ML19351F444

Review of TMI-1 Control Room from Human Factors Viewpoint.

ML19351F444
Person / Time
Site:	Three Mile Island
Issue date:	12/31/1980
From:	GENERAL PUBLIC UTILITIES CORP.
To:
Shared Package
ML19351F443	List: ML19351F442 ML19351F444
References
NUDOCS 8101130056
Download: ML19351F444 (155)

Text

OUTLINE This report, "A Review of the Three Mile Island Unit 1 Control Room from a Human Factors Viewpoint," December, 1980, documents the review which is discussed in " Licensee's Testimony of Patrick S. Walsh, William E. Meek, Herbert Estrada, Jr.,

Julien M. Christensen and Thomas B. Sheridan in Response to Sholly Contention No. 15 and ANGRY Contention No. V(C) (Control Room Design-Human Factors Engineering) ," dated September 15, 1980.

The report summarizes the findings of a detailed engineering review of the TMI Unit 1 control room design under-taken by GPU Service Corporation, and recommends improvements based upon these findings. The report first describes the approach used in the review -- i.e., the specific steps taken to evaluate the control room human factors. Next, the principal findings and recommendations from the review are presented, including l

the strengths of the present control room, the generic and specific shortcomings of the present control room, and conclu-sions on related topics more broadly related to the man-machine j interface. Finally, appendices which support and supplement the findings are provided, including the guidelines used for l the control room review, control room findings and observations, the control room environmental review, communications, equip-ment maintenance experience, and supplementary findings.

1 I

I I 810118 0 0SW l

i L

A REVIEW OF THE THREE MILE ISLAND UNIT 1 CONTROL

{ ROOM PROM A HUMAN FACTORS VIEWPOINT l

l December, 1980 l

l O

---

,,me-.y- y

TABLE OF CONTENTS SUBJECT PAGE I. I NTRODUCT ION- - - - - - - - - - - - - - - - - - - - - 1 II. APPROACH- - - - - - - - - - - - - - - - - - - - - - - 3 III.

SUMMARY

PRINCIPAL FINDINGS AND RECOM.VENDATIONS - - - 9 A. Strengths of the Present Control Room - - - - - - 9 B. Generic Shortcomings of the Present Control Room- 11 C. Specific Shortcomings of the Present Control Room 15 D. Conclusions on Related Topics - - - - - - - - - - 23 IV. REFERENCES- - - - - - - - - - - - - - - - - - - - - - 32 V. APPEliDICES A. Guidelines for Control Room Review B. Control Room Findings and Observations C. Control Room Environmental Review' D. Communications E. Equipment Maintenance Experience F. Supplementary Findings l

P A REVIEW OF THE TMI UNIT 1 CONTROL ROOM FROM A HUMAM FACTORS VIEWPOINT I. INTRODUCTION Unit 1 at Three Mile Island has had an excellent availability record over five years of operation (1974-1979). According to the data of the NRC gray books, the

, unit capacity factor for this period was 76.7% versus a i naticnal average for all reactors of 63.8% during the same period (capacity factor is the total energy generated divided by the energy which would be generated by operating at rating 100% of the time). It had relatively few operational problems and fewer still which can be assigned, unambiguously, to human factors problems in the arrangement and design of controls and displays in the main control room. Despite these facts, because of the criticisms which have been made of the human fcctors design aspects of nuclear power control rooms in general, GPUSC has undertaken a detailed engineering review of the Unit 1 control room design. This report summarizes the findings of this review, and recommends improvements based on these findings.

The review has been performed by a team made up of:

(i) Members of the GPUSC engineering staff:

l (ii) Engineers from MFR Associates, Inc., a firm with background in the design and operation of power plants; (iii) Dr. J.M. Christensen, a consultant in human factors in aerospace and other industries; and l

l (iv) Dr. T. B. Sheridan, Professor of Engineering and Applied Psychology at the Massachusetts Institute of Technology.

In addition, TMI Unit 1 operating personnel assisted the review team, specifically by participating in walkthroughs, and by evaluating proposed modifications.

l The findings and recommendations contained herein i sepresent the consensus of the review team.

