ML20210R018

An Investigation of the Contributors to Wrong Unit or Wrong Train Events

ML20210R018
Person / Time
Issue date:	04/30/1986
From:	Persinko D, Rameysmith A Office of Nuclear Reactor Regulation
To:
References
NUREG-1192, NUDOCS 8605160013
Download: ML20210R018 (37)

Text

-

NUREG-1192 An Investigation of the Contributors to Wrong Unit or Wrong Train Events 1

U.S. Nuclear Regulatory Commission D. Persinko, A. Ramey-Smith pa arooq,

~~

l kog51 86043o 1192 R PDR

b v

NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room,1717 H Street, N.W.

Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office, Post Office Box 37082, Washington, DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices; Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

l Documents such as theses, dissertations, foreign reports and translations, and non NRC conference l

proceedings are available for purchase from the organization sponsoring the publication cited.

i l

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Division of Technical Information and Document Control, U.S. Nuclear Regulatory Com-mission, Washington, DC 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 10018.

l i

NUREG-1192 An Investigation of the Contributors to Wrong Unit or Wrong Train Events Manuscript Completed: April 1986 Dato Published: April 1986 D. Persinko, A. Ramey-Smith Division of Human Factors Technology Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Wcshington, D.C. 20555

~.....'

l l

l

1 TABLE OF CONTENTS Introduction 1

Methodology 2

Selection of Events 2

Interviews 5

Identification of Contributors 5

Results 7

Labeling 12 Tagging Request and Inquiry System 12 Critical Equipment Monitoring System 12 Plant Labeling at D. C. Cook 13 Plant Labeling at Turkey Point 14 l

Training / Inexperience 15 Procedures 15.

Incident Investigations 16 Summary 18 Summary of. Findings 18 Observations 19 NRC Initiatives.

21 Guidance 21 Regulatory Analysis 22 iii i

I~

E

o Acknowledgements 23 Appendix.A References.

A-1 Appendix B Assessment of Contributors B-1

.(Site Visit data)

Appendix.C Assessment of Contributors C-1 (AE0D/S401 data) iv

.-.--a..

INTRODUCTION The NRC has had a major concern with the high frequency of human error in nuclear power plants causing actions to be performed on the wrong train of systems with redundant trains or on the wrong unit of a multi-unit facility.

This type of error was highlighted as a result of an incident that was discovered on April 19, 1983, at Florida Power and Light's Turkey Point Unit 3 wherein a nuc? ar turbine operator mistakenly closed isolation valves in the steam supply 11..is to the available auxiliary feedwater (AFW) pump 8 and C turbines rather than the desired isolation valves in the other AFW steam supply lines.

This event was complicated by the fact that incorrect verifications of valve position were made for five subsequent days.

Consequently, the Office of Nuclear Reactor Regulation (NRR) requested the Office for Analyses and Evaluation of Operational Data (AE00) to undertake a study of similar events.

In January 1984, AE0D published the results of its study entitled " Human Error in Events Involving Wrong Unit or Wrong Train" (Appendix A, Ref. 1).

In that report, AE0D identified 26 additional events during the period January 1981 to approximately August 1983 that had characteristics similar to the Turkey Point Unit 3 event, that is, losses of safety system function that resulted because of human errors involving personnel actions performed on an incorrect train or unit.

One finding of the report was that of the 27 events evaluated,19 resulted from human error suggesting that these errors are major contributors to loss of safety system events.

Subsequently, in a memorandum dated August 8, 1984, from Heltemes to Denton, AE00.noted that although IE issued Information Notices 84-51,

" Independent Verification," and 84-58, " Inadvertent Defeat of Safety Function Caused by Human Error Involving Wrong Unit, Wrong Train or Wrong System,"

wrong unit / wrong train events were continuing to occur.

From August 1983 to August 1984, an additional 13 events involving wrong unit / wrong train errors

-had occurred.

l

~

_2 Although the intent of this study was to investigate wrong unit / wrong train errors, some events discussed involved " wrong component."

In these cases, an action was performed on the correct train or unit but on the incorrect component. However, contributors to these events were-judged to be the same as those contributing to wrong unit / wrong train events.

To ' address the concerns arising from wrong unit or wrong train events, NRR created Generic Issue 102, " Human Error in Events Involving Wrong Unit or Wrong Train," to be resolved as a specific task within the Division of Human Factors Technology's Maintenance and Surveillance Program Plan (MSPP).

The plant maintenance activities addressed in the MSPP include those plant functions required to carry out a systematic maintenance program such as surveillance and testing, operations / maintenance interface, maintenance management, procedures, and technical documentation. During Phase I, a survey of maintenance practices at U.S. nuclear utilities was conducted and operational errors and events reviewed. The present study was conducted as part of the survey effort.

METHODOLOGY Selection of Events Events were chosen for inclusion in the study based on wrong unit / wrong train data provided in the Licensee Event Report (LER) database. An attempt was made to select utilities across a range of vendor types, number of units at a site, vintage, and size.

Table 1 provides a summary of the plants visited during this study, the LERs discussed, and any additional events discussed.

Table 1.

SUMMARY

OF PLANTS VISITED Date of Maximum Architect Commercial Dependable Plant NSSS Engineer Operation Capacity (Net MWe) Events Discussed Dresden 2 GE SL June 9, 1970 772 LER 237-84-013 3

GE SL November 16, 1971 773 249-85-005 237-84-012 Surry 1 W

SW December 22, 1972 781 LER 281-81-001 2

W SW May 1, 1973 775 280-83-033 280-82-072 280-83-051 North Anna 1 W

SW June 6, 1978 890 LER 339-85-006 2

W SW December 14, 1980 893 339-82-022 Nonreportable event Peach Bottom 2 GE B

July 5, 1974 1051 278-81-008 3

GE B

December 23, 1974 1035 278-85-008 Salem 1 W

PSEG June 30, 1977 1079 LER 272-82-003 i"

2 W

PSEG October 13, 1981 1106 272-83-024 2 Nonreportable events LaSalle 1 GE SL January 1, 1984 1036 LER 373-83-140 2

