ML18040B039

Evaluation of Detailed Control Room Design Review for Susquehanna Steam Electric Station, Technical Evaluation Rept

ML18040B039
Person / Time
Site:	Susquehanna
Issue date:	01/25/1984
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML17139C196	List: ML18040B039
References
CON-NRC-03-82-096, CON-NRC-3-82-96, RTR-NUREG-0737, RTR-NUREG-737 SAI-186-351-73, NUDOCS 8402030532
Download: ML18040B039 (30)

Text

SAI-186.-351-73 EVALUATION OF THE DETAILED CONTROL ROOM DESIGN REVIEM FOR SUSQUEHANNA STEAM ELECTRIC STATION Technical Evaluation Report Prepared for:

U.S. Nuclear Regulatory Commission Washington, D.C.

Contract NRC-03>>82-096

~

~

TABLE OF CONTENTS Section ~Pa e F OREWORDe ~ ~ ~ ~ ~ ~ e ~ ~ ~ ~ e ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

BACKGROUND.

PLANNING PHASEe ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

1. Pre aration and Submission of Pro ram Plan .

2. Establishment of a uali fied Nultidisci linar Review Team..

REVIS PHASEe ~ ~ ~ ~ ~ ~ ~ e ~ ~ ~ ~ ~ 3

1. S stems Function and Task Anal sis ~ ~ e ~ ~ ~ 5

2. Control Room Inventor 8

3. Control Room Su>ye . 10

4. Review of 0 eratin Ex erience 10 ASSESSMENT AND IMPLEMENTATION PHASE . 11

1. HED Assessment Methodolo 11

2. Selection of Desi n Im rovements . 11

3. Verification that Selected Oesi n Im rovements Will Provide the Necessar Correction. . . . . . . . . 12:

4. Verification that Im rovements can be Introduced in the Control Room Without Creatin An Unacce table HEOs. . . . . . . . . . . . . , . . . . . 12

5. Coordination of Control Room Im rovements With Chan es Resultin From Other Im rovement Pro rams. 12

6. Pro osed Schedules for Im lementin Desi n Chan es . 13 ANALYSIS OF PROPOSED DESIGN CHANGES AND JUSTIFICATION FOR HEDS WITH SAFETY SIGNIFICANCE THAT ARE TO BE LEFT UNCORRECTED OR PARTIALLY CORRECTED . 13

1. Anal sis of Pro osed Desi n Chan es. 13

2. na sis of Justifscations for HEDs with Safet Si nificance That Are to be Left Uncorrected . 15.

REPORTING PHASE . ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 17 CONCLUSION. . . . . . . . e 17 REFERENCES. 20 APPENDIX A APPENDIX B

FOREMORD This Technical Evaluation Report (TER) was prepared by Science Appli-cations, Inc. (SAI) under Contract NRC-03-82-096, Technical Assistance in Support of NRC Licensing Actions: Program I I I. The e'valuation was performed in support of the Division of Human Factors Safety, Human Factors Engineering Branch (HFEB). NRC previously evaluated Pennsylvania Power &

Light Company's (PP&L) program plan (Reference 2) for conducting Detailed Control Room Design Reviews (DCRDRs) at the Susquehanna Steam Electric Station. NRC staff comments on PP&L's program plan were forwarded to the on July 15, 1983 (Reference 3). NRC review of the program plan led 'icensee to a favorable conclusion; processes described in the plan were found to be complete.

The SAI. evaluation team held discussions with the HFEB staff in the course of the evaluation of the Su@nary Report (Reference 1).

Evaluation of the Detailed Control Room Design Review For Susquehanna Steam Electric Station This report documents Science Applications, Inc.'s (SAI) evaluation of the Detailed Control Room Design Review (DCRDR) Summary Report submitted to the Nuclear Regulatory Commission (NRC) by Pennsylvania Power 8 Light Company (PP8L) for Susquehanna Steam Electric Station (Reference 1). PP8L's review was conducted in accordance with the program plan (Reference 2) submitted to the NRC June 3, 1982. NRC staff evaluated the program plan and

- forwarded their comments (Reference 3) to the licensee on July 15, 1983.

The NRC review of the program plan led to a favorable conclusion; processes described in the program plan were found to be complete.

Results of the SAI evaluation follow a brief overview of the background leading up to the DCRDR sumnary report.

