ML20203G741

From kanterella
Jump to navigation Jump to search
Technical Evaluation of Dcrdr,San Onofre Generating Station,Units 2 & 3
ML20203G741
Person / Time
Site: San Onofre  Southern California Edison icon.png
Issue date: 03/27/1986
From:
SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:
NRC
Shared Package
ML13333B403 List:
References
CON-NRC-03-82-096, CON-NRC-3-82-96 SAIC-86-3025, NUDOCS 8604290244
Download: ML20203G741 (51)
v • d • e


Text

    • '

ENCLOSURE 2 SAIC-86/3025 TECHNICAL EVALUATION OF THE DETAILED CONTROL ROOM DESIGN REVIEW SOUTHERN CALIFORNIA EDISON COMPANY'S SAN ON0FRE NUCLEAR GENERATING STATION, UNITS 2 AND 3 4

March 27, 1986 Prepared by: .

Science Applications International Corporation 1710 Goodridge Drive McLean, Virginia 22102 Under Contract to:

U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Contract No. NRC-03-82-096 i

i f

s El(ja-

3 4 FOREWORD This Technical Evaluation Report was prepared by Science Applications International Corporation (SAIC) under Contract NRC-03-82-096, Technical Assistance in Support of NRC Licensing Actions: Program III. The NRC previously reviewed San Onofre Nuclear Generating Station's (SONGS) (Units 2 and 3) Detailed Control Room Design Review (DCRDR) combined Program Plan and Summary Report which was submitted on January 31, 1984, and subsequently scheduled a meeting with SONGS on August 30, 1984. Meeting minutes 'were prepared and sent to Southern California Edison Company (SCE) on September 14, 1984. During the week of June 17-21, 1985, NRC conducted an in-progress audit at SONGS 2 and 3 and transmitted the results in an audit report on July 30, 1985. SONGS submitted a supplement to the Summary Report in January 1986.

This Technical Evaluation Report (TER) is based upon all information supplied in the SONGS supplemental report as well as the previous informa-tion exchanges mentioned above. This is the second TER prepared by SAIC.

The first TER was provided after receiving a combined Program Plan and Summary Report from SONGS which, through the evaluation process, did not appear to constitute a Summary Report submittal, i

i i

9

.* r .- .

4 TABLE OF CONTENTS Section Page i

BACKGROUND . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 DISCUSSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1 1. Establishment of a Qualified Multidisciplinary Review Team . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2. System Function and Task Analysis ............. 6
3. A Comparison of Display and Control Requirements With a Control Room Inventory . . . . . . . . . . . . . . . . . . . 9
4. A Control Room Survey To Identify Deviations From Accepted Human Factors Principles ............. 12
5. Assessment of HEDs To Determine Which Are Significant and Should Be Corrected .................. 16
6. Selection of Design Improvements . . . . . . . . . . . . . . 20
7. Verification That Improvements Will Provide the Necessary Improvements / Verification That Control Room Modifications Do Not Introduce New HEDs ................. 21
8. Coordination of Control Room Improvements With Changes From Other-Programs Such as the Safety Parameter Display System

[ (SPDS), Operator Training, Reg. Guide 1.97 Instrumentation, and Upgraded Emergency Operating Procedures (E0Ps) . . . . . 22

9. Operating Experience Review ................ 25
10. Analysis of Proposed Design Changes Schedule for Implementing Design Changes, and Justification for No Corrective Action . . . . . . . . . . . . . . . . . . . . 27 CONCLUSIONS AND RECOMMENDATIONS ................... 28 AGENDA FOR ABBREVIATED AUDIT AT SONGS 2 AND 3 ............ 30
REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 l APPENDIX A - Control Panels and Consoles . . . . . . . . . . . . . . . 33 j APPENDIX B - Operational Support Systems . . . . . . . . . . . . . . . 35 APPENDIX C - Control / Display Hardware ................ 37 APPENDIX D - Workspace/ Environment . . . . . . . . . . . . . . . . . . 39 APPENDIX E - HEDs Resulting From the Verification and Validation Review Phases . . . . . . . . . . . . . . . . . . . . . . 41 APPENDIX F - NRC Audit Items . . . . . . . . . . . . . . . . . . . . . 42 4

4 i

. _ _ . , , - . . _ . ~ _ _ _ , _ _ . . _ _ _ _ _ - _ . . . _ _ _ . . . , _ _ _ _ _ . , , _ . _ _ , . . . , _ _ . _ , _ _ _ _ _ . . _ _ _ _ _ . _ . _ _ _ _ _ . , . - - _ _ _ _ .

TECHNICAL EVALUATION OF THE  !

DETAILED CONTROL ROOM DESIGN REVIEW FOR SAN ONOFRE NUCLEAR GENERATING STATION, UNITS 2 AND 3 BACKGROUND Licensees and applicants for operating licenses shall conduct a Detailed Control Room Design Review (DCRDR). The objective is to " improve the ability of nuclear power plant control room operators to prevent acci-dents or cope with accidents if they occur by improving the information provided to them" (NUREG-0660, Item I.D - Reference 1). The need to conduct a DCRDR was confirmed in NUREG-0737 and Supplement 1 to NUREG-0737 (Reference 2). DCRDR requirements in Supplement I to NUREG-0737 replaced those in earlier documents. Supplement I to NUREG-0737 requires each appli-cant or licensee to conduct a DCRDR on a schedule negotiated with the Nuclear Regulatory Commission (NRC).

NUREG-0700 (Reference 3) describes four phases of the DCRDR and provides applicants and licensees with guidelines for their conduct. The phases are:

1. Planning
2. Review
3. Assessment and Implementation
4. Reporting.

The requirements of Supplement I to NUREG-0737 indicate the need to include a number of elements in the DCRDR. They are:

l

1. Establishment of a qualified multidisciplinary review team.
2. Function and task analys'es to identify control room operator tasks and information and control requirements during emergency opera-tions.

I

~

3. A comparison of display and control requirements with a control room inventory.
4. A control room survey to identify deviations from accepted human factors principles.

. 5. Assessment of human engineering discrepancies (HEDs) to determine which are significant and should be corrected.

6. Selection of design improvements.
7. Verification that selected design improvements will provide the necessary correction.
8. Verification that improvements will not introduce new HEDs.
9. Coordination of control room improvements with changes from other programs such as the safety parameter display system (SPDS),

operator training, Reg. Guide 1.97 instrumentation, and upgraded emergency operating procedures (EOPs).

Licensees are expected to complete Element I during the DCRDR's planning phase, Elements 2 through 4 during the DCRDR's review phase, and Elements 5 through 8 during the DCRDR's assessment and implementation phase.

Completion of Element 9 is expected to cut across the planning, review, and assessment and implementation phases.

l A Summary Report is to be submitted at the end of the DCRDR. As a minimum it shall:

1. Outline proposed control room changes.
2. Outline proposed schedules for implementation.

l

3. Provide summary justification for HEDs with safety significance to l

be left uncorrected or partially corrected.

l 2 t

The NRC staff evaluates the organization, process, and results of the DCRDR. Results of the evaluation are documented in a Safety Evaluation Report (SER) published within two months after receipt of the Summary Report. Guidance contained in NUREG-0800, Section 18.1 (Reference 4) is provided to evaluate the acceptability of this Summary Report.

DISCUSSION Southern California Edison Company (SCE) submitted to the NRC a DCRDR Program Plan and Summary Report for the San Onofre Nuclear Generating Station (SONGS) Units 2 and 3, on January 31, 1984 (References 5 and 6).

Based on a review of that submittal, the NRC scheduled a meeting with SCE to discuss NRC concerns regarding the submittal. That meeting was held on August 30, 1984, and meeting minutes were prepared which represented the NRC's response to SCE's combined DCRDR Program Plan and Summary Report (Reference 7). Also, the NRC evaluation of the submittal led to the deci-sion to conduct an on-site audit in order to clarify the review methodology, -

to audit documentation completed to date, and to provide feedback to the licensee regarding the acceptability of the review being conducted. The audit was conducted during. June 17-21, 1985, and results were documented and transmitted to SCE on July 30, 1985 (Reference 8).

SCE submitted a four-volume Supplement to the Summary Report for San Onofre Units 2 and 3 on January 30, 1986 (Reference 9). The technical evaluation provided below is based on all information transmitted at this time and is arranged in order of the DCRDR elements identified in Supplement I to NUREG-0737.

