ML20115B102

Rev 3 to, Evaluation of Detailed Control Room Design Review Program Plan & Summary Rept for TMI-1, Technical Evaluation Rept

ML20115B102
Person / Time
Site:	Three Mile Island
Issue date:	08/15/1984
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML20115B100	List: ML20115B102 ML20115B105
References
CON-NRC-03-82-096, CON-NRC-3-82-96, RTR-NUREG-0737, RTR-NUREG-737 SAI-186-557-74, SAI-186-557-74-R03, SAI-186-557-74-R3, NUDOCS 8504170372
Download: ML20115B102 (30)

Text

i

~,

O 1

ENCLOSURE 2 SAI-186-557-74 Rev. 3 EVALUATION OF THE DETAILED CONTROL ROOM DESIGN REVIEW PROGRAM PLAN AND

SUMMARY

REPORT FOR THREE MILE ISLAND, UNIT 1 Technical Evaluation Report 9

August 15, 1984 _:

Prepared for: ,

U.S. Nuclear Regulatory Comission Washington, D.C.

P

! Contract NRC-03-82-096

.p 8504170372 850408 PDR ADOCK 05000289 F- PDR _..,

, ,,,v-- , , ,--,---------e- , - , - ,, e-, - - - -,- y

O L

i FOREWORD This Technical Evaluation Report (TER) was prepared by Science Applications, Inc. (SAI) under Contract NRC-03-82-096 - Technical Assistance in Support of NRC Licensing Actions: Program III. The evaluation was performed in support 'of the Division of Human Factors Safety. Human Factors Engineering Branch (HFEB). SA! previously evaluated GPUN's program plan and summary (report submitted conductedconcurrently for Island the Detailed Control Roomof Design Review DCRDR) for Three Mile - Unit 1. Results that evaluation are described in a Safety Evaluation Report (SER) prepared by HFEB and transmitted to the licensee. Subsequent to issuance of the SER, a meeting and documentation audit were held with GPUN. GPUN submitted a supplement to its summary report in June 1984.

This report includes the SAI evaluation of the licensee's summary report (Reference 1) and supplemental information obtained from a 1980 -

submittal (Reference 2). Findings from the two meetings were also consid-ered in preparation of this evaluation (References 3 and 4) as was informa-tion provided in the supplement to the summary report (Reference 5). .

S e

i

)

Table of Contents Section Page BACKGROUND . . . . . . . . . . . . . . . . . . . . . . . . 1 PLANNING PHASE . . . . . . . . . . . . . . . . . . . . . 4 REVIEW PHASE . . . . . . . . . . . . . . . . . . . . . . . 5

1. Review of Operating Experience . . <. . . . . . . . . . 6

2. System Function and Task Analysis. . . . . . . . . . . J5

3. The Control Room Inventory . . . . . . . . . . . . . . 10

4. The Control Room Survey. . . . . . . . . . . . . . . . 10 ASSESSMENT AND IMPLEMENTATION PHASE. . . . . . . . . . . . 12

1. HED Assessment Methodology . . . . . . . . . . . . . . 12

2. Selection of Design Improvements . . . . . . . . . . . 12

~

3. & 4 Verification that Improvements Will Provide the ~

Necessary Correction and Verification that .

Improvements can be Introduced in the Control Room Without Creating Any Unacceptable Human .

Engineering Discrepancies. . . . . . . . . . . . . . . 14

5. Coordination of Control Room Design Improvements With Changes From Other Programs. . . . . . . . . . . . . . 14

6. Proposed Schedule for Implementing Design Changes. . . 15

7. Justification for HEDs With Safety Significance That Are Left Uncorrected or Partially Corrected. . . . . . 15 CONCLUSIONS AND RECOMMENDATIONS. . . . . . . . . . . . . . 17 l REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . 20 l

APPENDIX - AUDIT MEETING . . . . . . . . . . . . . . . . . 22 l

l l

ii

_-- _ .. __. - - _ __ _ _ . _ _ _ _ _ __ _ ~ .

EVALUATION OF THE DETAILED CONTROL ROOM DESIGN REVIEW SUN (ARY REPORT FOR THREE MILE ISLAND, UNIT 1

- This report documents the Science Applications, Inc. (SAI) evalua-tion of the Summary Report of the Detailed Control Room Design Review (DCRDR) (Reference 1) submitted to the Nuclear Regulatory Commission (NRC)  ;

on; January 16, 1984 by GPU Nuclear Corporation (GPUN) for Three Mile Island i Unit 1 (Reference 1). This evaluation also considers information obtained from review of a supplement to the summary report submitted by the licensee on June 29,1984 (Reference 5) and a GPUN report prepared in 1980 (Reference 2). Further information regarding DCRDR activities was acquired at a meeting held between GPUN and the NRC on March 27,1984 (Reference 3) and a

~ documentation audit meeting held on April 18,1984 (Reference 4). Some of the types of exhibits viewed during this'latter meeting are shown in [.

. Appendix A. Findings from both of these meetings also were considered in -

assessing GPUN's summary report. This report supercedes our earlier reports dated April 14,. March 26, and May 4, 1984. .

Results of the SAI evaluation follow a brief overview of the background leading up to preparation and submission of the summary report.by the licensee.

8ACKGROUND Licensees'and applicants for operating licenses are required to conduct a Detailed Control Room Design Review. . The objective of the review

'is to "... improve the ability of nuclear power plant control room' operators.

to prevent accidents or cope -with accidents if they occur by improving the information provided to them" (NUREG-0660, Item I.D.1) (Reference-6). The

~

need to conduct a DCRDR was confirmed in NUREG-0737 (Reference 7) and the requirements to be met in such a review were contained in Supplement 1 to --

NUREG-0737 (Reference 8). Guidelines for conducting a DCRDR are provided .in

,' -NUREG-0700 (Reference 9) while NUREG-0801 (Reference 10) presents the

, assessment processes for use by the NRC.

