ML20198J924

Forwards Info Re Function & Task Analysis & Selection of Design Improvements Concerning Dcrdr,Per 860227 Ser. Description & Implementation Schedule for Resulting Human Engineering Discrepancies Will Be Sent by 861031

ML20198J924
Person / Time
Site:	Oyster Creek
Issue date:	05/19/1986
From:	Fiedler P GENERAL PUBLIC UTILITIES CORP.
To:	Zwolinski J Office of Nuclear Reactor Regulation
References
NUDOCS 8606030253
Download: ML20198J924 (9)

Text

GPU Nuclear g gf 100 Interpace Parkway Parsippany, New Jersey 07054 201 263-6500 TELEX 136-482 Writer's Direct Dial Number May 19, 1986 Mr. John A. Zwolinski, Director BWR Project Directorate #1 Division of BWR Licensing U.S. Nuclear Regulatory Commission Washington, D. C. 20555

Dear Mr. Zwolinski:

s

Subject:

Oyster Creek Nuclear Generating Station Docket No. 50-219 Detailed Control Room Design Review (DCRDR)

The NRC's letter of February 27, 1986 detailed the additional infonnation necded by the staff to complete its evaluation of the Oyster Creek Nuclear Generating Station DCRDR Summary Report.

In accordance with the Safety Evaluation enclosed in the above letter and as discussed in Mr. J. N.

Donchew's letter of December 17, 1985, please find attached information relative to " Function and Task Analysis" and " Selection of Design Improvements". With respect to " Control Room Inventory", GPUN will compare the control room with the display and control requirements through Revision 4 of the BWR Owner's Group Emergency Procedure Guidelines (EPG) to identify any additional instrumentation and control requirements. A description and implementation schedule for any resulting human engineering discrepancies will be submitted to the staff by October 31, 1986.

Very truly yours, PDF:gpa 3070f Vice President & Director Attachment Oyster Creek cc: Administrator, Region 1 NRC Resident Inspector U.S. Nuclear Regulatory Commission Oyster Creek Nuclear Generating Station 631 Park Avenue Forked River, N. J. 08731 King of Prussia, PA 19406 Mr. Jack N. Donohew U.S. Nuclear Regulatory Commission 7920 Norfolk Avenue Dethesda, Maryland 20014 Mail Stop #314 8606030253 060519 L'

PDR ADOCK 0D00 9

i y

GPU Nuclear is a part of the General Pubhc UtMtics System

(

Description of Function and Task Analysis Process for EP6 Revision 2 This document describes the process of transformin'g generic BWR EPGs to the OC System Based Emergency Operating Procedures thatjwere implemented at the plant in September, 1984. The specific set of guidelines reviewed were those submited with the OC Procedures Generation Package in 1983. The process of review, revision, validation, and training described here goes beyond the function and Task analysis performed as part of the Control Room Design Review. An integrated and iterative approach was taken to procedure development. The following description is keyed to the flowchart of activities employed in the process attached as Figure 1.

This flowchart was used during the NRC audit of the OC CRDR on November 2, 1984, to provide an overview of GPUN activities during E0P development.

A.

ConversionofgenericEPGstoplantspecificEPGs(referreotoasfirst draftE0Ps).

Since the EPGs were developed for all classes of BWR's, changes had to be made to the guidelines so that they were plant specific to Oyster Creek. These changes included, for example, adding steps which referred to Isolation Condensers and deleting steps which referred to High Pressure Coolant Injection Systems. These types of changes were made by engineers in Plant Engineering and reviewed by engineers in the Safety Analysis group of GPU. These engineers also verified that the plant specific guidelines would support assumptions.made in the design basis safety analysis. Both engineering groups were? involved with the entire process of procedure conversion to ensure that technical basis was maintained throughout the process. These plant specific guidelines were the basis for operator training, function and task analysis and conversion to the final procedure form. At this time these guidelines had not been modified to take irito consideration any of the characteristics of the OC Control Room controls or indicating displays.

B.

Initial Procedure Reviews In April 1983, a series of independent reviews of the draf t E.0Ps were conducted by several groups in GPUN and by GPUN's contractor MPR Associates. These reviews were conducted for a number of reasor.s including technical correctness, procedure logic, usability and definition of operator tasks and functions required by the procedures.

The various GPUN reviews were done separately and independently of the MPR reviews.

Ib83C/p.)

fl B. Initial Procedure Reviews Contd.

One of the GPU reviews consisted of a step by step analysis of the specific tasks, and their information and control requirements, including their attributes. For each task and sub-task, the required display and control characteristics were defined. These were then compared against the available instrumentation and attributes in the Control Room.

It was assured that each task and sub-task requirement could be satisfied, readable for the parameter in question, including range and smallest unit. The Control Room annunciators were also assessed during this review to determine their effect on ease of access and time to obtain reading.

An example of the worksheets used during this review is included as Figure 2.

An "Information Requirements" column was not documented as part of this worksheet but was considered under the " Parameter"-

column. This review was conducted by GPUN Safety Analysis with assistance by the Human Factors Staff. A meeting was held at the end of this initial review process during which all parties reviewed and

.took part in the resolution of all comments. The procedure flowcharts produced by MPR and examples of several new formats were reviewed to select the format to be used during the operator walkthrough of the procedures. Participants at this meeting included the individuals from GPUN Safety Analysis and Plant Engineering who participated in the development of the EPGs by the BWR Owners Group, as well as GPUN Human Factors and MPR Associates.

C.

Initial Operator Training and Simulator Evaluation During the period of time that initial procedure review was being performed, operator training on the technical basis of the EPGs was conducted. Comments were solicited from the operators during this phase of training and during all subsequent training cycles, and used to improve the procedures. The draft E0P's were then subjected to evaluations at the BWR Training Center Simulator to determine the technical adequacy.of the prescribed actions during simulated accident conditions. Although General Electric had performed analyses to support the generic guidelines, this was the first opportunity for individuals familiar with the plant to exercise the procedures during simulated extreme transient conditions. The evaluations were performed 4

by SH0 Licensed engineers from Plant Engineering. This review resulted in a revision to the draft procedures based on the observation of problems in using and interpreting the procedures in an emergency scenario. The revised procedures were used in the first operator c

training session at the BWR Training Center in the summer of 1983.

1 These revised procedures were also used as the basis for the j

walkthroughs conducted at the Control Room Mockup.

i 1683C/p.2 1

f D.

Walkthrough and C:nvarsica of Procedure Format A series of walkthroughs, meetings, r9 views and simulator visits resulted in a thorough understanding by tne review team of the functions and tasks performed by the operators during use of the procedures. As a result of trils process, a new format evolved and was adopted.

The first evolution consisted of walkthroughs held at the OC Control Room Mockup on May 19 and 20, 1983.

In the walkthroughs, the following measures were used to analyze the ability of the operators to understand and to perform the operations called for by the procedure tasks.

1.

Each of the entry conditions for the two top level procedures (reactor control and containment control) was reviewed with the operators to determine whether the condition was clearly and unambiguously displayed to them in the Control Room.

2.

The procedures themselves were talked througn--the two top level procedures, and the contingency procedures. As has been stated, the procedurea involve many logical branches ("If... then") and conditioned responses. The talk-through process trierefore involved compounding of conditions, not necessarily mechanistically, to ensure that each logical aver;ue was explored. For each step, an assessment was made to determine:

e whetnar the operator understood the operation called for.

e ubether the operator conditioned his response according to the conditional requirements of tne procedure (s).

whether the operator was 'apable of understanding and executing c

e the step in combination,with other steps in other procedures he was using at the same tre.

e whether the manning in the Control Room was sufficient in numbers and 'orgrpization to carry out, simultaneously, all the steps that applied.

e whether, if the operator's execution of a step was conditioned on specific values of process variables, the information on those variaoles was displayed to him in appropriate units, with appropriate precision, at'a location where he would be able to see it.

e unether controls or conmunications or both were provided in the Control Room, as nceded, to execute the step in a timely manner.

e wnether displays provided in the Control Room gave the operator nacessary visual feedback on the su:: cess or failure of his control action.

This process verified that the controls and displays provided in the Control Ro.om effectively support the tasks required by the emergency operating procedures (or specifically identified needed displays or controls which the Control Room does not have).

1683C/p.3

(

D. Walkthrcugh and Ccnversion of Procedure Format Contd.

The walkthrough process, although it did not produce a prescriptive checklist of tasks and information requirements, was a thorough analysis of operator functions and tasks because it approached the draft procedures from two aspects. The first was a step by step review of the procedure with the operators identifying the information requirements necessary to complete the step. The second aspect was the use of mechanistic transient scenarios which forced the operators to use the procedures in more realistic sequences of operations and served to test the available controls and indications, and their information characteristics, in the Control Room that were needed to support the procedures. Any deficiencies were recorded during the sessions and reviewed by the team at the end of each day.

After the walkthroughs, memoers of the review team evaluated the use of the draft procedures during training exercises at the Dresden Simulator (BWR Training Center in Morris, Illinois). The evaluations of the training exercises at the Dresden Simulator were based on observations of the operators' actions in responding to simulated upsets and on the comments of the operators themselves. The controls and displays of the Dresden' Simulator are substantially different from those at Oyster Creek.

Because of this, these observations did not contribute significantly to the Task Analysis of the OC Control Room but did give team members insight as to the problems that could arise in the dynamic environment of the Control Room.