1. Establishment of a Qualified Multidisciolinary Review Team.

The organization for conduct of a successful DCRDR can vary widely, but is expected to conform to some general criteria. Overall administrative leadership should be provided by a utility employee. The DCRDR team should be given sufficient authority to carry out its mission. A core group of specialists in the field of human factors engineering and nuclear engi-neering are expected to participate with assistance as required from Other i

disciplines. Staffing for each technical task should bring appropriate expertise to bear. Human factors expertise should be included in the 3

. . _ . .. _ _ L... -- -__. _ _ _ _ _

,o e ,. .

staffing for most, if not all, technical tasks. Finally, the DCRDR team should receive an orientation which contributes to the success of the DCRDR.

Section 18-1, Appendix A, of NUREG-0800 (Reference 4) describes criteria for the multidisciplinary review team in more detail.

The Southern California Edison (SCE) DCRDR is an effort that builds upon an earlier design review that was performed as a condition of licensing. That review, performed in 1980, was conducted prior to the establishment of the requirements in NUREG-0737, Supplement 1, and therefore was not responsive to all of the specified requirements. The review team determined, however, that the earlier review was conducted in good faith by a qualified multidisciplinary team and resulted in substantial findings and modifications to the control room design.

The Supplement to the Summary Report includes a description of San Onofre's Units 2 and 3 DCRDR Management and Staffing. The SCE approach to management of the control room design review is outlined in Figure 1-5 of the Summary Report. The elements include the following:

1. Steering Committee
2. DCRDR Working Group
3. DCRDR Human Engineering Discrepancy Assessment Team
4. DCRDR Human Engineering Discrepancy Evaluation Team
5. Human Factors Engineering Consultants
6. DCRDR Line Organization Support
7. Combustion Engineering Owner's Group
8. SCE Site Change Committee The Steering Committee was composed of four members representing engi-neering management within both Southern California Edison (SCE) and Bechtel Power Corporation (BPC). All of them were registered professional engineers with extensive control systems design experience. Their resumes were pro-vided in Appendix 1A of the Supplement to the Summary Report. The DCRDR working group was composed of a core team of ten members and included human factors engineering consultants (HFC), a senior reactor operator (SRO),

instrumentation and control (!&C) engineers, Nuclear Steam Supply System engineers and Balance of Plant engineers. Additional members from the SCE/BPC line organization provided assistance for certain planned tasks.

4

Examination of the resumes of the DCRDR working group members indicated  :

their expertise with nuclear power plant fundamentals, design, and opera-tion; and it indicated that each of the disciplines described in Section 18-1 Appendix A, NUREG-0800 was available.

The Supplement to the Summary Report also indicates that Whitston Associates / Monterey Power Technologies provided orientation and training for the DCRDR working group and participating line organizations to familiarize personnel with the principles of human factors engineering and their appli-cations to the DCRDR. Task assignments were then based on previous experi-ence of the review team members. Table 1-1 of the Supplement to the Summary Report shows the task listing of the DCRDR working group. Table 1-2 and Table 1-3 gives the breakdown and assignment of tasks by responsibic, alter-i nate, and support engineers. In addition, Figure 1-4 of the Supplement to the Summary Report gives a detailed schedule for each of the tasks including the assessment and implementation phases, developed for the DCRDR during the planning phase.

During the in-progress audit, the audit team found that while the team members selected for the DCRDR are both qualified and multidisciplinary, questions surfaced regarding the organization and management of the DCRDR staff. In particular, the NRC audit team was concerned that separation of members between the review phase and the assessment phase may result in a fragmented approach rather than a collective cohesive one. This concern is resolved, as the Supplement to the Summary Report shows that there are some members who are in both the review phase and the assessment phase. Another concern of the audit team was that no person or group was assigned the i responsibility to coordinate and integrate the DCRDR with other improvement programs. This concern is also resolved, as Table 1-1 of the Supplement to the Summary Report mentions three engineers responsible for co-ordination of DCRDR with NUREG-0737, Supplement I activities. The final concern of the audit team, related to team members' assignments, was the need to develop a complete plan for DCRDR work still to be completed, such as the task analy-sis. The Supplement to the Summary Report shows that this concern is resolved; Table 1-1 gives detailed information of the task assignments by name for all the elements, and Table 1-2 and Table 1-3 give a breakdown and .

assignments of tasks by responsible engineers, alternate engineers, and support engineers.

5

As noted, the Supplement to the Summary Report provides the resumes of the principle DCRDR team members, along with a description of team manage-ment and staffing. Evaluation of the Supplement to the Summary Report documentation and review of the in-progress audit evaluation of team struc-l ture was conducted in order to verify that all previous NRC concerns had been addressed. As a result, the reviewers conclude that the structure and management of the DCRDR team satisfies the Supplement I to NUREG-0737 requirement for a qualified multidisciplinary review team.

2. System Function and Task Analysis.

The purpose of the system function and task analysis is to identify the control room operators' tasks during emergency operations and to determine the information and control capabilities the operators need in the control

, room to perform those tasks. An acceptable process for conducting the function and task analysis is:

1. Analyze the functions performed by systems in responding to tran-sients and accidents in order to identify and describe those tasks
operators are expected to perform.
2. For each task identified in Item 1 above, determine the information

, (e.g., parameter, value, status) which signals the need to perform the task, the control capabilities needed to perform the task, and the feedback information needed to monitor task performance.

3. Analyze the information and control capability needs identified in

% Item 2 above to determine appropriate characteristics for displays and control to satisfy those needs.

The System Function and Task Analysis (SFTA) performed at han Onofre '2 and 3 (SONGS 2 and 3) was based on the Combustion Engineering Owners Group (CE0G) generic information and control characteristics review (ICCR) that This generic ICCR was developed from was submitted to the NRC in CEN-307.

l the Combustion Engineering Emergency Procedure Guidelines (CE EPGs),

! Revision 2. The CE EPGs were also the basis for developing the plant-specific SONGS 2 and 3 Emergency Procedure Technical Guidelines (EPTGs),

which were subsequently used to establish the plant-specific Emergency l

6

e Operating Instructions (E0!s) (Reference 9). The scope of the review also encompassed the remote shutdown capability. The review of the generic ICCR, EPTGs and other SFTA tasks were performed by a team of professionals which consisted of HFCs, SR0s, I&C Specialists, Design Specialists, and Techni-cians.

In establishing the EPGs, CE0G had adequately performed a system function analysis for symptom-based emergency operations. However, the identification of information and control requirements was not adequately addressed by CE0G .in the early development of generic EPGs. In order to rectify this problem, CEOG performed a generic ICCR in 1984 and 1985 to define tasks and task element specifications that would be used as a basis for identifying information and control requirements and their associated characteristics. The generic ICCR was approved by the NRC staff.

In the process of developing its plant-specific SFTA, SCE identified differences in system designs and operations and modified applicable portions of the generic ICCR accordingly. The licensee also developed SONGS 2 and 3 EPTGs that were independent of the existing control room design.

These two efforts have provided a consolidated basis for establishing the SONGS 2 and 3 plant-specific information and control requirements.

The steps involved in the generation of the licensee's plant-specific ICCR can be summarized as follows:

l i

1. Identify the applicable systems that are -cquired for the emergency operations, i 2. Generate a list of tasks associated with the plant systems and I

subsystems for the entire range of emergency operations.

l

3. Perform a " commonality analysis" which produces a standardized list
of tasks that is unique across the EPGs.

1

4. Analyze each standard task into task elements or action steps.

7

5. Characterize the task elements on the component level to identi fy information and control requirements and their associated charac-teristics.
6. Consolidate all information and control characteristics associated with each component into one listing for comparison purposes.

The result of the plant-specific ICCR effort was to provide the infor-mation and control requirements and associated characteristics that are required for emergency operations. The requirements for displays include information on the type of display, range, accuracy, units, availability (i.e., power sources), and response time. For controls, the requirements consist of type of control, mode, range, units, availability, and response time.