BACKGROUND Licensees and applicants for operating licenses are required to conduct a Detailed Control Room Design review (DCRDR). The objective is to

"...improve the ability of nuclear power plant control room operators to prevent accidents or cope with accidents if they occur by improving the information provided to them" (NUREG-0660, Item I.D). The need to conduct a DCRDR was confirmed in NUREG-0737 and in Supplement 1 to NUREG-0737. OCRDR requirements in Supplement 1 to NUREG-0737 replaced those in earlier documents. Supplement 1 to NUREG-0737 requires each applicant or licensee to conduct their DCRDR on a schedule negotiated with the NRC. Guidelines for conducting a DCROR are provided in NUREG-0700 while. criteria for NRC's evaluation of a DCRDR are contained in NUREG-0801 (draft). (The NUREG documents cited are listed as References 4-8.)

A DCRDR is to be conducted according to the licensee's own program plan (which must be submitted to the NRC); according to NUREG-0700 it should include four phases: (1) planning, (2) review, (3) assessment, and (4) re-porting. The product of the last phase is a summary report which must include an outline of proposed control room changes, their proposed schedules .for implementation, and summary justification for human engineering discrepancies with safety significance to be left uncorrected or

partially corrected. Upon r eceipt of the licensee's summary report and prior to implementation of proposed changes, NRC must prepare a Safety Evaluation Report (SER) indicating the acceptability of the DCRDR {not just the summary report). The NRC's evaluation encompasses all documentation as well as briefings, discussions, and audits if any were conducted.

The purpose of this technical evaluation report is to assist the NRC in the technical evaluation process by providing an evaluation oF the PP&L summary report.

The DCRDR requirements as stated in Supplement 1 to NUREG-0737 can be summarized in terms of nine specific issues, a list of which provides a convenient outline of the areas covered in this technical evaluation. The nine issues are:

1. Establishment of a qualified multidisciplinary review team.

2. Use of function and task analyses to identify control room operator tasks and infor mation and control requirements during emergency operations.

3. A comparison of display and control requirements with a control room inventory.

4. A control room survey to identify deviations from accepted human factors principles.

5. Assessment of human engineering discrepancies (HEDs) to determine which HEDs are significant and should be corrected.

6. Selection of. design improvements that will correct those discrepan-cies.

7. Verification that selected design improvements will provide the necessary correction.

8. Verification that improvements can be introduced in the control room without creating any unacceptable human engineering discrepan-cies.

9. Coordination of control room improvements with changes resulting from other improvement programs such as SPDS, operator training, new instrumentation, Reg. Guide 1.97 (Rev. 2), and upgraded emergency operating procedures.

Planning Phase

1. Pre aration and Submission of a Pro ram Plan The DCRDR Program Plan for Susquehanna 1 and 2 was submitted in June 1982. The NRC review of the licensee's program plan included comments on the plan for review team structure and qualification, and the process used for:

(1) function and task analyses, (2) control room inventory, (3) control room survey, (4) HED assessment, (5) selection of design improvements, (6) veri-fication of improvements, including the assessment that no new HEOs are introduced, and (7) the. coordination of DCRDR activities with other pro-grams. The NRC concluded that the scope of the plan covered all major points of concern stated in NUREG-0737, Supplement l.

2. Establishment of a uglified Multidisci 1inar Review Team PPSL's review team appears to meet the qualifications requi~ed for a DCRDR multidisciplinary review team.

Review Phase PP&L's Detailed Control Room Design Review represents both Units 1 and 2 control rooms. However, the OCROR covered only Unit 1 control room. As indicated in the summary report, the control rooms are ~nearl identical.

Because Unit 2 control room was under construction it was not available during the DCROR. PPKL indicates that findings from the Unit 1 control room review will be applicable to Unit 2. This is an open issue- until any differences between the two control rooms are documented and separately evaluated. SAI's evaluation, however, pertains only to Unit l.

PP&L's summary report provides 9 pages devoted to plant history and background. Although interesting reading, on the whole such information is extraneous to our objective, which is to evaluate the summary report of the DCRDR. What is relevant, however, is the fact that in 1971 a Preliminary Conceptualization and Optimization Study incorporated human factors guide-lines into the recommended control room configuration (Reference 1, p. 1).

The result of the study and final design was an advanced control room which the licensee assures the NRC was "designed for operator convenience" (Ref-erence 1, p. 9).

The methodology and procedures conducted for the DCRDR are described in four pages of the report (Reference 1, p. 10-14). These include:

1. Systems Function and Task Analysis

2. Control Room Inventory

3. Control Room Survey

4. Operator guestionnaire

5. Verification of Task Performance Capabilities

6. Validation of Control Room Functions

7. Preliminary Review Items The above activities are those recommended by NUREG-0700 (Reference 5) guidelines as contributing to the accomplishment of review phase objectives.