. 1 4

g *- ' w , e - er e ,,,,+r,,-wmm,.,-.------m,v,,,, w-., ~,.r~ mw ee---.awee,n--,e--,e,--,----,,,,, n-,, . . - . - , , --,-w-,ee ,w,, - ~, e

The DCRC2 requirements as stated in Supplement I to NUREG-0737 can be summarized in terms of nine specific issues, a list of which provides a convenient outline of the areas covered in this technical evaluation. The l nine issues include:

1. Establishment of a qualified multidisciplinary review team;

2. Use of function and task analyses to . identify control room operator tasks and information and control requirements during emergency operations;

3. A comparison of display and control requirements with a control I

room inventory;

4. A control room survey to identify deviations from accepted human factors principles;

[

5. Assessment of human engineering discrepancies (HEDs)' to determine which HEDs are significant and should be corrected; -

6. Selection of design impr_ovements that will correct these discrep-ancies;

7. Verification that selected design improvements will provide the -

necessary correction;

8. Verification that improvements can be int oduced in the control room without creating any unacceptable human engineering discrep-ancies; and

9. Coordination of control room improvements with changes resulting from other. improvement programs such as SPDS, operator training, new instrumentation (Reg. Guide 1.97, Rev. 2) and upgraded emer- -

gency operating procedures.

A DCRDR is to be conducted according to the licensee's own program plan (which must be submitted to the NRC); NUREG-0700 suggests that it should address the previously stated requirements and be conducted in accordance 2

with the- fWowing four phases: (1) planning. -(2) review, (3) assessment, and (4) reporting. The product of the last phase is a summary report which must include an outline of proposed control room changes, their proposed schedules for implementation, and summary justification for human engineer-ing discrepancies with safety significance to be left uncorrected or partially corrected. Upon receipt of the licensee's summary report and prior to implementation of proposed changes, the NRC must prepare a Safety Evaluation Report (SER) indicating the acceptability of the DCRDR (not just the summary report). The NRC's evaluation encompasses all documentation as well as briefings, discussions, and audits if any were conducted.

The summary report submitted for evaluation by GPUN included a program plan which described control room design review tasks which already had been completed. This plan was developed and implemented in 1980 by GPUN '

prior to the issuance of the DCRDR requirements stated in Supplement 1 to NUREG-073'7 and the methodology suggested in NUREG-0700 or other appropriate 1 guidance. The overall document also contained a summary report of findings -

from .the compieted portions of the control room design review, highlighting

. changes that had been accomplished to date. The plan and findings from a review of the system-oriented E0P's were provided in the licensee's supple-ment to the summary report. ,

In February 1980, GPUN undertook a human factors review of the control room at TMI-1. In light of widespread criticism of nuclear power plant control rooms in general, and of the TMI-2 control room in particular, GPUN considered this review desirable. A review team was formed to plan the activity and formulate guidelines for the review including criteria by which the control room was to be judged in the absence of regulatory guidelines.

In June 1980, the review team provided its preliminary findings to GPUN management. Members of NRC staff subsequently were briefed on these findings. NRC performed an audit of the control room at that time. Results of GPUN's review (Reference 2) and the NRC audit (Reference 11) were entered -

~

as evidence in the Atomic Safety and Licensing Board Hearing for the restart of Unit 1. The Board endorsed a program of corrective action (Reference 12). GPUN also completed an alarm system review in 1981 (Reference 13).

( Design details were developed and extensive improvements in the control room

! and alarm system carried out in 1981-1982. Between 1983-1984 new, abnormal 3

l L , _ _ . _ _

trcesient operating procedures (ATOGs) were formulated and implemented.

Reviews of the functions and tasks implicit in these procedures were performed in'1983-1984 to complete GPUN's DCRDR-activities at TMI-1.

PLAlWIIIIG PHASE The program plan submitted within the summary report met some of the basic objectives for conducting a control room design review. A number of.the elements of a review specified in NUREG-0737 Supplement I were addressed. .However, specific areas of the work have not been described in sufficient detail to provide assurance that the licensee understood the processes necessary to complete the tasks and therefore meet the require-ments. The detailed results of the evaluation of the GPUN program plan are described in Reference 14.

The licensee's Program Plan for TMI-1 included a description of I the. staffing and management that was established to conduct the control room ,

design review activities begun in 1980. From information provided by GPUN in subsequent submittals and meetings, it appears that the structure and -

management of the DCRDR appeared to be flexible enough to permit a multi-disciplinary effort. ' Management of the DCRDR was the responsibility of the Systems Engineering Department of GPUN. s A multidisciplinary core team was established to conduct the control room design review. The core team included human factors consul-tants, GPUN staff, and personnel from MPR Associates. From resumes provided i for core. team members other than the shift supervisor, the expertise of the core team included:

I

{ o Systems Engineering o Human Factors Engineering o Nuclear Engineering o Instrumentation and Control -

o Electrical Engineering o Operations Analysis l . o Reliability and Risk Analysis

o Mechanical Engineering o Safety Analysis 4

l

J GPUN was not able to-reconstruct actual personnel assignments and levels of effort for its completed activities begun in 1980. From informa-tion provided during the March 27th meeting, however, it appears that parti-

.cipating organizations were qualified. for DCRDR tasks for which they were res ponsible. Noteworthy is the fact that human factors consultants not only provided guidance to the effort but actually performed selected review activities.

i The review team as established did appear to have freedom to carry out the review and access records, information, and facilities as needed.

The team also had the ability to acquire support from other staff, special-ists, and administrative personnel as needed. Supplemental staff involved in the review were mentioned by name (Glaviano, Feinberg, Buck, MPR staff).

From resumes submitted for these individuals, it appears that , supplemental staff were qualified for tasks to which they were assigned. .

