ML20127J594

Preimplementation Audit of Dcrdr of Davis-Besse Nuclear Power Station

ML20127J594
Person / Time
Site:	Davis Besse
Issue date:	06/14/1985
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML20127J597	List: ML20127J594
References
CON-NRC-03-82-096, CON-NRC-3-82-96, RTR-NUREG-0737, RTR-NUREG-737 NUDOCS 8506260708
Download: ML20127J594 (36)

Text

-

t PRE-IMPLEMENTATION AUDIT OF THE DETAILED CONTROL ROOM DESIGN REVIEW OF THE DAVIS-BESSE NUCLEAR POWER STATION June 14, 1985

~

Prepared for:

U.S. Nuclear Regulatory Comission Washington, D.C. 20555 Contract NRC-03-82-096 Prepared by:

Science Applications International Corporation 1710 Goodridge Drive McLean, Virginia 22102 TCG260 768' %

t 9

, FOREWORD This report documents the findings from a pre-implementation audit of the Detailed Control Room Design Review (DCRDR) being conducted by Toledo Edison (TED) for its Davis-Besse Nuclear Power Station. The pre-implementation audit was conducted by a four-man team comprised of one representative from the Human Factors Engineering Branch of the NRC's Division of Human Factors Safety, two representatives from Science Applica-tions International Corporation (SAIC), and one representative from Comex Corporation, a subcontractor to SAIC.

The pre-implementation audit consisted of extensive discussions held the week of April 29, 1985, with representatives of TED and its consultants, Impe11 (nuclear engineerin (human factors engineering)g, operations, and I&C) and DCRDR methodologies, dataEssex forms,Corporation and Human Engineering Discrepancies (HEDs) were reviewed. Where clarification of HEDs reviewed was needed, the relevant systems and components were examined at

' the control room mock-up. A visit was made to the control room and Remote Shutdown Panel at the beginning of the pre-implementation audit.

SAIC's participation was provided under Contract NRC-03-82-096, Technical Assistance in Support of Reactor Licensing Actions: Program III.

SAIC previously participated in the evaluation of TED's DCRDR Program Plan and Summary Report for Davis-Besse Nuclear Power Station.

4 ii

1 9

?

TABLE OF CONTENTS Section Page BACKGROUND . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I PLANNING PHASE . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1

1.

Qualifications and Structure of the DCRDR Team . . . . . . . 3 l

~

REVIEW PHASE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1. Function and Task Analysis . . . . . . . . . . . . . . . . .

2. 5 Comparison of Display and Control Requirements With a 3.

Control Room Inventory . . . . . . . . . . . . . . . . . . . 9 Control Room Survey

4. Operating Experience Review .................... 10

................ 11 ASSESSMENT AND IMPLEMENTATION PHASE

................. 12 1.

2. Asses sment of HEDs . . . . . . . . . . . . . . . . . . . 12 Selection of Design Improvements . . . . . . . . . . . .

3. . 15 Verification That Improvements Will Provide the Necessary 4.

Corrections Without Introducing New HEDs . . . . . . . . . . 20 Coordination of the DCRDR W .

Programs . . . . . . . . . .ith Other Improvement

................ 21 ANALYSIS OF PROPOSED CORRECTIVE ACTIONS AND LEFT UNCORRECTED . . . . . . . . . . . . .............. . JUSTIFICATIONS 22 FOR HEDs

1. Proposed Corrective Actions

2. ................. 23 Justifications for HEDs Left Uncorrec.ted . . . . . . . . . . 24 CONCLUSIONS AND RECOMMENDATIONS

................... 27 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 APPENDIX - Attendees of the Meetings Held During the Pre-Implementation Audit of the Davis-Besse Nuclear Powe r S t a t i o n D C R D R . . . . . . . . . . . . . . . . . . . . 34 1

iii

t PRE-IMPLEliENTATION AUDIT '

0F THE DETAILED CONTROL ROOM DESIGN REVIEW OF THE DAVIS-BESSE HUCLEAR POWER STATION This report documents the findings from a pre-implementation audit of the Detailed Control Room Design Review (DCRDR) being conducted by Toledo Edison (TED) for its Davis-Besse Nuclear Power Station. The basis for the decision to conduct a pre-implementation audit was the review of the DCRDR Summary Report for the Davis-Besse Nuclear Power Station (Reference 1). The requirements set forth in NUREG-0737, Supplement 1, " Requirements for Emergency Response Capability," December 1982 (Reference 8), served as the basis of the Summary Report evaluation and the pre-implementation audit.

The purpose of the pre-implementation audit was to clarify the review methodology, to audit documentation of the review, and to provide feedback to the licensee on the acceptability of the review conducted. Participants in the audit medings are identified in the Appendix.

The DCRDR began with the submittal of the Program Plan to the NRC on June 15,1983 (Reference 2). The NRC staff comments on the Program Plan were forwarded to TED on October 7,1983 (Reference 3). The DCRDR Summary Report was submitted to the NRC on June 29,1984 (Reference 1). The NRC staff comments on the Summary Report were forwarded to TED on October 10, 1934 (Reference 4). On January 31, 1985 TED submitted a revised assessment -

of HEDs and implementation schedule for correction of HEDs associated with special studies (Reference 5). The findings of the pre-implementation audit follow a brief overview of the background of the DCRDR requirements.

BACKGROUND Licensees and applicants for operating licenses are required to conduct a Detailed Control Room Design Review (DCRDR). The objective is to

... improve the ability of nuclear power plant control room operators to prevent accidents or cope with accidents if they occur by improving the i information provided to them" (NUREG-0660, Item 1.D.1). The need to conduct a DCRDR was confirmed in NUREG-0737 and in Supplement I to NUREG-0737.

DCRDR requirements in Supplement I to NUREG-0737 replaced those in earlier I

(

I

l l

t documents. Supplement 1 to NUREG-0737 requires each applicant or licensee to conduct its DCRDR on a schedule negotiated with the NRC. Guidelines for conducting a DCRDR are provided in NUREG-0700 while the assessment processes

{

for the NRC are contained in NUREG-0800. (The NUREG documents cited are listed as References 6 through 10).

l A DCRDR is to be conducted according to the licensee's own Program Plan (which must be submitted to the NRC). According to NUREG-0700, it should include four phases: (1) planning, (2) review, (3) assessment, and (4) i reporting. The product of the last phase is a Summary Report which, accord-ing to Supplement 1 to NUREG-0737, must include an outline of proposed control room changes, their proposed schedules for implementation, and

', summary justification for human engineering discrepancies with safety significance to be left uncorrected or partially corrected. Upon receipt of the licensee's Summary ~ Report and prior to implementation of proposed changes, the NRC must prepare a Safety Evaluation Report (SER) indicating the acceptability of the DCRDR (not just the Summary Report). The NRC's evaluation encompasses all documentation as well as briefings, discussions, and audits, if any were conducted.

The purpose of this pre-implementation audit report is to assist the

' NRC by providing a technical evaluation of the TED DCRDR process and results. "

The DCRDR requirements as stated in Supplement 1 to NUREG-0737 can be summarized in terms of the nine specific elements listed below:

1. Establishment of a qualified multidisciplinary review team.

2. Use of function and task analyses to identi fy control room operator tasks and information and control requirements during

, emergency operations.

i

3. A comparison of display and control requirements with a control room inventory, i-

4. A control room survey to identify deviations from accepted human factors principles.

4 2

y - r--- yw-- _,w,._,. , --..,, p _-,,.,_,,,.,.,,,m. __,.._.7,._._-,_9 % _

__,.,y_ , _._,,__ , .,_-__,,____.w,

( 5. Assessment of human engineering discrepancies (HEDs) to determine which HEDs are significant and should be corrected.

