.arcctions nre used in various forras to group instruments of like functions. .. hen consoles are designed with benchboards prir..arily containing controls, and vertical boards priraarily containing meters, the eye coordination between -*

controls and dise lays is taore olfficult than if they were placed inuediately adjccent to each other. (This is not intended as a criticisu of the design, because every design arrange:.:ent has tradeoffs tnat prevent ideal arrangenents.) Enercency operations require rapid and accurate coordination of decision, control, and fee 6 Lack under stressful conditions. Demarcation enhancements, e articularly when done in conjunction with hierarchy labeling, can crectly improve this coordination.

Althougn grouping or. these panels is generally good, groups are in utny cases not set off by spaces: that is, one group runs into another without any visual distinction. Because of changes after the original cesign has been irupleraentec, some instruments are not well located with respect to their related group. In order to highlight a group, sor.te r e a r ra n g en.en t 1:.ight be necessary. Sometimes it is possible to swap like components, if separation criteria can be l'.et, to get better grouping.

This e l i.;.i na te s the need to cut new holes and install inserts.

Suggested Criteria

1. Locating instrurt.ents: Grouping should help the operator to locate meters and controls quickly and accurately, without resorting to searching labels.

2. Coordination: The operator should be aided in identifying controls and corresponding 1.'.eters on another part of the panel.

3. Logical arrangements: Instruments should be grouped in logical crrangements that facilitate an understanding of the intent of the group and thereby locating the proper instrument.

[ Application:

1. Demarcations for groups will Le devised in order to obtain the clearest arrangeraent using the minimum amount 3

. e ,

of swapping and relocation necessary to obtain casily identifiable groups. .

2. Groupings will have hierarchy labels and may have subgroup labels where it appears useful. Internal demarcations may be used to differentiate subgroups within groups. Specific controls, particularly emergency controls, will be bilighted .ithin a group or on their own. Labels and . color will be used to coordinate meter groups with control groups.

3. Swapping will be used sparingly as necessary to accouplish grouping, and relocations .till be used only when necessary to include an instrument within its proper group. ]

NIMIC Ed:RNCCV.UNTS ine following criteria is suggested for Liaics:

1. Sinplicity: sinics should stress siuplicity so that they provide the simplest reminder to the operator.

2. rapid scan: Operators should be able to rapidly scan miuics and discern the status, particularly when the syster.s a re pe r f ori..ing - their primary energency f unction. '

3. Alignment: The o'perator .should be sided by the aimic -

in determining proper system lineup. _

. a

4. Relationships: The relationships between uinics, - -

5.here appropriate, should be enhanced by the i;.iuic arranger ent.

5. Changes: Enhancements should emphasize improvements to :..imic lines and labels, and not change locations of controls '

and ir.dication unless absolutely necessary.

[ Application: (Nunbers correspond to criteria)

1. All uimic lines should be as straight as possible. '

The primary, or primary emergency function of the ruinic should be the straightest nimic and should use the roost prominent lines.

2. The primary energency function of the mimic should stand out so that the operator's eye will be guided to the proper section to determine operating status. Secondary or alternative uses of the mirai c should be visually subordinated to d if ferentia te them f rom the primary use. Support functions should i

be further subordinated, or possibly not rairaiced.

3. Mimics should have only the necessary information to l aid the operator in making proper alignments when system changes are required. ]

4 e

l

. i I

COLONS .

Colors can be used effectively to help tie sir..ilar functions together that are located on different parts of the panel or on different panels. The oesign of Liuerick panels spreads some systens between consoles tr.d vertical panels. Also, some systems are located on nore than one console.

Suggested Criteria:

1. Consistent: The use'of color should be consistent throughout the control roo:a. However, the same color can have different n.eanings in different applications so long as the operator will not be confused by the different uses.

2. Color Codes: Colors will not generally be used as specific codes. Colors will not stand alone as the identifier of function but will be-used in conjunction with hi..rarchy labeling anc instrument recognition.

3. Color Si.ading: Systems that have sir.ilar functions but require differentiation should have a different shade of the san.e color.

