ML20134P167
| ML20134P167 | |
| Person / Time | |
|---|---|
| Site: | Crystal River  |
| Issue date: | 08/29/1985 |
| From: | SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY |
| To: | NRC |
| Shared Package | |
| ML20134P171 | List: |
| References | |
| CON-NRC-03-82-096, CON-NRC-3-82-96 NUDOCS 8509060165 | |
| Download: ML20134P167 (34) | |
Text
F o
EVALUATION OF THE DETAILEO CONTROL ROOM DESIGN REVIEW
SUMMARY
REPORT FOR CRYSTAL RIVER UNIT 3 GENERATING STATION August 29. 1985 Prepared for:
s U.S. Nuclear Regulatory Comission Washington, D.C. 20555 Contract NRC-03-82-096 0
Prepared by:
Science Applications International Corporation 1710 Goodridge Drive McLean. Virginia 22102 8 5 $ % fo G /(s 6 &
FOREWORC This Evaluation Report was prepared by Science Applications Interna-tional Corporation (SAIC) under contract NRC-03-82-096 Technical Assistance in Support of NRC Licensing Actions:
Program !!!. The evaluation was performed in support of the Division of Human Factors Safety. Human Facters Engineering Branch (HFEB). HFE8 previously evaluated Florida Power Corpora-tion's (FPC) Program Plan for conducting a Detailed Control Room Design Review (DCRDR) for its Crystal River Unit 3 (CR3) Generating Station. The Nuclear Regulatory Commission's comments on that Program _ Plan were forwarded to FPC on January 27, 1984.
Responses to the NRC's comments were provided to the NRC by the licensee in a rejoinder dated March 27, 1984. An in-progress audit was conducted at the plant on February 11-15, 1985. The NRC issued an In-Progress Audit Report on April 5,1985 which was transmitted to i
FPC. FPC submitted a DCRDR Summary Report for CR3 on June 17, 1985.
This report includes the SAIC evaluation of the Detailed Control Room Design Review Summary Report. Information provided at the in-progress audit and the previously submitted Program Plan and rejoinder also were considered in preparing this evaluation.
\\
i 9
i 2
I l
~
TABLE OF CONTENTS Section Page BACKGROUND.............................
1 PL AN N I N G PH AS E......................... I '.
3 1.
Preparation and Submission of a Program Plan 3
2.
Establishment of a Qualified Mult1 disciplinary Review Team.......................
3 REV I EW PH AS E............................
5 1.
Review of Operating Experience 5
2.
Control Room Su rv ey....................
6 3.
System Function and Task Analysis.............
7 4.
A Comparison of Display and Control Requirements with a Control Room Inventory..............
10 5.
Validation of Control Room Functions 12 ASSESSMENT AND IMPLEMENTATION 13 1.
HED Assessment Methodology 13 2.
Selection of Design Improvements.............
15 3.
Verification That Selected Improvements Will Provide the Necessary Correction and Verification That Improvements Will Not Introduce New HEDs 16 4.
Coordination of Control Room Improvements With Changes Resulting from Other Improvement Programs....
17
~
ANALYSIS OF PROPOSED CORRECTIVE ACTIONS AND JUSTIFICATIONS FOR HEDS LEFT UNCORRECTED 18 1.
Proposed Corrective Actions................
19 2.
Justifications for HEDs Left Uncorrected 20 CONCLUS!0NS AND RECOMMENDATIONS 21 R E FE RE N C E S.............................
26 APPENDIX A.............................
28' APPENDIX B.............................
29 APPENDIX C.............................
30 APPENDIX D.............................
31 l
l l
i f
I EVALUATION OF THE i
DETAILED CONTROL ROOM DESIGN REVIEW l
SUMARY REPORT FOR CRYSTAL RIVER UNIT 3 GENERATING STATION l
This report documents the Science Applications International Corpora-l tion (SAIC) evaluation of the Summary Report of the Detailed Control Room j
{
Design Review (DCRDR) submitted to the Nuclear Regulatory Commission (NRC) i by Florida Power Corporation (FPC) for Crystal River Unit 3 Generating Station (CR3) on June 17, 1985 (Reference 1).
This evaluation also f
considers information obtained from the previously submitted Program Plan l
(Reference 2) which was evaluated by SAIC (Reference 3) and a rejoinder f
j (Reference 4) prepared by the licensee to respond to the NRC's comments f
regarding its Program Plan.
Additional information relevant to the DCRDR I
was obtained during an in-progress audit (Reference 5) held on February 11-
- 15. 1985. Documented findings from this audit also were considered in assessing FPC's Sumary Report (Reference 6).
Results of the SAIC evaluation follow a brief overview of the i
background leading up to preparation and submission of the Summary Report by f
I l
the licensee.
s j
~
N BACKGROUND Licensees and applicants for operating licenses are required to conduct j
a Detailed Control Room Design Review. The objective of the review is to l
[
... improve the ybility of nuclear power plant control room operators to f
prevent accidents or cope with accidents if they occur by improving the information provided to them" (NUREG-0660. Ites I.D.1) (Reference 7). The l
f need to conduct a DCRDR was confirmed in NUREG-0737 (Reference 8), and the
[
requirements to be met in such a review were contained in Supplement I to l
NUREG-0737 (Reference 9). Guidelines for conducting a DCRDR are provided in NUREG-0700 (Reference 10), while NUREG-0800 (Reference 11) presents the evaluation criteria for use by the NRC.
l The DCRDR requirements as stated in Supplement I to NUREG-0737 can be j
summarized in terms of nine specific issues, a list'of which provides a l
}
l i
l 1
7 e
I
i l
convenient outline of the areas covered in this technical evaluation.
The
{
l nine issues include:
[
i 1.
Establishment of a qualified mustidisciplinary review team.
4 ii 2.
Use of function and task analyses to identify control room operator tasks and information and control requirements during emergency operations.
3.
A comparison of display and control requirements with a control room inventory.
4.
A control room survey to identify deviations from accepted human factors principles.
i 5.
Assessment of human engineering discrepancies (HEDs) to determine j
2 which HEDs are significant and should be corrected.
6.
Selection of design improvements that will correct these discrepancies.