During a preliminary review of the Supplement to the Summary Report, the reviewers identified several concerns with regard to the instrument and control data collection activity. First, the needed characteristics for

" type of display" (T00) list "value" with no specific definition of the term "value." Second, SCE stated that "... pressure units of psia and psig were considered equivalent." Without further clarification, the use of this unit equivalency is unacceptable. Third, SCE stated that "...most indicators have accuracies well within 15% (standard instrument accuracy is approximately 2%), so an accuracy requirement of 15% was met by most control room instrumentation." This amount of instrument inaccuracy was found to be unacceptable, and the licensee was requested to provide further justifica-tion on its position.

In an informal response to the NRC dated February 25, 1986, SCE addressed the first concern by indicating tha.t the term "value" was used to denote a direct reading meter as opposed to a strip chart recorder, open/

closed indicator lights, etc. This clarification adequately resolves the reviewers' concern. To address the second concern SCE provided justifica-tion for its statement regarding the use of " psia" and "psig" interchangeably by indicating that the citation was an isolated case which involved an engineering judgment. The licensee further explained that for pressure indicators that require a scale of 0-2500 psi or 0-1200 psi (such as indicators for Steam Generator Pressure, Reactor Pressure, etc.), the 8

..,--_,.__.m_ _ . . , - __._m. _ . _._ _ . - . ,

difference between " psia" and "psig" units is minimal, and therefore, they can be assumed to be equivalent. However, for pressure indicators with a scale range of 0-50 psi, the licensee confirmed that the units of " psia" and "psig" would not be considered equivalent, and an engineering. Judgment would be effected to identify the appropriate units. This resporise s~atisfactorily resolves the reviewers' concern raised during the preliminary review. To address the third concern (instrument accuracy requirements) SCE. provided additional information in the informal response of February 25, 1986.

However, it does not fully resolve reviewers' questions regarding determination of instrument inaccuracies. Reviewers are concerned with the level of detail documented on the Instrumentation and Control Documentation Form.

Additionally, subsequent review of the SFTA methodology indicates that the interval and division characteristics of operator information needs were.

not determined during the task analysis but were evaluated as part of the control room walk-through validation process (page 5-8, Reference 9). Our.

review of the validation process as described in the Supplement did not yield any conclusive information associated with this step. Therefore, a complete review of the SFTA efforts cannot be provided.

In summary, it appears that the licensee has performed an SFTA conform-ing to the guidelines of NUREG-0700. However, the licensee must address the reviewers' concerns with the methodology issues documented above before conclusions can be drawn as to SCE's satisfaction of this requirement of NUREG-0737, Supplement 1.

l t

3. A Comoarison of Disolav and Control Reouirements With a Control Room Inventorv

l According to the NRC requirement stated in NUREG-0737, Supplement 1, l the DCRDR should include: "(iii) 'a comparison of.the display and control '

requirements with a control room inventory to identify missing controls and l

displays" (Reference 2). The'necessary inputs for this requirement are the

! products from the task analysis (the needed instruments and controls and their characteristics), and the contr.ol room inventory. The intent of this l requirement is to identify any missing controls and displays, and those that are unsuitable for the operator task needs.

9 l

1

l

- SCE has developed a formal inventory of the existing instrumentation and controls in the control room. The information was collected from SONGS' official design documents such as:

1. Control panel drawings that contained information on panel compo-nents, their locations, tag numbers, and their description or function.
2. Design change notices which affected the current panel drawings.
3. The official nameplate list that contained the exact wording on each component nameplate.

The inventory was then verified against the existing installed instruments and controls for its correctness and completeness. The complete and veri-fied inventory was then computerized with the ability to sort on various elements within the database.

At the in-progress audit, the NRC reviewed a sample page of the inven-tory and found that all of the characteristics of the instruments and controls were not inventoried. SCE was advised to ensure that the type of inventory items selected to characterize the instruments and controls match the type identified during the task analysis (Reference 8). A review of the inventory pages presented in the Supplement to the Summary Report indicates that there is no change from the sample page provided at the audit. Thus, the concern raised by the NRC team at the audit still remains and should be addressed by the licensee.

SCE has performed a comparison of the information and control require-ments with a control room inventory. The methodology for conducting this comparison effort was divided into two activities:

1. The availability verification
2. The utilization verification The availability verification activity was further divided into two steps which called for:

10

a l

1 l

1. A suitability check (i.e., identify potentially suitable equipment I in the control room that would satisfy the requirement of the ICCR).
2. An availability check (i.e., compare the characteristics of the existing instrument or control against the requirements as defined by the ICCR).

On the other hand, the utilization verification activity was performed to identify unused or unnecessary equipment and mark them for possible removal from the panels. While the process for the comparison effort appears to be adequate, there is a concern related to the suitability check mentioned above. As noted during the review of the SFTA, it appears that all of the characteristics of operator information and control needs were not fully determined prior to the comparison effort.

Specifically, the reviewers are concerned with the use of unacceptable criteria for instrument accuracy and the lack of information describing the interval and division characteristics of the control room instrument.

Without resolving these concerns, the comparison process as presented would not have led to the determination of the appropriate equipment for operator tasks as required by the emergency operations. Additionally, a review of the findings indicates that this comparison effort only resulted in the identification of five HEDs; this small amount of HEDs may be construed as an indication of the short-comings in the SFTA methodology. Finally, reviewers note that no HEDs associated with the remote shutdown panel were identified. The licensee states that " requirements for controls...were not satisfied by the remote shutdown panel" (pg. 6-6, Reference 9). However, it also states that "the control requiremerts were satisfied if either a remote shutdown panel control or some method of local control was available." This l still does not fully justify the lack of control requirements for the remote

shutdown panel. The licensee should provide further clarification regarding these statements.

SCE has also performed a validation of control room functions using desk-top review .and simulator exercise techniques. Desk-top reviews were performed for all E01s while they were developed. All identified 11

discrepancies were noted and resolved accordingly before conducting simula-tor exercises. The objective of the simulator exercises was to observe:

1. Performance of all updated E01s. i l

1

2. Operator responses to 55 failure events.  ;
3. Operator responses to a special test simulating 'a multiple events transient.

Any problems observed during these simulator exercises were recorded and HEDs were initiated and assessed accordingly. A review of the events exer-cised on the simulator indicates that the licensee has covered more scenarios than those recommended by NUREG-0700. This validation process which identified three HEDs appears to be consistent with the recommenda-tions of NUREG-0700.

In summary, it appears that the licensee has developed a method for comparing the existing control room equipment to the needed information and control capabilities identified during the SFTA. However, there are poten-tial problems concerning the use of the results from the SFTA for the suitability comparison effort. In addition, there is a concern that the data collection form for recording the control room inventory excludes some of the characteristics of displays and controls required to produce a mean-ingful comparison. In addition, the task analysis excluded interval and division characteristics and detailed instrument accuracy. Finally, the licensee should clarify the issue concerning control requirements for the remote shutdown panel. These concerns should be resolved by the licensee in order to meet this requirement of NUREG-0737, Supplement 1. Although not required by Supplement I to NUREG-0737, th'e licensee performed a validation of control room functions consistent with the guidelines of NUREG-0700.

4. A Control Room Survey To Identify Deviations From AcceDted Human Factors Princioles.

One of the requirements of Supplement I to NUREG-0737 is to conduct a control room survey to identify deviations from human factors principles.

The key to a successful control room survey is a systematic comparison of 12

the control room against accepted human engineering guidelines. One accepted set of human engineering guidelines is provided by Section 6 of NUREG-0700. Discrepancies between the control room and human engineering guidelines should be documented as HEDs.

In 1980 SCE completed a control room survey during the preliminary design assessment (PDA) that was required for licensing and prior to the issuance of Supplement I to NUREG-0737. That survey was performed by Whitson Associates, SCE's human factors consultants. This effort was con-ducted before the NRC provided guidance in NUREG-0700; however, Whitson Associates prepared a manual of criteria to assist in identifying HEDs. SCE states in the Supplement to the Summary Report that the criteria are " effec-tively identical to that ultimately provided in Section 6 of NUREG-0700" (page 4.1-1, Reference 9). The current survey effort of 1985 was applied to the current control room configuration, presumably taking into account previous HEDs and the solutions implemented since the PDA. Also, SCE indi-cates that the DCRDR team applied criteria that are " systems oriented" and designed for an operating facility. Criteria were organized into the following five areas of the control room:

o Control panels and consoles o Operational support systems o Control / display hardware o Work space / environment o Discrete considerations The Supplement to the Summary Report contains information for each of these five areas and includes the criteria, criteria /NUREG-0700 Matrix, Metho-dology, Findings and Assessment, Recommendations, and Implementation. This information is presented in Section 4 of the Supplement to the Summary Report. The checklist used for the 1985 survey update is provided in Appendix 4A of the Supplement to the Summary Report. Information provided in Section 12 of the Supplement to the Summary Report provides further discussion of the annunciator system portion of the control room survey and what remains to be completed.

