ML20137Y542
| ML20137Y542 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 09/30/1985 |
| From: | Vassallo D Office of Nuclear Reactor Regulation |
| To: | Farrar D COMMONWEALTH EDISON CO. |
| References | |
| RTR-NUREG-0737, RTR-NUREG-737 NUDOCS 8510080026 | |
| Download: ML20137Y542 (3) | |
Text
.
Sep*. ember 30, 1985 Docket Nos. 50-254/265 Mr. Dennis L. Farrar Director of Nuclear Licensing Commonwealth Edison Company Post Office Box 767 Chicago, Illinois 60690
Dear Mr. Farrar:
SUBJECT:
RESULTS OF ON-SITE AUDIT OF THE 4
DETAILED CONTROL ROOM DESIGN REVIEW Re:
Quad Cities Nuclear Power Station, Units 1 and 2 In response to the Commission's NUREG-0737, Supplement 1, Commonwealth
~
Edison Company (CECO) conducted a detailed control room design review j
(DCRDR) for Quad Cities, Units 1 and 2.
A Final Summary Report on this review was submitted by letter dated May 1, 1985. The NRC staff and i
consultants reviewed this report and, in June 1985, conducted an on-site
)
audit at the Quad Cities Station. Our findings as a result of our i
evaluation and audit to date are contained in the enclosed Audit Report.
J Results of the staff evaluation thus far indicate the CECO has conducted a very comprehensive human factors review of the control room which will satisfy most of the DCRDR requirements of Supplement I to NUREG-0737.
However, one major requirement has not yet been satisfied and will necessitate submission of a supplemental report. NUREG-0737, Supplement I clearly states, "All licensees shall submit a summary report of the j
completed review outlining proposed control room changes... The report will also provide a summary justification for human engineering discrepancies with safety significance to be left uncorrected or partially corrected." The purpose of a preimplementation audit is, "... audit of proposed modifications (e.g., equipment additions, deletions and i
relocations, and proposed modifications)."
The Quad Cities Summary Report did not provide proposed resolutions to many human engineering discrepancies (HEDs) and some of the justifications for not correcting HEDs were inadequate. Although the on-site audit succeeded in resolving many of the DCRDR requirements, it did not succeed in producing sufficient information on proposed corrective actions.
The enclosed Audit Report, prepared by the NRC staff's consultant, presents the results of the NRC's review thus far. The staff agrees with the technical content and conclusions of the Audit Report and transmits the Report to CECO to be used in completing the Quad Cities DCRDR and for guidance in performing the remaining CECO plant reviews.
85100t:0026 850930 PDR ADOCK 05000254 F-PDR
O, Mr. Dennis L. Farrar CECO has proposed a schedule for implementation of corrective actions for Quad Cities, Units 1 and 2 that spans somewhat more than two refueling outages. We believe this schedule to be satisfactory in light of the supplemental report that is required.
Sincerely, Original signed by/
Domenic B. Vassallo, Chief l
Operating Reactors Branch #2 Division of Licensing
Enclosure:
As stated cc w/ enclosure:
See next page 4
i DISTRIBUTION
-Docket File NRC PDR Local PDR ORB #2 Reading HThompson OELD SNorris RBevan ELJordan JPartlow BGrimes ACRS-(10)
Gray File i
I l
l DL:0RB#2 DL:0RB#2 DL.4B#2 i
SN s
RBevan DVassallo 09/30/85 09/1985 09/Jo/85
Mr. Dennis L. Farrar Quad Cities Nuclear Power Station Commonwealth Edison Company cc:
Mr. B. C. O'Brien James G. Keppler President Regional Administrator Iowa-Illinois Gas and Region III Office Electric Company U. S. Nuclear Regulatory Commission 206 East Second Avenue 799 Roosevelt Road Davenport, Iowa 52801 Glen Ellyn, Illinois 60137 Robert G. Fitzgibbons, Jr.
Isham, Lincoln & Beale Three First National Plaza Suite 5200 Chicago, Illinois 60602 Mr. Nick Kalivianakis Plant Superintendent Quad Cities Nuclear Power Station 22710 - 206th Avenue - North Cordova, Illinois 61242 Resident Inspector U. S. Nuclear Regulatory Commission 22712 206th Avenue North Cordova, Illinois 61242 Chairman Rock Island County Board of Supervisors Rock Island County Court House Rock Island, Illinois 61201 The Honorable Tom Corcoran United States House of Representatives Washington, D. C.
20515 Mr. Gary N. Wright Nuclear Facility Safety Illinois Department of Nuclear Safety 1035 Outer Park Drive, 5th Floor Springfield, Illinois 62704 i
4 AUDIT REPORT OF THE DETAILED CONTROL ROOM DESIGN REVIEW FOR QUAD CITIES STATION, UNITS 1 AND 2 AUGUST 5, 1985 Prepared by:
Science Applications International Corporation 1710 Goodridge Drive McLean, Virginia 22102 Under Contract to:
U.S. Nuclear Regulatory Commission Washington. D.C. 20555 Contract No. NRC-03-82-096 n
1:-
f c'
' j t "I g i~
~'
(
N
. ~, - - - -,
-r.-
y-
9 8
FOREWORD This Audit Report was prepared by Science Applications International Corporation (SAIC) under contract NRC-03-82-096 Technical Assistance in Support of NRC Licensing Actions:
Program III.
The assessment was performed in support of the Division of Human Factors Safety. Human Factors Engineering Branch (HFEB). HFEB previously evaluated Commonwealth Edison Company's (CECO's) generic Program Pian for conducting Detailed Control Room Design ~ Reviews (DCRDRs) at all of their nuclear stations, including Quad Cities Station, Units 1 and 2.
Because the Ceco Program Plan provided insufficient details, the NRC staff met with CECO on June 14,1983 where additional infcrmation was provided to describe CECO's Program Plan. NRC evaluative comments were prepared and transmitted to the licensee on July 11, 1983. No in-progress audit was conducted t.t this plant although the NRC did audit another CECO plant. Dresden Nuclear Station Units 2 and 3 that used the same basic review process as at (Dad Cities Station, Units 1 and 2.
This report includes the SAIC evaluation of the Detailed Control Room Design Review (DCRDR) for Commonwealth Edison Company's Quad Cities Station, Units 1 & 2.
Information provided in the previously submitted Program Plan also was considered in preparing this evaluation.
A preliminary review of the Detailed Control Room Design Review Final Summary Report for Contmonwealth Edison Company's Quad Cities Station, Units 1 and 2 was conducted by the NRC staff and SAIC. Based upon this review, the NRC decided to conduct an on-site, pre-implementation audit of the Quad Cities Station DCRDR.
This audit was conducted on June 10-13, 1985.
This Audit Report is based upon both the Summary Report submitted by CECO and the information provided by the licensee during the June 1985 pre-implementation audit.
l l
M l
'*h ii
\\
1 TABLE OF CONTENTS I
Pa ge Section 1
BACKGROUND..............................
3 P L ANN IN G P H AS E.............................
3 1.
Preparation and SJbmission of a Program Plan........
2.
Establishment of a Qualified Multidisciplinary 4
Review Team........................
5 REVIEW PHASE.............................
5 1.
Review of Operating Experience...............
7 2.
System Function and Task Analysis 9
3.
Control Room Inventory...................
11 4.
Co nt rol Room Survey.....................
15 5.
Validation of Control Room Functions............
17 I
ASSESSMENT AND IMPLEMENTATION....................
17 1.
HED Assessment Methodology.................
20 2.
Selection of Design Improvements..............
3.
Verification That Selected Design Improvements Will Provide the Necessary Correction and Can Be Introduced in the Control Room Without Creating Any Unacceptable 21 Human Engineering Discrepancies 4.
Coordination of Control Room Improvements With Changes 22 Resulting From Other Improvement Programs DESCRIPTION OF PROPOSED DESIGN CHANGES AND JUSTIFICATION FOR HEDs WITH SAFETY SIGNIFICANCE TO BE LEFT UNCORRECTED OR PARTIALLY 22 CORRECTED..............................
23 1.
Proposed schedules for implementing HED corrections 2.
Proposed corrective actions and justifications for 23 HEDs to be left uncorrected................
27 CONCLUSIONS AND RECOMMENDATIONS...................
32 REFERENCES..............................
n U-iii
I e
TABLE OF CONTENTS (Continued)
Section Page APPENDIX A - HEDs for whic'h corrective actions or justifications for not correcting were proposed but were found to be inadequate......................
33 APPENDIX B - Attendance list for Pre-Implementation Audit 43 APPENDIX C - Differences Between NUREG-0700 and Ceco Checklist Presented at Quad Cities Pre-Implementation Audit on Ju ne 11, 1985......................
47 APPENDIX D - List of Incomplete Studies and Reviews..........
60 APPENDIX E - A Brief Description of Remote Shutdown Capability and Comments.........................
'64 l
{
.i
!!~
C iv
AUDIT REPORT OF THE DETAILED CONTROL ROOM DESIGN REVIEW FOR QUAD CITIES STATION, UNITS 1 AND 2 This report documents the findings from a pre-implementation audit.
June 10-13, 1985, and the evaluation of the DCRDR Summary Report submitted to the Nuclear Regulatory Commission (NRC) on May 1,1985, by Commonwealth Edison Company for the Quad Cities Station Units 1 and 2 Detailed Control Room Design Review (DCRDR) (Referen:e 1). The review by Ceco at Quad Cities was conducted in accordance with a generic Program Plan submitted to the NRC in March 1983 for performing DCRDRs for all of Ceco's nuclear stations (Reference 2). The CECO Program Plan had insufficient details addressing the processes to accomplish the DCRDR objectives; therefore, the NRC staff met with CECO on June 14, 1983 in order to obtain additional information to describe Ceco's Program Plan.
NRC staff reviewed the Program Plan and forwarded their comments to Commonwealth Edison on July 11,1983 (Reference 3). A result of the staff review of Ceco's generic DCRDR Program Plan was the decision to conduct an in-progress audit of this process to ensure that CECO was not proceeding with an inadequate program 'and to provide CECO with feedback on their approach.
The in-progress audit was conducted at Ceco's Dresden Units 2 and 3 since these were the first units to which Ceco's DCRDR process was applied.
Since the same DCRDR process will be used at both Dresden and Quad Cities, the results from the Dresden DCRDR were integrated with the Quad Cities DCRDR.
Results of the SAIC evaluation follow a brief overview of the background leading up to the DCRDR Summary Report and the pre-implementation audit.
BACKGROUND Licensees and applicants for operating licenses are required to conduct a 6etailed Control Room Design Review (DCRDR).
The objectNe is to
"... improve the ability of nuclear power plant control room oper.ators to prevent accidents or cope with accidents if they occur by improving the information provided to them" (NUREG-0600, Item I.D) (Reference 4). The 1
need to conduct a DCRDR was confirmed in NUREG-0737 (Reference 5) and in Supplement I to NUREG-0737 (Reference 6).
DCRDR requirements in Supplement 1 to NUREG-0737 replaced those in earlier documents. Supplement I to NUREG-0737 requires each applicant or licensee to conduct its DCRDR on a schedule negotiated with the NRC. Guidelines for conducting a DCRDR are provided in NUREG-0700 (Reference 7) while criteria for NRC evaluation of a DCRDR are contained in NUREG-0800 (Reference 8).
A DCRDR is to be conducted according to the licensee's own Program Plan (which must be submitted to the NRC). According to NUREG-0700, it should include four phases:
(1) planning, (2) review (3) assessment, and (4) reporting. The product of the last phase is a Summary Report which must include an outline of proposed control room changes, their proposed schedules for implementation, and summary justification for human engineer-ing discrepancies (HEDs) with safety significance to be left uncorrected or partially corrected.
Upon receipt of the licensee's Summary Report and prior to implementation of proposed changes NRC must prepare a Safety Evaluation Report (SER) indicating the acceptability of the DCRDR (not just the Summary Report). The NRC's evaluation encompasses all documentation as well as briefings, discussions, and audits if any were conducted.
The purpose of this Audit Report is to assist the NRC in the technical assessment process by providing an appraisal of the Quad Cities DCRDR process and results.
The DCRDR requirements as stated in Supplement 1 to NUREG-0737 can be summarized in terms of nine specific issues, a list of which provides a convenient outline of the areas covered in this Audit Report.
The nine issues are:
1.
Establishment of a qualified multidisciplinary review team.
2.
Use cf function and task analyses to identify control room operator tasks and information and control requirements during U
emergency operations.
3.
A comparison of display and control requirements with a control room inventory.
2 l
l
4.
A control room survey to identify deviations from accepted human factors principles.
5.
Assessment of human engineering discrepancies (HEDs) to determine which HEDs are significant and should be corrected.
6.
Selection of design improvements that will correct those discrepancies.
7.
Verification that selected design improvements will provide the necessary correction.
8.
Verification that improvements can be introduced in the control room without creating any unacceptable human engineer.ing discrepancies.
9.
Coordination of control room improvements with changes resulting from other improvement programs such as SPDS, operator training, new instrumentation, Reg. Guide 1.97, and upgraded emergency operating procedures.
PLANNING PHASE 1.
