ML20126M104

Operating Experience Feedback Report - Human Performance in Operating Events.Commercial Power Reactors

ML20126M104
Person / Time
Issue date:	12/31/1992
From:	Kauffman J, Lanik G, Spence R, Trager E NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
AEOD-C92-1, NUREG-1275, NUREG-1275-V08, NUREG-1275-V8, NUDOCS 9301080202
Download: ML20126M104 (40)

Text

._ _ _ . _ - . _ _ _ _ . . _ . _ _ . . _ _ . _ _ . _ _ _ _ _ _

N U REG-1275 4 Vol. 8 Oaerating Exaerience Feedbac1 Reaort - Human Performance in Coera:ing Even:s Commercial Power Reactors mei. N emee_

U.S. Nuclear Regulatory Commission Office for Analysis arul Evaluation of Operational Data J. Y, Kautfman, G. I: lanik, R. A. Spence, li A. Trager

$p* **cuq$* $

• i o*..'

9301000202 PDR NUREG 921231 1275 R pop

.- . __ . , _ . . . . . . _ . _ . . . . . . - , . . . . a-.._.-,,_. . . , _ . - , _ _ . . . _ . . _ . . . . , , , , _ _ , , , , , .

I AVAILABILITY NOTICE Availabihty of Reference Materials Cited in NRC Pubhcations Most documents cited in NRC publications will be available from one of the following i sources:

1. The NRC Public Document Room, 2120 L Street, NW., Lower Level, Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082 Washington, DC 20013-7082

3. The National Technical information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC pubhca.

tions, it is not intended to be exhaustive.

. Referenced documents available for inspection and copying for a fee from the NRC Public Document Room Mclude NRC correspondence and internal NRC memoranda: NRC bulletins, circulars, information noticos, inspection and investigation notices; licensee event reports; vendor reports and correspondence: Commission papers; and applicant and keensoo docu-ments and correspondence.

The following documents la the NUREG series are available for purchase from the GPO Sales Program: . formal NRC staff and contractor reports, NRC-sponsored conference proceed-ings, international agreement reports, grant pubhcations, and NRC booklets and brochuros.

Also available are regulatory guides, NRC regulations in the _ Code of Federal Regulaflons, and Nuclear Regulatory Commission issuances.

Documents available from the National Technical Information Service include NUREG-series reports and technical reporte prepared by other Federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical fioraries include all open literature items, such as books, journal articles, and transactions. Federal Regisler notices, Federal and State legislation, and congressional reports can usually be obtained from these libraries, Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draf t reports 'are available free, to the extent of supply, upon written request to the Office of Administration, Distribution and Mail Services Section, U.S. Nuclear -

Regulatory Commission. Washington, DC. 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, for use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are' American National Standards, from the-American National Standards Institute,1430 Broadway, New York, NY 10018.

d

-me t'- yy-- er- g g y y m W & pgp e www --e v- rgyg.kPtitr t'f'W9TG8DV*t'8FTMW#$ -ee yp pvep-a-vig i. gy 4ir y yau y9yyge%y 4g remy+yg. sap yog.p. 4 mmp -s-gg 94%+gy6 pan.%'g4-- v- 'twu--- v - * -ysiriw1a-

. y, , eb'-Mf-T-

i i

NUREG-1275 Vol. 8

- 1 Operating Exaerience Feedback j

. Report - Human Performance in Operating Events l

Commercial l'ower Reactors 9-t Manowript Completed: Deccinher 1992 Date Published: December 1992 J. V. Kauffman, 0,13. lanik,11. A. Spence, II. A. Trager Division of Safety Programs Omec for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission Washington, DC 20555 .

+1 f+,

j ',E!

g r/# f1"

~

l-l l

l l

l

,6u., y.a-.

, ,,--+-,s., ---mg ,-ru , . , ,- . , , + , - , - . . ..p, nf4-,r<-, . , - , + , w ee + , . - , , s , ,, y .+

AllSTRACT ,

'lhis report describes the results of a Nuclear Regulatory to positive reactivity insertion, reactor scram due to con.

Cornmission (NI(C) program begun in 1990 to conduct trol rod withdrawal, pressurizer spray valve failure, par-onsite, indepth studies of human performance that af- tiallossofinstrumentairincontainment turbinebuilding fected reactor safety during selected Ixnver reactor pipe rupture, loss of shul down cooling, excess steam de.

events. 'lhe purpose of the program is to identify the fac- mand event, main steam isolation , loss of f ors that have contributed to good operator performance electrohydraulic fluid, and reactor water cleanup isola-during events, as well as the factors that hindered per- tion defeated.

fortnance, and to feed this information back to industry.

• lhis report provides information on control room staffing Under the huraan performance study program, six onsite and organization, the " dual role" shift technical adgisor, studies were performed in 1990, seven m 1991, and three use of shifL resources during emergencies, operator con-in 1992, l'ach onsite study was conducted by a multi dis- trol of engineered safety features, simulator training, ciplinary team, lead by an NI(C staff member, with addi- crew teamwork during stressful situations, task aware-tional NHC and Idaho National lingineering 1.nboratory ness, use of procedures, the human machine interface, personnel. 'the events studied include a wide variety of and licensee followup on event!i. 'the information could accident scenarios, including: stuck open safety relief be useful to licensecs in efforts to upgrade existing pro-valve, reactor trip with safety injection. reactor scram due grams Io improve safety, l

l l

r iii NURin t2 5, VolN gM+'*cn+'-"b-m-69N"1=v7M-'Pht] TMWFT-9'FC'.f7-U-Y'T"*"'F-""'- -1~TT**1'"-9""T'* **N"-M

i i

CONTENTS i 1

Page  !

AllSMtACT . . . . . . . . . . . . . . . . . . . . . . . . . ................. .....................,......... iii l i x n CU n V E S U M M Al t Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii AC K N O W Lii D G l i M l ! NI S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix AilllitEVIATIONS . . . . . . . . . . . . . . . . . . ... ............................................. xi 1.0 I N i lt O D U Cl l O N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 ,

1 2.0 l LUM AN Piill! OllM AN Cl! SI U DiliS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 l 2.1 1990 l ive n t S t ud i e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 ,

2.1.1 Peach flottom Unit 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . -2 l 2.1.2 Ca t a w ba U n i t 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , - 2 2.1.3 N i n e M il e Poin t U n i t 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 j 2.1.4 Dresden Unit 2 . . . . . . . . . . . . . . . . ....................... . . . . . . . . . . . . . . . . . . . 4 l 2.1.5 l i ra id wood U n i t i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1.6 Q u ad Ci t ie s U n i t 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.2 1991 !!ve n t S t udi e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.2.1 M il lst o n e U n i t 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.2.2 Oco n e c U n i t 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 2.2.3 Diablo Ca nyon U n it 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8- '

2.2.4 Monticello . . . . . . . . . . . . . . . . ................................................. 9 2.2.5 Wa t e rford U n i t 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2.6 Quad Cities Unit 2 . . . . . . . . . ......................... ....................... 10 2.2.7 C rys t al It ive r U n it 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.3 .1992 EventStudies...............,.................................................. 11 2.3.1 Prai rie I sl a n d U n it 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.3.2 l aSalle Co u n ty U n it 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.3.3 Fort Calhoun . . . . . . . . . . . .. . . ................................................. 13 3.0 AN A l .YS I S S ECrl ON . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 l 3.1 I n t rod u c t io n " . . . . . . . . . . . . . -. . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 i

3.2 Control lloom Organization '

. . . . . . . . . ............ ............... .................... ' 14-l 3.2.1 Staffing and itesponsibilities . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

(-

3.2.2 S hif t Tec h nical Advisor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.2.3 Tea mwor k Findin y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - 16..

3.3 Procedu res . . . . . . . . . . . . . 4 . . . . , . . . ..... ........................................ .. -17

[.

3.3.1 Procedural Adherence . . . . . . ..... .................... .................... .  : 17 L 3.3.2 - Knowledge-Ilased Performance During Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18:

o

3.3.3 Operator Preconditioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....... .... 18

. 3.3.4 Control of Emergency Safety Features . . . . . . . . . . . . . . . . . . . . . . . . . ...... .... 19-v . NUllEG-1275, Vol. 8

=- -- ,-  ;---

um -+wew=.-

7.- (y-egw v4 y r -r%=m T' vt w,q Pg iv 9-gi gp.<m,ev-we e- - - - m e-usev- wm W p us--hryweyr' g w g- e g + - gq w+y9 y mny- ' yew 9 *9 y i h "- vy 9 ' ,-g---@ r= ^9' %eTr=-.h-y9- W +$*

3.4 Ilutnan-Machine Interface ........................................................... 19 3.4.1 Sh u t down I nst ru m e n t a tion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 ..

3.4.2 Ope ra t o r A wa re n e ss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 3.4.3 In st ru m e n t a t ion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 .

3.5 I nd u st ry I n it ia t ive s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - 21-3.5.1 live n t it evi ew Proce ss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 ....

3.5.2 Industry Program to investigate iluman Perforrnance . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . 21 3.6 I;itr - i actors

................................ 4 . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . 22 4.0 PitOOllAM ACTIVITiliS . .

............................................................. 24 5.0 CO N C LU S I O N S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 ........

- 6.0 Il l i Fli it II N C l !S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25. . . . . . .

7.0 A P P l iN D I C l i S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 ..........

7.1 APPliNDIX A: llackground on the Position of Shift Technical Advisor . . . . . . . . . . . . . . . . . . .. . . 27 TAllLES Table 1 Iteason's categorinttion of 1990 1991 events............................................. . 22 Table 2 Categorization of 1990-1992 events..................................................... 22 Table 3 Factors associated with the even ts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 .......

l l

.NUltEG- 1275. Vol. 8 vi y -

-4 n.g, 'n,,.,.,.m-,,,.-r -N-.,,,,,,,~.mu ..,N,.=. m.n .

-.m ,...~.,.e ...p.w.. .- , , , . - ,.,p.n. .,n.e,en, ,.m v. N ,' m - ,en.,---,.- --

EXECUTIVE SUMMAltY

'the Olhec for Analysis and !! valuation of Operational factors compates the similarities among the events. The Data (Al:OD) of the U .S. Nuclear llegulatory primary observations and con:lusions of 1he special study Commission (NitC) began a prograrn in 1990 to conduct include:

onsite, indepth studies of human perfortnance that affected reactor safety during selected power reactor Control Itoom Organimtion events. 'the purpose of the prograrn is to identify the Control room staf f mg level. division of responsibility, and factors that have contnbuted to good operator degree of teamwork signtocantly affected crew response performance during events, as well as the factors that to events. Control room personnel were overburdened have hindeied perf ormance, and to feed this information duiing some events, despite the availability of sufficient back to industry. number of crew on shift, usually due to unequal task assignments.

Itach study was conducted by a multidisciplinary teatn, lead by an AILOD staff member, with additional NitC headquarters, terional, and Idaho National Engincering (the use of the " dual-role" shift technical advisor impaired crew performance because the other senior talxuatory personnel 'lhe studies focused on those reactor operators were overloaded when one senior factors that helped or hindered operator performance, reactor operator assumed the shift technical advisor role.

The team usua'ly spent I to 3 days onsite interviewing

'the " dual role" shift technicaladvisors sometimeslacked plant pctsonnel and gathering records. Indivi<Jual reports independent " fresh eyes" because of involvement in shift of each site study were prepared and distributed within activities. Other tasks, such as notifications. also the NitC, the site imolved in the study, industry groups, detracted from the shift technical advisor's safety and the public. NUltt!O/ Cit-5953," Studies of Iluman function.

Performance During Operating livents (1990-1992),"

(INiii. Iteport 1:0 0-2690, November 1992) desenbes ,

,pamwork during events improved human performance the results of the studies that were conducted. This case in complex. high stress situations. Good icamwor k was an study describes generic observations and conclusions important factor m knowledge-based performance, drawn from 16 such studies.

DuTiculties which arise due to control room organization

'lhese events, represent an estimated one fourth to and task assignments could be minimized, in most cases one third of the events which significantly challenged w thout additional staff, by changes to control room shift operating crews during this 21/2 year period. Sigstudies structure and assignments based on functional analysis were per formed in 1990, seven m 1991, and three in 1992. ( ncluding shift technic;d advisor functions) and lessons Nine events occurred at pressurized water rcactors and learned from analysis of opeiating events.

seven occurred at boiling water reactors len events occurred at power and 6 occurred in standby or shutdown Proc 0dtlicS mode at 15 plant sites lave studies were performed as part of Augmented Inspecti,n Team inspections w hile 11 Some operators acted during events without using a were performed solely under AEOD auspices- procedure. I'rocedure content, case of use, and management policy and practices influenced procedure

'lhe events represent a wide variety of event or accident use. Procedure problems were key contributorsin the less scenarios, including: stuck open safety-relief valve, successful events, but were not found in the more reactor trip with safety injection, reactor scram due to successful events when the procedures were accurate, positive reactivity insertion, reactor scram due to control complete, and management required their use.

rod withdrawal, pressuri/er spray valve failure, partial im if instrument air in the containment, turbine building Operators experienced difficulty in applying knowledge pp rupture, loss of shutdown cooling, excess steam to unusual plant conditions during events, which resulted demand, main steam isolation, reactor water cleanup in delays in recognizing and responding to events, Some isolation defeated during reactor water cleanup, relief knowledge-based performance is necessary in every event valve hiting, and loss of electrohydraulic fluid. to recognize the significance of the situation, initiate use of the appropriate abnormal operating procedures or

'lhis st udy summarizes each event and the findings drawn, EOPs, and follow those procedures to respond to events.

observations discerned from multiple events, and conclusions concerning overall human performance. Preconditioning from past experience, training, or

'lhese fall into four groups: control room organization, management direction stronely affected how operators procedures, human-machine interface, and industry recognized and responded to vents and in some cases led initiatives. Finally, the categori/ation of events by latent operators to disbelieve valid indications or take vii NUltliG-1275, Vol. 8

inappropriate actions. Pru mJitioning to bypass liSI' A lack of appropriately ranged, direct reading, control actuations is a significant petential safety problem. room instrumentation to rnonitor reactor pressure, temperature, and level caused opet ator s to have difficulty in two of 16 events investigated by Aliolh operators in accogniting and responding to shutdown events, when defeated the automatic action of an engineered safety operator actions were required to accomplish the safety featurc. 'Ihe operators conected 1 heir mistakes. functions of disabled, automatic safety systerns..'the NRC llowever, this expcrience may indicate a higher failure program on shutdown risk has addres<.ed these iwucs.  !

rate than anumed in probabikstle risk assessments.  ;

Some licensees have not provided sufficient guidance that IlldHStry lilllialiVeS limits defeating enginect ed safetyleatures, allowed for by techniert specifications and emergency or administrative 'the effectiveness of individual lleensee's studies of

• procedures- human performance during operating events varies '

widely, While some licensees have initiated worthwhile .

'ihese events show that some of the irnportant 'IMI plant kpeenficeorrectiveactions becauseof theirfollowup less<ms learned may not have been retained, on these events, others have mived such opportunities.

Improveracnts in the control of emergency safety features offer a high safety return in the reduction of Osk  :

from operator error. Industry groups are engaged in many efforts to improve human performance and human reliability. These ef forts litilnan Machine interface have resulted in improvements to plant, performance, procedur es, and programs. With the percetved reduction Annunciator and computer alarrns were important in the number of events caused by equipment failures, ,

operator aids in recognidng and responding to events. IN PO and other industry groups and human performance . >

Operators failed to recognize conditions that were experts agree that a key to continued improvement in off normal, but which were not alarmed during events. plant performance and safety is improved human ,

performance, liceause no one utihty will experience a Power reactors are designed to provide automatic safety significant number and a broad sange of types cf reactor response for accidents and design-basis transients events, infor mation colleet ed from across the industry is a imtiated during imwer operation. l'or events initiated means to provide a more complete basis on which to during shutdown. operators are expected to diagnose and develop gencrie guidance for improved operator respond appropriately. performance.