During the in-progress audit, the NRC audit team had expended consider-able effort in evaluating the thoroughness of the Whitson Criteria as 13 1____.____

compared with Section 6 of NUREG-0700. Overall, the criteria appeared sufficient, particularly in light of the effort completed during the PDA and apparent through the corrective actions implemented and observed by the NRC audit team.

Based on review of the Supplement to the Summary Report, the reviewers find that the 1985 survey upgrade appears to update the PDA control room survey sufficiently. However, there appears to be one area of the survey that is in progress - the annunciator survey. Also, the reviewers require more information describing the human factors survey of the control room computer systems.

The Supplement indicates that one recommendation from the DCRDR survey of the annunciator system is a new study " TASK K-409." This study is intended to proceed beyond previous efforts and will include "reconsidera-tion and redefinition of annunciator criteria in the light of human factors considerations, system hardware constraints, and the operating experience gained since the SONGS 2 and 3 were placed.in service." It will also include a second phase for " investigating and reviewing alarm window assignments including priority designations, appropriateness of multiple input combinations on single windows, relative window locations, and alarm input circuitry" (page 11-12, Ref. 9). Only after the study will action be taken.

Of concern to reviewers is the fact that SCE has expended considerable resources to improve the annunciator system since the plant began operating.

Although the accomplishments are significant, for example, nuisance alarms have been reduced from 100 to 10 per hour, SCE should consider the benefits of yet another study. _

Reviewers suggest that other options, such as replace-ment of the system, also be explored before embarking on this task.

Reviewers are also unclear why TASK K-409 is to incluje the evaluation of human factors criteria, such as " Identify windows that are not arranged in consistent functional groups" (page 11-6, Ref. 9). It appears that this evaluation should have been completed during the DCRDR. However, if it is j still to be done, SCE has not mentioned whether it will retain a human i

factors specialist from the DCRDR. Conduct of the task without this disci .

[

pline would be unacceptable.

l l

14 l

l

.. e A second area of the survey that appears incomplete is the control room computer systems. SCE's 1985 computer system survey update is described on pages 4.3.2-16 through 4.3.2-24 of the Supplement. It includes the results of the original survey at which time only the Plant Monitoring System (PMS) was installed. Since that time the Accident Monitoring System (AMS) has been added to the control room and was included in the survey update.

The AMS contains the Critical Safety Function Monitoring System (CFMS) which is SONGS terminology for the NRC-required Safety Parameter Display System (SPDS). In addition to the CFMS is another system which is a seismically qualified subset of the CFMS parameters "the qualified safety parameter display system" (QSPDS). The AMS also contains other functions such as an enhanced Historical Data Storage and Retrieval System (HDSR).

According to Appendix P to the Supplement, CE performed a human factors review of the CFMS. It is unclear whether the CE human factors survey was used by the DCRDR team or whether they performed a separate survey. Of further concern to the reviewers is the low number of HEDs reported for the CFMS and QSPDS. The vague descriptions of the HEDs reported also make it difficult to fully evaluate the completeness of the survey effort. Also, the NRC in-progress audit of June 12-21, 1985 identified 2 potential HEDs associated with the CFMS displays which indicated it had not been fully surveyed. More detailed discussion of the survey effort and HEDs could help to alleviate this concern regarding the thoroughness of the computer system survey.

Reviewers are also uncertain as to the exact use of the AMS and PMS and the primary users of the systems. While there appears to be 2 HEDs written for the AMS, many more were written for the PMS, some with respect to the consistency between the PMS and other displays while Mhors concern the system performance. One proposed solution for the PMS HEDs is replacement of the system, another addresses integration of the PMS and CFMS (page 4.3.2-23, Reference 9). Reviewers require more information regarding these considerations before a valid evaluation can be provided. A full descrip-tion of the systems, system users, and interfaces would have permitted a more complete evaluation.

In conclusion, the PDA and the 1985 control room survey upgrade appear to' substantially meet this requirement of Supplemant 1 to NUREG-0737.

15

However, SCE should provide information to clari fy reviewers' concerns described in the preceding paragraphs. In summary, those concerns are:

1. Identification of personnel who performed the survey of the control room computer systems and the scope of the effort.
2. The recommendation to conduct a new study of the annunciator system.
2. The proposed corrective actions and schedule for implementing cor-rective actions to resolve HEDs from the annunciator system survey.
5. Assessment of HEDs to Determine Which Are Sionificant and Should Be Corrected The objective of this element of the DCRDR is to evaluate and determine the effects that an HED may have as a potential cause for a control room operator to commit an error, to determine the safety significance of such an error, and to determine the potential for a resultant unsafe plant condition and/or a Technical Specification violation. In making these determinations the objective recognizes the consideration of the cumulative effects of HEDs which individually may be relatively insignificant. The final product of the HED assessment effort is the determination of which HEDs should be corrected because of their potential effect on the operator and on plant safety.

According to page 8-2 of the Supplement to the Summary Report, SCE's 1980 DCRDR HED assessment was based on whether:

"HED was associated with a safety system, and HED would ooviously decrease the opportunity for the operator to effectively monitor and control the necessary safety system parameters."

According to the licensee, these two conditions determined which correction category the HED would be placed in.

During the supplemental phase (1985) of the DCRDR, a more formal procedure for processing HEDs was developed and employed. The importance of 16

the individual HEDs, and assignment of priority for their correction, was assessed by considering three factors that influence the significance of each HED. The factors are " Potential for Error," " Degree of Safety Signifi-cance," and " Potential for Unsafe Condition or Technical Specification Violation." A constant relative weight was assigned to each of these factors, as shown below:

o Potential for Error - 0.555 o Degree of Safety Significance - 0.167 o Potential for Unsafe Condition or Technical Specification Violation - 0.278 These constant weights reflect the analysts' judgment of the contribution of each of these factors to each HED.

In addition, for each HED, a value was assigned to each of the three factors which indicates the seriousness of a particular situation and factor under consideration. The following scale was used for this purpose:

0 1 2 3 4 5 None Very Low Moderate High Very High Low or Documented These values are the relative magnitude of each factor for the particular HED under consideration and vary for each HED.

17

The "HED Point Value" representing the importance of the HED was next calculated using the relationship:

3 HED Point Value - E W j Mj i=1 where W j 's are the constant weights and M j 's are the relative magnitudes.

As an example, the first entry on Table 8-3 of the Supplement to the Summary Report which describes all the HEDs is the following:

Potential Safety Tech. Spec.

for Error Imoortance Violators Inadvertent CRIS actuation 5 1 0 The HED point value would then be:

(5)(0.555) + (1)(0.167) + (0)(0.278) = 2.942 Next, the following table was used to convert these HED point values to a priority level and schedule for modification:

Priority Level NRC Equivalent HED Point Schedule for for Correction Cateomry Value Ranae Modification

  • I IA 4.667 to 5.0 Prompt 2 IB 4.334 to 4.666 Prompt 3 IC 4.0 to 4.333 Prompt 4 IIA 3.5 to 3.999 Near-ienn 5 III 3.0 to 3.499 Near-Term 6 IIB 2.5 to 2.999 Near-Term 7 ID 2.0 to 2.499 Near-Term 8 IIC 1.0 to 1.999 Long-Term (Mandatory) 9 IV 0 to 0.999 Long-Term (Optional) l 18

{

1 l

The detailed procedure or process flow path for processing, disposi-tion, and tracking the resolution of individual HEDs is shown in Figure 8-1 of the supplementary submittal: "HED Processing Methodology Flowchart," and the " Organization Chart for HED Processing" is shown in Figure 8-2 of the supplementary submittal.

According to page 8-4 of the Supplement to the Summary Report, SCE processes HE0s or findings by using the following procedure:

" Utilizing the HE0 assessment criteria, Table 8-2 (of the supple-mentary submittal), review the description of the HE0 to determine if it is significant enough to be classified as .r. HED.