This activity essentially concluded the portion of the effort that was the Function and Task analysis of the procedures with the ourpose of determining the compatibility of the Control Room displays and controls with the procedure requirements. The review team did remain involved with the rest of the implementation effort described below to assist with the improvement of format and to ensure that further changes did not invalidate previous analyses.

In July of 1983, meetings were held to determine the format that should be adopted and all the procedures were converted to the new format. The new format was validated by walkthroughs with operators on the Control Room Mockup and by a formal survey conducted by the Human Factors Staff of GPUN.

E.

Final Reviews, Training and Implementation After the operator survey, their comments were incorporated into the procedures and the operators were trained using the format at the Control Room Mockup and at the Dresden simulator. This training was primarily to familiarize the operators with the new format since the technical content of the procedures had not changed. Use of the procedures was observed both by plant management and by the GPUN Human Factors Staff. After these training sessions, final reviews were conducted and the procedures were implemented in September of 1984.

1683C/p.4

E.

Final Reviews, Training and Implementation Contd.

During the time operator training was being conducted, a final survey was performed of all Control Room instruments used during implementation of the procedures. This survey compared the requirements identified in the previous function and task analysis witn the details of the instruments in the Control Room, including location, scale range, scale divisions and readability. HED's identified during this review were evaluated by the review team and assigned priority based on their importance and a comparison to all other CRDR HED's.

A report for this phase of the CRDR was produced by MPR, reviewed and approved by the entire review team. The findings of this phase of the CRDR were integrated with the previous phases and a Summary DCRDR Report was prepared and revieweo by the team. The final Summary Report was submitted to the NRC on April 30, 1984.

1683C/p.5

h I

Figuro 1 y

h Evolution & Reviews of EOPs' including Analysis of Control Room Tasks GPU EPGs

. SAFETY ANALYSIS REV 2

. PLAT 4T ENGINEERING

• T RAINING V

A 1ST DRAFT EOPs 1

APR 1983 INFORMATION taltilAL FLOW CHART MPR (PLANT SPECIFIC)

OPERATOR EOPs REQUIREMEf4TS TRAINING ANALYSIS Y

4 MPR PROCEDURE (INDEPENDENT)

O REVIEWS GPU SIMULATOR TEST OF GPU

, SAFETY ANALYSIS

+P NT ENGINEERING (DRE EN)

MPR MTG, PARStPPANY GPU C

tratitAL PROCEDURE COMMENTS

. PLANT ENGINEERING

. HUMAN FACTORS PROCEDURES

+ - - - - - - - - - - -

GPU REVISED TO REFLECT StMULATOR

• SAFETY ANALYSIS

, PLANT ENGINEERING TESTS MPR

. LANT ENGINEERING WALKT OUGH MAY 18,19,25

.TRA1NtNG OC MOCKUP PLANT OPERATIONS Y

V' OPERATOR TRAINING AT PLANT OPS.

MPR (JUNE 16)

OBSERVE SIMULAIOR (6 WEEKS)

DEVISE GPtl (2s') D OPERATOR (DRESDEN)

NEW PROCEDURE MPR

. HUMAN ORS TRAINING FORMATS

• PLANT ENGINEERING AT StMULATOR I

ay' I

I

....n

~

ar ry wm m

-GPU

~

~ ~

- - ~ ~ ~

1983 DISCUSS cSAFETY ANALYSIS i

FORMAT

. HUMAN FACTORS D

'I CONVERT GIU TO NEW

• HUMAN FACTORS-FORMAT (MPR INPUT)

V PLAfiT OPS GPU 4T EN ERING AUG 23 WALKTHROUGH

• SAFETY ANALYSIS MOCKUP

+ TRAINING MPR 1P SURVEY OF GPU OPERATORS

• HUMAN FACTORS ON NEW PLANT OPERATIONS FORMAT (3 DAYS) l if 1r REVISION TRAINING AT PS GPU PROCEDURE MOCKUP Ord T

JNG FJEW FORMAT FORMAT 1P OBSEFNE TRAINING AT GPU OPERATOR (g#h SM PLANT OPS

• HUMAN FACTORS TR i 4 f4G 7

FORMAT NEW PROCEDURES Y

h hlNEERING STR 1 PR RE UMAN FACTORS CAW V

]f FAlso ggghle On MPR - DRA7 CONTROL ROOM GPU - REVIEW DESIGN REVIEW FINAL" GPU (Jg gre CSfd

• HUMAN FACTOR EVALUATIOt4 JAN 1984 PROCEDURE

+ HUMAN FACTORS PLANT ENGINEERING. REPORT ISSUED REVISION PLANT ENGINEERING HEDs EfJUMERATED if if

SUMMARY

PROCEDURES GPU DCRDR APRIL 30 SEPT APPROVED [] REPORT 198-3 igg 4 a ISSUED IMPLEMENTED t l

h FIGURE 1 EXAMPLE TASK ANALYSIS DATA SHEET EOP Control Room Control Room Sten Decision Action Parameter Indications Annunciators C - nts _} RC/P-1 17 If torus pool Maintain RPV Torus pool temper-PANEL If/Zf PyFI C Tenverature indt-temperature cannot Pressure below the ature Temperature 0/400/2.5 HI, HI cator on IF/2F is be kept below the limit a multipoint Heat Capacity M QEder. T rature Limit RPV oressure See item #16 18 If torus pool water Maintain RPV Torus pool water PANEL 11F PAkEL C Level indication level cannot be Pressure below the level Level -20/20/0.5 HI/LO on llXR is a maintained below the limit PANEL llXR multipoint re-Suppression Pool Level 3/7/0.25 corder Load Limit Level -5/15/1.25 RPV Pressure See item #16 19 If Steam Cooling is Enter Contingency See definitions reautred

1. 3 20 If the main con-Open MSIVs and re-Condenser EAl GEL SF/6F EAli[LQ denser is available, establish main availability Vacuum 1A/8/C 20/30/0.1 LO Vacuum and boron injection condenser Circ Water Disch. Valve Trip 1 Vacuum is required and 0/C Trip 2 Vacuum there is no gross EAliEL 7F fuel failure or Flash Tank Vac 0/30/0.5 MSLB See definitions MSL Rupture EAllWfl&E PANEL J Total MS Flow on Total MS Flow 0/8E6/5E3 Hi Flow 5F/6F is a strip Indiv MS Flow 0/4E6/6E3 Hi Temperature chart.

PANEL 10B Trunnion Ibn Temp 100/400/5 Fuel Failure PANEL lAf PANEL lif Stack indication Indications Stack /Offgas/ 0/1E6/ LOG Stack /Offgas on 10F ts strip 2 Area Rad alann 0/IE3/ LOG HI, HI chart PANEL 2R PANEL J MSL/ Area + Process MS Radiation Rad Monitors 0/IE3/ LOG H12 _ REY _ Level See item si RC/P-3 21 If RPV water level Depressurize RPV is stable and either and Cooldown at Control Rod Position PANEt 4F PANEL H

• All rods in bd-100*F/hr Individual analog Rod Drift yond position 06 oositions Rod Overtrarel
• X 1he boron in-SLC Tank level PANEL 4F EAg[L_G jected into RPV Level (1) 0/100/1 HI/LO
• Rx is shutdown SLC Flow to RPV EallEL_G without boron Flow Established 1

J2175

8 :3 C j ] ~ '~* /** "*%b' UNITED STATES g" NUCLEAR REGULATORY COMMISSION waswiwovow o.c.nosse February 27, 1986 Docket No. 50-219 Mr. P. B. Fiedler Vice President and Director Oyster Creek Nuclear Generating Station Post Office Box 388 Forked River, New Jersey 08731

SUBJECT:

DETAILED CONTROL ROOM DESIGN REVIEW (TAC 56147) Re: Oyster Creek Nuclear Generating Station GPU Nuclear-(GPUN) Corporation is required by Supplement 1 to NUREG-0737, Generic Letter 82-33 dated December 17, 1982, to conduct a Detailed Control Room Design Review (DCRDR) for the Oyster Creek Nuclear Generating Station. The staff has previously reviewed the GPUN Program Plan for the DCRDR and conducted an pre-implementation audit on November 1, 2 and 28,1984. Final evaluation of the DCRDR will be completed after receipt of supplemental information needed by the staff to complete its review of the licensee's DCRDR Summary Report. This information is requested by April 1,1986. Results of the NRC evaluation thus far indicate that GPUN is pursuing a course of review which should satisfy the requirements of NUREG-0737, Supplement 1, if the remaining DCRDR activities and documentation are completed. The enclosed Safety Evaluation (SE), with the attached Science Applications International Corporation (SAIC) Technical Evaluation Report (TER), presents the results of the staff review of your DCRDR Summary Report and its Supplement dated April 30, 1984, and April 5,1985, respectively. The staff agrees with the technical content and conclusions of the SAIC TER except for the conclusion that the application of Revision 3 of the BWR Owner's Group Emergency Procedure Guidelines (EPG) to the Oyster Creek control room must be submitted for review to the staff. The infonnation discussed in the enclosed SE and needed by the staff to complete its evaluation of your DCRDR Summary Report was the subject of a meeting held in Bethesda, Maryland. The meeting minutes dated December 17, 1985, document in detail what is needed by the staff. Contrary to the conclusion stated in these meeting minutes that you will submit the detailed i p at