6.

Selection of design improvements that will correct those discrep- l ancies.

7. Verification that selected design improvements will provide the necessary correction.

4

8. Verification that improvements can be introduced in the control room without creating any unacceptable human engineering discrepancies.

9.

Coordination of control room improvements with changes resulting from other improvement programs such as SPDS, operator training, new instrumentation (Reg. Guide 1.97, Rev. 2), and upgraded emer-gency operating procedures.

PLANNING PHASE The NRC staff review concluded that the TED Program Plan, in general, was well structured and covered all the major requirements for a DCRDR. The i

staff also concluded that although the scope of the review effort for each requirement discussed in the Program Plan varies a great deal. TED's plans for conducting a DCRDR, if properly executed, should " result in the identification and correction of serious HEDs in the control room." The NRC i

staff's review of TED's execution of its plans for conducting the DCRDR as described in the Summary Report was inconclusive due to the lack of detail in the information provided and the incompleteness of HED resolutions.

1. Qualifications and Structure of the DCRDR Team Table 2 in the Program Plan lists the activities comprising the DCRDR and the intended involvement of disciplines in each activity. Based upon this table and resumes provided in the Program Plan, the NRC staff concluded that "...a qualified multidisciplinary review team has been assembled to conduct the DCRDR" (Reference 3, p. 4). A review of the information provided in the Summary Report on the actual involvement of the disciplines 3

t t

in each activity found discrepancies between it and what was said in the Program Plan. The discrepancies were confirmed through discussions held during the pre-implementation audit with TED. Whereas the Program Plan and Summary Report state that human factors specialists will be involved in the selection of design improvements and the verification that the design improvements provide the necessary correction without introducing new HEDs, TED actually is not going to involve human factors specialists in these activities as integral members of the DCRDR team. TED stated in discussions held during the pre-implementation audit that it will involve human factors specialists in the remaining DCRDR activities when it determines such assistance is necessary. The NRC audit team stated that human factors involvement should not discontinue at the end of the review and assessment phases of the DCRDR but should be included in the activities remaining to be completed, including the special studies, selection of design improvements, and verification that the improvements provide the necessary corrections without introducing new HEDs.

In its evaluation of the Program Plan the NRC expressed a concern with the workload placed upon the DCRDR Project Administrator, which included coordinating not only the DCRDR, but also "...many other improvements in emergency response and the integration and coordination of other human factors programs" (Reference 3, p. 5). During the pre-implementation audit, the NRC audit team confirmed that the DCRDR Project Administrator was responsible for or participated in not only the DCRDR, but also TED's responses to the NUREG-0737, Supplement I requirements for the Safety Param-4 eter Display System (SPDS), the upgrading of Emergency Operating Procedures (EOPs), and the review of Reg. Guide 1.97 instrumentation. The excessive workload placed upon this position as a coordinator of NUREG-D737, Supple-ment 1 initiatives and as a participant in the DCRDR activities appears to have affected the quality of the DCRDR.

In summary, several activities remain to be completed in the DCRDR.

Although it appears that the DCRDR Project Administrator has the authority to obtain support for the DCRDR activities TED stated that it is not presently planning to include human factors specialists as an integral participant.

i Human factors specialists should be integral, active members of the DCRDR team for the activities that remain to be completed, including all of the special studies, selection of design improvements, and i

4

. ~ - . - _ - .-.. - . . - .. . -. - - . - _ , - _ _ . - --. - . .

i verification that the improvements provide the necessary corrections without introducing new HEDs. Information concerning the levels of involvement of human factors specialists and other disciplines in each of the special studies and the selection and verification of design improvements should be provided by TED after these activities have been completed. Until this information has been provided for review, the adequacy of TED's DCRDR team qualifications doesn't appear to meet the requirements of NUREG-0737, Sup-plement 1 for the remaining DCRDR activities. TED's expressed plan not to include human factors specialists in the remaining activities would violate the requirement for a qualifieo, multidisciplinary review team.

REVIEW PHASE The activities included in TED's Control Room Review which were dis-cussed during the pre-implementation audit correspond to the following NUREG-0737, Supplement I requirements:

1. Function and Task Analysis

2. Comparison of Display and Control Requirements With A Control Room Inventory

3. Control Room Survey In addition, the Operating Experience Review was discussed during the pre-implementation audit. Although the Operating Experience Review does not specifically correspond to a requirement of NUREG-0737, Supplement 1, the results of this activity are integrated into required DCRDR activities and therefore will be given attention in this report.

1. Function and Task Analysis 4

From its review of the Summary Report, the NRC staff concluded that "Although the task analysis methodology described was rigorous and comprehensive, and satisfies the requirements of Supplement I to NUREG-0737 to the extent that it was performed, it does not identify operator informa-tion and control needs in terms of instrument and control characteristics" (Reference 4, p. 7). In the Conclusion section of the NRC staff comments, the following items were listed as those areas of TED's System Functions 5

i i

Review and Task Analysis (SFR&TA) which could not be evaluated due to the need for more information than that given in the Summary Report:

o A description of the types of personnel used to perform the system functions review, task analysis, verification of equipment avail-ability, and the extent of each individual's responsibility and participation in conducting these activities.

e A description of the criteria used to analyze operator traffic patterns and the specific HEDs identified from this analysis.

e A description of the process used and the analysis conducted to develop information and control requirerents independent of existing control room instrumentation which are extensive enough to encompass a comprehensive set of operator E0P tasks.

1 Through discussions held with TED represen'tatives during the pre-implementation audit, the NRC audit team learned that a multidisciplinary team performed the SFR&TA. Included in the TED DCRDR review team were two 1

consulting organizations. Personne1'from one consultant provided the disci-plines of nuclear engineering, operations, and I&C. Personnel from the second consultant provided the disciplines of human factors engineering and operations.

TED's review team, which was split into two groups (by consultants),

performed the system functions review and an identification of high level tasks using a " parallel" approach. This approach consisted of two system functions reviews: (1) a procedure-based system functions review, and (2) a top-down system functions review. The first group performed the procedure-based system functions review which was based upon Davis-Besse Anticipated Transient Operating Guidelines (ATOGs) that were tailored by Babcock and Wilcox (B&W) to the Davis-Besse control room. The top-down system functions review was performed to compensate for any bias introduced into the procedure-based system functions review due to the use of Davis-Besse-specific ATOGs. This dual effort included the identification of the (1)

Davis-Besse critical safety functions; (2) safety systems; (3) system functions; (4) the operator actions or tasks spelled out in the upgraded, symptom-based emergency operating procedures; (5) high-level information and 6

L

control requirements (i.e., parameters and control functions); and (6) the actual control room instruments and controls. TED's DCRDR team did not identify the required characteristics of instruments and controls.

TED's human factors consultants performed the task analysis beginning with the high-level tasks and information and control requirements identi-

fled by the first group. Independent of the first group's identification of actual control room instruments and controls, the human factors consultants extracted the procedural steps from the two system functions review efforts i and developed task data forms which detailed the elements that comprised the tasks the operator performs in the procedural steps (see p. 5-10 of the Summary Report). TED stated during the pre-implementation audit that its

human factors consultants did a further identification of information and control requirements from the two system functions review efforts. However, the TED DCRDR team did, not identify the required characteristics of instru-ments and controls.