NURI!G-1275, Vol. 8 - viii

ACKNOWLEDGEMENTS interviews. In addition, the efforts of Orville Meyer and 4

We express appreciation to the licensee staffs for their llill Steinke of the Idaho National l(ngineering cooperation in pnividing the information necessary to analyte human perforrnanec during the operating events. laboratory in s.upport of the analyses are particularly We particubirly thank the operators who were on duty noteworthy.

during the events for their cooperation during the

?

e ix NUltliG-d75,' Vol. 8 '

i

_= ~ -

AllilitEVIATIONS Al 01) Analpis and I: valuation of NSO nuclear station opeiator Operational Data (Nit ("s Of fne for)

Augmented Inspection Tearn POltV powet operated relief vahe Ali I'lt i pressuriter relief tank l' Wit pressurved water reactor llWil bothrewater teactor llCIC reactor core isolation cooling Dillt decay heat reinoval itCS te: actor coolant systein i IIC electrobydraulic control 1(Iilt re.sidual heat temoval emergeng operating procedute 11 0 scactor operator 1:01' enginected safety feature llWCU scattor water cleanup l!St.

SCO senior contial operator t il'Cl high-pressure coolant mjection SCitti shif t conttol rooin engineer mstrument and control Sl! shift engineer IAC 1&li instrument and electrical SG tteam rencrator SI safety injection ilthi intermediate range inonitor senior reactor operator Sl(O licensee esent report SitV safety telief salve I .litt St A stuft technical advisor htSIV mam stearn i olation valve TS technical specification U.S. Nuclear 1(egulatory Comnussion 'I Sl! tecimical staf f engincet NitC xi NUltl!G- 1275, Vol, S

i l

Scoti"o l'ontam'an mt" auction and descisption of the 1.0 iNTROI)UCTION Al:OD program to investigate human performance durmg operating events. Section 2 contains a brief descuption of och event studied, includmg important Operaur.e ocots have shown the irnportance of human hndings. Section 3 is the detaued analysis section and performaivx in reactor salcty. To otm udditional contains observations, background diwnssion, and-infornuta,6. Ow Othee foi Analyn aim, livaluation of e amples. Section 4 contains a brief discussion of future '

Upcrauon,d Data (Al OD) of the U.S. Nudear prognim events. Section 5 contains tonclusions regarding

- llegulatory Comimssim WitC) bern a pnpon m 1990 actions that can be taken to ituprove human per formance ,

to conduci onsits,indepW Whel bonyn per formance its response to r;wrating events. Section 6 contains durmg selected power reacmr crew %e tiurpose of the :cierences Stction 7 contains an Appendix that pnnides propram is to identify the factoo, tha' nave rentrihtned to additional backgrouri ' regarding the shilI technical gmd operator performance durmg events as well as the advisor (S t A) position.

~

fattors that have hindered pc formance, and to aced this infortnation back to industry. 'Hus report is provided to livents were selected for onsite cvaluation when human describe potentially genenc observations and onclusions performance appeared to be nn important factor in the reached f rom these studies. progression t.f the event (i.e., rbe event was a complicated es ent or transient, operators perfor rnance appeared to be cmptional, or ae did not understand the response by the Over the tut 2 ,2 years, Ai!OD has investigated 16 opnatoid F.ach onsite analysts team was events as part of this program. These me :epresentative muWuiplinary and led by an NI((, staff rnember with of events that were strongly infh" nced by human additional NltC headquarters, regional, and Idaho performance during this time period. The can be National lingineering laboratory personnel. Site visits considered reablime testsof the operatonand the factors

• "C 5""% C"" ducted within I to 3 dayofter the event llut affected their performance.

so the operators, recollections of the events would be as

.. fiesh as possible. Data acquisition and preliminary Individual reports of each sne visit were prepared and analysis required from 1 to 3 days onsite. The iluman-distributed withm the NitC, to the raes m, vohlcd m the Performance Investigation Process prohical developed in studies, and to mdustry groups, and AliOD ttted to get cooperation with the Nite Office of 1(escaich provided a f eedback on the studies. Durmg 1990, Al!OD met with meful collection of techniques to facilitate this work consultants, Dr. Tom Sheridan of the Massachusetts Institute of Technology, and Dr. A!! Mosleh of the Interview gtides were prepmed in advance of the site l University of Maryland. Telephone conferences were visits. The specific details of the event determined the held with management at the sites where studies had type of data that were relevimt. The principal sources of l

been conducted and a presentation to the ACl(S was data were plant logs, computer records, and interviews l made in order to obtain comments and advice on ways to with operators on duty during the event 1.icensee improve the studies.On March 23,1992 AliOD met with management and operators cooperated in the data l Professor James Iteason of the University or Manchester, collection.

Dr. IlaroM Van Cot, of the National Academy of Sciences, and Dr. Sheridan to obtain their comments and A more detailed progmm description is provided in suggestions regardmg continued progress with the studies iteference 2.

04 # 4 2.0 llUMAN PERFORMANCE The events were comples with human performance STUDIES l influenced by many, often interrelated, factors. The

,fo date, AliOD has performed 16 human performance i analystu hiok'd e broadly to identify the most significant stadiesL6 in 1990,7 in 1991, and 3 m 1992 Ilesults of the contiibuting factors.Ihat helped or hindered operator performance. The studies provided insights t' multiple hdipdupi studies are summarized below. More detailed -

der.criptmns can be found in the individual event reports.

factors affectmg human performance,includ> samples lhe events occurred at power and durmg shutdown, Nme of good practices as well as changes that chid improve nents occurred at pressurited-water reactors (PWils) human performance, and 7 occurred at boiling water reactors (llWits). The events spanned a broad range of conditions, An interim report was issued ,m May 1991 (llef. 2) t" happenstance, and challenge, desenhe the observations and findmgs from the fint six studies performed. This report descnbes the 6 original 2,[ 1990 Evesit Sttidies studies and 10 additional studies performed since then, summarizes the results of the studies, and describes the The 1990 human performance studies concerned the analysts observations and the conclusions they reached. following six events:

h in NUltliO-1275 Vol. 8 T 'T" 7 1g'W9*"M f 'fpre egabNumya g' y-w gr g w='e1=Pm * * - - - - = y r gs y qg gp--o pg---ter e-pw eg-"-==-g yy *-pw -vt e vem-g mgy=rgr-+M-ewek g- g*-py<M-wh e y ytyp 'e -' y e4 % n r---W C g w 9 g"g=e--e'

2.1.1 Peach llottom Unit 3-Loss of (MSIW) and stopped the lillC pumps ending the Electroli)draulic liluid (1/28/90) hydraulic fluid leak. Operators stabihred the r eactor level at about 9:50 a.m., appammately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after reactor

'lhe peach llottom Unit 3 cvent (Ref. 3) occurred at 8:5$ scram.

a.m. on January 28,1990, while the plant was at 99.8 percent power. A major leak of electsohydraulic control Peach llottom Unit 3 findings:

(lillC) fluid was observed from a main turbine control ,

valve. Anticipting a potential turbine trip without bypass lhe strategic direction of the control room crew was transient (if 1: llc was lost), the shdt manager ordered a proactive and in accordance with the technical bases fast power reduulot. '.o about $0 percent-power and then for the liOPs.

a manual scram of the reactor.

• Reactor operator (RO) actions were in accordance with procedures and training: however, they were Pecdwater pumps A and 16 were manually tripped to inadequate for use of condensate pump A after prevent overfill: however, the high reactor vessel level reactor t.ciam or use of reactor feed pump A or 11 to transient following the scram caused a trip of feedwater back up reactor feed pump C. Procedures were pump C. 'lhe operator was unabic to restart feedwater written for startup rather than recovery, pump Cand did not attempt to restart feedwater pump A or 11. The configuration of the trip reset indicating light *

• the control room crew experienced a high level of for Unit 3 reactor feedwater pump turbines was differer t stress caused by the anticipation of a potential from the Unit 2 configuration and that in the simulator, turbine trip without bypass and the need to After the event, the licensee identified that a common overcome human machine interface problems, error in the maintenance of reactor feedwater pump turbines would have prevented restart of turbines 11 and e llecause of the lack of a direct-reading flow C. Ilowever, reactor feedwater pump turbine A could instruttent, control of IIPCI flow to the vessel was have been restarted. errvk

'lhe shift manager directed a fast reactor pressure Prior training and good communications helped the reduction. '!he pressure set point on the turbine bypass crew shut down the plant safely.

valves was lowered to dump steam to the condenser to l feed the reactor with condensate pump A. nyts also 2.1.2 Cattmba Unit 1-Ilenctor Coolant provided a greater pressure rnargm agamst openmg of a m h p M-dn p/20/9@

l safety relief valve (SRV). 'lhe technictd basis for the i emergency operating procedures fliOPs) cautioned .lhe Catawk. Unit i event (Ref.4) occurred at about 9.20 l agamst unnecenary heating of the Mark i suppression a.m. on March 20, 1990, while the plant was in cold t

pool by opening the SHW. The crew was unable to shutdownJihe operators were performing reactor fill and

establish reactor feed flow from condensate pump A unt operations following a refueling outage. During the because they did not close the suction valves for reactor nitial pressurization of the reactor coolant system (ItCS) feedwater pumps A and 11. The open suction valves to 100 psig, the operators overpressurized the ItCS and allowed the flow from condensate pump A to be returned the residual heat removal (RliR) system because they to the condensate tank through the three 6-mch were monitoring pressure instrumentation that was noperable, minimum recirculation flowhnes from the reactor feedwater pumps. 'lhe procedure for teactor feed with condensate pump A was written for plant startup when 'lhe event started when the oncoming day shift began the feedwater pump suction valves were normally closed. pressurizing the RCS at about 7

05 a.m. The pressuriier was filled until water exited the power operated relief .

valves (PORW). The operators shut the PORVs and With no reactor makeup available from the feedwater and condensate systems, the crew placed reactor core placed them in the low temperature overpressure isolatia cooling (RCIC) and high pressure coolant protection mode. The operators increased charging injection (llPCI) systems in senice because the RCIC makeup flow from centrifugal charging pump lit to 100 system alone was unable to maintain reactor level. 'lhis ppm and decreased letdown flow to 30 ppm. 'the target RCS pressure was 100 psig.

required Ihe r w to etmtrol iIPCI turbine speed and the

' - test return line throttle valve. 'lhe 1iPCI flow instrument Similar previous pressuri/ations had required 4 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> measured total flow from the llPCI pump. With the to reach 100 psig. llecause gases are usually trapped in return line open, there was no quantitative measure of the steam generator (SG) U-tubes, the pressm e rise is not injection flow to the reactor vessel. Reactor level descetable over the early, longer part of the charging a

fluctuated between -10 inches and + 60 inches At 9:35 period. The operators had three indicators of RCS P m., the crew shut the snain steam isolation valves pressure: two wide-range (0 to 3000 psig) and one NURliG-1275, Vol. 8 2 r

I l

narrow-range (0 to 600 psig). Ilowever, the operators

• The operators vented the itCS longer than usual were not aware that all three RCS pressure instrument before system pressuritation without considering transmitters were still isolated following welding of the that this might cause the pressure to rise more rapidly than on prior occasions. I tube fittings during the refueling outage. 'the two i wide-range RCS pressure instruments were also the No armunciator alarmed when the RIlit system was e

sensors for the low ternperature over. pressure overpressurited, because the maximum RilR protection mode for the PORVs.

pressure was below the actuation set point of the RUS pressure rose faster than anticipated 'lhis may have pressure switch. Also, the computer alarm was occurred because the previous shifI extended venting for inoretable because it used a signal from the isolated I to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> longer than on previous fill-and vent pressure transtmtiers.

operations. At 9:38 a.m., the RIIR pump Il suction relief  :

valve lifted and limited RCS pressure to 455 psigand the 2.1.3 Nine Mile Point Unit b-Partial Loss RilR pump A discharpe prenure to 625 psig. 'the of findritirleitt Air (5/14/90) operators did not observe these pressure rises, although On May 14,1990, at about 8:50 p.m., Nine Mile Point ,

the RilR discharge presure indicator was operable 'the _

Unit 2 (Ref. 5) experienced a partial loss of instrument RilR suction relief valve remained open, passing the air. As a result of this loss, the offgas system was affected, RCS charging flow to Ihe pressurizer relief tank (PRT).

subsequently causing a decrease in condenser vacuum When the operators obsened the rising PRT level, they and ultimately causing the operators to scram the reactor began searching for the leakage path from the RCS. at about 9:20 p.m.

flowever, the operators did not know that the RCS and the RllR system were pressuri7ed. A systems engineer UnL 2 was at .100 percent. power before the event.

entering the control room at this time noticed the high Numepus alarms were received from the offgas svrtem RllR system pressure and brought it to tije attentron of during the shift that the operators believed were c'aused the control room operators. No annunciators alarmed condenser air inleakage. At approximately 8:52 p.m.,

durmg this sequence because the maximum RI1R th o@ system steam pressur e alarm was received.'ihe pressure reached was slighdy b(low the actuation set operators found that the steam supply valves to the offgas point of the alarm pressure switch, and the computer system had closed. At approximately the same time, an alarm yet its signal from the inoperable pressure itO in the control room observed a seal water discharge transmitters. valve to the mechanical vacuum pumps was open. 'the opemtor immediately r,uspected a localized loss of Catawlu Unit 1 findings: mstrument air or an electrical problem, but no electrical problem was detected.The operator discussed this with

• Plant procedures failed to ensure that the itCS the Unit 2 chief shift operator.

pressure instruments were returned to senice following maintenance and no formal independent A nonheensed operator was dispatched to investigate.

review 0f outstandmg work requests was made The operator had supervised the contractor who installed before m,i ,tial fill and vent. the instrument air sptem and had sufficient knowledge of

@c pem to suspect maynh a padaHe enskumW

• The tagging procedure did not require placing > att had occurred.11e confrrmed this by walking down the out-ol.semcc tags on inoperable control room systems and opening the instrument air test connections.

indicators. 17 tom 8:58 p.m. to 9:19 p.m., the control rmm operators noticed decreasing condenser vacuum and lowered power

• 'lhe operators did not monitor Ihe letdown chemical h redumg r,emulahn now aM then mmhg some and volume control system pressure and the kliR c ntrol rods, The operators scrammed the reactor from pump discharge pressure, lloth indicators are 45 percent-power at 9:19 p.rn.

hicated near the RCS pressure indications.

Monitoring pressure changes in the chemical and 'ihe operators entered the IIOPs when the reactor water volume control system and R HR systems could have level fell to 144 inches and exited the IIOPs when water L

been used to confirm changes in RCS pressure, level was restored to its normal band at 9:25 p.m.

l e While the increasing PRT level indication alerted On May 15,1990, the licensee staff found a ruptured the operators that the RCS response was abnormal, instrum'ent alt line in the turbine building. An excess flow l

L their initial mind set was that the PORVs were - check valve had prevented the partialioss of instrument leaking and that the RCS was not pressurized. A air from becoming more widespread.

l previously uninvolved RCS system engineer did not

(; have this mind set and alerted the operators to the This event etm be summarized as a successful shutdown of high RllR system pressuici the reactor after the operators properly diagnosed the l

3 NURiiG-1275, Vol 8 J

, - _ . . . , , . . . . . - . - . , . _ . - , , - - , _ . . . , . _ , _ _ . . . . _ ~ - M . . .. .s - - - . - . , . -

- . ~ _ _ - _ - - - _ - - - -_-___-

i i

problem. 'lhe operators took a symptomatic approach _ reduce systern pressure to apprmimately N)0 psi. 'lhe S!i l alter the eactor was scrammed even though they had believed it was necessary to reduce heat input to the torus  !

diagnosed a specifte esent. and hoped the SRV would rescat.

t Nine Mile point Unit 2 findings: 'lhe open SRV blowdown to the torus initially caused the l temperature of the torus to rise rapidly (1.3* 17/ minute).

• The control room crew diagnosed the equipment - Opening the two tmbine bypass valves for 2 minutes pr oblem accurately and responded quickly in spite of reduced the total heat input to the torus but contributed numerous nuisance annunciators, to a 129' F plant couldown in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, w hich was in excess of the 100' F/ hour norrnal cooldown limit, (plant

• Troubleshooting of the problem was hampered cooldown without opening the turbine bypass valves  ?

because the piping and instrument diagrams for the would not have caused the torus temperat ure to approach air system were not complete. 'lhe diagrams only sts heat capacity temperature limit.) 'lhereafter, plant showed piping up to the major isolation vahes, and couldown and decay heat removal (1)llR) were af fected for a partial instrument air loss, the operators had to primarily by the SRV blowdown to the torus, although all watch for individual failure alarms or walk down the auxiliary steam loads were not secured until later in the systern. event.