{ 1 ~ Mr. Fiedler February 27, 1986 results of your application of Revision 3 of the EPG to the Oyster Creek control room, the staff has concluded that this will not be required. You i must only document, including your schedule, that you will apply Revision 3 of the EPG to the Oyster Creek control room and submit at the conclusion of this application samples of the task analysis data sheets described in the I meeting minutes dated December 17, 1985, and a description of the HEDs, if any, and the schedule for their implementation. This application of Revision 3 of the EPG should be included in your integrated living schedule being developed for Oyster Creek. The staff concludes that its detailed review of the implementation of Revisions 1 and 2 of the EPG to Oyster Creek will be sufficient. Sincerely, / N-John A. Zwolinski, Director BWR ilroject Directorate #1 Division of BWR Licensing

Enclosure:

Safety Evaluation cc w/ enclosure: See next page m

( Mr. P. B. Fiedler Oyster Creek Nuclear Oyster Creek Nuclear Generating Station Generating Station cc: G. F. Trowbridge, Esquire Resident Inspector Shaw, Pittman, Potts and Trowbridge c/o U.S. NRC 1800 M Street, N.W. Post Office Box 445 Washington, D.C. 20036 Forked River, New Jersey 08731 J.B. Liberman, Esquire Commissioner Bishop, Liberman, Cook, et al. New Jersey Department of Energy 1155 Avenue of the Americas 101 Commerce Street New York, New York 10036 Newark, New Jersey 07102 Eugene Fisher, Assistant Director Regional Administrator, Region I Division of Environmental Quality U.S. Nuclear Regulatory Commission Department of Environmental 631 Park Avenue Protection King of Prussia, Pennsylvania 19406 380 Scotch Road Trenton, New Jersey 08628 BWR Licensing Manager GPU Nuclear 100 Interpace Parkway Parsippany, New Jersey 07054 Deputy Attorney General State of New Jersey Department of Law and Public Safety 36 West State Street - CN 112 Trenton, New Jersey 08625 Mayor Lacey Township 818 West Lacey Road Forked River, New Jersey 08731 D. G. Holland Licensing Manager Oyster Creek Nuclear Generating Station Post Office Box 388 Forked River, New Jersey 08731 i

[""% UNITED STATES 3- ' 't. NUCLEAR REGULATORY COMMISSION 3 .y WASHINGTON, D. C. 20655 e S %..... / SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION J DETAILED CONTROL ROOM DESIGN REVIEW GPU NUCLEAR CORPORATION JERSEY CENTRAL POWER AND LIGHT COMPANY OYSTER CREEK NUCLEAR GFNERATING STATION DOCKET NO. 50-219

1.0 INTRODUCTION

On October 31, 1980, the NRC staff issued NUREG-0737 which incorporated in one document all TMI-related items approved by the Connission for implementation at that time. Supplement I to.NUREG-0737, Requirements for 4 Emergency Response Capability (NRC Generic Letter No. 82-33) dated December 17, 1983, provided additional clarification regarding the Detailed Control Room Design Reviews (DCRDR) as well as for the Safety Parameter Display Systems (SPDS), Regulatory Guide 1.97 (Revision 2), Emergency Response Facilities, Emergency Operating Procedures upgrade and Meteorological Data. As required by Supplement 1, the licensee submitted a DCRDR Program Plan and a DCRDR Sunnary Report. By letter dated July 1,1983, GPU Nuclear (the licensee) submitted its Program Plan for the human factors review of the control room at Oyster Creek Nuclear Generating Station (Oyster Creek). This program plan was reviewed by the staff. The staff issued its evaluation on the program plan in its Safety Evaluation dated February 6,1984, concluding the program plan was acceptable. By letters dated April 30, 1984, and April 8, 1985, the licensee submitted its Summary Report and its supplement on the Oyster Creek DCRDR. These 4 submittals have been reviewed by the staff and its contractor. The staff requested by letter dated August 14, 1984, additional information (RAI) needed by the staff to complete its review of DCRDR. In order to expedite completion of the staff's review, the staff with its contractor conducted a pre-implemen-tation audit of the licensee's DCRDR program. This audit was held on November 1-2, 1984, at the licensee's DCRDR contractor's place of business and on November 28, 1984, at the Oyster Creek site. These audits were held partially to help the licensee understand the staff's RAI of August 14, 1984 b T sib .Q' po

f: . 2.0 DISCUSSION Item I.D.1, " Control Room Design Reviews," of the Nuclear Regulatory Comission (NRC) Action Plan NUREG-0660 developed as a result of the TMI-2 accident states that operating licensees and applicants for operating licenses will be required to perfom a DCRDR to identify and correct design discrepancies.. The objective is to improve the ability of nuclear power plant control room operators to prevent or cope with accidents if they occur by improving the infomation provided to them. Supplement 1 to NUREG-0737 confirmed and clarified the DCRDR requirement in NUREG-0660. The DCRDR has the following elements: 1. Establishment of a qualified multidisciplinary review team 2. Function and task analysis to identify control room operator tasks and infomation and control requirements during emergency operations 3. A comparison of display and control requirements with a control room inventory 4. A control room survey to identify deviations from accepted human factors principles 5. Assessment of human engineering discrepancies (HEDs) to detemine-which HEDs are significant and should be corrected 6. Selection of design improvements 7.- Verification that selected design improvements will provide the necessary correction 8. Verification that improvements will not introduce new HEDs 9. Coordination of control room improvements with changes from other programs such as SPDS, operator training, Regulatory Guide 1.97 instrumentation, and upgrade of emergency operating procedures (EOP). Supplement 1 to NUREG-0737 requires each applicant and licensee to submit a sumary report at the end of the DCRDR. The report should describe the proposed control room changes, implementation schedules, and provide justification for leaving safety significant HEDs uncorrected or partially corrected. 3.0 EVALUATION As required by Supplement 1 to NUREG-0737, the licensee submitted for Oyster Creek its DCRDR Program Plan dated June 1983, its DCRDR Sumary l l - ~ - -.

I s . Report in April 1984, and a supplement to the DCRDR Summary Report dated April 1985. The staff and its consultants have reviewed these submittals and have participated in a meeting on November 1-2, 1984, and an on-site audit at the Oyster Creek plant on November 28, 1984, to evaluate the licensee's DCRDR program. - The staff's consultants from Science Applications International Corporation (SAIC) have prepared a Technical Evaluation Report (TER) which is attached to this SE. The NRC staff concurs with the technical evaluations and conclusions contained in the TER except for the conclusion that the application of Revision 3 of the BWR Owner's Group Emergency Procedure Guidelines (EPG) to the Oyster Creek control room must be submitted for review to the staff. The use of the phraseology "It appears that..." in the TER should be interpretated as a statement that the licensee meets the requirements. The information discussed below which is needed by the staff to complete its _ evaluation of your DCRDR Sumary Report was the subject of a meeting held in Bethesda, Maryland. The meeting minutes dated December 17, 1985, document in detail what is needed by the staff. Contrary to the conclusion l stated in these meeting minutes that the licensee will submit the detailed results of its application of Revision 3 of the EPG to the Oyster Creek control room, the staff. has concluded that this will not be required. The licensee must only document that it will apply Revision 3 of the EPG to the control room and submit at a later date samples of the task analysis data sheets described in the meeting minutes dated December 17, 1985, and a description of the HEDs, if any, that result from this application of the EPG and a schedule for the implementation of the HEDs. The staff concludes that its detailed review of the implementation of Revisions 1 and 2 of the EPG to Oyster Creek will be sufficient.

4.0 CONCLUSION

The staff concludes that the licensee has satisfied the majority of the requirements needed for the satisfactory completion of a DCRDR for Oyster Creek. The evaluations of these elements of the DCRDR are summarized below. Additional information is provided in the attached TER. ] Multidisciplinary Review Team A qualified multidisciplinary team was established to conduct the DCRDR activities. Control Room Inventory The licensee has satisfactorily described the results of the comparison of the control room inventory with the display and control requirements identified in Revisions 1 and 2 of the EPG for the Oyster Creek control room. Control Room Survey A human factors survey of the control room was conducted in what appears to be a thorough manner. GPUN used guidelines which it derived from several sources. A control room survey was conducted as required by Supplement 1 to NUREG-0737.

. l l Assessment of Human Engineering Discrepancies The process the licensee described to assess the significance of HEDs fulfills the requirements of Supplement 1 to NUREG-0737. Verification of Improvements l l The licensee implemented an acceptable process to verify that improvements could be introduced into the control room without creating new HEDs. Coordination with Other Programs Based on information provided at a meeting and in documents submitted, the licensee is satisfying the requirement to coordinate control room improvements with changes resulting from other improvement programs. In order to satisfactorily complete the DCRDR required by Supplement 1 to NUREG-0737, the licensee must submit, for staff review and approval, a supplemental DCRDR Sumary Report containing the infonnation for the DCRDR elements described below. Function and Task Analysis The licensee needs to provide written documentation of those processes it has described at meetings to determine infonnation and controls required for emergency operations and their requisite characteristics during its implementation of Revisions 1 and 2 of the EPG. Control Room Inventory The licensee shall compare the control room with the display and control requirements in Revision 3 of the EPG for the Oyster Creek control room to ( identify any additional instruments or controls required in the control room. At the completion of this comparison, the licensee will submit the description of the resulting HEDs, if any, and the schedule for their implementation. Selection of Design Improvements The process implemented and criteria used by the licensee to select design improvements to resolve HEDs fulfill the requirement of NUREG-0737, l Supplement 1. The licensee has corrected many identified HEDs. Some, however, have not been corrected at this time. The licensee should provide proposed modifications and/or implementation schedules for those HEDs listed below: I Group I: HED No. 1-16 Group II: HED No. 21, 42, 49, 56, 66, 67, 69, 70, 71, 74, 75 Group IV: HED No.17, 37, 39, 43, 45, 58, 59, 60, 61, 62, 63, 64 Group VI: HED No. 10, 12