If the HE0 is deemed not significant enough to be classified as an HED, the rationale is documented on the form and the item is considered closed and the form filed in a special HE0 file. If the HE0 is considered to be an HED, proceed to Step 3" (i.e.,

Determination of Priority Level for Correction or Justification for the Correction, described in subsection 5.2. This categoriza-tion considers the probability of error, safety significance, and technical specification performance).

SCE indicated that Priority 9 HEDs were also evaluated to determine if the cumulative effects of a generic HED or several minor HEDs justified further consideration. Specifically, the question applied to these indi-

! vidual HEDs was whether:

"The continued existence of these cumulative discrepancies significantly complicate operations, increase the likelihood of misoperation or error, or lengthen the time required to perform an operation?" (p. 8-9, Reference 9) l If the team concurred that the above situation existed an HED was documented l and prioritized by the previously described process.

l In conclusion, the overall methodology for assessment and prioritiza-tion of HEDs appears reasonable. It would have been helpful, however, had some discussion of how the three weight factors were chosen. While l 19 l

assignment of 55% to potential for error may be reasonable, though a little high, the rationale supporting the assignment of 16% to degree of safety significance and 27% to unsafe condition and/or Technical Specification is not understood and seems unreasonable.

violation, respectively, Obviously, both the latter factors are related; however, without more detail regarding what each of these factors contains, the weights assigned seem disproportional. For example, a low score on the " Technical Specification violation" would decrease the entire assessment of an HED. Also, a zero assigned to " potential for error" does not seem valid and the assessr-mt results would be inaccurate.

While SCE has considered the cumulative effects of Priority 9 HEDs, it would be more complete if Priority 4 through 8 HEDs were also evaluated in this regard. Review of those HEDs placed in delayed schedules, in light of their cumulative effects, may result in the need for a more immediate solu-tion.

Another area where additional information would be helpful is in connection with the use of the HE0 Assessment Criteria. How many "Yes" or "No" answers are required to determine whether the observation is, in fact, an HE0 or an HED? Does each criterion carry equal weight in the decision-making process? In order to draw final conclusions, reviewers require information to address these concerns until which time this requirement of Supplement I to NUREG-0737 is an open item.

6. Selection of Desian Imorovements The purpose of selecting design improvements is, as a minimum, to correct safety-significant HEDs. The selection of design improvements should include a systematic process for development and comparison of alter-native means for resolving HEDs. Both enhancement and design modifications l
may be considered.

The process to select design improvements is described on pages 8-6 through 8-8 of the Supplement to the Summary Report. A recommendation is generated by the assessment team and proceeds through review and possible modification by the evaluation team and the site change committee. The specific process and criteria used to formulate design changes were not l

20

described, however, it appears from some of the proposed solutions that panel replicas and drawings were used. The evaluation team is ultimately responsible for the development of design solutions, while the site change committee provides review with regards to issues such as cost benefit, plant operation, technical specifications, and other site issues.

Reviewers found that the description of the process is substantial, appears to provide means to track decisions regarding design solutions, and ensures that necessary plant coordination functions associated with the design change are involved.

Any recommendation that is rejected by the site change committee is rerouted through the evaluation team who may provide another recommendation.

If a resolution cannot be agreed upon, the site change committee will have the final decision and reasons for disapproval will be documented.

The process for the selection of design improvements appears thorough and meets the requirement of Supplement 1 to NUREG-0737. SCE should ensure that the process is reapplied until all design solutions are selected.

7. Verification That Imorovements Will Provide the Necessary Imorovements/

Verification That Control Room Modifications Do Not Introduce New HEDs The process to verify that selected design improvements correct an HED without introducing new ones can be accomplished by a variety of ways.

NUREG-0800 suggests that the use of mock-ups is valuable for expioring instrument arrangements, addition or deletion of instruments, and surface enhancements. Reapplication of survey guidelines associated with design ,

changes, control room operator walk-throtghs, and a re-examination of infor-mation and control needs are possible approaches toward meeting this requirement.

Before a proposed HED corrective action that requires a design change is implemented, the HED evaluation team will conduct a review to verify that the corrective action will be effective and should not create any new HEDs.

This verification will utilize one of the following methods: a review of a hal f-scale control panel replica, a review of a full-scale mock-up, or a review in the simulator. The exact criteria or evaluation process, to 21

- I

verify HED corrections were not specifically mentioned; however, it appears that the human factors specialist participating on the evaluation team should help to ensure the review is successful.

Before a corrected HED can be closed following notification through established tracking procedures that corrective action has been completed, a review is conducted by the HED evaluation team to validate that the correc-tive action did not create a new HED. This validation will be performed either in the simulator or in the control room. A description of the scenarios or E0Is to be used for the validation was not given in the supple-mental report; had it been provided, SCE could have had more evidence that the procedure was adequate.

Although, the description of the procedure is brief, reviewers conclude that it is adequate to meet these requirements of Supplement I to NUREG-0737. The licensee should be reminded that the procedure should be reiter-ated until all design solutions are selected and implemented.

8. Coordination of Control Room Imorovements With Chances From Other Pro-orams Such as the Safety Parameter Disolay System (SPDS). Ooerator Trainina. Rea. Guide 1.97 Instrumentation, and Uoaraded Emeraency Oper-atina Procedures (EOPs)

The DCRDR is part of the post-Three Mile Island Emergency Response '

Initiatives which impact the control room, and as such requires integration with other programs. All modifications can be integrated with respect to design overlap and scheduling overlap as they affect the control room opera-tions. The DCRDR can be performed in such a way that changes are reviewed and implemented in a fashion that least disrupts operators and their activi-ties. The exact means of accomplishing this is dependent on the plant's own programs and the schedules. The result of successfully meeting this

! requirement should be the integration of control room changes to maintain a consistent, coherent, and effective control room for the operators to per-form their tasks. NUREG-0800 provides further guidance to assist in meeting these objectives.

22

1 SCE provides a description of the mechanisms and procedures to accom-plish this requirement in Section 9 of the Supplement to the Summary Report (pages 9-1 through 9-22). At the time of the in-progress audit, SCE pro-vided a presentation of the methods being used to integrate the DCRDR with other programs. NRC audit team concerns revolved around the need for a formalized method to accomplish the coordination function as well as the  ;

need to assign the responsibility to a person or group of people to help  !

ensure that it was carried out.

Section 1 of the Supplement to the Summary Report indicates that three persons were responsible for the coordination of DCRDR activities with other programs. Also, the supplement provides a thorough discussion of how each program overlapped and contains a schedule to show the coordination history of the resulting programs and modifications. The licensee states that in preparing the Supplement to the Summary Report, it has also performed a verification that each program has been successfully coordinated.

The following five upgrade programs were included in the coordination effort described by SCE:

a. Accident Monitoring System (AMS), Critical Functions Monitoring System (CFMS), and Qualified Safety Parameter Display System (QSPDS)
b. Emergency Operating Instructions (E01s) Review
c. Operator Staff Training
d. Regulatory Guide 1.97 Compliance
e. Onsite Technical Support Center (OTSC) and Emergency Operr. ting Facilities (EOF)

The means by which SCE coordinated these five programs is summarized in the following paragraphs.

23

a. SCE indicates that the AMS was " integrated into the control room design and plant operations by the critical safety function concept" (page 9-3, Reference 9). The AMS safety functions were also the basis for the CE EPGs and the SONGS E01s. The information and controls requirements defined in the DCRDR task analysis were used to verify the parameters selected for display on the CFMS and QSPDS (page 9-5, Reference 9).

SCE helped to incorporate the AMS into the control room with a verifi-cation and validation program to ensure that design requirements were met and that operators gained the needed information. Training of operators to the new systems was accomplished by incorporating it into requalification training. Human factors principles were incorporated into the overall design and displays during the design phase. The OCRDR task force also reviewed the systems.

b. The coordination of the DCRDR and the SONGS E01s was provided by using the task analysis to verify the adequacy of both the control room design / inventory and the E01s. Also, control room changes are routed through SCE station operations and technical representatives to evaluate for their impact on E01s.
c. Training was coordinated with DCRDR changes implemented in the control room by including station training representatives in the HED evalua-tion process. This permitted training personnel to note any HED cor-rection that will impact operator training on E0ls tasks and that will affect the simulator configuration. SCE also notes that the task analysis is used for defining tasks in '.he E01s to which operators must be trained.
d. Regulatory Guide 1.97 instrumentation was considered during the DCRDR by examining existing instrument characteristics and its capability to meet the Reg. Guide 1.97 needs. SCE relied on the AMS to meet most of the information needs. Human engineering principles were considered during implementation of new instrumentation and during the design of computer systems to provide the needed information and to enhance operator performance.
e. The technical support center and the emergency operations facility both were coordinated with the control room by examining the means to access 24

plant parameters and-safety status. This was accomplished via the CFMS and parameters on the QSPDS. Computer monitors are provided for both of these facilities. Information access and dedicated communication functions between the control room and these facilities is verified periodically during emergency preparedness tests.