• The " Instrument and Service Air System Dresden Unit 2 findings:

Procedure" was written primarily to address a total e 'lhe control room emergency organization provided  !

low ofinstrument air rather than partiallosses of the 1 ttic assistance to the Sli When the Sli became the system, emergency director and assumed command of a ,. control room activities, he had little assistance in

,lhe operators had undergone simulator traimng on a loss of instrument air scenario, which aided in the analyzing the condition of _ the plant and in monitoring and evaluating operator activities.'the diagnosis and mitigation of this event. "

SCRii was making telephone notifications and the two shift foremen were out in the plant -

2.1.4 Dresden Unit 2-Sluck Open Safety Relief Valve .(8/02/90)

• The turnover of controt room supervision during the event resulted in reduced and discontinuous SRO At 1:05 a.m. on August 2,1990, Dresden Unit 2 operators advice and communications in the control mom.

manually scrammed the plant after trying unsuccessfully 'lhis may have contributed to misjudgments that

! to shut an SRV that had failed open (Ref,6). Over the were made during the event,(c.g., excessh e concern -

- next hour the plant cooldown rate reached about 129' . with torus heatup and lack of concern for a high F/hr. This exceeded the technical. specification (TS) cooldown rate).

normal couldown rate limit of 100* F/hr,

• Although spurious opening ol,~ an SRV is an l Unit 2 had been at approximately 80 percent power and anticipated event for a boiling water reactor, there decreasing load at 100 MWe/hr when an acoustic monitor was no event. specific guidance for piant. cooldown j act uated and ot he r indications (50 MWe drop in electrical in the plant procedures or training material. *lhe TS l

output, rapidly rising torus water temperature, and basis for this event stated that if the reactor is increasing SRV tailpipe temperature; although this was scrammed before t he torus reaches 110' F, the torus not consistent with the SRV position indicating lights) can safely dsorb Ihe heat hiad from plant cooldown were received of a stuck open SRV , The shift contml caused by an SRV blowdown.

room engineer (SCRii) (degreed,' " dual. role" senior e reactor operator [SRO] and STA) decided that an SRV The operators were generally unaware of generic industry. problems involving stuck open SRVs at was open and notified the shift engineer (Sli). The Sli other llWRs.

relieved the SCRl! and negan directing the activities of '

the watrol mom crew. The SCRli assumed the 2,1,5 liralduood Unit 1-l.oss of Reactor responsibilities of STA.

Coolant (10/04/90)

Using the abnormal operating procedure, the operators The liraidwood Unit i event Oter. 7) occurred at 1;24 a.m. .

tmsuccessfully tried to reelose the relief valve. The S!! on October _4, 1990, while _in cold shutdow n.

- then ordered the crew to prepare for and perform a Approximately 600 gallons of reactor coolant were  ;

manual reactor scram. Ifollowing the scram the Sli_ inadvertently discharged through a vent valve, resulting l

became concerned about the unexpected high rate of in contamination of personnel. A studyof the event was heatup of the suppression pool and without procedural performed as part of a Region 111 Augmented Inspection guidance ordered opening two turbine bypass valves to Team (All) investigation (Ref. 31)  ?

NURl!G-1275, Vol. 8 4

~%_._ a. - _ _ _ . _ . . _ _ . _ _ _ . _ _ _ _ _ . _ . . _ ;_ _ _ _ ,

At the time of the incident,ihaidwood Unit I was in cold NSO not dosely nmnitormg the activities being shutdown with the RCS at approximately IMi* 10 and .%0 conducted in the Unit I amtrol toom, psig. Technical staff engir cen ('I SEs) wer e csecuting two pnwedures in jurallet: IlwVS 4.6.2.2-1 TI(cactor (2) TSH 3 and the auuhary NSO had a moderate level of Coolant Systern Pressure Isolation Valve Irakage task involvement and awareness. Although they  !

Surveillance," and itwVS O.5-2.ltil.2- 1, *Itesidual ileat directly participated in executing some of the 1(emoval Wlve Stroke Test," 'Ihe two sun cillancc5 had activities associated with the two procedures, both -

begun on the third shift (3 p.in. to 11 p in.) and were still individuals appeared to lack an= overall ongoing at shift changeover from shifts 3 to I (I I p.tn. to 7 understanding of the system's configuration. 'the a.m.). At approximately 1:20 n,m.,'l Sl% 1 and 2, stationed auxihary NSO did not involve himselfin snonttoring in the amtrol roorn, instructed TSU 3, stationed in the the state of the system while execudng the valve 364 foot elevation of the Unit I auxiliary building manipulations and thus did not serve to provide penetration area, to have the equipment attendant close redundancy to the activities of'ISHs I and 2.

a vent valve, which was being used to collect leakage across an 1(CS pressure boundary isolation valve. At (3) TSHs 1 and 2 had a high state of task awareness and approximately h24 a.m., ~13H 1, without lecciving were directly involved in conducting ' and confismation innu TSH 3 that the vent valve had been coordinating the two procedures, closed, instructed the ausdiary nuclear station operator (NSO) to open a different valve as part of the 1(Ilit valve .hu.s tad invokemenUawarenen omhumdon was such Ih"I overall task success was essentially a function of stroke test. When the auxiliary NSO did this, the 1(CS was aligned to the inlet of the still open vent valve. I' low h ! and 2s pedonnane, Howner, een  ;

perfonnance was affected by conducting a difficult through the sent suddenly surged and hurst the tygon mordnadon tad whHe subect hi fatigue. Without -

4 tubing attached to the valve, and the hot water sprayed redundancies or checks on their performance by other personnel in the auxiliary building. 'the total indicated operational personnel, which would be expected in an loss of pressuri/cr level was $ pertent, from 40 to 35 cUWuw stnatum, Om hkcMuiod of uninhang some  ;

percent, which represented a loss of approximately 600 type of ewr was quite high.

pallons.

(onunand, control, _imd communication w'ere - nol~

TSli 3, another 'thl! present in training with 'mli 3, and eUc w dudng qm emuu;on oNmse two suneWances, the equipment attendant wcre decontaminated folhiwing .Du' SH, du' , an Om nh I wem not the incident, 'lhe equipment attendant teceived a sunwn'ndy second-degree burn approximatel' 2 inches in diameter command to oUcr oms @t of dm M ,

a v nor be awm of changes in Om KS on his lef t forearm when he shie ded his face from the spraying water, After being decontaminated, he uus '"" N"

• O"'

taken to a hical hospital to have the burn treated, liraidwood Unit 1 findings:  ;

Coordinating two procedures in parallel without any * 'the coritrol room crew was not sufficiently aware of wntten guidance represents a fairly cornplex, dynamic or involved in the surveillances that were underway, task, which required knowledge-based as opposed to rule-based performance by the TSHs. 'the probahility of

• The TSHs were performing a relatively complex, making an error or mental slip (e.g., momentarily dynamic task while in a state of fadgue and there forgetting a step)is relatively high in such situations, and were no redundancies'in place to_ help prevent -

may be increased if the person involved is fatiguedJlhHs errors.

I and 2 had been on the job for 17 to 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br />. In . . .

executing dynamic tasks it is critical that system

• These surveillances were conducted with ineffective redundancies or checks be in place to catch or prevent command, control, and communicadons, such enorsi llowever, no such redundancies were in place. 2.1.6 Quad Cilles Unit 2-Itenctor Scrum-L Due lo Control llod Witlidrawal Operational and TS!! personnel exhibited three levels of (10/17/90)

. lask involvement or task awareness during this event:

- (1) 'the SCiti! the Unit 1 NSO the

, , SH and the shift

, p.m. on October 27, 1990; while in hot standby, 'the advisor had a low level of task aware ness and, in fact, leactor scrammed on hi hi intermediate range flux were t ot aware that two pnwedures were being because the operator withdrew rods to increase reactor conducted,'this lack of awareness was attributed to pressure without recogniting the need to follow the insutheient information being transferred during normal procedures for reestablishing reactor criticality, the shift turnover and the SCl(H and the Unit i NI(C Information Notice 91-04 "lteactor- Scram 5 N UltliG-1275, Vol. 8

-1 ry -.rr*W'www'pr N v -i-vSy e m --

r-w gt <-tm.v*~rurr==-+e.Ty1 t- *r a *-t erw er .W rre=--wm-,,- , - w m- NW y e-**W=

• we r r v euw--e y s em v y* - T w eeira- wF

l i

Following Control llod Withdrawal Associated With I ow Quad Cities Unit 2 findings: l Power Turbine Testing," (itef. 9) was later issued as a result of this event. * 'lhe plant stalf had alow level of awareness that the reactor conditions required by the turbine torsional "the objective of Unit 2 operations during this event was test would be difficult to maintain. 'this low level of -

to support a special test to precisely determine the task awareness began vcith the planning and i torsional resonant frequencies of the turbine generator preparation of the special test and carried on rotors. A temporary change was issued on October 24, through all activities to culminate in the reactor 1990, to the normal operating procedure for " Shutdown scram. 'lhis was also reflected in the procedures, From Power Operation to a Standby 1101 Pressuri/ed which had no special instructions for reactivity .

Condition," to allow the use of recirculation pumps and management and no cautions about possible high F control rods to reduce power and thereby provide greater rod notch worths.

flexibility during power reduction to hot standby. 'Ihe ternporary change did not identify any special instructions

• 'the Silos did not adequately monitor control md t or cautions. manipulations by the Unit NSO.

e itequalification training had not covered reactor Shift 1(11:00 p.m to 7:00 a.m.)had attempted the test on operation in hot standby, and the operators had no October 27.1990. lhe Unit 2 NSO had mserted control special training or briefing fm the special test.

rods to reduce reactor pressure to shut the turbine bypass valves and permit connection of special test circuitry to , Information on similar events at other stations had the tilIC system. During this maneuver the NSO noticed not been disseminated to the ilus, high control rod notch worths. 'ihis information was -

passed on orally from shif t I to shift 2, but not from shift 2 * 'lhe Unit 2 NSO did not report back anyinformation to shift 3. No log entry was made of this information- to the SCllii while executing the SCllli's command

. to insert control rods, although the changes in rod Operators again attempted to perform the special test on positions and reactor power level were significant j shift 3. On shift 3, in addition to the special test, there enough tojustify supervisory overview by the SCill!, ,

were other conditions that were of concern to the S!! and the S Citli: * 'lhe communications between the Sl! and the SCill!

and between the SCilli and the NSO were minimal (1) two intermediate-range monitor (IllM) channels and did not contain cautions or directions to report were " bypassed," because one litM had a spurious information back.

trip, and one IllM remote detector drive was inoperable with the detector inserted. * 'the Unit 2 NSO performed the procedure alone but

, failed to monitor reactor power when moving l (2) the drywell had been deinerted to permit entry. control rods.

I

. . ,

• Although shift I observed high notch worth,Ihis was

.there is limiting condition for operation in the plant,sTS not recorded nor passed on to shift 3.

that required reinerting within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or the plant would have to be put in hot shutdown.

2.2- 1991 Ercilt Sitidies At 3:10 p.m., plant management decided to abort the 'the 1991 human performance studies concerned the special test and return to power.The Sli telephoned the following seven events:

SCitll and directed him to take the l'illC off line to .

permit removing the special test circuits. The SCill! 2.2.1 Millstone Unit 3-Turbine llulldinh directed the Unit 2 NSO to insert control rods to reduce Pipe Rupture (12/31/90)-

reactor pressure to less than 800 psig. 'lhe NSO inserted L control rods, a total of 84 steps,' while observing the 'the Millstone Unit 3 (Itef.10) event occurred at 4:33 .

l reactor pressure decrease. The reactor pressure p.m. on December 31,1990, while the unit was operat.ing decreased to 770 psig, but at the same time the reactor at 86 percent-power. Two 6 inch diameter moisture power had decreased to llange 1 of the IllM (the lowest separator condensatc return drain lines ruptured and' i range of the litMs; the reactor was signific4mtly discharged hot condensate system steam and water to the  :

suberitical). At 3:58 p.m. the NSO began ral withdrawal turbme building. A llegion i AITinvestigated the event I to increase pressure and withdrew one group of four rats and issued the AIT report on February 12,1991 (itef.11). 1 one notch. lle then withdrew one rod one notch. lteactor power increased sharply and the reactor scrammed from The catastrophic piping failures took place shortly af ter a l an litM hi-hi trip on a 254ccond period at 3:59 p.m. licensed - senior' control operator (SCO)z(an. 8110 q 1

NUltliG21275, Vol. 8 6 Jy-g+-++ripq T-T Wtv 1 T- g r7VW- 1 te,i- ff-y-*mywrry---.---g.,y, -,-gp,m.h,--

• O "y q 7'rwt- iry--g (-M-n- ppr$rW1-per4 Dew +ypr y n WY a-y'ig erg yw wy qvrr pygerig-re1'+WyW ~-99-%wT'N - W

responsible for supervising controt nom operations) had the secondary systems piping had been experienced manually closed a valve in one of the lines as part of the during Unit 3 operation, these had been due to hicaliicd process to isolate and repair a leak in the line. 'the SCO flaws, such as those caused by jet impingement, where a narrowly escaped inj ury and et urned to the control room small pipe teed Into a larger diameter pipe. Plant ,

to report the failure. 'the control room operators personnel had little awareness that a through-wall leak manually initiated a reador trip and a main steam line might be due to thinning of the pipe wall by isolation and began recovery activities. erosion corrosion mechanisms. As a result, they did not take precautions to protect personnel against a pipe l'ollowing the trip, the operators found that they had lost rupture.

automatic control of pressuriter level.'the operators and instrument and control (l&C) technicians deduced ihat Millstone Unit 3 findings:

moisture in the turbine building caused a loss of power that isolated instrument air la the letdown valves and e Operator error was not a factor contributing to this -

pressuriier spray valves. Tney devised a method to event. ,

restore instrument air to containtnent and thus restore e Command and control at the plant was diminished  !

nonnal control of itCS inventory and pressure. when the SCO operated valves in the turbine Millstone Unit 3 had no administrative procedure building, governing the steps that should be taken to evaluate e Sution procedures did not cover actions to be taken through-wall leaks in this system. Although licensed for through-wall pipe leaks in the system and did not operator error was not a factor contributing to this event' caution personnel that these could be a precursor to it may have been less than prudent for plant personnel to a casnophic failure. ,

try to evalunte the significance of the through wallleak without obtaining assistance from engineering.

• Teamwork by the licensed operators and the I&C l . technicians identified the cause for the loss of When the SCO elected to personally .solate the leaking instrument air to containment and corrected the -

pipe section, control room command and control was problem, temporarily degraded, lie was working alone in the turbine building without direct means of communication . lhe event occurred at a relatively good time of the with the control room and without the knowledge of, or day; there were pers<mnel available who were assistance from, the turbine building plant equipment coming on shift, who had not gone off shift, and who operator. 'The SCO escaped injury following the pipe were working on the Unit 2 outage, rupture and returned to the control room, where he

_ played an important role in recovery act ivities. 2.2.2 Oconec Unit 3-Loss of Sliutdown The problem in maintaining control of reactor pressure and inventory was created by the loss of instrument air to The Oconce Unit 3 event occurred at approximately 9 '

the pneumatic operated control valves within a.m.on March 8,1991 wben the unit lost DIilt capability containment. The indications of this problem were the for about 18 minutes during a refueling outage (llef.12),

increasing pressure and level in the presarieer, which the Several hours before the event, instrument and electrical .