~

In conclusion GPUN established a qualified multidisciplinary team

~

to conduct its DCRDR. However, information provided on management and

~ staffing seems to relate to activities begun and completed between 1980 and -

1983. Little reference is.made to staff or. levels of effort ~ involved in the review using upgraded E0Ps completed between 1983-1984. This information is necessary to fully evaluate staffing for the complete control room review e ffort.

REVIEW PHASE GPUN review phase plans and activities included:

i

1. Review of operating experience,

2. Review of functions performed in the control room, l 3. Review based on 1980 plan procedures,

l. 4. Control room inventory, and

5. Control room survey. -

For the most part, the above activities are those recommended by

NUREG-0700 guidelines as contributing -to the review phase objectives.

Activities 2,4 and 5 contribute to the accomplishment of specific DCRDR requirements contained in Supplement 1 to NUREG-0737. Activity 3 permitted 5

1

a' review and validation' of existing (1980) operator tasks and provided data relevant to the assessment phase of the project. This and Activity 2 are discussed briefly in the System Function and Task Analysis section to follow.

~

1. Review of Operating Experience A review of operating experience is not explicitly required by NUREG- .

0737. However, it is an activity recommended by NUREG-0700 guidelines as contributing to the accomplishment of review phase objectives.

As described by GPUN, its retview of operating experience included:

(1) a review of plant-specific Trip and other Licensee Event Reports, Experience Summaries, equipment maintenance and plant records to ensure that problems actually encountered in TMI-1 operation were identified and factored into the control room review; (2) a review of industry-wide expe- $

rience; (3) conduct of formal and _ informal opinion surveys of control room operators to identify strengths and weaknesses of the control room physical '

surroundings' and alarm system improvements; and (4) the acquisition of -

[ solicited and unsolicited information from operators during walk-throughs.

l From information provided at meetings and in submitted documenta-tion, it appears that GPUN performed an operating experience review consis-tent with guidelines provided by- NUREG-0700. Information and opinions were solicited from almost all TMI-1 operators during the walkthroughs, although little information has been provided on the number of operators formally surveyed. Industry-wide reports were reviewed and documented although the method and scope of the review have not been described. Such information would have provided greater confidence in the review of operating experience performed. by the licensee.

2. System Function and Task Analysis Supplement I to MUREG-0737 states that the licensee is required to perform a " function and task analysis (that had been used as the basis for developing emergency operating procedures) to identify control room operator tasks and information and control requirements during emergency operations."

In other words, the objective of the task analysis is to establish the input 6

. 1

u.

and output requirements of control room operator tasks. These information

' requirements are then to serve as benchmarks for examination of the adequacy of control room instrumentation, controls, and other equipment.

GPUN began its system function and task analysis activities in 1980 prior to the issuance of NUREG-0737 Supplement 1 and the guidance suggested in NUREG-0700. Methods used and findings were documented in GPUN's submittals (References 1 and 2) and discussed at meetings held with the NRC (References 3 and 4). Also, relevant portions of the GPUN submittal for the Procedures Generation Package was reviewed (Reference 22).

GPUN conducted its system function and task analysis during the 1980 review by: (1) defining planti functions and operator responsibilities; and (2) conducting walkthroughs/talkthroughs of existing (1980) plant pro- ,

ced :res for normal and postulated off-normal events using a full-scale mockup. In this way, functions were first identified and then validated. [

Task performance capabilities were verified. Control and display require- -

ments (availability and suitability) primarily were evaluated by the review team, relying on its experience and knowledge rather than by evaluating the facility against an independently conducted analysis of what control and

-display characteristics were most desirable. ,

Using this process, GPUN did not completely perform the systematic, a priori type of system function and task analysis recommended by NUREG-0737 Supplement 1. Rather an analysis of operator functions and

. performance capabilities revealed information and control needs required by.

operators to perform broad' functions of selected,1980 procedures.

Even though GPUN's analyses did not comply with all are,as required by NUREG-0737 Supplement 1, a review of findings showed that methods employed resulted in the identification of the same type of HEDs which would

- have been expected if an a_ priori system function and task analysis had been conducted. -

Between 1983-1984, GPUN completed a second effort specifically to address the function and task analysis (that had been used as a basis for developing emergency operating procedures) required by NUREG-0737 Supplement 7 ,

1. This effort, discussed and reviewed below, was described by the licensee 2 . in its supplement to the summary report (Reference 5).

GPUN has been an active participant in the system function and task analysis efforts of B&W, the NSSS reactor vendor for TMI-1. To date.

the NRC has not met with the B&W Owner's Group to discuss the Abnormal Transient Operating' Guidelines (ATOGs) used by TMI-1 as a basis for its Abnormal Transient Procedures (ATPs). However, the NRC has issued memoranda -

to two other owners' groups to clarify the requirements for performing a task analysis when the licensee uses generic symptom-oriented emergency operating procedures (References 19 and 20).

The ATOGs, as developed by B&W, were specific for the first B&W plant to implement rymptom-oriented E0Ps. The TMI-1 team examined the base plant and TMI-1 -for differences. Differences were reflected in the development of ten plant-specific procedures for TMI-1. $

Four steps were then carried out as part of the TMI-1 system function and task-analysis. Although the order has not been specified, the -

. steps included: (1) walkthrough of each step in each of the 10 procedures; (2) observation of operator training exercises in the use of procedures; (3) conduct of additional walkthroughs; and (4) desk-top analyses of tasks implicit in the procedures.

Based on information provided in the submittal, it appears that conduct of' the above steps by GPUN once again resulted in a verification of task performance capabilities and procedures. Neither steps 2 nor 3 were described in any detail. From the brief description provided, it is unclear

, whether the desk top analysis activity was conducted independently of the control room and new procedures, and if it was accomplished prior to the performance of walkthroughs. It is also unclear if the analysis considered control and display characteristics which then could have been validated in the control room. If these issues had been considered and addressed by -

GPUN, its system function and task analysis might have more closely approxi-

- mated the intent of NUREG-0737 Supplement 1.