Activities 2 through 4 contribute to the accomplishment of specific DCRDR requirements contained in Supplement 1 to NUREG-0737. In addition, PPSL included descriptions of methodologies for four other activities (not expli-citly required by the NRC): 4) Operating Experience Review, 5) Verif-ication of Task Performance Capabilities, 6) Validation of Control Room Functions, and 7) Preliminary Review Findings. These last four review activities are not explicitly covered in this evaluation except as they impact or augment those required by NUREG-0737, Supplement 1 (Reference 7).

Our evaluation of the above activities is presented in the following order:

1. Systems Function and Task Analysis

2. Control Room Inventory

3. 'Contr ol Room Survey

4. Review of Operating Experience

1. S stems Function and Task Anal sis Licensee Action PP&L performed a systems function and task analysis in order to determine the input and output requirements of operator tasks involved in selected operating events. The individual steps undertaken by the licensee were: 1) to identify systems; 2) to describe system functions; 3) to identify operating events; and 4) to perform a task analysis. A brief des-cription of these ind1vidual steps, taken from the Susquehanna DCRDR Summary Report, is given here to facilitate a discussion of the adequacies and inadequacies of this task.

Systems important to safety and/or significant to unit operation were identified on the basis of three considerations: 1) systems designated as safety related, 2) manual control systems needed by the operator for real-time support to prevent plant trips, and 3) manual systems needed for post-trip control of decay-heat transfer from the'ore'(Reference 1, p. 11).

Descriptions of system functions included system function (mission) conditions for system use, and a brief explanation of system operation (Reference 1, p. 12).

Safety-important systems were used to identify the event sequences to be analyzed. Various plant procedures were reviewed to ascertain which procedures required the operation of these systems. The operating events were then developed from the procedures (Reference 1, p. 12). Matrices were developed to compare safety-important systems to operating events.

The task analysis was performed by pre-filling task analysis forms using procedures or portions of procedures associated with the selected operating events (Reference 1, p. 12). The data pre-filled on the task

'analysis forms included: operator subtaskq, element, time, system, control room information sources, control room information requirements met, control manipulated by operator or potential branching point, system response from

display, performance criteria, and operator error (Reference 2, Appendix B).

This data was then used in the video-taping of simulator exercise sessions for the verification of task performance capabilities and validation of control room functions. The simulator exercises were essentially a method-ology for performing the verification and validation subtasks. In addition to the video-taping of the simulator exercises, PP&L performed a link analysis to track successive operator movements and interaction.

SAI evaluation The PP&L OCROR used safety-important systems as a basis for identifying operating event sequences to be analyzed. The criteria used were the three items: 1) systems designated as important to safety, 2) manual control systems needed by the operator for real-time support to prevent plant trips, and 3) manual control systems needed for post-trip control of decay-heat.

transfer from the core. The program plan stated that a fourth factor, in addition to the above three, would be used to identify systems. The degree I

of interconnection of non-class lE systems does not appear to have been ~ ~ ~

considered in the summary report. This is contrary to NUREG-0700 paragraph 3.4.2.2. In conclusion, it is not possible to determine if all systems important to safety have bee'n considered.

The methodology for identifying and describing system functions was not presented in sufficient detail to be able to judge if it is adequate. It appears as though the function identification subtask was based on plant operating procedures, although this was not stated. If this is the case, PP&L has not documented this. In any event, PP&L has not demonstrated that the system functions and control room operator interfaces have been com-pl etc 1y identi fi ed and .analyzed.

"Yarious plant procedures" were reviewed by the licensee to identify which procedures required the operation of safety-related systems (Reference 1, p. 12). PP&L did not state that all updated EOPs were used. It is therefore possible that some procedures were omitted or versions pre-dating TNI-II were used. In fact, two operating procedures listed in Table 1 of the summary report fall in the latter category. The service water system OP-11-001 was dated 8/30/78, and the reactor core isolation cooling OP 001 was dated 9/1/78. Because the operating event sequences were developed

from the plant procedures, PPSL has not provided assurance that all updated EOPs were used. Also PP8L ha's not demonstrated that the event sequences selected reflect the spectrum of plant operations with emphasis on emergency conditions. The summary report does not mention that an operating experience review was used to augment the event sequence identification process. This is a variation from the program plan (Reference 2, p. 32).

The task analysis portion of the FATA process was not a "classical" task analysis, rather it was a validation of control room functions and verification of task performance capabilities. This conclusion can be reached by reviewing the example of the pre-filled tapk analysis forms submitted with the program plan. There was no column in the task analysis form for information and control requirements. It may also be inferred from the paragraphs describing task analysis and verification and validation in the summary report (Reference 1, pp. 13-14). PP8L did not determine information and control requirements based on the function analysis for each event sequence, independently of the existing control room. (Information and control requirements are necessary in order to discover what kind of controls and instruments are appropriate for the system function as well as to establish what must be available in the control room to perform the task.) PP&L appears to have used the plant procedures exclusively to deter-mine the instrumentation .and control requirements. Hence PPLL may not have discovered that some controls and/or displays are missing from the control room or are unsuited to the function from a human engineering standpoint.