110 diagnosed as caused by closed letdown and (I&li) technicians had obtained authorization to perform pressuriter spray valves. The SCO and 110 realiicd that testing on valve 31.P-19 Train A emergency sump suction the pressure ircrease would be limited by the automatic valve. (A low pressure injection system valve that is a ,

actuation of the .POltVs or by the pressuriter safety boundary v;dve of the Dillt system when shutdown)<

l valves.The SCO took action to limit the rate of increase When the technicians opened the valve, a gravity drain in level by manually reducing the charging flow to the path was created frwho hot leg. A blank flange, which minimum required for the reactor coolant pump seals. A was supposed to be installed between the valve and the i team consisting of the SCO, the- 110, and the !&C sump, had been installed on the 11 train line.'the water specialist then moved efficiently' through problem levelin the reactor vessel fell to the bottom of the hot leg identification, diagnostics, action selection, and action to causing a loss of shutdown cooling until the valve could be restore normal control of pressuri/er pressure and level. reclosed and the water level restored. A llegion 11 AIT A number - of Unit- 3 operations, rnaintenance, engineering, and other plant personnel had observed the Approsimately 2 weeks earlier, two rnaintenance steam leak before the pipe rupture.'lhere was apparently personnel were assigreed to install a blank flange on the a lack of awareness by these individuals that the emergency sump suction line to valve 31.P-19. Since the i

through-wall pipe leak could be a precursor to a procedure for installation of the flange did not address catastrophic failure. While other through-wall leaks in how to identify the correct line, the maintenance 1 7 NUltiiG-1275 Vol. 8 l=

i supervisor, on the Imis of a review of a drawing, 2.2.3 Dittblo Catyoti Utill 1-l{c;telot* Trip suggested that the flange be installed on the lcll Imd Safely injection emergemy surnp suction line. llowever, the draw ing used (5/17/91) was a schematic and not intended to provide information on true phpical location, in reahty, the suction line 10 'I he Diablo Omyon Unit i event areurred at 6:28 a.m. on valve 31.P-19 was the one to the right. When the May 17.19(11, when Unit I tripped Irorn 100-percent '

maintenance personnel reathed the emergency surup power becausc oImi error bv an l A C technician (lici.14).

location, a handwiitten, nonstandard label on the wall lhe technician took a nucicar instrumentation channel abuse the sump also designated the lef t line ns 31 P-19 out of scnice with another channel aiready out of service, '

~lhey pnveeded to mstallIhe flange on the left, which was which satished the necemry 2.out of 4 trip hgic. )

t hc line leading to emergerny su mp suction valve 31.P-20. Following the rextor trip, multiple steam dump valves Once the flange was installed on the hoc to valve 31 P4tl, failed open causing an excessive cooldown and -

opening 31 P-19 drained teactor coolant through the depressuri/ation of the primary system, which initiated a open DHit system hot leg suction line into the emergency low pressuri/cr pressuie safety injection (SI).

sump. ,

lhe operators understood that the Si initiated because of cooldown and shrinkage of reactor coolant - and not-Over the last ses etal3cars, the licensee had estabbshed a labeling prognmi for plant components. Ilowescr, this because of a loss of coolant. After verifying that the ,

ronditions in !!OP IH), "limergency Procedure lleactor program did not consider a pipe or flange to be a Trip or Safety injection " were met, they entered I!Op cornponent. Although the pipe penetratiun was labeled  ;

F.+1.1, conectly, the only identification on the flange was the "Si Termination." A number of factors contnbuted to the error by the l&C technician that inconect nonuantkud label. Following this event, piping resulted in the reactor trip. 'l'he e.dibration procedure did llanges were added to the labeling program, not follow guidelines that would have made the error less .

hkely, the technician had not completed training in Connol operators acted promptly and effectively to self-verification, and the goal of completing the diagnose the decreasmg reactor vessel water level. 'the sur.cillance before shift change may have created a location of the water low was quickly established and time based stress in addition, the technician was withou! -

appropriate actions to isolate the leak and restore water direct supervision although still in training. 'ihus a level were rapidly performed. The combination of number of factors, includmg procedures, training. stress, -i training in system pnredures and theory and prior and supervision adversely effected online surveillance recognition of the maintenance activity being performed testing.

was eviJent in the posiine operator's response.

'lhere was a potential problem with the annunciator Oconce Unit 3 findings: system. The annunciator system acknowledge circuit in the control room causes all blinking annunciator tiles to e go to solid illuminatisn and silences the alarmt Other Procedures used for installing and testing the blank flanpc did not provide sufficient information for phmts, control num system designs divide tlye identifying the line. annundahirs into several groups, each of which has its own audible signal and acknowledge bu tton. Since Diablo

!!rroneous, nonstandardlabels at the flange hxation ~ Canyon's single acknowledge circuit affects all the inisled the installation crew and the verihers' alaans, there is an increased possibility that an incoming alarm may not be detected.

• . During the installation sequence, maintenance "

personnel did not act independently when The licensee could improve the post trip event review performing an independent verification -of the process. At thecondusion of the event, the operatorsand flange location- other involved personnel were required to give written individual statements on what they recalled, llowever, e some of the statements were quite terse, perhaps because Miscommunication between the control room they were written following sNft turnover at 8 a.m. The supervisor and the maintenance technician led to statements contained notes on observations, and did not opening the valve without the knowledge of control comment on how the event might have been avoided or room persimnet.

how the response might have been improved. *

• - Diverse reactor vessel level instrumentation helped Diablo Canyon Unit i Imdmgs:

ensure that the control operators had no doubt that there was a _real drop in level rather than a false *-

indicated level, The controt room operators tesponded effectively to the reactor trip and 51.

NURiiG-1275, Vol. 8 8

e Several lactors contnbuted lo the technician's ertor unusual characteristics of this shutdown and better in pulhng the wrong fme, includmp surveillance alhicated shdt resources. Shift resourecs and attention procedute dehtiencies, time-based stress, and lack were directed toward ticar. term actions to support of supe vision. reactor maintenance activities rather than on the immediate steps requited to monitor the plant ac'isitics

• '!he design of the annunciator acknowledge chemt to safely shut down and depressuri/c the reactor, m the control soorn did not help differentiate of Command and control of Ihe operator at the conhols was prioriti/c inwming alatins, diminished because other conttol toom perwnnel were j

involved in preparations for containment entry.

e Prior problems with steam dump valves and other equipment were addressed by procedural 'the r.hutdown procedure did not contain cautions or nestoctions but made the normal procedures and notes separding the positive reactivity when the steam 1:OP mor e complex to follow. l low ever. anticipating hud was greater than the decay heat rate or options to and pnwiding fot equiprnent problerm in liOPs and counter a significant couldown.'lhis event occut red when training can help ensure effective operator a normal startup was terminated and transition waa made to the shutdown pmcedure, llecause the startup was performaner, tetminated at an early stage, the crew had to deletmine e Although individual written statements wer e where they wer e in the shutdown process and which steps ,

in the procedure were applicahic. ;l prepared by operators involved in the event, the statements were often terse and did not contain Monticello findings:

information on preventmg recurrence or imprming the response. e 'ihe opetating clew was net sufficiendy aware of how emting condahms would affect the reactivity ,

2.2.4 Monlicello-lil lli IRM Scrum management tat.k.

gjg g

'the Monticello event occu n ed at about 4:40 p.m. on June "**"""'

u "W"k ""Nant on mojutonng actWes to Wy M 6,199h (Ref.15) when operators terminated a reactor n an sunn k reMm startup and began a reactor shutdown to repair a leaking SitV.'the reactor automatically tripped when both the A e 'the operating crew lacked an adequate and 11 litM channels reached their hi-hi trip set point. understanding of the plant response they were

'!he method used to Ahut down the reactor was notch observing as plant conditions changed.

insertion of control rods. Ilecause 'he decay heat rate was less than steam loads, the reactor cooled and positive o Procedures did not adequately cover the transition reactivity was added to the core The 110 did not fmm the startup procedure to an appropriate step in compensate for this cooldown; reactor power increased the shutdown procedure.

and resulted in the reactor scram when the operators did "

not mamtain the ll(Ms in midrange. 'lhe operators e lhe control room crew were not asked to prepare subsequently closed Ihe MSIVs to limit the reactor vessel individual written statements to preserve their individual observations and insights. 'thereforet the cooldown.

event analysis pmeess was fiawed because of the lack The operatingcrew did not recognin that the steam hmds of these statements, even though the control room combined with a law decay heat rate would cause a crew discussed this event to help their recall.

cooldown resullmg in increased reactivity. In addition, the crew did not react to the alarms and indications of the 2,2.5 Waterford Unit 3-Execss Stenm cooldown or the reactor power increase. Shift supervisors Demand -

(6/24/91) did not discuss such reactivity effects as iow decay heat rate, xenon buildup and redistribution, and temperature lhe Waterford Unit 3 event (itef.16) occurred at 1:24 changes. Procedures and training did not specifically p.m. on June 24, 1991, when the unit cxperienced an address a shutdown with low decay heat levels. Taken excessive coo!down following a manual reactor trip at 1:24 p.mJlhe event began at 11:19 a.m., when a lightning together, these conditions left the crew poorly prepared for the reactivity management task, strike resulted in a . turbine trip, which mused 'an

- automatic power cutback to about 35 percent. At h15 ShifI turnover and et ew briefings before the event did not p.m., operators noticed SO #2 level was increasing and communicate to the crew a full understanding of the could not be controlled. 'the 110s did not consider the planned evolution. *1his contributcd to an unnecessary reactivity changes due to xenon buildup which were level of stress during the shutdown. Iletter planning and occurring. Ilecause the SG high-level alarm was set at-

- detailed personnel assignments may have identified the 86.7 percent and the high-level reactor trip setpoint was L

9 NURliG-1275, Voi, M

-- at 87.7 percent, the operators had no time to attempt to operating shift crew acknowledged during the interviews lower the SG level to avoid a reactor trip and manually that such - activities were routine. Perhaps more

' tripped the reactor, l'ollowing the trip, primary system - significantly, the control room organization failed to catch temperature and SG pressure dropped rapidly because this oversight until the offnormal condition was ident6ied -

both a startup feedwater regulating valve and a steam by chance during a surveillance by another NSO. The bypass valve had failed open, prompting the operators to SCRl! normally performed detailed panel checks only at manually initiate a main steam isolation. the beginning and end of the shift and relied completely on the unit NSO during the shift, in accordance with After the event, the operators did nel prepare individual station policy, even though this particular NSO was the statements on w hat they recalled. but they concurred on a least experienced on shift; During normal operations joint statement prepared by the STA. Although there is near 100-percent power, the plant probably would have no evidence that this group statement resulted in an tripped after loss of main steam line ll.-liowever, the incomplete description of the event, it is possible that it plant was in a power coastdown and initial power h. vel did not capture important individual observations and was about 83 percent. The deiaved recognition of the _

insights. closed MSIV could have been avoided if alarm set points had been reset to take the lower power lei,:1 into Waterford Unit 3 findings: consideration.

e Teamwork by the control room operators resulted in Quad Cities Unit 2 findings:

an effective and timely response.

• The loss of steam flow in one line was not recognized

o. The operators were well prepared for the event by for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> because there was a low level of ,

simulator training, particularly for excessive steam awater ess of reactor operating parameters by the demand events. Ilowever, xenon buildup was not crew and by the Unit 2 NSO,in particular.

recognized.

• Teamwork by the control- room crew was not o The SG high-level alym set point was so close to the sufficient to identify the condition in a timely-high level trip set point that there was insufficient manner,which may have been the result of the shift time to try to take control of level. organizational structure. ,

• Pmdmes and tmining contained negligible 2.2.6 Quad Cities Unit 2-Main Steam ICchmeal guidance for abnormal conditions that are Isolation (9/18/91) .

withm alarm set points.

The Quad Cities Unit .2 event (Ref.17) occurred at 6:05

• Operator aids, such as computer programs, may

~

p.m. on September 18,1991, when the reactor was in an assist -in operations by highlighting offnormal end-of cycle coastdown and the main steam line 11 conditions.

isolated causing power to spike from 83 percent to 98 percent. Ilowever, the control room crew did not identify

• The MSIV failed because of incomplete instructions -

this power spike until over 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> later.The inboard 11 in the work package for maintenance that had been MSIV dise '1ad separated from the stem and restricted performed on the valve.

flow in main steam line II, causing reactor pressure to increase from 984 psig to 1018 psig. - Although this

• The current shift organization and practices may not increased reactor pressure resulted in fluctuations in ensure effective monitoring of plant status, power, level, and core flow, it caused no alarms to annunciate because no set points were exceeded. 2.2.7 Crystal River Unit 3-Pressurizer A number of- factors contributed to the- delay in recognizing that MSIV had closed.The plant did not have The Crystal River Unit 3 event (Ref.18) occurred at'3:09 detailed guidance on panel monitoring. Clearly, the Unit - a.m. on December 8,1991, after the plant was starting up; 2 NSO who was responsible for monitoring the panels after a short maintenance outage, at about 10-percent overh>oked the indicated loss of flow in main steam line II, power, preparing to roll the main trbine, when a slow the- momentary spike in level and power,' and the . loss of RCS pressure became apparent to the operators, sustained - clevation in reactor pressure. There - are - The actuator for the pressurizer spray line control valve

indications that he may have been distracted by a had failed significantly open, _how ever, the valve malfunctioning strip chart recorder, by equipment continued-to indicate closed. The operators did not surveillances he was performing, by activities in the

~

realize why the RCS pressure was decreasing until the on the-job training and evaluation of trainees presen in pressurizer spray line isolation (bh)ck) valve was closed the control room, and by other things. Ilowever, the about an hour later. An operator withdrew control rodsin NURI!G-1275, Vol. 8 10

. . - _ __ _ _ _____ . _ ~ _ _. _ _ _y ._ _

1 an attempt to manage the decreasing itCS pressurefthe appropriate actions to diagnose and correct the cause of -

reactor tripped on low pressure, but the operating crew the pressure decrease like those contained in one of the bypassed automatic enginected safety features (liSFs) station's abnormal procedures. Operators did not execute (high pressure injection emergency - feedwater, all applicable steps of an abnormal pmcedure that emergency diesel pencrators, and partial containment contained directions to_ close the pressurizer spray line I

isolation valve, because liSF termination criteria had isolation) actuation for about 6 minutes (the actuation bistables were tripped in the bypass condition for about been met.The station's administrative procedures did not i caution against or prevent exiting an - abnormal . or l 16 seconds). ,

cmcrgency procedure before checking remaining sections -

'lhis initial bypass of the liSF, while the plant pressure of the procedure.

- decrease was not understood, was not directed by abnormal or emergency procedures, and was not directed Crystal itiver Unit 3 findings:

by shift supervision, fiSFs were then unbypassed and the

• The initial bypass of the ESI' was an inappropriate high pressure injection and other systems activated.

operator action, not directed by abnormal or Operators then established manual control of the high emergency procedures or by shift supervision.'lhe pressure injection system to maintain ItCS pressure licensee developed procedural guidance to prevent above 1500 psig.

recurrence.

liSF was bypassed a second time in accordance with

• The event was complicated by failure of the spray procedures. This was done to prevent an unnecessary valve position indication.

actuation while establishing control of itCS pressure and maintaining adequate subcooling margm. However, the

• A numW of pblems'in command, control, and source of the ItCS depressurization was still not known communications, and in procedures contributed to which mdicates that bypassing !!SF even under these this event.

conditions may not be conservative, sugf,esting a lack of adequate guidance for managing liSF systems. g g g cgg ggugggg The event was complicated by the combined failures of 'the 1992 human performance studies concerned the the pressurizer spray valve and a, s mdication. As a result, foHowing three events:

sigmficant spray flowed to the pressurizer while the

' closed position indicating light for the pressuri/cr spray 2.3.1 Prairie Island Unit 2-Loss of control valve was lit and the 40-percent open and the Shutdown Cooling (2/20/92)

, full-open indicating lights were not lit.

The Prairie Island Unit 2 cvent (Itef.19) occurred at The operators had difficulty with command, control, and 11:10 p.m. February 20,1992, when a loss of shutdown communications lixamples include: the operators' cooling resulted from insufficient water level in the ItCS.

failure to use the annunciator response procedure forlow 'lhe operators responded promptly and initiated recovery

'- 11CS pressure; Ihe initial bypass of IISP without direction procedu res to restore water Icvel in the reactor vessel and or concurrence by shift supervisors and shift supenisors re-establish shutdown cooling flow. On February 21, being unaware or uninformed that an !!SF was bypassed 1992, NitC llegion III sent an ' AIT to investigate the

!- forabout 6 minutes; shift supenision's late declaration of event (llef. 27).