GE SL October 19, 1984 1036 373-84-071 374_85-012 374-84-017 374-85-020 D.C. Cook 1 W

AEPS August 27, 1975 1020 LER 315-81-005 2

W AEPS July 1, 1978 1060 315-83 009 315-83-048 315-84-014 Nonreportable event McGuire 1 W

Duke December 1, 1981 1180 LER 369_81-180 2

W Duke March 1, 1984 1180 370-84 021 370-84-034 370-85-010

Date of Maximum Architect Commercial-Dependable Plant NSSS Engineer Operation Capacity (Net MWe) Events Discussed Turkey Point 3-W B

December 14, 1972 666 LER 250-83-007 4

W B

September 7, 1973 666 251-83_016 250-84-003 250-85-004 250-85-017

)

2 B&W Duke /B September 9, 1974 860 None LEGEND:

W

- Westinghouse SW

- Stone and Webster

'I I

GE

- General Electric SL

- Sargent and Lundy B

- Bechtel PSEG - Public Service Electric and Gas AEPS - American Electric Power Services 1..

f' I

-. Interviews Once a particular plant and event (s) were selected, the utility was contacted and arrangements made to visit the site.

The licensee's staff was briefed on the purpose of the visit and was provided an overview of the information the interview team was hoping to obtain. A protocol was developed and used as a general guide for maintaining consistency among the in-depth interviews conducted.

Topics of discussion included those factors which the interview team felt may have contributed to the human error (s) that occurred in the wrong unit / wrong train event.

The factors that were discussed during the interviews included, but were not limited to, labeling, procedures, shift manning schemes, and training and qualifications. Where possible, the team interviewed the individual (s) that was directly involved in the event, as well as other knowledgeable plant personnel involved in operations, maintenance, and training.

In addition to questions of a general nature, each event was discussed in turn and a plant walk-through conducted.

Identification of Contributors Information gained during the interviews and photographs taken during the walk-throughs are discussed in trip reports prepared for each site visited (see Appendix A, Ref. 2-10).

These data were reviewed and a professional judgment made as to what were the contributors to the human error.

These contributors were then categorized as either the primary contributor or as a secondary contributor. A primary contributor is defined as the most dominant contributor or the sole known contributor to the event.

In most cases, it is felt that without this primary contributor, the error would likely not have occurred.

Secondary contributors include those contributors to the human error that exacerbated the contribution of the primary contributor.

_ _ _ _ _ _ _ The NRC team identified 10 contributors to the wrong unit / wrong train human errors. These are defined as follows:

Labeling - inadequacy in the identification of controls, displays, valves, and other equipment items that must be located, identified, or manipulated.

. Training / Inexperience - classified as a contributor when plant personnel identified it as such or when the NRC team concluded that additional experience or improved training could reasonably be expected to significantly reduce the likelihood of the wrong unit / wrong train human error.

Procedures - includes applicable administrative, operating, maintenance, test procedures, and both written and unwritten plant practices with technical and/or human factors deficiencies.

Mind Set - a fixed state of mind, e.g., the improper expectation that the next work assignment will not be dissimilar from the previous assignments, resulting in a context error.

Layout / Equipment Design - inconsistency of equipment layout and design with human engineering design principles.

Communications - inadequacies in the verbal and written communication of assignments and messages.

Physical Stress - includes fatigue, overtime work, high temperature and cramped surrounds.

Drawings - inadequacies, both in a technical and human factors sense, in drawings used by plant personnel.

Interrection of work flow - includes cases in which an individual was in the process of performing a task and was then interrupted. When the previously ongoing work was resumed, an error occurred.

Rushed - the sense of urgency, either real or imagined, to complete a task quickly.

RESULTS 1.

Appendix 8 contains the results of the assessment of the contributors to the human errors in each of the 35 wrong unit / wrong train events investigated.

Table 2 summarizes these data.

The data is also presented in Figures 1 and 2.

An examination of the data illustrates the following major findings.

~

Inadequate labeling contributed to 54 percent of the 35 events evaluated. 1.abeling was the primary contributor in 32 percent of.the events and a secondary contributor in 23 percent of the events.

Inadequate training and staff inexperience contributed to 43 percent of the 35 events, being the primary contributor to the wrong unit / wrong train error in 14 percent of the events and a secondary contributor in 29 percent of the events.

Poorly human factored or incorrect procedures contributed to 37 percent of 35 events.

Procedures were the primary contributor in 14 percent of the events and the secondary contributor in 23 percent.

When taken together, labeling, training, and procedures were the primary contributors to human error in 60 percent of the wrong unit / wrong train events investigated.

Operations personnel were responsible for the wrong unit / wrong train errors far more of ten than any othe,r group of plant personnel.

Of the 32 events where the individual's affiliation was known, 24 (75 percent) of them involved operations personnel (18 nonl,icensed, 5 licensed, 1 both licensed and nonlicensed). Often these errors occurred during activities. in preparation for maintenance.

1' 4 Table 2.

Percentage and Frequency of Primary and Secondary Contributors to Human Errors in 35 Wrong Unit / Wrong Train Events (Site Visit Data)

Primary g Primary Secondary Secondary Contributor Contributor Contribution Contributor Only Only 2

54 (19)3 32 (11) 23(8)

Labeling (Lab)I Training / Inexperience (T/I) 43 (15) 14 (5) 29(10)

Procedures (Pro) 37(13) 14 (5) 23 (8)

Physical Stress (Phy) 26 (9) 3 (1) 23(8)

Communications (Com) 17(6) 9 (3) 9 (3)

Mind Set (MS) 17(6) 11 (4) 6(2)

Layout / Equipment Design (Eq) 17 (6) 11 (4) 6(2)

Rushed (Rush) 11 (4) 0(0) 11(4)

Drawings (Dwg) 6 (2) 3 (1) 3 (1)

Interruption of Work (Int) 6 (2) 3 (1) 3 (1)

I Abbreviations used in Figures 1 and 2 2 Percent 3 Number of events Table 3 illustrates the association between primary and secondary contributors.

For example, physical stress was a secondary contributor in three of the events in which labeling was the primary contributor.