Preparation and Submission of a Program Plan The NRC staff reviewed Commonwealth Edison Company's generic Detailed Control Room Design Review Project Program Plan submitted for all of their i
nuclear stations including Quad Cities Station Units 1 and 2.
The NRC -
staff met with Ceco on June 14, 1983, where additional information was provided that described the DCRDR process to be used by Ceco.
The NRC reviewed the Program Plan with reference to the requirements of Supplement I to NUREG-0737 and the guidance contained in NUREG-0700 and NUREG-0800 and transmitted comments to Ceco by memo dated July 11, 1983.
A result of that neview was the decision to conduct an in-progress audit at theefirst plant to which the DCRDR process was to be applied, Dresden 2 and 3.
The results
~
of the Dresden DCRDR were integrated with the Quad Cities DCRbR since the process was the same.
3
_ =
4 2.
Establishment of a Qualified Multidisciplinary Review Team Both the Program Plan and the Summary Report for Quad Cities included a description of the staffing and mar agement that were established to conduct the Control Room Design Review.
The structure and management of the DCRDR appeared to be flexible enough to permit a multidisciplinary effort.
Management and administration of the Ceco DCRDR at Quad Cities Station was the responsibility of the Technical Services Nuclear Department. Within this department, the DCRDR Program Administrator reported to the Technical Services Nuclear Department Manager who reported directly to an Assistant Vice President and hence to a Ceco Executive Vice President.
i The Quad Cities DCRDR team consisted of a group of professionals from CECO and Advanced Resource Development Corporation (ARD) with a wide ra.nge of skills necessary for the performance of the DCRDR.
As indicated by resumes provided in Appendix C of the Summary Report, the 14 members of the core team appeared qualified to perform DCRDR activities.
Expertise of the -
team included:
i e instrumentation and control engineering e engineer / architect with control room design experience e operations e human factors engineering.
Ten subject matter experts (SMEs) were available to work on the project as needed.
They provided the appropriate level of plant design and operational knowledge.
The skill mix of the team is consistent with the guidance provided in NUREG-0800.
Furthermore, it appears that the review team, as established, did have the freedom to carry out the review and access records, informa-tion, and facilities as needed.
A task assignment summary matrix was pre-sented at the onsite audit that indicated which team specialists were involved with each of the different phases of the DCRDR project.
It indi-cated that the necessary skills were available and that they were proper 1; utilized.
U-i 4
i In summary, we believe Ceco has met the requirement of establishing a qualified multidisciplinary review team.
REVIEW PHASE
. CECO review phase plans and activities included:
1.
Historical event review and review of operating experience 2.
Task analysis 3.
Control room inventory 4.
Verification of task performance 5.
Validation of control room functions l
6.
Control room survey.
The above activities are those recommended by NUREG-0700 guidelines as contributing to the review phase objectives.
Activities 2, 3, 4, and 6 contribute to the accomplishment of specific DCRDR requirements contained in Supplement I to NUREG-0737. Activities 1 and 5 are recommended by NUREG-0700 guidelines.
4 1.
Review of Operating Experience A review of operating experience is not explicitly required by NUREG- -
0737 Supplement 1.
However, it is an activity recommended by NUREG-0700 as contributing to the accomplishment of review phase object,ives.
l i
l CECO conducted a two-part operating experience review at Quad Cities Station to identify conditions which impact probability for those operator errors which could affect safe operation of the generating stations. The l
l first part of the effort, the historical event review, included a review of I
the operating history of the plant to document recurring proble'ms and an i
examination of generic industry-wide problems applicable to the plant.
The l
second part of the review, the operating experience review, included the j
i 5
l
i
~
conduct of an operator survey and interviews with operators to obtain feedback based on previous operating experience, i
l To accomplish the review of plant operating history and industry-wide experience, five sources of historical reports were collected and reviewed.
In-house documentation including Quad Cities Licensee Event Reports (LERs),
Quad Cities Deviation Reports (DVRs), and Quad Cities Professional Committee Reports (PR0s) for five years were reviewed by a Human Factors Specialist i
(HFS).
Industry-wide Significant Event Reports (SERs) and Significant Operating Event Reports (SOERs) for the past five years also were reviewed by the HFS.
All reports collected were reviewed to identify those reports that involved control room operator, procedural and/or control board equip-ment failure and/or design arrangement errors.
Over 1,250 reports were reviewed and found relevant to Quad Cities Station.
Criteria were developed for analyzing the above-mentioned reports to identify and prioritize those reports which documented a control room '
problem as defined by specified criteria. Each high priority report that described a problem relevant to the control room was investigated to deter-l mine if the problem already had been adequately addressed from a human j
factors perspective.
If the problem had not been adequately addressed and l
additional human engineering corrective action could be taken to minimize the probability of the problem recurring, a control room INman Engineering Discrepancy form (NED) was completed.
Using this process, seven problems were evaluated as uncorrected and had HEDs written, resulting in a very thorough and productive historical review.
l The Quad Cities operator survey effort entailed administration of an -
i open-ended, self-administered questionnaire to staff members, including non-licensed operations personnel, licensed operations personnel, and licensed 7
j non-operations personnel at Quad Cities.
The survey was structured to l
address the nine content areas suggested in NUREG-0700. The objective of
(
the survey was to obtain special, pertinent knowledge that operating person-nel at the Quad Cities plant possess regarding both positive and negative control room system features which they had experienced and/or observed in the course of preparing for operations or during operations. Pefs'onnel were also asked to provide background / biographical information.
The effort put into this survey instrument produced a useful tool for the review process.
6
Sixty-three surveys were mailed out for completion.
Twenty-six (41%)
were returned by mail to Ceco and given to the HFS unopened.
Con fi-dentiality was assured by assigning each questionnaire a number.
The list of potential respondents and corresponding numbers were kept in confidence by HFS personnel.
As some information relevant to operator experience could not be solicited easily by using a structured questionnaire approach, individual semistructured interviews also were conducted by the HFS with selected plant personnel.
The licensee has not identified the interviewer and has not provided information to describe the number or characteristics of operators that were interviewed. The objectives of the follow-up interviews were:
(1) to clarify ambiguities in an individual's written responses to the self-administered questionnaire; and (2) to gather additional details pertairling to that individual's responses.
Once interview data were collected, all information from the completed survey activities were compiled, reduced, and analyzed.
Findings, written as prospective HEDs, later were reviewed during the assessment process.
Sixty-three HEDs were identified as a result of the survey activities.
In summary, CECO's operating experience review at Quad Cities appears extensive, thorough, and appropriately conducted.
Consistent with NUREG-0700 objectives and guidelines, it entailed a systematic examination of industry-wide reports and plant-specific documents.
Structured question-naires and semistructured interviews were administered to and conducted with a range of operating personnel. The activities conducted resulted in the
~~
identification of 70 HEDs which were not identified as a result of other -
DCRDR activities.
2.
System Function and Task Analysis The objective of the Quad Cities system function and task analysis was to establish the input and output requirements of control room operators' l
tasks under emergency conditions.
To accomplish this, the generic Boiling Water Reactor Owner's Group (BWROG) Emergency Procedure GuideliRes (EPGs) i were made plant-specific by subject matter experts who eliminated references to those systems and equipment not found at Quad Cities.
Once the site-7 i
__.m,
.m m.,
specific document was developed, operator actions which were implied or stated were written as task statements.
All unique tasks were identified, coded with a task number, and grouped into the prevailing system being exercised or acted upon.
l The tasks subsequently were broken down into task elements and/or l
action steps by subject matter experts (SMEs) in order to reflect a step-by-step procedural set of actions that must be carried out in order to accom-plish the task. These task reduction activities were accomplished by a series of questions about each task such as task conditions, initiating i
cues, frequency performed, and performance criteria were asked in order to provide additional information about task performance which gave the subject l
matter experts a context in which to discern operator tasks.
This informa-tion was first collected on task development forms, later entered 1.n a database, and then sorted by task number.
This process resulted in the development of the primary data base for the entire DCRDR.
This process was performed outside the control room as much as possi-i ble. As described by the licensee, the task analysis performed for DCRDR purposes was not done from a "what exists" perspective, but rather from the perspective of "what should be."
However, the proximity of procedures.
{
piping & instrument diagrams, electrical schematics, additional expertise and cues which would enable the SMEs to be more thorough, necessitated frequent referral to resources which could have compromised the independence of the analysis effort.
While this process was not accomplished completely independent of the control room, the DCRDR team members, in an iterative process, continued to probe SME responses to ensure that their responses reflected "what should be" as opposed to "what exists" in the control room.
While task development was underway, display and control requirements were collected and coded on Task Analysis Instrument and Control Requirement Forms for each action step. Like the task elements, the display and control requirements were coded from a "what is needed" perspective for action steps.
Coded variables included:
displayed parameter and typerof display, manual control type and action, automatic controller type, parameter units, range, and division. After the requirements of the action st(p's had been defined by the SMEs, the availability phase of the verification process was performed by checking for the existence of required instrumentation in the 8
L control room.
If the required instrumentation were found to be present, then a code number representing that particular item was entered onto the data recording sheets confirming the availability of the required instru-mentation. However, if the required displays or controls did not match what was physically available in the control room, this was coded on the data collection form as a discrepancy or "no match".
Many HEDs were identified as a result of this process.
Overall, CECO's system function and task analysis was conducted in a comprehensive and systematic fashion. The analysis was based on the BWROG's EPGs which were made site-specific, by the deletion of equipment and systems that were not applicable to the Quad Cities Station. Task statements de-rived from the site-specific document were reduced to task elements which were further reduced to action steps necessary to accomplish each task.
Information and control requirements and their associated characteristics c
were derived for each action step.
After the SMEs had defined the instru- '
ment and control requirements for each action step, they were compared to existing control components and a code number corresponding to applicable existing control room components was assigned to the. action step.
During the conduct of this analysis SMEs were able to use schematics, procedures, and other aids from the control room to " enable SMEs to be more thorough."
The primary factor that indicated that these "in control room" task analysis steps did not bias the results of the analysis was the existence of numerous "no-matches" which often resulted in HEDs.
The HFS also lead the SMEs taking part in the analysis with appropriate questioning to make sure that they did not bias their requirements-based analysis through their familiarity with the installed equipment.
The process described above ~
l resulted in an integrated task analysis and inventory comparison rather than l
two isolated steps followed by a formal comparison.
The audit team agreed that in this instance the procedure described above resulted in one of the better task analyses conducted in the industry.
I I
3.
Control Room Inventory i
The Quad Cities inventory effort included compilation of Nn inventory followed by a verification for suitability.
As both activities were 9
mp.
--. ~
-.--m-y---,yr-.y-w--
.gi,--m--
m -, -..
e,,.-
y e+ya a,.,si--_.mn mm.,w
.w e,
eg.sw-y-%
_eiw,ip-wp.4y,-m aqwry-e,g pr-gwe
=-NMr
s necessary to satisfy the inventory requirement of Supplement I to NUREG-0737, both are described below.
i The objective of the Quad Cities control room inventory was to estab-lish a reference set of data which identified all instrumentation, controls, and e.quipment within the control room for comparison with the equipment requirements identified during the task analysis.
All displays, controls, controllers, annunciators, and other equipment in the control room with which the operators interact were included in the very comprehensive inven-tory.
Consistent with NUREG-0700 guidelines, human factors specialists and nuclear systems operators compiled the inventory using direct observation in the control room, and instrumentation diagrams of the control room panels.
All equipment on the front panels, back panels, and common panels..for Quad Cities Units 1 & 2, as well as equipment on the desks and other work-stations in the center area of the control room were inventorted.
Each piece of equipment ort the control boards and its relevant characteristics '
were identified by codes that had been used to characterize equipment requirements from the task analysis.
Inventory data was stored in the computerized data base management system.
Once this was accomplished, a verification of equipment availability and suitability was accomplished. The objective of the verification process was to ensure that operator tasks derived from the plant-specific EPGs could be performed in the existing control room with minimum potential for human error.
There were two aspects to the verification process.
First, as -
desciibed in the system function and task analysis, it was determined whether appropriate equipment was available in the control room to perform each task required by emergency operations.
Second, for equipment that had been identified as available, criteria specified on pages 6-34 through 6-36 of the Summary Report were used to determine whether the characteristics of each piece of equipment made it suitable for the task (whethert it offered the operator sufficient control and display capabilities to accomplish the task efficiently).
This latter step, performed by using the~ computer system, compared the characteristics identified during the task analysis phase and the control room inventory. Any "no match" items were noted as 10
l deviations and an effort was made to resolve these discrepancies. Those deviations that could not be resolved were recorded as HEDs resulting from a lack of control room item suitability.
Overall, Ceco has provided a detailed description of what appears to have been a well-planned and executed control room inventory. The inventory itself was extremely comprehensive and out of more than 7,000 task elements, about 2,000 "no matches" were identified as a result of comparison of the control room inventory with task analysis results. These "no matches" were analyzed and resulted in numerous HEDs.
The documentation process and data management system have been used effectively in an integral manner that helped to produce a successful control room inventory.
Furthermore, this inventory will be a useful tool when the control room is being modified.
CECO has met the control room inventory requirement of Supplement L to NUREG-0737.
4.