7.
Verification that selected design improvements will provide the necessary correction.
8.
Verification that improvements can be introduced in the control room without creating any unacceptable human engineering I
discregancies..
9.
Coordination of control room. improvements with changes resulting from other improvement programs such as SPDS. operator training.
new instrumentation (Reg. Guide 1.97 Rev. 2), and upgraded e
i emergency operating procedures.
l A DCRDR is to be conducted according to the licensee's own Program Plan l
(which must be submitted to NRC); according to NUREG-0700, it should address j
the previously stated requirements and be conducted in accordance with the l
following four phases: (1) planning. (2) review. (3) assessment, and (4) l reporting. The product of the last phase is a Summary Report Erhich must l
1 2
i J
include an outline of proposed control room changes, their proposed schedules for implementation, and summary justification of human engineering i
discrepancies with safety significance to be left uncorrected or partially corrected. Upon receipt of the licensee's Summary Report and prior to implementation of proposed changes, the NRC must prepare a Safety Evaluation Report (SER), indicating the acceptability of the DCRDR (not just the 4
Summary Report). The NRC's evaluation encompasses all documentation as well as briefings, discussions, and audits if any were conducted.
i PLANNING PHASE 1.
Preparation and Submission of a Program Plan The NRC staff reviewed Florida Power Corporation's Detatted Control Room Design Review Program Plan submitted for Crystal River Unit 3 i
Generating Station. The NRC's comments on the Program Plan were forwarded to FPC by letter dated January 27, 1984. Responses to the NRC's comments were submitted by the licensee in a "ninetetn page rejoinder dated March 27, 1984.
Review of both docurents led to the decision to conduct an in-i progress audit at the plant on February 11-15, 1985, the purpose of which i
was to compare the organization, process, and results of the Crystal River DCRDR with the DCRDR requirements of Supplement I to NUREG-D737.
With the exception of the survey and HED assessment portions of the f
DCRDR the FPC Summary Report follows the FPC Program Plan. Deviations from l
the Program Plan in the survey portion of the Summary Report can be traced j
~
to FPC's use of NUTAC guidelines as well as NUREG-D7DD guidelines.
Deviations from the Program Plan in the HED assessment portion of the I
Summary Report are due to an apparent change in methodology. These points are more fully discussed in this report.
2.
Establishment of a Qualified Multidisciplinary Review Team i
t f
Both the Summary Report and the Program Plan for Crystal River included
[
a description of the staffing and management that were established to l
conduct the Control Room Design Review. The structure and management of the l
DCRDR oppeared to be flexible enough to permit a multidisciplinary effort.
l General Physics Corporation (GP) assisted FPC in accomplishment of the j
t f
l I
The lines of responsibility between the DCRDR Director (Project DCRDR.
Manager) and upper management, and between the DCRDR Director, the GP Project Director, and GP Project Manager appeared to facilitate the communication and coordination of project information throughout the hierarchy. The DCRDR Project Manager was responsible for repErting the results of the review to upper management and for coordinating the DCRDR activities and other Dnergency Response Capability (ERC) initiatives.
All review team members reported directly to the Project Manager.
An orientation program was provided to DCRDR team members to promote a j
basic understanding of the DCRDR process. The DCRDR team itself, consisted of a group of professionals from FPC and GP with a wide range of skills necessary for the performance of the DCRDR. Task assignments and levels of effort of the review team members were described in FPC's March 27, 1984 i
submittal. Although the structure of the review team varied for different project activities, the staffing appeared to reflect the demands of the technical tasks and the resources needed by the team. Expertise of the team included:
e plant operations e nuclear /sys.tems engineering e instrumentati n'and controls engineering e human factors engineering.
l t
Based on the audit team's review of staff resumes. it was determined that the necessary disciplines were represented in all DCRDR team activities. In addition to representatives from the above disciplines, this core group was supplemented, as required, with specialists from other fields, such as electrical engineering, mechanical engineering, and industrial / organizational psychology. The qualifications of all review team members appear to agree with those specified in NUREG-D800 (Para. 2.1.2).
i In summary, we believe FPC has met the requirement of establishing a j
qualified multidisciplinary review team.
i t
4 l
l
h I
f I
REVIEW PHASE I
FPC's review phase plans and activities included:
1.
Operating experience review l
2.
Control room survey 3.
System function review and task analysis 4.
Verification of task performance i
5.
Validation of control room functions 6.
HED documentation.
i i
The above activities are those recommended by NUREG-0700 guidelines as l
contributing to the review phase objectives. Activities 2. 3, 4. and 6
(
contribute to the accomplishment of specific DCRDR requirements contained in Supplement 1 to NUREG-0737.
Activity 1 is recommended by NUREG-0700 guidelines.
1.
Review of Operating Experience A review of operating experience is not explicitly required by NUREG-0737. Supplement 1.
However. it is an activity recommended by NUREG-0700 as contributing to the' accomplishment of ;eview phase objectives.
l
)
FPC conducted a two-part operating experience review at Crystal River.
l The first part of the effort, the historical document review. included a f
l review and analysis of the operating history of the plant to identify and i
document humantengineering observations associated with operating events.
I The second part of the review, the operator survey, included the conduct of l
an operator survey and interviews with operators to obtain feedback based on
(
previous operating experience.
l l
i To accomplish the historical document review. Licensee Event Reports i
(LERs) from 1977-1983 and Unplanned Operating Event Reports (UDERs) from f
1977-1982 were reviewed and analyzed to determine operator actions that
[
l caused or resulted from the event.
Operator corrective actions which were
{
proposed or made in the control room to reduce the probability of recurrence i
of the event were verified. Human engineering discrepancies which were
{
unresolved as a result of these actions or created by modifications to the j
5 i
e
~
i operator-control board interface were identified and documented. Seven HEOs were identified as a result of the review.
The Crystal River operator survey effort entailed preparation of an operator q'uestionnaire containing questions of the type suggested by NUREG-0700.
The questionnaire was distributed to operations personnel.
Fifteen questionnaires were completed and returned for analysis.
Approximately 50%
of the operations personnel (19 persons) then were interviewed to obtain first-hand data on plant-specific human factors issues.