I . In conclusion, the staff has reviewed the licensee's DCRDR activities to date and concludes that the greater majority of the DCRDR Program has been completed. With the acceptable completion of those remaining activities noted above, the licensee will have completed the requirements of Supplement 1 to NUREG-0737 for a DCRDR. Principal Contributors: A. Ramey-Smith and J. Donohew. Dated: February 27, 1986

I ATTACHMENT TO SAFETY EVALUATION r EVALUATION OF THE DETAILED CONTROL ROOM DESIGN REVIEW

SUMMARY

REPORT FOR OYSTER CREEK NUCLEAR GENERATING STATION Supplemental Technical Evaluation Report May 20, 1985 Prepared for: U.S. Nuclear Regulatory Commission Washington, D.C. Prepared by: Science Applications International Corporation 1710 Goodridge Drive McLean, Virginia 22102 Contract NRC-03-82-096 0 '6 f 0 01 ,jg 0 9ff s

T FOREWORD This Supplemental Technical Evaluation Report (STER) was prepared by Science Applications International Corporation (SAIC) under Contract NRC 82-096. Technical Assistance in Support of HRC Licensing Actions: Program III. The evaluation was performed in support of the Division of Human Factors Safety. Human Factors Engineering Branch (HFE8). This report includes the SAIC evaluation of the following documents and activities: the licensee's Summary Report (Reference 1); the Program Plan (Reference 2); the Supplement to the Summary Report (Reference 5); the meeting of November 1-2, 1984 (Reference 3); and the on-site Pre-Implementation Audit (Reference 4). T 6 ~_,,,.m--

T a TABLE OF CONTENTS Section Page BACKGROUND............................ 1 PLANNING PHASE...............'........... 3 1. Preparation and Submission of a Program Plan...... 3 2. Structure and Qualifications of a Multidisciplinary Review Team.................... 4 3. Coordination of the DCRDR With Other Improvement Programs...................... 5 REV I EW PH AS E........................... 6 1. Review of Operating Experience............. 7 2. System Function and Task Analysis............ 7 3. Control Room Inventory................. 11 4. Control Room Survey................... 11 ASSESSMENT AND IMPLEMENTATION PHASE................ 12 1. HED Assessment Methodology............... 12 2. Selection of Design Improvements............ 14 3&4. Verification That Selected Design Improvements Will Provide the Necessary Correction and Verification That Improvements can be Introduced in the Control Room Without Creating Any Unacceptable Human Engineering Discrepancies............. 15 ANALYSIS OF PROPOSED DESIGN CHANGES AND JUSTIFICATION FOR HEDS WITH SAFETY SIGNIFICANCE THAT ARE TO BE LEFT UNCORRECTED OR PARTIALLY CO R RE CTE D............................. 15. CONCLUSIONS AND RECOMMENDATIONS.................. 16 RE FE RE NCE S............................ 19 LIST OF ATTENDEES......................... 21 APPENDII A............................ 23 O I i

EVALUATION OF THE DETAILED CONTROL ROOM DESIGN REVIEW SumARY REPORT FOR OYSTER CREEK NUCLEAR GENERATING STATION This report documents the Science Applications International Corpora-tion (SAIC) evaluation of the Summary Report of the Detailed Control Room Design Review (DCRDR) submitted to the Nuclear Regulatory Commission (NRC) by GPU Muclear Corporation (GPUN) for the Oyster Creek Nuclear Generating Stattoren April 30,1984 (Reference 1). This evaluation also considers Information obtained from the previously submitted Program Plan (Reference 2). Further information regarding DCRDR activities was acquired at a meeting held between GPUN and the NRC on November 1-2,1984 (Reference 3). (Some of the types of exhibits viewed during the meeting are shown in Appendix A.) Additional information relevant to the DCRDR was obtained during a pre-implementation audit held on November 28,1984 (Reference 4). Findings from both of these meetings also were considered in assessing GPUN's Summary Report as was documentation submitted in a Supplement to the Summary Report submitted to the NRC on April 8,1985 (Reference 5). This report supersedes our earlier report ' dated July 20, 1984. Results of the SAIC evaluation follow a brief overview of the background leading up to preparation and submission of the Summary Report by the licensee. BACKGROUND Licensees and applicants for operating licenses are required to conduct a Detailed Control Room Design Review. The objective of the review is to ... improve the ability of-nuclear power plant control room operators to prevent accidents or cope with accidents if they occur by improving the information provided to them" NUREG-0660, Item I.D.1 (Reference 6). The need to conduct a DCRDR was confirmed in NUREG-0737 (Reference 7), and the requirements to be met in such a review were contained in Supplement I to NUREG-0737 (Reference 8). Guidelines for conducting a DCRDR are provided in ~ NUREG-0700 (Reference 9) while NUREG-0800 (Reference 10) presents the evaluation criteria for use by the NRC. 1

I The DCRDR requirements as stated in Supplement 1 to NUREG-0737 can be summarized in terms of nine specific issues, a list of which provides a convenient outline of the areas covered in this technical evaluation.The nine issues include: 1. Establishment of a qualified mult1 disciplinary review team. 2. Use of function and task analyses to identify control room operator tasks and information and control requirements during emergency operations. 3. A comparison of display and control requirements with a control room inventory. 4. A control room survey to identify deviations from accepted human factors principles. I 5. Assessment of human engineering discrepancies (HEDs) to determine which HEDs are significant and should be corrected. 6. Selection of design improvements that will correct these discrepancies. 7. Verification that selected design improvements will provide the necessary correction. 8. Verification that improvements can be introduced in the control room without creating any unacceptable human engineering discrep-ancies. 9. Coordination of control room improvements with changes resulting from other improvement programs such as SPDS, operator training, new instrumentation (Reg. Guide 1.97, Rev. 2), and upgraded emer-gency operating procedures A DCRDR is to be conducted according to the licensee's own Program Plan (which must be submitted to NRC); according to NUREG-0700, it should address the previously stated requirements and be conducted in accordance with the 2

r 1 0 following four phases: (1) planning (2) review (3) assessment, and (4) reporting. The product of the last phase is a Summary Report which must l include en outline of proposed control room changes, their proposed schedules for implementation, and summary justification of human engin discrepancies with safety significance to be left uncorrected or partially corrected. Upon receipt of the licensee's Summary Report and prior to implementation of proposed changes, the NRC must prepare a Safety Evalua Report (SER) indicating the acceptability of the DCRDR (not just the Summ Report). The NRC's evaluation encompasses all documentation as well as briefings, discussions, and audits if any were conducted. The Summary Report submitted for evaluation by GPU Nuclear describes completed tasks and findings from a control room design review which was initiated in late 1980 at Oyster Creek prior to the issuance of the DCRDR requirements stated in Supplement I to MUREG-0737 and the methodology gested in NUREG-0700 or other appropriate guidance. A control room mock-up was constructed, and in early 1981 guidelines and objectives were formulated ? to provide a framework for the control room design review. A major review of the alarm system was undertaken, and other planned modifications affect-ing plant controls and displays were subjected to human factors evaluation Review of the control room as a whole was conducted between 1 and included preparation of a Program Plan and analysis of tasks associated with executing symptom-oriented emergency operating procedures. PLANNING PHASE 1. Preparation and Submission of a Program Plan The Program Plan submitted for Oyster Creek showed that GPUN met m of the basic objectives for conducting a control room design review. Many of the elements of a review specified in Supplement 1 to NUREG-0737 had been addressed. However, specific areas of the work were not described in suffi-cient detail to provide assurance that the licensee understood the processes necessary to complete the tasks and therefore meet the requirements. The results of the evaluation of the GPU Nuclear Program Plan are detailed in Reference 11, i i 3 1

r The licensee's Program Plan included a brief description of the staffing and management that were established to conduct the control room design review. From additional information provided by GPUN in the Summary Report, it appears that the structure and management of the DCRDR were flexible enough to permit a multidisciplinary effort. Overall direction of the review was provided by GPUN. More specifically, management of the DCRDR was the responsibility of GPUN's Director of Systems Engineering and Manager of Plant Analysis. 2. Structure and Qualifications of a Multidisciplinary Review Team A competent and relevant multidisciplinary team was established to conduct the control room design review. The team included GPUN staff, personnel from MPR Associates, and human factors consultants. The resumes provided indicate that the expertise of the review team included: e System Engineering Reliability and Risk Analysis e Human Factors Engineering e Operations Analysis e Instrumentation and Control e Chemical Engineering e Electrical Engineering e Mechanical Engineering e Nuclear Engineering. e GPU Nuclear outlined the degree of involvement of MPR and consultants and provided personnel assignments. It appears that participating organiza-tions and individuals were qualified for DCRDR tasks for which they were responsible. GPUN was responsible for overall direction of the review. GPUN staff participated in almost all review activities to some extent. GPUN acted as contract manager for MPR and the human factors consultants, set the review schedule, integrated the review and corrective actions with plant activities, and scheduled correction of discrepancies. MPR developed the review's framework, coordinated review phases, and drafted report findings. The human factors consultants participated in development of review guidelines, engaged in walk-throughs, and assisted in the evaluation of deficiencies. 4