Using Davis-Besse operators TED's consultants performed a verification "

of task performance capability. This activity, referred to during the pre-implementation audit as "V&Y," consisted of three subactivities: (1) ana-i ly- trator traffic patterns; (2) verify equipment availability; and (3) veri , human engineering suitability of available equipment. Operator traf-fic patterns were evaluated by documenting operator movements during the i performance of tasks in the context of event sequences and applying relevant i criteria from NUREG-0700. Equipment availability was evaluated by comparing the high-level information and control requirements with the control room during walk- and talk-throughs of the operator task sequences that were developed in the task analysis. Through discussions with the TED review team during the pre-implementation audit, the NRC audit team confirmed that the task analysis did not identify required instrument and control charac-teristics and that the verification of human engineering suitability of available equipment was 'not based upon such a list of required characteris-tics but upon the ability of the personnel to identify unsuitably designed instruments and controls. The characteristics of instruments and controls that were listed in the system functions review and task analysis data sheets were not required characteristics but were the characteristics of the actual contral room instruments and controls.

y

, , - . . . _ . _ _ - _ - . . ,.,...,_-.._,_,,,-.r_._,,_...-m_.-_- _ _ _ _ , , _ _ - - . , _ , , , , _ _ _ , _ - - _ _ _ _ , - , _ . _ , _ . _ ,

4 In addition to discussions with the TED review team, the NRC audit team conducted a review of the plant-specific Davis-Besse ATOGs to determine their adequacy as a basis for the system functions review and task analysis.

' The review found that the Davis-Besse ATOGs, relative to other Babcock &

Wilcox plants reviewed, are comprehensive with respect to encompassing all operator emergency tasks. However, one area which is not contained in the Davis-Besse ATOGs is the set of operator tasks necessary to monitor and assess the various challenges and failure modes of the radioactivity release 4 .

critical safety function (CSF). The ATOGs refer frequently to emergency plan procedure El 1301.1 in cases where a release of radioactive material is possible. The failure to include operator tasks associated with monitoring radiological conditions appears to be the most frequently overlooked aspect 4 of an SFR&TA conducted at other licensee facilities (i.e., this problem does not appear to be unique to the Davis-Besse DCRDR). In addition to not considering Radioactivity Release, the NRC audit team found in some cases (i.e. Steam Generator Tube Rupture) that the listing of information and control requirements was much less comprehensive than those suggested by the ATOGs.

J The NRC audit team reviewed the V&V documentation and HEDs identified and found this effort to be systematically performed. The 68 HEDs that were identified from the V&V included HEDs concerning unavailable and unsuitably designed instruments and controls as well as inadequate ' control / display integration and panel layout. Although the V&V was found to be systematic-ally performed and many HEDs were identified, the NRC audit team concluded that: (1) the verification of equipment availability was based upon an incomplete analysis of all operator emergency tasks, and (2) the verifica-tion of human engineering suitability of available equipment was not based upon an a priori analysis of required characteristics of instruments and controls which is used to comprehensively and objectively verify the human engineering suitability of available instruments and controls.

In summary, TED's system function review and task analysis was found to be lacking in the following areas:  :

1. A comprehensive analysis of operator tasks, information and con-trol requirements, and required characteristics of instruments and

)

i 8

l

.. . = - .-.

controls necessary to monitor and assess the various challenges q

and failure modes of the Radioactivity Release CSF.

2. A comprehensive analysis of information and control requirements and required characteristics of instruments and controls for Steam Generator Tube Rupture.

3. An a priori, comprehensive analysis of required characteristics of instruments and controls for all operator emergency tasks.

In order for TED to meet the function and task analysis requirement of NUREG-0737 Supplement 1, it must satisfactorily perform and document the three areas of activities above. We recommend that for the performance of item number 1. TED should use the following scenarios or applicable steps from the Emergency Operating Procedures:

e A small break SBLOCA e A major release up main vent stack e An unmonitored release path Although item number 2 was performed to a limited extent and item number 3 can no longer be performed a priori, these activities must be performed as well as item number 1 in order to ensure that the availability and suitability of equipment needed to support all operator emergency tasks can be comprehensively and adequately verified. Until TED has satisfactorily performed and documented these activities for NRC review, the Supplement I to NUREG-0737 requirement for a function and task analysis is considered ,

incomplete.

2. Comparison of Display and Control Requirements With a Control Room Inventory TED's DCRDR activities which address this requirement are the verifica-tion of equipment availability and verification of human engineering suitability. As previously discussed in the Function and Task Analysis section cf this report. TED's verification of equipment availability was based upon an incomplete analysis of all operator emergency tasks and information and control requirements. TED's verification of human engineer-9

t ing suitability was not based on an a priori, comprehensive analysis of required characteristics of instruments and controls used to support operator emergency tasks. These verification activities were performed .

using the control room mock-up rather than an inventory of the control room.

The use of the control room mock-up for these activities was found to be acceptable by the NRC audit team. Since the system function review and task analysis was found to be inadequate, and this work is the basis for the verification of instrument and control availability and suitability, the comparison requirement of Supplement 1 to NUREG-0737 has not yet been met.

In order for TED to meet this requirement, it must satisfactorily perform and document the three activities described in the Function and Task Analy-sis section of this report and perform and document a verification of

- instrument and control availability and suitability for the requirements We recommend that TED also validate the developed from these activities.

control room for the operator tasks included in the scenarios used for i

performing the Radioactivity Release CSF.

3. Control Room Survey The NRC staff concluded from a review of the Summary Report that "the methodologies and findings described in the summary report were comprehensive and indicative of a valid approach" (Reference 4, p.12).

This conclusion was confirmed during the pre-implementation audit through discussions with TED and Essex representatives and a review of the survey documentation. To review further the adequacy of the survey of the Davis-Besse control room, the NRC audit team compared the HEDs it identified in a

" mini survey" of the control room with the HEDs identified by TED. With the exception of one HED, the comparison found every HED identified by the NRC i audit team to have been identifised by TED in its survey. The one HED not  !

identified concerned the incomprehensible annunciator system flash patterns.

This HED should be reviewed and resolved by TED.

i During a visit to the control room, discussions with operators revealed j that new components have been added to the control room since the survey was I conducted. As part of the DCRDR, TED should evaluate the adequacy of these ]

components based upon human engineering principles. These components should l be evaluated by survey and verification and validation techniques.

l i

+

4 10

, l l

In summary, the control room survey performed by TED up to this time has been adequately performed. In order to complete this activity and meet the requirements of NUREG-0737, Supplement 1 TED should evaluate the human engineering adequacy of the new components added to the control room since the survey was performed. In addition. TED should include the annunciator system flash patterns in its review, assessment, and resolution of HEDs.

4. Operating Experience Review SAIC found that the operator interviews and historical documentation review were acceptable as described in the Summary Report. However, discus-sions held with TED DCRDR representatives during the pre-implementation audit and a review of the operator interview and historical documentation review results by the NRC audit team revealed the following problems:

e It appeared that the interviews were conducted by inexperienced personnel who lacked knowledge of reacto.r plant systems, thus limiting the extensiveness and effectiveness of the interview data.

e Recording of operator interview results was performed in a cursory manner, with very little detail annotated. Valuable additions to the potential HED data base appear to have been lost in this process. It appears that this lack of detail was due to a lack of familiarity with reactor plant systems and terminology on the part of the interviewers.

e Operator responses to questions which indicated the existence of generic problems were not pursued to the point of documenting specific examples of the problem.

e Where the interviewer / recorder did write down a specific instrument or control name, the specific nature of the deficiency associated with the gevice was not well documented.

e Some specific examples of the poor recording techniques are as follows:

11

- Many " things" are labeled differently in the control room than what operators call them. The " things" were not listed.