4. Color Selection: Colors should, as far as possible, be chosen to suggest the systen or function they represent.

5. CitT Colors: Colors used for systems should be the sar.;e colors that will be used on the CRT systen diagraus. _ _

[ Application:

1. Colors should be system colors so that systeu functions can be related by color pads.

2. Colors for mir..ics can be syster.. color for pads, and use black for minic lines.

3. Select color shades that Llend with panel green. ]

4 t

I 5

_r--1 ,u a n ccsu ~

EMERCrENCY COOLING 1 7pg -< , .a 'l'/- CONV ENTIONAL PLANT SYSTEMS y ,,,,,, , ,,,, ~ .

SYSTE M S .

~

ra a = = A ro e.ae neo m .,ur,; i upcs .O. 5 o ,, r.

A.

N N .N '" ** *i ' ' ' ' -

~ --

>aHemess.1

- - I N = L = =

No*a'i ator PtScim.

v)y I ,n .'. su e .~ s. , g 8 -

l Js,.r ,sr.. -

.c

{c, m -

.re 9

- ./ i. i \ __ _' gy r--

r.,a.e .

f -- _- ".@p ,

W l .

ESlAh! * *iD~D

~~

?

~

i ' I RCIC "' /

'5" " ' '

~ -

3 L

n. T.7 cT.?

( T 4 -

l f ..

l } (,iso -.#J'7't" 'a l.i i ,

, (.

,.a s-- es. . ,,/ ~

A J c

~

f.k~.

N V -- /O 'unc.r

%yo"$MEi l , f Q '

= . _ _

@s e

'c- CORE SPMAY t

fR i

/ l l

ye

) ,

{

I 1

a co .. ,o gn;;..?

atcoMsine I

r P

t g

W y ,,,,,,

l \w g'

e.nc

/ n e Ac.roft - - - - - , n .a e t.. s. .

l .soa s,. na. 3 i

l s,a s.a, i

/,J,"."; '~ " : "  ! g l-,.piaggc;og-..,,,..,tn c

• ./ . R

, f ,. / . , _

h #

~ / 8

{

'- - -' 4 I

, . . ~

f 1

(#j

~

c r

/

g 3 W HT .

r srs. pacxius '

e.u n a u s t an j'fa *d G'E mtem l

l ,'

q 3

Y 7' orn ".. q .

, , i __-

95'r

<> < r , H, i y o.memenaiarita 1 9 *c' 4

t= = rem e.

1 g

z

-- g x g j9f - + - r* \ g-- -- j,aap *~-

gr.1  %

i j 1 -

p

(~__ 1' evaaJ ,

FE EDhATen I

T, +,  %- l neArens o

p. .

. ) 1 --Ri i I I (r c or e)"a po,v55>-N8'"

r.  ; a

r-- - - n e siou Ai. .

e g '/

= Dj (fTP.Of3STReNGS) g I

(rnso v e. e .h.e 2 r.H

- agtv=rea namovAi. : Ii -a ace rumN *5

gg tif.

'(; ios.ooo a.e.mi- ii *"*"*

W/.

x q .. . nen

~"T u) g l3 P aranosy' r

-8d=%  %

z

( , . , f '. . u moio RAD.' . , o , ,, j -

I tI c " ' * *'- W^* " *"* r * \,. '

I RH R_,,

,5,js

" ~~

-w,

1. """ s4< sveu _ _ , _ _ , ,, g

p , t

.);l /

' c. ,

t - - - - - - c.... .t - - - _ - . _ .

L_

l v..

,,) " ,r i c .. , .

-8 f- yp

- r m r , r m  :

ROMS C8" DENS. De MIN. C LARIF.,

STostAGe wargR ggo

**" %^.',' " '

LIINERICK GENERATING STATION 1vp <

!0".* > '*7. -< > < >

i k _ l

e

. .~

e.MW .,

s  ! , ' _/ e

)

. t Y

t. _.

M,

.l._, i 8

i L i-7 _,

i .

0 [w __

..i.

nI t-1

c. j

_ ~4

'q A

+ .-

g 1

g r.

y ,.

y i,6 i i c.

l ll- e -g U

y

. . F*

}p g)e l -

)*

g4

, ., Ii : ! , g --

i y l. .

r

" ,. y 1 g  ;

j

r. s

-=

. i i. _ l I

r/ f- *

,u , ,-

I I

---

.-......-..S..

u _.

t t

4J I i!, i l .1 ' y ,'

'l[ .

l 1

l  :'f

• 3 llI t T I

-* i~~ i 'i

-,y l e-

.,Q, *

.; v* I '-

. -  ; , l

- -' > a i.f V';"J~tl..l ,

- t: , .

g .I rl sl

^

,s. ..-- .22.:}-2 .

l- -

~ ,{~* i

_ 8 f -l g 1 l [ . . ib],.