Control Room Survey The licensee's control room survey considered the extent to which equipment and the environment in the control room were designed to accommodate basic human characteristics such as physical size and perceptual-motor capabilities.
To conduct the survey, human factors specialists and Commonwealth Edison operations personnel observed and measured control room features i
using human factors guidelines derived from those in Section 6 of NUREG-0700.
As shown in Appendix C, some CECO guidelines differed from those in NUREG-0700. The licensee states that, "some of the items were quantified or -
reworded so as to make them clearer and more precise."
During the pre-j implementation audit, these differences between NUREG-0700 and the CECO checklist were reviewed in detail. The differences are discussed in the following section.
Review of Differences Between NUREG-0700 Guidelines and Ceco Checklist 6
The majority of differences between the guidelines of NUREG-0700 (Section 6) and the CECO checklist are in areas which require evaluation using task analysis results.
Since the task analysis was accomplished only 11
on emergency operations. CECO revised the applicable NUREG-0700 guidelines to show that they are limited to emergency operations.
The audit team i
agrees with this interpretation as long as improvements to instrumentation used in emergency operations do not result in inconsistencies with nonemer-gency (and thus unimproved) instrumentation. To avoid adding to operator confusion, improvements to instrumentation used in emergency operations should be applied to all similar instrumentation.
Several other differences are based on (1) misprints in NUREG-0700; (2) qualitative guidelines which Ceco chose to make quantitative to improve review objectivity; and (3) very minor differences on guidelines of lesser significance. We find these modifications to be acceptable.
The audit team disagrees with the modifications made by Ceco on.the three NUREG-0700 guidelines discussed below:
1.2.3.D.2 0700 Other controls may be mounted as far back as 25 inches from the console edge.
This distance accommodates the extended functional reach of the 5th percentile as defined.
CECO Controls are no more than 30 inches from the conscie edge.
JUSTIFICATION:
The extended functional reach of 5th percentile female is 28.9 inches without stretching.
Locating controls 30 inches from the console edge is realistic in that most operators exceed the value of the 5th percentile female, and they will tend to bend slightly over the console to -
manipulate controls.
l TEAM POSITION:
Extended functional reach is measured from a wall to the tip of the right index finger with the arm extended and the right shoulder extended out from the wall as far as possi-i ble with the left shoulder against the wall.
In order to minimize the potential for inadvertent activation of controls, the operator should not be forced to lean over the benchboard to operate controls on the back portion.
12 l
l l
Since the measurement referred to in the guideline is taken from the front edge of the benchboard, it is not equivalent to the extended functional reach measurement.
In fact, it is 8 to 10 inches less than an extended functional reach.
At 25 inches for control board depth, the guideline of NUREG-0700 has already accounted for some amount of bending by most operators.
- 1. 2. 3. F.1 0700 For control and monitoring actions that must occur in sequence, all necessary controls and displays should be within the maximum extended reach and the viewing rar.ge of the seated operator from a single reference point.
- 1. 2.3. F.2 0700 For the situation described in Item 1 above, and (for) sus-tained or precise control action, the operator should be able to reach the controls without having to bend / stretch significantly.
1 CECO For the situation described in Item 1 above, and sustained or precise control action is required, the controls are within 29 inches.
l JUSTIFICATION:
The extended reach for 5th percentile female is 28.9 inches without bending or stretching. By bending slightly she can reach the 29 inches. This limit more clearly quantifies the criteria.
TEAM POSITION:
As in the previous guideline (1.2.3.D.2), if a measurement could be used, the guideline would probably be that controls should not be farther than 25 inches from the front edge of the console. The reason a measurement was p
not used is that, depending on the task difficulty and duration, 25 inches may be too great a distance to reach, p-3.2.1 C 0700 LIMITS - The signal should capture the operator's attention but should not cause irritation or a startled reaction.
l l
13
i CECO LIMITS - The signal intensity does not exceed 90 dB(A),
C JUSTIFICATION:
The establishment of 90 dB(A) provides a standard to be utilized across all Ceco stations.
This standard does not exceed the maximmum intensity of 90-115 dB( A) found in Guidelines 2.2.6.C for maximum intensity for signals.
TEAM POSITION:
If a quantitative value were to be specified, it should be some maximum value over ambient noise level, not an absolute value of 90 dB(A).
Depending on the ambient noise level. 90 dB( A) may very well startle or cause irritation to the operator.
In addition, intensity is not the only signal quality that might startle or cause irritation.
CECO's survey effort is in accordance with the intent of Supplement 1 '
to NUREG-0737. Instrumentation, control, and other equipment items were examined for human engineering acceptability as components without reference to their specific uses in task performance. Discrepancies were based on design incompatibility with human perceptual, motor, psychological, or size characteristics. The survey effort resulted in the identification of 520 HEDs.
l In summary, the survey effort was complete in that it covered the nine content areas suggested in NUREG-0700 (e.g., workspace, panel design, annun-ciator warning system, etc.).
Environmental conditions, including sound, lighting, and the HVAC system, also were surveyed.
While primarily using -
the guidelines in NUREG-0700 as the basis for their survey, CECO did modify three guidelines to which the audit team does not agree.
The control room should be re-checked for these three items and responses provided if it is not in compliance. Although recommended for review in NUREG-0700 the remote shutdown capability was not considered as part of the CECO review at Quad C,i ties.
l t
14
l l
Remote Shutdown Panel Survey i
o l
Although not explicitly identified as a requirement in Supplement I to NUREG-0737, the NRC has recommended that a human engineering evaluation of the remote shutdown capability be included within the scope of the DCRDR.
Members of the NRC audit team did review the Quad Cities remote shutdown capability and felt that it has many problems such as the following:
e Every local panel and control location required for remote shutdown violates multiple principals of good human engineering and is, therefore, suceptable to human error.
e The time required to shutdown the plant using the remote stations may be excessive.
e The number of keys to be used for access to control locations is considerable and the keys are not located in a group but must be ~
selected individually.
e The positioning of personnel at several locations to start the shutdown procedure presents communications and coordination l
problems.
Appendix E provides a more detailed description of the remote shutdown capability and its perceived problems.
5.
Validation of Control Room Functions Commonwealth Edison Company conducted a validation review at Quad Cities to determine whether the functions allocated to the control room operating crew could be accomplished effectively within both the structure of the established emergency procedures and the design of the control room as it exists.
t.
D Due to the fact that many of Quad Cities' systems, instruments, and controls are identical to Dresden's and the simulator, it was ife~cided that Dresden validation results would be used for Quad Cities where applicable.
For those systems unique to Quad Cities, a supplemental validation would be 15 I
i conducted using a walk-through/ talk-through approach. The events which were used in the validation were:
e a normal reactor startup e a normal reactor shutdown e a small break loss of coolant accident (LOCA) e inadequate core cooling an anticipated transient without reactor scram following the loss of e
offsite power e a reactor scram o a main steam line break inside the drywell.
Operations personnel walked through procedural steps of selected emergency events which were unique to Quad Cities.
Selected emerge.ncy ev' nts were chosen to provide for the exercise of all major systems and e
every control room workstation.
Operations personnel walked through each procedural step and, described the action being taken, the information ~
sources used, any uncertainties involved, the controls used, the expected system response, and how the response would be verified.
A human factors specialist accompanied each operator and observed the relations between operator performance and control board / control room design and evaluated the walk-through against a number of procedurally-related criteria including:
(1) whether units of measurement displayed were appro-priate and consistent with procedure; (2) labels associated with various controls, displays, and annunciators referenced /used were readily identi-fiable; and (3) the operator actions expressed or implied by the procedure
~
were within the capability of the operator (pg. 4-30 of the Program Plan).
Where the human factors specialist observed instances in which equipment availability, suitability or 1pcation could be enhanced, or in which opera-tor uncertainty due to procedural ambiguity could be minimized. HEDs were l
written.
1 The simulator validation was videotaped and the tape reviewed to generate HEDs.
This plan seemed to work very well with the exception that several HEDs were generated which were later cancelled when 1't was found
~
that the condition resulting in these HEDs was actually the result of parallax when viewed on the videotape.
16
The licensee implemented a validation procedure consistent with the guidelines of NUREG-0700. Events chosen for walk-through were consistent with those suggested in NUREG-0700 and exercised all control room work statt..s.
Real-time simulator results applicable to Quad Cities were also considered in the validation.
From analyses performed, 24 HEDs were generated.
ASSESSMENT AND IW LEMElffATION HED assessment and implementation procedures are described in Sections 7 and 8 of the Summary Report.
Volume 2. Sections 1-12 of the Summary Report present review findings.
1.
HED Assessment Methodology The assessment of HEDs generated by the previously described DCRDR activities was accomplished by the HED Assessment Team (HEDAT) composed of the lead human factors specialist, the DCRDR coordinator, the I&C engineer, the Station. Nuclear Engineering Department Station Project Engineer, and the Station Assistant Superintendent for Operations.
The team met and reviewed the HEDs.
Based on team consensus, HEDs were classified into one of three categories (I, II, or III) based on the level of safety relatedness of the equipment in question.
The HEDAT then determined to which of three levels (A, B, or C) of severity each HED should be assigned within each category using specified criteria relating factors described on page 5-3 of the Program Plan, including the plant safety implications of the HED.
I l
The HEDAT-assigned categories are as follows:
l Category I:
Discrepancies associated with engineered safeguard systems (ESS) or engineered safety features (ESF).
Category II:
Discrepancies associated with plant systems not included in Category I.
t Category III: Discrepancies not falling into either CategoYy I or II.
17 l
.. - _ - _,., - - ~,.. - - -..,
n.
c n
e
0 The HEDAT assigned levels of severity as follows:
Level A:
Includes HEDs with documented errors, documented control-based problems or, in the judgment of the HEDAT, may have a significant impact on plant safety and/or productivity.
Level B:
Includes HEDs which may have a moderate influence on plant performance (consequences may delay or impact, but not significantly, the efficient operation of the plant).
Level C:
Includes HEDs with a relatively minimal impact on plant performance (consequence of human error will not lead,,to degraded plant safety system).
As defined above, it appeared that the classification of Category I was only applicable if the deviation was associated with either ESF or ESS.
This limitation presented a concern to the audit team since other systems besides ESF and ESS can impact plant safety. However, at the audit. Ceco indicated that all HEDs with plant safety implications as described in the Final Safety Analysis Report (FSAR) and a number of support systems would be classified as Category I HEDs.
Level assignment was the determining factor in the recommendation to correct HEDs. HEDs in Level A are to be corrected, while HEDs in Levels B and C may or may not be corrected, depending on their relative operational l
significance. Once assessed, personnel from the Station Operations and Station Nuclear Engineering Departments met with the lead human factors specialist, the DCRDR coordinator, and the I&C engineer to review the assessed HEDs and decide which to correct.
Those HEDs to be corrected were differentiated from those not to be corrected, and justifications for HEDs not to be corrected were prepared.
C From a review of both the Program Plan and the Summary Report assess-ment phase methodologies, certain differences were found. Whiletthe follow-ing differences were discussed at the pre-implementation audit with 18 1
representatives of CECO. the NRC audit team indicated that further documen-tation by CECO is necessary for clarificatior, 1.
The reasoning behind CECO's switch from the rating system to be used during the assessment phase as presented on page 5-3 of the i
Program Plan to the consensus method that actually was used by Ceco.
2.
The reason why the Pre-Assessment Form described on page 5-3 of the Program Plan and included in f.ppendix A of the Summary Report, was not considered to be necessary and was not used by CECO.
i 3.
The reason why CECO changed from the four-tiered level rating system of ABCD as presented on page 5-5 of the generic Program Plan to the three-tiered level rating of ABC used by Ceco.
4.
Assurances that cost factors will not impact decisions to correct '
HEDs as presented by CECO at the audit since this is contrary to the statements on page 7-2 of the Summary Report.
5.
Assurance that the audit team's understanding that benefit ratios will not be considered during the assessment phase since page 7-3 l
of the Sumary Report indicates otherwise.
During the audit, it was noted that many HEDs were cancelled by the l
HEDAT. If cancelled, the HED was dropped from the computerized data base and received no further processing.
A subsequent audit of these cancelled
~
HEDs revealed the weakest link in an otherwise superior documentation -
system.
The records of the HEDAT review process as to why certain changes and cancellations were made are not complete.
For instance, the cancelled HEDs were often noted " cancelled, not a HED" with no further explanation.
l The record provided to the audit team was the rough notes of the Ceco DCRDR l
coordinator.
1 n
All HEDs noted as " cancelled, not a HED" were reviewed at the audit.
There were 36 such indications on the record of HEDAT reitew.
In a subsequent session, the lead human factors specialist provided reasons for the cancellation of 24 of the 36.
In the audit team's judgment, of those 19
i 24 two of the " cancelled" HEDs (111-A-VL-3,111-B-05-5) should have been kept in the active HED system and reviewed for possible corrective actions.
This sample tends to indicate that the HEDAT methodology and judgments for the most part were accomplishing the intentions of the DCRDR.
- However, those remaining HEDs that were " cancelled" should have also been retained with.their disposition noted.