I an unusual event and related notifications: and a shift turnover process that did. not ensure. that all crew On February 20,1992, Prairic Island Unit 2 was 2 da s members were aware of recent signific:mt changes in the into a refueling outage. Late on day shift, reactor vessel l observed operating characteristics of the pressurizer draining-to midloop had commenced and then been spray valve. If those changes had been investigated, the terminated for shift change.The evening shift (6:00 p.m.

L equipment problem with t_he spray valve may have i een to 6:00 a.m.) conducted begmning-of-shift briefings and identified and corrected, and the event averted. The re-established draining. The two ItOs conducting the involvement of " management on shift" (a manager with draindown were extra personnel from another shift used SitO qualifications who is senior to the shift supervision) to supplement the normal duty shift.The extra ItOs were for the reactor startup contributed positively to the event in communication with operators in. the containment progression by noting that ESF was bypassed and by _ building to accomplish the draindown.-

recommendmt, the pressurizer spray isolation valve be closed. Newly installed ~clectronic level instrumentation was considered _ operable' during the evolution. When the There were weaknesses in procedures. The annunciator draindown started, the electroniclevel instrument display response procedure for low itCS pressure addressed on the control room emergency response computer responses to control circuit faults, but did. not cover system was off. scale high. A tygon tube was the only I.

1I NUlt11G--1275, Vol. 8

-.= w - , - , ., ..-,s - . , , , -~-i..-,, ,-rw., 4 --,--g - - . , , , , -.,%-- ,_,- ,, s -e v e .w r. w n. *r W'- 7=' ey-',-*we-

-a 9

l j

1 instrument providing usable levelinformation during the regained. 'Ihe -21 RHR ' pump was then stopped -

draindown. To obtain actual level within the system,- and realigned for shutdown cooling and restartedc A 3 tygon tube levels were transformed, via manual peak temperature of 221' 17 was reached before re- '

calculation, to concet for the nitrogen pressure effects, establishing shutdown cooling and returning the phmt to:

pre-event conditions.

A systems engineer.was on duty to provide assistance with the dmmdown and also to perform a preoperational A containment evacuation of people l was check on the electronic instrumentation when it was accomplished, with the exception of 2 operations indicating on. scale. After approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of personnel. 'they were directed to stay in the containment draining, at 9:30 p.m., the electronic instrumentation was by the control room staff to continue monitormg tygon still off-scale high. 'lhe systems engineer conferred with tube level and be available to operate valves for the an instrument technician and made a decision to leave the draindown, Containment. integrity was verified to be control room to investigate the level transmitter valve intact as directed by the emergency procedure, lineup in the containmert building. This effort was interrupted by the announcement that sautdown cooling Pnu. .ne Island Unit 2 findings; was lost. The systems engineer returned to the control

• Procedures and training did not provide sufficient room at that time.

direction L in nitrogen pressure control. The At 10.55 p.m., the drr.indown ROs were having difficulty 85" #""## *"" """ "E *"# #

, calculating actual level and became concerned about

1. " "'" " " * " " " *"E " Y *" "

n t been addressed during training. As a result, reactor vessci water level. A containment building .

operator was sent to open a vent in the suction line of the RilR system to check for mr (nitrogen). One of the

• There was uncertainty as to who had resp (msibility draindown ROs decided nitrogen pressure was higher and authority to rnake the decision to hold or stop than it should have been at this point in the dmindown draindown activity. 'the shift supervision assumed and opened a reactor head vessel vent to vent off some of the ROs .were experienced and did not require '

the excess pressure. The containment operator reported continual supervision. An apparent hesitation by the -

back that nothing but air was coming from the vent on the draindown crew to communicate some concerns to RHR suction line. Ile was ordered to close the vent and the supenisors may have resulted from the ROs not drain valves. Electronic level had suddenly changed from working with their normal crew.

off-scale to an indication of about 723 feet (5 inches below midh>op), and a low level alarm was received. Based on

• The draindown ROs lacked awareness of how higher interview data, the indicated level was as low as 722 feet nitrogen pressures affected the draining process.

6.5 inches (10 inches below midloop). Alarms on the emergency response computer system for RIIR pump

• There was a lack of questioning attitude regarding i Iow suction pressure, low motor-amps, and hiw flow were the response of the electronie display indicators I received at 11:08 p.m. The shift manager ordered the even when it was identified in the procedure that the -

running 22 HI1R pump stopped at i1:10 p.m. displays should be operable.

o h yould have been appropriate to hold or stop the The shift supenisor took direct command of the operations and entered abnormal procedure D2 AOP1, dramdown, because of ., discrepancies and-

• • Ixss of Coolant While in a Reduced Inventory uncertainties regardmg water level but this was not done, Condition 7 which directed the starting of a charging pump to raise the reactor vessel water level. The

• A human-machine interface issue.was identified -

operators were monitoring RCS temperature using when the k) cal operator had difficulty reading the available in. core thermocouples. The temperature was level correctly in the tygon tube due to pamilax about 133' F at the ume of the running RllR pump trip. problems, poor lighting and tube visibility degraded -

One entry condition for EOP 2E-4, " Core Cooling by the tube penetrating the next floor.

Following ioss of'RilR Flow," - required RCS temperature to be at 190 F. However, operators 2.3.2 LaSalle County Unit 2-RWCU .

obsened from the rate of level increase and heatup that Isolation Ilypass actions of the 'ahnormal procedure were insufficient to (4/20/92) mitigate the transient before reaching entry conditions of The ImSalle County I'.m 2 event (Ref. 20) occurred at the emergency procedure.The emergency procedure was 8:47 a.m.on April 20,1992, when a reactor water cleanup immediately implemented when the temperature (RWCU) system shut down lifted an RWCU regenerative reached 190* F. The 21 RHR pump was aligned to the heat exchanger relief valve for 31/2 minutes, while an

- refueling water storage tank and started to inject water to operator had the automatic RWCU isolation erroneously the reactor vessel. Reactor vessel icvel was promptly bypassed.

- NURl!O-1275, Vol. 8 12

- - , . u . . = . - -,. - _ . - , - . - . . .

,.s . -s . -.am---4-h =4 6-ms - - . - - .m. & p. - m ~ m. - a.A - A Several weeks earlict, an RWCU isolation had occurred bypass key use, teamwork with auxiliary operators because of a spurious RWCU high-differential flow was a positive factor in verifying its validity, sienal. Iloth RWCU containment isolation valve motors had failed because of thermal exp nsion effects on the

• There was no direct RWCU relief valve discharge valve limit switch settings and licensee management had flow indication in the control room and other criticized the operators for allowing the spurious inst ruments used to diagnose this event were hwated -

isolation. 'ihe motors had to be replaced and a testing on different panels.

program was established to verify the limit switch settings

• Control room operators performed recovery actions -

as the plant power levelincreased.

wnhout consulting applicabic procedures because of -

their frequent revision and level of detail.

On April 20, Umt 2 was at 20 percent-power. The NSO shut down the RWCU, as part of the test procedures for 2.3.3 Fort Calhoun-Stuck Open Relief '

venl.ymg the hmit switch settmgs, by clostng the system Valve return valve before stopping the RWCU pumps, which (7/03/92).

was in reverse order to that stated in the procedure The Fort Calhoun event (Ref 21) occurred at II:36 p.m.

substeps. About a minute later, the RWCU on July 3,1992, when a nonsafety-related inverter was high. differential flow alarmed, m, dicating the start of a returned to service following repairs. When connected to 45-second delay timer preceding the RWCU isolation. its bus, the inverter output voltage oscillated and caused an electrical supply breaker to electrical panel Al-50, to

'lhe NSO wanted to preserve the test and obtained the trip open on a high current condition.

shift foreman's permission to bypass the automatic IISF elosure of the RWCU containment isolation valves 'Ihe  !!!cctrical panel Al-50 supplied various instrumentation NSO removed keys _ from othei front control board and components in the plant, including the control switches and gave them to a second NSO. The second circuitry for the main turbine. When power was lost, the NSO used them to bypass the RWCU isolation, but circuitry caused the main turbine control valves to close to returted a continuing RWCU differential flowof 95 gpm. protect the main turbine. With the turbine control valves shut, the heat sink for the RCS was ternporarily lost, About 3 minutes later, the operators worked as a team to resulting in an RCS pressure increase. %c reactor and verify that the aiarm was not spurious. An equipment turbine tripped at approximately 2400 psia. As pressure attendant identified flow through an RWCU continued to increase, the PORVs, main steam safety regenerative heat exchanger relief valve. A third NSO valves, and a pressurizer code safety valve opened to found reactor building equipment drain tank level reduce RCS pressure. The PORVs shut at 2350 psia.

'- increasing, while the 95 gpm RWCU differential flow When pressure reached approximately '1750 psia, a :

continued. The NSO asked the SCRl! and the shift pressurizer code safety valve shut and RCS pressure foreman how they wanted to isolate the RWCU. Iloth increased to approximately 1925 psia. At this point.

agreed to allow the automatic RWCU isolationidespite pressure began to drop rapidly. The operator shut the-the partially erroneous precaution in the special test PORV bk)ck valves when the pressurizer quench tank procedure t hat valve operation without thermal overk>ad - level and pressure were observed to rise, and the :

protection (as in the case of automatic operation) could PORV/ code safety valve tailpipe acoustic flow alarm was damage the motor or the valve if the-limit switches received. The - pressure drop continued and SI, settings had drifted because of thermal expansion. The containment isolation, and ventilation actuation signals -

operators returned the RWCU bypass key switch to- were received. All safety systems functioned as designed.

normal, allowing the RWCU to1 automatically isolate, The open pressurizer code safety valve partially closed at' which terminated the loss of inventory from the RWCU approximately 1000 psia.The l_icensee declared an alert through the open relief valve. when the safety valve stuck open.

The operators implemented the liOPs and secured the LaSalle County Unit 2 findings:

four reactor coolant _ pumps.The plant was subsequently.

cooled down, using natural ' circulation and shutdown

• The operators lacked understanding of the required cmHng to cold shutdown conditions. A Region IV Ar!j order of performance of procedural directions. mvestigated the event and issued the Art report on

• The special test proecdure did not address response

^"E" to an automatic isolation signal. Fort Calhoun findings:

• While the alarm response procedure for the RWCU e The operations staff quickly_ diagnosed the plant high-differential flow ~ alarm did not address status and took appropriate actions in a timely detennination of alarm validity or criteria for !!SF manner. Operators were helped greatly by plant and 13 NURIiO-1275. Vol 8 -

-~ . . . - , .. _ . __ _ _. _ -_ _ .~ _ _. - _ --

- ~ -- - - ~ . - - . - - - . - - - - - - - - - - - - - -

- procedure improvements made following the"Ihree responded well. Difficulties which arise due to control.

Mile Island accident. room organization .and task assignments could be minimited, in most cases without additional staff, by e A number of factors contributed to the successful' changes to control room shift structure and assignments operator resp (mse including; loss of coolant from based on functional analysis (including STA functions) the RCS event was included in simulator training, and lessons learned from analysis of operating events.

EOPs were upgraded and provided sufficient guidance, emergency planning actions were L, mples practiced weekly in simnlator training sessions, and control room organization and stafh,ng provided a 'lhe studies of the events at Commonwealth Edison sufficient number of personnel with appropriate plants (Refs, f2,7, 8,17, 20,) identified an organizational partitioning of responsibihttes. structure in which problems frequently arose during events that required implementation of the > STA - i o A number of areas where the technical content of function, The STA function was assumed by the SCRE,

!! ops could be improved were revealed by the who normally directed control room operations, The event. control room supervisory function transferred to the SE. ,

Other SROs on shift (referred to as the shift foremen)-

3.0 ANALYSIS SEC'l, ION, were often outside the control room directing auxiliary operators.TheSE directed and verified theactionsof the :

control room operators and became .the e. rgency director. During the event at Dresden, for exa 4c, this 3.1 Introdttet. ion control mom organization resulted in the overburdening

.The- analysis section contains observations and of the Sli. The SCRi! spent much of his time on conclusions from AliOD s onsite analysis of operating telephone notifications and the shift foremen were events. Examples are provided to support the outside the control room, resulting in limited redundancy observations but are not intended to be exhausuve. 'l,o (md independence in control room decision-making and better capture the operating experience, examples from 1 mited checking of important control room activities.

other sources are used, where appmpriate. Discussions The Crystal River Unit 3 (Ref,18) control room are provided to give background or perspective on so.nc topics. The reader is cautioned that this section is organizational . structure included many positive attributes including a " stand alone" STA. two SROs in.

essentially our expert opinion and the study events were the control room with divided responsibilities (one was -

not selected randomly.

responsible for EOPs and plant response, the other for emergency preparedness and overall site response),

In Sections 3.2 through 3.5, control room organization, staffing of ROs beyond that required by TS, and procedures, human-machine interface, and industry operations " management on shift" in support of the initiatives are discussed. in Section 3.6, a more holistic =

reactor startup. Although this organization ultimately approach is taken in discussing performance shaping placed .the plant in safe, stable shutdown condition, fa: tors that influenced crew response-cognitive mistakes were made and :not .immediately corrected. This - experience suggests that a good 3.2 Control Room Organization organizational structure provides the framework for a' Con t rol rmm organizational factors significantly affected good response, but does not ensure a good response.

Other factors such as teamwork, communications, and crew response to events. These factors include the -

knowledge level of the crew rnay still impede the crew's staffing level, division of responsibilities, and degree of response. The Crystal River event showed the value of teamwork. Additional observations are presented " defense in depth" in that some mistakes were caught and concerning the STA position, corrected (such as the bypass of engineered safeguards actuation) by the " fresh eyes" of the management on >

3.2.1 StafGng nnti Responsibilities shift. Other mistakes, such as the lack of timely event.

Observation declaration and notification, occurred despite the " fresh eyes" of the STA and management on shift.

Control room staffing levels and other organizational The Fort Calhoun (Ref. 22) control room organization w eaknesses impaired some crews in perfonning their performed vclL This organization had many positive emergency functions. At these plants control mom _ attributes including: SROs with responsibilities divided management personnel were overburdened during among them; with responsibilities divided between the emergencies when tasis, supervision, and technical primary and secondary plants; a " dedicated" El'A: and a

( oversight were not appropriately allocated. At other " dedicated" emergency communicator. The crew may plants, with pmper staffing and periodic training. crews - also have performed well i ecause the emergency NURl!G-1275 Vol. 8 14

response functions (including event declaration, esent pump discharge valves 31 minutes earlier, which

- notifications, notification paperwork, and " meetings" " effectively shut off natural circulation in the core area."

with the " duty" onsite emergency responders such as liased on David Woods' analyses of simulated emergency chemistry and health physics technicians) were practiced scenarios, Professor Reason noted that the above once in the week of requalification training, examples are not isolated incidents. In the simulated scenarios, none of the diagnostic errors were noticed by

-In its report (Ref,' 23) the Fit < Patrick diagnostic the ' operators who made them, but by fresh eyes.

evaluation team raised concerns that the shift staffmg and Pmfessor Reason noted that these " observations are very structure weaknesses " limited the ability of a minimum much m. keeping with what we know of knowledge-based -

shift crew to res[und to a scenario involvina activation of processing in particular, and of mistakes m general. When

.the plant fire bngade, implementation of the EOPs, and the diagnostic hypothesis is mcorrect, feedback that is implementation of. the emergency response plan, upeful for detecting slips is unavailable. lhere is no including assessing emergency actions levels and making discrepancy between action and intention, only between protective action recommendations." the plan and the true state of affans." Accepting this,it sums dear that the primary function of the STA is to )

in its report. (Ref. 24) concerning an esent at the Nine provide objective, credible, and authorttative feedback to Mile Point Unit 2, the incident investigation team I crew on their diagnosis- and planned corrective described similar difficulties that the shift supervisor actmnt Dms uth,es took the nad for an M A s sening as the emergency director during an event, recommendations to be heeded intry considerat, ion when ,

-encountered with " overload" while fulfilling duties deciding the STA's position in their shift organization.

involving liOP readmg, event classification, fire Many utilities licensed the $1 A, at least partially, for this protection concerns, and implementation of the n ason. This is partly the reason for the dual role emergency plan. SI A/SCRE supenisory operating position at the l

Commonwealth Edison plants. Northern States Power 3.2.2 Shift ,I,echm. cal Adv.isor '

accomplished this by supporting existing SROs in efforts to become degreed so that they could fill the dual-role '

Appendix A to this report contains a discussion en the STA position at the Montice!!o plant. Placing the STAS background and history of requirements related to the on shift, however, has the potential drawback that fresh STA position. 'lhis includes a discussion of the eyes may be lost becausc of the KfA's involvement in shift

" dual-role" STA position- activities. Conversely, an STA may have _ difficulty in providing technical advice or solving a problem if he/she i

Obsmutmn was not familiar with ongoing activities preceding the problem.