-i Y' i i . .

Ia i

l' #

• i al

,. ._ i i g c.

.g .- .1

- l e

i a f.y ?~

3

• y fl  ;

l** ' ','r; J8,C l '

! c3 i s, -

i n k -+

i

• Ol .

w.. .. -

e _t_ a_

i

!j.

gi .;

6: I t

%- % !% l g i ~ ^

y_ . I i

c. ,

. .. e _ .. __- i,

.._1 ll '. .

I

'l t  !

_ .i, . ' .H \

. t

~

+u . ., I .. .. i __

i i r- _

i

.. -l .q g g.

,g .

,, e. , l

I 1

. .a g

. -!,- 0] .Ii. f. >

i g , g,, __ , _ . . _ .. . __

y! i s. t I

1 u ._ ._ .J

ATTCH 5

l

)

NOMENCLATURE FOR CONTROL ROOM (PROPOSED)

This operational nomenclature _was developed from the " Limerick Generating Station Abbreviations", Revision 8, August 15, 1983.

It is planned that this be'used for the improveJ labeling on the control room panels and remote shutdown panel. The Equipment Name column is derived from the referenced document for items

(equipme'nt, systems, etc.) to control room operations with some additions from other listings. The Nomenclature column is the short titlefto be used for labeling on the control panels. The Abbreviation column corresponds to the adjacent short title for use in the control room where required. _ ,

l l

1 l

l l

ATTCH 6 l

.g. - -

o -e , ,,

MOMENCLATURE FOR CONTROL ROOM (PROPOSAL)

COUIPMCMT N A t1E NOMFr!CLATURE ABBREVIATION Accumulator Accumulator ACCU!i Aftercooler Aftercooler AFT CLR Air Conditioning Air Conditioning A/C Alternate Rod Insertion Alternate Insertion ALT I!: SERT Alternating Current Alternating Current A/C

~~

Analyzer Analyzer A!:AL And And &

Annuticiators Annunciators AN!!U::

Area Radia tion tionitor Area Radiation APA RI.D Atmospheric _

Atmospheric ATtOS 8

Automatic Automatic AUTO -

W Automatic Depressurization Automatic AUTC DEPRESS System Depressurination Auxiliary Auxiliary AUX Average Power Range Monitor Power Range PWP R :G Backwash Backwash B/t; Battery Battery BATT Bearing Bearing BRr Bleeder Trip Valve Bleedcr Trip ELLD TDP Block Bloci: PLK Board Board ERD Boiler boiler BLR Eoiling Water Reactor Boiling ;-?ater Reactor BWR Breaker Breaker BKR Building Building BLDc

/

'.* '* ~ ,, ,,

EQUIPt1ENT mat:E N O t:F.??C L A T U R E .* ABPREVI ATIO!!

.Dypass Valve Bypass BYP Cathode Ray Tube Screen SCR:!

Screen Computer Computer CMPTP Centrifuge Centrifuge CENT Chemical Chemical C H E.'

l 1 Chilled Water Chilled Water CH i3E (k. . Il e " C h ollo r CVt C Chlorine Chlorine C12 ,,

Circui*t Breaker Breaker BI:1: .

Circulating Circulating CIRC Circulating Water Circulating Water CIRC UTC Clean Radwaste Clean 1:aduaste CLt: Rt.D iiST Closed Closed CLSD Closed and Locked . Closed anc Locked CLS & Lt:

Collection or Collector Collection or COLL Collector Combined Intermediate Intermediate Valve INT VLV Valve Compa r tme n t Compa r tmen t C0!* PT Compressed or Compressor Compressed or CO P Compressor Condensate Condensate CO! D Concensato Storage Condensate cot!P' TK Tank Tank Control Control CC. :'I Control Pod Drive Rod Drive RD DRV Control Station Control Station cot:T STA Con el Switch Control Switch CCMT SW 31____._____________.________________________.________

• . . +- .. _.