In conclusion, SCE has established the mechanisms and procedures for integrating all emergency response intiative programs. SCE's Supplement to the Summary Report includes a thorough description of how the coordination has been accomplished. In addition, it indicates that a group of individuals was responsible for the effort and that the DCRDR team often participated in the other program activities. This requirement of Supple-ment I to NUREG-0737 has been satisfied.

9. Ooeratina Experience Review Although not a requirement of Supplement I to NUREG-0737, review of operating experience is beneficial to the DCRDR. SCE's review of operating experience consisted of two tasks:
1. Conducting operator interviews
2. Reviewing documentation relevant to plant operating experience SCE's objective for conducting the operator interviews and evaluating exist-ing documentation was to identify and record any HEDs that have been encoun-tered during operation of the plant.

Questionnaires were administered to the control room operators prior to the face-to-face interviews conducted by SCE's human factor specialists.

The interviews focused on the items checked on the questionnaire and items l added by a majority of other personnel. The interviews explored the specific nature of the problem, its prevalence, effects on control room operations, and suggestions for improvement. In addition, open-ended questions exploring the positive aspects of the control room were asked.

The results of the survey and interviews were turned over to the DCRDR working group and became the basis for several HEDs. As summarized in pages 2-29/2-30 of the Supplement to the Summary Report, the survey and interviews served as a valuable source of information for identifying possible human 25 9

engineerinc discrepancies and directed the team members to salient problems in the control room, many of which were already being addressed in design change packages initiated by SCE.

The review of documentation relevant to plant operating experience consisted of a review of the following documents:

1. Licensing Event Reports (LERs)
2. Startup Problem Reports (SPRs)
3. Station Incident Reports (SIRS)
4. Independent Safety Evaluation Group Reports (ISEG)
5. Operating Experience Feedback Reports
6. Human Performance Evaluation System Reports (HPES)

The plant-specific document review was limited to the review of those documents that were generated since the units were placed into commercial operation, and the review of startup problem reports that were generated during and after the startup phase of the plant. The objective was to review and evaluate the station operating experience using the station's documented reports to identify potential HEDs. The LERs, site problem reports, SPRs, SIRS, ISEG reports, and HPES reports were reviewed and eval-uated for potential HEDs. The pertinent problems were documented on the HED report form shown in Appendix D of the Supplement to the Summary Report.

The review of Unit 2 and 3 LERs resulted in four HEDs. A total of 787 SPRs were reviewed for both Units 2 and 3 which resulted in 145 HEDs of which 111 were annunciator related. A total of 112 SIRS were reviewed for both Units 2 and 3 which resulted in 4 HEDs. In short, the Supplement to the Summary Report demonstrates that useful data was obtained from the sources.

In summary, the operator interviews and the documentation review were l found to be acceptable and to have produced valuable data for integration into the survey, task analysis, and verification efforts and the identifica-tion and assessment of HEDs.

l l

l 26

l

10. Analysis of Proposed Desian Chances. Schedule for ImolementinalDesian Chances, and Justification for No Corrective Action SCE provides a brief discussion of findings generated from each review area, including the control room survey, the verification of instrument availability and suitability, the validation of control room functions, and operating experience review. The findings or HEDs are reported in light of the current DCRDR status and provide the earlier findings from the 1980 survey work. Recommendations for correction of the HEDs have been provided for review, though often the description is too brief for evaluation.

Appendices to this TER outline the specific comments and concerns that have resulted from an evaluation of the recommendations and implementation status. Because this TER has resulted in numerous questions, more informa-tion regarding the findings (or HED), the recommended action, and status of the actions must be gathered in order to evaluate fully the Summary Report.

Refer to appendices for exact comments and information needs.

The reviewers also have a significant concern with the documentation of HEDs and proposed corrective actions. Some HEDs appear to be comprised of one or more HEDs, and the corrective actions address only one of the HEDs.

Ambiguities in the document arose when reviewers attempted to trace the 1985 findings described in the review section text to Tables 8-3 "1985 HEDs by Category" and 12-2 " Summary of HED Disposition-Implementation Program."

Sometimes the final corrective actions did not agree, and other times recom-mendations and corrective actions were quite different. There ambiguities may be due to the documentation of several HEDs ender one HED number, and consequently more than one ccrrective ection would be found. Also, appar-ently at some point in the assessment process the site evaluation committee has modified changes. These instances of confusion are outlined in the appendices.

Another type of problem encountered in the review was the cancellation of Design Change Packages (DCPs) with no explanation in the text. Also, some areas of the DCRDR appear incomplete (for example, the annunciator survey), and reviewers are unable to review those proposed solutions.

Some cases of disagreement are cited between SCE and reviewers' priori-tization of HEDs; some HEDs were found to be of high safety significance but i

l 27

are prioritized by SCE into a relatively low category, therefore affecting the schedule for correction.

Documented in the appendices to this TER are reviewers' conclusions regarding the justifications for no corrective action. In most instances, reviewers require more information in order to evaluate fully the HED and the associated justifications. In other instances, reviewers disagree with the "no action" decision determined by the site change evaluation team.

CONCLUSIONS AND RECOMMENDATIONS

1. Establishment of a Multidisciplinary Team SCE's Supplement to the Summary Report has addressed concerns that resulted from tne in-progress audit. This requirement of Supplement I to NUREG-0737 has been satisfied.
2. Function and Task Analysis Based on the documentation provided in the Supplement to the Summary Report, reviewers found that the process used to perform the task analysis was generally adequate. However, some parts of the results - the character-istics of information and control requirements - were not defined to the necessary level of detail. Conclusions regarding this requirement cannot be made until the deficiencies found in the results are discussed with the licensee.
3. Control Room Inventory A control room inventory has been developed for comparison with the

! information and control requirements described in the task analysis.

Reviewers conclude the method is satisfactory; however, due to the deficien-i cies mentioned under Function and Task Analysis, the results may be incom-plete. It also appears that the inventory did not contain all the detail needed to conduct a meaningful comparison. Until these concerns are addressed, reviewers cannot draw a conclusion as to the satisfaction of this requirement.

28 l

1

( .

4. The Control Room Survey  ;.

Reviewers find that SCE has completed a substantial effort to address this requirement during both a 1980 preliminary design assessment and the current survey update. Reviewers are concerned, however, as to when two areas of the survey - the computer systems and annunciator - surveys will be complete. Also, more information describing the computer systems survey is required. Reviewers cannot fully evaluate SCE's satisfaction of this requirement until those concerns are addressed.

5. Assessment of HEDs Reviewers concluded that the HED assessment is systematic, however, more information is required concerning the weights assigned to safety, operator error, and technical specification violations. Also, reviewers are concerned about those findings assessed as HE0s and discarded. Conclusions cannot be provided until these concerns are addressed.
6. Selection of Design Improvements Reviewers conclude that the processes that have been developed will satisfy this requirement. Reapplication of those methods will be required, however, until all design solutions are selected.
7. Verification That Selected Design Improvements Will Provide the Neces-sary Correction Without Introducting New HEDs Reviewers conclude this requirement has been satisfied, but will need to be reiterated until design improvements are selected for all HEDs.
8. Coordination of Control Room Improvements With Changes From Other Programs SCE has provided a thorough description of the means by which this requirement was satisfied. Reviewers conclude that the requirement has been met.

29

l . .

9. Operating Experience Review SCE has reviewed documentation of plant and industry operating history and has surveyed operator experience through questionnaires and interviews.

Based on the description provided in the Supplement to the Summary Report, this review activity meets the guidance of NUREG-0700.