Interviewees included licensed reactor operators, senior reactor operators shif t technical advisors, and supervisors, each representing varying levels of expertise.
Survey results were examined in light af NUREG-0700 human engineering guidelines to identify potential HE0s.
Additionally, operating l
problems and control room procedures were identified as areas to be j
investigated during subsequent DCRDR phases.
These activities resulted in the identification of 44 HEOs.
i Overall it appears that FPC's operating experience review at Crystal j
River was conducted appropriately. Consistent with NUREG-0700 objectives and guidelines, questionnaires and interviews were administered to and conducted with a range of operating personnel.
Although there is no indication that industry-wide reports were reviewed, plant-specific documents were systematically examined. Fifty-one HEOs were identified as a result of the operating experience review.
2.
Control Room Survey i
I The licensee's control room survey was conducted by operations and i
human factors personnel to ascertain whether the control room design met the l
human engineering guidelines presented in NUREG-0700 Section 6.
FPC's j
survey relied on a checklist approach and considered the general areas j
covered in NUREG-0700 Section 6 including control room workspace.
communications, controls, and annunciator warning systems, etc.
Environ-mental measurements (illuminance, temperature, humidity etc.) were taken to
[
evaluate associated guidelines.
The full-scale mock-up of the CR3 control room was used during the survey to supplement work performed in the control l
room.
l a
l l
As documented in the Summary Report, the survey used criteria taken directly from NUREG-0700.
However, review of the survey by the audit team i
indicated that some of the INPO MUTAC guidelines were also incorporated into f
the Section 6 guidelines.
FPC has not indicated which, if any, NUREG-0700 l
checklist items were not applied or were superseded by NUTAC critiria.
i In conducting the survey, guidelines were addressed on either a control room-wide or component level basis. The Remote Shutdown panel was included in the survey effort.
Survey results were recorded on human engineering observation forms. FPC stated that the results from previously conducted human factors reviews implemented at Crystal River (i.e., FPC/
INPO Pilot and Essex Study) were compared with the DCRDR control room survey results. The comparison was found favorable.
Based on information provided in both the Program Plan and Summary Report and at the in-progress audit, it appears that the overall conduct of l
the survey was adequate and well implemented. However, consistent with the audit team recommendation, the lic'ensee heeds to identify any NUREG-0700 criteria which were omitted from the survey process. Justifications for these exclusions should be provided. This is particularly important in that many of the identified HEOs which are to be left uncorrected deviate from NUREG-0700 guidelines.
This may be the result of extensive use of s
subjective guideline,s such as those in INP0 NUTAC rather than use of more objective guidelines such as those suggested in NUREG-0700. Untti the licensee is able to document and justify exclusions and/or deviations from NUREG-0700, the staff cannot fully evaluate the licensee's control room survey effort.
I 3.
Systems Function Review and Task Analysis
~
l The NRC issued an In-Progress Audit Report (Reference 5) following an on site audit of the CR3 nuclear facility. That report dercribed in detati the findings of the audit team and specifically the level of completion of the SFTA. This report evaluates the additional information provided in the FPC Summary Report (Reference 1) and its transmittal letter (Reference 12).
The' following concerns of the NRC audit team were not satisfied during the in-progress audit:
7
?
f i
l j
1.
The process used to identify parameters and other information and i
control needs that are not provided in the ATOGs or are different from those specified in the ATOGs was not described.
l 2.
The methods used to determine the char acteristics (e.g., units, range, accuracy, type of control / display) of the needed instrumentation was not described or documented.
1 3.
The differences, if any, between the task analysis approach used during development of the plant-specific Emergency Procedures (EPs) and Abnormal Procedures (APs) and the task analysis used during the l
DCRDR process were not identified or evaluated.
t l
I 4.
The scope of the emergency scenarios selected by FPC excluded some j
f' of the EPs and APs and Verification Procedures (VPs) which contained significant numbers of operator emergency tasks.
FPC has not resolved any of the four concerns with their Summary Report (Reference 1). The first of the four concerns derives primarily from an absence of discussion about processes and methodologies which FPC may have f
used during their table-top analysis. It is not clear what documents FPC
~
may have used to determine the plant-specific entries in the pre-fill forms (Figure 4 of Reference 1), or how it may have used those documents. The second of the four concerns also stems from an absence of discussion about what methods were used to determine the characteristics of the needed l
instrumentation;and controls / displays.
Again, the Figure 4 of Reference 1 I
does not describe the process; it merely shows the result in outline form.
The third concern described above si'ailarly was not discussed in the Summary Report.
Despite the absence of documentation of the first three concerns, the process described during the audit appeared satisfactory to the audit team.
With regard to the scope of the emergency scenarios selected by FPC, it is clear that the additional EPs. APs and VPs enumerated in the NRC in-progress audit report were not completed by FPC at the time the Summary Report was written. The submittal letter, dated June 17, 1985, from FPC to NRR (Reference 12), indicated that FPC intends to develop scenarios to 1
.,. _ ~ - _ _. - - _.. - -.. -. -.... -. _ _ _ _.. - _ - _. - - - -..._....._._ __ _ __.I
,_~
L supplement the verification and validation portion of the DCRDR.
However.
FPC did not indicate whether it intended to use the additional scenarios to supplement the SFTA portion of the DCRDR.
Until FPC subjects the following scenarios to the entire SFTA process, this portion of the DCRDR will remain
~
an open issue:
1.
Response to challenge to containment.
2.
Response to the release of fission products outside containment (e.g.. to auxiliary building).
3.
Response to multiple equipment failures or operator errors (see Section 7.1 of MUREG-0737. Supplement 1).
4.
Response to major loss of electrical distribution (such as Station Blackout).
There is an additional concern with the scope of the emergency scenarios which FPC has selected. Excerpts from pages 20 and 21 of the FPC Summary Report illustrate this concern.
On page 20. FPC states that. 'The intent of the task analysis was to adequately sample emergency-related operator tasks." 0,n page 21. FPC states that "This set of procedures steps through either wholly g in, part tasks combined in the EPs and VPs and ma.ior n
emergency-related APs including radiological response decay heat removal.
(
l emergency feedwater actuation, natural circulation and loss of containment i ntegri ty."