EQUIPMEt!T !!AME .tJOMENCLATURE ABBREVIATIOt2 Containment Containment CT!iT (see Note 1)

Containment Atmospheric Containment Dilution CTMT DIL )

Dilution System Continuous Air Monitor Air tionitor - AIR MO:-

Cooler Cooler CLR j Cooling Cooling CLG Cooling Tower Cooling' Tower CLG ThR

. ~

Core Spray Core Spray CO!< SPRY Core Standby Cooling Standby Cooling STBY CLC Systems Coupling Coupling COUP Cycle Cycle CYC Deaerator Deaerator DEA , ,

Deminerlizer Deminerlizer D E!* I !:

De.Tiineralized Water Demineralized DEMI:: UTD TK Storage Tank Water Tank Detector betector DET Diesel Generator Diesel Generator D/C Differential or Differential or DIFF Difference Difference Differential Pressure Differential Pressure DP or P or Delta P or Delta P Direct Current Direct Current DC Dirty nadwaste Dirty Radwaste DIRT RAD WST Discharge Discharge DISCH Disconnect Switch Disconnect Switch DISC SW Division Division DIV Drain Drain DRt:

n __- _ _ _ - -__ ____ -__-_-

7 .

5 -

COUIPfiENT NAt1E NOi1E!!CLATURE ABET:EVI ATI Of! l Drywell Drywell D/h Ejector Ejector EJC Electro flydraulic Electro Hydraulic EliC Control Control Emergency Emergency EMEG Emergency Core Cooling Emergency Core EMRC COEr CLG System Cooling Emergency Service Water Emergency Service EMRG SERV WTR Water i

.W Enclosure Enclosure ENCL Engine Engine ENG Ecualizer or Equalizer or EQUAL Equalizing Equalizing Equipment Equipment EGP Equipment Drain Equipment Drain EOP DRN TK ~ ~

Collection. Tank Tank Evaporator Evaporator CVAP Exciter Exciter EXC E.xhaust or Exhauster Exhaust or Exhauster EXil Exponential - Negative Exponential - Negative ~~

N (e.g. 10 to the negative 6th power = 10N6)

Exponential - Positive Exponential - Positive ~-

P (e.g. 10 to the plus 6th power - 10P6)

Extraction Extraction EXT Feed Feed FD Feeder Feeder FDR l

Field Field FLD Fifth Fifth Sth l

Filter Filter FILT Filter Deminera1izer Demineralizer DEMII; e

NOMENCLATURE ABEREVIATIC? .

EQUIPMENT NAttr First 1st First Floor FLR Floor FLD DRN Tl; Floor. Drain Collection Floor Drain Tank Tank Fourth 4th Fourth Fuel Pool FUL PL Fuel Pool Generator GEN Generator Seal Condenser SEI. COND Gland Seal Condenser .. .

Governor GOV Governor Ground GRD Ground Ground Switch GDD SW Ground Switch Group GDP Group lieader HDD fleade r Heat HT - _

Heat Heater HTF Heater Heating IITC licating Heat, Ventilation HT,VE?T,A/C

!!ea t , Ventilation, Air Conditioning Air Conditioning lle a t Exchanger itTX Heat Exchanger Hertz  !!Z Hertz High Pressure llP High Pressure Coolant HP INJ Iligh Pressure Coolant Injection Injection Hydraulic

!!yd raulic HYD 11ydraulic Unit ilYD Ut:T j Hydraulic Control Unit l Hydrogen H2 Hydrogen Hygrogen Analyzer H2 AMAL Hydrogen Analyzer liyd r osta tic HYDRO liydrostatic 6

. ~

EQUIPMEt3T NAME NO!!ENCLATURE ABBREVIATION ~

i Inboard Inhoard INBD Information Information ' INFO Injection Injection INJ Inoperative Inoperative INOP Instrument Instrument INST Intermediate Range Monitor Intermediate Range INT DMG Intermediate Stop valve Intermediate Stop IUT.STOP Iso Phase Iso Phase ISO Isolate, Isolation Isolate, Isolation ISOL Kilowatt Kilowatt KW Kilovars Kilovars KVAR Ki_lovolts K'ilovolts KV 4

- Kilovolt - Amperes ,

Kilovolt - Amperes KVA _

Liquid Liquid LIO Locked Locked LK Local Power Range Monitor Local Power LOCAL PWR Loose Parts Monitoring Loose Parts (None)