It should be noted that the review described in this report was performed entirely on GPU's initiative. The l work was completed prior to the issuance, by NRC, of an j approved regulatory guide for human engineering l

l

/

lllllllllI"'

evaluations (as of this writing an approved guide does not exist). Consequently, the scope and depth of the review, and the guidelines for it, were established by the review team. The scope and depth selected by the team are judged by them to ensure that any significant deff.ciencies in the human factors of the TMI-l control room have been identified, and understood sufficiently to reccmmend appropriate corrective action.

The specifics of the corrective actions to be taken by GPU as a result of this review are not described in this report (the text does take note of certain instances, l where action to correct a shortcoming has already been initiated). It is the review team's understanding that GPU'will formulate and publish an action plan which will l describe their responses to the findings and l recommendations herein. In the sections that follow, the l

approach to the review --the specific steps taken to evaluate the control room human factors-- is described first. Next the principal findings and recommendations are presented. Finally, appendices which support and

! supplement the findings are provided, t

1 Acknowledgement:

The review team would like to express its appreciation for the l

assistance and cooperation provided by GPU and Meted personnel throughout this human factors evaluation.

l l

l l

/

b =

11

P O II. APPROACH The review included the following elements:

1. Guidelines and objectives were developed whereby the specifics of the control and display designs could be evaluated. (As was noted above, no guidelines specifically designed for use in nuclear plant evaluations had been issued.when this review was begun). The guidelines were formulated by:

a. developing operational guidelines defining operator responsibilities and functions specific to control of the TMI-l power plant, and

b. searching appropriate human factors literature, particularly references (1), (2) and (3) ,

• and adapting the human factors guidelines of these references to a form suited for evaluation of an existing nuclear plant control room.

The guidelines and objectives developed are included as Appendix A.

2. A full-scale control room mockup was constructed to allow evaluations as described in 3 and 4 below. The use of the actual control room for a major part of the

, evaluation effort was considered undesirable by the l review team and the operating staff because of the extremely disruptive effect that procedure walk-throughs and related activities would have on ongoing plant operations. Further, the discussicns and explanation which form an important part of the walk-i through process would necessarily be constrained in l the actual control room. The displays and controls for l

the mockup panels were reproduced by a combination of photographic and Xerox enlargements of a grid work of high quality photographs. The mockup is currently

being used to evaluate design changes evolving from the review. Figure 1 and 2 are photographs of the mockup during assembly in the Unit 1 turbine hall.

l

3. Key operational and emergency procedures were walked l through in the mockup to develop a clear understanding l

of how, when, by whom and in what way displays, controls and means of communication in the control

!

• References are listed in Section IV.

l

l 8

= ,

a, L ' -

l

\ ii

a. -

y.

~,

3 Gini...k.. .'lAf#il,#E!iiynitW/l.,'u.v.e

. eJ :. -

m.-

4R.'? ^ -

A ,~

-=

CC'ITRCL ROOM MOCKUP FIGU RE 1 Ol[ i

\i (L. ->lii)/ WJu uu M UU Lu i u!'

~

hM ,f D_

n, .f e,

i

/

l il l !! s' l . ~ ~ W M m ,c.!

~

"..I k, N1_.d alung e 7 'k*

lN I 1.'.l C .,.. '.tC 3;;4g .-4

<(

f ,

CONTROL ROOtt MOCKUP FIGURE 2

. e room are used and what changes, if any, would be desirable. Qualified Metropolitan Edison operating personnel performed the simulated operations, with the evaluations being performed by the review team.

Operating procedures that were walked through included plant heatup and startup (including operations at power), shutdown and cooldown, and refueling.

Sections of certinent subsidiary procedures (e.g.,

feed and ce..densate system startup) were also walked

, through as appropriate. Procedures utilized in the l walk-throughs are listed in Table 1.

l A " talk-through" technique was generally used in the operating procedure walk-throughs. The operator actions in these evolutions are in large part deliberate and slow paced. For such evolutions, real time simulations (a true walk-through) were found to be uninformative.