10. Analysis of Proposed Design Changes and a Schedule for Implementation SCE has implemented extensive human factors enhancements and modifica-tions since the original PDA in 1980. The reviewers have evaluated the results of the 1985 DCRDR update and have identified several types of concerns. Those concerns are specified in the appendices to the TER and need to be discussed with the licensee in order to evaluate fully the DCRDR for SONGS 2 and 3. Also, SCE should clarify why some HEDs will not be corrected until after the second refueling outage,
11. Justification for HEDs Left Uncorrected Reviewers have identified those HEDs for which a justification for no correction was either not provided or for which reviewers disagree or require more information. Those findings are listed in the appendices to this TER.

Because of the above outlined areas of concern, many of the requirements of Supplement 1 to NUREG-0737 could not be fully evaluated and conclusions could not be drawn. Therefore, it is recommended that an

  • abbreviated audit at SONGS 2 and 3 be conducted in order to clarify concerns resulting from SAIC's evaluation of the Supplement to the Summary Report and to resolve any open items.

AGENDA FOR ABBREVIATED AUDIT AT SONGS 2 AND 3

1. Function and Task Analysis Discuss the process used to generate a database of characteristics of instruments and controls that were identified during the task analysis.

Discuss all characteristics collected and how they were defined to help 30

identi fy missing and/or unsuitable controls and displays. Of particular concern is the acceptability of the large instrument inaccuracy as described in the SFTA, and the lack of information regarding the identification of interval and division characteristics of control room instruments.

2. Control Room Inventory Discuss the level of detail that was collected in the inventory to describe what information and control capabilities exist in the control room.

Discuss the methodology used to compare the information and control requirements and their characteristics to the existing equipment on the remote shutdown panel.

3. Control Room Survey Discuss the completeness of the computer portion of the survey and provide descriptions of the computer systems included in the-survey.

Describe the corrective actions and implementation schedule to resolve HEDs from the annunciator-survey and/or Task X-409. Also, discuss why a new annunciator study is needed.

4. Assessment of HEDs Provide method for assessing HE0s.

Discuss the weights assigned to safety, operator error, and techni-cal specification violation.

Discuss the prioritization of HEDs and schedule for corrections.

Also discuss the prioritization of HEDs that will not be corrected

until after the second refueling outage.
5. Discuss Questions Outlined in the Appendices to the TER 31

REFERENCES

1. NUREG-0660, "NRC Action Plan Developed as a Result of the TMI-2 Acci-dent," May 1980, Revision 1, August 1980.
2. NUREG-0737, Supplement 1, " Clarification of TMI Action Plan Require-ments," U.S. Nuclear Regulatory Commission, December 1982.
3. NUREG-0700, " Guidelines for Control Room Design Reviews," U.S. Nuclear Regulatory Commission, December 1982.
4. NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," Section 18.1, Rev. O, September 1984.
5. Control Room Design Review Plan, San Onofre Nuclear Generating Station, Units 2 and 3, SCE Document No. M37327, Revision 0, Southern California Edison Company, San Diego Gas and Electric Company, January 31, 1984.
6. Control Room Design Review Report, San Onofre Nuclear Generating Station, Units 2 and 3, SCE Document No. M37328, Revision 0, Southern j California Edison Company, San Diego Gas and Electric Company, January 31, 1984.
7. Minutes of Meettng Between NRC and SCE on the Detailed Control Room Design Review (LCRDR) for San Onofre, Units 2 and 3, September 14, 1984.
8. Results of In-Progress Audit of the Detailed Control Room Design Review for San Onofre Nuclear Generating Station (SONGS), Units-2 and 3, July 30, 1985.
9. Detailed Control Room Design Review Supplemental Report, San Onofre Nuclear Generating Station, Units 2 and 3, SCE Document No. M37328, Revision 0, Volumes 1, 2, 3 and 4, Southern California Edison Company, San Diego Gas and Electric Company, January 1986.

32

. APPENDIX A CONTROL PANELS AND CONSOLES These appendices contain findings and conclusions regarding HED correc-tive actions, justifications for no action and the implementation schedule.

It generally is organized by the same method as that used by SCE; each section contains the major review section as reported by SCE and subdivided into the subject categories.

Al. Hierarchical Systems Organization No Comments.

A2. Control / Display Integration The HEDs that are part of the 1985 DCRDR update are to be corrected by rearrangements. Those rearrangements are provided in the text and "are to be used as the basis for formulating the detailed engineering designs" (pg.

4.2.2-7, Reference 9). The proposed implementations are presently with management review. Reviewers are reluctant to draw conclusions because the proposed design solutions (relocations) are still being reviewed and may be modified during " detailed engineering design." Also, according to Table 12-2 some of the proposed-relocations were not approved and a justification for no action was not provided (see 57-A21-11, 58-A21-03, 63-A21-01).

A3. Demarcation The 1985 survey update did not result in any new HEDs.

A4. Labeling Seven HEDs resulted from the 1985 update. Reviewers concur with pro-posed solutions; however, solutions are before the site change review committee for concurrence. If implemented as proposed, reviewers find solutions acceptable.

i 33

A5. Use of Color No new HEDs were documented.

A6. Anthropometrics No new HEDs were documented; however, reviewers are concerned that the criteria used to assess the angle of the benchboard console was less conser-vative than that used in NUREG-0700 (Figure 4.2.6-1, Reference 9).

Reviewers need to evaluate this concern during an audit.

i 34

APPENDIX B OPERATIONAL SUPPORT SYSTEMS
81. Annunciators Reviewers require more information in order to evaluate the proposed design solutions because the solutions are deferred until another annuncia-tor study is completed (task K-409).

Also, on page 11-17, SCE indicated that ten of the DCPs from the earlier annunciator design solutions are cancelled. Those DCPs are men-tiened in Section 11 of the Supplement to the Summary Report but an explana-tion for cancellation was not provided.

82. Computer System Reviewers require more explanation for both the HED and the proposed solution or justification for no solution. Particularily for those HEDs that are to be corrected by replacement with a new computer. One question that arises, for example, is: When is the replacement for the PMS computer intended to be implemented, what is it, and how will it resolve the HEDs?

The specific concerns regarding this section are as follows.

o HEDs B25 and B24 The PMS alarm displays are delayed during upset conditions because of the number of alarms and the display method. SCE's action is that "for the replacement systems, opera-tor discretion will determine the delay in alarm display during upset conditions" (page 4.3.2-21). Reviewers believe a prompt solution should be provided and alarms should be presented sequen-tially.

o HEDs B21-03, B22-01, 823-01, B24 A solution was not proposed.

B3. Powered Voice Communications 831 Adequate solution.

35

B31 Reviewers requirc clarification of the HEDs, and of each finding that is part of this HED as well as the solutions.

84. Operator Aids B41-04, B41 SCE concluded that no action be taken for these HEDs.

Reviewers are unclear as to the reason why an HED was written if the neces-sary operator aid in question (maintenance management system database) is available. Perhaps the system that is available is inadequate for operator needs.

l 4

l 1

36

.e .

b APPENDIX C CONTROL / DISPLAY HARDWARE C1. Scale Coding and Hardware 54-Cll Reviewers need information about the exact indicators for which the HED was written.

54-C11 Reviewers conclude.that this is a safety significant HED that sh,ould be corrected before the second refueling outage.

57-C11 Reviewers conclude that this should be implemented promptly rather than near term.

s C2. Human Suitability.

C23-01 - Reviewers concur with action; however, the implement,aticn should be prompt.

C23 Satisfactory, however experiments on the simulator are planned to determine the best solution.

C21 What is corrective action?

58-C21 Reviewers find that the HED is safety significant and , ,

should be corrected promptly.

44-C23 Corrective action was not approved and a justificition (for no action) was not provided.

58-C23-01 - Corrective action was not approved, and reviewers do rat concur with justification for no action.

57-C22 Corrective action should be prompt based on the high safety significance of operator error.

58-C23 Satisfactory, however reviewers believe solution should be scheduled for " prompt" implementation.

37

s .

57-C22 Reviewers require more information to complete the evalua-;.

tion.

63-C23 Satisfactory.

63-C21 Reviewers require more information describing the diffi-culty in reading these meters.

54-C23-01 - Corrective action was not approved and justification was not provided.

57-C23-01 - Reviewers require an explanation for how the erroneous baration event occurred.