- Many CRT displays are confusing or unnecessary. No des-cription of the problems with the displays was provided.

- - PAM panel meters are confusing or difficult to read.

. Again, no specifics were provided on which meters have the problems.

e The 1978 loss-of-feedwater event at Davis-Besse, which many believe was the precursor to the accident at TMI, did not appear to be included in the review of applicable operational events.

Since the Operating Experience Review is not listed among the require-ments of Supplement 1 to MUREG-0737, this subject and the problems identified by the NRC audit team were not pursued during the pre-implementation audit. Based on the documentation made available by TED, the NRC audit team found that the operator interviews were not fully auditable and appeared to be less than satisfactory for the potential utility of this data collection technique. A review and conclusion on the adequacy of historical documentation review could not be made during the pre-implementation audit since no LER files, etc., were made available by TED DCRDR members to the NRC audit team.

ASSESSMENT AND IMPLEMENTATION PHASE

1. Assessment of HEDs In its review of the Summary Report, the NRC staff concluded that "The methodology and criteria for assessing HEDs appear to be sound" and that "With the exception of the absence of a logic diagram which is planned for use in assigning scheduling priorities for correcting Category 1 HEDs, the information provided in the summary report demonstrates that TED possesses the knowledge and capability for assessing HEDs and meeting this requirement of Supplement I to NUREG-0737" (Reference 4, p.13). Through discussions held with TED during the pre-implementation audit, it was learned that

^

12

Category 1 HEDs (those HEDs that have been identified as documented errors) were assessed for their significance relative to plant safety. The NRC audit team concluded that the assessment of Category 1 HEDs was satisfa ctory.

TED submitted a letter, dated January 31, 1985, to the NRC which docu-mented the reprioritization of 29 HEDs which were deferred to "special studies" (Reference 5). In this letter TED states, "To help establish the schedule for the conduct cf these studies, we decided to re-examine the most safety significant HEDs to further prioritize them and thus determine which of the studies would provide the most significant benefits." TED reprior-itized those HEDs deferred to the special studies which were originally prioritized as "As" and "Bs." The original prioritization scheme, once HEDs were placed into either Categories I, II, or III based upon the judged probability of error occurrence, was to determine the priority for implemen-tation of correctioni based upon the judged potential effect the hypothe-sized errors could have upon plant safety. Based on this judgment, the following priorities were. assigned to the HEDs:

e Priority A - Prompt - first outage (fifth refueling outage over-all), given engineering lead time, availability of materials, and coordination with the Integrated Living Schedule.

e Priority B - Near term - second outage (sixth refueling outage overall), given engineering lead time, availability of materials and coordination with the Integrated Living Schedule.

I e Priority C - Long term (seventh refueling outage overall)

For example, all HEDs assigned a priority of "B" would have associated corrections implemented by the end of the sixth refueling outage regardless of HED categorization. The dates for each of the refueling outages were

, determined by TED to be as follows: fifth = Spring of 1986; sixth = Fall of

, 1987; and seventh = Spring of 1989.

TED's reprioritization of "A" and "B" HEDs was undertaken by the DCRDR team (with the exception of the human factors specialists) and each of these  ;

13 1

6

. _ _ -- -- - = . .- - . . _ . -- - -

29 HEDs was prioritized for " disposition" (i.e., resolution), not implemen-tation, using the following rankings:

e High - The hypothesized error will prevent or degrade a safety function.

e Medium - The hypothesized error will challenge a safety system or could potentially degrade a safety function.

e Low - The hypothesized error could potentially challenge a safety system.

These rankings or priorities translate to the following refueling outages for determining the disposition of HEDs: High = fifth; Medium = sixth; and Low = seventh. The results of TED's reprioritization of these 29 HEDs were that only one was determined to have high safety significance, eight HEDs were determined to have medium safety significance, and the remaining twenty HEDs were determined to have low safety significance. The one HED deter-mined to have high safety significance was divided into three sections of which one section was rated High, another Medium, and the other Low. In effect, the reprioritization downgraded the safety significance of all 29 HEDs. Functionally, the reprioritization postponed the correction implemen-tation commitments for these 29 HEDs in excess of 18 and 36 months (since only the disposition will be determined at those times, not the implemen-tation of corrections). The NRC audit team found the downgrading of the safety significance of these HEDs and the postponement of the implementation of corrections to be unsatisfactory. In addition, the lack of human factors specialist participation in this'reprioritization, particularly with respect to hypothesizing the potential human errors that could occur, was found to be unsatisfactory.

In reference to the original prioritization process and that used for the 29 HEDs, the NRC audit team discussed with TED representatives the consideration of cumulative and interactive effects in assessing the potential for human error and the significance of human error to plant cafety. TED stated that it had no systematic review or consideration of the cumulative and interactive effects of individual HEDs during HED assessment.

TE0 did cite the Steam Feedwater Rupture Control System (SFRCS) study as an 14

4 o 1 l

( instance where cumulative and interactive effects of individual HEDs upon l panel layout were considered, but this appears to be more applicable to the selection of design improvements rather than assessment.

In summary TED's original prioritization process for all HEDs was found to be acceptable except for the consideration of cumulative and interactive effects of individual HEDs. The reprioritization of 29 HEDs involved in special studies was found to be unsatisfactory because it downgraded the safety significance of these HEDs, postponed the commitment made in the Summary Report for implementing corrections, and did not involve human factors specialists. We recommend that TED should (1) perform and document a systematic review of the cumulative and interactive effects of individual HEDs; (2) review the new prioritization of the 29 HEDs using human factors specialists; (3) use human factors specialists in any further HED reprioritization; and (4) provide documentation to the NRC of the justi-fication for the reprioritization of each HED affected. Until documentation of the consideration of cumulative and interactive effects of individual HEDs and justifications for the reprioritization of each HED affected are provided, this requirement of Supplement 1 to NUREG-0737 has not been adequately addressed.