From an inspection of the table, the following relationships were noted:

i

Figure 1. Contributors to iNU/ INT Events Primcry ord Secord,ry 50 -

b9g {

.33 -

33 ~/ s u m

/

h M)Ih$fhhiIh@S'sW Q S<S,h.

99 Lcb T/l Pro P ty Com MS Eq Rush D.vg int g a gs,,,,,,

d"?"'%,om,y Figure 2.

Contributors to WU/WT Events

. (Primcry Ordy)

Dv.9 (3.07.)

T/l (14.07.)

,/

l Lat. (32.07.)

/,

~ g Pro (14.07.)

I /

[

Phy (3.0%)

l

\\//

N

/

1,..(am)N()

g/ - <>=>

eq (i i.Or N us (ii.On) 1

i i?

3 1

1 1

1 1

1 1

1 1

ice t3 1

%* 83a!e" ro g"

5 1

t su rb oi tr ut

,Eh" %3.i 3

1 1

1 1

1 bn i o rC tny or e3t3"lu 2

1 Ca m yi rr aP d

&;a.3 nh 1

1 oc ste,3 ca eE S

h ft oi t" ii 2

W y

cd ne et ua E1i8k 2

1 2

2 1

qi H

ec ro Fs s A

,E8Cg e2h 2

2 3

2 1

3 e

l m" ;23 3

1 1

1 1

g ba T

y s

r p

s a

x n

e d

e o

r n

n n

i t

o o

I s

n t

S i

c g

/

e g

a t

e n

g r

t i

c l

s p

i n

u e

/s i

a g

uk S

yr l

i d

S te n

c n

rr a

l n

e uD u

i i

ro m

e i

c d

o m

s w

eW i

b a

o n

y m

y a

t r

a r

r i

aq o

h r

nf P

L T

P M

LE C

P D

I o ll llIll As expected, the human error involved in wrong unit / wrong train events often results from the interaction of several contributors.

For example, the effects of inadequate labeling appear to have been exacerbated by a number of different secondary contributors.

Conversely, inadequate labeling was implicated as a secondary contributor across a broad spectrum of primary contributors.

Training / inexperience was a sole contributor to a wrong unit / wrong train error in only one of the events investigated, whereas in eight events where training / inexperience was the primary contributor, secondary contributors also existed.

When inadequate procedures was the primary contributor, it was often compounded by a number of different secondary contributors, including labeling, training / inexperience, layout / design problems, interruption of work, and being rushed.

The contributor " mind set" interacted with several secondary contributors.

Inadequacies in those areas which may have been able to

" wake up" the individual were considered secondary contributors. These included labeling, procedures and communications.

Physical stress also was a secondary contributor in one event investigated.

Although physical stress was identified as the primary contributor to a wrong unit / wrong train error in only one of the events investigated, stress was a secondary contributor.in eight other events whose primary contributors included inadequate labeling, training / inexperience, mind set, layout / design, communicati'qs, and drawings.

Physical stress, then, tends to increase the likelihood that other inadequacies will result in an error.

Labeling, training / inexperience, procedures, mind set, communication, and physical stress are able to cause a wrong unit / wrong train event individually without any secondary contributors. Because of the limited

, - - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ sample of events discussed, it is possible that the other contributors have the potential to create a wrong unit / wrong train event without secondary contributors as well.

Labeling The findings from this study illustrate the consequences of inadequate labeling.

Poor labeling was more often implicated in the wrong unit / wrong train events investigated than any other contributor.

Some plants have undertaken programs to address the need for labeling in the plant.

Those of particular note are discussed below.

Tagging Request and Inquiry System. The Tagging Request and Inquiry System (TRIS) is in place at Salem (as well as Hope Creek).

This computerized system features labels unique to each plant component and can ensure that the operator's worksheet and equipment tags correspond to the equipment labels. Some standard tagging requests have been programmed into the computer.

Both the worksheet and equipment tags are printed out by the computer including, for example, desired component switch location. TRIS keeps track of normal and current switch or valve positions as well as inoperable equipment. At the end of every shift, the operators request the printout of inoperable equipment to permit them to monitor system status.

TRIS relies on operator input to keep the system accurate.

Currently at Salem, there are about 30,000 items in TRIS, with labels on all major equipment. Additional information is provided in the Salem trip report (Appendix A, Ref. 5).

Critical Equipment Monitoring System (CEMS). The Peach Bottom facility is in the process of implementing the CEMS to address the needs of operations personnel. The CEMS labels use a unique code description for each component and a computer-readable bar code. To this point, implementation of the system has been limited to the assignment and installation of component labels, primarily on valves. Of approximately 40,000 manual valves,13,000

__ have been labeled. When fully implemented, the CEMS will include breakers using the existing breaker numbers but adding unit and system designations.

A plant operator will be able to verify that he has located the proper piece of equipment in the plant by utilizing a hand-held computer terminal capable of reading bar codes.

The CEMS will be used during surveillance and blocking activities.

It will also be utilized in monitoring system status because the hand-held terminal will have the capabiiity of receiving input on component positions (e.g., valve open or breaker closed) from the plant operator as he varies component status in the plant.

The status of automatic systems will have to be manually fed into the CEMS upon actuation. The CEMS will also eventually be used to actually generate permits for blocking tasks. The licensee is, however, encountering some difficulties in implementing CEMS.

CEMS is discussed in more detail in the Peach Bottom trip report (Appendix A, Ref. 4).

Plant Labeling at D. C. Cook. The D. C. Cook staff indicated that systems and components on flow prints as well as any other equipment items that have a human interface will be labeled in the plant. Cook has selected color-coded aluminum tags with~ color contrasted lettering for labeling components in nonadverse environments outside containment.

For labeling mechanical components inside both containments, or in adverse environments outside containments, stainless steel tags are used.

Electrical cabinets are in the process of being provided with bold color-coded identification.

The facility database contains the official noun name of devices which will be used on all labels, procedures and drawings, and uses the list of standard abbreviations developed during the control room design review. The Cook personnel see the plant labeling process as an on-going, iterative process.