It was clear from the in-progress audit, and it is also clear j
f
(
from the Summary Repor.t. that FPC has not covered all operator emergency l
tasks as required by Supplement 1 of NUREG-0737, but intends to " sample"
~
either " wholly or in part" tasks in the E0Ps. Thus, the scope falls short j
of satisfying the requirements for a DCRDR.
In conclusion, it is evident that some portions of the function and
[
l l
task analysis were well performed; however, other portions were not well f
documented and the scope is not complete. Therefore, the SFTA portion of i
the DCRDR remains an open ites. In order to complete the SFTA successfully, j
FPC should:
I t
+
I i
l
'1.
Expand the scope of the E0Ps (EPs, APs, and VPs) so that all operator tasks specified in the CR3 E0Ps (EPs, APs, and portions of j
VPs) are subjecteci to the SFTA and V&V process.
This should include the following procedures which, up to this time, do not j
a,ppear to be complete:
i EP-120 _
Inadequate Shutdown Valve EP-140 Emergency Reactivity Control VP-540 Runback Verification Procedure j
AP-241-AP-277 Response to Various Area and Process Radiation Monitor Alarms AP-360 Loss of Decay Heat Removal AP-450 Emergency Feedwater Actuation AP-530 Ratural Circulation i
AP-770 Emergency Diesel Generator Actuation i
AP-1061 Loss of Containment Integrity f
I 2.
Provide a description of the methods and processes used to identify
(
information not provided by the ATOGs; determine the characterts-tics of needed instrumentation; determine any differences between the task analysis approaches used during development of plant-specific APs/EPs and that ased by the DCRDR team.
This will facilitate a better understanding of the overall SFTA process.
f t
s l
l 4.
A Comparison of Display and Control Raquirements with a Control Room Inventory FPC's comp'arison of information and control requirements with the existing instruments and controls in the control room was performed by comparing the information a.a.d control requirements identified in the task analysis with a full-scale photographic mock-up of the control room to identify missing and unsuitably designed instruments and controls. As described at the audit, the CR3 Equipment List and Bill of Materials were also used for reference.
This comparison, referred to by FPC as Verifica-l tion of Task Performance Capabilities, involved a two-phase approach and was performed subsequent to the table-top analysis used to identify information and control requirements.
I t
10
1 As documented in the Summary Report, the first phase of this activity resulted in identification of the presence or absence of required instruments and controls (!&C) as confirmed by comparing the requirements I
identified in the task analysis with the actual control room. The presence of required ISC was noted in the "I&C Identification" column of the task analysis form. As stated by FPC in the Summary Report, instances of missing instrumentation were noted and documented accordingly on a human engineering observation form.
However, a review of HEDs submitted for review did not substantiate any such instances.
The second phase of this task determined the human engineering suitability of the required ISC. The ISC in the control room were examined j
to evaluate whether they were consistent with characteristics identified as necessary during the task analysis. If the 14C did not meet the require-ments, an HE0 was noted.
1 During the audit, a number of c,oncerns were raised regarding conduct of the inventory task. First, as the scope of the task analysis was found to be incomplete. the verification process (availability and suitability) would be incomplete until all information and control requirements had been i
identified. Thus. it was recommended that additional accident scenarios which would exerche specified operation actions be analyzed.
Second, an i
inadequacy with the sock-up was identified which rendered the verification process incomplete. Since all instrumentation and controls were not mocked up, the requirements relevant to the missing instrumentation and controls l
were never compared totally with available hardware.
For those particular l
categories of instruments and controls for which the process was not com-plated. it was suggested that this task be completed in the actual control l
room where all the displays and controls were available. Third, the audit team egressed some reservations regarding the age of the mock-up and design f
changes in tne centrol room which may have been implemented subsequent to mock-up construction.
l Based on information provided on page 22 of the Summary Report it is not clear whether the verification was accomplished using the mock-up or the actual control room.
If accomplished in the mock-up, concerns of the audit team about the age and completeness of the sock-up have not beert addressed j
by the licensee. Whether the licenae plans to compare the availability and
[
11 t
_.~
f suitability of ISC requirements and characteristics that surface from task analysis activities yet to be completed with the control room or sock-up has not been specified.
Until these issues are clarified by the licensee.
neither the process nor scope of the inventory task can be assessed.
5.
Validation of Control Room Functions 1
]
Consistent with NUREG-0700. Section 3.8 guidelines. FPC conducted a i
validation of control room functions to determine whether those functions allocated to the control room operators by the APs/EPs could be accomplished effectively with the design of the control room as it exists. The licen-i see's approach employed a normal complement of the operating crew walking through selected events of the symptom oriented APs/EPs evaluated during the task analysis on the CR3 mock-up. The purpose of the walk-throughs was to evaluate the operational aspects of the control room design in terms of control / display relationships, display grouping, control feedback, visual and communication links manning levels, and traffic patterns.
The operating crew was provided with operating procedures to use as they walked through the events. Additionally, operators were given part of I
an Operating Sequence Overview for each event, describing initial I
conditions, sequence initiator, expected progression of action, and final conditions. As the sperators walked through the procedures slower than i
real-time, they identified the component being controlled or monitored.
j purpose of the action, and expected system response to the action. As the l
operators walked through each event, they pointed to each control or display i
they needed and indicated which annunciators were involved. DCRDR team members recorded operational problems on the task analysis forms. Following j
the walk-through, the operator was asked to note any errors or problems that
{
were encountered during the walk-through. To provide structure for operator comments, dynamically-oriented guidelines from NUREG-0700 Section 6 were l
read to the operators, as appropriate.
i I
A primary concern for the audit team regarding the validation process I
was the scope of the scenarios selected for analysis. A set of six accident scenarios (utilizing only three of the numerous abnormal procedures) were selected for use which did not test a number of types of operator emergency actions. Unless the usability by operators of all operator / system inter-l t
12
faces' involved in emergency procedures has been confirmed during a valida-tion, a potentially unsafe condition may exist.
In the cover letter which accompanied transmittal of the Summary Report. FP.C has indicated that it will develop scenarios for eviluation of response to challenge to containment, response to the release of fission products outside containment, and response to multiple equipment failures.