In the future, at other CECO stations, more detailed minutes of all HEDAT reviews should be kept, noting the disposition and reasons for actions taken on all HEDs.
The HEDs were reviewed individually by the HEDAT, but some of them were grouped in the Summary Report. During the audit, it was noticed that the category and levels assigned to the grouped HEDs in the Summary Report frequently did not reflect the categorization and level of the most signifi-cant HED in the group. A sample of seven such groups was audited, and. it was found that in four out of the seven the grouped categorization and level was at a lower classification than the ciost significant individual HED in the group.
The worst case noted was a groeping of four HEDs either classi-fled as IA or IB individually; however, when grouped, they were assigned the classification IIIC. The licensee should review all grouped HEDs in the Summary Report for proper assignment of Category and Level.
The process as applied was generally satisfactory, yet there were l'
assessment practices that should be improved at subsequent CECO station reviews.
Furthermore, Ceco should docnent those items described above to help this phase of the DCRDR meet the requirements of Supplement I to NUREG-0737.
2.
Selection of Design Improvements The purpose of selecting design improvements is, as a minimum, to correct safety significant HEDs. Selection of design improvements should include a systematic process for development and comparison of alternative means of resolving HEDs.
Furthermore, according to NUREG-0737, Supplement 1., the licensee should document all of the proposed control rooms changes.
CECO's Summary Report described the process for development and comparison of alternative means for correcting HEDs. However, the major weakness in the selection activity and the DCRDR as a whole is the large 20
number of HEDs that are unresolved.
Both the Summary Report and the audit discussions indicate that many studies and reviews designed to resolve HEDs are yet to be accomplished.
This makes the Quad Cities Summary Report incomplete as required by Supplement 1 to NUREG-0737.
The numerous studies and additional reviews listed in Appendix D are intended to address the many problems that are contained in the Quad Cities HED descriptions.
The results of these studies and reviews will be combined into design packages tailored for correcting HEDs at Quad Cities.
The solutions presented by the design packages will be in accordance with good human factors Engineering principles and ensure consistency throughout the control room.
Although the licensee has described a process for implementing design improvements which indicates its awareness of the need for conventions and implementation of improvements in the control room in an integrated fashion, it has not presented adequate descriptions of design improvemerfts.
According to NUREG-0737, Supplement 1, the Summary Report of the completed review should indicate which HEDs they intend to correct and how they will do this and indicate those HEDs that will be left uncorrected or partially corrected and why.
Presently, Quad Cities has a large number of HEDs that are unresolved. Quad Cities intends to perform numerous studies and reviews that will result in Quad Cities-specific design packages that should resolve the HEDs.
While this seems to be a very thoughtful process, it needs to be documented and submitted as part of the Summary Report.
In addition, this documentation must include justifications for not correcting or partially correcting HEDs with safety significance. This will remain an open item until the NRC reviews the completed design packages and justifications.
3.
Verification that Selected Design Improvements Will Provide the Neces-sary Correction and Can Be Introduced in the Control Room Without Creating Any Unacceptable Human Engineering Discrepancies Ceco has described a process which will provide verification of the effectiveness of corrective actions.
Verification will be performed using p,anel mock-ups incorporating the corrective actions, consul [ation with operators and systems experts, human factors specialist reviews, and possible use of the control room simulator.
Should verification;;show that a corrective action will have a negative effect on control room operations, l
21
the corrective action will be cancelled or altered as appropriate. When accomplished, process should meet the requirement of Supplement I to NUREG-0737.
4.
Coordination of Control Room Improvements With Changes Resulting from Other Improvement Programs Based on information provided in the Summary Report, it would appear that Com=onwealth Edison Co=pany has a coordinated program in place to i
address each of the Supplement 1 to NUREG-0737 initiatives. The Summary Report further states that the program extends throughout its system of nuclear generating stations and has specific provisions for each station.
The program is headed by Ceco Station Nuclear Engineering Department which provides the necessary coordination and support to ensure that a systematic approach is adopted for the inclusion of each of the recommended design changes resulting from these initiatives. Should the licensee link the results of all the separate efforts using automated databases, this will ~
permit the evaluation of all corrections in terms of their synergistic effects as well as their individual value.
Although this process as outlined appears to meet the Supplement I to NUREG-0737 requirement to coordinate control room improvements with changes resulting from other improvement programs, it is preferred to have this information documented to facilitate the review process.
For example, at the Quad Cities pre-implementation audit. Ceco presented a well-organized flow diagram of the Station's coordination program.
Inclusion of a copy of this document along with a detailed explanation should help to satisfy this requirement.
~~
DESCRIPTION OF PROPOSED DESIGN CHANGES AND JUSTIFICATION FOR HEDs WITH -
SAFETY SIGNIFICANCE TO BE LEFT UNCORRECTED OR PARTIALLY CORRECTED Licensees are required by Supplement 1 to NUREG-0737 to submit an outline of proposed design changes, including their proposed schedules for implementation and a summary justification for HEDs with safety significance t,o be left uncorrected or partially corrected.
p em l
l 22
i 1
1.
Proposed schedules for implementing HED corrections Proposed schedules for implementing HED corrections were provided in j
the cover letter which accompanied the Summary Report when it was transmitted to the NRC.
As cited in that letter, proposed schedules are predicated upon NRC approval of Ceco's disposition of each of the HEDs as the schedule is sensitive to the size of the current scope of work. The schedules are subject to the availability of equipment, outage dates, and l
engineering design lead time. Finally, the impact of Reg. Guide 1.97 was l
not factored into the schedules.
As a result, the proposed schedules j
submitted will be finalized after receipt of NRC input and completion of the Reg. Guide 1.97 review.
As proposed, the schedules for completion of the corrective actions have been designated as the completion of the first refueling outage or 'the second refueling outage for Quad Cities Unit 1 and Unit 2.
Ceco identifies September 1987 and October 1988 as the expected first and second refueling -
outage dates for installation of DCRDR modifications at Unit 1.
October l
1986 and March 1988 are the anticipated refueling outage dates for installa-tion of modifications at Unit 2.
Since Unit 1 is expected to have a refueling outage in January 1986, which is really the "first" outage, the I
audit team believes the schedule should reflect the actual outage number rather than "first" and "second." Although implementation dates have been assigned to the specific HEDs on the bases of safety significance category and level, the length of time between identification and possible correction of some HEDs appears to be unrealistic. Supplement 1 to NUREG-0737 indi-cates that improvements involving an enhancement program should be done promptly.
2.
Proposed corrective actions and justifications for HEDs to be left uncorrected HEDs identified during the DCRDR are presented in Volume 2. Sections 1-13 of the Summary Report.
Findings are presented by section nu,mbers which correspond to the DCRDR activity which resulted in identification of the HED. Section numbers and corresponding DCRDR activity include: p-i 23
~ ------
o, i
I = Survey checklist - Contml Room Workspace 2 = Survey checklist - Communications 3 = Survey checklist - Annunciator Warning Systems 4 = Survey checklist - Controls 5 = Survey checklist - Visual Displays 6 = Survey checklist - Labels and Location Aids 7 = Survey checklist - Process Computers 8 = Survey checklist - Panel Layout 9 = Survey checklist - Control Display Integration 10 = Historical Review 11 = Operator Survey 12 = Validation 13 = Verification.
1 Appendix A of this report contains the complete list of HEDs for which proposed corrective actions, or justification for not correcting, were found to be inadequate for one of the reasons described below.
An example of an actual HED which falls within each reason category is provided for clarifi-cation of the category.
The proposed corrective actions or justifications for all other HEDs not cited in Appendix A are found to be satisfactory.
j A1.
The description of the proposed corrective action is too brief, ambiguous, or general to allow an adequate evaluation to be made.
l HE D 1.5.5. A-1 : The discrepancy described is that the background noise level at each of the workstations in the primary operating area is between 60 and 67 DB(A) which is above the recommended maximum of 65 DB(A).
CECO's response indicates that they intend -
to reduce the noise level to within the recommended levels.
However, Ceco does not present a method for accomplishing this task.
This might indicate that a solution has not been finalized.
Furthermore, CECO has proposed to correct this situation prior to the second refueling outage, but, according to its category / level of 2-A, should be corrected by the first refueling outage as it has proposed for HED number 1.5.5.B.1.
1:
I 24
A2.
The proposed corrective action only partially corrects the 4
j discrepancy.
HED 8.1.2. A-1 :
The HED described here is the functional grouping of controls on the horizontal portion of panels 3 and 4 and the I
common panel I which are separated by only 2 inches as opposed to the recommended minimum of 2.5 inches.
CECO's response indicates they intend to use demarcation lines to show functional groupings.
While this response addresses the visual aspect of this discrimination problem, the possibility of inadvertent actuation is not addressed.
Ceco indicates that they intend to use demarcation, color coding, and other visual techniques to correct several HEDs.
Widespread use of these techniques must be carefully coordinated to prevent a visual overload problem.
It. is j
recommended that these types of solutions should be carefully reviewed by human factors specialists prior to final disposition.
Bl.
The justification for not correcting the HED and/or the description of the discrepancy is too brief, ambiguous, or general to allow an adequate evaluation to be made.
HE D 1.5.3. A-1, 1.5.3.B Sec ti on 1 :
The discrepancy described is the lighting levels at a number of locations which fall below the minimum required, while a number of locations have 111umi-nation levels which exceed the requirements.
Ceco's response indicates that there is no apparent problem as a result of the lighting levels and that the operators indicated that the lighting was satisfactory.
While stating that some of the locations were ~
below the minimum required and that other locations exceeded the maximum required illumination levels, the quantitative results of the survey are not stated.
The logic that led Ceco to decide that l
the lighting as described and surveyed presents no problems should be presented.
Minor deviations from the guidelines can be l
tolerated; major deviations should be corrected, e
p 25
B2. The basis for the justification is not adequate for one or more of the following reasons:
a.
It does not address operational or behavioral factors or issues.
b.
It does not sufficiently address the discrepancy.
c.
It cites the absence of previous operator errors.
d.
It cites utility, industry, or manufacturer's standard.
i HED 2.1.1.C.1 Section 2 - The discrepancy is that no pro-cedures are provided for giving priority to transmission of emer-gency messages from the control room.
This may result in the delay of needed communications from the control room.
CECO's i
response states that there are several means of communication from the control room so that there are alternatives available to'the operator.
During an emergency situation when communications and time are paramount, the operators should not have to compete with -
other communications traffic.
Procedures should be developed and
{
strictly adhered to that would not only guarantee communications but would improve the operator's ability to transmit messages.
This HED response can not be accepted as it presently stands.
l l
C.
Additional review or study is required before a solution or justi-fication for not correcting the HED can be provided.
Although an implementation schedule has been provided, no date has been pro-vided for completion of study and submission of a proposed solu-tion for review.
HED 6.1.1 The discrepancy described is equipment which is not properly labeled. Ceco's response indicates that they intend to correct this discrepancy as a result of a consistent labeling package.
This labeling package as well as several other reviews for such items as color coding, demarcation, meter scales and legend lights will apparently be combined to produce ap integrated design package for Quad Cities.
Until this design package is reviewed by the NRC staff, HEDs awaiting the results o,f~ studies or reviews will remain open items.
26
_ _ _..,,. ~..
.,,-~,._.....,., _ -,..,
1 1
D.
Audit team disagrees with response or implementation schedule and provides its position.
HED 4.4.5.E.4-1. F The discrepancy described here is the use of a slotted aluminum block " tool" to operate the thumbuster selector switches which is evidence of the major deviation of the switch resistance and size from the guidelines.
While the " tool" works, its temporary nature makes it susceptible to being dropped, misplaced, or misused and it can slip from the switch during activation.
It is an unacceptable permanent solution to the HED.
CONCLUSIONS AND REC 019tENDATIONS 1
Commonwealth Edison Company's Summary Report for the DCRDR conducted at Quad Cities Station Units 1 and 2 demonstrates a strong commitment towards meeting the requirements of NUREG-0737, Supplement 1.
The documentation submitted provided extensive discussions of the review activities conducted to perform a DCRDR and indicates that Commonwealth Edison basically met most j
of the requirements.
However, additional information is required from the licensee to provide assurances that all requirements as stated in NUREG-i 0737, Supplement I are satisfied.
While the report of the Planning Phsse generally satisfied the require-ments of NUREG-0737 Supplement 1, there were still question; regarding the levels of effort and staffing for the DCRDR tasks.
From our review of the Summary Report, there were concerns with the methodology by which the Review Phase was conducted.
Finally, there was a general lack of reported HED resolutions that indicated that the Implementation Phase was incomplete.
~
The following is a summary of comments on Commonwealth Edison's com-pliance with each of the DCRDR review steps and requirements documented by the Summary Report and confirmed during discussions at the pre-implementa-tion audit. In general it appears that Ceco's effort is one of the better D,CRDR efforts to have been conducted by a utility.
The review. portion was comprehensive, with the task analysis being conducted early enough in the process to become a key factor during the remaining phases of the 1)CRDR.
i l
l 27 i
1 CECO had described a well qualified, adequately staffed DCRDR e
team, which was composed of a good skill mixture to conduct the DCRDR.
Information relevant to levels of effort and staffing on DCRDR tasks was provided at the pre-implementation audit.