52-C23-01, 54-C23-02, 56-C23-01, 57-C23-02, 58-C23-03, 60-C23-01, 61-C23-01 - These HEDs involved the modification of the indicator lens to convey a pump / valve identifier. Reviewers cannot fully understand the proposed design solution.

l l

l 38

~

,4

  • APPENDIX D WORKSPACE/ ENVIRONMENT D1. Temperature, Humidity, Ventilation Findings resolved.

D2. Esthetics No HEDs.

D3. Lighting D31 The solution proposed was not approved and a justification was not provided.

D31 Reviewers require more information concerning the reduction of lighting levels to resolve the HED and a justification for no action if that is the final status of the HED.

D4. Auditory No additional update work.

D5. Room Layout and Access 051-01 - Reviewers could find no justification for leaving this HED uncorrected.

D6. Operating and Emergency Documentation i 061 Satisfactory.

D62 Satisfactory.

062 HED is open due to incompleteness of K409 study.

D62 Satisfactory.

39

~p.g .

062 Satisfactory. [

062 Reviewers need to know current status or justification for no action.

D62 Reviewers disagree with justification for not providing training to correct this HED.

07. Discrete Considerations 63-A21 HED is being evaluated by site change committee; action is not final.

63-C21 Corrective action was modified by the HED evaluation team but the change was not described.

63-A41-01 - Corrective action is too vague; more discussion is required.

63-C23 Corrective action is not provided.

08. Remote Shutdown Panel 42-A21 Corrective action is adequate; however, it has not been reviewed by the site change committee.
09. Valve Position Feedback Finding (MSR Valves) - Reviewers need mere information regarding the justification for no correction.

O 40

~

j. ., ,

APPENDIX E HEDs RESULTING FROM THE VERIFICATION AND VALIDATION REVIEW PHASES EI. Verification ICCR01 - The solution was not approved and a justification for no

- action was not provided.

ICCR02 - Reviewers require more information concerning the reason the HED was writtee if a single indication was not needed.

Also, it appears that the requirement for a single actuation device was modified based on the availability of numerous actuation devices. Also of concern is whether time constraints were considered in evaluating the suit-ability of numerous, rather than one, control devices. Reviewers need to clarify this justification for no corrective action.

E2. Validation 062 No action is proposed and reviewers require a justification for leaving HED uncorrected.

Reviewers concur with other findings, recommendations, and assessment.

l l

41

~

\

V i '

APPENDIX F NRCAhDITITEMS 4

1. Reviewers disagree with the justification for no correction for some of I these HEDs identified by the NRC audit of June 17-21, 1985. More information is required for the following items. These items are reported by " Condition Number" on pages 4.6.6-8 of the Supplement to the Summary Report.

l Numbers 3, 4, 6, 7, 8, 9, 11, 12, 13, 15, 16, 21 and 22.

i 42

  1. I
  • ENCLOSURE 2 ,

SUGGESTED AGENDA San Onofre, Units 2 and 3 Detailed Control Room Design Review Pre-Implementation Audit day l AM Administrative processing for on-site access. Planning and preparation - set up office space, informal briefing and introductions, short visit to control room.

1. Function and Task Analysis The licensee should discuss the process used to generate a data-base of characteristics of instruments and controls that were identified during the task analysis. Discuss all characteristics collected and how they were defined to help identify missing and/or unsuitable controls and displays. Of particular concern is the acceptability of the large instrument inaccuracy as described in the SFTA, and the lack of information regarding the identification of interval and division characteristics of con. col l room instruments.

l Break for Lunch PM 2. Control Room Inventory

a. Discuss the level of detail that was collected in the inventory to describe what information and control capa-bilities exist in the control room.
b. Discuss the methodology used to compare the information and control requirements and their characteristics to the existing equipment on the remote shutdown panel.

l l

1

+ ,

.9 i

3. Control Room Survey
a. Discuss the completeness of the computer portion of the survey and provide descriptions of the computer systems included in the survey.

~ ~

b. Describe the corrective actions and implementation schedule to resolve HEDs from the annunciator survey and/or Task K-409. Also, discuss why a new annunciator study is needed.
4. Assessment of HEDs
a. Provide method for assessing HEO.
b. Discuss the weights assigned to safety, operator error, and technical specification violation.
c. Discuss the prioritization of HEDs and schedule for corrections. Also discuss the prioritization of HEDs that will not be corrected until after the second I refueling outage.

day 1 AM 5. Audit team break up to discuss questions outlined in the Appendices to the TER. The audit team should conduct this audit activity at the simulator in order to view HEDs and design solutions. The licensee should assure that the appro-priate team r. embers are available to discuss the HEDs.

NOON 6. Audit team caucus and au'dit team leader will provide exit briefing.

2

J  %

SUGGESTED AGENDA San Onofre, Unit 1 Detailed Control Room Design Review In-Progress Audit

~ .

Day 2 2:00 PM Hold a Kick-off meeting with the licensee to present and discuss identified strengths and weaknesses in the Progran Pl an. The licensee should present any clarifications and additional information/ documentation at this time. The development of action items and the identification of any modifications to the remaining

, steps in the in-progress audit will occur at the end of the meeting.

The licensee should discuss the following items and provide supporting documentation.

1. Qualifications and Structure of the DCRDR Team
a. Provide the two requested resumes, f
b. Discuss levels of involvement per activity for each member of the Review Group.
2. Function and Task Analysis
a. Provisions for ensuring that systems and subsystems will include all safety and safety-related systems from the WOG ERGS except plant-specific deviations.
b. Description of scenarios,
c. Nature of the E01s intended as the basis for the task analysis.
d. Definition of term " relevant characteristics."

3

J .

I e. Nature and purpose of the review of the Task Analysis Worksheets using SONGS-1 experience,

f. Personnel conducting the various steps in the task analysis.

~ .

Day 3 AM 1. Comparison of Display and Control Requirements With a Control Room Inventory

a. Provisions for ensuring that the process used to conduct a verification of task performance capabilities will identify missing and/or unsuitable controls and displays,
b. Definition of term "related information."
c. Participation of human factors specialist.
2. Control Room Survey
a. Provision of samples of the checklists.
b. Clarification of the process for evaluating dynamic

- criteria,

c. Assessment of the remote shutdown capability.
d. Audit team will conduct a mini-survey of the control room and audit the licensee's survey results. HED docu-mentation should be provided.

Break for Lunch PM 3. Assessment of HEDs

a. Nature of the verification of HEDs as real HEDs.

4

y 'a

b. Methodology for weighting the factors used in assigning priorities for the correction of HEDs.
c. Participation of all necessary personnel in the assess-ment of HEDs.

~ .

d. Replacements for HED Assessment and Evaluation Team members.
e. Provision for assessment of all HEDs with a low priority for cumulative or interactive effects.
f. Sequence of HED assessment and selection of design improvements.
g. Audit team will audit any results from the assessment process.

day 4

~

AM 1. Selection of Design Improvements i

a. Methodology for developing design improvements.
b. Criteria for determining the acceptability of a design improvement.
c. Provision for presenting design improvements as a package to the Site Change Committee (SCC).
d. Provision for the consideration of human factors issues in the SCC's final approval / judgment on design improve-ments,
e. Provisions for ensuring that Priority 1, 2, and 3 HEDs are corrected immediately.

5

. "4% , *

2. Verification That Improvements Will Provide the Necessary Corrections and That Control Room Modifications Do Not Introduce New HEDs
a. The licensee should present the methodology ~they intend

~- to use to complete this requirement.

Break for Lunch PM 3. Coordination of the DCRDR with other improvement programs.

a. The licensee should present plans for integrating DCRDR inputs with the following programs:
1. E0P upgrade
2. SPDS
3. Reg. Guide 1.97 instrumentation
4. ERFs
5. Training
b. Discuss the licensee's intentions for using the SPDS to resolve HEDs.
4. Conduct an audit team meeting to evaluate and integrate material audited and to prepare a presentation for the exit meeting.

s 5. Conduct an exit meeting with the licensee to dispose of action items and provide constructive feedback.

l i

I 6

o

_ - _ , , _ _ . _ _ _ , _ _. _ _ _ _ _ _ . _ _ . - _ _ _ . - _ _ . _ , __. - _ . _ - __m-

Retrieved from "https://kanterella.com/w/index.php?title=ML20203G741&oldid=3067570"