Scenarios will be assessed using the walk-through method previously described.
Station Blackout, a scenario recommended for study by the evaluation team. is being addressed on a generic basis by the Nuclear Utili-ties Group on Station Blackout.
FPC is participating in this effort.
Overall, from information provided in the Summary Report and transmittal letter. it appears that the licensee's validation effort should contribute to the overall accomplishment of the DCRDR once a complete set of EP/AP scenarios has been completed. However, before an assessment of the work can be made, the licensee should validate the steps of the additional j
accident scenarios documented in "the transmittal letter; describe its debriefing methodology. including the use of NUREG-0700 guidelines which l
involve dynamic characteristics of the control board; and document and 2
assess new human engineering observations.
ASSESSMENT AND IMPl.EMENTATION l
HED assessment and implementation procedures are described in Sections 3 and 4 of the Summary Report. Review findings are presented in Appendix C l
I of the Summary eport.
~
1.
HED Assessment Methodology i
As described by the licensee in the Summary Report, during the assessment phase all the HEOs identified during review activities were assessed as to their effects on operator performance and safe plant operation. HE0s were assigned priorities according to the combined criteria of the likelihood of operator error and the resulting safety consequences.
Using factors specified in the Summary Report (impact on saft Pl ant i
operation, function and safety classification of the HE0-related ccaponent/
[
l 13
[
(
I I
syst'em, and potential for human error), each HE0 was classified in one of the following priority categories:
o Category 1 - Documented error j
l e Category 2 - Safety Consequence. High Potential Error l
~
e Category 3 - Safety Consequence Low Potential Error f
a Category 4 - Low Safety Consequence. Low Potential Error i
Little additional information is provided in the Summary Report regarding the HED Assessment methodology.
It is not clear from documenta-tion provided or from results _of the audit whether specific rating j
procedures and sound criteria have been developed. The licensee has failed j
j to describe the method used to estimate the safety consequence and the i
potential consequences of error associated with HE0s.
It is still unclear i
as to how results of the operating experience review, system function
}
review, and task analysis were used for input on error potential.
No l
)
methodology for combining safety importance and error potential to prioritize HEOs has been provided.
l Furthermore, the licensee has not discussed any process and criteria j
{
for determining which ME0s should be classified as HEDs.
In fact. FPC has not used the tern HED in its Summary Report. Yet, a review of the HEOs which were submitted indicated that at least 378 HE0s were identified, but I
only 290 HEOs were 1 included in the Summary Report. Thus, an additional phase of the assessment process may have taken place, but it has not been mentioned.
Numerous okher concerns were expressed regarding assessment at the in-
~~
progress audit. For example, the audit team emphasized that the assessment an.1 categorization of HEOs should be undertaken with a full complement of DCRDR assessment team members which should include human factors representa-tion.
Information provided in the Summary Report does not indicate whether this has been accompitshed. In light of the fact that the Summary Report provided little new information to supplement audit team findings, all of the previously mentioned concerns and questions still remain. Therefore, it is still impossible to evaluate fully the assessment process as described.
l l
i 14 l
l t
i l
l 2.
Selection of Design Improvements j
f At the audit, the licensee described adequate procedures for imple.
j menting design improvements and indicated due consideration of possible interactive and aggregate effects of the proposed corrections ulich might f
introduce new discrepancies. The design improvement selection process appeared well orchestrated, with a fairly systematic approach established l
from the initial receipt of the HE0 by the A/E contractor through final l
sign-off of the completed improvement.
However, at the time of the audit the methodology for actually selecting design improvements and evaluating alternatives had not been fully established.
l i
As described in the Summary Report. HEOs selected for correction were l
further evaluated to determine the preferred method of correcting the discrepancies.
The process of selecting corrective actions included identification of alternative solutions and their implications for training, j
procedures, crew structure, and management, as well as costs and benefits of control room modifications.
As described to the audit team, criteria j
associated with system availability, reliability, safety, and operational l
(
input of alternative means of correcting HEOs also were considered as was coordination with other upgrade / modifications such as Reg. Guide 1.97.10 j
CFR Part 50, and Appendix R.
l l
At the audit. FPC' indicated that HEOs would be brought into agreement l
with acceptable human factors practice as described in NUREG-0700. Section
(
6.
Enhancements were suggested to correct many HE0s.
Guidelines in selecting there;HEOs for correction by enhancement were derived from review team experience in addition to the background information listed in the EPRI Report.
For some HE0s, design modifications were selected based on human i
engineering criteria and I AC specifications. For other HE0s, alternative f
j corrective actions such as the use of SPDS, training, or procedure modifica-tions were considered in place of enhancement or design modifications.
i i
As previously mentioned. FPC's design improvement selection process j
appears well organized, with a fairly systematic approach established from i
the initial receipt of the HE0 through final sign-of f of the completed
}
improvement. At the audit, the licensee identified the specific, factors to l
be used in actually selecting design improvements or other corrective j
f f
l 15 l
[
1 actions.
Such factors included priority ratings, cost effectiveness, extent of correction, operator performance / training, potential for creating new error, and integration with other control room improvement programs. To date, the methodology for combining these factors or weighting individual factors has not been described. How both conceptual and accepnble solu-tions were developed and the role of the review team in this process are not documented.
Without 4his information. it is not possible to assess fully the degree to which the Itcensee's procedures for selection of design i
improvements and evaluation of alternatives meet the requirements of NUREG-0737. Supplement 1.
Furthermore, many of the HEOs submitted for review require further study before corrections can be proposed. Until DCRDR review actions and evaluative studies are completed, design improvements cannot be selected. Until selections are made, this requirement will be considered incomplete.
i 3.
Verification That Selected Improvements Will Provide the Necessary Correction and Verification That Improvements Will Not Introduce New HEDs FPC's approach toward satisfying this NUREG-0737. Supplement I require-ment entails an evaluation of the design improvements, both individually and collectively, to ensure that the selected improvements adequately correct their respective disc (epancies and do not create other safety problems. The verification will be' accomplished by the DCRDR team by comparing the modified control room design with:
1 1.
The control room human factors design conventions document.
j i
I
~
2.