3

2. Selection of Design Improvements In its review of the Summary Report, the NRC staff found that TED "did i not describe the process or analysis it used to select design improvements to correct significant HEDs" (Reference 4, p.14). In addition, the NRC staff stated that "the licensee has opted to conduct a number of 'Special Studies' to determine the disposition of all HEDs and in January 1985. TED will provide detailed schedules for the completion of the short term actions and the special studies." Based on these facts, the NRC staff concluded that "...the scheduling information and disposition of HEDs contained in the TED summary report are not conclusive and, therefore, no judgement as to their adequacy can be made at this time" and that "...the licensee has not complied with the requirements for this element of a DCRDR and for a summary report."

l Through discussions held during the pre-implementation audit with TED, the NRC audit team learned that little progress had been made towards the l

15

1 resolution of HEDs since the submittal of the Summary Report on June 30, 1984. No systematic, rigorous process for identifying alternative 'correc-tions to HEDs and selecting final dispositions has been developed or employed. In addition, there is presently no human factors participation and expertise involved in the selection of HED dispositions with the excep-

' tion of the development of a specification for labels and location aids. A t

review of the 347 HEDs listed in the Summary Report found that approximately 50% of the HEDs have been dispositioned by TED. These HEDs have been disposed of either by correction, justification for no correction, or dele-tion. The disposition of the remaining 50% of the HEDs in the Summary Report has been deferred until a series of special studies has been completed. These special studies are the following:

e Annunciator study (31 HEDs) e Computer study (14 HEDs)

) e Controls study (23 HEDs) j e Displays study (47 HEDs) i e Engineering study (5 HEDs) e Illumination and Lighting study (5 HEDs) e Labels and Location Aids study (31 HEDs) >

e Noise study (4 HEDs) e Operations study (3 HEDs) e Steam Feedwater Line Rupture Control System (SFRCS) study (10 HEDs)

As indicated in the January 31, 1985 letter to the NRC, TED has committed to l

complete its special studies and the disposition of al1 HEDs by Spring of, 1989. During the pre-implementation audit the NRC audit team learned that only three studies are currently being pursued: Displays, Labels and Loca-tion Aids, and SFRCS. Given the long lead time TED has established in its January 31, 1985 letter to the NRC, meeting its own deadline for completion of the special studies does not seem to be a problem. However, the establishment of such a long lead time can have detrimental effects upon an integrated, timely control room upgrade program. The evaluation and selec-tion of HED dispositions across approximately five years (i.e., Summer of 1984 to Spring of 1989) for the remaining 50% of all HEDs will not allow TED to ensure that the HED dispositions selected within a special study (1) are compatible with dispositions selected before and already implemented, and l 16 i

TED

- (2) will provide the necessary correction without introducing new HEDs.

stated during the pre-implementation audit that its studies will provide for the consideration of cumulative and interactive effects of individual HEDs.

However, the consideration of cumulative and interactive effects appears to be only feasible for those HEDs associated with the same special study.

Due to the excessive amount of time TED has scheduled for completion of each of the special studies and the disposition of associated HEDs, many HED dispositions will have been selected and implemented in the control room by TED prior to knowing how the remaining HEDs will have been dispositioned and without adequate consideration of an overall integrated control room upgrade package. Overall. TED's excessive time schedule for resolving HEDs in the special studies promotes a piecemeal approach to selecting and implementing HED dispositions rather than the united, integrated approach needed to ensure HED dispositions provide the necessary corrections without introdu-cing new HEDs.

During the pre-implementation audit, the NRC audit team reviewed the available documentation on the three special studies currently being conducted; namely, the Displays study, Label and Location Aids study, and the SFRCS study. In addition to noting the current inadequate amount of human factors participation in these special studies, the NRC audit team's comments on these specific special studies were given as suggestions. The NRC audit team suggested that TED consider the following in its Label and i Location Aids study: (1) the Standard Abbreviations / Acronym list that is being developed should be applied not only to the control room labels and procedures, but also to the SPDS and other operator interfaces throughout the plant; (2) ensure that the specification being developed by TED's con- l sultant for labels and location aids is used for DCRDR-related and future operator interface modifications; (3) ensure that the labeling and location aid specification is compatible with conventions TED will establish for color coding, luminance contrast, etc.; and (4) labeling provided for newly implemented components should be verified for accuracy using background documents such as p&lDs and instrument lists. Other than recommending the active participation of human factors specialists, no suggestions were given concerning the Displays study and the SFRCS study.

The plant design change process and the HED documentation were reviewed by the NRC audit team during the pre-implementation audit. Once the 17 l

l 1

1 decision to make a design change has been made, a design change undergoes 4 the following process:

1. Development of objectives, scope, methodology, and criteria for j design change evaluation. l

2. Evaluation of options for making design change and selecting

. specific design change.

3. Initiatiation of a Facility Change Request (FCR).

4. Engineering review and approval of proposed design change.

. 5. Prioritization Subcommittee review and approval of proposed design change.

1 i 6. Procurement of funds for implementing design change.

7. Assignment of responsibilities to implement design change.

8. Implementation of design change.

At the time of the pre-implementation audit, several HEDs associated l

with the SFRCS study had entered this process and were involved in several The FCRs had been signed off by the I&C Engineer and the DCRDR

~

FCRs.

Project Administrator, who are responsible for approval of design changes coming from the DCRDR. However, as previously stated, no systematic methodology including participation of human factors specialists was used by

TED DCRDR personnel to identify and evaluate alternative corrections and i select final dispositions for engineering review.

A review of the HED documentation found that many HEDs did not have l adequate information for use in assessing and resolving the HEDs. The

descriptions of the HEDs were sometimes ambiguous, generic, or inaccurate.

The assessment and disposition of HEDs were sometimes ambiguous, contradic-tory, or missing. The reasoning behind many HED dispositions was not obvious and was not documented in most HEDs. Many of the HEDs which TED deleted should have been kept as valid HEDs with documented assessments and l-18 Y

---,----.,r.r.w_,n ., m.,- , -,------.,-n ,e ,,,,m- , .-,._--.--,,,-v.,r, m,m,c,_mm,,,,,n.-,.,--,,,m - , - ,

justifications for not taking corrective action. The HEDs in many instances

! could not be traced back to the specific discrepant components. 'In addi-tion, operator interview comments could not be traced to HEDs due not only to inadequate HED documentation but to inadequate documentation of the operator comments on the interview data collection forms. Approximately 17 HEDs were reported in the Summary Report (HEDs99-115) but were found not to have been documented or assessed on lied forms. A comparison of the HED files with the HED listing provided in Appendix C in the Summary Report found discrepancies concerni .g HED assessments and dispositions. Overall, the HED documentation wu found to be inadequate as a basis for performing the assessment, selection, and verification of design improvement activities in the DCRDR.

In addition to the overall inadequacy of the HED documentation, the NRC audit team found some proposed corrective actions and justifications for not taking corrective actions to be either unclear or inadequate for resolving i the HED. Specific comments related to these findings are provided in the Analysis of Proposed Corrective Actions and Justifications for HEDs Lef t Uncorrected section of this report.

i

! In summary. TED has made little progress toward the disposition of HEDs since the submittal of the Summary Report on June 30, 1984. Approximately 50% of the HEDs identified in the DCRDR are still unresolved and will not be

{ until the seventh refueling outage, which will occur in the Spring of 1989.

TED has not met the NUREG-0737 Supplement I requirement that the licensee ,

...shall submit a summary report of the completed review outlining proposed control room changes, including their proposed schedules for implementation" and that the Summary Report will provide "a summary justification for human engineering discrepancies with safety significance to be left uncorrected or l partially uncorrected." The NRC audit team found the following inadequacies i'n TED's approach for selecting design improvements: (1) the absence of a systematic, rigorous methodology for identifying alternative corrections to HEDs and selecting final dispositions; (2) the absence of human factors participation and expertise with the exception of the development of a i specification for labels and location aids; (3) the overly extended, piece-meal approach for disposition of the remaining HEDs; (4) inadequate HED documentation; and (5) inadequate disposition of some HEDs. TED's present approach does not meet the requirements of NUREG-0737, Supplement 1 for 19 i .

l selecting design improvements. In order for TED to meet the requirements

, successfully, it should (1) perform and document a systematic, rigorous methodology for selecting (and verifying) design improvements; (2) involve human factors specialists as active, integral members of the DCRDR team for selecting (and verifying) design improvements; (3) perform and document a l methodology that considers cumulative and interactive effects of individual HEDs upon the whole integrated control room improvement package; (4) improve HED documentation so that it is complete, unambiguous, accurate, and audit-able; and (5) develop solutions to HEDs and implementation schedules that j are agreeable to the NRC. TED should provide documentation to the NRC which details its response and approach to resolving the inadequacies that pres-ently exist and are listed above.