~ i The review team, as established, appears to have had freedom to carry out the review and access records, information, and facilities as needed. The team apparently also had the ability to acquire support from other 4 administrative staff and specialists as needed. Other staff involved in the review are mentioned by specialty (systems engineer / safety analysis staff, shift technical advisors, operating staff, etc.); however, resumes for these individuals were not provided. Overall, GPUN did assemble a team which was qualified to carry out the requirements of Supplement I to NUREG-0737. 3. Coordination of the DCRDR with Other Improvement Programs The licensee's Program Plan indicated an intent to comply with the coordination requirements of the NRC and awareness of the potential disruption of the control room and complications to operator training that may result from an uncoordinated implementation plan of corrective actions. In order to facilitate coordination of programs and to ensure that the high 1 standards established during the DCRDR are maintained, future modifications to the control room such as the Safety Parameter Display System and instru-ment modifications for compliance to Regulatory Guide 1.97 will be subject to procedures which integrate human factors reviews into the design process. The procedures are supported by a full-time human factors staff. The pro-l cess and procedures are described in the licenst;e's Summary Report I (Reference 1 pp. I.3-I.4). The process and procedures have been already applied to design of the Remote Shutdown Panel. During the November 1-2, 1984 meeting, GPUN staff and MPR consultants specifically described additional interfaces of the DCRDR with other NUREG-0737, Supplement 1 improvement programs. For example, Revision 2 of the BWROG Technical Guidelines was used to formulate plant-specific EPGs. GPUN then conducted a task analysis procedure to help generate its E0Ps. The E0P activity was coordinated with the DCRDR using an interactive process involving walk-throughs, rewrites, and validation. Operator training of E0Ps also was part of this process. As a result of discussions which took place at th'e pre-implementation audit (Reference 4), GPUN agreed to document the use of their proposed computer-driven CRT to correct a group of 26 HCDs. Because the computer is not a safety-grade device, GPUN stated that they could not use it as the 5

i 1 sole display of parameters necessary for the execution of E0Ps. However, in their Supplement to the Summary Report, GPUN did not describe how it intends to integrate the use of the computer /CRT and the existing equipment when executing E0Ps. Does GPUN plan to re-write portions of the E0Ps, upgrade training, or take other measures which apply to the HEDs in Group V7 e In conclusion, with the exception of the above-mentioned concern, it appears as though GPUN did coordinate control room design improvements with changes from other programs. Furthermore, GPUN has implemented an ongoing review process and associated procedures which integrate a human factors review into the design of all future modifications to the control room. This process is supported by a full-time human factors staff. This should ensure continued integration and coordination of the DCRDR with other improvement programs and therefore fulfill the NUREG-0737, Supplement I rcquirement. REVIEW PHASE i GPU Nuclear Review Phase plans and activities included-1. Review of operating experience 2. Review of operator functions and responsibilities 3. Review based on plant procedures and walkthroughs 4. Function and task analysis 5. Control room inventory 6. Control room survey. To some extent, the above activities are those recommended by NUREG-0700 guidelines as contributing to the review phase objectives. Activities 4, 5, and 6 contribute to the accomplishment of specific DCRDR requirements contained in Supplement I to NUREG-0737. Activities 2 and 3 permitted a review and validation of operating procedures and provided cata relevant to the assessment phase of the project. Activities 2,3, and 4 are discussed together in the System Function and Task Analysis section to follow. 4 6

1. Review of Operating Experience A review of operating experience is not explicitly required by Supplement I to HUREG-0737. However, it is an activity recommended by NUREG-0700 guidelines as contributing to the accomplishment of review objectives. As described by GPU Nuclear in the Program Plan, its review of operating experience included: (1) a review of Licensee Event Reports and internal plant records on reactor trips and other events to ensure that problems actually encountered in Oyster Creek's operation were identified and factored into the control room review; (2) a review of Nuclear Power Experience summaries; (3) conduct of a formal opinion survey of control room operators to identify strengths and weaknesses of the control room; and (4) the acquisition of solicited and unsolicited information from operators during walk-throughs. F From information provided in submitted documentation and at meet it appears that GPUN performed an operating experience review consistent with the guidelines provided in NUREG-0700. Both BWR plant and industry-wide reports were reviewed and documented as part of the DCRDR activities. The majority of plant operators and training personnel were interviewed formally during the data collection phase of the operating experience review. Operations input was also gathered informally during walk-throughs. 2. System Function and Task Analysis Supplement 1 to NUREG-0737 states that the licensee is required to perform a " function and task analysis (that had been used as the basis for developing emergency operating procedures) to identify control room opera tasks and information and control requirements during emergency operations " In other words, the objective of the task analysis is to establish the input and output requirements of control room operator tasks. These information and control requirements are then to serve as benchmarks for examination of the adequacy of control room instrumentation, controls, and other equipment For licensees choosing to use the Boiling Water Reactor Owners' Grou (BWROG) control room survey program, the NRC has issued Generic Letter 4 7

F 18, clarifying some task analysis requirements (Reference 12). A further memorandum, issued by the NRC on May 14, 1984, has defined the requirements for performing a task analysis -when the licensee uses the BWROG emerge procedure guidelines (Reference 13). This latter position was considered in this evaluation of GPUN's task analysis activities and is summarized below: e It appears that Revision 3 of the General Electric Corporation Emergency Procedure Guidelines (EPGs) provides a functional analysis that identifies, on a high level, generic information and control needs. However, these EPGs do not explicitly identify the plant-specific information and control needs which are necessary for preparing emergency operating procedures and determining the adequacy of existing instrumentation and controls. e Because plant-specific information and control needs cannot be extracted directly from the EPGs, plant-specific analysis is required. I Each licensee and applicant must describe the process used to identify e plant-specific parameters and other plant-specific information and control capability needs and must describe how the characteristics of the needed instruments and controls will be determined. These processes may be described in either the Procedure Generation Packages or the DCRDR Program Plan with appropriate cross-referencing. For each instrument and control used to implement the emergency e operating procedures, there should be an auditable record that defines the necessary characteristics of the instrument or control and the basis for that determination. The necessary characteristics should be derived for analysis of the information and control needs identified in the NRC-approved EPGs and from analysis of plant-specific information. GPU Nuclear's methodology for performing the function and task analysis was described in both its Program Plan and Summary Report submittals. Addi-tional information was acquired at the meeting held between the licensee and the NRC. GPUN started its original system function and task analysis (SF&TA) activities in 1980 by conducting walk-throughs of 1980 off-normal and normal procedures in a full-scale control room mock-up. GPUN has more recently completed an SF&TA using new symptom-oriented E0Ps. This evalua-8

r tion focuses on this latter effort as Supplement I to NUREG-0737 specifies l that the SF&TA be used as a basis for developing the new E0Ps and for conduct of the DCRDR. t As described by the license: at the meeting, GPUN began the process of implementing the symptom-oriented E0Ps in 1983. In order to comply with Generic Letter 83-18, GPUN converted the BWROG Technical Guidelines (EPGs Revision 2 into plant-specific technical guidelines or "first-cut" proce-dures by analyzing plant systems and components to determine needed parameters, safety limits, etc. The process involved determination of functions and tasks required of operators during emergency conditions and thei r information needs and control functions. CPUN stated that these "first-cut" procedures were not' tailored to the displays and controls installed in the Oyster Creek control room at that time. The procedures were subjected to a number of iterations. Walk-throughs and training exer-cises were conducted in the mock-up and Dresden simulator. Although the Dresden simulator does not replicate the Oyster Creek control room, these activities provided some degree of verification and validation that the E0Ps I could be implemented in the Oyster Creek control room. The determination of instrument and control characteristics was the result of a number of activities including the iteration of E0P development, the E0P walk-throughs, and a desk-top analysis of system functtons and operator tasks required during emergency conditions. Information on the characteristics of controls and displays to meet operator needs also resulted from walk-throughs to evaluate the suitability of existing equip-ment. In a separate effort, GPUN staff evaluated the availability and suitability of instruments in the control room using a survey approach. Existing characteristics such as meter ranges, scales, need for zone band-ing, upper and lower units, setpoints, etc., were examined critically. The SF & TA activities including E0P development and E0P walk-throughs resulted in a verification that controls and displays already in the control room supported tasks required by the E0Ps. Many of the processes described by GPUN also emphasize the validation of the compatibility of the pro-cedures, manning, and training with the control room for the accomplishment of emergency tasks. However, since data collection forms were not provided - for the review, i.e., there is no audit trail, it is not possible to 9 i

y ~ evaluate fully the scope and breadth of the analysis of knformation and . control needs and characteristics required. In summary, GPUN has complied partially with the four points discussed in the NRC memo of May 14,1984 (Reference 13). With regard to the first two points, the memo referred to Revision 3 of the BWROG EPGs as pro function analysis. Since GPUN used Revision 2, the two emergency proce-dures, secondary containment and radioactivity release control, have been omitted from the system function and task analysis activities to date. As documented in the Supplement to the Summary Report, these procedures w be developed during the next refueling outage at Oyster Creek, which will commence in 1985. With regard to the second two points in the memo, GPUN has not provided a comprehensive description of the task analysis and has not provided an example of an auditable record which defines the necessa characteristics of each instrument and control used to implement the E0Ps and the basis for that determination. In conclusion, GPUN seems to have performed a system function and task analysis activities which partially comply with the NRC requirement. In order for the NRC to evaluate fully the degree to which the system function and task analysis meets the requirements of Supplement 1 to NUREG-0737, GPU 4 should: 1. Provide written documentation of those processes it has described at meetings to determine information and controls required for emergency operations and their requisite characteristics. This is necessary because GPUN has not pro 0ided an example of an auditable i record which defines the necessary characteristics and basis for the determination of each instrument ind control used to implement all of the BWR E0Ps. I 2. Write E0Ps for the two remaining emergency procedures; namely, secondary containment control and radioactivity release control. The GPUN should carry out a system function and task analysis for these procedures using prescriptive task analysis techniques. The process used should be documented, and an example of completed task analysis worksheets including the identification of display and control characteristics should be submitted. 10 l