The task analysis segment is therefore unsatisfactory. NUREG-0700, para-graph 3.4.2 4 gives guidance on this segment of the DCRDR.

The link analysis performed by PP&L showed that the layout of controls and panels was "excellent with regard to operator placement/movement" (Ref-erence 1, p. 14). Because no methodology was presented with the for ms in Appendix D of the summary report, no attempt was made to assess this por tion.

A possible indication that the PPSL task analysis did not achieve the expected results of identifying human engineering discrepancies is that only two HEDs in the "no action required" implementation category and only one HED in the."to do" category were identified by this step. .The other 107 HEDs, which were submitted for review, were identified- by the control room

survey. This result could have been predicted because the task analysis, as performed by PP&L, used operating procedures to validate control room functions instead of comparing information and control room requirements with existing instruments/controls. Because PPEL did not submit the remaining 358 HEDs for review, it is not possible to determine if any of them were identified by the task analysis process.

Overall, the methodology for systems function and task analysis only partially satisfies the requirements of NUREG-0737, Supplement 1.

o PPSL has not provided assurance that all safety-impor tant systems have been identified and included in their matrix (Figures 2 and 3).

Non-class 1E systems were not addressed, therefore it is not pos-sible to verify that no highly interconnected systems have been overlooked.

o 'PPSL has not confirmed that only updated procedures were used to identify system functions'nd control room operator interfaces.

o PPSL has not demonstrated that the event sequences selected reflect the entire spectrum of plant opeiations with emphasis on emergency conditions.

o The task analysis is inappropriate. PPSL has not provided evidence to determine if information and control requirements based on the function analysis independently of the existing control room was made. This implies that additional verification and validation as well as HED documentation and proposed control room changes will have to be performed.

2. The Control Room Inventor According to the- NRC requirement stated in NUREG-0737, Supplement 1, the review should consist of: "(iii) A comparison of the display and con-trol requirements with a control room inventory to identify missing displays and controls." (Reference 7, p. 10)

PP8L's summary report contains a brief escription of the control room inventory which was generated from up-to-date panel drawings, engraving lists for component identification, and a complete set of photographs of the control room. Communications and ancillary equipment were also documented (Reference 1, p. 11). PP8L has neither reported what the inventory contains,'uch as component, location, parameters, and other equipment characteristics nor have they reported how the inventory was used to meet the above stated requirement.

The information presented in the summary report departs from that in the program plan in a significant way. The program plan describes the collection of an inventory of all control room instrumentation and equipment with the associated systems, subsystems, and functional groupings; instrumentation related to each; emergency equipment and communication devices (Reference 2, p. 28). They also state: the results will be documented in a form suitable for use during the verification of task per-formance capabilities (Reference 2, p. 29). The procedure for the verifica-tion of task performance capabilities as described in the program plan includes steps taken to determine if the necessary instrumentation and controls are available and if instrumentation'and control features allow for successful task completion (Reference 2, pp.. 34, 35).

The discrepancy between the program plan and the summary report is evidenced by the phase entitled, The Verification of Task Performance Capa-bilities. During this phase PPEL's summary report states that instrumentation and controls that are required to perform the selected operating events are ava il able to the operators as determined by a comparison. of input and output requirements from task analysis with the existing control room equipment via the SSES Simulator.

In conclusion, PPSL conducted an inventory of control room instrumenta-tion and equipment but does not identify its function. The summary report leads us to believe that it was, in fact, not used for comparison with display and control requirements. In addition, since we have concluded that the task analysis conducted to identify information and control requirements was unsatisfactory, the comparison of this data with the inventory (or existing control, room) would lead to inappropriate results; missing controls and displays may not have been thoroughly identified.

3. The Control Room Surve PP8L performed a control room survey in 1981 using checklists developed from human engineering guidelines presented in NUREG/CR-1580 and NUREG-0700 (Reference 1, p. 10). Any differences or discrepancies between NUREG/CR-1580 and NUREG-0700 guidelines were noted and a supplemental checklist was developed (Reference 1, p. 10). The licensee notes that "particular atten-tion was paid to those NUREG-0700 guideli.nes that specified -stricter tolerances than those in NUREG-1580 (Reference 1, p. 10). PPE L's report lists the control room panels which were included in the checklist evalua-tion. They have not, however, stated that this list of panels encompasses the entire primary operating control panels. A drawing of the control room layout including all panels surveyed would be necessary for our review. It is important to note that the remote shutdown panel is included in the list of control panels to be surveyed. Although not explicitly identified as a requirement in Supplement 1 to NUREG-0737 {Reference 7) the NRC staff has recommended that a human engineering evaluation of the Remote Shutdown Capa-bility be included within the scope of the DCRDR.