4 l 3. Verification That Improvements Will Provide the Necessary Corrections Without Introducing New HEDs i

In its review of the Summary Report, the NRC staff found no methodology which described how TED was going to ensure that the selected improvements provided the necessary corrections without introducing new HEDs. The NRC staff concluded that from the information provided in the Summary Report.

. . TED had not demonstrated either the understanding of this requirement or the i commitment necessary in order to meet successfully this requirement of NUREG-0737, Supplement 1.

i Through discussions held with TED representatives during the pre-implementation audit, the NRC audit team learned that no human factors

)

engineering verification of selected design improvements had been performed.

TED stated that its design change process, via FCRs, provides for the

! verification of design changes. However, this verification is an I engineering I AC review rather than a human factors engineering-oriented review. As in the case of the selection of design improvements TED has not developed and employed a systematic, rigorous methodology for verifying j selected design improvements. TED presently has not met these requirements of NUREG-0737, Supplement 1. In order to meet these requirements, TED

. should (1) develop and employ a systematic, rigorous human factors engineering-oriented methodology for verifying that the selected design

improvements provide the necessary corrections without introducing new HEDs; 1

l 20

---

,v._--.,-. - - _ , . _ _ _ . , , , _ _ , . , -

_,n-,,-,.v,,--._, ,, .- r .

I w \

1 and (2) involve human factors specialists as active, integral members of the i DCRDR team for verifying (and selecting) design improvements.

4. Coordination of the DCRDR With Other Improvement Prograins In its review of the Summary Report, the NRC staff found that "Except  !

for the description of the role the E0Ps serve in the system function review and task analysis, no other reference was made concerning the coordination and integration of the DCRDR program with other ERC initiatives" (Reference 4, p.16). The NRC staff concluded that "from the information provided by TED in the summary report, the coordination of the DCRDR with other improve-ment programs was minimal and did not demonstrate either the understanding of this requirement or the comr.itment necessary to successfully meet this requirement of Supplement 1 to NUREG-0737."

Through discussions held with TED representatives during the pre-implementation audit, the NRC audit team confirmed that minimal coordination of the DCRDR with other improvement programs had occurred. With the excep-tion of the use of the E0Ps as the basis of the SFR&TA, no evidence was

, found that any coordination had occurred. The Technical Section group of Davis-Besse, headed by the DCRDR Project Administrator, is responsible for 4

performing the emergency response capability initiatives. The fact that the DCRDR Project Administrator is responsible for the DCRDR SPDS, E0P upgrade,

, and Reg. Guide 1.97 instrumentation review is a characteristic of the Davis-

Besse organizational structure which should enhance TED's ability to coordi-nate these initiatives adequately. In addition, several operations and I&C

personnel involved in the DCRDR are also involved in the SPDS, E0P upgrade and Reg. Guide 1.97 instrumentation review. However, a systematic approach has not 5een established to coordinate these initiatives and integrate the resulting changes into each other or into training, which would take advantage of the Davis-Besse organizational structure. The lack of coordi-nation and integration in these improvement programs became obvious during the pre-implementation audit when the NRC audit team learned that new instrumentation had been added to the control room since the DCRDR review

phase without any human factors consideration or review given.

1 In summary, Davis-Besse's organizational structure as discussed above should enhance TED's ability to coordinate improvement programs adequately.

4 21

However, TED should perform and document a formal program which ensures that the individual improvement programs receive the fullest possible benefit from the other improvement programs. TED should maintain auditable documen-tation in the form of plans, procedures, and results which ensures adequate coordination and integration of the DCRDR with training, SPDS, E0Ps, and '

Reg. Guide 1.97 instrumentation. Until documentation is provided by TED which demonstrates adequate coordination and integration of these improve-ment programs, this requirement of NUREG-0737, Supplement 1 will not have been met.

ANALYSIS OF PROPOSED CORRECTIVE ACTIONS AND JUSTIFICATIONS FOR HEDs LEFT UNCORRECTED As previously stated, approximately 50% of the 347 HEDs reported in Appendix C of the Summary Report have been deferred to the yet-to-be-completed special studies. The January 31, 1985 letter from TED to the NRC has established a deadline for TED to determine dispositions for all HEDs by the seventh refueling outage occurring in the Spring of 1989. The remaining 50% are those HEDs for which TED has proposed corrective actions, justifica-tions for not taking corrective actions, or deletions. As stated in the Selection of Design Improvements section of this report, some of the dele-tions were found to be valid HEDs for which TED should have developed justifications for not taking corrective actions rather than deleting them.

The HEDs referred to do not include HEDs that were deleted because they were redundant with other HEDs.

. In t. review of the HED documentation during the pre-implementation audit, the NRC audit team found inconsistencies between the HEDs described in the Summary Report and the information presented on the individual HED forms. There were inconsistencies in several HED assessments and in numer-ous HED descriptions and proposed dispositions. Therefore, the review of the HEDs described in the Summary Report will need to be repeated. Until TED has dispositioned all HEDs and documented the HEDs, assessments, and dispositions in enough detail to be audited, final review and decisions by NRC concerning the adequacy of TED's disposition of HEDs should be post-poned. TED should provide detailed justifications for deleting HEDs or leaving them uncorrected and should address relevant operational and behavioral factors. TED's current schedule towards resolving HEDs postpones 22

a final HED review until at least the Spring of 1989. We believe this schedule creates an unacceptable delay of a final HED review.

In order to provide TED with feedback regarding the type of HED review that will be performed and the detail of the HED information needed to perform the review, examples of HED reviews are provided below. The example reviews include HEDs that were not described in enough detail to allow a review to be performed. HEDs for which the proposed corrective actions were not satisfactory, and HEDs for which justifications for HEDs left uncorrected were proposed but were found to be unsatisfactory.

1. Proposed Corrective Actions

a. The description of the proposed corrective action is too brief, general, or ambiguous to allow an adequate evaluation. More information is needed regarding the discrepancy and/or the proposed corrective action.

P.1.6-6 (p. C-5 of the Summary Report) - The discrepancy is described as merely " signal discriminability." The proposed review disposition states "FCR in place to add annunc. for fire alarm. PNL C5731." The description of the discrepancy is too brief, and the proposed review disposition does not state how the added annunciator for fire alarm resolves the signal discrimin-ability problem.

P.1.7-1 (p. C-6) - The discrepancy is that recorder supplies and fuses are not stored in the control room. The proposed review l disposition is " review rules for changing bulbs & etc. with ops. & I I&C to make suppites available to operators CR." The proposed review disposition is not a resolution but an action item. TED needs to state the resolution of tnis HED.

P.1.7-3 (p. C-6) - The discrepancy is that " tools needed to change bulbs that are not available in the control room." The proposed review disposition is that the tool is available and this HED is not a problem. TED's proposed review disposition seems to 4 contradict the HED. Either the author of the HED did not 23 3

adequately survey the control room for' this item or the HED author i

felt that the tool TED says is available was not suitable for l

changing bulbf,. TED should provide an explanation of how this tool is suitat.ly designed for changing bulbs.