8

- . - . _ - =. - . . . . . - . - . _ _ - - - . _ _ - - - . . - , - - - . - .

- _ = . - _.

. +

l What is clear is that walkthroughs resulted in verification of procedures. Walkthroughs verified that:

, 1. Instruments and controls called for in the E0Ps existed in the control room;

2. Devices necessary to confirm system status, indication, or control were in the control room;

3. Set points, units of measurement, and scale readings called for in the procedures could be determined from available instrumentation; i and

4. All controls in the control room could be operated in the manner called for in the ATPs.

• We concur with the GPUN submittal that the walkthroughs which -

~

constituted its system function and task analysis effort were _" procedure verification walkthroughs" (Reference. 5, pg.11.8). Their completion is not equivalent to the intent of the system function and task analysis require-ment of NUREG-0737 Supplement 1_because they are basically descriptive rather than prescriptive activities. Reference to Appendix 8. " Procedure Verification Walkthrough Data." performed in December,1983, shows clearly that the GPUN team systematically verified the hardware called out in the ATPs. There is no evidence in the materials submitted that indicates how or if a prescriptive process was used to determine the characteristics of the information and control needs to perform the tasks. (Information character-istics include such items as parameter type, dynamic range, setpoints, need for trends or alarms, etc. Control characteristics include such items as discrete or continuous, rate, gain, response requirements, etc.)

i Overall, we conclude that GPUN, in both its 1980 and 1983 reviews, performed a verification of procedures and a verification of task perform- .

_ance capabilities for selected 1980 procedures and all of the upgraded E0Ps.

l >

GPUN did not comply with the NUREG-0737 Supplement I requirement to system-

l. atically determine information and control requirements and the characteris-tics of those requirements independently of the control room.

9

3. Control Room Inventory The licensee's stated objective for ,nis task was to complete a control room inventory to identify all instrumentation,. controls and equip-ment within the control room. GPUN's inventory is based on photographs used for a mockup which include all components with which the operator inter-faces. ' The- actual inventory is included in a set of reproducible' drawings.

The compiled-inventory.was used by the licensee in several phases of the contro,1 room design review. First, during the review of. operator functions' inventory drawings were referred to extensively to determine if

. control and display requirements were met. The presence of extraneous controls and displays in the control room was noted. Missing controls, on the other hand, were primarily identified during the walkthroughs and from operator comments' ra' iar than by a comparison of requirements with an inventory. Second, the inventory was used as an integral part of the i

l control room survej effort. Third, inventory drawings were modified to

]

~

reflect proposed hardware changes to correct identified deficiencies.

NUREG-0737 Supplement I requires the comparison of control room control and display characteristics with those derived from a prescriptive task analysis. Because GPUN did not perform a comparison of display and control requirements based on a prescriptive task analysis with a control room-inventory, they have not satisfied the intent of NUREG-0737 Supplement

1. The inventory by itself as represented by a full-scale mockup and reproducible drawing was, however, satisfactory.

4. The Control Room Survey -

GPUN conducted a survey of control room components to identify' characteristics of instruments, equipment, and layout and ambient conditions that did not conform to good human engineering practice. The survey included: (1) a panel review (controls, displays, panel layout); (2) survey -

of alarm systems; and (3) survey of control room environment (ambient condi-

' tions, lighting, ' sound, workspace, etc.).

e 10

To conduct the survey, checklists were developed from guidelines contained in MIL-STD-1472B (Reference 14) and human engineering references such as VanCott and Kinkade (1972) (Reference 15), and Woodson and Conovar

'(Reference 16). The development of such guidelines was necessary as GPUN conducted its survey of TMI-1 in 1980 ' prior to the hsuance of the NRC DCRDR guidelines (NUREG-0700). GPUN's consultants from MPR primarily were respon-sible for formulating the guidelines, developing survey checklists, and conductng the survey. Human factors consultants, Drs. Sheridan and Christensen, assisted MPR in the development of proposed guidelines and survey techniques. Once developed, survey checklists were completed by reviewing photographs of panel components from the inventory. As necessary, quantitative measurements and qualitative observations were made in the control room itself.

It appears from both discussions with GPUN and a review of docu- -

mentation that the scope of the control room survey essentially was compre- )

hensive and included consideration of all primary control panels. Whether ,

the Remote Shutdown Panel was reviewed is unclear. Although not explicitly identified as a requirement in Supplement 1 to NUREG-0737, the NRC staff has -

recommended that a human engineering evaluation of the Remote Shutdown l Capability be included within the scope of the DCRDR. Of particular conc ~ern is the fact that we cannot determine if the specific guidelines and criteria used by the Ifcensee are in accordance with accepted human factors guide-lines and criteria such as those suggested by NUREG-0700. GPUN contends, i

however, that a comparison of its guidelines to NUREG-0700 showed that guidelines actually used were comparable if not more rigorous. The compari-son, however, has not been provided by the licensee for review.

In summary, as a result of discussions held with GPUN and a review of documentation, it is clear that a control room survey was conducted

basically in accordance with the requirements of Supplement 1 to NUREG-0737

! and the guidance of NUREG-0700. The completeness of the survey, however,

[ cannot fully be assessed until the licensee provides documentation to show -

the comparison between guidelines developed and used and those in NUREG-0700.

11 l

f

l

! ~ ASSESSIENT AND Ilm.DENTATION PHASE GPUN's assessment and implementation phase is addressed in Section IV of.their summary report and in the supplement to the summary report.

DCRDR findings and recommended corrective actions are described indepth in the licensee's 1980 submittal, the summary report and the supplement to the summary report. These were elaborated upon extensively during the meetings held between GPUN and the NRC.

1. HED Assessment Methodology Overall, GPUN's control room review resulted in the identification of almost 6000 HEDs, of which 4700 of the deficiencies related to label pl ates. ,A large number of pushbutton controls (400), vertical Bailey Meters (170), and word indicator lights (125) also were deemed deficient. The need for demarcations and relocations was documented as were deficiencies in [

light intensity.