A procedure exists for maintaining labels, and plant maintenance procedures include a check-off for the adequacy of labels on the equipment being maintained.

l

. _ _ _ _ _ _ D. C. Cook's labeling effort is described here because it illustrates the sharp contrast between "old" and "new" plant labeling philosophies.

During the tour of the facility, the NRC staff was stunned by the gross lack of permanent labels in some areas of the plant and yet impressed at the stark difference between those areas that had been upgraded and those yet to be done.

Components in areas where permanent labels had not yet been installed were identified with duct tape and magic marker lettering, whereas the upgraded labeling program features highly readable, color-coded identification.

Plant Labeling at Turkey Point. Turkey Point has begun a program of

" Area Information Striping" to help get people to the right location and to reduce wrong unit errors.

In this program, color-coded stripes are being applied to walls', electrical cabinets, equipment bases and pedestals and curbing around equipment. Turkey Point is also instituting a valve tagging program using color-coded fiberglass tags that contain information on the valve number and name as well as the normal operating position. There are plans to modify procedures to include a check-off or verification that the correct tags are in place during system alignment checks and maintenance.

Recommendations have also been made to provide location maps at the entrance to low access areas (e.g., inside containment) to aid personnel in locating equipment.

The labeling programs summarized above illustrate some of the positive steps being taken by licensees to improve the performance of their staff.

However, very poor labeling was also observed during plant walk-throughs.

Examples of such poor labeling practices include:

1) nonexistent labels; 2) replacing virtually unreadable brass component identification tags with aluminum embossed tags, thus only marginally improving the readability of the component tags; 3) the lack of unique component identification numbers between units; 4) the lack of consistent use of nomenclature and abbreviations; and 5) the lack of an adequate label maintenance program to replace missing or damaged labels.

= Training / Inexperience Performing on-the-job training only on one unit, working previously on a fossil unit and not being made aware of the differences in plant layout, using drawings during training which are not up to date, and not understanding what is required when performing independent verifications are examples of training def;iciencies which contributed to wrong unit / wrong train events.

Often improved training was the corrective measure taken after a wrong unit / wrong train event had occurred. However, many times a more direct contributor to the error exists (e.g., no label, poor human factors equipment design, inadequate procedures).

In these cases, the direct cause of the event should be remedied in order to obtain the largest reduction in the probability of recurrence.

The combination of experience level and training should equal the desired level of competence.

It is felt that a reduction in wrong unit / wrong train events can be accomplished by the use of an effective performance-based training program. Most of the events discussed in this study occurred prior to receiving INP0 training accreditation. Wrong unit / wrong train event frequency which can be attributed to training / experience should be monitored subsequent to plants receiving INP0 accreditation ia order to assess the effectiveness of this training in reducing these types of events, l

Procedures i

1 The three main reasons why wrong unit / wrong train errors resulted from l

l procedures are: 1) the procedure was generic, that is, it applied to both units, multiple trains or multiple plant conditions, 2) the procedure contained flaws from a human factors viewpoint (other than applicability to multiple units, trains or conditions) in the way the procedure was written, and 3) plant personnel needed to generate valve and switch numbers each time a procedure was used.

In cases where'one procedure applied to multiple units, trains or plant conditions, the individual committing the error often accidentally referred to the wrong unit or train within the procedure. Often, corrective actions taken by_a licensee included separating combined procedures into separate procedures.

However, when asked whether separating combined procedures was done for all combined procedures or-just the one involved in the event, the answer often given was that only the procedure involved in the event was separated.

In events where poor procedures resulted.in wrong unit / wrong train events, the procedures were complicated, required the user to flip back and forth within a procedure, were long, did not have enough detail, did not include caution notes, or included diagrams of both trains on one page.

In those events where plant personnel were required to copy or generate a list of valve or switch numbers each time the procedure was to be performed, the wrong information was generated or copied.

Some licensees have pre-printed sheets containing this information to reduce the probability of i

this type of error occurring.

One program of note regarding procedure improvement has been undertaken by Florida Power and Light. Realizing that poor procedures contribute to wrong unit / wrong train errors, Florida Power and Light has undertaken a comprehensive review of procedures at its Turkey Point facility. The review is concentrating on improving procedure quality and technical content, making all common procedures unit specific and improving the human factors of the procedures.

Incident Investigations LERs and other incident reports often do not contain sufficient information to fully understand the contributors to wrong unit / wrong train events.

In the present study, interviews were conducted during 10 site visits and information obtained on 35 events.

I

)

- Through discussion with licensees, it was learned that additional wrong unit / wrong train events have occurred at many of these sites; however, since no technical specifications were violated, these events were not reportable to the NRC. As a result, many licensees were reluctant to discuss these events or to discuss them in sufficient detail to be of use in any analyses.

Nonreportable events should not be considered trivial.

For example, one nonreportable event which was discussed in detail with the NRC team involved burning up a reactor coolant pump motor with great risk to the safety of the operator who made the error.

Many of those interviewed in this study felt that human errors involving wrong unit / wrong train just happen and there is little which can be done to prevent them. This belief is exhibited in the resulting actions taken after a wrong unit / wrong train event.

In the vast majority of events, the resulting action consisted of disciplining or counseling those involved rather than attempting to fully understand the underlying cause.

It should be noted, however, that some licensees do attempt to go beyond disciplinary actions, that is, to understand the contributors to the event and take i

resulting actions to prevent future occurrences.

In particular, Virginia Electric Power Company (VEPCO) is a participant in INP0's Human Performance Evaluation System (HPES) wherein all plant events caused by human error are investigated using guidelines and methodologies established by INP0 and the results transmitted to INP0 for use in an HPES database. Unfortunately, only five domestic utilities participate in the HPES.

(See North Anna /Surry trip report (Appendix A, Ref. 2) for more discussion of the HPES.)

l Appendix C contains the results of an assessment performed during this study l

of the contributors to the human errors in events described in the AE00 special report (AEOD/S401). Although not discussed during the site visits, i

the results are in general agreement with the results obtained from the 35 events discussed during the site visits.

Labeling and procedural deficiencies are the leading contributors to errors in events discussed in the AEOD report.

Because these events were not discussed in the same detail

s,

,a N

as were those during the sitcyvisits', the information available and insight obtained into the contributors is limited.