The use of the " dual-role" STA impaired crew performance because the other SRO(s) were overloaded Operator performance may be improved by the STA when one SRO assumed the STA role. The " dual-role" presence in the control room. Events nnd this analysis STAS sometimes- lacked independent " fresh eyes" (see Section 3.4.1) show that shutdown events can be

- because of involvement in shift activities. Assignment of _ more cognitively challenging and advice may be needed other tasks during events sometimes detracted from the before the event (to prevent the event) rather than after SPA's safety function; the event _which is the more common practice.

SRO training has improved since the requirements for Discussior the SFA position were developed. Thus, some aspects of '

the STA function may no longer be required.; Also, Chapter 6 of Professor James' Reason's book. Humarr prompt staffing of the emergency response orgamzation Error (Ref. 25) concerned the detection of human errors. redaces the need for a techmcal advisor for that situation.

Professor Reason provided evidence for his conclusion that detection by others appears to be the only way in g,pfey

- which certain diagnostic errors are brought _to light in complex and highly stressful situations. During the event The Dresden shift organization (Ref. 6) was typical of at Three Mile Island Unit 2 on March 28,1979,it was the Commonwealth Edison, which included a dual-role SFA.

shift supervisor of the oncoming shift wha detected the - -Questions arose- about _ the effectiveness of this s possibility of a stuck-open PORV 21/2 hotirs after it had arrangement. As described earlier, during emergencies .

opened following a reactor trip. At Oyster Creek on May the SCRE assumed the role of STA and the SE directed 2,1979, it was an engmeeting supervisor entering the control room operations. Potential problems included (l) control room who noted abnormal systems conthtions the SE may have been less familiar with the current caused when an operator had erroneously closed four -condition of the plant than the SCRE who he relieved (recirculation) pump discharge valves _ instead of two (the Sli's office was h>cated out of sight from the control 15 NUREG-1275, Vot 8 i

.M._,,-r_ u,,.,,: c..,m ..---.w,m-,-- .,c .-ma, , , . ,v._m wn..,--,x.---,m,-.v---.-o ,.-*.,-,ym.- - - . , , , . - - .

__ ._ _ _-~ .- ._. _~__ .. - < _ _ _ - -

p~

p room panels), (2) the SCRE may have been too involved recalled this was one response to a low RCS pressure with the details of the operation to provide an objective condition. This was another example of person who was overview of the situation to provide fresh eyes,and(3)the not part of the operating crew performing an STA-like -

Sl'A made state and kical telephone notifications.

function. The on-call, " dedicated STA was present At hlonticello(Ref.15), the shift manager was a dual role during the event, lie assisted with attempts to diagnose the cause of the decreasing RCS pressure and in the l SRO and STA. Unlike at the Commonwealth plants, the SRO filling the STA position was the senior SRO on shift. verification of the execution of the abnormal procedures. I During the hionticello event, the crew's understanding 3.2.3 Teamwork Findings and anticipation of the observed and expected plant response was weak. It is possible that with another set of Obxrvation eyes, unburdened by shift activities and paperwork, the _ _ _ .

event would have been precluded.The value of fresh eyes Teamwork -improved performance. in complex, .

' became apparent later in the event when an RO returned high-stress situationst and good teamwork. was an from the field and suggested that the htSIVs be closed to important factor in knowledge-based performance.

limit plant cooldown.

Discussion At Diablo Canyon (Ref.14) the STA position was a dedicated (not dual. role) individual who was not required . M M b the AEOD human performance studies, the to be licensed as an SROy ,the St A serves on shift as STA ,, teamwork" includes more than simply command, '

for both units and participates m shift turnover activities. control, and communications. AEOD views teamwork as From our interviews it appeat ed that the S'I A was helplul neluding all factors related to performance of.the during the reactor inp and SI event on hiay 17, 1991' operating crew as a unit as opposed to a group of.

although he was "not the normal crew person" and was individuals

• apparently inexperienced. The SFA stayed at the safety parameter display system and monitored critical safety A recent article titled ." Cognitive Psychology and Team parameters after they entered guideline E-0, " Reactor Training: Training Shared hiental hiodels of Complex

.Ihp or Safety In;cction." lie communicated to the shift Systems" (Ref. 26) stated that critical performance in supemsor that there was a red path on the heat smk many complex systems depends on the coordinated -

critical safety function but that it was probably erroneous, activity of a group of individuals, it further notes that the because there was indication of both motor-driven and nature of specific teamwork skills and how best to train one turbine-driven auxiliary feedwater pumps mjectmg, team members to perform together effectively is not well -

understood, despite the amount of research that has been The Waterford Unit 3 STA position (Ref.16) was a dedicated (not dual. role) individual who was not required

. to be licensed as an SRO/Ihe STA was on call to support 'the NRC also recognizes the importance of team ' -

' the - shift . crew, - and he reviewed plant togs and performance. Since 1987-1988 NRC operator licensing -

participated in shift . turnover activities. During the personnel have given increasing interest and attention to manual reactor tnp and excess steam demand event on command and control, com munications, and othe r factors June 24,1991, the STA monitored the safety parameter that are important to crew performance. In a pilot -

display system and informed the shift supervisor of plant program that is currently u nderway, the licensed operator conditions. - requalification program was changed so that operators -

are requalified on the simulator as part of a crew and not In the RIIR system overpressurization event at Catawba as individuals. Licensed operators are still tested as

.(Ref,4), it was the RCS system engineer, in the control individuals in the written and walk-through portions of the requalification.

room on unrelated matters, who participated in the diagnostics and recalled an NRC information notice on

&amplex interfacing systems loss of coolant accidents.13ccouse the

~ RCS system engineer had been previously uninvolved, it During the Dresden Unit 2 stuck open SRV event (Refe

- was possible for him to get the operators out of the 6), there were problems with teamwork' and cognitive trap they had fallen into. Thus,'the system communications. "Ihc SE made a cognitive mistake in engineet performed an SFA-like function in this event.

directing the opening of the turbine bypass valves that was not challenged or corrected by other crew members.

During the pressurizer spray valve failure at Crystal River Suppression pool cooling was not initially maximized as Unit 3 (Ref. 18). it was the acting operations required by procedure, because of either superintendent (management on shift for the reactor

' miscommunication or misunderstanding. During the startup) who suggested closing the pressurizer spray line

. opening of the bypass valves, the operator was not given isolation valve in series with the spray valve, because he specific instructions as to the number of valves to be NUROGal275, Vol. 8 . 16

- , , . _ . _ .. _ _ _ _ _ - . .a _ . , - . _.

opened, the desired pressure at which the valves should Obsemation

- be closed, or - the' desired rate _ of depressurization, llecauscJ the SCRii , was busy performing event Some operators acted'during events without using a notifications.and the shift foremen' were performing procedure. Procedure content,- ease of use, and manual valve manipulations in the plant, diagnostic; management policy and practices influenced procedure use.

support and checking of the Sli's direction was lacking.

During the Peach llottom event (Ref,3), communications and crew actions demonstrated cooperation and The IaSalle County Unit .2 Avent (Ref,20) was partially teamwork. Training of control room crews as a team was caused by an RO who failed to shut down the RWCU cffective in establishing confidence and trust among the system in the order stated in the procedure, and then team members. This allowed the crew to function well in bypassed a valid RWCU isolation signal. "Ihe alarm spite of the stressful situation- resp (mse procedures did not direct the operators how to verify the validity of an RWCU isolation alarm. The 3.3 Procedtires special test procedure did not address how to isolate the i.

RWCU, if necessary. The operators allowed the RWCU ~

The operation of nuclear power plants is based on the isolation to occur without referring to any procedure, premise that rule-based performance is more reliable despite a special test procedure being used which than knowledge-based performance. Procedures were contained a precaution to avoid operating the valves 1

developed as an aid to the operators for safe plant without thermaloverload protection.The RO stated in an operation and represent the best available thinking _on . interview'. that' he normally relied on memory and proper operator response, assuming sufficient personnel experience to handle emergencies, then used procedures are available to enact them. afterward to check his_ actions, because of frequent procedure revisions and having to go through three pages .

L!OP implementation involved years of effort by owners' ' to find the one step needed.'

groups, licensecs, vendors, nnd the NRC.

During the study of the Crystal River Unit 3 event on (Symptom. based IIOPs are intended to assure operator 8, 1991, (Ref. 18), a -number of December resp (mse to achieve safe plant conditions without procedure-related observations were made. The requiring diagnosis of the specific event.) Decision points annunciator response procedure for low RCS pressure are thought out beforehand to guide the operators to the was not used by the operators. llence, the investigation of proper response when a choice needs to be made, the reactor depressunzation was not systematic; and Deviations from procedures should not occur except under conditions addressed by administrative procedures operators withdrew control rods to raise reactor power, temperature, and pressure even though actual Tave was (i.e., plant staff should have guidance on how to proceed stable and not the cause of the pressure decrease. ,Ihe when pnxedure deficiencies or inadequacies are event declaration and notifications were late because the I' encountered. In other cases, personnel or plant safety shift , supervisor relied on L " knowledge" of the.

may necessitate prompt actions that are at variance with a regmrements rather than checking: the applicable pmcedure. Similarly, written guidance for supervisors procedurcs. Pmcedure deficiencies were -identified m

[who may be presented with these unique situations) that (1) the associated alarm response procedure would he appropriate). addressed only control system failures, (2) not all steps of the applicable abnonnal procedure were executed Ilowever, an operator's use of procedures depends upon . (including d,rections i to close the pressunzer spray block.

his perception of their adequacy, his level of expertise, va c) because adm,mistrative procedures allowed jhe._

- management expectations of their usecand group norms. abnormal procedure to be exited once ESF termination

. Operators do not always use or follow their procedures. ,

criteria were met,(3)admtmstrative guidance was lacking in some cases, it was found that operators did not follow e neerning bypass of I!SF prio_r to abnormal or EOP -

procedures because they contained errors. Procedures of entry, and. (4) guidance for effective control room.

high quality are more likely to be used and procedures. commumcations was either lacking or not effectively _

which are used are more likely to be maintained.

implemented.

While procedures are available for a large number of During the Nine Mile- Point Unit 2 partial loss of potential accidents and transients, some situations will instrument air event (Ref. 5,) the applicable procedure '

. arise where existing procedures do not apply. Thus. was written to addtass a total loss of instrument air, not knowledge-based performance will be necessary at times, partial losses in specific legs of the system.The operators to return the plant to a safe condition. may have had a better understanding of which systems were available if the procedure or associated training -

3.3.1 Procedural Adherence addressed partial losses of instrument air. During the.

/

17 . N URifG-1275, Vol. 8

! i

- . - , ~ . - ~ . .- . . . - . . . -.. . .

1s

= Nine Mile Point Unit 2 IIT event (Ref. 24), operators Preconditioning from past experience,/ training. or experienced difficulty restarting the feedwater pumps management direction strongly affectedLhow operators-because the startup procedures did not address quick recognized and responded to events and in some cases led restart of feedwater and condensate pumps : under operators to- disbelieve valid -indications or to take emergency conditions, an anticipated available water inappropriate actions, source required in the' EOPs, in addition, the scram procedure did not segregate and make a distinction Di3cussion

- between immediate actions and supplemental actions. ..

Operators often react to specif.ic plant conditions by  ;

33.2 Knowledge-Based Perforrnance During remembering past operating experience, simulator scenarios, management direction, or classroom trammg.

Events These usually combine in concert to focus operator .

. reactions in a certain manner when an event occurs.

.Obsenutmn However, previous experience with spurious alarms, ,

. malfunctioning instruments, or onposite directions for

- Operators experienced diffi alty m applying knowledge different scenarios may create confusion or misdirection, to unusual plant conditions, which resulted m delays in recognizing and responding to events. Operator preconditioning to ESF actuations - can--

misdirect operators: unnecessary ESF actuations are Discussion perceived to be unnecessary challenges to the systems; they may cause a scram and cause extra work. Section

' Some knowledge-based performance is necessary in every 3.3.4 of this report describes impromptu operator actions event to recognize the significance of the situation, that have = resulted, in part because of operator -

initiate use of the appropriate abnormal operating preconditioning to avoid ESF actuations.

, procedures or EOPs, and follow those procedures to respond to the event. Examples Example, . Several weeks before the 12Salle County Unit 2 event (Ref 20), an RO bypassed a valid RWCU isolation signal, .

In the Monticello event (Ref.15), the crew did not partly because licensee management had previously anticipate the expected plant cooldown when shutting criticized operators for allowing an automatic RWCU =

down the reactor under conditions of low decay heat and isolation that resulted m damage to the valve motors.

auxiliary steam h3 ads. The RO did not understand the because of improperly set limit switches. Although the IRM response to the power increase due to 'RCS perators knew the RWCU differential flow meter cooldown when rod insertion was stopped. indicated high, previous experience with spunous RWCU isolations during plant heatup may also have conditioned During the Quad Cities Unit 2 event (Ref. 8), an operator them to ha've expected a spurious signal. The alarm

had difficulty integrating reactor -theory and plant response procedures did not contam sufficient

response when an operator withdrew control rods to raise jnstructions on how to verify the validity of the ,, NCU pressure and received an automatic reactor scram when isol tion signal, power increased rapidly while IRMs were not maintained The normal bypassing of Si during plant shutdown at on scale.

Crystal River Unit 3 (Ref.18) may have conditioned the '

operators to respond as they had previously, instead of-In the Crystal River Unit 3 c, vent (Ref.18), an operator recognizing that the existing situation was different, withdrew control rods m an attempt to raise power, and hence, Tave, in response to a perceived cooldown event At Dresden (Ref 6), simulator training scenarios typically .

when, in fact, the reactor depressurization was not due to used a stuck open relief valve as the initiating event for an

a cooldown, as evidenced by a stable Tave, anticipated transient without scram (NIWS). In those E .

scenarios, the torus heats rapidly and the' torus =

Operators had difficulty using their knowledge in the temperatu re is a concern or major significance. Operators calculation of corrected water level at Prairie Island (Ref. stated _that they had not been trained for the simpler

19) Difficulties included -not realizing that' rounding event to its expected conclusion, The more complicated -

? would _ introduce unacceptable errors and performing simulator training prepared the operations personnel for .

simple additions requiring conversion of inches to feet-

[ the unlikely worst-case scenario. Ilowever, the lack of l: training for expected simple events failed to. highlight the j= 333 Operator Preconditioning fact that the concerns and response to worst-case l scenarios are often different from those of simple events.

_ Obsmution This preconditioning may explain why the crew-had _

l ~. NUREG-1275, Vol. 8 18 ii 2 .. u - - . - a, _..__-s _ __ , __,2. ___ ___ _ _n_ u._.__

. . -_ _- .. . . .= -- _

unnecessary, unwarranted concern for torus temperature open RWCU relief valve, with the concurrence of an response in,this event, SRO, without using available procedures.

3.3.4 Control of Emergency Safety Features At C ystal River Unit 3 (Ref.18), an RO defeated the ESF actuation system signals during 'a reactor Obscivation depressurization event caused by an open pressurizer spray valve, without the concurrence of an SRO or In two events, operators inappropriately defeated the procedural guidance.

automatic operation of ESFs during valid system demands. Some licensees have not provided sufficient guidance that limits bypassing or disabling ESES, allowed 3.4 Hunian-Macliine Interface for by TSs and emergency or operating procedures. The human-machine interface issues discussed below focus on the difference between shutdown and power Discussion operation , aids to operator awareness, and instrumentation to support operator actions, in two of 16 events investigated by AEOD, operators defeated the automatic action of an safety feature. 'lhe operators corrected their mistakes. However, this 3.4.1 Shutdown Instrumentation experience may indicate a higher failure rate than Observation assumed in pmhabihst e nsk assessments.