HEDs from the review were assessed and prioritized by the review -

team. Deficiencies were evaluated either separately or in categories-depending on the type of finding._ Assessed HEDs were assigned a priority rating of 1 to 3 (high, moderate, low) based on the increased potential for operator error and the possible consequences of that error. Once a HED was prioritized, a recommendation was made for its correction.

Overall, GPUN's HED assessment activity satisfies the requirements of NUREG-0737, Supplement 1. Noteworthy is the fact that almost all HEDs identified, regardless of assigned rating, were corrected promptly.

2. Selection of Design Improvements GPUN briefly described the process used to select design improve-ments for HEDs identified from the review. The licensee notes that " human -

factors deficiencies can generally be corrected either by operator training and procedures, or by modification to controls or display hardware" (p. IV.1 Reference 1). The criterion used to formulate corrective actions for TMI-1 was:

12

4 "If a practical hardware modification can be devised which fixes the deficiency, then that modification should be made, whether or not the deficiency is safety-related in the narrow sense of this term."

Thus for each HED ' identified, whether safety-related or not, a decision was

- made to correct it via a. practical. hardware change. HEDs not amenable to change by hardware modification were corrected via training and procedures.

Surface enhancements (mimics, demarcations,. and relabeling). and component rearrangements were examined as potential hardware modifications.

They were graphically presented on the control room mockup. Operators walked through relevant procedures and provided feedback and their '

impressions of the changes to the review team as an aid to reaching a final optimal solution. It was indicated by the licensee that redesigns were sometimes required-before a solution was found that suited both operations [

~

and human factors engineering guidelines.

i Design alternatives also were reviewed by GPUN management and the .

i review team. Approval of changes was the responsibility of GPUN human i

factors personnel. It is noteworthy that the licensee has developed a'

~

, program that requires human factors' review for both the conceptual and final l designs of all control room modifications. MPR Associates, consultants to GPUN have also developed human factors standards for any future design of TMI-1 controls and displays.

A slide presentation of control room changes was shown at the April 18th meeting which illustrated the various modifications already in

!. place at TMI-1. The modifications are comprised largely of relabeling, I

demarcation, and mimic enhancements as the existing control / display arrangement typically was compatible with these types of corrections. Other

modifications include 6dding missing controls, changing procedures and i training, rescaling meters to provide more appropriate operating ranges, and -

implementing operator aids (red and green zone markings) for normal and off-l normal ranges. Major panel upgrades were also undertaken for the Emergency l Safety Actuation System.

l I

k-13

In conclusion, GPUN implemented an appropriate process to' select design improvements for those HEDs which warranted correction.

3 and 4. Verification that Selected Design Improvements Will Provide the Necessary Correction and Verification that Improvements can be Introduced in the Control Room Without Creating Any Unacceptable Human Engineering Discrepancies As part of the review initiated in 1980, verification was accomplished by a process whereby full scale drawings of panels showing design improvements were placed on the mockup. Walkthroughs were then performed by operators using the procedures or scenarios that originally resulted in identification of the deficiencies. Operator. feedback was solicited by the review team to verify that the corrections were compatible with ta'sk performance and did not introduce new or additional deficiencies.

The mockup of changes was also reviewed against human factors criteria. [

In conclusion, GPUN's-method to verify that improvements provided the necessary corrections and that no new deficiencies were created is found .

to meet the requirements of Supplement 1 to NUREG-0737. Additionally, as noted in the previous section, GPUN indicated that they now have an ongoing human factors program to insure that human engineering standards are main-tained in the future. Although not documented, it is presumed ^ that the  ;

operation of this program would have ensured verification of design improve-ments suggested from GPUN's review conducted between 1983-1984.

5. Coordination of Control Room Design Improvements With Changes From Other Programs GPUN responded to the NRC requirement to coordinate the control room design improvements with other programs in their letter of April 15, 1983 (Reference 17). This letter addressed the scheduling and coordination of the DCRDR, SPDS, upgraded E0Ps, Regulatory Guide 1.97, and the emergency -

response facilities. During the audit discussion, GPUN staff and MPR consultants specifically described some of the interfaces of the DCRDR with other NUREG-0737, Supplement 1 improvement programs.

14

. . .~. _ _-- __- _ _ _ . _ _ _ _ _ _ _ _ _ _ .

l For example, GPUN tarified plant-specific E0Ps during its DCRDR.-

GPUN also considered the coordination of the DCRDR with the emergency response facility while conducting walkthroughs of 1980 emergency operations. The implementation of the emergency plan was considered during the DCRDR while evaluating instrumentation on the Radiation Monitoring Panel. . As a result of this review, operator aids were added to indicators to highlight pertinent conditions or stages of alert that the operator needs to monitor. GPUN also evaluated the commu'nication functions associated with the initiation of an emergency plan while conducting its 1980 walkthroughs.

6. Proposed Schedule for Implementing Design Changes NUREG-0737 Supplement i requires each licensee to submit a proposed schedule for implementing design changes. Typically, GPUN has corrected identified HEDs promptly. No schedule has been provided for the correction of HEDs detailed in the following section of this evaluation. 2

7. Justification for HEDs With Safety Significance That Are Left Uncorrected or Partially Corrected -i Licensees have the option of correcting all identified HEDs or of

. assessing them for significance and correcting or' partially correcting only

those that are'significant. Correction of HEDs determined not to be significant is at the discretion of the utility. However, Supplement 1 to

~

[ NUREG-0737 requires all licensees to provide a summary justification for E

human engineering discrepancies with safety significance to be left uncorrected or partially corrected.