Although the purpose of this study was to iden'tify those factors that contributed to the occurrence 'of wrong unit / wrong train human errors 'and make recommendations for reduc'inlsTtheir incidence, part of the wrong unit / wrong train event sequence involves promptly discovering the error after it has occurred. One method of accomplishing this is through the licensee's independent verification efforts.

NRC guidance on independent verification has been provided in NUREG-0737, Item I.C.6, issued in November 1980 and IE Information Notice 84-51' issued on June 26, 1984. However, based on the interviews conductea, it is clear that the independent verification programs are subject to misunderstanding and'sh'ould be reevaluated.

Four of the events discussed which occurred in 1983-1984 involved a misunderstanding of independent verification. Dual instead of independent verification was performed and in other cases, the verification performed was based on an incorrect indicator (e.g., verifying valve position by looking at locks on valves).

SUMMARY

Summary of Findings The major findings from this study o.f 35 wrong unit / wrong train events investigated are as follows:

1.

Inadequate labeling of plant equipment, components and areas was the leading contributor to wrong unit / wrong train errors when both primary and secondary contribution is considered.

Training / inexperience ranked second with inadequate procedures third.

2.

As a primary contributor, labeling accounted for more than twice the number of events 'than the next nearest contributor. When taken together, inadequacies in labeling, training and procedures were the 1

4 4

primary contributors to human error in 60 percent of the wrong unit / wrong train events investigated.

3.

Operations personnel were responsible for the wrong unit / wrong train errors far more often than any other group of plant personnel. Of the 32 events where the individual's affiliation was known, 24 (75 percent) of them involved operations personnel (18 nonlicensed, 5 licensed, 1 both licensed and nonlicensed). Often these errors occurred during activities in preparation for maintenance.

4.

Although most events involved a combination of contributors, eight events occurred as a result of only one known contributor.

These 8 events encompassed 6 of the 10 categories of contributors.

Consequently, when considering the limited sample, it is believed that any of the contributors have the potential to cause a wrong unit / wrong train event by themselves.

5.

Information provided in LERs does not fully describe all of the contributors to wrong unit / wrong train errors.

In addition, the scope and level of detail of the information provided varies greatly among LERs.

Observations 1.

Currently, there is no NRC requirement for labeling of controls, valves, electrical and other equipment which must be located, identified or manipulated by plant personnel. Additionally, there is no NRC requirement for area labeling to assist in identifying units, rooms, areas and component location.

Such area labeling includes color-coded unit signs on doors to rooms identifying the room and associated unit, signs identifying trains if components in a given room or area are train l

l specific, and location maps showing component locations within a given room or area (see LaSalle and Turkey Point trip reports (Appendix A, Ref. 6, 9)).

General guidance or examples regarding labeling in conformance with good human engineering principles can be found in:

1) EPRI Report NP-1567,

" Human Factors Review of Power Plant Maintainability", 2) EPRI Report NP-4350, " Human Engineering Design Guidelines for Maintainability",

3) NUREG-0700, " Guidance for Control Room Design Reviews", and 4) INP0 84-007, " System and Component Labeling." Knowledge regarding good labeling has already been obtained by each licensee as part of the control room design review process.

Some licensees have upgraded labeling of components outside of the control room using knowledge gained during the control room design review process.

2.

An effective peformance-based training program will recognize that part of one's work in the plant (particularly in operations) is to locate equipment and will ensure that plant personnel are trained and tested on mastering that task as part of the training program. Such training will include such knowledge, skills and abilities as labeling conventions, drawing reading and physical locations within the plant.

3.

Nonemergency plant procedures do not reflect the knowledge gained during the emergency procedure upgrade program.

The procedures discussed during the site visits which contributed to the wrong unit / wrong trafG events investigated were often poorly written and/or applicable to multiple units or multipla trains.

Feedback from licensed and nonlicenseu operators regarding degree of complication, length and format would assist in determining which procedures warrant improvement.

The procedures element of the Human Factors Program Plan addresses the issue of the quality of plant procedures.

4.

Individual utilities are investigating the range and acceptability of labeling materials and schemes to arrive at an environmentally acceptable label that conforms with good human engineering principles.

During the site visits, it was found that little communication is evident between utilities and even within the same utility on this topic.

4

._ 5.

Participation in the " Human Performance Evaluation System (HPES)":

1) l creates a heightened awareness by plant personnel about human error, and

2) provides knowledge regarding mc+ hods to prevent and investigate events involving human error to plant personnel. Although information regarding wrong unit / wrong train errors has been conveyed to individual utilities primarily through IE Information Notices and Bulletins, an information gap still exists among licensees about the details of such events and methods which can prevent them from occurring. Participation in HPES would close this gap.

NRC Initiatives l

Guidance 1.

The NRC should provide clarifying guidance regarding independent verification. Definitions of independent verification (e.g., verifying actions through differences in location or time), qualifications of an independent verifier, training on independent verification and what to observe when conducting independent verification should be included in i

this clarification.

2.

No guidance currently exists for NRC inspectors' use in evaluating the adequacy of plant labeling schemes and implementation.

NRR should I

provide input for developing an Inspection Module on plant labeling schemes and implementation.

3.

NRC's evaluation of the performance-based training programs being implemented in the nuclear industry should include an assessment of whether learning objectives relevant to wrong unit / wrong train issues are included.

Specifically, such training programs should require that operations personnel demonstrate their ability to properly locate plant components both from verbal instructions and from plant drawings, and their knowledce of the plant labeling conventions.

l

-. 4.

As a result of information obtained during the site visits, it is evident that, in most instances, information provided in LERs does not fully describe all of the contributors to wrong unit / wrong train errors.

In addition, the_ scope and level of detail of the information provided varies greatly among LERs.

Consequently, LER requirements involving human error should be revised by the staff so that information provided by the licensee is comprehensive in identifying contributors to an event. This would assist AE0D in evaluating events involving human As part of the Human Performance element of the Human Factors error.

Program Plan, DHFT intends to provide input to AE00 for improving the reporting of human performance issues in LERs.

5.