It is clear from the description of guidelines used to develop check-lists that a thorough set of items and indicators was included in the checklists. However, PPKL has not described the checklist methodology nor the procedures used to conduct the control room survey. Therefore we cannot fully evaluate this review activity until, PP&L provides this additional information. The summary report could be enhanced with additional informa-tion describing the identity and number of personnel and levels of effort of those who performed the control room survey.

4. Review of 0 eratin Ex erience The operating experience review consisted of a questionnaire given to operators and a review of documented operational errors such as those in a Licensee Event Report (LER). Although the summary report does not expli-citly mention the procedures to review LER documents, PPSL states in the program plan that LERs and FSARs would be considered as possible review documents {Reference 2, p. 27). Since PPSL's categorization process for 10

HEDs places documented errors in Category 1, it would be highly inappro-priate if LERs and other historical records were not reviewed. Conse-quently, additional clarification of the use of LERs to identify operational errors and HEDs is necessary to assess this review activity.

Although this activity is not explicitly requir ed by NUREG-0737, Supplement 1, it is pertinent to PP&L's HED assessment phase since docu-mented operational errors constitute Category I HEDs (see also section on A <<~td While the operator questionnaire methodology appears to have been satisfactory, we conclude that the HED categorization process would be unsatisfactory without a review of LERs. PP&L did not provide additional information describing this review step as it impacts the HED categorization process.

Assessment and Implementation Phase i

PP&L's assessment and implementation phase is addressed in Section 4, page 19 of the sum'mary report. Appendix C contains two groupings of human engineering" di'scr epancies (HEDs): 1) those HEDs classified as "No Action Required: Systems Related to Safety," and 2) those HEDs "to be corrected."

1. HED Assessment Methodolo The HED assessment methodology as presented in the Summary Report is identical to that in the program plan whi ch was found to conform to NRC guidance on this process. However, the assessment methodology in the sum-mary report excludes their proposed schedules for the implementation of corrections which, as stated in NUREG-0737, Supplement 1, should be submit-ted in the summary r eport (Reference 7, p. 11). Therefor e, this aspect of the assessment methodology cannot be evaluated and is unsatisfactory until PP&L can provide additional information.

2. Selection of Desi n Im rovements PP&L's summary report provides very little information describing the process to select design improvements for HEDs that were analyzed for

corrections. On page 22 the report states that existing plant programs will be used to effect changes; however, further information describing the process to examine various alternative solutions, their integrated effects on operator performance and the arrival at a final design solution were not provided. Therefore, this stage of PP&L's Assessment and Implementation phase is found incomplete until a summary description is provided.

3. Verification That Selected Desi n Im rovements Will Provide the Necessar Correction The summary report is missing information describing how design improvements will be verified to assure that they do in fact provide the necessary corrections. Therefore, the verification process cannot be evaluated and is judged unsatisfactory until the required information can be provided by PP&L. Also, it is not clear how the proposed implementations associated with HEDs to be corrected were determined without this effort.

4. Verification That Im rovements can be Introduced in the Control Room Without Creatin An Unacce table Human En ineerin Discre-

~anc$ es The summary report does not provide a procedure to assure that proposed improvements can be introduced i'nto the control room without introducing new HEDs. Therefore this verification step cannot be reviewed until a descrip-tion is provided.

5. Coordination of Control Room Im rovements With Chan es Resultin from Other Im rovement Pro rams The summary report contains no description as to how and when the coordination of the DCRDR with other programs (e.g., SPDS, operator training, Reg. Guide 1.97, and upgraded emergency operating procedures) will be accomplished. Therefore, this process cannot be evaluated and is judged unsatisfactory until the required information can be provided by PP&L.

6. Pro osed Schedules for Im lementin Desi n Chan es PP&L states in the summary report that "HEOs in this category (to be corrected) will be corrected by May 14, 1985." Mhile this is an adequate final completion date, further description as to the scheduled integration of changes with other control room changes (SPDS, Reg. Guide 1.97) that may impact the OCRDR is required in order to confirm that an adequate schedule is in place. Also, an implementation schedule is necessary to differentiate between near-term and long-term corrective actions and their respective degree of significance or potential to degrade operator performance.