~

GPUN's approach for implementing corrective action' to identified HEDs was to correct all that were amenable to " practical hardware mddification

whether or not the deficiency was safety-related. This review focuses on GPUN's response to the NRC evaluation (Reference 21) of GPUN's earlier submittals (References 1 and 2), as well as the additional HEDs noted in the .

current supplementary submittal (Reference 5). "

15

. _ _ . . _ . _ . _ - . _ . _ _ _ _ _ _ . _ _ . . ~ . _ _ _._

o .

The followin3 HEDs were originally reported in References 1 and 2:

HED No.15. GPUN has determined the priority for replacement of strip chart recorders, but has not given a schedule for the completion of the work.

HED No. 16. GPUN has categorized the decay heat cooldown controls as low priority and is still studying corrective measures. No schedule was given for. completion of the work.

HED No.19. GPUN is currently modifying the page system. Other communication systems are being studied. No schedule was given for completion.

HED No. 20. GPUN has taken corrective action on the control room environment items to reduce noise, dust, and lighting brightness. _

A study showed "no instances of ... uncomfortable humidity." .

'Although not s'tated, it appears that GPUN used MIL-STD-14728 standards for their control room environment. If this is so, how -

does this Standard differ from accepted human factors guidelines such as those suggested guidelines in NUREG-0700?

HED No. 34. If GPUN did not use the suggested NUREG-0700 standard to compare the light intensity of the synchronizing light how does the standard they selected compare with generally accepted guidelines such as NUREG-0700?

l HED No. 36. No further questions.

l The following HEDs were reported in the supplementary submittal.

L HED No. 1. ATWS - Reactor Trip indicators. Even though the operator can obtain the required information by scanning indicator -

~

lights or observing the new ~ alarm CRT, there does not seem to be a step in the procedure to require the operator to do either task

nor does this appear to be an objective of a training ' program.

GPUN should consider changing procedures and/or training programs

{

I to avoid this situation.

16 I

I l

~

HED 4o. 2. Solution appears good, but no schedule was given for completion.

HED No. 3. Excessive heat transfer. The comment for HED No.1, above, applies here. GPUN should consider changing procedures and/or training programs to avoid this situation.

HED No. 4. OTSG tube leak. The steam generator is a safety system. The tape solution does not conform with accepted human factors standards, including those suggested by NUREG-0700. GPUN found this to be an unsatisfactory solution before; .why is it satisfactory now?

HED No. 10. High pressure injection flow. This is a safety system. The solution is inadequate. The GPUN assumption that the flow per pump is approximately half the flow through the common I valves cannot be proved without separate flow indicators at each pump. Consequently, pump damage could occur. The long term solution is also inadequate. This appears to be a case where -

individual pump flow indicators would be the appropriate solution.

~

'We concur with the proposed solution for the remaining HEDs. Also we concur with the justification for not correcting or partially correcting the remaining HEDs. -

Overall, this portion of the summary report is inadequate in terms j of NUREG-0737 Supplement I requirements. The licensee must provide appro-priate justification and specific human engineering standards for HEDs discussed above.

CONCLUSIONS AND RECOBOENDATIONS We conclude that, for the most part, GPUN's control room design -

review activities completed to date satisfy many of the requirements spect-fled in NUREG-0737, Supplement 1. The following is a summary of our com-ments on GPUN's compliance with each of the NUREG-0737, Supplement I review steps and requirements. Issues for which we need idditional information to ensure that the requirements have been met fully are raised.

17

9

It appears that a qualified multidisciplinary team was established to conduct the DCRDR activities begun in 1980. Specific tasks, resumes and levels of effort should be provided for personnel who were involved in the 1983-84 review of updated E0Ps and subsequent associated DCROR activities,

o. A review of operating experience was conducted consistent with NUREG-0700 guidelines and objectives.

o The licensee's SF&TA included walkthroughs of off-normal events which relied on existing (1980) plant emergency operating procedures and updated E0Ps. Thus the procedures and task performance capabilities were verified. However, a process to determine the characteristics of information and control need,s independent of the control room was not described and apparently .

not performed. As a result, GPUN has not completely satisfied the NUREG-0737 Supplement I requirement for an SF&TA.

o Because GPUN did not perform a comparison of display and control requirements based on a prescriptive task analysis with a control room inventory, they have not satisfied the intent of NUREG-0737 Supplement 1. The inventory by itself as represented by a full-scale mockup and reproducible drawing was, however, satisfactory, o A human factors survey of the control room was conducted in what appears to be a thorough manner. GPUN used guidelines which it derived from several sources. A comparison of these guidelines with those suggested in NUREG-0700 or an equally acceptable set of guidelines would provide additional assurance that the survey was comprehensive.

o The process GPUN verbally described to assess the significance of HEDs fulfills the requirements of Supplemer.t 1 to NUREG-0737. -

This process was documented in the supplement to the summary report.

18 i.

i o The process implemented and criteria used by GPUN to select design I '

improv'ements to resolve HEDs are found to fulfill the requirement of Supplement 1 to NUREG-0737. '

o For the 1980 review, GPUN used walkthroughs, as a part of its formal verification process to ensure that selected design improvements would provide the necessary corrections. Walk-  ;

-throughs were also used to verify that improvements would not introduce new HEDs. GPUN has failed to document whether this process was also used in the 1983-84 review.

1 o From information obtained at the meetings, the licensee indicated that it is satisfying the requirement to coordinate control room improvements with changes resulting from other improvement programs.

o GPUN has corrected almost all identified HEDs. A few, however, ,

have not been corrected or are only partially corrected at this time. The if censee should describe the scheduling process or -

milestones in sufficient detail to permit determination of whether HED corrective actions will be implemented in an acceptable time frame. For those HEDs with inadequate justifications the licensee should reconsider solutions.

2 .

e e

19 i

. . . _ - , - . - - - - . . . , , - . , - - , - . - , , _ . - . , . - , ,.--w--,---,_.-m.-, ..m.,--

REFERENCES

1. " Program Description and Summary Report of the Detailed Design Review of the Three Mile Island Unit 1 Control Room," GPUN Corporation NRC Accession Number; 8401230325, November 1983.