The NRC, through the Office of AE00, should continue to monitor events involving wrong unit / wrong train / wrong component and determine their frequency over time. AED0 data through 1985 indicated that plants with less than 2 years of operations may experience a disproportionately large number of these types of events.

The data indicates that wrong unit / wrong train events are continuing to occur.

Regulatory Analysis 1.

Currently, there is no NRC requirement for labeling of controls, valves, electrical and other equipment which must be located, identified or manipulated by plant personnel nor is there any requirement regarding area labeling (e.g., doors, rooms, units).

The NRC should perform a regulatory analysis to determine whether a requirement should be established that locations which involve a man-machine interface (e.g.,

controls, displays, valves, electrical equipment) and plant areas be labeled in conformance with good human engineering principles.

2.

The NRC is evaluating the need to develop technical guidance for the industry to use to upgrade normal operating procedures and abnormal operating procedures as the staff has done for emergency operating procedures.

Future work in this area should include conducting a regulatory analysis to determine what regulatory action for other plant procedures is warranted.

ACKNOWLEDGEMENTS The authors wish to acknowledge Eugene Trager of the NRC Office for Analysis and Evaluation of Operational Data, and Martin Virgilio and Gregory Cwalina of the NRC Office of Nuclear Reactor Regulation for their participation in this study. -Mr. Trager participated in the site visits conducted during this study and was the author of the AE0D Special Study Report (AE0D/S401) entitled " Human Error in Events Involving Wrong Unit or Wrong Train."

Mr. Virgilio and Mr. Cwalina were instrumental in the initial planning stages of this study. Mr. Virgilio also participated in the first site visit conducted during this study.

1 I

1

i l

Appendix A References 1

A-1 J.

Memorandum from Heltemes (AE00) to Denton (NRR) dated January 13, 1984,

Subject:

Special Study Report - Human Error in Events Involving Wrong Unit or Wrong Train.

2.

Letter from Chan (NRC) to Stewart (VEPCo) dated February 7, 1986,

Subject:

Surry and North Anna WU/WT Trip Reports.

3.

Letter from Zwolinski (NRC) to Farrar (CECO) dated March 6,1986,

Subject:

Dresden WU/WT Trip Report.

4.

Letter from Gears (NRC) to Daltroff (PECo) dated March 13, 1986

Subject:

Peach Bottom WU/WT Trip Report.

5.

Letter from Fischer (NRC) to McNeill (PSEG) dated March 17, 1986 i

Subject:

Salem WU/WT Trip Report.

6.

Letter from Bournia (NRC) to Farrar (CECO) dated March 17, 1986

Subject:

LaSalle WU/WT Trip Report 7.

Letter from Wigginton (NRC) to Feinstein (AEPS) dated March 13, 1986

Subject:

D. C. Cook WU/WT Trip Report.

8.

Letter from Hood (NRC) to Duke Power dated March 12, 1986

Subject:

McGuire WU/WT Trip Report.

9.

Letter from Mcdonald (NRC) to Woody (FPL) dated March 20, 1986

Subject:

Turkey Point WU/WT Trip Report.

10.

Letter from Hood (NRC) to Duke Power dated March 12, 1986

Subject:

Oconee WU/WT Trip Report.

'l I

i i

1 Appendix B Assessment of Contributors to the Events Investigated During the Site Visits i

i l

l

l g Labelling 8

2 u

o x

0 3

S 2

E o

S E"D3

b

S ;

8 t

e d E

E

~

2 8 2

~

" C E t L t

23 2

+

a-m Event h ; 2 ; [ 0,

a S 3 0 2 b

{

S c

u Sit 2 Number Title T

i.

u ; y 3 k' S ;

t 8 2 3 e

c Comments 8 8 % 8 8 8 E

2 SE.C.E 2

.a I

1 c

o m a z a u z o m u r m. z -

m: 0 a.

Dresdin 237-84-013 EHC Valve U

S P

S S

valve non-licensed oper.

249-85-00S Diesel Generator U

P S

S electrical non-licensed oper.

switches i

237-84-012 RPS Trip T

S S

P instrument instrument mechanic Surry 281-31-001 Boric Acid Valve U

P S

S valve non-licensed oper.

230-a2-072 S. I. Accumulator T

S P

control licensed control room-room operator switch 280-83-033 MOV Toroue Switch U

S P

electrical electrician 7

switch 280-83-0S1 Containment Vacuum T

P S

S ' piping /

licensed reactor

• drawings were out of date; not 4bmp Line valve operator taken into the field; no training on design change 2 rth Anna 339-82-022 Ouench Spray Subsystem T

S S 'P electrical engineer

• overtime cabinet electrician 339-85-006 De-energitation of 120V T

S' P

S electrical lon-licensed oper.

• load list missing in breaker AC vital Bus breakers cabinet Non-reportable Lube Oli '%mp T

P' S-*

pump naintenance

• 1abel not obvious; pump running event nechanics lights broken

• • noise

ok c

dn s

a r

r lt e

n o

eo k

e y

t s nn a

e ey al a

e b

he ie pn r

th cb o

bl e

t na fi a

v d

ul ot ec a

ee s

n a

vi h

t s t

ng kc l r su n

an ci at d

ia e

af vc l

xc i

s hd bi e

u eey r

fl o

bh s

t a o

ie ne oe c

s t

C wl t

ov ldr s

s tm l

eeo ti i

tt so e

bsw nm l

nn ir b

aut e

ee lf a

l s

t; f

tdd l

ru se e

f sno td her ir m

o ieo ces n

gvt su i

xpt etg o

uen nd t

k ees ran i

onu oe r

c d r rri t

h cc e

e nne oew ud t ee no v

h oid cna ae l rr i r o

c n*

n ner cs aee

• p

• • u i gd

• u

• ww t '

r r

r r

e l

e e

l e

t p

o p

p o

p n

o r

o o

r o

i tr tr a

d no d

d no d

m e

ot e

e ot n

e s

ca s

s ca a

s t n u* 24

.E" %R. EIn.