In the investigations of emergency evolutions, however, both talk-through and walk-through (real time simulation) techniques were employed. In these evolutions, events often unfold at a pace determined not by the operators, but by the plant, so that an understanding of the tasks imposed on them, in real time, is most desirable. The emergency procedures l walked-through included reactor trips from a variety of causes, turbine trips with and without reactor trips, a variety of losses of feedwater flow and other upsets in the feed system, a spectrum of losses of

reactor coolant with a variety of postulated causes, l and a spectrum of steam system leaks. In certain of I these emergency walk-throughs, additional complications were superimposed. Complications included fire, pctsonal injury, and abnormalities in amounts or locations of radioactive material.

In the operating procedure walk-throughs, the procedure itself, as read by the operator in charge

! (usually a shift foreman) was the initiator of each j step in the evolution. But in the emergency procedure l

walk-throughs a symptom oriented initiation strategy was followed. That is, a symptom or set of symptoms were described to the operator at a pace representative of how the symptom variable might behave in a representative casualty. The objective here was to determine how the operators used the displays, communications and other information at l their disposal to determine what emergency procedure l

l -

t

, e TABLE 1 SUBSIDIARY PROCEDURES WALKED THRCUCH TOP LEVEL PROCEDURES OR DISCUSSED IN SUPPORT OF TOP WALKED THROUGH LEVEL PROCEDURE WALK-THROUGHS  ;

)

OP 1102-1 Unit 1 Plant OP 1103-2 Filling and Venting Heatup Reactor Coolant Sys-tem OP ~1103-5 Pressurizer Operation OP 1102-2 Unit 1 Plant 1106-6 RC Pump Operation Startup lOP OP 1106-16 Once Through Steam Generator, Fill Drain I and Layup OP 1104-2 Makeup and Purification System Operation lOP 1106-1 Turbine Generator Operation OP 1102-10 Unit 1 Plant OP 1106-3 Feedwater System Shutdown OP 1103-15 Reactivity Balance

! Calculation OP 1102-11 Unit 1 Plant lOP 1105-4 Integrated Control Cooldown i System lOP 1102-13 Decay Heat Removal by OTSG RP 1502-1 Unit 1 Refueling op 1104-4 . Decay Heat Removal Operations System RP 1505-1 Core Assembly EP 1202-2 Station Blackout l EP 1202-3 Turbine Trip EP 1202-4 Reactor Trip

! EP 1202-6A Loss of Coolant l Accident (breaks within capacity l l of makeup system)

EP 1202-6B Loss of Coolant l Accident (small breaks causing l l

i automatic HP injection) l l EP 1202-26A Loss of Feedwater OP 1106-15 Main and Auxiliary to both OTSG's* Vacuum System EP 1203-24 Steam System Sup-i ply Rupture Actu g ation on both Steam Generators *g l

• A number of postulated casualties were walked through for which these are the most applicable procedures l

. e to follow. This is of particular interest in small J reactor or steam system leak situations, where the '

symptoms may not match the extreme FSAR-based emergency procedures.

An additional function of the walk-throughs was to compare the nomenclature of control console and panel labeling with that of plant procedures and appropriate piping and instrumentation schematic diagrams. The schematic diagrams were considered standards. Where discrepancies were found, appropriate specific changes to console labeling and/or procedures have been recommended. (In the case of procedures, discrepancies were called to the attention of the operating staff).

4. Displays and controls on the principal panels and consoles were individually reviewed separately from the walk-throughs. The object of this review was to evaluate items such as scale divisions, selection of units, and legend readability, which might not be picked up in the walk-throughs.

5. A review of alarm systems was performed to evaluate the usefulness of the information presented to the operator by the several control room annunciator systems in both normal and off-normal situations. The alarm system review is broad.in scope and separable l

from the other control room evaluations. The details

! of this work will therefore be described in a separate report. The principal findings of the alarm system review to date are included herein, however, for completeness.