r 3. Control Room Inventory The licensee's stated objective for this task was to identify all instrumentation, controls, and equipment within the control room. GPUN's inventory is based on photographs used for a mock-up which include all components with which the operator interfaces. This includes all main control panels and visual annunciators for alarms. The actual inventory is contained in a set of reproducible drawings which includes radiation monitoring panels. The compilation of the inventory appears to be complete. The compiled inventory was used by the licensee in several phases of the control room design review. During the review of operator functions and responsibilities, the inventory was used to verify that the operator could perform required duties. Similarly, the inventory was used to verify that tasks implicit in the symptom-oriented E0Ps could be accomplished. The inventory also was used as an integral part of the control room survey effort. The availability and suitability of displays and controls were determined primarily during the walk-throughs in which the needed control and display characteristics, although not documented, were compared with the inventory. Supplement I to NUREG-0737 requires the comparison of control room control and display characteristics with information and control require-ments derived from a function and task analysis. GPUN has not yet provided a written description of how required display and control c'haracteristics were identified independently of the control room during the task analysis. 1 Furthermore, the comparison of control and display characteristics with I i those determined from the task analysis needs to be accomplished for Revi-sion 3 of the EPGs, and an auditable record maintained. Not until these data are provided, can a full evaluation of the inventory task be completed. 4. Control Room Survey GPUN conducted a survey of control room components to identify any { characteristics of instruments, equipment, layout, and ambient conditions 1 that did not conform to good engineering practice. The survey included: (1) a panel review (controls, displays, panel layout, process computer i displays); (2) survey of alarm systems; and (3) survey of control room ? 11 ) l

environment (ambient conditions, lighting, sound, workspace, communications, etc.). Survey results were obtained by reviewing photographs of panel compo-nents from the inventory. Measurements and observatior.s were made in the control room itself, as necessary. These results were then compared with detailed human engineering guidelines prepared for. the Oyster Creek control , room. These guidelines, showa in Appendix A of the Program Plan, were developed from guidelines contained in MIL-STD-1472B (Reference 14) and human engineering references such as VanCott and Kinkade (Reference 15) and Woodson and Conover (Reference 16). The devt.,lopment of such guidelines was necessary as GPUN conducted its survey of Oyster Creek prior to the issuance of the NRC DCRDR guidelines (NUREG-0700). It appears from both discussions with GPUN and a review of documenta-tion that the control room survey was comprehensive in that it included all primary control panels. The Remote Shutdosn Panel was not surveyed as it is E currently under construction and evaluation. The actual survey instrument used by the, licensee was not included in its submittals and was not reviewed at the meeting (Reference 3). Thus, although it is clear that a control room survey was conducted as required by NUREG-0737 Supplement'1, a review of the actual survey instrument used by GPUN would have provided_ greater confidence in the comprehensiveness and rigor of the survey effort. ASSESSMENT AND IMPLEMENTATION PHASE GPUN's assessment and implementation phase is addressed in Section V of the Program Plan. Section IV of the Summary Report provides a summary of conclusions, and Section V describes the corrective action plan to resolve discrepancies uncovered by the review. A summary of review findings is included in Tables V-I and V-II of the Summary Report. 1. HED Assessment Methodology GPUN's control room review resulted in the identification of roughly 1000 HEDs. Some 20 deficiencies related to the control room environmental issues. One hundred sixty-eight deficiencies,were generated by the review 12

r I .r_= of operator tasks and over 800 deficiencies were uncovered by the detailed survey of the control room hardware. HEDs identified during the review were assessed to determine whether corrective action needed to be taken. The fundamental criteria were (1) the likelihood that a deficiency would lead to an operator error; and (2) the impact that such error on the plant would be significant. i These criteria j are appropriate and imply consideration of operational safety. The licensee i also included plant availability and potential for equipment damage as l secondary criteria. I i HEDs were prioritized individually or generically by revi consensus into one of three categories based on likelihood of operator error Pa such error on the plant. Categories were defined as follows: Importance Category A - a deficiency that may impair an operator's performance under off-normal :onditions. Importance Category 8 - a deficiency that violates one or more human factors guidelines used in the review but is unlikely to lead to an trreversible operator error in an off-normal situation or can lead to operator error under normal conditions and/or generic deficiencies that individually are not likely to degrade performance seriously, but taken together can be significant. importance Category C - a deficiency which is unlikely to affect opera-tor performance under any condition, or a deficiency for which solu-tions are not clear cut. t l Scheduling of the corrective action for each deficiency initially was accomplished by placing each deficiency into one of five categories. Scheduling ranged from corrective actions to be taken at the earliest oppor-tunity (Category 1) to accomplishing the correction either as conveniently as possible or after the 1987 refueling outage (Category 4). HEDs corrected during the course of the review process were placed in Category 5, "already corrected." Revised schedule categories were provided in the Supplement to the Summary Report. This scheduled established three categories for completion of evaluation and/or HED implementation. Pending GPUN's 13

completion of the evaluation and NRC's receipt of the proposed corrective actior.s. it will be possible to complete a review of the licensee's scheduling and implementation of corrective actions. GPUN's HED assessment activity satisfies the requirements of NUREG-0737, Supplement I to determine which HEDs are significant and should be corrected. Discussion at the meeting (Reference 3) indicated that a multi-disciplinary group consensus process involving human factors consultants, operators, MPR personnel and GPUN staff was used to assess HEDs individually and in aggregate for their potential plant safety consequences. The output of this evaluation was safety-significant HEDs to be analyzed for design improvements. Consistent with NUREG-07DD guidelines, several groups of HEDs, including HEDs considered to warrant no corrective action, were sub-jected to a detailed evaluation. 2. Selection of Design Improvements Overall, it appears that the selection of design improvements was an integral part of the DCRDR performed at Oyster Creek. A number of factors were considered by the review team in selecting design improvements. Examples of these factors include: (1) relative effectiveness of the action to correct the problems; and (2) relative practicality of implementing the action promptly. Possible alternative design improvements examined by the licensee were changes or additions to control. room hardware and administra-tive actions such as procedural changes or training. As a result of the selection process, the licensee stated that the vast majority of identified HEDs were considered correctible through hardware change. Only about 15% of i the deficiencies warranted procedural change. Based on this combination of verbal and written information, the audit team believes that the process implemented and the criteria used by GPUN to select design improvements to resolve HEDs satisfy the requirement of Supplement 1 to NUREG-0737. 14

3 and 4. Verification That Selected Design Improvements Will Provide the Mecessary Correction and Verification That Improvements Can be Introduced in the Control Room Without Creating Any Unacceptable j ) Human Engineering Discrepancies. The licensee did implement a process to verify that design improvements would provide the necessary correction without introducing new problems. All corrective actions were subjected to a human factors review and normal plant approval requirements for any changes to the existing configuration, documentation, and training. As previously mentioned, the licensee has developed a program that requires human factors reviews for both the conce tual and final designs of all control room modifications. System engineers and ISC personnel also review design changes. All corrective actions which involved changes in configuration were { incorporated on the full-scale mock-up. Walk-throughs were conducted with operating staff to confirm that the operators' response had been improved 8 i and that no new problems had been introduced. Thus, the licensee has met l these requirements of Supplement I to NUREG-0737. ANALYSIS OF PROPOSED DESIGN CHANGES AND JUSTIFICA SIGNIFICANCE TO BE LEFT UNCORRECTED OR PARTIALLY CORRECT 4 Licensees are required by Supplement 1 to NUREG-0737 to submit an outline of proposed design changes, including their proposed schedules for implementation and a summary justification for HEDs with safety significance to be left uncorrected or partially corrected. Results of the DCRDR, categorized into seven groups, were included in the Summary Report for Oyster Creek. A preliminary evaluation of the findings resulted in the identification of numerous HEDs, solutions, and/or schedules that were too ambiguous or briefly described to permit assessment. Many of these HEDs were discussed'by GpVN at the November 1-2 meeting (Reference 3). The remaining HEDs provided the focus for the pre-implemen-tation audit held on November 28, 1984, and were discussed in the Supplement to the Summary Report. 4 15 t a- ~-,,,,., ...-----,-...r- -n.---,,-------,------,.n----