n r

n n

r i

n na e

de e

e de c

e ei i

c mc c

ep c

c ep i

so i

i so r

i ui l

n l

l n

t l

rn em em c

th n

co n

n co e

n sc o

i o o

o i o l

o ne n

l r n

n l r e

n it m

e o

l l

l c o

l l

r a

a an r

a a

o cr c

cr c

cs t

i e i r i o l

i i r

,* 3E~ #{ aw l ah rt re rf oh r

re erc tr tk ts rc tl tk e

set ce ca cn e

tt ce ca v

eni en ee ea p

ni en ee l

ow l a l r a

i ew l e l r l r i

dgs et eb et p

cs ep eb v

.E 32a t

.2sm S

,2*E d;5382a

,22 % c5%2t%-

u3 u5r P

• f 3;1a S

.&* ~ h aS5 2-P P

S P

S 8;0EH5u S

P S

P P

S

,2a$2m S

• 2S,.Q8m o

gn DEt;8u P'

i a" ems u8a l

le

.eE" %z ba x= ;i" & u8n.

S L

E0;T8z P

S P

u 6* 5E" 8,.7s T

U U

T C

U C

C C

re t

e r

v e

l v

p a

g n

m V

n n

I u

o i

P r

s i

r l

r t

e s

t e

o e

o n

t m

a a

t o

l t

e n

r p

l a

C t

a m

a o

y l

w i

r u

l f

B a

d n

T e

r o

s t

e w

n t

o n

t s

e e

o e

s C

a s

n v

F dn G

n r

e e

I l

to I

r T

n T

a f

ui l

o i

r V

o ht e

l t

g L

s e

Sa a

c n

u p

U s

l se t

a o

D r

m C

s Ro e

r A

o u

W o

Hs iD iV R

W C

T J

R L

RI e

e l

l b

b 3

4 a

a 8

8 0

1 7

2 r

0 2

t t

0 0

4 7

1 1

te 0

0 r

r 0

0 1

0 0

0 nb o

o em 2

3 p

p 1

5 3

4 4

5 vu 8

3 e

e 8

8 8

8 3

8 EN rt rt 2

2 n

n 8

8 3

3 4

4 7

7 ne ne 7

7 7

7 7

i 2

2 ov ov 2

2 3

3 3

J ne ne e

m e

t o

l m

ht l

i e

ct a

S l

ao S

a eB a

S P

L fJj a

j?

j!

I 4

1 i

1 4

f u

Labelling 5 9 E

v c

=

u

?

S t

o 5

E" 8

~

c d E

E E E S C2

h %

S ;

~

a % 8 3 3

E5 Y

a-Event h ; 2 E 0 4

@ ; 5 3 a i' 3 E

j S

c Site Number Title T

c? j g 5 ; u t 8 i

M Comments c

8 8 % 8 8 8 f

2$T E E 2 I

c o

=> z m z m u z o a v s a a

nc o na n.

LaSalle 374-85-020 Service Water Sample C

P nd. chem foreman DC Cook 315-81-005 St Valve Breaker U

5 P

electrical non-licensed oper.

• magic marker labels breakers 315-83-009 Spray Additive Tank U

S' P

valve non-licensed oper

• independent verification Outlet valve procedures emphasized recording seal number and not verifying position 315-83-048 Containment Spray T

Sd S S'

• P S

valve non-licensed oper

• magic marker labels with no Heat Exchange licensed onerator train designation

• • fatigue 315-84-014 SI Pumps T

S P

S S' S

valve non-licensed oper

• hot ( 100 F) 0 contamination clothing fa tigue non-reportable Containment Spray U

P' valve non-licensed oper

• overtime b

tz event

• 1cGuire 369-81-130 Containment Ventilation J

P*

valve non-licensed oper. *1ack of control for consistency Isolation Valve between labels and drawings following station modifications; label was incorrect 370-84-021 High flux Rate Signal T

P S

instrument instrument and

• mind was on plant conditions electrical tech.

370-84-034 Inverter U

P* 5" inverter licensed oper.

• dual verifier confused by non-1icensed oper. procedure

• • procedure was generic to eight inverters for both units

m s

l t

l h

i ar t

n to i

u sl y

)

w no l n

,f t

o i c na sf to w

s l

oh ro en t

ofl e

t t

u e

toe b

nr os hn r

b a

eor hy so;o dea s

l dte a

ief esl t

nah 8d ttt vu n

y ert /

uces o

d e

r pea so oal e mde m

ar d

epr yn g

pr eec do a

anmu rk n o

o e

n s

d-tiod ca C

p p

ikn ce sah m) m co7s eg c gl n era ter nnoi(r vnso n

e oolt h

aiar i;

k c i

ie ht p

ksd trcas gttsm2 ld rrn emi naaoi1 tued aoa ic pt/

osl e mo r

nid rs nean dg rca ifeeey rii m

n oie aik vva d

tb oei cgr rrol od imim ord naa t eoa*

dino rio im*

• vl v*9

• hic

• fc

• (*

r r

r r

r e

e o

e e

p p

t p

p o

o a

o o

r d

d e

d d

e e

p e

e s

s o

s s

n n

n n

uI E*

8^ %& cIo.

e e

d e

e c

c e

c c

i i

s i

i l

l n

l l

e n

n c

n n

o o

i o

o n

n l

n n

l l

a a

c cs ir s

i r v2sE~ T{ aw e

e re t

re e

v v

tk e

tk v

l l

ca s

ca l

a a

ee ee a

v v

l r l r v

eb eb

.F3* a P

,2

• m

,Sj i;5382a S

,U" t e5 %2t~ -

S

~3 uSr P

ta 3;ta 5

l 5

03 ~ t o552r S'

8;3;"g8v i

P P

.24$2m S

)o

• 2 3,C'.8z P

gn D8t;8v i

-'E%E u8a l

le

.aE" Ez S

b S

a xO;2"au8a L

8%;T8z P

C T

v m* 5* " h cm U

T u

T r

n m

e o

e k

i t

t s

y a

c y

a e

r r

e e

S p

B l

j t

n r

S n

p o

i I

e t

i i

T t

n r

t d

a a

w e

T a

e d

m u

n r

s t

H e

i o

t c

g e

rn F

a t

e A

t c

s ei n

a F

pp x

pi u

o e

G S

UP A

C R

N E

6 3

4 7

0 7

1 0

0 1

r 1

0 te 0

0 0

0 0

0 nb 3

4 5

5 em 5

3 vu 8

8 3

8 8

8 EN 1

0 0

0 0

0 7

5 5

5 5

5 2

2 2

2 3

2 tn io P

e er y

t i

e i

S u

k G

r c

u i

T

Appendix C Assessment of Contributors to the Events Discussed in AEOD Report,

" Human Error in Events Involving Wrong Unit or Wrong Train" (AE0D/S401)

=*

d Labelling b

=

5 9 2

v e

s t

2 2

E'C2

h e d E

8 8

S

~

~

-3 ;

e s

1 Event h ; 2 j E % <

S S 3 i'b F

{

c e

Site number T

?)