This requirement of NUREG-0737 is satisfied.
I Although not a requirement of Supplement I to NUREG-0737, a review e
l of operatir.g experience was conducted consistent with NUREG-0700 guidelines and objectives.
i e
Ceco described a system function and task analysis based on the generic BWROG EPGs which were made plant-specific. All unique tasks were identified and broken down into task elements. Instru-ment and control requirements and relevant charecteristics were
~
identified for task elements. The methodology appears comprehen-f sive and systematic.
While there was a preliminary concern about the independence of the task analysis from the existing control -
room, it is apparent from the audit that the existing instrumenta-tion did not bias the process. Instrument and control require-ments were developed and subsequently checked using an iterative process resulting in numerous HEDs, which is indicative of a properly executed process.
The system function and task analysis of this DCRDR satisfactorily meets the requirements of Supplement I to NUREG-0737.
e The licensee compiled a complete and comprehensive control room invent,ry.
A verification of equipment availability was then conducted by comparing information and control requirements deter- -
~
mined from the task analysis with the equipment present in the control room as identified by the inventory. With assurance that the information and control requirements were derived from a well-executed task analysis, it has been determined that this compari-son satisfactorily meets the requirements of Supplement I to NUREG-0737.
p e
The DCRDR documentation management system, which was ~ automated, proved valuable and well used in all phases of the DCRDR.
l l
28 l
e A human factors survey of the control room was conducted in what appears to be a comprehensive and thorough manner. The method-ology and objectives of the survey essentially were in accordance with the guidance provided in NUREG-0700 and meet the requirement of Supplement I to NUREG-0737.
CECO's deviations from NUREG-0700 in conjunction with applicable justifications for such deviations were submitted and discussed at the pre-implementation audit.
While these discussions resolved a majority of the differences between NUREG-0700 and CECO's checklist, Ceco should amend its checklist to reflect the concerns previously delineated in this report and should re-evaluate the control room in the three areas in which the audit team disagrees with the CECO checklist.
e The process Commonwealth Edison developed to assess the signifi-cance of HEDs does not appear to meet fully the requirement of Supplement I to NUREG-0737.
The HEDAT eliminated 36 HEDs without providing documentation necessary to justify this action.
Fur-ther, some HEDs that had been grouped generally reflected a cate-gory / level lower than the highest individual HED category / level.
These consolidated HEDs must be considered and resolved at the highest category / level among the single elements.
In the Summary Report, it appeared that the Category I HEDs were only associated with engineered safety features (ESF); however, it was the audit team's understanding that all safety-related equipment, as spect-fied in the final safety analysis report and all applicable supporting equipment, were included in the assessment, w-The Pre-Assessment Form, as described in the Program Plan was included in the list of forms in Appendix A of the Summary Report but its use was not described in the text.
The audit indicated that it was not considered necessary and was not used.
While the process developed by CECO to select design improvements e
is satisfactory, the studies and reviews to develop'the design packages for improvements have not been completed.
Un,til these resolutions or improvements can be detailed, this pha'se does not meet the requirements in NUREG-0737 Supplement 1.
29 l
l
l e
Commonwealth Edison has described a formal verification process to ensure that selected design improvements will provide the neces-sary correction without introducing new HEDs. This process, when accomplished, should meet the requirement to NUREG-0737 Supple-ment 1.
i e
The additional information provided by the licensee during the l
audit indicates that it is meeting the requirement to coordinate control room improvements with changes resulting from other improvement programs.
In addition to these general comments, the following is a list of the activities, areas of improvement, and documentation that Ceco should satisfactorily perform in order to meet the NUREG-0737 Supplemen.t I requirements for a DCRDR.
It is recommended that this information be documented in a supplement to the Sumary Report.
1.
Control Room Survey e Ensure that the revised checklist guidelines using task analy-sis results do not result in improvements to instrumentation l
used only in emergency operations that would be inconsistent hith nonemergency instrumentation.
e Modify the three Ceco checklist guidelines discussed at the audit and restated in this paper so they will be in accordance with the criteria of NUREG-0700.
These revised guidelines should then be incorporated into CECO's review process and '
applied to the Quad Cities Station control room review.
2.
Assessment of HEDs Document the reasoning behind CECO's switch from the rating e
system, presented in the Program Plan to be used.iduring the assessment phase to the consensus method that was actually used.
U l
30
e Document why Ceco changed from the four-tiered level rating system presented in the Program Plan to the three-tiered level rating used.
e Ensure the NRC staff that cost factors will not impact decisions to correct HEDs as presented by Ceco at the audit since this is contrary to what was printed in the Summary Report.
e Ensure the NRC staff that benefit ratios as described in the Sumary Report will not be applied during the assessment phase.
e Provide detailed documentation for the HEDAT's justification for cancelling 36 HEDs during the assessment process.
e Provide assurance that those HEDs that have been grouped together reflect the categorization and level of the most -
significant HED in the group.
i e Document the reasoning for not using the Pre-assessment Form as described in the Program Plan.
3.
Selection of Design Improvements e Complete the studies and reviews listed in Appendix D.
Provide the NRC with a description of the design packages that result from these studies and how these results will be used to correct the control room discrepancies.
~
e Resolve the inadequacies in the proposed corrective actions and justifications for not taking corrective actions for the HEDs specified in Appendix A of this report.
4.
Coordination of Control Room Improvements e Provide to the NRC a diagram of the station's cpordination program. This flow diagram should be accompanied by a detailed functional explanation.
31 l
l
REFERENCES 1.
" Commonwealth Edison Company Quad Cities Station Detailed Control Room Design Review Final Summary Report," Commonwealth Edison Company, May 1985.
2.
" Generic Detailed Control Room Design Review Project Program Plan for Commonwealth Edison Company " Section 1-3 of Attachment to letter to N.R. Denton from C. Reed, Commonwealth Edison Company, RE: Response to Generic Letter No. 82-33, April 14,1983.
3.
"NRC Staff Comments on the Commonwealth Edison Company Generic Detailed Control Room Design Review Project Program Plan " July 11, 1983.
4.
NUREG-0660. Vol.1., "NRC Action Plan Developed as a Result of the 1MI-2 Accident," USNRC, Washington, D.C., May 1980; Rev.1. August 1980.
5.
NUREG-0737, " Requirements for Emergency Response Capability," USNRC, Washington, D.C., November 1980.
6.
NUREG-0737 Supplement 1
" Requirements for Emergency Response Capability " USNRC, Washington, D.C., December 1982, transmitted to reactor licensees via Generic Letter 82-33. December 17, 1982.
7.
" Guidelines for Control Room Design Reviews " USNRC, Washington, D.C., September 1981.
8.
NUREG-0800, " Evaluation Criteria for Detailed Control Room Design.
~~
~
Review." USNRC, October 1981.
9.
" Quad Cities Station DCRDR Pre-Implementation Audit Report," Comex Corporation, June 17, 1985.
l I.
I'.~
i 32 1
1
APPENDIX A HEDs listed in Volume 2 of the Summary Report for which Corrective Actions or Justifications for Not Correcting were proposed A1. The description of the proposed corrective action is too brief, ambig-uous, or general to allow an adequate evaluation to be made.
HED No.
Section-Page 3.3.3.E-1 3-21 6.2.4.D-1 6-12 5.1.2. 05.1 11-16 1.1.1. A V 15 13-9 The proposed corrective action only partially corrects the discrepancy.
A2.
HED No.
Section-Page HED No.
Section-Page 2.1.8.A-1 2-8 1.5.5.D1 05-1 2-10 2.2.1.B-1 2-10 8.1.2.A-1 8-5 2.2.1.C.2-1 2-10 6.1.1 V, 14 13-50 i
Bl. The justification for not correcting the HED and/or the description of the discrepancy is too brief, ambiguous, general, or does not cover all cases, to allow an adequate evaluation to be made.
i
~~
HED No.
Section-Page HED No.
Section-Page 3.1.4-1 3-7 1.1.1.B V 10 13-6 4.3.1.B-1 4-9 1.1.1.B 05.2 13-6 4.3.3.C.3-1 4-11 1.1.1.A V,25 13-14 1.1.1. A VL,7 12-6 4.1.1.A.2 V,1 13-21 1.1.1.8 05,7 12-6 u
1.1.1.8 VL 5 12-9
~
1.2.2.E VL,5 12-14 3:
33
.l B2. The basis for the justification is not adequate for one or more of the following reasons:
1.
It does not address operational or behavioral factors or issues.
2.
It does not sufficiently address the discrepancy.
3.
It cites absence or previous operator error.
4.
It cites utility, industry, or manufacturer's standard.
i HED No.
Section-Page i
3.2.1.E-1 (1,2) 3-10 4.2.1.A-1 (1,2) 4-5 9.1.1.E-2 9-2 C.
No proposed solution or justification for not correcting is provided as the HED is undergoing study or additional review.
HED No.
Section-Page HED No.
Section-Page 2.1.7.B-1 2-7 3.1. 2. C.2 -1 3-4 2.1.8.D.5-2 2-9 3.1. 2. C.3 -1 3-5 2.2.1.B-1 2-10 3.1.5.B.1-1-1 3-8
- 2. 2.1. C. 2 -1 2-10 3.15.A-1 3-8 1.5.5.01 05-1 2-10
- 3. 2.1. 0-1 3-9 2.2.2.A-1 2-11 3.2.1.F-1 3-11 2.2.5.A-1 2-12 3.2.A.F 05.2 3-11 2.2.5.B-1 2-13 3.3.1.A-1 3-12
"~
2.2.6.A-1 2-14 3.3.1.B.1-1 3-13 l
2.2.6.C-1 2-15 3.3.2.B-1 3-15 l
3.1.2. A.1-1 3-1
- 3. 3. 2. F.1 -1 3-16 3.1.2. A.2-1 3-2 3.3.3.B-1 3-17 3.1.2. A.2-2/05 3-2 3.3.3.C.1-2 3-19 3.1.2. A.2-3 3-2 3.3.4.A-1 3-22 3hl.2.C.1-1 3-3 3.3.5.C.1-1 p 3-25 3.3.4.C-1 3-3 3.3.5.C.1-2 3-25 l
3.3.4.C-2 3-3 3.3.5.D.1-1 1:'3-25 3.3.4.C-3 3-3
- 3. 3. 5. D. 2 -1 3-25 3.3.4.C-4 3-3 3.3.5.0.4-1 3-25 34 l
HED No.
Section-Page HED No.
Section-Page 3.3.5.D.5-1 3-25 5.4.2.B.4/05-2 5-36
- 3. 3. 5. D. 6 -1 3-25 6.1.1-1 6-1 4.2.2.A-1 4-6 6.1.1-2 6-2
- 4. 2. 2. F.1 -1 4-8 6.1.1-3 6-2 4.4.1.B-1 4-13 6.1.1-4 6-3 4.4.5.B-2 4-20 6.1.1-7 6-4 5.1.1.B.1-1 5-2 6.1.1.H-5 6-5 5.1. 2. D.1 -1 5-4 6.1.2. A.2-1 6-6 5.1.2.E-2 5-8 6.1.2. A.3-1 6-7 5.1.3.A-1 5-9 6.1. 2. B. 3 -1 6-8 i
5.1.3.D.2-1 5-11 6.2.1. A-1 6-9 5.1.3.D.3-1 5-11 6.2.1.B-1 6-10 5.1.4. A.1-3 5-13 6.1.2.A-1 6-10 5.1.4. A.1-1 5-13 6.3.7.A-1 6-10 5.1.4. A.1-2 5-13 6.2.2.A-1 6-11 5.1.5. A.1-1 5-14 6.6.1.B-1 6-11 5.1.5.C-1 5-16 6.3.1.A-1 6-13 5.1.6.C.1-1 5-17 6.3.2.B-1 6-13 5.1.6.C.2-1 5-17 6.3.2.C-1 6-13 5.1. 6. D.1 -1 5-17 6.3.2.D-1 6-13 5.3.2.A.2-1 5-17 6.3.2.E-1 6-13 l
5.2.1.B 5-18 6.3.3.A-1 6-14 5.2.2. A.2-2 5-19 6.3.3.A-2/05 6-14 5.2.3.A-1 5-20 6.3.9.A-1 6-19 5.3.2. A.1 -1 5-25 6.6.3.A.3-1 6-22 5.3.3. A.2-1 5-29 6.6.3. A.2-1 6-22 5.3.3. A.3-1 5-29 6.6.3.4.4-1 6-23 i
5.3.3.B.2-1 5-30 6.6.3. A.1-1 6-23
- 5. 3. 3. C-1 5-31 6.6.3.B.3-1 6-24 5.4.1.A-1 5-32 7.1.8. A.2-1 7-13 5.4.1.B-1 5-32 7.3.2. A.2-1 7-14 51,4.2.B.3 -1 5-32 7.2.7.H-1 q -27 7
5.4.2. A.1-1 5-33
- 7. 2.7. K.1 -1 7-28 5.4.1.C-1 5-33
- 7. 2. 7. L.1 -1 1: 7-29 5.4.1.K-1 5-34
- 7. 2.7. L.2 -1 7-30 5.4.2.B.4-1 5-36
- 7. 2. 7. L. 3 -1 7-31 l
35
=
=.
e, HED No.