6. The envircnmental conditions in the control room were surveyed to evaluate whether they adequately support the operators therein. The conditions evaluated included temperature, humidity, lighting, noise, creature comforts, arrangement of equipment and facilities, etc. This review included both quantitative measurements and qualitative observations, as well as interviews with the operating staff. The environmental survey, and the conclusions i and recommendations drawn from it are described in Appendix C.

7. The maintenance history of the equipment in the control room--the annunciators, meters, indicator lights, push buttons, control switches, controllers,

, a

< ,J l

recorders, and other electrical apparatus--was reviewed. Recommendations for changes to this equipment engendered by this study must consider its functional reliability. The results of the equipment survey are described in Appendix E.

l l

O e

• O 6

Ill I

l l

l I

i

(

l f

l 1

l l

l l-l l

l t

x 5

III.

SUMMARY

PRINCIPAL FINDINGS AND RECOMMENDATIONS

• A. Strengths of the Present Control Room This review has concluded that while improvements, some of them significant, can be made in the present control room at TMI Unit 1, the room as it exists has significant strengths. It is therefore of great importance that such improvements, as are judged to be warranted, build on these strengths.

The specific strengths of the room, as it exists, are as follows:

1. The operating console and associateu back panels are uncluttered, with controls and displays generally arranged in logical, functional groups. This feature, in combination with the operator staffing discussed in 2 below, leads to orderly and effective operator response in off-normal (e.g. , emergency) situations. The arrangement leads to orderly traffic patterns and individual operator responsibilities which are reasonable and logical.

2. The staffing of the control room with qualified personnel, as specified.by Meted, allows effective treatment of off-normal situations. It should be noted that this staffing level is in excess of that currently required by the Nuclear Regulatory Commission. Specifically, two qualified control room operators (CRO) and one shift foreman, a qualified senior reactor operator (SRO), are immediately available and can effectively handle most anticipated situations. But an additional CRO is also available, within minutes, and an additional evaluating capability--either the shift supervisor or shift technical advisor--is likewise available. This additional capability is extremely desirable for treating those upsets, I

The detailed findings on whi'ch this section is based are given in Appendices B and F. A plan view of the control -

room showing the various panel and console designations is included as Figure 1 at the end of Appendix B.

-9_

i

A lens likely but possible, in which additional complications occur--reactor trips coincident with significant disruptions to the electric plant, for example.

3. The functional responsibilities of control room operators, as delineated in the guidelines, determine in part the numbers of controls and displays which should be in the control room. But the assignment, to local stations, of subsystem t operational controls also has an important effect,

' especially on the numbers of controls. The controls which are locally assigned should be those which lead to more effective and safer equipment operation. If the assignment is made correctly, it results in uncluttered but effective panels and consoles in the main control room.

The division of control responsibility between the main control room and local stations appears to have been made sensibly for TMI-1. For the evolutions covered by the walk-throughs, it appears that the operations which are assigned to local panels can generally be effectively performed there, in a timely manner, but under the general supervision of the control room. Again, within the scope of operations covered by the walk-throughs, local control panels and gaugeboards are generally located near the equipment to which they apply. The numbers of auxiliary operators (four to seven per shift) and their responsibility assignments are consistent with effective and timely operation of these local panels.

~

4. The disp sys associateM with the use of a particular control are usually visible and recognizable from the station where the operator uses that control.

5. The alarm annunciators for the display of off-normal conditions for a particular system are generally above the console section containing the controls and displays needed to act on the alarm.

6. The alarm panels are essentially " dark" when the plant is operating normally at power. The ability of the operator to recognize and assimilate an off-normal condition is thereby maximized.

7. The logic for individual alarm annunciators is such that the operator is given adequate

, a O

information on which to base his immediate response. Obtaining troubleshooting information for long term response may require him to utilize the plant computer, or to have an auxiliary operator consult a local control panel. This design philosophy has resulted in a system in which the principal process alarms--plant alarms excluding fire detection, heating and ventilating, certain radwaste alarms, and certain demineralized water system alarms--number less than 350. As a consequence, the alarm panels are significantly less cluttered than those of other units where 700-1000 process alarms are often provided.