2 5 ;

t 8 2 5 E

coments u

u 8 8 % 8 8 8 E E 2 2 ST t

.a.,

I c

a.

m z n. z a u m on, v s a r ~

a o Big Rock Point 155-81-022 T

P electrical non-licensed rooms and equipment not identified switch operator Cenn. Yankee 213-81-008 T

P valve surveillance procedure had valve nos.

reversed Browns Ferry 259-82-032 T

S P

electrical safety system out of service while another breakers train was removed for T.S. surv.

R:binson 261-81-003 i

P electrical procedures sai:: "open" circuit EI instead of

.[

breakers

" fuse 5 removed" I

Point Seich Insp. Report 50-266/82-12 U

S P

S valves non-licensed oper. Unit I dwgs used to give instructions on Unit 2; operator was assigned to Unit 1 visual alarms poorly placed Calvtrt Cliffs 318-32-018 U

S 'S P

electrical electricians

• not clearly identified as Unit 1 or 2 programer g

panels w

switch licensed oper.

• mirror image 318-83-007 T 5 P '

Sequoy:h 327-31-073 T

P relief valve maintenance

• wrong location on Md0 oersonnel elec. fuse

• faulty -- method not clear Fitzpatrick 333-82-041 T

P board 333-81-038 T

p inst modules maintenance

• faulty personnel

C-2 E:2 3

E 2

i 3

2 b

k S

b k'.

5 3

.2 e

m o

pantoAug sod tedpupd paatoaut guand pb]

5 E

~.

$5utmeJG s

9341RM uB6 sag dtnD]/inoKel 1lJoM Ao uotidnJJ31ut 18S putu StaJ1S te31SK4d

'duaul Jo BuluteJ1 a,

uolle31uftauo3

$3Jnp330Jd J8410 i

1tegel wD uou E

K3 urns 6suo3

=

luam33 eld Jood j

anctun lou Kitligepean Jood guaistm] uoM a

doo) Jo uneJ1 Jo 16un m

.c co e

b N

b h

h a.,

s A

e 3

3 G

2 i.

a3 2

3

(

t t

i -

l

geORM=

us vCum 1uuTORv cO M.s.ON i ~..O-r NuM. -<-.<,~,,r,oc

,v., 4,...,

Eo't E BIBUOGRAPHIC DATA SHEET NUREG-1192 Sii INSTRUCTIONS ON THE vf R$g 2 TsTLE AN0 5UtilTLE 3 Lt AVE BL A An Investigati of the Contributors to Wrong Unit or f

Wrong Train Even f

,,,,,,,,,oR,co,,,,,,,

/pril l

WONTR

..AR 1986

. tut,.ORii.

D. Persinko, A. Rame ith

[

6 DATE REPORT l$$uED j

MON,,,

,,AR f April 1986 76t WORMING ORGANi2Af TON NAME AND Maitsh ORg ss ir=s ae le Codi.1 (PROeECT/T A$t WORE UNIT NUWgtR Division of Human Factors chnology Office of Nuclear Reactor lation

'[

,,, N OR G R A,,, ~uM.. R U.S. Nuclear Regulatory Comm ion Washington, DC 20555 to EPONSORING ORGANi2 ATION NAME ANO MAILING ADDRE55 trache s coael 11a T YPE OP REPORT Division of Human Factors Technolo Office of Nuclear Reactor Regulation Regulatory U.S. Nuclear Regulatory Commission

. Pi a.Oo cOvi aio,,~~..

Washington, DC 20555 12 SUPPLEMENT AR Y NOTES 93 imST~ACT rJoo weres or reses Wrong unit / wrong train events result when acti ns are performed on the wrong train of systems with redundant trains or on the wrond nit of a multi-unit facility.

This type of human error was investigated at 10 p. a sites through in-depth interviews with knowledgeable plant personnel and thro h ant walk-throughs.

The purpose of the interviews was to determine the contri tors o wrong unit / wrong train human errors in order to develop a strategy to r uce t incidence of such events.

Those factors that contributed to wrong unit /wr g train rrors are identified and are ranked according to their relative incide ce of inv vement.

Observations pertinent to wrong unit /wrorj train even s and recommendations for NRC action to reduce the incidence of wrong nit / wrong tr 'n events are given.

W

/

/

I4 DOCuWs NT AN ALysig e N E,WORUS'OE SCRePTOMS i

in AvasLAg Lif v STA'tWINT Wrong unit, wrong train, wrong comf onent, human error Unlimited

't SECUR67V CL A55+P C A TION tro peres

. IOENT8 ERS Os'EN E NDE D TERMS tin e recorrt Unclassified

,,NmW.

O.P.c.is t

18 PR'CE

UNITED STATES sncut rou~.ru ctass n4Te Z

NUCLEAR REIULATORY CIMMISSION Po8'^Gjs* 'yS "D

{

WASHINGTON, D.C. M ygs,",fE.,

mo OFFICIAL BUSINESS

'L' PENALTY FOR PRIVATE USE. $300 y

N 3

120555078877 1 1 M' US NRC y &

U T E4 R -P C R NUREG Li W-501 DC 20555 WASHINGTON gl, a<.

m, C/3 '

$\\

O>d O.

Z' On d'

2m OO Z'

H

D S

O' A

I a

a

(

4 O

1