System Loss of Coolant Accident Loss of Coolant LOCA Accident Low Pressure Low Pressure LP Low Pressure Coolant Low Pressure LP INJ Injection Injection Machine itachine MACH Main Control Room Control Room CONT EM Main Generator Main Generator GEN Main Steam Isolation Main Stear Isolation MN STM ISOL r Valve l

l 7

^

EQUIPMENT NAME NOMENCLATURE ABBREVIATIOM Main Steam Line Main Steam MM STM tiain Stop Valve Stop Valve STOP VLV Make-up Make-up M/U Manual Manual MAN Maximum Maximum MAX tiechanical Mechanical MECH tiegavar Megavar MVAn Megawatt Megawatt MN Minimum Minimum " MIN Mode Switch Mode Switch 11 / S Moisture Separator tioisture Separator MOIST SEP

!!otor Motor tiTR Monitor Monitor mot! , _

Motor Control Center Motor Control Center t:CC tiotor - Generator Motor - Generator M/G Neutral Neutral NEUT Nitrogen Nitrogen N2 Normal Waste Normal Waste NOUti NST Non-Regenerative Non-Regenerative NON REGE!! HTX Heat Exchanger Heat Exchanger l

I l Off Gas Off Gas (None)

Oily Maste Oily Waste OIL WST Open Open OPN Outboard Outboard OUTBD Out of Service Out of Service OUT/ SERV Overload Overload OVLD Oxygen Oxygen 02 8

l l

EQUIP!1ENT NAME NOMENCLATURE ABBREVIATIOh Oxygen Analyzer Oxygen Analyzer 02 ANAL Perkiomen Make-up Perkiomen Make-up PERK M/U Point Point PT Position Position POS Potential Transformer Potential Transformer POT XFMR Pounds Per Square Pounds Per Square PSIA Inch Absolute Inch Absolute Pounds Per Pounds Per PSI **

Square Inch Square Inch Pounds Per Square Pounds Per Square PSIG Inch Gage Inch Gage Power of Hydronium Power of Hydronium pH Ion Ion Preheater Preheater PRE HTR Pressure Pressure PRESS _ _

Pressure Control Valve Pressure Control PRESS CONT Pressure Reducing Valve Pressure Reducing PRESS REDUC Process Computer System Process Computer PROS CMPTR Pull to Lock Pull to Lock PULL / LOCK Pum p Pump PMP Radiation or Radiation or FAD Radioactive Radioactive Radioactive Waste Radioactive Waste RAD WST Reactive KVA Reactive KVA KVAR Reactor Reactor RX Reactor Enclosurb Reactor Enclosure RX ENCL Isolation Cooling System Isolation Cooling ISOL CLG Containment Cooling Containment Cooling CTMT CLG WTR Water Water Reactor Feed Pump Feed Pump FD PHP 9

e a ---

EOUIPMENT NAME NOMENCLATURE ABEREVIATICl1 Reactor Feed Pump Feed Turbine FD TURE Turbine Reactor Water Clean-up Clean Up CI.NUP System Reactor Pressure Vessel Reactor RX Recirculation System Recirculation RECIRC Recombiner Recombiner RECCMG Reducer Reducer REDCR Refuel Refuel REFL Refueling Water Refueling Water REFL W2R TK Storage Tank Tank Refrigeration Refrigeration REFRIG Refueling Refueling REFULL Regulator Regulator REG _ _

Heraoved Removed RMVD Reservoir Reservoir RESV Residual Heat Residual Heat RESD HT Removal System Residual Heat Removal Residual lleat RESC llT SERV Service Water Service Water WTR Return Return RET Revolutions Per Pevolutions Per RPM Minute Minute Rod Block Monitor Fod Block ROD PLK Rod Minimizer Rod Minimizer ROD !!IN Rod Position Information Rod Position RCD PCS System Rod Sequence Control Pod Sequence ROD SEO System Rod Worth Minimizer Rod Minimizet ROD MI!1

e o .

COUIPftENT N AftE NOMENCLATURE AP.DREVI ATIOt!

Room Room RM Safeguard Safeguard SFGD Safety Relief Valve Safety SFTY Saturated Saturated SAT Schuylkill Make-Up Schuylkill tiake-up SCHUYL M/U Seal Seal (None)

Second Second 2nd secondary Secondary SEC . -m Section Section SECT Selector Selector SEL Separator Separat)r SEP Sequence Sequence CEO Service Service S EI:V Service Water Service Water SERV UTP C/ Tw Shut Down Shut Down S/D Sixth Sixth 6th Source Range Monitor Source Range SORC Rt:C Stage Stage STG Standby Gas Treatment Standby Gas STRY GAS Standby Liquid Standby Liquid STDY LIO Control Start Up Start Up S/U Station Station STA Steam Steam STt:

Steam Jet Air Ejector Air Ejector AIR EJC Steam Packing Exhauster Steam Packing STt' PAK EXII Exhauster 11

EQUIPMENT NAME NOMENCLATURE ABBREVIATIO!