8. The control and display hardware, particularly push buttons, switches, meters and controllers has proven very reliable. The disruptive effect of frequent maintenance of components on the main console is avoided.

9. The environment of the control room--the temperature, humidity, lighting and noise level--

is generally within accepted standards (References 1 and 3), though further improvements appear feasible as will be discussed below.

B. Generic Shortcomings of the Present Control Room As with most nuclear plants " designed in the 1960s, the control room at TMI-l has a number of generic human factors deficiencies. Virtually all of them are correctable witaout wholesale panel replacement and without relocating a large number of controls and.

displays. The generic deficiencies, and the measures which can be taken to correct them, are as follows:

1. Although the controls and displays are usually grouped functionally, these groupings are not emphasized, labeled, or demarcated effectively.

2. The name plates (labels) which identify switches and meters are burdened with verbiage, and utilize letter sizes not easily read. Nomenclature sometimes does not match that of operating procedures. Content, color, and letter size are inconsistent.

By demarcating and labeling functional groups of controls and displays, and labeling the group as a whole, the excess words on individual component labels can be eliminated. New label plates, with lettering meeting huran factors standards and with consistent nomenclature can replace the old.

3. Two, and occasionally three, push buttons are used to actuate many motor operated valves.

Identifying valve numbers as well as descriptive names are engraved on the push buttons. In some cases push buttons are mounted in large regular arrays, making it difficult to determine which push buttons actuate a particular valve. Push button back lights vary in lighting intensity; when the lights are dim, it is difficult to determine the position of a valve. When a valve is tagged out, to inhibit operation during maintenance activity, the stick-on tag used for this purpose obscures the number, description, and position of the valve tagged.

These deficiencies can ce corrected by:

a. utilizing name plates adjoining the push buttons, identifying both function and number of the valve.

b. operating back lights at a voltage level producing adequate light-intensity (voltage ~ ~ ~ ~ ~ ^ ~

adjusting resistors are provided for'back ~

lights, but voltage levels appear to vary).

4. Vertical, edge-type meters are used to display most analog process variables. As indicated above, labels for these meters are difficult to read. In. addition, meters are often referred to by identifying number in operating and emergency procedures, but these numbers usually do not appear on meter labels. Powers of 10 are frequently employed on meter scales, but the scale factor (i.e., x10, x100, x10") is difficult to read. Scale divisions often do not meet human factors criteria. Finally, the units selected for many meters (e.g., feet, %, gallons) often make correlating the indicated process variable with related indications difficult. For example, tank levels are often displayed in feet or percent, while incoming and outgoing flow rates are given in gallons per minute. Most of these deficiencies can be corrected by improved labeling, by new, more effectively graduated scales, and by more effective supplementary labels, to give information such as meter number, scale factor and units. Further, small additional label plates can

lo . .

be spotted to assist in correlating variabl=s, (such as a small "265,000 gal." opposite the 100%

scale mark).

i

5. Operating controls for the control valves, motor operated valves, and other process devices are generally distinguishable from one another through the use of physically different operating devices. There is one significant deficiency in this regard. Controls for virtually all pumps and circuit breakers employ General Electric SB switches, with identical pistol grip handles.

Since the controls for breakers and pumps are often adjacent, there is some risk of operating the incorrect control. This deficiency can be corrected by using effective demarcating and by providing tactually and visually different handles for breaker switches than for pump (or f an) motor

, switches.

If these generic deficiencies were not corrected, the overall impact on plant safety and reliability would be difficult to quantify. Most control operations are deliberate in nature. Many of the deficiencies can be (and have been) overcome by operator training.

Nevertheless, there is evidence that the generic deficiencies have contributed to~ operational mistakes, l

though none of them placed the plant integrity in i jeopardy. Three examples ate cited:

a. A turbine extraction valve was incorrectly closed when the push button for one stage of extraction steam was mistaken for another.