I

b. Proposed corrective action only partially corrects the discrepancy P.2.1-2 (p. C-8) - The discrepancy described in this finding is

- that the Gaitronix cords are located in traf fic paths. The proposed review disposition is to replace periodically the cords as nec'essary. However, the issue is twofold: (1) the cords may be damaged due to excessive trampling or contact; and (2) they may present an obstacle in the traffic flow. The HED disposition addresses the first aspect of the discrepancy, but doe's not resolve the second aspect of the problem.

l

c. Proposed corrective action does not corr et the discrepancy P.9.2-37 (p. C-37) - The discrepancy is that some displays are not readable to the required accuracy. The proposed review disposi-tion is to revise the " procedure to allow for instrument error."

Such corrective action would leave the discrepancy uncorrected.

If an analysis of tasks has determined that the displays must be read at a level of accuracy that the display designs do not allow, revising the procedure which addresses these tasks and displays will not change the actual task requirement for display design or the display design itself. Revising a procedure does not resolve an unsuitable display design. We believe that this type of compensation or resolution of discrepancies (changing the procedure to fit the design) is generally.not an acceptable means of correcting HEDs.

2. Justifications For HEDs left Uncorrected

a. The justification (or HED description, component description, etc.)

is too brief, general, ambiguous, or does not sufficiently address the discrepancy to allow an adequate evaluation to be e.ade.

24

.- - - .. . - - _ . . .- - __ _, - -~ - _ _ _ _ .-

P.2.1-4 (p. C-8) - The discrepancy is that the loudness of the ringing is not adjustable at the individual telephones. The review disposition is that it is "not a problem, no action." This justification is not adequate because it does not explain why the

HED is not a problem.

P.3.1-31 (p. C-13) - The discrepancy is that the turbine-generator system first out annunciator panel is not located above the turbine panel. 'The proposed review disposition is that the " panel is accessible if operators need to get to it." The discrepancy does not describe where the turbine-generator system first out annunciator panel is with respect to the turbine panel, and the

, justification does not elaborate on how it is accessible and why this is satisfactory for operator performance.

P.9.2-46 (p C-38) - The discrepancy is that there is excessive operator workload (simultaneous tasks). The ' proposed review dis-position is that adequate task performance was verified during walk-throughs of procedures. TED needs to provide detailed ,,

information in its justification which addresses operational and t behavioral factors.

b. The HED has been deleted although it is a valid human engineering discrepancy. The HED should remain in the valid, active HED file, and  ;

justification for leaving the HED uncorrected should be provided.

P.5.1-8 (p. C-22) - The discrepancy is that the logarithmic scale used should be linear. The proposed review disposition is that it is not a problem and is deleted. TED should not delete this HED simply because it has determined that fixing the scale is not feasible. TED should provide a justification for leaving this HED uncorrected that is based on operational / behavioral factors.

c. The justification contradicts the HED identified 4

/

P.2.1-8 (p. C-8) - The discrepancy is that operators have

" problems" communicating on phone handsets while wearing protective equipment. The proposed review disposition indicates 25

. l that this is not a problem and that operations verified that one can communicate. Such a finding and disposition are contradic-tory. TED should clarify the actual situation in operational /

behavioral terms.

P.3.1-3 (p. C-10) - The discrepancy is that the annunciator panel labels are not easy to read from the primary operating area. The justification, however, indicates that this is not a problem heause the a.inunciator satisfies the guidelines. If this HED has I

been identified or referenced to NUREG-0700, the justification appears contradictory. TED should better explain the justifica-tion.

P.6.1-6 (p. C-27) - The discrepancy is that the symbols are not a commonly accepted configuration. The justification argues that there are no uncommon symbols on panel. TED should provide a detailed description of these symbols and an explanation why this HED has been identified if the justification is accurate.

d. The justification is not adequate P.2.1-9 (p. C-9) - The discrepancy is that the annunciator alarm

) is nondirectional. The proposed review disposition is that the i error assessment is low due to the size of the control room. This justification needs to cite, in detail, the operational and ,

behavioral factors involved in determining the error assessment to l be low and to justify why this HED should be left uncorrected. l l

P.9.2-13 (p. C-35) - The discrepancy is that there is inadequate control / display capability (dilution pump speed control / display) I to accomplish the task walked through in the V&V activity. The ,

proposed review disposition is that it is not a problem and that a local control is available. TED's justification does not appear  ;

to be adequate since this HED was identified relative to a control )

room function in the V&V, emergency task walk-throughs. l l

P.9.2-93 (p. C-42) - The discrepancy is that there is inadequate information concerning .the Reactor and the incore TC trend 26

( recorder. The proposed review disposition is that such informa- I tion is available on the SPDS. Justifying the availability of needed information on the SPDS is not satisfactory because the SPDS is not qualified, IE equipment. A hardwired, qualified backup display of this information is necessary in case of SPDS failure.

CONCLUSIONS AND RECOIMENDATIONS l

Minimal progress or effort has been made or expended on the DCRDR since submittal of the Summary Report on June 30, 1984. At a point nine months after submission of the Summary Report, the Davis-Besse DCRDR is at a level of detail and state of completeness equivalent to most other licensees' DCRDRs at the point when the NRC conducts in-progress audits. Based on TED's schedule for determination of dispositions for all HEDs by the Spring of 1989, implementation of most HED corrections will apparently not occur until some time in,the 1990s. Although changes or FCRs have to mpete with other projects for funding within 1TD's Integrated Living Schedule, we believe that TED has not placed an appropriate emphasis upon the timely and satisfactory conduct of its DCRDR. This lack of emphasis is evident not only in the excessive time schedule and slow rate of progress for the special studies, but in TED's near-exclusion of human factors expertise from the DCRDR since submittal of the Summary Report. With the exception of the development' of a labeling and location aids specification, no human factors

assistance has been obtained during the time between the Summary Report submittal and the pre-implementation audit. The NRC requires that a multi-disciplinary team including persons with human factors expertise remain j intact until the DCRDR is completed. This multidisciplinary DCRDR team I

should be involved in studies that relate to the DCRDR. Presently, some planned control room modifications and studies do not appear to be coordi-nated with or under the cognizance of the DCRDR team. These include (1)a nuisance alarm study; (2) a plan to replace all miniature PAM panel meters; and (3) removal from service of broken or unnecessary annunciator tiles.

Because of a lack of rigorous recording techniques to date, the remaining special studies programs will require the repetition of detailed work. It is strongly suggested that the special studies projects employ personnel capable of understanding technical deficiencies and recording same 27 l

l L ___ _. _ . __ ___ _ _ _

in a retrievable manner. Between now and the commencement of the special studies, an ef fort should be undertaken to better collate, correlate and cross-reference the hard data contained in existing DCRDR records.

In addition to these general comments, the following is a list of the activities, areas of improvement, and documentation that TED should satis-factorily perform in order to meet the NUREG-0737, Supplement I requirements  :

for a DCRDR: '

1. Qualifications and structure of the DCRDR Team o Include human factors specialists as integral, active members of the DCRDR team for the activities that remain to be completed.

, e Document the responsibilities and levels of involvement of the human factors specialists and all other disciplines in each of the special studies -and the selection and verification of design improvements.

2. Function and Task Analysis e Analyze operator tasks, information and control requirements, and required characteristics of instruments and controls necessary to monitor and assess the various challenges and failure modes of the Radioactivity Release critical safety function.

e Comprehensively analyze information and control requirements and required characteristics of instruments and controls for Steam Generator Tube Rupture. ,

o Analyze required characteristics of instruments and controls for all emergency operator tasks.