A lad appmpdately ranged, direct-reading, control Inappropriate defeating of ESF by operators represents a r om instrumentation to monitor reactor pressure, common-mode failure of these otherwise highly reliable _

pem ms Maddy systems. With predicted hardware unreliability of these mper g,an au in recogmzmg and responding to shutdown events, when systems of the order of 0.001 per demand and better, operator actions were required to accomplish the safety inappropriate operator action may be a dominant failure functions of disabled, automatic safety systems.

mode.These events show that some of the important TM1 lessons learned may not have been retained. Information Discussion Notice 92-47 alerted the nuclear industry about the Crystal River event. In addition, owners' groups initiated Of the 16eventsstudied,10of theeventsoccurredduring activities to pmvide better guidance to operators for power operation and 6 took place while the plant was at ~

contml of ESFs. standby or shut down. The differences between power operation and shutdown events provide scme insight into Not all plants had adminit,trative guidance for control of

~

the extent of required operator actiors and the ESFs for all plant modes, especially for situations where instrumentation needed for plant safety, the operators have not entered ;the EOPs. Some guidance did not cover when ESFs may be bypassed or disabled, U.S. power reactors are designed to provide automatic when they should be reinstituted or restarted, and- safety response for most accidents and design-basis priorities for event response. Procedures involving ESFs transients initiated during power opemtioni During such did not have a function recovery section. Not all plants events. operators often intervene quickly even though the allowed ESFs, once initiated, to operate until explicit plant is provided with automatic protective systems.

termination criteria were met. Operators were generally provided adequate guidance for control of ESFs once The French nuclear regulators and utility have EOPs and abnormal operating pmcedures were entered, . recognized the risk associated with shutdown and have although a ' review of licensee event reports (LERs)(Ref, begun a program to establish automatic initiation of SI to

28) showed that lack of guidance concerning rearming restore water level during shutdown conditions.

. ESFs was potentially a generic weakness.

For events initiated during shutdown, it is essential that Without appropriate guidance developed beforehand, operators respond. Operators usually have to diagnose operators were forced to make rapid individual decisions the cause of a problem and correctly realign equipment to in stressful situations. For situations where an SRO terminate a shutdown event. Many_ automatic safety determines that it is necessary to deviate from TSs to functions are disabled during shutdown and it is tikely that -

defeat ESFs, Title 10 to the Code of Federal Regulations equipment will be out of service for maintenance and 50.54(x) and (y) apply. unable to perform its safety function. Any additional problems make recovery more difficult. Ilowever, Emnples operators may be hindered by lack of the necessary instrumentation, training, and pmcedures to effectively in the LaSalle County Unit 2 event (Ref. 20), an RO diagnosc and terminate the eventJI'he NRC program on defeated a valid RWCU isolation signal caused by an shutdown risk has addressed these issues.

10 NUREO-1275, Vol. 8

Examples - During transients that result in a. reactor trip, a large number of annunciators are activated; their usefulness to The Prairic Island (Refs.19 and 27) shutdown event - the operator is diminished as the number of low priority showed that new electronic reactor vessel level annunciators inercases. Prioritization of annunciators instrumentation, installed to meet Generic Letter 88-17, could improve the effectiven ss of this system.

was ineffective because of faulty pressure compensation and did not respond properly because of the nitrogen Advances in plant computer technology provide' the overpressure in the pressuriier The tygon tube reactor potential for development of more advanced aids to vessel level indication had to be manually compcnsated operator awareness of plant conditions. For example, the by operator calculation. The operators experienced plant computer could be instructed to perform -

difficulty in performing these calculations in a timely instrument cross-checks to alert operators to defective manner. The licensee - required the core exit instruments. Where manual calculations are needed to thermocouples to be operable only at reduced reactor complete a procedure, the plant computer could be sessel inventories, whereas the generie letter specified programmed to perform the calculation to assure timely them to be operable whenever the reactor vessel head and accurate results.

was installed.

Also, plant computer alarm points could be based on The Catawba shutdown event (Ref. 4) involved a situation deviations from the actual operating conditions when the where the operators were interested in reactor pressure reactoris operating at a reduced power level, rather than near zero psig. while the only insttumentation available 100-percent power parameters. I'or shutdown or ranged from 0 to 3000 psig., and 0 to 800 psig. Small refueling conditions, a full' range of reactor vessel pressure changes of the type expected during fill and vent instrumentation including full range level, low range operations would not be noticeable on these instruments. pressure, and direct reactor core temperat ures, would be appropnate.

The Oconee shutdown event (Ref.12) involved a decrease of 56-inches in reactor vessel water level. "Ihe &amples operators questioned the validity of the level reading and verified it by high containment sump level and low hot leg During the Catawba overpressurization of. the RIIR level. The reactor vessel level decrease had been caused system (Ref.4) the operators were not aware that reactor by an I&li technician, who had manually opened a motor pressure was mercasmg until they diagnosed the cause of operated valve after electrical power to the control room increasmg level m the PRT due to the discharge of an position indication had been removed. 'lhis hindered the RHR relief valve.They relied on one set of mstruments -

operators from determining which valve had been opened that was inoperable without cross checking another erroneously. The operators observed the RilR hiop nearby instrument that showed increasing pressure.

temperature and decided that the core temperature As the Oconee RCS was losing _ water through an open increase was minimal and increasing - slowly. They flange (Ref.12); the operators were alerted by wide range -

beheved they had several hours before the core would heat up to the boiling point. Ilowever, bec.mse of thelack level instrumentation, but first suspected a- faulty of flow m the RHR sys*em. that temperature was not a instrument until the RCS level loss was confirmed by true indication of core temperature. A calculation done narrow range . instrumentation in the hot leg. The after the event predicted that -the core would have operators observed the RHR' kop temperature and decided that the core ternperature increase was minimal reached boiling in about 40 mmutes, and increasing slowly. 'lhey believed they had several hours before the core would heat up to the boiling point.

3.4.2 O.perator Awareness However, as noted in Section 3 :4.1. the core would have .

Obsenutmn reached boiling in about 40 minutes. The operators did not fully understand the severity of the situation during -

the event.

Annunciator and computer alarms were important operator aids in recognizing and resp (mding to events. In At Quad Cities Unit 2 (Ref.17), the MSIV closed with a fact, operators failed to recognize conditions that were consequent pressure and power spike that was not

~

I clearly off-normal, but which were not alarmed. noticed by the crew for over 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.'Ihe power spike and I

the flow increase were below the alarm set points because Dncussion

. the reactor was operating at reduced power.

I Operators cmnot respond to an event tmtil they At Prairic Island (Refs. 19 and 27), operating .

recognize that the plant is in an abnormal condition or characteristics of the reactor vessel level instruments transient. This process is facilitated by annunciators. used in the dram down. prevented the operators from instruments, procedures. and training. having a true indication of the reactor water leveh They l

NURI!O-1275, Voh 8 20 i

,n-, , ., ---, , , , - , , -ve-v.,-r. ~v--+.- n.-~~ce---~~--=~~ ~ ~ ~ , " = ~ - ' - ~ ~ ~ * * * ~ '"" "" ' ~ ' ' * *

-_ . - . . - - . -- . _ -. .- . - . . - . . ~

attempted to perform hang!_ calculations to generate a Obsenution corrected level and the results were inaccurate and

, arrived at too late to prevent loss of DilR. 'the ' effectiveness of individual licensee's studies of human performance during operating events varies 3.4.3 Instrumentation widely. While some licensees have initiated worthwhile plant specific corrective actions because of their followup l Obsenutmn on these events, others have missed such opportunities.

Crew response was affected by availability of .### ##

instrumentation, appropnateness of the instruments to the task, and the iclative hication of the instruments and I.or s me of the sixteen events AEOD studied, the controls. licensee had prepared a follo.vup report that describes the event in some detail. In almost every case, the -

Emmp/c, licensee had prepared an 1.liR. AEOD reviewed these and compared them with the human performance study I: In the Crystal River event-(Ref.18), operators were of the same event. In some eases, it was difficult to tell i- unable to identify that the depressuritation was the result that Ihe reports describe the same event. It appears in- D of an open pressurizer spray valve because the spray valve these cases.that the licensee failed to consider the human -

position indication erroneously indicated closed, performance aspects of the event or failed to include that in ormation in the report.

At Peach Hottom (Ref. 3), as with other HWRs, there was no direct indicatior of HPCIinjection flow to the reactor The . NRC receives little information on human vessel. 'lhe HPCI flow indication was in the common performance from licensees for most operational eventsc header of the injection and test return lines and measured IliRs usually do not contain detailed information on the combination of both flows. Ihc effect of the injection human performance. Collection of relevant information

-- could only be determmed from changes to the reactor in a database could be useful to the industry as a whole, vessel level. Many RCIC systems are instrumented similarly.

3.5.2 Industry. Program to Investigate At Fort Calhoun (Ref. 22), the instrumentation installed lluman Performance following the Three Mile Island accident allowed the Observation operators to identify a failed open pressurizer safety valve and facilitated operator response to the event.The safety industry groups are engaged m, many efforts to improve parameter display system, the reactor level instrument human pedomance and human reliability. These efforts system, and the sonic flow indicators provided operators have resulted m improvements to plant performance, with important information.

procedures, and programs. With the perceived reduction in the number of events caused by equipment failures, At laSalle (Ref. 20), the RWCU system relief valve lifted INPO and other mdustry groups and human performance .

and remained open The differential flow indication had experts agree that a key to continued improvement m

- often generated spurious isolations and was considered plant performance and safety _is improved human unreliable. Operator identification that an actual loss of pedomance.

I coolant event was in progress was delayed until the reactor building equipment drairi tank level finally -

Di3cussion L pnwided indirect indication of a leak.

T* SP"if'c mmnt industry initiatives to achieve this ~

-3.5 Industry Initiatives are: - INPO has coordinated-implementation of the l

Human Performance Enhancement System and EPRI is AEOD tried to evaluate progress that licensees have made in analyzing human performance during operating conducting research in human reliability by measuring .

events and feeding operating experience information crew performance _ in event scenarios using plant-simulators, In addition, INPO's overall program for back to the industry, through review of operating events, While the AEOD human performance study site visits analysis and evaluation of operational events includes -

, have been relatively short, averaging less than two days feedback to industry of some aspects Lof human .

per site visit, useful insights into influences on operator performance.

performance have been gained, both positively and I-negatively. Tlie AEOD program to investigate human performance differs from industry efforts in that we: (1) perform our 3.5.1 Event Review Process own independent onsite event investigations, (2) use a 21 NUREO-1275. Vol. 8 t e- ,e -,%y.,,y,,g , ,,,,, , , , , , , , ,

L

protocol with trained individuals to ensure quality and . categories for data on cach of the events: dcfenses (for consistency of data, ~ (3) analyze .the information to good or ill), acts (either appropriate or not), conditions develop and communicate generic findings, and very - _ (hical factors relating to the task or environment that importantly, (4) provide information and fmdings which shape operator performance). situations (whether the are available for the use of and scrutiny by allinterested plant was in a typical or nontypical stat e) and latentfactors

- parties, llowever, the number of events we have studied (upstream causal agencies . that originate in the -

is small. managerialororganizationalspheres). Aftercategorizing the data, he then found there were six factors that could liccause no one utility will experience a significant be used to discriminate between events where crew number and a broad range of types of reactor events, performance . was " successful (the crews were not infor mation collected from across the industry is a means h nu ng inWcatbny, anMey adnewd _

to provide a more complete basis on which to develop "***U'"", tinly short time) and where it was generic guidance for improved operator performance. m suam 1 (pe wwwg was delayed by misdiagnoses and/or mappropriate actmns). lie found .

that there were 8 "less successful" events (Peach llottom, 3.6 Latent Factors Catawl a, Dresden Ilraidwood, Quad Cities [both events). Monticello, and Crystal = ltiver), and . five James lleastm proposed (itef.1) analyzing the data on the ' " successful" events (Nine Mile Point, Millstone, Oconce, '

13 cvents in 1990-91 to show how latent factors can Diablo Canyon, and Waterford). lle summarized the data influence crew performance. lie used the following in Table 1.

Table' 'l Reason's categoritation of 1990-1991 events t

Discriminating factors i.ess successful crews More successful cr ews (N = 8) (N=5)

Procedural problems 8/8 0/5 Training problems 6/8 2/5 Teamwork problems 5/8 1/5 Nontypical situations 5/8 1/5 Organizational problems - 4/8 0/5 I!.arly hours AM 4/8 0/5 On average, the factors were present in two-thirds (67 When AliOD analyzed the 1992 data in the same way,it

! percent) of the less successful events as compared with was:found that the : Fort Calhoun event was more about 13 percent of the successful events. Reason has successful and the Prairic Island and la Salle events were -

suggested that "although it is always possible that the less successful.'Ihe data from all the events is included in differences between the successful and the less successful _ Tuble 2 for comparison based on the factors identified in may have reflected differences in the intrinsic quality of Table 3. An additional- factor has been. added for the operators involved, situational factors were a more - human-machine interface i problems. The data are .

l - likely source of variation and are, in any case, more easily - _ summarized as follows:

remediable," (ltef. 30).

Table 2 Categorization of 1990-1992 events Discriminating factors i.ess successful crews More successful Crews (N m10) (N = 6) _

Procederal problems 10/10 0/6 Training problems 7/10 _2/6 Teamwork prob! cms 6/10 1/6 Organizational problems 6/10 U/6 Human-Machine Interface problems 6/10- 3/6 Nontypical situations . _

-7/10 2/6' Ilarly hours AM (1:00 to 5:00 a.m.) 3/10 0/6 Null 110-1275, Vol. 8 22

,__,~ . _ , _ . ~ _ _ _ _ _ , _ . _ . _ _ _ _ _ _ _ _ _ _ _ _

Tabic 3 Factors associated with the events hss successful events More successful events i

r-

- PB Ca Dr Br QC-90 Mo QC-91 CR PI LS INM Mi Oc DC Wa FC Procedure Y N N N N N N Y Y Y Y Y Y Y Y Y Problems Training N Y N N N Y N Y Y Y Y Y N Y Problems Y N Teamwork N N N N N N N N N Y Y Y Y Y N Y Problems Nontypical N N N N Y Y Y Y N Y Y N N Y Y ,

Situations N  !

i Organizational N N N N N N Y Y Y N Y N Y Y N i fj Problems N i Early Hours N N N N N N N Y Y N Y N Y N N Morning N j

lluman-machine Interface Y Y N N N Y Y Y N N N N N Y Y Problems Y PEACH BOTTOM UNIT 3 NM NINE MILE POINT UNIT 2 PB CATAWBA UNIT I - Mi MILLSTONE UNIT 3 Ca DRESDEN UNIT 2 Oc OCONEE UNIT 3 Dr Br BRAIDWOOD UNIT 1 DC DIABLO CANYON UNIT I

! Wa WATERFORD UNIT 3 y QC QUAD CITIES UNIT 2 FC FORT CALHOUN O Mo MONTICELLO h CR CRYSTAL RIVER UNIT 3 d PI PRAIRIE ISLAND UNIT 2 LS LA SALLE UNIT 2

=

a One might note the following: teams explain that the LEll rule requires human factors reporting. During the routine review of inspection-o Pmeedural problems contributed to all of the less reports and LERs AEOD Division of Safety Programs successful events. His - data points out the staff also are alert to identify - potential human importance of procedures, training, and teamwork performance issues.

to operatcr performance. While problems in these -

areas contributed to operator difficulty in less AEOD intends to continue its human performance successful events, such problems rarely existed in efforts. AEOD will emphasize means to compile and successful events. analyre human performance experience ; from all available sources. AEOITs goal is prompt feed back of c e Nine ' events involved nontypical situations, 7 of human performance experience as well as lessons which were considered "less successful." extracted from the data, e Three events occurred in the early hours and all

5.0 CONCLUSION

S were considered "less successful."