Finally, as stated in NUREG-0737 (Reference 7, p. 11), "Imp< ovements that can be accomplished with an enhancement program (paint-tape-label) should be done promptly." In conclusion, the summary report does not describe this activity, therefore this process cannot be evaluated until PP&L provides additional information.

Analysis of Proposed Design Changes and Justification .for HEOs with Safety Significance that are to'h Left Uncorrected or Partially Corrected I

1. Anal sis of Pro osed Desi n Chan es Appendix C of PP&L's summary report contains two subgroupings of HEDs:

the first groups all HEDs classified as "No Action Required: Systems Related to Safety," the second groups the "To-Do" category of HEDs. The following is a discussion of the overall adequacy of proposed corrections.

Please note that it is difficult to evaluate the proposed corrections because of our unfamiliarity with the actual control panels and the various design solutions that PP&L has explored. The process for selecting design solutions and the technique to verify that solutions correct the HED without creating new ones were not described in the summary report. (Appendix A contains a listing of the HED Number and the generic comment on PP&L's proposed improvement for those HEDs to be corrected.)

1) Proposed implementation is unsatisfactory because it is missing, e.g., HED No. 466.

2) Proposed implementation description is unsatisfactory because it is too brief or the necessary information is not provided to determine

what PP8L intends to do to correct the discrepancy, e.g., HED No.

176- "PMR 83-317 will correct"

3) Proposed implementation is unsatisfactory because it does not correspond with the recommendation or ignores part of the recom-mended solution without explanation, e.g., HED No, 97: Control/

display relationship is unclear. Recommendation: enhance with demarcation or labeling. Implementation: discusses labeling only.

4) Proposed implementation is unsatisfactory because it does not address HED, e.g., HEO No 160: Annunciator Alarm Signal Intensity is not controlled by administrative procedure. Implementation:

Conduct a sound survey to determine the appropriate level.

(Minimal signal intensity is pertinent information for resolution of this HEO; however, as the discrepancy indicates, the signal

- intensity should be administratively controlled to avoid alteration.)

5) Proposed implementation is unsatisfactory because it calls for further evaluation or analysis which suggests either a plan to develop a solution or suggests a plan to develop a justification for no correction, e.g., HED No. 224.

6) Proposed implementation appears to overlook the interaction of HEDs or the creation of a new HED while selecting a design solution, e.g., HED No. 300: Controls were found to be located below the minimum height. Implementation: Collars provided on discrepant controls'ill prevent inadvertent activation. This implementation may correct the accidental activation problem; however, a potential operability problem may result for controls with collars at this height. This additional HED has not been addressed in the proposed implementation.

7) Proposed implementation is unsatisfactory because it only partially corrects the HED, e g., HED No. 300: Controls/Displays are.

located below the recommended height. Implementation: The solu-tion addresses the location of controls but omits any. discussion of how to resolve the location of displays.

8) Proposed modification is unsatisfactory because it will not correct the, HED, e.g., HEO No. 373: Components are laid out in an improper operational sequence. Implementation: The solution is to implement demarcation to clarify sequence. It is not clear how demarcation will place these components in the proper sequence or how demarcation will enhance their operability to reduce error.

The above eight comments represent generic issues we have identified from the evaluation of PP&L's proposed implementations for HEOs to be corrected.

In general, these comments indicate that further information addressing this

, phase of the OCRDR - "Assessment and Implementation" - is required for a thorough evaluation to determine the adequacy of PP&L's summary report.

PP&L should conduct further design solution activities, if they have not already done so, and provide the documentation of those activities and analyses. As stated in NUREG-0737, Supplement 1, licensees are to submit a summary report of the completed review outlining proposed control room changes, including their proposed schedules for implementation (Reference 7,

p. 11).

In conclusion, PP&L has not completely fulfilled the requirements due to either inadequate, missing, or incomplete proposals for implementation of changes for HEDs to be corrected. In addition, PP&L's proposed schedules for the implementation of design changes have not been submitted. Until additional information is submitted by PP&L, this aspect of the HED assess-ment and implementation phase is judged unsatisfactory.

2.'nal sis of Justifications for HEDs with Safet Si nificance that are to be Left Uncorrected The OCROR review process generated 468 HEDs. Of these, 145 were deleted, 166 required no action, 112 were completed and 45 remained "to do" (Reference 1, p'. 21). Of the 166 requiring no action, only 65 were submit-ted in Appendix A of the summary report, and therefore it is incomplete. It is not clear why the other 101 HEOs in this category were not submitted as required by NUREG-0737.

This review addresses the adequacy of PP&L's justifi'cation not to correct the 65 HEDs which were submitted. The justification not to correct 15

many HEDs was adequately provided; however, there were instances for which adequate justification was not provided. Several "generic" subgroups were identified for the latter group. They are discussed below.