Section-Page HED No.
Section-Page i
I 7.2.8.A.2-1 7-33 8.2.1 VL,3 12-23 8.1.1.B-1 8-1 1.1.1.A V,6 13-3 8.1.1.B-2 8-2 1.1.1.A V,9 13-5 8.1.1.B-3 8-3 1.1.1.A V,11 13-7 8
8.1.2.A-2 8-6 1.1.1. A V,14 13-8 i
8.2.1.C.1-1 8-7 1.1.1.A-V-17 13-10 i
8.2.2.A-4 8-11 1.1.1.B-VL-2 13-10 8.3.2.D.1-1 8-14 1.1.1.B V-9 13-10 9.2.2.D-1 9-4 8.1.1.C-05-1 13-10 5.0 HR 2 10-3 1.1.1. A V.18 13-11 i
8.2.1.A.2.HR-1 10-4 1.5.3.F V,5 13-16 0.0 05.3 11-1 3.1.2.A.2 V 4 13-17 1.1.1.8 05.1 11-3 3.1.2.C.1 V.2 13-18 1.5.1.0 05.1 11-8 3.3.3.C.1 V,3 13-19 3.1.2.D.1 05.2 11-13 3.3.4.0 V 2 13-20 3.3.1.A 05.2 11-14 3.3.4.D-1/05 13-20 6.1.1 05,6 11-22 3.3.4.0-1 13-20 6.6.3 05, 1 11-22 5.1.1. A.1 V.1 13-25 l
6.6.3 05, 2 11-24 5.1.1. A.1 V.22 13-30 7.2.2.B.1/05.2 11-26 5.1.1.A.3 V.3 13-32 8.1.1.8 05-7 11-28 5.1.2.A V.1 13-33 8.1.1.B-05-8 11-29 5.1.2.A V.2 13-34 l
8.1.1.2. 5-1 11-32 5.1.2. A V.3 13-35 8.2.1.C.1 05 11-34 5.1.2.D.1 V.2 13-36 1.1.1. A VL,1 12-4 5.1.2.D,1 V.3 13-37 1.1.1.A V. 21 12-4 5.1.2.D.1 V.4 13-38
~
1.1.4.VL,1 12-10 5.1.2.D.1 V,6 13-40 1.1.4.VL,2 12-12 5.1.2.D.1 V,7 13-41 1.1.5 VL 6 12-13 5.1.6.D.1 V.2 13-43 5.2.3.VL 1 12-17 5.1.6.D.1 Y.3 13-44 5.4.2.B.4 VL,2 12-18 6.1.1 V 8 13-45 6.i,.1.VL-1 12-19 6.1.1 V.9 13-46 6.6.3 VL,2 12-20 6.1.1 V.10 13-47 8.2.1 VL 1 12-21 6.1.1 V.11 13-48 8.2.1 VL,2 12-22 l
36
HED No.
Section-Page HED No.
Section-Page 6.1.1 Y,13 13-49 6.3.3.B V.1 13-56 6.1.1 V,14 13-50 6.3.3.B V,2 13-57 6.1.1 V.16 13-51 6.3.3.C V 2 13-58 6.2.1.A V,2 13-52 6.3.8.A Y,2 13-59 6.3.2.F V.1 13-54 8.2.1.C.A V,9 13-60 6.3.3.A V.2 13-55 9.3.2.B V.1 13-61 D.
Audit team disagrees with response or implementation schedule and provides its position.
HED Nos. 1.2.2.B.1-1. C-1. D.1-1. D.2-1, 1.2.3.C-1 D.1 Six guidelines are violated.
Proposed corrective action responds to two guidelines and only partially improves condition.
Round knobs on front row controls should be installed by completion of first refueling outage.
Response must address inadvertent actuation of all other
~
controls by short operators who will lean on the control boards (with a hand) to reach vertical board controls.
HED No. 1.1.4.D-1 The response reflects a periodic review, not something to be accom-
[
plished by completion of the second refueling outage.
HED Nos. 1.5.5.A-1, B.1 HEDs are related. Both are assessed as Category 2. Levei A.
Correc-tive action on both shsuld be accomplished by completion of the first refueling outage.
HED Nos.1.5.3. A-1, B-1, C-1. E.1-1. E-2-1. F-1. F 052 F 053, F 054 HEDs describe lighting problems of low illumination level and excessive glare.
The resolution indicates that glare is to be reduced but illu-mination level is not to be improved.
Some areas of low illumination
,, are significant and should be improved. The audit team belie.yes that a combined solution is warranted to correct both problems.
it l
37
HED Nos. 1.3.2.A-1, B-1 The Category 1. Level B, severity assigned to one of these HEDs, along with the fact that the HED exists on both major and minor systems, requires a better justification for no action, or consideration of some action such as improvement to heriarchical labeling, mimics and demarcation.
HED No.1.3.1.E.5-1 Category 1. Level C. HED with insignificant corrective action does not warrant waiting for fuel outage.
HED Nos. 3.4.2. A-1, B.1-1 The responses to these two HEDs appear to be reversed. It is assumed that the annunciator controls will be re-positioned, color shaded,,and color coded consistently, and will be differentiated from other controls.
HED Nos. 4.4.5.E.4-1. F-1 As explained earlier in the text, the slotted aluminum block " tool" required to operate the thumbuster selector switches is evider.ce of the major deviation of the switch resistance and size from the guidelines.
Its temporary nature makes it susceptible to a series of problems which make this " tool" an unacceptable permanent solution to the HED.
HED No. 5.1.1. A.2-1 Unused displays should be removed by completion of the first refueling outage.
HED No. 5.1.2.E.1 Meter scales should be changed to reflect a standard multiplication factor to improve consistency in control room and eliminate one more source of potential confusion to the operator.
h, HED Nos. 5.3.1. A.1-1 A.3-1 q
The primary concern with lamp failure is on single status lights (not dual open/ closed lights) which are normally off but which:111uminate when status changes.
Unless they can be tested, there is little assurance that they are working.
During the onsite audit, members of 38
the audit team observed an operator perform a switching function to demonstrate one such status light.
It did not illuminate.
The operator was not successful in accomplishing replacement of a bulb that would illuminate nor was he successful in determining the cause.
As to an operator's responsibility to inspect and replace burned out indicating light bulbs at the beginning and end of each shift the audit team observed too many burned out bulbs to accept this procedure as a satisfactory solution.
l l
HED No. 5.3.3. A.1-1 Some of the standard square legend indicating lights observed in the control room during the audit did not provide enough contrast to be readily distinguished when lit. These should be replaced.
HED No. 6.5.2.1 Administration procedures for the control and use of temporary labels ~
should be in place by completion of the first refueling outage.
HED Nos. 7.1.4.E.1. A-1 7.1.7. 8-1 7.2.3.B-1 7.1.4.E.2. A-1
- 7. 2.1. F.2-1 7.2.3.C.2.A-1 7.1.4.G-1 7.2.2.8.1-1 7.2.3.D.2. A-1 7.1.5.C-1 7.2.2.C-1 7.2.5.H-3 7.1.5.D.1-1 7.2. 2. 0-1 7.2.7.M.1-1 7.1.5.D.5-1 7.2.2.E-1 7.3.1.D-1 1
i 7.1.7. A-2
- 7. 2. 2. G.2 -1 7.3.3.D.1-2 7.1.7.A-1 l
The above represent twenty-two guidelines that are being violated. -
These HEDs are related to the process computer peripherals installed at Quad Cities.
Some of these HEDs were discussed at the audit in which CECO indicated that these computer peripherals were intended to provide the operator with plant status during normal operations and that the printer was only for recording historical data.
It was also learned that the plant was in the process of changing from their old G.E.
computer to a new Honeywell system.
While each individual HED is not considered to be a serious problem, the audit team is codi~erned that such a large quantity of HEDs are written against a particular system.
The responses to these discrepancies should further clarify issues 39
_ = _
i concerning operational or behavioral factors and address the topic of cummulative and interative effects.
HED No. 8.2.1.C.1-2 The audit indicated that the background shading proposed will not resolve the discrepancy involving the controls cited. While a good i
simic and shading will help, the entire board is laid out in such a fashion that these solutions will produce a very complicated visual picture. Suggest that this problem be reviewed for a more adequate solution such as relocation of the controls.
HED No. 8.2.2.A-3 As discussed at the audit, the use of background shading as proposed appears to be an inadequate resolution.
Suggest that the controls and displays be reconnected in a more logical sequence.
HED No. 9.1.2.A.1,
The category and level of this HED need to be defined. Since this control / display relationship is different from the rest of the control room, the use of background shading is an inadequate resolution for this discrepancy.
HED No. 8.1.1.C.05-2 4
The audit team examined the 90X-54 panel (off-gas) and found displays and controls that have never been used. Additional items were found to be " tagged out" since 1983.
While this panel does not contain emergency controls, the audit team agrees with operator survey that the design of this panel does not facilitate efficient and safe operation.
~~
It is suggested that this panel be reviewed and made to conform to good human engineering practices such as removal of unused displays and controls, and replace, repair or removal of items tagged out.
I HED No. 1.1.1.VL-2 l
While the RHR system functions automatically during emergencies, the l
flow indication must be obtained by the operator. This Category 1 Level A HED indicates that it is difficult to obtain the flod. rate from a recorder located over the "B" loop when operating the "A"
loop.
l 40
Better justification or some improvement action such as an additional recorder for the "A" loop is required.
HED No. 1.1.1.BVL, 4 If the system is automatic, as indicated, it is not clear why there is a CCST level indicator on Unit I and not on Unit 2.-
Furthermore, the supplementary crew members do not make up for the lack of such indica-tion on Unit 2 during an emergency situation. Since this Category 1 Level B HED is a product of the validation process, more complete justification or corrective action is required.
HED No. 1.1.1.AV, 1 This is similiar to HED 1.1.1.BVL, 4.
The response indicates that a function is automatic, however, verification showed that the operator needed this information. The response further indicates that Unit 2 is reliant upon Unit I for information.
It is suggested that if this information is needed, Unit 2 should be supplied with these indicators.
HED No. 1.3.1.E.3V, 1 Ceco's response indicated that procedures are in place to support the operators' ability to determine availability of status indication for the two CCST meters which are not located on Unit 2.
As reviewed at the audit, the procedure change which directs a third person to assist the Unit 2 operator is not an adequate response to this Category 1, Level B problem.
HED Nos. 4.1.1. A.2V.2 ; 4.1.1. A.2V, 3 These two HEDs refer to throttle-able control valves that apparently do not have spring returns.
As explained for HED 4.1.1.A.2V, 2, the worst consequence that could happen from this design is the loss of manual control of the control rod drive.
According to the plant operation personnel this has occurred before without any impact on plant perform-ance. However, the audit team is not sure whether manual control of the control rod drive is required during any emergency procedure and, if so, how the operators are made aware of the difference in" operating 5
characteristics of these controls. Secondly. NUREG-0700; guideline 6.8.2.3.a recommends that all identical controls should be consistent l
41 i
o, at all locations suggesting that the licensee review all throttle-able control valves for spring return characteristics.
4.4.5.D.2, V2 This Category 1. Level B HED requires a better justification for no action that would resolve the closely spaced switch-positions on these range selectors.
e Il
~
i I:
42
APPENDIX B PRE-IMPLEMENTATION AUDIT MEETING June 10,1985 Robert E. Howard CECO DCRDR Coordinator Kathleen A. Nesse Ceco Human Factors Kim Siler ARD Human Factors Chris Plott ARD Human Factors Gene Silverman ARD Lead Human Factors Engineer Albert D. Morrongiella NRC Resident Inspector Jim Swales Ceco Operations Engineer -
Quad Cities Jim Schnitzmeyer CECO Assistant Technical Staff Supervisor Tom Tamlyn CECO Services Supt.
Nick Kalivianakis Ceco Station Manager Joe Moyer NRC/SAIC Human Factors Joseph B. Winter ARD Human Factors Whit Hansen NRC/COMEX Operations Phuoc Le NRC/SAIC Human Factors / Systems Analyst Richard J. Eckenrode NRC/DHFS/HFEB DCRDR Team Leader Larry E. Davis CECO Station Support Services l
~~
e 4.
~
1:
l 43
PRE-IMPLEHENTATION AUDIT MEETING June 11, 1985 Robert E. Howard CECO DCRDR Coordinator Joseph.B. Winter ARD Human Factors Joe Moyer NRC/SAIC Human Factors Phuoc Le NRC/SAIC Human Factors /
Systems Analyst Whit Hansen NRC/CDMEX Operations Richard J. Eckenrode NRC/DHFS/HFEB DCRDR Team Leader Robert L. Kershner ARD Corp.
DCRDR Lead Human Factors Specialist Gene Silverman ARD Corp.
DCRDR Lead Human Factors.
Specialist (Backup)
Steve Cooley ARD Corp.