2. "A Review of the Three Mile Island Unit 1 Control Room from a Human Factors Viewpoint," GPUN Corporation, December 1980.

3. Meeting between the NRC and GPUN, Washington, D.C., March 7,1984.

4. Meeting between the NRC and GPUN, Washington, D.C., April 18, 1984..

5. " Supplementary Report of the Detailed Control Room Design Review for Three Mile Island Unit 1," GPUN Corporation, June 1984.

6. NUREG-0660, Vol.1, "NRC Action Plan Developed as a Result of the TMI-2 Accident," U.S. Nuclear Regulatory Commission, May 1980; Revision 1, August 1980. .

7. NUREG-0737, " Clarification of TMI Action Plan Requirements,"' U.S.

Nuclear Regulatory Commission, November 1980.

8. NUREG-0737, Supplement 1, " Clarification of TMI Action Plan Require-ments " U.S. Nuclear Regulatory Commission, December 1982.

9. NUREG-0700, " Guidelines for Control Room Design Reviews," U.S. Nuclear Regulatory Commission, September 1981.

10. NUREG-0801 Draft, " Evaluation Criteria for Detailed Control Room Design Review," U.S. Nuclear Regulatory Commission, October 1981.

11. NRC's Audit: NUREG-0752, " Control Room Design Review Report for TMI- -

1," December 1980.

20

12. Atomic Safety and Licensing Board: "In the Matter of Metropolitan Edison Co. Three Mile Island Nuclear Station Unit 1, Docket No. 50-289-SP Partial Initial Decision, Vol.1. - December 14, 1981," pp. 164-176.

13. "A Review of the Three Mile Island Unit 1 Alarm System," February 1981.

14. " Corrected Program Plan Evaluation for Three Mile Island Unit 1," SAI,

' April 4, 1984.

15. Military Standard MIL-STD-14728 Human Engineering Design Criteria for Military Systems Equipment and Facilities, Department of Defense, Washington, D.C., December 1974.

16. Var. Cott, H.P. and Kinkade, R.G., Editors, " Human Engineering Guide to -

Eculpment Design," Revised Edition, Government Printing Office,1972.. _

17. Woodson, W.G. and Conover D.W., " Human Engineering Guide for Equipment Design," University of California Press,1964. .

18. Letter GPU Nuclear, April 15, 1983, to Eisenhut.

19. Memorandum from H.B. Clayton, NRC to D.C. Ziemann, NRC, " Summary of Meeting with Westinghouse Owner's Group Concerning Task Analysis Requirements," April 5, 1984

-20. Memorandum from S.H. Weiss, NRC, to V.A. Moore, NRC, " Summary of Meeting with BWR Owner's Group Concerning Task Analysis Requirements,"

May 14, 1984.

i. 21. NRC review of TMI-1 Program Plan and Summary Report.

22. "TMI-1 Abnormal Transient Procedures (ATPs) Verification /Validatio n -

4 Program," Attachment 6. GPUN Letter.5211-842015 January 26, 1984.

TMI-1 TAC No. 51291 SAI/1-263-07-557-74 Contract NRC-03-82-096 l 21 4

_ _ _ . , _ . . ..____,.____._m., -

_-.._..___.__,..,...,,..,..__..____,___-._,_..-.-.c, -

APPENDIX - AUDIT DEETING The following is a description of some of the types of exhibits displayed and reviewed during the April 18 meeting between GPU Nuclear and the NRC.

o Documentation relevant to the development of control room survey guidelines. . File included correspondence from GPUN consultants regarding survey criteria and checklists.

o Documentation from the preliminary panel review, including checklists and worksheets.

o Documentation generated during the development of panel improve-ments. Guidelines for implementing improvements to ensure con-sistency and integration of all improvements were included. -

o Samples of.information label plates developed as operator aids were displayed.

o Documentation relevant, to meter modification requirements, including instructions for the removal and replacement of Bailey Meter Scales and the design and implementation of red / green bands.

o Extensive documentation for meter modifications including examples of improvements and corrections.

o Documentation generated during the alarm improvement review including a list of alarm groups evaluated, o Working copy of the control room environmental.. survey.

4 o Documentation relevant to the lighting survey. -

o Copy of Atomic Safety and Licensing Board review, "In the Matter of Metropolitan Edison Co. Three Mile Island Nuclear Station, Unit 1." Docket 50-289-SP, Partial Initial Decision, Vol.1 December 14, 1981.

22 i

. . ~ .;. ..

o File on the Emergency Safety Actuation System including correspon-dence from consultants around identified HEDs and suggestions. for improvement.

o' Correspondence and photographs relevant to the Emergency Plan Panel markings, o Documentation relevant to the roles of GPUN consultants in the control room design review.

,o Examples of types of data acquired from walkthroughs of normal evolutions.

o Documentation relevant to the literature search including references and examples of reports and forms reviewed.

o Slides of various aspects of the control room both before and -

after the implementation of design changes (i.e., makeup system, lighting, radiation monitoring panel, thermal and hydraulic -

panel).

l li-M h

(,

e 23

p......... ..

'g .~.

' , , if

'[

"I .

a 4

f. , c , , t ,

ENCLOSURE 3

-HUMAN FACTORS ENGINEERING BRANCH 7 ,

DETAILED. CONTROL ROOM DESIGN REVIEW

. SUPPLEMENTAL SAFETY EVALUATION REPORT u '"

.y .[ FOR

.THREE MILE-ISLAND, UNIT 1

g. -

! Discussion The" purposyof this SER Supplement is to close out the open issues relative-

'to TMI-1-Task Action Item I.D.1, Detailed Control Room Design Review (DCRDR).-

TheScienceApplicationsInternational' Incorporated (SAIC) Technical Eval'uatiionLReport-(TER) Supplement, which provides an: evaluation of the

General-Public Utilities Nuclear.(GPUN) TMI Unit 1 DCRDR open issues,.is' \

' enclosed..as Appendix d to:this SSER.- 'The~DCRDR issues closed out by this SER Supplement fare: .

l -

11.= Submittals of additional resumes and the definition of the

-functions, responsibilities,eandlevelsofleffortforstaff- '

~

• ~

involved in the 1983-1984 review;-

, s _

2.. A-descriptionofthesequenceandftheprocessusedto etermine  ;

information and control requirements / characteristics.. The licensee.