Steam Seal Steam Seal STil SEAL EVAP Evaporator Evaporator

~

Strainer Strainer STRN Suction Suction SUCT Supervisory Supervisory SUPV Suppression Pool Suppression Pool SUPP POOL Switch Switch SW Synchro = cope Synchroscope SYt:0 ...

System System SYS Tank Tank TK Tem pe ra tu re Tem pe r a tu re TEMP Temperature Control Valve Temperature Control TEt1P CONT Third . Third 3rd - -

Throttle Throttle TIIROT Tower Towcr TWR Transfer Transfer TRANS Transformer Transformer XFMH Traversing In-Core Probe Core Probe COR PROB Turbine Turbine TURB Main Turbine Turbine Bypass TURD BY Bypass Valve Turbine Enclosure Turbine Cooling TURR CLG WTR l

Cooling Water Water Turbine Generator Turbine Generator TURB GEt or T/G l

f Turning Gear Turning Gear TURll GEAR l Ultrasonic Ultrasonic ULTS!1C 1

Unit #1 Unit #1 U/1 o )

EOUIPMENT NAME, NOMENCLATURE ABBREVIATION Unit #2 Unit #2 U/2 Vacuum Vacuum VAC Valve Valve VLV vapor or vapor or VAP Vaporizing vaporizing Ventilation Ventilation VENT Vibration Monitoring Vibration Monitoring VIB MON System Waste Waste WST Water Water WTR Yard Yard YD vote 1. " Containment" will refer to the combined Drywell and Supression Pool bounda ies, i.e. the primary containment. _ ,

. e: s- , , , ,

I SPECIAL PARAMETER ABBREVIATIOIS FOR METERS Temperature T l

Pressure P -

Flow F Level L Valve Position POS Differential Pressure AP Amps A Volts V Watts W '

..g 4

i i

4

c. 1, A50tSS 1:, PACT UP3;J OPEliATO:<' S AL'ILITY TO Pcisi 0;c Cach li C D 1..u s t Le assessed based upon its potential for -

causing error by operators, and therefor the resulting potentici inpact upon safety. The following descriptions identify the note common categories and causes of huuan error, but the tcan is not liuited to only these itens in its considerations.

This list is intended to help teau meubers in evaluating the .

Fotential significance and seriousness of a I;EC to cause operator error. The significance can best be determined by the conbined professional judgenent of thejteam representing different areas of expertise. Ucch neraber should nahe his own judgenent, and then the tean should review the several viewpoints and obtain a con-sensus. If no consensus can be obtained, the team will vote. The significance and seriousness of an individuc1 UED should also be considered for possible interactions witn other liEDs as well cs individually. The resulting statenent of significance and seriousness of the lied will then be used to de te rraine the conse-quences of errors with respect to safety. Finally, the overall - - =

Friority of the MED will oc deternined by applying the criteric of the four priority stateuents.

The list is divided into three i..ajor categories. Subcatego-ries list the areas of performance that t..ake up each cctegory. In turn, cach area of performance lists typical contributors to degraded performance. In evaluating the impact of c dicercpancy, any one cause ncy have a acjor in act e or it r..ay have z very ninor impact. Minor ir.. pacts in r. ore than one area of performance, however, any conbine to cause a discrepancy to have a greater , ,

inpact on operator perfornance. '.. hen r..a j o r ca te g o r i e s conbine, there is c potential for greater seriousness.

h PHYSICAL PCRFORMAi;CE

1. Reduction of effectiveness of the operator's bodf and 6..ind ccused by:

a. Undue fatigue:

(1) Duration of operation (2) Frequency of demands (3) Environnental conditions

b. Discomfort:

(1) Working conditions (2) Resting conditions

c. Injury

2. Restriction of the operator's ability to perforn:

a. Control suitability

b. Availability ATTCH 7

6 , ,' >

. ~

h GENSOR*l/PCRCEP7UAL PERFOur.ANCC 1.. Reduction in visual sensing: _

a. Visibility of instrument or information-1 (1) Neters and controls (2) Labels cnd legends (3) Scales and-units (4) Displays

b. Readability of information:

(1) Lcbels and legends (2) Scales and units

. . -m (3) Displays

c. Visual distractions:

(1) Cluttered presentations (2) Lack of differentiation (3) Excessive information

2. In.pairment of audio reception: - -

a. Audibility

b. Noise level

, 3. Perception of infork.ation received visually or audibly:

a. Identification of information sought:

(1) Easily recognizable (2) Dif ferentiated f rora other information (3) Expected location or arrangement

b. Understandable information:

l (1) Terminology succinct (2) Useful form 4

, . g . .

)

- _C_._n ENTA L P E R F O R =./.N C E

1. The degree of stress: -

l

a. Hapidity of response required

b. Severity of situation (energency procedure)

c. Accuracy of response required

2. The tendency to cause confusion:

a. Aisicading information or arranger.ent

b. Complexity:

(1) arnipulations ,

(2) Displays

...g (3) Procedures

3. Nental workload:

a. The degree of inforr..ation collection requiretients:

(1) Proximity to operator's location

_(2) orgcnization for easy identification

b. Correlation of information:

(1) Status of systems /couponents (2) Alignment of syster.is (3) Ef fects of one systera on another

c. Mental raanipulations:

(1) Recall of detailed inforraation (2) Perform calculations (3) Transposition / conversion of units

d. Evaluation and decision:

(1) Effective guidance (2) Sequential or parallel

4. Coordination with others in or outside control room:

a. Absence / remote location of information or controls

b. Delay of feedback information

c. Interaction with other systeras

2 g 1 p6 .

O BWR OWNERS GROUP CCNTROL ROOH DESIGN REVIEW PROGRAM

, DEVELOPMENT AND METHODOLOGY

~ . . . - - . . .

8/1/81

l A

e a

- t l

l -

1 l

ATTCH 8 l

• +

• specifie procedures based upon these guidelines are not yet available, the analyses performed provide,much useful information on 1 the adequacy of present control room instkumentation and the ability )

of the operator to respond in accordance with the Guidelines within the framework of existing control room design. As such, they serve I

as a valuable method of integrating procedure and control room .

upgrade efforts. More detailed analyses are expected to be performed at the time actual plant specific procedures are prepared.

5.2 Evaluation Methods

• An in-depth analysis of control room design requires review of every panel containing controls and displays normally used by operators, , . . ,

_g including auxiliant and back panels. Evaluations are therefore l performed on a panel-by-panel basis, checklist Sections A, B, and C .

being completed separately for every panel. ,

1 Each checklist item is evaluated by means of two numerical ratings:

i (1) a " compliance factor" indica. ting the degree to which the panel under consideration complies with that criterion, and (2) a , ,

" potential for error f actor" representing the telative likelihood l

I that non-compliance with that checklist item could cause or contribute to operator error.

• A graded system of compliance evaluations is employed because a simple yes/no judgement of design compliance with a given human

' factors standard may provide only limited information when a wide spectrum of actual design effectiveness is possible. Therefore, each panel is rated on a scale of one to four for each checklist item.

"One" indicates full compliance with a given criterion on the panel i

I being reviewed, "two" indicates chat the criterion has been "mostly" i

f complied with, "three" indicates "somewhat" compliance, and "four" indicates total non-compliance. A " sero" signifies that the criterion is not applicable to that panel.

The " potential for error factor" has been preassigned for each checklist item, based on the' vork of a task force consisting of approximately thirty General Electric and utility engineers from 17-

.~

+ n -

a wide variety of disciplines. Each item was independently evaluated by each task force member, based upon his own knowledge and erpe rience. From this data base, a final value was assigned based upon the statistical frequency distribution of the ratings.

4 Each rating factor was reviewed and approved by the Control Room Improvements Committee of the BWR Owners Group. The resulting factors ranged from one to three, "three" indicating "high" potential for operator error, "two" a " moderate" potential, and "one" a " low" potential for causing or contributing to operator error.

These two rating factors, the degree of compliance assigned by the survey team, and the predetermined potential for error, are multiplied together to obtain a final Evaluation Product. These .

Evaluation Products are then utilized in forming prelimina ry prioritization recommendations for control room enhancements (see Figure 6).