The resulb au e consistent with those obtained carlier. On D es human tiedormance site studies have provided average,: he first five fuors, as rearranged, were present v luabic msights into how operating crews actually cope in 70 percet of the less successful events as compared with real events. ideally more data would be available to with about l' percent of the more successful events. Support conclusions. A large data base will take some time to develop bceause thesc events are mfrequent. I'his -

While this analysis is highly subjective, and the .

discriminating factors were not equally likely, it is based int rmation is the result of about 21/2 years of effort and on data from representative number of studies (16 studies is estimated to cover about one-fourth to one-third of the -

at 15 facilities) and provides a means of examining the events which significantly challenged operating crews results as a whole. Interaction among the discriminating during that period.

factors can be seen as one compensates for another. For Despite the small data base, certain conclusions can be example, good teamwork may have compensated for a drawn based on the observations in Chapter 3 of this procedure or trammg problem. In any case, it seems clear 7 that crew performance can be made more effective by 'C P"

• improving pmcedures, training. _ teamwork, and_

1. During some events, control room personnel were organizationL and by suggesting that crews exercise

- overburdened, despite the availability of sufficient greater caution when in nontypical situations and during number of crew on shift, due to unequal task the early morning hours' assignments. Difficulties which arise due to control -

room organization and task assignments could be 4.0 PROGRAM ACTIVIT.IES minimized, in most cases without additionat staff, by:

changes to control room shift structure and assignments based on functional analysis (including -

AEOD has recognized the need for improved collection STA functions) and lessons learned from analysis of and extraction of human performance lessons learned operating events.

across all plants (Ref. 29). To improve extraction of human performance lessons learned, AEOD has begun 2. In two events, operators inapproprialcly defeated

activities to create a human performance data base- the automatic operation of ESFs during valid system demands. These events show that some of the To improve collection of human performance data, important TMI lessons learned may not have been AEOD staff has begun efforts to improve reporting of retained. Potential improvements in the contml of -

- human performance data by both licensees and NRC emergency safety reatures offer a high safety return staff. For exampic, AEOD_ management is alert to in the reduction of risk from operator error, include human performance in AIT and Incident -

Investigation Team charters, when appropriate, and has 3. Teamwork improved performance , in complex, provided staff with human performance evaluation high-stress situations; and good teamwork was an expertise to these teams, AEOD has supported efforts of important factor in knowledge-based performance, other NRC offices, such as the human. performance investigation pmcess, that are raising the awareness and 4. Pmcedures were an important factor in crew knowledge of resident, regional, and headquarters performance. Procedure problems were ' key -

inspectors. During AEOD site visits, the teams contributors m the less successful events, but were encourage the licensees to perform human performance not found in the more successful events when the investigations and to report the results in LERs. The procedures were accurate, complete, and N UR EG-1275. Vol 8 24 a,, - - . - . - , - u, ,,....a;.-- - - . - . . - . - . . - . - - - , . - . . .

management required their use. (3.2.3, 3.3.1 and 8. Memorandum from J.ll, Rosenthal, NRC, to T.M.

Novak, NRC, "lluman Factors Study Report-13.2)

5. l'or events initiated during shutdown, operatois are

9. NRC Information Notice 41-01, " Reactor Scram expected to diagnose and respond appropriately. A lack of appropriately ranged, direct. reading, control Following Control Rod Withdrawal Associated with room instrumentation to monitor reactor pressure, I ow Power Turbine Testing "

temperature, and level caused operators to have 10. Memorandum from J.E. Rosenthal, NRC, to T.M.

difficulty in a ccognizing and responding to shutdown Novak, NRC, " Human Factors Study Report-events, when operator actions were required to Millstone Unit 3 (12/31/90)," April 4,1991, accomphsh the safety functions of disabled.

automatic safety systems. The observations in Nuclear Regulatory Commission, "NRC

11. U.S.

Section 3.4.1 of this report have been shared with Region 1 Augmented Inspection Team Report NRR and the NRC program on shutdown risk has (50-423/91-80)," I etter from M.W. Ilodges (NRC) addressed these issues. to li.J. Mroczka, Northeast Nuclear linergy Com-With the perceived reduction in the number of pany, February 12,1991, 6.

events caused by equipment failures, INPO and 12. Memorandum from J.li. Rosenthal, NRC, to T.M.

other industry groups and human performance Novak, NRC, "Iluman Factors Study Report-experts agree that a key to continued improvement Oconce Unit 3 (3/8/91)," May 29,1991.

in plant performance and safety is iipproved human performance. Because no one utility will experience 13. U.S. Nuclear Regulatory Commission, "NRC a significant number and a broad r'ange of types ~ of Region !! Augmented Inspection Team Report reactor evems, information colketed from across (50-269/91-0S, 50-270!91-08, 50-287/91-08),"

the industry is a means to provide a more complete 1.etter from S.D. Ebneter (NRC) to M.S Tucker, basis on which to develop generic f,idance for Duke Power Company, April 15,1991.

improved operator performance.

14. Memorandum from J.E. Rosenthal, NRC, to T.M.

6,0 RE,FERENCES Novak, NRC, " Human Factors Study Report-Diablo Canyon Unit 1 (5/17/91)," August 23,1991.

1. Memorandum from E.A. Trager, NRC to J l!. 15. Memorandum from J.E, Rosenthal, NRC, to T.M.

Rosenthal, NRC," Human Performance Study Pro- Novak, NRC, " Human Factors Study Report-gram Review Meeting," May 8,1992- Monticello (6/6/91)," September 20,1991.

2. Memorandum from J.E. Rosenthal, NRC, to T.M. 16. Memorandum from J.E. Rosenthal, NRC, to T.M.

Novak, NRC, " Interim Report on Human Per- Novak, NRC, " Human Factors Study Report-formance Study Program." May 24,1991. Waterford Unit 3 (5/17/91)lsic](Actual event date

3. Memorandum from J.E. Rosenthal, NRC, to T.M.

Novak, NRC, "lluman Factors Team Report- 17. Memorandum from J.E Rosenthal, NRC, to T.M.

Peach Bottom Unit 3 (1f2S/90)," March 2,1990. Novak, NRC, " Human Factors Study Report-

4. Memorandum from G.F. lanik, NRC, to T.M.

Novak, NRC, " Human Factors Team Report- 18. Memorandum from J.E. Rosenthal, NRC, to T.M.

Catawba Unit 1 (3/20/90)." J une 5,1990. Novak, NRC, "lluman Performance Study Report-Crystal River Unit 3 (12/8/91)," January

5. Memorandum from J.E. Rosenthal, NRC, to T.M. 30,1992.

Novak, NRC," Human FactorsTeam Report-Nine Mile Point Unit 2 (5/14/90)," August 24,1990. 19. Memorandum from J.E. Rosenthal, NRC, to T.M.

Novak, NRC. " Human Performance Study

6. Memorandum from J.11. Rosenthal, NRC, to T.M. Report-Prairie Island Unit 2 (2/20!92)," May 12, Novak. NRC, " Human Factors Team Report- 1992.

Dresden Unit 2 (8/02/90)," October 3.1990,

20. Memorandum fmm J.E. Rosenthal, NRC, to T.M.

7. Memorandum from J.E. Rosenthal, NRC, to T.M. Novak, NRC, "11uman Performance Study Novak, NRC, " Human Factors Study Report- Report-laSalle County Unit 2 (4/20/92)" June 16.

Braidwood Umt 1 (10/04/90)," January 23,1991. 1992.

25 NUREG-1275 Vol. 8

4 21.' Memonmdum from J.E. Rosenthal, NRC, to T.M. - Society ' Bulletin, Volume 33, No._12. December 1 Novak, NRC, lluman Performance - Study 1990.

Report-Fort Calhoun (7/03/92)," September 25, 1992. 27, U. S. Nuclear Commission, "NRC Region , til-Augmented Inspection Team - Report -

22. - U.S. Nuclear Regulatory Commission, "NRC - (50-306/92-005)"12tterfrom A.lL Davis (NRC)to Region IV Augmented Inspection Team Report 1.R. Eliason, Northern States Power Co., March 17, (50-285/92-18)." letter from J.L Milhoan (NRC) 1992.

_l to W.G. Gates, Omaha Public Power District,-

Augr it 6,1992._ 28. Memomndum from =T.M. Novak, NRC, to E.L Jordan, NRC," Generalization of Crystal River Unit

23. FitzPatrick Diagnostic Evaluation Team Report, 3 Iluman Performance-Operating Experience NRC, November 11,1991. Iteview," April 16,1992.

• ""*"'". ~

24. " Transformer Failure and Common Mode less of '# o

" ^"' "

Instrument Power at Nine Mile Point Unit 2 on pe r E " ance ' r1 2 1992.

August 13,1991," (NUREG-1455), NRC, October, 1991.

30. Telefax from J. Reason to 11. Blackman, INEl,

25. " Human Error" by James Reason (Cambridge -

University Press,1990). 31. U.S. Nuclear Regulatory Commission, "NRC Region til Augmented Inspection Team-Report

26. " Cognitive Psychologyand Team Training: Training (50/456/90-020)," letter from E.G.- Greenman Shared Mental Models of Complex Systems" by (NRC) to C. ' Reed, Commonwealth Edison Janis A. Cannon Howers, et al., Human Factors Company, October 23,1990.

NUREG-1275, Vol. 8 26

eveniuai coat of the shift supervisor serving in the 7.0 Al'PENDICES dual role The Commiwion encourageslicensees to have the dedicated STA rnsuine an active role in 6hift activities if the alternative, dedicated STA position is selected.This 7.1 Appencilx A: llackgroulut on the could be accomplished by having me SrAs rotate wim the Positioll of Shill Tecluilcal Ativisor shift and by including iesponsibdities io review piant ions, participate in shift turnover activities and truining, and Requiremenf5 thut n/ydy to the STA po.sitiotr rnaintain an awareness of plant configuration and status.

Sl!CW92-026, dated January 21, 1992, desenbes the liacAgroumt - intendedfunction of the S7A evolutiem of requirements for the STA at nuclear pmer plants. It notes that Generic lxtter 86-04 was issued on The I cdcral itegister notice of October 28,1985, is clear liebruary 13,1986, to provide licensees with a copy of the that the requirement for the STA is intended toimprove li ederalllegister notice of the "NitC Policy Statement on the abihty of shift operating personnel to recognite,

!!ngincenng lixpertise on Shift." The policy statement diagnose, and cifectively deal with plant transients or was intended to ensure that adequate engineering and other abnormal conditions.

accident assessment expertise is possessed by the -

operating staff at a nuclear power plant. The STA function is to objectively evaluate the plant condition during abnormal and accident conditions nnd The NitC pohg statement offers two options to meet the recommend action, Specific training in the plant transient

- STA requirements of providing engineering expertise on response helps to accomplish this.The requirement for a shift. Option i provides for ehminating the dedicated bachelor's degree in engineering or equivalent helps SPA position by combining one of the required on shift ensure the STA has c.igineering expertise to contribute SitO positions with the STA position into a " dual role," and can think and communicate effectively. (Ihc .

SitO/STA position. The SitO/ SPA must hold a baccalaureate is usually the lowest degree conferted by a baccalaureate degree in engmeering, . engineering 4 year college or university,'this is not an unreasonable technology, or physic;d science, or a i rufessional qualification for this position.) Qualification as an SitO lingineer license. Option 2 permits a licensee to satisfy makes it more likely that the KrA will be respected by the the policy by placing on each shift a dedicated SFA who licensed SitOs on shift so that the STA's advice will be meets the education and knowledge criteria of adequately considered. Itequiring the SPA to rotate with NUI<l?G-0737, item I.A.1.1, and participates in normal a shift and have responsibilities to review plant logs, shift activities. participate in shift turnover activities and training, and maintain an awareness of plant configuration and status, The generic letter notes that the Commission encourages are other things that improve the SPAS knowledge and beensees to move toward the dual. role pmition, with the credibility with the shift.

l l

l l'

l 27 NUltt!G-1275. Vol. 8 ,

t

" ---r-e n m we,,- r<,,1.,-ee. u ,-,4,n.

o s Nuca AR HrGULAlORY COMMSSION L HEPORT NUMDtH NHorORM m t Asogned by NHC. Arki Vol .

(2-FG) Supp Rev , and Adde rutom tNnw NBCM i102,

• * * " ^"Y )

Wi *2 BIBLIOGRAPHIC DATA SHEET ace mimcuans on u ceo NU Rl!G-1275, Vol. 8 Al!OD Case Study C92-01

r. TH u ANu euunn e a oAn m POH r ruousm o Operating lisperience 1 cedback Report - 1luman Performance m Operating I! vents Mor mt vrAn liecember l 1992 Commercial Power Itcactors

4. l'iN OH OHANI NUMUDt b Au t HvH ib) 6 l YPt OF Ht DOH f J. V, Kauffman, G. I' I anik, it. A. Spence. I!. A. Trager Technical

7. PF HiOD CovtHED prdume Dates)

January 1990 -

December 1992 s ItH6 OHuNo cHouarooN - Nmt ANo ^oont t.s 04 NHc proado one un,ce u Hegm u s Nuc%r Heuniory conmsoon. and rnalung addrttus. If coritractor, prev 41e name an,1 mmhng ajJress }

Disision of Safety Programs Office for Analysis and livaluation of Operational Data U.S. Nuclear llegulatory Commission Washington, DC 20555

9. WONSOHaNG OHGAN12 ATION - N8NL AND AOoHE SS Of f 4RC, t yre fiamo as provtf ; if tetr ac tur, prow ,e NHC Otvision, Off ers or negyon, s U.S Naciear Recpdatory Comemmon, and methng addt ess )

Same as 8. above 10 SUP6 ti ML NT AHY NOILG t1. ADMIRAC r (200 words or less)

This report describes the results of a Nuclear llegulatory Commission (NitC) program begun in 1990 to conduct onsite,in depth studies of human per formance that affected reactor safety during selected power reactor events. 'lle purpose of the program is to identify the factors that have contributed to good operator performance during events as well as the factors that hindered performance, and to feed this information back to the industry.

Under the human perlormance study program, six onsue studies wer e performed in 1990, seven in 1991, and three in 1992.

Each onsite study was conducted by a multidtsciplinary team, lead by an NRC staff member,with additional NitC and Idaho National lingineering Iahoratory personnel. The events studied include a wide variety of M ident scenarios.

This report provides information on control room staffing and organi/ation, the " dual role" shift technical advisor, use of shift resources dt-ing emergencies, operator control of engineered safety features, simulator training, crew teamwork dur-ing stressful situations, task awareness, use of procedures, the human-machine interface, and licensee followup on events.

The information could be useful to licensees in efforts to upgrade existmg programs to improve safety.

13. AV A: LAD:lli V ST Af f MrNT

12. KEY WORD $ fDC SCR!PT ORS (t.tst wordt rv <Waws that will assat researchers in locatrng tN4 report.)

Unlimited control room organi/ation " """" C' ^ WHC ARON emergency safety features ( ""* M event investigation knowledge-based performance linclassified ohn umru human performance Unclassified latent factors

n. Nov m-H or eAo,3 procedure adherence shtft 'echnical advisor task awareness "' F""M teamwork NW rOHM 1% (2 89)

F R

Printed on recycled j': paper Federal Recycling Program L

e ~, y ,.e , , , N -m w-,-eoe, e,*-,r - w m m e -,- <e,s - -m= - - - - --~~-v=.------.---e-N--e-~--m" o---- - - ~ ~

i NUREG-1275, Vol. 8 < OPERATING EXPERIENCE FEEDilACK REPORT- 11UMAN PERFORMANCE IN OPERATING EVENTS ' . DECEMBER 1992

- UNITED STATES - . rmST CLASS MA!L . _

' NUCLEAR REGULATORY COMMISSION ' POSTAGE AND FEES PAtD..

WASHINGTON, D.C, 20555-0001 usnac FERM1T f40 G-67, <

9FFICIAL BUS!PIESS PENALTY FOR PRIVATE USE. $300 -

+

w

_ _ _ __. __ ..m, _.2_