The I&C requirements identified during the control room survey and i
task analysis.
3.
Approved f.icject design criteria (e.g.. electrical separation i
criteria).
I I
HED solutions found inadequate will be reassessed, and solutions will be revised to meet the criteria.
~
l i
l 16 l
1
. -- - - - - - - - I
\\
=
l The information provided in the Summary Report reiterates information j
provided to the audit team. Additionally, the licensee has indicated that a I
procedure will be established, as part of the engineering procedures, to ensure adequate human factors considerations for control room changes that are considered after the DCRDR is completed. This procedure, based on the design basis established during the DCRDR will include completing a human engineering checklist.
Who will monitor this procedure has not been
{
specified.
As indicated in the audit report it appears that FPC understands the intent of the verification requirement. Substantive details, however, sur-rounding the methodology have not been provided. Furthermore, the licensee has not described how interactive and aggregate effects of the proposed changes will be considered.
If design improvements were validated by accomplishing walk-throughs of operating procedures, the methodology employed needs to be documented. It was suggested by the audit team that the DCRDR review team should scrut.inize proposed changes using the same l
human factors guidelines that were used to' identify HE0s initially, and that l
the mock-up should be updated and used for the verification and validation of control room improvements. Based on the information provided in the I
Summary Report. it does not appear as if these suggestions were heeded.
3 In conclusion, concerns and questions posed at the audit still remain.
Until these areas are addressed by the licensee, a full evaluation of its verification of design improvement efforts cannot be made. Furthermore, the l
majority of HEOs submitted in the Summary Report for review require further i
l study even before a design improvement can be suggested. Once improvements are proposed, they will need to be verified to ensure that the correction 1
l does solve the identified problem without introducing additional discrepan-i cies.
Until this is accomplished for all HEOs to be resolved, this requirement of NUREG-0737. Supplement I will be considered incomplete.
i 4.
Coordination of Control Room Improvements With Changes Resulting From l
l Other Improvement Programs f
i i
Based on information provided at the audit and in the Summary Report.
it appears that FPC has a coordinated program in place to address the l
Supplement 1 to NUREG-0737 initiatives. The program, which is the overall 17 l
l i
t I
l responsibility of one FPC staff person, should provide the necessary coordi-i nation and support to ensure that a systematic approach is adopted for the inclusion of each of the recommended design changes resulting from these f
initiatives.
Specific examples of coordination were provided at the audit and in the i
Sunnary Report. Examples of specific interfaces are summarized below:
i 1.
The upgraded, plant-specific E0Ps were used as one reference for the DCRDR analysis of operator requirements.
i l
2.
The SPDS design utilizes the same critical safety functions as the APs/EPs.
I i
3.
Procedures and training were assessed as part of the DCRDR operator i
interviews.
4.
Procedural modifications, train'ing, and SPDS capabilities were sometimes considered as correction actions for an HEO.
i 5.
Through engineering studies, the results of the DCRDR will be integrated with other control room modification requirements such j
as addition'a1. instrumentation necessary to implement Reg. Guide I
1.97.
If FPC follows through and continues with its plans as DCRDR-identified HEOs are resolv6d Its ' efforts will meet the requirements for this element l
of the DCRDR.
l ANALYSIS OF PROPOSED CORRECTIVE ACTIONS AND JUSTIFICATIONS FOR HEDS LEFT i
UNCORRECTED l
l l
FPC documents approximately 290 HE0s in Appendix C of its Summary l
Report. Of that number 10 HE0s were classified as Category 1,16 HE0s as Category 2, 52 HE0s as Category 3, and 212 NE0s as Category 4.
FPC has performed or proposed corrective action for 2 of the 10 MEOs in Category I.
The remaining 80% of Category 1 HE0s still require further study to determine what, if any, solution will be implemented.
For Category 2 HEOs, 18 l
i i..
j I
l i
FPC has proposed corrective action for 1 of the 16 HEOs. The remaining 951 of Category 2 HEOs still require further investigation to determine what, if any, solution will be implemented. For Category 3 HEOs. FPC has proposed or implemented solutions for 9 HEOs. The remaining 83% of Category 3 HEOs have yet to be investigated further to determine what, if any, solution will be i
implemented.
For Category 4 HEOs FPC has proposed or implemented changes j
for 15 HEOs. intends to study 12. and intends no changes for 185 HE0s.
Because FPC has proposed or implemented solutions for only 27 HEOs.
j and still has studies to perform for 78 HEOs of the 290 HE0s, a complete evaluation of the proposed solutions could not be performed.
l l
For those HE0s which FPC has resolved by describing corrective action (27) or providing justifications for not taking corrective actions, the audit team evaluation found some but not all to be satisfactorily resolved by FPC. Those HE0s for which corrective actions were proposed but found to be inadequate are discussed in the, Proposed Corrective Action section of r
this report and are listed in Appendix A. ' sections a and b.
Those HEOs for l
which justifications for not taking corrective actions were provided but l
were found to be inadequate are discussed in the Justifications for HEDs Left Uncorrected section of this report and are listed in Appendix B.
l sections a and b. ' Additionally, those HE0s described by FPC as requiring f
further study are l'is.ted in Appendix C.
Also, this report includes a listing of HEOs for which an adequate solution has been proposed, but for which no implementation has occurred. These HEOs are listed in Appendix D.
l The remaining unlisted HEOs are those which were found to be adequately l
resolved.
In the following two sections are brief examples of HE0s which j
were found to be inadequately resolved where the audit team elaborates its l
1 findings.
l i
1.
Proposed Corrective Actions l
i Appendix A. sections a and b of this report contain the complete list for HE0s for which corrective actions were proposed but were found to be inadequate for one of the two reasons discussed below:
a.
The description of the proposed corrective action is too brief.
general, or ambiguous to allow an adequate evaluation to be made.
)
19 i
w..
.-A.-u a.d.
wa,-
1 u
.J...
p
- m.s+-
-m--
-.4 4-*6.hwhae 2
m_AA_
em.