Senior Human Factors Specialist Ray Christensen CECO Operations - Dresden Larry E. Davis Ceco Station Support Services Kathleen A. Hesse Ceco Human Factors - Technical Staff Nuclear Chris Plott ARD Human Factors Engineer l
Mike Tucker Ceco /SNED Principle Engineer, Electric Zygi J. Boxer Ceco /SNED 0737 Integration Coordination Jim Krass SEED
~
CECO I & C Kim Siler ARD Human Factors l
t l
- i. -
44
PRE-IMPLEMENTATION AUDIT MEETING i
June 12, 1985 l
Robert E. Howard CECO DCRDR Coordinator J.B. Winter ARD Human Factors Joe Moyer SAIC Human Factors Phuoc Le SAIC Human Factors Whit Hansen COMEX Operations Richard J. Eckenrode NRC/DHFS DCRDR Team Leader Robert L. Kershner ARD LHFS Don Taylor ARD Human Factors Engineer Larry E. Davis Ceco Station Support Services Chris Plott ARD Human Factors Kim Siler
'ARD Human Factors
~
Jim Krass SEED Ceco I & C Steve Cooley ARD Human Factors Kathleen A. Hesse CECO Human Factors e
g$
~
- 1 45
PRE-IMPLEMENTATION AUDIT MEETING June 13, 1985 Robert L. Kershner ARD LHFS Larry E. Davis CECO Support Services Robert E. Howard CECO DCRDR Coordination Albert D. Morrongiello NRC Resident Inspector Whit Hansen NRC/COMEX OPS, Consultant Richard J. Eckenrode NRC/DHFS DCRDR Team Leader Joe Moyer NRC/SAIC Human Factors Brian R. Strils Quad Cities Sta.
Compliance Coordinator Jim Swales Quad Cities Operations Engineer Tom Tamlyn QCNPS Services Supt.
Nick Kalivianakis QCNPS Manager Steve Cooley ARD Human Factors Don Taylor ARD Human Factors Mike Tucker Ceco EE/SNED J.B. Winter ARD Human Factors Chris Plott ARD Human Factors Kim Siler ARD Human Factors I
l e
~
46
1._:
APPENDIX C Differences Between NUREG-0700 and Ceco Checklist Presented at Quad Cities Station Pre-Implementation Audit on June 11. 1985 1.1.1.A 0700 PRESENT IN ThT CONTROL R005 Control moon instrumentation and equipment should include all cony.rols and displays needed for (1) detection of abnormal conditions, and (2) bringing the plant to a safe shutdown condition.
2 00 PRESENT IN THE CONTROL R0051he control roos contains all controls and displays required by the 1hsk Analysis for emergency operations.
JETIFICATION: Abnormal conditions and shutdowns are covered in the task analysis.
1.1.1.3 0700 ARRAN2D TO FACILITAE COVERACE-Operstors should not have to leave the primary operating area (see Exhibit 6.1-1)'
to attend to ccntrol room instrumentation on kek panels during ope::stional sequences in which continuous monitoring or the timing of control actions may be critical.
CECO ARRANGED 10 FACILITAE COVERA 2-A11 controls and displays needed during emergency operation are contained within the primary operating area (see Exhibit 1-1).
JE TIFICATION: The scope of the DCRCR covers only those instruments required during emergency operations.
1,1,2.A 0700 COVERA 2-Control room manning and task assignments should ensure complete and timely coverage of controls, displays, i
and otMr equipment required during all modes of operation.
CECO COVERA 2-Control room manning and task assignments ensure complete and timely coverage of controls, displays, i
and other equipment required during emergency operations.
JE TIFICATION: The scope of the DCRCR covers only those instruments required during emergency operations.
1.1.2.B 0700 UTILIZATION OF ADDITIONAL PERSONNEL-Additi nal onsite or offsite personnel may augment the normal crew complement under certain conditions (e.g., refueling)i. If so, activities and task assignments should be planned to ensure proper coordination.
(Note: special training for thissituationanyberequired.)
J 47
1.16t.B 2 00 IFTILIZATIDN OF ADDITIONAL PERSONNE1,-Proceduns/policiss addn as W need for additional onsite or offsite personnel to augment the normal crew complement under certain conditions as defined by 200 Cenerating Station Emergency Plan.
JISTIFICATION: he scope of the DCROR covers only those instruments i
requind during emergency operations.
1.2 3.D.2 0700 Other controls may be mounted as far back as 25 inches from the console edge. This distance accomodates the extended functional reach of
- 5th percentile as defined.
ECO Controls are no more than 30 inches from the console edge.
JUSTIFICATIO!;: ne extended functional reach of 5th percentile female is 28.9" without sintching. I,ocating controls 30" from the console edge is realistic in that most operators exceed the value of the 5th percentile female and by will tend to bend slightly over the console to manipulate controls.
f 1.2 3.E 0700 DISPLAY PCSITIONING-D e principal factors affecting the nadability of displays, including annunciator tiles, are (1) display height and orientation relative to the operator's line of sight when he/she is standing directly in front of the displayr (2) display distance and orientation relative to the operator's straight-ahead line of sight when the operator must read the display from an off-side position and (3) the size of display markings relative to the distance at which the display must be road. Marking / character size is addressed in Guideline Section 6 51. and is not i
considered here. Except as specifically noted, measurements of angles should be made with the eye point in line with the leading edge of h benchboard. h is is illustrated in Exhibit 6.1-7 2 00 DISPLAY PCSITIONING-h principal factors affectin6 the readability of displays, including annunciator tiles, ares (1) display Leight and orientation relative to the operator's line of sight when he/she is sitting directly in front of h display: (2)displaydistanceand orientation relative to the operator's straight-ahead line of sight when the operstor must read the display from an off-side position and (3) W size of display markings relative to the distance at which h display must be road.
Marking / character size is addressed in Cuideline Section 5.ie and is not considered here. Except as specifically notedi asasurements of angles should be made with h eye point in line with h leading edge of the benchboard. 2 1s is l
illustrated in Exhibit 1-10.
l 48
1.
3.E JUSTIFICATION: Possible misprint in 0700. he word " standing" has been changed to " sitting" in ites one of the description of display positioning for " sit 4own" consoles.
1.2 3.F.1 0700 For control and monitorins actions that must occur in sequence, all necessary controls and displays should be within the maximum extended reach and the viewing range t
of the seated operator from a sin 6 e reference point.
1 2 00 For control and monitoring actions that must occur in sequence during emergency operations as determined from the task analysis, all the necessary controls and displays an within the maximum extended zeach ani the viewing range of the seated operator from a sin 6 e reference point.
1 J1ETIFICATION: he scope of DCRCR covers only those instruments required during emergency operstions.
1.2 3.F.2 0700 For th3 situation described in iten 1, above, and sustained
_r or precise control action, the operstor should'be able to reach the controls without having to bend / stretch significantly.
2 00 For the situation described in item 1, above, and sustained or precise contzel action is requized, the controls are l
within 29 inches.
JUSTIFICATION: De extended Isach for 5th percentne female is 28.9" without bending or stretching. By bending slightly she can reach the 29 inches. his limit more clearly quantifies the criteria.
.. 1.2 5.A.2 0700 Controls requirin6 Precise or frequent operation and t
emergency controls should be placed in an area between
$ inches and 53 inches above the floor.
2 00 Emergency controls, as identified in the task analysis, are placed in an area between $ inches and 53 inches above the floor.
JUSTIFICATION: he scope of the DCRCR covers only those ins,truments 3
required during emergency operations.
p-I 49
1,I.8.C 0700 AR) DES'!S-When personnel any namin seated for relatively 2
lon6 periods, chairs with arsresta are prefernd.
Adjustable or utzsetable armresta any b necessary to allow the elbows to rest in a naturni pos1 Mon and for compatibility with a particular desk / console.
2 00 ARPOES'IS-Where personnel may remain seated for relatively long periods, chairs with arzresta are provided.
JtETIFICATION: Adjustable armrests are not viewed necessary. Operators do not sit for long periods performing manual tasks.
Arzrests are provided on chairs.
1.2.6.T 0700 SEAT ADJ1 STABILITY-For chairs at sit-down stations, seat height should generally be adjustable from 15 to 18 inches (Exhibit 6.1-19). For chairs at sit-stand stations, seat height should be adjustable from 26 to 32 inches (Exhibit 6.1-20).
2 00 SEAT ADJ1ETABILITY-For chairs at sit down stations, seat height is adjustable from 15 to 18 inches (Exhibit 1-17).
For chairs at sit-stand stations, seat height is adjustable 7
from 26 to 30 inches (Exhibit 1-18).
JLETIFICATION: Voodson,1981 pg. 682, allows for chairs, used ' t sit-stand a
stations, to adjust to a maximum of 30 inches..
1 5 3.B 0700 WIFORMITY '!he level of illumination should not vary greatly over a given work station.
2 00 WIFORMITY '!he level of illumination does not vary more than 10 fc over a given work station.
J1ETIFICATION: '!he establishment of 10 fc provides a standard to be utilized across all 200 stations.
O l
st 99 E~
50
i DIMEREN3S E7VEEN NUREG-0700 AND 200 CHECKLIST I
3 2.1.C 0700 LIMI7S-1he signal should capture the operator's attention but should not cause irritation or a startled reaction.
2 00 LIMITS-7he signal intensity does not exceed 90 dB(A).
JtSTIFICATION: The establishment of 90 dB(A) provides a standard to be utilized across all ECO stations. This standard doas not exceed the maximum intensity of 90-115 dB(A) found in Guideline 2.2.6.0 for marimum intensity for signals.
3 2.1.D 0700 EECTION-Each auditory signal should be adjusted to result in approximately equal detection levels at nozzal operator work stations in the primary operating arsa..
2 00 DEECTION-All auditory signals are within (12 5dB) of the average of all annunciator auditory signals.
JISTIFICATION: 0700 criteria is based on ")DT.B Preferred Practice".
(12 5dB(A)) better quantifies this criteria and are detectable.
k.
gi II 51
DIFERENCES BE7VEEN NUREG-0700 AND 200 CHECKLIST 4.1.1.A 0700 ADEQUACY-Each control should be adequate for the function it performs.
f 2 00 ADEQUACY-Each control used for emergency operations should be adequate for the funct4.on it perfozus.
J1ETIFICATION:
h scope of the DCRCR covers only t_ hose instrumenta required during emergency operations.
4 -
4.1.1.3 0700 ECONOMY-Esch control should be necessary, and the simplest effective control for the task concerned.
CECO ECONOMY-Esch control should be necessary, and the~ simplest effective control for the emergency tasks performed.
i JLETIFICATION, h scope of the DCRCR covers only those instruments -
_r required during emergency operations.
4.2.1 0700 DIRECTION OF MOVEENT-To minim 4*e operator error, control movementa should conform to the following population stereotypes (for U.S. population only):
2 00 DIRECTION OF MOVEENT-Control movementa conform to the following population stereotypes (for U.S. population only):
JUSTIFICATION: 0700 specifications for "zmise" and " lower" are too strict. MIL-STDC, pg 63, 5 4.1.2.1 and van Cott and Kinksde, p 350, table 8-2 are less strict.
4.2.2.C.4 0700 hn knob thickness is a coding parameter, differences between thicknesses should be at least 0.4 inch.
ECO hn knob thickness is a coding parameter, the difference between thicknesses is at least 0 375 inch.
JUSTIFICATION: hn knob thickness is a coding partmeter, the difference between thickness of at least 0 375 inches as supported in McCormick.
52
DIF7ERENCES ELtfEN NUREG-0700 AND 200 CHECKLIST 4.2.2.B 0700 LOCATION CODING-Controls should be located so as to be easily n lated to functions and functional groupings.
Controls with similar functions should be in the same location from pnel to panel.
(See Guideline 6.8.2 3.)
2 00 LOCATION CODING-Controls are located so as to be nlated to functions and functional gruopings.
l JtETIFICATION: 0700 wording creates confusion. 0700' criteria implies that' t
all controls with certain functions (i.e., pumps, valves, fans, etc.) are in the same location from panel to panel.
Cuideline 8.2 3.A implies that all control sets (i.e., inlet valve-pump-discharge valve) are consistently grouped.
200 changes the words to be more consistant with Guideline 8.2 3.A.
7 4 3 2.A.1 0700 Unguarded and monrecessed pushbuttons Mini =m 0 385
~
ECO Unguarded and nonneessed pushbuttons. Mini =m 0 375 -
i Maximum 0 75.
l
[
JtETIFICATION: A minimum diameter of.375 for unguarded and nonneessed pushbuttons is supported in MIL STD 1472.
4.4 3.C.1 0700 Displacenegt (A) (degrees)
Mini =m 80 Mavimum %,
ECO Dispisceaegt (A) (degrees) yin t -, 30 Maximum 90 JLETIFICATION:
In MIL-STD 1472C, pg 74 minimum displacement for key 6
operated controls is 30.
(Possible misprint in 07J0
(
l l
H i:-
9 53
DD7EENCES BE" NEE N NUEG-0700 AND 200 CECKLIST 4.4 5.E 0700 G00 Displacement (A) (degrees)
Minimum 15 Maximum 90 l
JUSTIFICATION: 200 is making " displacement" for rotary controls a Guideline (from Exhibit 6.4-13 in 0700).
[
(
i i
e-i -
l l
l e
l t'
e 54 l
l 1
~
DIFFIENCES E'NEEN NUREG-0?DO AND 2C0 CECKLIST 5 1.1.