... ~ The following are the results of the SAIC evaluation of proposed corrections and justifications for no correction. The evaluation considered documentation provided in the Summary Report and Supplement and in verbal information provided by the licensee at the meetings and audit. This review will retain the numbering scheme used by the licensee in the Supplement to the Summary Report to group HEDs. Each discrepancy is numbered sequent within each group. All the HEDs listed below require further evaluation by the licensee. Schedules for evaluation were provided by the licensee in the Supplement to the Summary Report. The licensee needs to describe proposed modifications as appropriate and provide a schedule for implementation in a future Supple-ment to the Summary Report. Group 1: HED No. 1-16 Group II: HED No. 21, 42, 49, 56, 66, 67, 69, 70, 71, 74, 75 Group IV: HED No.17, 37, 39. 43, 45, 58, 59, 60, 61, 62, 63, 64 Group VI: HED No. 10, 12 GROUP VII: No Action Required or Deficiency Corrected This group contained both HEDs that had been corrected and those HEDs that were assessed as requiring no action. Corrective actions already -completed were found to be adequate as were justifications and reasons provided for not correcting HEDs. CONCt.USIONS AND RECOMMENDATIONS We conclude that GPUN's control room design review activities completed to date satisfy most of the requirements specified in NUREG-0737, Supplement 1. However, three of the requirements have been been partially satisfied. The following is a summary of our comments on GPUN's compliance with each of the NUREG-0737, Supplement I review steps and requirements, It appears that a qualified multidisciplinary team was established e to conduct the DCRDR activities. 16

r A review of operating experience was conducted consistent with e NUREG-0700 guidelines and objectives. The itcensee's SF&TA included determination of functions an e in an iterative fashion and analysis and walk-throughs of Revision 2 of the SWROG updated E0Ps. GPUN needs to provide written docu-mentation of those processes it has described at meetings to determine information and controls required for emergency opera-tions and their requisite characteristics. Prior to the implemen-tation of Revision 3 of the EPGs, GPUN should carry out a system function and task analysis for these procedures using prescriptive task analysis techniques. The process used should be documented, and an example of completed task analysis worksheets, including the identification of display and control characteristics, should be submitted. The inventory by itself, as represented by a full-scale mock-up e and reproducible drawings, is satisfactory. GPUN has not provided a written description of how required characteristics were identified independently of the control room. Therefore it is not possible to evaluate their comparison to the inventory. In addi-tion, GPUN needs to conduct this comparison for Revision 3 of the EPGs. A human factors survey of the control. room was conducted in what e appears to be a thorough manner. GPUN used guidelines which it derived from several sources. It appears that the control room survey was conducted as required by Supplement I to NUREG-0737 The process GPUN described to assess the significance of HEDs e fulfills the requirements of Supplement 1 to NUREG-0737. The process implemented and criteria used by GPUN to select design e improvements to resolve HEDs fulfill the requirement of NUREG-0737 Supplement 1. 17 ) 1

The licensee implemented a process to verify that improvements o could be introduced into the control room without creating new HEDs. From information provided at a meeting and in documents submitted, e the audit team concluded that the licensee is satisfying the requirement to coordinate control room improvements with changes resulting from other improvement programs. GPUN has corrected many identified HEDs. Some, however, have not e been corrected at this time. The licensee should provide proposed modifications and/or implementation schedules for those HEDs previously identified in this report. T l 18

a. REFERENCES 1. " Summary Report on the Oyster Creek Control Room Design Review," GPU Nuclear, NRC Accession Number 8405150216, April 1984. 2. " Program Plan for the Control Room Human Factors Review at Oyster Creek Nuclear Generating Station " GPU Nuclear, June 1983. 3. Meeting held between the NRC and GPUN at MPR offices Washington, D.C. November 1-2, 1984.- 4. Pre-Implementation Audit held on November 28, 1984. 5. " Supplement to Summary Report on Oyster Creek Control Room Design Review." GPU Nuclear, April 1985. 6. NUREG-0660. Vol.1. "NRC Action Plan Developed as a Result of the TMI-2 Accident " U.S. Nuclear Regulatory Commission, May 1980. Revision 1 August 1980. 7. NUREG-0737, " Clarification of TMI Action Plan Requirements " U.S. Nuclear Regulatory Commission, November 1980. 8. NUREG-0737 Supplement 1 " Clarification of TMI Action Plan Require-ments " U.S. Nuclear Regulatory Commission. December 1982. 9. NUREG-0700, " Guidelines for Control Room Design Reviews," U.S. Nuclear Regulatory Commission September 1981. 10. NUREG-0800 " Evaluation Criteria for Detailed Control Room Design Review." U.S. Nuclear Regulatory Commission. October 1981. 11. Memo from W.T. Russell, Division of Human Factors Safety, to G.C. Lainas, Division of Licensing

Subject:

" Review of Oyster Creek Nuclear Generating Station Detailed Control Room Design Review Program Plan Submittal " February 1,1984. 12. NRC Staff Review of the 8WROG Control Room Survey Program (Generic Letter 83-18), April 19,1983. 13. Memo to Voss Moore from S. Weiss, May 14, 1984

Subject:

summary of task analysis requirements for the 8WR Owners Group. Meeting 14. Military Standard MIL-STD-1472B, Human Engineering Design Criteria for Military Systems Equipment and Facilities Department of Defense, Washington, D.C., December 1974, 15. VanCott, H.P. and Kinkade, R.G., Editors, " Human Engineering Guide to Equipment Design," Revised Edition, Government Printing Office,1972. 19 t -~.

.... ~ _ _.

16. Woodson.

W.G., and Conover. D.W., " Human Engineering Guide for Equipment Design." University of California Press.1964. O e 4 S

• 4 20

- - -... = = I LIST OF ATTENDEES OYSTER CREEK MEETING NOVEMBER 1-2, 1984 Name Organization Ann Ramey-Smith NRC/HFEB John Stokley SAIC Bonnie Rusinek GPU ~ Jack Donahue NRC/DL Rafael J. Gramatges WESC/GPU Michael Laggart GPUN Pat Walsh GPUN Herb Estrada MPR Gary Broughton GPUN Carol Kain SAIC i 21

l LIST OF ATTENDEES L! OYSTER CREEK PRE-IMPLEMENTATI6N AUDIT E NOVEMBER 18. 1984 Ni" Name Organization Ann Ramey-Smith C. J. Cowgill NRC/HFEB B. Rusinek SRI /0C GPU P. S. Walsh GPUN M. W. Laggart GPUN Herb Estrada MPR Assoc. T. G. Broughton GPUN Charles J. Haughney Ellen Levine Comex (NRC Contractor) SAIC Jack Donahue NRC/DL i 22

l APPENDIX A i The following is a description of some of the exhibits displayed and reviewed during the November 1-2, 1984 meeting between GPUN and the NRC: Materials used for the review of operating experience including e extracts of LERs and Operator Opinion Survey. e Program Plan. Annotated guidelines used as checklist in control room survey. e Sample flow charts of E0Ps including prototype procedure diagrams e for containment control and an overview matrix. Copy of "first-cut" procedures including the present (approved) e version of E0Ps. GPU checklist of instrument characteristics for E0Ps. o Correspondence related to verification of procedures. e Sample documentation of alarm system modification, including e before/after photos of alarm panels, various mock-ups used for development of alarm modification, and before/after sample of alarm response procedures, Drawing of 8F/9F including sample label plates. e Before/after photo of core spray logic. e Oyster Creek SAIC/1-263-07-557-48 Contract No. NRC-03-82-096 23

J" This is' the present status of Human Engineering Deficiencies (HED's) l requested to be reported on by the NRC staff during the October 9,1985 meeting. This submittal closes out reporting on summary item (4) refer-enced in NRC memo from Jack Donohew to GPU Nuclear Corporation December 17, 1985, on the Staff's Evaluation of the Detailed Control Room Design Review NUREG-0737 Item I.D.1. The HED's listed below are reported on: Group I: HED No. 1-1 thru l-16 Group II: HED No. 21, 42, 49, 56, 66, 67, 69, 70, 71, 74, 75 Group IV: HED No. 17, 37, 39, 43, 45, 58, 59, 60, 61, 62, 63, 64 Group VI: HED No. 10, 12 i 1 l

Page 1 (f 8. ITEM No. DEFICIENCY DESCRIPTION OF RESOLUTION CORRECTIVE ACTION 1-1 Yarway and reactor protection level instruments Evaluate removing density Project is underway to remove compensation, are not density compensated causing unnecessary compensation from contrt.1 level-GE providing guidelines. Scheduled to be alarms if density-compensated recorder is used instruments. done by 13R. for control. 1-2 Core region level instruments are not used. Evaluate making core region Instrument was upgraded and tested to instruments operational when improve operator confidence. Since reading pumps are running. is misleading with pumps on. evaluation - determined instrument should be off when pumps are on. 1-3 Need temperature indications for elevations in Upgrade temperature instrumentation'. Torus. RX Bldg. H&V and key drywell para-drywell, torus and H&V system. meters util be going to computer, available 11R. 1-4 Synchroscope operates counter to industry Evaluate making synchroscope rotate Technical and Human Factors evaluation' standard. in standard direction. determined modification is not necessary. 1-5 The added facades may aggravate the problem of Measure temperatures if facades are Temperature survey shows no modification high temperature in the spaces behind panels. installed. Correct as necessary. is necessary. 14 The differential pressure instrument currently Evaluate use of.present dp meter to Dp readings have use during normal opera-provided for the containment spray system display needed information. tion; local indication adequate as measures the difference between she11 side and emergency procedure does not require tubeside pressure and has no fonctional use. leanedtate operator action. The emergency procedure calls for a she11 side differential reading, which is only provided locally. 1-7 Displays associated with Rod Worth Minimizer are Consider relocating the electronics. Rod Worth Minim 12er and front controls will distracting to operator. Rod Worth Minimi2er (Note that a few of the indicator be resolved during 12R. displays and controls are not needed on front lights are used and would remain.) panel. 1-8 Condensate return valve control lacks ability to Operators can work with present on-Evaluation of throttle control indicates equilibrate heat removed by condenser and decay off control. Evaluate throttle available delta P is limited; impractical heat from reactor.

control, to install large size globe valve.