-wasIto generica11y' describe t'he process used to conduct in-depth interviews .with control room operators during the 1983-1984 review.

.' GPUN was to proYide 'some examples of HEDs . generated .as a result of

'the; interview process and their resolutions. Essentially, GPUN was

=

to trace:the analysis; process that was-used to generate an HED.

3 ,_

e =

______m____ _ _ . . _ _ . . . _ _ _ _ _ . _ _ - - - - -

l The licensee was also to identify which E0Ps were included in the 1983-1984 review.

1

3. Confirmation that the same verification methodologies used in the 1980 review were also used during the 1983-1984 review.

4. Submittal of implementation schedules for all HEDs with safety.

consequences identified during the 1983-1984 review.

^~

5. Submittal of documentation which describes the ongoing Human .

Factors Program at TMI-1 which relies to some extent on operator input.

An on-site audit to review results of the GPUN TMI-1 DCRDR and to resolve the open issues was performed by the NRC and its contractor SAIC, on October 4, 1984. The audit team was able to satisfactorily resolve the open issues relative to the GPUN DCRDR for TMI Unit 1. Discussion of these. issues is provided in Appendix A to this SER.

Conclusion Based on the staff's review of the TMI-1 combined Program Plan and Summary

. Reports, dated November 1983 and January 1984, Supplemental Summary Reports, dated June 1984 and December 1984, meeting with the licensee and its human factors consultants on March 27th and April 11, 1984 and the results of an on-site audit conducted on October 4, 1984, we conclude that GPUN has

.3 -

satisfactorily performed and completed a DCRDR in accordance with the requirements of Supplement I to NUREG-0737, dated December 17, 1982.

This safety evaluation was prepared by R. Ramirez, Human Factors Engineering Branch, Division of Human Factors Safety.

Dated: February 13, 1985 Updated March-25,1985 l-

+

BIBLIOGRAPriY l1. " Requirements for Emergency Response Capability," NUREG-0737, Supplement 1,'US NRC, Washington, D. C., December 1982, transmitted to reactor licensees via Generic Letter 82-33, December 17, 1982.

- 2. - Letter from H. D. Hukill, GPU Nuclear Corporation, to J. F. Stolz, NRC, dated January 16, 1984, submitting response to Generic Letter 82-33 for Three Mile Island, Unit 1.

'3. " Program Description and Summary Report of the Detailed Design Review of Three Mile Island - Unit 1 Control Room," GPU Nuclear Corporation,.

November 1983 (attachment to Reference 2). ]

4. NUREG-0700, " Guidelines for Control Room Design Reviews," U. S. Nuclear Regulatory Comission, September 1981.

5.. GPU Review, "A Review of the TMI-1 Control Room,From a Human Fa~ctors Viewpoint," December 1980.

6. Evaluation of the DCRDR Program Plan and Summary Report for Three Mile Island - Unit 1 (Draft), February 24, 2984.. .

7. Letter from H. D. Hukill, GPU Nuclear Corporation, to D. G. Eisenhut, .

NRC, dated April 25, 1983, submitting response to . Generic Letter.82-33..

8. NUREG-0660, Volume 1, "NRC Action' Plan Developed as a Result of the

-TMI-1 Accident," U. S. Nuclear Regulatory Comission, May 1980; ~

Revision 1, August 1980. -

9. 'NUREG-0737, " Clarification of TMI Ac' tion Plan Requirements,":U. S.

' Nuclear Regulatory Comission, November 1980.

10. NUREG-0801 Draft, " Evaluation Criteria for Detailed Control Room Design Review," U. S. Nuclear Regulatory Comission, October 1981.

i 11. NRC's Audit: NUREG-0752, " Control Room Design Review Report for TMI-1," December 1980 and Supplement 1 dated April 1981..

- 12. . Atomic-Safety and Licensing Board: "In the Matter of Metropolitan Edison Company Three Mile Island Nuclear Station. Unit 1, Docket No.

50-289-SP, Partial Initial Decision, Vol.1, December 14, 1981,"

pp. 1-164-176.

-13. "A Review of the Three Mile Island Unit 1 Alarm System," February 1981 (GPU Nuclear Report).

14~. NRC Report: Inspection Report No. 50-289/82-17 and Letter, Docket 50-289.

l........, , .. .

_____._u

[

15. Meeting, NRC and GPUN, Washington, D. C., March 7, 1984.

16. Meeting, NRC and GPUN, Washington, D. C., April 18, 1984.

17. " Supplementary Report of the Detailed Control Room Design Review for Three Mile Island Unit 1," GPUN Corporation, June 1984.

18. " Evaluation of the Detailed Control Room Design Review Program Plan and Summary Report For Three Mile Island Unit 1 (Rev. 3) SAIC," August 15, 1984.'

19. " Pre-Implementation Audit of the Detailed Control Room Design Review for GPU Nuclear Three Mile Island Unit 1, SAIC," October 30, 1984.

20. Letter from H. D. Hukill, Director, TMI-1, to John F. Stolz, NRC,

" Detailed Control Room Design Review Summary Report For Human Factors (DCRDR)," dated December 14, 1984.

21. " Evaluation of.the DCPDR Supplement II to the Summary Report For Three Mile Island Unit 1," SAIC, January 18, 1985.

22. ' Letter from H. D. Hukill, Director, TMI-1, to John F. Stolz, NRC,

" Detailed Control Room Design Review (DCRDR)," dated February 14, 1985