-.---._.-_-.4
_m l
4 l
HE0 0254 - The discrepancy involves safety-related trend recorders j
which have a multitude of problems associated with them. Many of i
the problems are described. However, the action to be taken states f
that, " Reg. Guide 1.97 changes will replace many of _the safety related recorders. Otherwise, maintenance requests will be made to i
correct them." Because none of the safety-related recorders are i
listed, it is not possible to allow adequate evaluation. This i
appears to be a generic problem, and it is not clear maintenance l
procedures have been effective, judging by other HEOs where operators have discussed malfunctioning recorders.
l
?
- b. The proposed corrective action only partially corrects the f
discrepancy.
HE0 0203 - During operator interviews it was reported that various I
controls were likely to be operated in error because of their
[
location and the fact that they all have black-handled switches.
I The FPC resolution is to add labdis. This resolution would appear to resolve possibly one of the concerns of the operators, but not i
necessarily both concerns. i.e..' look-alike black handles and confusing location.
t i
w 2.
Justifications for HE0s Left Uncorrected i
j Appendix B. sections a and b of this report contain the complete list of HEOs for which justifications for not taking corrective actions were
}
l provided, but;were found to be inadequate for one of the two reasons discussed below:
{
f a.
The justification (or HE0 description, component description, etc.)
}
is too brief general, ambiguous, or does not sufficiently address
[
the discrepancy to allow an adequate evaluation to be made.
[
I HE0 0045 - The HE0 described is that a group of (5) switches do not
[
[
have consistent direction of movement or standardized position for j
l the automatic position. FPC's justification for not correcting f
this HE0 is that "particular variables involved dictate the j
arrangement on the switch." Also. " automatic is relative even
~
l i
l l
20
}
l
l t
?
I though it may appear inconsistent with other position labeling in j
certain cases." The justification does not give any details why l
j
" automatic is relative" for which switch, or give any details about j
which "particular variables.. dictate the arrangement." _,
i b.
The basis of the justification is not adequate (e.g.. the justifi.
cation does not address operational or behavioral factors) or the
{
justification does not indicate what criteria were used to
[
disregard NUREG-0700 guidance.
[
j HE0 0207 - The HE0 described is that several temperature meters on the IC panel have pointers which cause parallax problems. FP C's justification for not correcting this HE0 is that "since the meters are low on the vertical panel, the parallax is minimized." FPC did not explain what the standard for determining minimum parallax was.
{
or describe what the results were from their evaluation of the j
impact of the parallax problem on operations.
j CONCLUSIONS AND RECOMMENDAT!015 f
I I
Florida Power Corporation's Summary Report for the DCRDR conducted at Crystal River Unit'3 Generating Station demonstrates a strong commitment towards meeting many of the requirements of NUREG-0737. Supplement 1.
l However, additional t'nformation still is required from the licensee to i
provide assurance that all requirements as stated in NUREG-0737. Supplement 1 are going to be satisfied.
j i
The following is a sums.ary of comments on, Florida Power Corporation's compliance with each of the DCRDR review steps and requirements documented i
j by the Summary Report and described by the licensee during discussions at l
the in-progress audit.
l e Qualifications and Structure of the DCRDR Team FPC has described a well-qualified, adequately staffed DCRDR team.
j which was composed of a good skill mixture to conduct the DCRDR.
l Information relevant to levels of effort and staffing on DCRDR tasks l
l l
21
i 4
l i
was provided at the audit.
This requirement of NUREG-0737 is 4
satisfied.
e Operating Experience Review l
Although not a requirement of Supplement I to NUREG-0737, a review f
I i
of operating experience was conducted fairly consistently with NUREG-0700 guidelines and objectives.
i e Control Room Survey
[
The licensee needs to identify which NUREG-0700 criteria were l
modified or omitted from the survey process.
If other criteria
{
(such as NUTAC criteria) were substituted for NUREG-0700, the 11cen-
[
see should identify these criteria and provide justifications for f
the substitutions.
o System Function and Task AnaIysis *
(
I i
- The licensee should expand the scope of the plant-specific E0Ps j
(EPs APs, and VPs) so that all operator tasks specified in the
[
CR3 E0Ps'are subjected to the SF&TA and V8V processes. Those EPs.
l
~
APs, and VPs.which must be completed are enumerated on page 9 of this report.
l The licensee should provide a description of the methods and I
I procetses used to identify parameters and other information and 1
control needs that are not provided in the AT0Gs or are different from those specified in the AT0Gs; determine the characteristics i
(e.g., units, range, accuracy, type of control / display) of the l
l needed instrumentation; and determine the differances, if any, r
between the task analysis approach used during development of' the l
plant-specific Emergency procedures (EPs) and Abnormal Procedures (APs) and the task analysis used during the DCRDR process.
t I
I i
22 i
t
e Comparison of Display and Control Requirements With a Control Room Inventory
- The licensee should complete the inventory process for all the
' controls and displays identified by the analysis of additional emergency scenarios required to complete the syrtem function and task analysis.
- The licensee should indicate if and how the concerns addressed in i
this report regarding the sock-up have been resolved if the mock-up is to be used for the inventory comparison, i
e Validation of Control Room' Functions The licensee should complete validation of remaining emergency scenarios.
s Assessment of HEDs j
i
- The licensee has not provided to the audit team or in the Summary l
Report en adequate description of its assessment methodology and criteria to facilitate evaluation of the activities conducted l
i j
relative to 'the requirements of NUREG-0737. Supplement 1.
The licensee needs to provide a clear description of the assessment in i
sufficient detail to permit evaluation of work accomplished.
j t
- The licensee is encouraged to ensure the participation of the entire DCRDR team. including human factors personnel. in the assessment process.
j i
l e Selection of Design Improvements t
- The licensee should provide more detailed description of the systematic approach used to determine and select HED solutions.
l f
i 23 l
1
l j.
1 l
- The licensee is encouraged to ensure participation of the entire DCRDR team including human factors personnel in the selection process.
I
- Before the licensee can select design improvements for many identified HEOs. it should complete the numerous evaluative j
studies mentioned on the HE0 forms. At a minimum, the Itcensee i
needs to provide a schedule for study completions and a time frame l
during which solutions will be proposed.