1-9 Condensate demineralizers have limited capacity A fluid system modification is This is a non safety system. Since this - especially at high powers, necessary to correct this problem is not a control room item it will be fully. Individual " runout" alarms tracked outside DCRDR. for feed pumps would help. Evaluate after completion of demineralizer mod now being made.

Page 2 of 8 ITEM me. DEFICIENCY DESCRIPTION OF RESOLUTION CORRECTIVE ACTION f 1-10 Operator is deprived of a rate-of-makeup Evaluate rearranging CR0 flow meter. Evaluation with operators indicated re-indication as flow increases, arrangement not necessary. Flow indication becomes pegged only when second CR0 pump is started during art emergency which is a rare occurrence. If emergency occurs, operator would know flow is above 100 GPM. 1-11 tow power feedwater control requires full-Evaluate a fluid system modification Valves were repaired and operator control time operator attention and results in (addition of Main Feed Regulator has improved. No further modifications thermal cycles to reactor vessel nozzle. Block Valves) to correct. are required. 1-12 Excessive reach required to operate valve Consider automatic control or Human Factors evaluation indicated to control reactor level during startup, improve location for manual control. modification not necessary. 1-13 Need controls for diesel generator output Analyze, not clear control is ESSF diesel generators, to be breakers. required. installed 12R, util have breaker controls in the Control Room and these diesel generators will provide power supply backup to the existing diesel generators. 1-14 Some controls are too sensitive. Evaluate on a case basis. Feedwater flow control and letdown flow control were studied. Maintenance program for the feedwater values has been upgraded and problem of cot 4rol of feedwater with the HP block valves corrected, tetdown control sensitivity problem is not related to plant safety.

Page 3 of 8-ITEM No. DEFICIE4CY DESCRIPTI0st OF RESOLUTION CORRECTIVE ACTIDst 1-15 Controls rotate opposite way expec'ted. Evaluate on a case basis. Main turbine associated controls on Panels 7F 4F/9F and 13e were evaluated as well as 3 3 the speed changer controls for.the diesel generators. The deficiency concerning the main turbine governor does not affect plant safety. Human factors evaluation indicated that modification of diesel generator-controls would suffer from negative transfer. Item controls for ESSF diesels to be installed 12R, will incorporate a speedchanger that rotates according to industry standard. 1-16 Some variables values are not accurately Treat on a case basis. This item was followed up as part of walk-measured by recorders, throughs for the relabeled replacement recorders installed during last outage. During these walkthroughs, no specific instance was found where a variable was inaccurate due to a deficiency in the sensor. Quality of recorders to be imprcved as part of recorder replacement program, 11R. p_

Page 4 of A' .ITDe no. . DEFICIENCY DESCRIPTION OF RESOLUTION CORRECTIVE ACTION- / ~ 2-21 ~ Arrangement and labeling of ventilation system Relabe1 and consider incorporation Labeling and demarcation to be provided. controls is confusing. Mimic would help. of Ilmited simic..(G5) Mimicing and rearrangement not required per Human Factors evaluation 2-C2 Some display scale graduations and unit labels -Scale graduations and labels will Recorders have been replaced, digital dis- -are too small and difficult to read. he improved..where meter size -plays have been added for key variables, permits. Uncorrected meters will scales are improved, none of controllers be evaluated for replacement, are important to safety. (G1.G2) 2-49 Yellow color code has various meanings. All indicators will be reviewed and Color code will conform to consistent changed to the color commonly used standard, scheduled in 11R. in the uttitty industry. (G6) 2-56 Ptsup and valve indicator lights are less than Replace old and discolored lens-Lens caps will be changed out on safety 10% brighter than their backgrounds. caps. Evaluate solutions to light related systems, scheduled 11R. variability problem. 2-66 Drywell vent and purge controls are located on a Relabel and demarcate. Consider Human Factors evaluation indicated back panel and arranged in a confusing way with rearranging to provide almic, rearrangement not necessary, relabeling inadeouate labeling. (G1, G5) will occur 12R. 2-67 Control switches for valves in cleanup system Relabeling w111 mitigate; mimicing Relabeling will be performed 11R, Human are confusingly arranged. should be evaluated. (G1) (G5) Factors evaluation indicated simicing and rearrangement not necessary. 2-C9 The condenser backwash controls are mirror Relabel, evaluate rearrangement Relabeling will be performed 11R, Human

imaged, and/or mimicing. (GI, GS)

Factors evaluation indicated mimicing and rearrangement not necessary. 2-70 Electrical system displays not well grouped. Labeling may mitigate. Consider Mimicing and labe11pg will correct. 11R. selected rearrangements. -(GI, G57) 2-71 A mimic would be useful in checking valve lineup Consider rearrangement or Relabeling will be performed 11R, Human (Condenser Backwash Controls). mimicing. Factors evaluation indicated simicing and rearrangement not nacessary, g

Page 5 of 8 , ITEM No. DEFICIENCY DESCRIPTION OF NESOLUTION CORRECTIVE ACTION f 2-74 For certain angular positions, the needle of the Consider replacement of meter Diesel generator voltage and power meters GE circular electrical meters can obscure the scales. (G2) and battery bus A. E and C voltage and number adjacent to the scale mark to adttch it is current meters will be replaced with

pointing, vertical meters in IIR. All other meters are either not safety related or have low probability of causing operator error.

2-75 Differences in units exist between rate and Evaluation will be done to add BA #328030 will correct, will provide integral displays for fluid system. labeling showing tank capacities labels indicating relationship between and relationship between volume volume and level, llR. and level.

Page 6 of'S ITEM Wo. DEFICIENCY DESCRIPTION OF ~ RESOLUTION, CORRECTIVE ACTION f 4-17 No display or alarm for reactor butiding sumps Consider adding appropriate alarms RX Bldg. Suno alarm will be added as'part or torus room sump in control room, or displays in control room. of BA 402791 in Cycle 12, 4-37 Design and operation of strip chart recorders is Replacement of some multipoint Some recorders replaced leR. Replacement inadequate, recorders is considered. Evaluate program extends over outages 12R and 13R. need for trend information on re-maining recorders (both multipoint and 2-pen). Provide replacement recorders or other means of dis-playing trend information (e.g.. computer trend) where required. (G3. G9) 4-30 Selection of time scale and recorder speed often Replacement of some multipoint Some recorders replaced 10R. replacement do not allow the rate of change information the recorders is considered. Evaluate program extends over outages 12R and 13R. operator needs to be inferred from the recording. need for trend inforination on remaining recorders (both multipoint and 2-pen). Provide replacement recorders or other means of displaying trend information (e.g., computer trend) where required. (G3, G9) 4-43 All the torus water level instruments utilize Investigate means for ensuring Redundant instrumentation and alarm re-a common standpipe. standpipe is full. sponse procedure cover this concern, no modification required. 4-45 Operator must confirm the de-energization of the Indicator lights should be put on Indicator lights will be put on front 8 scram solenoids by checking the 8 indicator front panel. panel IIR. light bulbs tested at periodic itehts on one of the back panels. In addition, intervals to avoid error. burned out indicator light bulbs can lead operator to make a serious error. 4-58 Two-pen recorders fail as is and the absence of On replacement 2-pen recorders. Important parameters have redundant analog chart motion may not be inenedtately obvious, consider use of " power on" light, and digital displays. (G3) 4-50 Controls difficult to reach. (ATWOS and Steam Consider relocation of steam line Actions are infrequent and of a monitoring line valve controls too high, others too low). valve controls, for others, no or test nature and not time critical; corrective action recommended at rolling step ladder available, no modifi-this time. cation necessary. v

Page 7 of 8 ITEM No. DEFICIENCY DESCRIPTION OF KSOLUTION CORRECTIVE ACTION / 4-6, vacuum pump controls on panel 13R are opposite Consider rearrangement, relabeling. Human Factors evaluation indicated con-the norinal lef t-to-right sequence. (GS GI) trols are not reversed; relabeling and desercation program for back panels scheduled for 12R. 441 Certain valve controls on panel 12XR are out of Consider rearrangement. Human Factors evaluation considers re-normal sequence, relabeling. (G5. GI) arrangement unnecessary; operator takes responsive action does not initiate active control. 442 Control for the 3 feedwater pumps are in a Consider rearrangement. Human Factors evaluation with operators horizontal array, while the controls for the 3 relabeling. (GS. G1) showed rearrangement not necessary; condensate pumps that supply them are arranged labeling and demarcation to be performed vertically 11R. 4-63 MSIV test Pushbuttons are hard to operate. Relocation of these pushbuttons (to Human factors study indicates rolling step a lower location) may improve ladder available for the convenience of operability. (GS) operator. Operators are satisfied with location of pushbuttons. Pushbuttons will not be moved. 4-64 On panels 13R. left and right test selection Consider switch replacement. Rarely used. Human Factors evaluation switches for the reheat stop valves and the showed not confusing to operators, no selectors for the turbine bypass valves rotate modification required. through 360. N

. - ~ _ - - - 'P!ge 8'cf 8 ITEM me. OEfICIENCY DESCeIPTION OF RESOLUTION C0eetCTIVE ACTION l 6-10 There is no means for adding or controlling Evaluate installing reliable Numidity study indicates readings within humidtty. humidtfier, acceptable boundaries. O-12 Present location of GSS/COS office is unable to Relocate GSS office to room Computer will be removed in 12e and room prevent casual entry to control area by currently occupied by Prime will be available to use as GSS office. persorwiel who have no reason for being there. Computer. a}}