3. Comparison of Display and Control Requirements With a Control Room Inventory a Verify equipment availability and human engineering suitability for the requirements that are developed from the three activities listed under Function and Task Analysis.

28

4. Control Room Survey e Evaluate the human engineering adequacy of the new components added to the control room since the survey was performed.

e Review, assess, and resolve the antiunciator system flash patterns.

5. Assessment of HEDs e Perform and document a systematic review of the cumulative and interactive effects of individual HEDs.

e Review, document, and justify the new prioritization of the 29 HEDs using human factors specialists.

6. Selection of Design Improvements e Carry out and document a systematic process of selecting design improvements.

e Ensure cumulative and interactive effects of individual HEDs upon the whole integrated control room improvement package are considered.

e Improve HED documentation for completeness, clarity, accuracy, and auditability.

e Develop solutions to HEDs and implementation schedules that are agreeable to the NRC.

l 7.4 3. Verification that Improvements Will Provide the Necessary Corrections Without Introducing New HEDs e Perform and document a systematic, rigorous methodology for verifying design improvements.

29

l a

9. Coordination of the DCRDR With Other Improvement Programs e Perform and document plans, procedures, and results of a formal )

program which ensures adequate coordination and integration of the )

DCRDR with training, SPDS, E0Ps, and Reg. Guide 1.97 instrumenta- ,

tion. l

. In addition to these activities, there are several areas which we recommend that TED improve upon. The following recommendations are not intended as additional requirements but to encourage the fullest possible benefit of the DCRDR: I e Validate the control room for operator tasks included in the scenarios used for performing the Radioactivity Release critical safety function, o Apply standards, specifications, and conventions to all plant operator interfaces, including the control room, procedures, SPDS, remote shutdown panel, and other local plant interfaces.

e Review the human engineering suitability of the remote shutdown panel not only from the static standpoint provided by the survey checklists but also from a dynamic standpoint provided by the task analysis and V&V.

o Review and ensure the completeness of the historical documentation review including plant-specific LERs and relevant industry-wide LERs.

e Review and ensure that operator interview comments for identifying deficiencies and improving the control room have been documented in HEDs.

e Develop and maintain plans, criteria, and procedures for an ongoing human engineering review of proposed post-DCRDR changes to the control room, remote shutdown panel, and other plant operator inter-faces.

30

We recommend that TED be asked to submit a supplemental. Summary Report which documents as a minimum the performance of the activities listed in items 1-9 above. The descriptions, assessments, dispositions, and implemen-tation schedules of HEDs should be in enough detail to allow an evaluation by the NRC to be performed (see examples provided in the Analysis of Pro-posed Corrective Actions and Justifications for HEDs Left Uncorrected sec-tion of this report). TED's present schedule for completion, as established in its January 31, 1985 letter, delays the submittal of a supplemental Summary Report until approximately mid to late 1989. We suggest that NRC and TED negotiate a schedule for a more timely completion of the DCRDR and submittal of a supplemental Summary Report.

31

REFERENCES

1. " Detailed Control Room Design Review for the Davis-Besse Nuclear Power Plant" Summary Report, attachment to letter from R.P. Crouse TED, to J.F. Stolz, NRC, dated June 29, 1984.

2. " Detailed Control Room Design Review Program Plan for Davis-Besse Nuclear Power Plant," attachment to letter from R.P. Crouse, TED, to J.F. Stolz, NRC, dated June 15, 1983.

3. "NRC Review Comments on Davis-Besse's DCRDR Program Plan," attachment to memorandum from W.T. Russell, NRC, to G.C. Lainas, NRC, dated October 7, 1983.

4. " Human Factors Engineering Branch Detailed Control Room Design Review Safety Evaluation for Davis-Besse Nuclear Power Station. Unit No. 1,"

attachment to memorandum from W.T. Russell, USNRC, to G.C. Lainas, USNRC, not dated.

5. " Supplement 1 to NUREG-0737 Detailed Control Room Design Review Implementation Schedule." attachment to letter from R.P. Crouse, TED, to J.F. Stolz, USNRC, dated January 31, 1985.

6.

~

NUREG-0660, Vol.1 "NRC Action Plan Developed as a Result of the TMI-2 Accident," USNRC, Washington, D.C., May 1980; Rev.1. August 1980.

7. NUREG-0737, " Requirements for Emergency Response Capability," USNRC, Washington, D.C., November 1980.

8. NUREG-0737 Supplement 1, " Requirements for Emergency Response Capability," USNRC, Washington, D.C., December 1982, transmitted to reactor licensees via Generic Letter 82-33, December 17, 1982.

9. NUREG-0700, " Guidelines for Control Room Design Reviews," USNRC, Washington, D.C., September 1981.

32

( 10. NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants " Section 18.1, Rev. O, USNRC, Washington, D.C., September 1984.

b Davis-Besse TAC No. 51154 SAIC/1-262-07-557-16 NRC-03-82-096 33

t APPENDIX Attendees of the Meetings Held During the Pre-Implementation Audit of the Davis-Besse Nuclear Power Station DCRDR

, TED Representatives Stan Batch TED T.P. Beeler TED J.C. Buck TED Mike Derivan TED Allen Elliff Essex John Farbry Essex .

Jacque Lingenfelter TED Sati Mitra Impell Barbara Paramore Essex L.C. Stalter TED David Stephenson TED USNRC Representatives P

Gary Bethke Comex Bruce Burgess NRC Al DeAgazio NRC Don Kosloff MRC Joe Moyer SAIC Tim D'Donoghue SAIC Ray Ramirez NRC 34

,c. .

Mr. R. P.-Crouse Davis-Besse Nuclear Power Station Toledo Edison Company Unit No.1 CC:

Donald H. Hauser, Esq. Ohio Department of Health The Cleveland Electric ATTN: Padiological Health Illuminating Company Program Director P. O. Box 5000 P. O. Box 118 Cleveland, Ohio 44101 Columbus, Ohio 43216 Mr. Robert F. Peters Attorney General Manager, Nuclear Licensing Department of Attorney Toledo Edison Company General Edison Plaza 30 East Broad Street 300 Madison Avenue Columbus, Ohio 43215 Toledo, Ohio 43652 ,

Gerald Charnoff, Esq. Division of Power Generation Shaw, Pittman, Potts Ohio Department of Industrial Relations and Trowbridge 2323 West 5th Avenue 1800 M Street, N.W. P. O. Box 825 Washington, D.C. 20036 Columbus, Ohio 43216 Paul M. Smart, Esq. Mr. Harold Kahn, Staff Scientist Fuller & Henry Power Siting Commission 300 Madison Avenue 361 East Broad Street P. O. Box 2088 Columbus, Ohio 43216 Toledo, Ohio 43603 Mr. Robert 8. Borsum President, Board of '

Babcock & Wilcox Ottawa County Nuclear Power Generation Port Clinton, Ohio 43452 Division Suite 200, 7910 Woodmont Avenue Bethesda, Maryland 20814 Resident Inspecter U.S. Nuclear Regulatory Commission 5503 N. State Route 2 Oak Harbor, Ohio 43449 Regional Administrator, Region III U.S. Nuclear Regulatory Commission 799 Roosevelt Road Glen Ellyn, Illinois 60137

.