1 e Verification that Improvements Will provide the Necessary Correc-j tions Without Introducing New HEDs I
l
- The licensett should provide details of the long-term human factors procedure mich will be established to evaluate control room design chang's subsequent.to the DCRDR.
- The licensee needs to document its verification methodology and describe how interactive and aggregate effects of proposed changes will be, considered.
l
- Verificatic'n needs to be completed for HE0 solutions yet to be f
determined.
l e Coordination of the DCRDR with Other Improvement programs
(
If FPC follows its proposed plan, the coordination of the DCRDR with
' etter improvement programs will comply with the requirement of l
Supplement 1 to NUREG-0737.
i l
e proposed Corrective Actions and Justification for HEDs Lef t Uncorrected
- The licensee needs to respond to problems specified in Appendices I
A - D of this report.
t t
f 24
i
\\
- The licensee needs to specify HEDs relating to missing i
instruments. Solutions for these HEDs need to be provided for rev kw.
j In light of the number of concerns expressed in this report,'the amount of work yet to be accomplished by the licensee, and the number of HEDs
[
vnresolved or unsstisfactorily described, the audit team recommends that a meeting be held with the licensee. This will provide FPC the opportunity to clarify issues and methodologies employed to satisfy DCRDR requirements. It will also allow the flRC to provide feedback to the licensee. If the meeting f
does not result in the resolutinn of concerns, a pre-implementation audit j
i should be scheduled at the plant.
)
J i
t i
i t
l i
I y
(
i i
i i
f t
r i
L i
h i
[
i 25
[
1 I
REFERENCES 1.
" Detailed Control Room Design Review Summary Report for Crystal River Unit 3 Generating Station." Florida Power Corporation. Apr113.1985.
2.
" Detailed Control Room Design Review Program Plan for Crystal River Unit 3 Generating Station." Florida Power Corporation. October 31, 1983.
1 3.
" Detailed Control Room Design Review Evaluations - Evaluation of DCRDR Program Plan for Crystal River Unit 3." Science Applications Interna-tional Corporation. December 5,1985.
4.
" Responses to U.S. Nuclear Regulatory Commission Comments on the l
Florida Power Corporation Crystal River Unit #3 Detailed Control Room Design Review Program Plan." Florida Power Corporation. March 27, 1985.
5.
In-progress audit held at Crystal River Unit 3 Generating Station.
February 11-15, 1985.
6.
"In-Progress Audit of the Detailed Control Room Design Review for f
Florida Power Corporation's Crystal River Unit 3 Generating Station."
Science Applicat, ions International Corporation. March 25, 1985.
i 7.
NUREG-0660. Vol.1.. "NRC Action Plan Developed as a Result of the TMI-2 Accident." USNRC. Washington, D.C., May 1980; Rev.1. August 1980.
NUREG-073[. " Requirements for Emergency Response Capability." USNRC, 8.
Washington, D.C., November 1980.
i I
9.
MUREG-0737 Supplement 1
" Requirements for Emergency Response Capability." USNRC. Washington. D.C.. December 1982 transmitted to reactor licensees via Generic Letter 82-33. December 17, 1982.
- 10. NUREG-0700. " Guidelines for Control Room Design Reviews." USNRC.
Washington. D.C.. September 1981.
26 i
1
- 11. ' NUREG-0800. " Evaluation Criteria for Detailed Control Room Design Review." USNRC. October 1981.
- 12. Letter from G. R. Westafer. FPC to J.F. Stolz. NRC dated 17 June 1985.
i 4
I f
{
f W
e j
k P
r v
l i
h f
m j
r t
t k
b
?
27 I
t APPENDIX A The following are HEOs for which corrective actions are proposed but were found to be inadequate for one of the following reascns:
f a.
The description of the proposed corrective action is too brief, j
general, or ambiguous to allow an adequate evaluation to be made.
j i
0278, 0254, 0122, 0121, 0147 b.
The proposed corrective action only partially corrects the discrepancy.
l t
0203, 0044, 0146, 0121, 0109, 0153 I
I f
5 i
N m
5 I
h I
~~
i I
f i
t i
t f
l I
l l
28
APPENDIX 8 HEOs for which justifications for not taking action were provided but were found to be inadequate for one of the following two reasons:
The justification (or HE0 description, component description, etc.)
a.
is too brief, general, ambiguous, or does not sufficiently address the discrepancy to allow an adequate evaluation to be made.
0282 0107 0069 0030 0056 0247 0226 0125 0261 0230 0364 0276 0287 0375 0365 0291 0196 0342 0259 0062 0346 of60 0348 0161 0040 0063 0212 0045 0355 0033 1
0364 0154 0376 0347 0116 0020 w
0270 0377 b.
The basis o the justification is not adequate (e.g., the justif t-cation does not address operational or behavioral factors) or the justification does not indicate what criteria was used to disregard NUREG-Q700 guidance.
~
0226 0071 0115 0222 0266 0327 0207 0072 0332 0267 0295 0112 0160 0334 0364 0172 0010.
0005 0277 0081 0012 0134 0300 0138 0348 l
0064 0092 0301 0099 0347 i
0009 0338 0303 0086 0004 0157 0187 0359 0268 0337 0140 0106 i
29 t
APPENDIX C The following group of HEOs has been selected for further study, but to date no solution has been proposed, or a schedule been proposed in the event that correction is required.
E i 0190 0292 0289 0171 0213 0188 0164 0168 0169 0353 0189 0167 0051 0294 0011 0324 0210 0052 0047 0060 0220 0290 0053 0313 0181 0219 0234 0055 0165 0378 0201 0041 0050 0312 0275 0147 0123 0054 0109 0066 0027 0176 0048 0150 0156 0218 0245 0049 0178 0114 0351 0209 0199 0166 0021 0345 0076 0083 0214 0253 0307 0358 0170 0216 0024 0018 0014 0038 0036 0354 0034s 0035 9
t i
i
(
1 30 t
i APPENDIX D The following HEOs have been found to have an adequate solution, but to date they have not been implemented.
0205 0379 0121 0023 0013 0016 0263 0105 0185 0349 0326 0044 0229 0175 0155 i
0137 0146 0110 0208 0001 t
0233 0194 0019 0375 G
I h
s, I
i t
31 l
. - _ _.