Reasons for inadequate justification not to correct a HEO:

1. Brevity of justification makes evaluation impossible, e.g., No.

70: No recommendation, implementation, or justification whatsoever was provided.

2. Degree of deviation from a standard is not an adequate reason for deciding not to implement a solution for a KED, e.g., No. 170.

3. PP&L does not appear to have a consistent color coding convention as indicated by the numerous HEDs, e.g., Nos. 242, 199, 111, 112.

4. Some HEDs were evaluated by a NUREG-0700 guideline which was not applicable or inappropriate, e.g., No. 452. Guideline 6.6.3.7a does not address sequential operation of components.

5. Cumulative effects of groups of several HEDs, each with minor deviations from guidelines, were not addressed, e.g., Nos. 268, 271, 272 and 274 all have various visibility problems with meters and recorders located on same panel.

6. To dismiss a KED based on one justification if that HED violates more than one NUREG-0700 guideline is not satisfactory, e.g., No.

122 violates 0700, paragraph 6.4.4.la as well as 6.9.1.2C3.

7. Some justifications contradict the HED description as well as ignore the specific NUREG-0700 guidelines, e.g. No. 112 - color codes have multiple meanings.

8. Inadequate justification. A violation of the 0700 guidelines cannot be dismissed by citi ng utility convention or absence "of operator errors during walk-throughs, e.g., No. 192.

A deviation in methodology from the PP&L program plan occurs when HEDs were not categorized in one of four groupings (Reference 2, p. 39, Reference 1, p. 19). The following HEDs were not categorized: Nos. 75, 104, 105, 121, 123, 208, 218, 392, 398, 420, 463.

The above comments provide PP&L with generic reasons why some of the justifications for not correcting some HEDs are inadequate. Appendix B of this report categorizes HED numbers under these generic groupings.

In summary, more appropriate arguments would be based on a demonstra-tion of: 1) a HED having minimal risk to plant safety; 2) low consequence of HED impacting emergency operations.

Reporting Phase As previously noted in the planning phase, PP&L submitted a program plan on June 3, 1982 (Refer ence 2). NRC comments were forwarded to the licensee on July 15, 1983 (Reference 3). The processes described in the program plan were found to be complete and favorable according to NRC com-ments. The PP&L summary report provided the basis for this SAI review and evaluation.: Where appropriate, methods described in the summary report were compared with those proposed in the program plan to determine whether varia-tions from the program plan were introduced. As can be seen in our concluding remarks, the summary report omits much of the information and required processes as reported in the program plan. Therefore those speci-fic processes have been left as open items until further summary information

,is provided by PP&L.

Conclusion We conclude that, overall, PP&L has not submitted an appropr iate summary report for their Detailed Control Room Design Review for the Susquehanna Steam Electric Station. This conclusion was reached because of var ious issues left open in the report, which should address all require-ments stated in Supplement 1 to NUREG-0737. Furthermore, the Summary Report departs from the program plan (which was found appropriate by an NRC review (Reference 3)) in several respects without explanation. Although we have concluded that the requirement to conduct a DCRDR has'not been fully met, 17

there are several positive points we believe the summary report has made.

They are as follows:

o The event scenarios selected for the function and task analysis included Plant Startup and Plant Shutdown.

o The control room survey included a survey of the remote shutdown panel s.

o PP8L provided human factors education to plant personnel involved in the DCRDR.

o The control room survey checklist criteria were based on NUREG-0700 guidance.

The following are issues left open which should be resolved in a meeting with the licensee and by the submittal of supplemental information.

o Lack of a description of an LER review to identify documented opera-tional errors and lack of evidence.to show that these findings were used to identify Category 1'EDs.

o The Function and Task Analysis was found inadequate based on the following issues:

o The assurance that all event sequences reflecting the spectrum of plant operations with emphasis on emergency conditions has been selected and analyzed.

o The methodology for identifying operator information and control requirements.

o The comparison of the operator information and control requirements with a control room inventory.

o Assurance that all safety-important systems and associated task interfaces were analyzed.

o The omission of non-class 1E systems with a high degree of interconnection from the DCRDR process.

o The identification and description of systems function.

o The use of all up-dated EOPs for the function and task analysis.

o The content and function of the control room inventory.

o Assurance that the control room survey included all primary control room panels.

o The schedule for the implementation of HED solutions.

o The process to select design improvements.

I o The process to verify that improvements provide the necessary t

cor recti on wi thou introducing new HEDs.

o The process and schedule to coordinate the changes from the DCRDR with other improvement program changes.

o Justification for proposed improvements found inappropriate in Appendix A of this report.

o Justification for HED problems in Appendix B of this report.