This led to a sudden change in~ turbine steam demand which disturbance in turn reverberated through the steam generators and reactor system. Turbine and reactor trips were avoided but with some difficulty.

b. Makeup pump 1C was operated with an incorrect suction valve lineup (suction valves closed). Damage to the pump resulted. Two factors may have contributed to this incident:

• The controls for the C makeup pump and the suction valves are separated from one another (the pump controls are apart from the balance of the makeup system to meet regulatory requirements for electrical separation, as applied at the time TMI-l was designed), and l

l l

• The labeling of pumps and valves does not make clear the suction valve arrangement. j

c. An important feeder breaker on an emergency bus was inadvertently opened by an operator intending to shut off a decay heat pump.

As mentioned previously, in none of these incidents was the integrity of the nuclear system in jeopardy.

In none of these instances was the plant operated, even briefly, outside the requirements of its technical specificatioons. Nevertheless incidents (b) and (c) above removed from service, temporarily, equipment which is part of a safety s'rstem. Incident (a) had potential for challenging pir.nt safety systems. On these grounds, the improvement of labeling and meter scales, to conform more closely with human factors standards, the provision of more effectively lighted and engraved valve operating push buttons and the coding by shape or other means of operating handles for circuit breakers and pump controls is considered warranted, and is recommended by the review team.

6. Another generic shortcoming of the control room, which is shared throughout the utility industry, lies in the design and operation of strip chart '

recorders. These recorders serve two important functions. For the variables recorded, they:

S provide the operator with rate of change information about the process variable (which will act as stabilizing feedback in manual control situations).

• provide a permanent time history record.

(This may be legally required, or may be useful in troubleshooting, or may be used to

! estimate time dependent parameters such as

( fatigue usage).

1 l The recorders presently used for these purposes have a number of shortcomings:

• They are mechanically unreliable.

'the scales are of ten dif ficult to read.

• The exposed section of the time scale and the recorder speed often do not allow the rate of change information the operator needs to be inferred from the recording.

l t

L ,A

. o l Although the recorders exhibit the aforementioned human factors deficiencies and represent a maintenance burden, the operating staff has adjusted to them. Accordingly, and because it is necessary to test and prove out any replacement recorders of new design before installing them, the review team recommends that recorder replacement be viewed as a long term program. The review team recommends the following approach:

• The preparation of specifications for the various recorders to be replaced (these would cover human factors as well as functional requirements).

• The performance of an experience survey to ascertain whether, in the power industry or elsewhere, reliable, effective recording equipment is currently in service.

The procurement and testing of lead units of the various types needed based on the above specifications and survey.

• The installation and use of " pilot" models in various locations in the. plant, but not in critical locations such as the control room, to obtain first hand

• practical experience.

In addition and in conjunction with upgraded computer facilities planned for TMI-1, the use of CRT trending, with hard copy capability, should be evaluated as a means for replacing selected recorders.

t .

C. Specific Shortcomincs of the Present Control Room In addition to the generic deficiencies discussed in the preceeding paragraphs, there are certain specific shortcomings of the TMI-l control room which merit discussion and, in the opinion of the review team, corrective action.

A summary of these findings and the associated recommendations follow. Details are included in Appendices B and F.

, 1. In a situation in which engineered safety features l are called upon to actuate, the role of the I operator is:

4,

• to confirm that such features as are called upon actuate correctly, and

• if a feature fails to actuate correctly, to take appropriate corrective action.

The status of the Engineered Safeguards Actuation System (ESAS) is displayed on panel PCR. The status board uses color coded indicator lights as follows:

• blue: the component is in the state required by ESA$ actuation.

• yellow: the component is not in the state required by ESAS actuation.

If a seriously off-normal situation were to occur, in which all safety features actuated, the status information provided on PCR would allow the operator quickly to confirm satisfactory system operation simply by observing that the panel had turned " blue." But in less severe evolutions, when fewer safety features are required to operate, confirmation of status is not easy.

Further, in evolutions where a safety feature fails to actuate, determination of appropriate corrective actions may be difficult. More specifically, the PCR panel has the following shortcomings:

a. The existing panel status presentation cannot be read reliably by an operator at his normal station in front of the console. (In a situation in which safety features have actuated, to require the operator to leave his station is considered very undesirable).