0700 TASK ANALYSIS-Analysis of operator tasks in nlation to J
system engineering and system functional objectives is recommended as the sunst means of establishing operstor information requirements.
CECO TASK ANALYSIS-Analys$a of operstor tasks in relation to system engineering and system functional objectives is recommended as the sunst asans of establishing operator information requinments.
JUSTIFICATION: he scope of the DCRCR covers only those instruments rwquired during emergency operations.
5 1.2.A 0700 SCAIZ SEI2CTION-Scale *mits should be consistent with the degree of pacision and accuracy needed by the operator.
E CECO SCALE SEIECTION-Scale units are consistent' with the l
degree of precision and accuracy needed by the operator j
to perform tasks during emerget:y operations.
JETIFICATION: De scope of the DCRCR cove 2s only those instrumenta required during emergency optrations.
5 1.2.D.i 0700 Span the expected range of operationa.1 persaeters, or CECO Span th expected range of emergency oprcstional parameters, or l
JUSTIFICATION: he scope of the DCRCR covers only those instruments l
requind during e:nergency operations.
5 1.4.B 0700 AVOIDANCE OF EXTRANEOUS IME-Categories of inforsation not needed in using the display should be avoided (e.g.,
patent notices, manufacturer's tradenark or address).
CECO AVOIDANCE OF EXTRANEOUS TIEMS-Categories of information not needed in using the display do not interfere with reading of the display, (e.g., patent notices, manufacturer's trademark or address).
g-JUSTIFICATION: Vord changes have not altered the direction of the criteria.
New wording askes the criteria easier to evaluate.
55
DInTENCES BEWEEN NUEG-0700 AND 200 CECKLIST 6.6.1 0700 NEED FOR LOCATION AIDS-Operster performance can be enhanced through the use of location aids such as demarcation, color, and aizics.
CECO Deleted fres checklist JtETIFICATION: Eliminated from checklist due to the fact that it is not an item to be evaluated.
6.6 3 3.1 0700 Appears as 6.6.4.3.1 Differential line widths any be used to code flow paths (e.g., significance, volume, level)..
CECO If line width is used to code mimics there should be a
- =
25% difference in h size of ameh of the widths used.
JUSTIFICATION: Based on MIL-STD 14720, 5 2.4.2, pg 32.- requiring pictorial graphics to meet the criteria of visibility stated within the MIL-sTD 5 5 6.2 5. for size graduation of labels. Graduations of 25% should be used to more clearly guantify the criteria.
l t
1 O
gf e-f, l
56
DIFFERENCES BEWEEN NUREG-0700 AND 200 CHECKLIST i
8 8.1.1. A 0700 CROUPING BY TASK SEQUENCE-Controls and displays should be assigned to work stations so as to minimize operster movement. To the extent practical, this assignment should consider both normal and emergency procedures.
It should be practical to perfors all fnquently occurring routine tasks, and time-sensitive emergency tasks, with a minimum of human movement from panel to panel.
CECO CROUPING BY TASK SEQUENCE-Controls and displays for tasks sequences performed during energency operations are grouped together.
JUSTIFICATION: The scope of the DCRCR covers only those instruments requind during energency operations.
8.1.2.C 0700 GROUPING BY IMPORTAN T AND FREQUENCY OF USE-Within the 7
constrsints of grouping by task sequence and by system function, ccmtrels and displays should be assigned to panels depending on their importance and frequency of use. Controls or displays which are neither important to plant safety nor frequently used should be installed in secondary panel locations.
CECO CROUPING BY IMPORTAN2 AND FREQENCY OF IEE-Vithin the l
constraints of grouping by task sequence and by system function, controls and displays an assigned to panels depending on their importance and frequency of use during emergency operations.
JETIFICATION: The scope of the DCRCR covers only those instruments required during emergency operations.
0 57
DIFFERENCES BE1VEEN NUREG-0700 AND CECO CHECKLIST
)
8.2.1 '
0700 SEQUENCE, FREQUENCY OF USE, AND PVNCTIONAL CCNSIDERATIONS 8.2.1.A 8.2.1.A.1 h layout of panels is a compromise among a suaber of 8.2.1.A.2 considerations. In some instances, various human factors 8.2.1.A.3 principles will conflict, not only with each other but also with other design requinments. Because it is difficult to rate the conflictin6 considerations for importance, final decisions must be tased on canful evaluation and sound judgment. This subsection deals.
with the analysis of the factors of task sequence, frequency of use and function.
a.
SEQUENCE-Controls and displays which an used together during a normal task sequence should be grouped together.
(1) Displays which are etserved in a specified sequence, as during hot-leg temperature check for all reactor coolant loops, should be F
grouped together.
It is desirsble that they be positioned so that they are moraally used in a left-to-right, top-to-bottom, or other natural sequence.
(2) Controls which are operated in seguence, as in energizing a system er aligning a series of valves for a particular function, should be grouped together.
It is desirsble that they be positioned so that they are normally used in a left-to-right, top-to-bottom, or other natural sequence.
l l
(3) When there is a set of related controls and
~
displays, the layout of displays should be symmetrical with the controls they represent.
8.2.1 CECO SEQUENCE, FREQUENCY OF USE, AND FUNCTIONAL CONSIDERATIONS 8.2.1. A 6.2.1. A.1 a.
SEQUENCE-Controls and displays which are used tog, ether 8.2.1. A.2 during an energency task sequence should be grouped 8.2.1'.A.3 together.
~
(1) Displays which are observed in a specified sequence, are grouped together. h y are positioned so that they an normally used in a left-to-right, top-to-botton, or other natural sequence.
1 l
58 i
m--g-w,_n-,, -, - -
a
~a
,um1-
l r
l (2) Controls which are opersted in sequence, are grouped together. hey an positioned so that I
they an normally used in a left-to-right, top-to-botton, or other natural seguence.
i l
(3) When there is a set of related controls and displays, the layout of displays is consistent with the controls they represent.
l JUSTIFICATION: he scope of the DCRCR covers only those instruments aquired during energency operations.
l l
8.2.1.3 0700 FREQ1ENCY OF USE-Frequently used controls and displays 8.2.1.B.1 should be arranged to reduce search time and minimize the 8.2.1.B.2 potential for error during use.
(1) They should be near the center of the preferred visual and manual a n as.
(2) hey should be positioned so as to be easily identified.
CECO FREQENCY OF USE-Controls and displays used fzwquently during energency operations are arranged to zoduce search r
~
um.
(1) Dese controls and displays are near the center of the preferred visual and manual azoas, j
(2) hase controls and displays azw positioned so as to be easily identified.
JUSTIFICATION: he scope of the DCRCR covers only those instruments required during emergency operstions.
l
. 8.2.1.C 0700 FUNCTIONAL CONSIDERATIONS-Functionally related controls "
8.2.1.C.i and displays should be grouped together when they are:
8.2.1.C.2 (1) Used together to perform tasks alated to a specific function (e.g.
operation of the musidual heat removal system,.
)
(2) Identical in purpose (e.g., reactor coolant pumps).
e CECO FUNCTIONAL CONSIDERATIONS-Functicnally related controls and displays are grouped together when they azss.
p (1) Used together to perform tasks related to a specific function during emergency operation.
(2) Identical in purpose.
JETIFICATION: he scope of the DCRCR covers only those instruments required during energency operations.
l 59
i 1
APPENDIX D Incomplete Studies and Reviews These studies and reviews should result in potential. corrective actions and/or..will be described in design packages that will be tailored for use in modifying the Quad Cities control room.
e Control Room Habilitability Package Auditory Environment Temperature Lighting Modification Approach Glare Shadowing Other Problems in the Control Room Improvement of Communications with Improved Protective Masks e
e Annunciators Development of standards Functional group Location in control room Band width Intentsities Discrepant auditory signals l
Signal-to-noise ratios Identification accuracy
~
Content / wording on tile Frequencies of signals Reflash Alarm printout capability e
Controls l
Coding techniques t'
l Review the operation of the valve between recirculation to P
condenser (FCV-3401) which is locally operated 60 l
l e
Meters and Display Package Removal of inactive displays Units displayed Meter scale design package Proper scale identification Standardized reference to back-pressue Nomenclature Scale range Input designation Consistency Accuracy required Pointer tip types Zone markings, color banding Design and use of legend lights Recorders Adequacy of ink pens Appropriateness of paper and scales Appropriateness of changes for each recorder Channel selection capability Vertical meter scale direction l
e Location of Torus Water Temperature and Dry Well Air Temperature Displays e
Control Room Enhancement Package Labeling package Hierarchical labeling
~~
Summary lead labeling Placement Mounting Frequency of use Cleaning Supplemental information for instruments Nomenclature n
Consistency Standardization of:
l Acronyms Abbreviations 61
.m Pointers on rotary knobs Inappropriate identification of components Clarity Width to height ratios of letters Characteristics Review display approach for engraved monograph HED 1.1.5 VL,6 Functional relationship Procedure for handling temporary labels Lines of demarcation Color Coding standardization in the control room Banding Mimics Standardization Flow direction Background shading Highlighting Control and display relationships e
CRT Display Guidelines to be Established Color Types of lines to indicate pipes or electrical Mimics Menu display l
e Review of procedures for use of computer programs l
e Develop Procedures Generation Guidelines Review procedures related to HEDs:
1.1.4. VL,1 1.1.4. VL,2 Integration Plan With Regards to R.G.1.97 E0Ps, and SPDS u m.
U~
Conduct of Shift Operators With Regards to HED 0.0 05,3 o
l 62 f
o Engineering Reviews HED 1.1.1. AVL,1 i
HED 1.1.1. AV.6 HED 1.1.1. AV.21 Turbine building and reactor building pump alarm circuitry Loss of essential services bus on comunications system 2 Alarms for " Rod and Block" and "APRM Upscale /High" annunciators which are always illuminated Rod worth minimizer Providing the proper scale for HED 1.1.1. A V,9 n-63
APPENDIX E A Brief Description of Remote Shutdown Capability and Comments The Quad Cities remote shutdown capability was not included in the DCRDR survey. However, members of the audit team were given a tour by a senior plant operator of the various stations from which remote shutdown is accomplished and were given a copy of the operating procedure.
At Quad Cities, remote shutdown is accomplished by sending control room personnel to five widely separated stations throughout the plant. The plant can be brought to a safe hot standby condition from these five stations, but if additional operations are required such as the initiation of RCIC or the local control of 4160 and 480 volt motor operated air circuit breakers, additional stations must be covered and coordinated.
All critical stations are linked by a dedicated phone system which is powered from a vital instru-
~
ment bus. The procedure also calls for the operators to take radios.
When,
leaving the control ' room, these individuals must pick up keys in order to enter some of the remote control stations and to operate remote valves and switches. The keys are not grouped so that they can be quickly acquired, i.e., the operator must be trained to know which keys in the key locker to select.
In a real emergency, requiring rapid control room evacuation, this selection process could slow things down or result in the selection of the wrong key or in failure to pick up a. key.
At the primary remote shutdown location which is staffed by the Shift Engineer, the Shift Foreman, the SCRE, and a nuclear station operator (instrument racks 2201-5 and 2201-6), three Yarway reactor level indicators,
are provided.
It was noted that 2 of the 3 read the same; the 3rd was several inches off.
These stations do not appear to have had much human factors engineering input in their design, as they seem to have been con-l structed to make the best use of available space without any consideration for the operator.
For instance, the Yarway level indicators were positioned at three different heights above the floor.
4 f
At one of the breaker panels where an operator must be s.tationed to shed load to keep from overloading a vital bus, there is nothing in writing to tell him which loads should be dropped first.
He must rely on his plant 64
knowledge to make sure he sheds the correct loads in the proper sequence.
At another breaker panel, it is necessary for the operator to insert his finger into a hole surrounded by what appears to be sharp sheet metal; an operation which one would be most hesitant to do.
The Quad Cities operator said he'd use a broom handle; however no such device was located in the vicinity of the breaker.
The 4160 and 480 volt circuit breakers when operated locally require the insertion of a remote control (long cable) push button device which is normally stored in a cabinet near the breakers. The push buttons (2) are not marked as to "open" or "close." One is colored red and is believed to be the "open" or " trip" button.
If so, this violates the Station color code convention.
The operator who is assigned to the turbine building floor, must cover a large area to carry out his responsibilities.
He is on the emergency telephone system and has been provided with an extension cord.
It was not observed if the extension cord is adequate to permit uninterrupted communi-cations while performing his emergency shutdown responsibilities.
If local operation of feed valves is required, they must be switched to a manual operating mode, and then must be operated using massive handwheels.
If a complete loss of power exists, this operating mode must be used.
However, if power is available and local control is required, the handwheels must still be used since no manual controls are provided to operate the powered valve controllers.
4 From the brief tour of the Quad Cities remote shutdown stations, a,
human factors engineering study of the capability would appear to be desir-able.
It would also be desirable to perform a regular shutdown from the remote stations (perhaps before an outage) to verify that personnel and systems operate as called out in the procedures.
It is the audit team's understanding that remote shutdown is not included in the regular training p,}rogram at Quad Cities.
s I.-
l l
65
-..