Final corrective action will be determined in an item-by-item review of these suggested areas, addressirs safety significance of the components and systems involved, f requency of use and the consequences of required operator retraining.

5.3 Survey Teams .

The BWR Owners Group Control Room Design Review is intended to be performed by inter-utility review teams composed of members with expertise in a variety of disciplines.

Four such teams hava currently been formed, each typically consisting of representatives from three or four utilities with backgrounds in operations, control and instrumentation or engineering, a human f actors consultant and a General Electric engineer. The host utility provides additional support as required in the areas of computers, operations, engineering, maintenance, and training. The resulting team structure thus includes expertise in all necessary fields. One utility employee is designated as the " team leader," responsible for

scheduling the review and coordinating review team activities.

Individual team member responsibilities are listed in Table V.

i 18

1

, s ,

DUTLiWI.vA TIO < 01 St.) ETY ti1Gt!Il ICA;-!CE In assigning the safety significance of a llCD found to be significant, the coubined judgeuent of the teat. is needed in consideration of the specific condition caused by the ilED or a combination of IILDs. The tecu ueubers should consider the following:

1. IIEDs that cause errors on systens thct directly effect scfety such as:

a. Engineered safety features L. ricactor protection systen

c. Containment isolation

d. tr..ergency core cooling systeus and their supt. ort systems

c. S y s t er.is for raoni to r i ng the course of accidents or the avcilability of safety related systeias -=

f. liccctor control systeus 9 Dff gas isolation systens

2. The ; otential for violation of technical specifications.

3. I!CDs that are known to nave caused errors that will lead to unsafe operation.

4. IIEDs that could cause the inadvertant activation or deactivation of a sa f ety rela ted syster;i o r syster. needed to safely shutdown the plant.

___ . AITCH _9_

r

_ s. . a:

L' _.

• l l

j primarily a This will be Form shown in Figure 4.

AScessment by appropriate technical I analysis, assisted trol room panels human factors I A summary top-down analysis of the con HEDs and to cxperts.

to identify the context of the of this will be- conducted Upon completion their specific meanings. f rmed, and understand the normal assessment of IIEDs will be per o onalysis, form completed.

the HED Assessment PRIORITY EVALUATION CRITERIA the control 4.3.2 discrepancies identified during ' ' '

engineering will be evaluated Iluman the supplementary review judged and be room survey This will to their safety significance. operation according emergency affect on their potential to been mainly The following four categories of priorities have each adversely. team as to which category - -

• • designed so a consensus from the be assigned can be rearbed.

IIED should

)

Priority 1_(High Saf ety Significance _ likely to adversely are cocumented or judged HEDs that itions by the control the management of emergency cond have affect This priority includes all HEDs that room operators. 'i n unsafe could result safety significance that high in unsafe operation, as any that have resulted operation, errors of serious could result in well as any that Cat.1II.)

(0801 Cat.I A,B ,C , Cat.II A, consequences.

r Priority 2 (Low Safety Significance 1 to cause have caused problems or appear likely HEDs that i s that could during normal and off-normal operat on problems 23 ATTCH 10

. 1

- + . ,,

(0801 Cat.ID, Cot. IIB,C.)

not result in unsafe operations.

Priority 3 (Operational Reliability) but could degrade that are not safety significant HEDs reliability, either singularly or operational efficiency and This priority includes HEDs ,

i,n combination with other HEDs. consequence, but in individually of minor that are could HEDs or other conditions with other combination degrade operator ef fectiveness under stress.

Priority 4 (No Significant Improvemen t)_ effect gg HEDs judged by the review team to have no significant a

as causing problems on operations and are not documented do during operation.

This priority includes all HEDs that not fit into any of the above categories.

4.3.3 DESIGN IMPROVEMENTS .

4.3.3.1 PANEL ENHANCEMENTS indLstry that large has been experienced throughout the It enhancements, through panel numbers of HEDs can be corrected More of like components.

labeling and swapping including that include a number of techniques specifically, enhancements shading, improvedents, such as demarcation lines, involve surface in the enhancement category and improved labeljng. Also included swapping. This involves changing is the technique of component within the location of a control or indicator with a like unit Swapping usually within the same grouping.

same panel, the the need for panel involves simple exchanges of locations without l In some cases, this technique can greatly improve modifications.

24 l

L I