19

REFERENCES'.

Susquehanna Steam Electric Station Detailed Control Room Design Review-Summary Report, Pennsylvania Power and Light Company, undated.

2. Susquehanna Steam Electric Station Detailed Control Room Design Review Program Plan, June 3, 1982.

3. "NRC Comments on the Susquehanna Steam"Electric Station Detailed Control Room Design Review," Attachment to Memorandum from D.L. Ziemann, NRC, to T.M. Novak, NRC, dated July 15, 1983.

4. NUREG-0600, Vol. 1, "NRC Action Plan Developed as a Result of the TMI-2 Accident," May 1980; Revision 1, August 1980.

5. NUREG-0700, "Guidelines for Control Room Design Reviews," September 1981.

6. NUREG-0737, "Clarification of TM I Action Plan Requirements," November 1980.

7. NUREG-0737, "Clarification of TMI Action Plan Requirements," Supplement 1, December 1982.

8. NUREG-0801, "Evaluation Criteria for Detailed Control Room Design Reviews," October 1981, draft report.

20

APPENDIX A

'I Generic comments on proposed improvements for those HEDs to be corrected.

1) Proposed impl'ementation is unsatisfactory because it is missing.

HED Nos. 462, 466.

2) Proposed implementation description is unsatisfactory because it is too brief or the necessary information is not provided to determine what PP8L intends to do to correct the HED. HED Nos. 4, 97, 176, 230, 375, 376, 437.

3) Proposed implementation is unsatisfactory because it does not correspond with the recommendation or ignores part of the recommended solution without explanation. HED Nos. 300, 367.

4) Proposed implementation is unsatisfactory because it does not correct HED. HED No. 108, 373, 465.

5)'roposed implementation is unsatisfactory because it does not address HED. HED No. 160.

6) Proposed implementation is unsatisfactory because it calls for

'further evaluation or analysis which suggests either a plan to develop a solution or suggests a plan to develop a justification for no correction. HED Nos. 4, 97, 184, 211, 224, 230, 232, 261, 283, 324, 329, 344, 349, 350, 367, 369, 431, 449, 465, 467.

7) Proposed implementation appears to overlook the interaction of HEDs or the possible creation of a new HED while selecting a design solution. HED No. 300.

8) Proposed implementation is unsatisfactory because it only partially corrects the-.HED. 'HED Nos. 2, 300.

9) Guideline addresses only part of the HED and proposed implementa-tion corrects only that part of the HED. HED No. 467.

(The proposed implementation HED Nos. not foun listed above were believed to have been appropriate within the constraints of the brevity of the implementation description and our unfamiliarity with the actual control panel s.)

I l

L 1

3

APPENDIX 8 Reasons for inadequate justification not to correct HEDs

l. Brevity of justification makes evaluation impossible. 'requently no justification whatsoever was provided. Nos. 70, 196, 204, 322, 326, 463.

2. Degree of deviation from a standard is not .an adequate reason for deciding not to find and implement a solution to a HED. Nos. 170, 239, 304, 383.

3. PP&L does not appear to have a consistent color coding convention as indicated by the numerous HEDs. Occasionally there are two different meanings attached to one color - green for example. Nos. 111, 112, 199, 242.

4. Some HEDs were evaluated by an NUREG-0700 guideline which was not applicable or inappropriate. Nos. 400, 452.

5. Cumulative effects of groups of HEDs, each with a minor deviation from the guidelines, were inadequately addressed. Lack of consistent mimics, color coding, legibility of instruments and controls are examples of

'his category. Nos. 75, 111, 112, 121, 122, 199, 239, 242, 268, 271, 272, 274, 400.

6. To dismiss a HED based on one justification if that HED violated more than one guideline is not satisfactory. No. 122 violates 0700 paragraph 6.4.4.1a as well as 6.9.1.2.C3.

7. Some justifications contradict the HED description as well as ignore specific NUREG-0700 guidelines. Nos. 112, 286, 391, 392, 407.

8. Inadequate justification. A violation of the 0700 guidelines cannot be dismissed by citing utility convention or absence of operator errors during walk-throughs. Nos. 192, 109, 122, 218, 398, 406, 413.

In addition to the above groupings, a deviation in methodology from. the PPEL program plan occurs when HEDs were not placed in assessment categories (Reference 2, p. 39, Reference 1, p. 19). The following HEDS were not categorized: Nos. 75, 104, 105, 121, 123, 208, 218, 392, 398, 420, 463.

The justification for not correcting all other HEDs in the "not-to-do" category is judged as appropriate within the constraints of the brevity of the description and our unfamiliarity with the actual control panels.

g~o~zs-p ja r,