Legend plates are too small, and lights, particularly blue lights, are too dim.

b. There are four separate patterns of safety features, which may occur separately, or in combinations, depending on the specific circumstances of actuation (that is, depending on whether a reactor trip, a low coolant pressure, a 4 psig reactor building pressure, a 30 psig reactor building pressure, or some combination of these symptoms has occured).

. o It would be extremely difficult for an operat.cr to discern and remember the status light patterns caused by each of these circumstances.

c. The present ESAS status panel uses a type of lighted legend indicator in which a single bulb provides blue indication while a second provides yellow. A burned out bulb makes an indicator cf this type ineffective. The failure of a single " yellow" bulb could, for example, result in a display which showed a valve to be in the engineered safety (blue) state, say, closed, when in fact it is partially open (both blue and yellow lights would be lit in this state).

The review team recommands that the ESAS status panel be revised. The panel should be interpretable by an operator at the console, and should have redundant or testable lights, so that the probability of a burned out indication leading to erroneous information is small.

2. The lineup of valves which connect the suctions of the emergency feedpumps to various sources of water cannot be readily determined from the rectangular push button array in which- they currently appear.

Because the valves' functions are difficult to describe, improved labeling will not substantially alleviate this problem. The need to confirm correct suction valve lineup could arise in a stressful situation (following a loss of normal feed). A mimic presentation of the feed pump suction piping and valves is recommended.

3. It is clearly desirable not to require operators at the main console to leave their posts during upsets; displays of the important plant analog variables, and the principal controls are here. The review uncovered several situations where this objective is not met. These are as follows:

a. One of the char ges to be incorporated prior to restart of Unit 1 is to isolate letdown (purification) flow automatically following a reactor trip. It has been planned to perform this function with two valves manually operable from back panel PCR only. Reinstating lerdown flow following a trip would therefore require the teactor operator to leave his post. GPU has revised the modification so that letdown flow

. 17 _

, a will be isolated by a single valve, controllable from the main console. The review team concurs with this change.

b. Immediately following a turbine trip, it is current practice to start certain standby oil pumps, controls for which are on back panel PLF. It should be pointed out that startup of this equipment is not functionally required during the first five minutes following a trip. The turbine coastdown is normally slow enough so that the turbine lubricates itself during this period; in the unusual event it does not, an automatic start feature will start the pumps. It is recommended that the turbine trip procedure be changed to allow the turbine / secondary plant operator to stay at his post, where he is useded to confirm that the turbine trip functions have executed correctly and that the feed water flow to the steam generators is satisfactorily controlled, before going behind console left to check the lube oil pumps.

c. If the engineered safeguards are initiated by low reactor coolant pressure (at 1600 psi), and the pressure subsequently rises (which will normally be the case),.the operator must manually reset the low pressure bistables before coolant pressure reaches 1700 psi. If he does.

not, injection cannot be terminated in an orderly manner. The manual resets for the (three) low pressure bistables are locked in cabinets at unmanned locations remote from the i

• control room. It is recommended that this l situation be corrected. (It is understood that

( reset of the low pressure ESAS channels will be j relocated to the main control console, which will eliminate the problem).

4. As has been described, the alarm system is effective in alerting the operator to off-normal conditions when normal plant operation at power is the initial -

condition. However, a significant number of alarms--20 to 40--normally follow in the train of a turbine trip and reactor trip. Most of these do not indicate conditions which, given the tripped state, require action on the part of the operator. But the presence of these 20-40 alarms is detrimental on three counts:

a. The continuing audible annanciations and the requiremen'. to acknowledge them is a distraction to console operators dealing with the plant, and interferes with their communications.

b. The presence of a legitimately off-normal alarm following a trip tends to be lost in the array of lit but less significant annunciators.

c. An operator, in acknowledging one main process system alarm, can inadvertently acknowledge other, unseen, process alarms (this is because four separate but equivalent acknowledge buttons are provided, and all alarms are not visible from each acknowledge station).

The review team recommends that these deficiencies be corrected. Corrective actions to be considered should include:

(1) Providing some means to silence or interrupt the audible tone associated with new alarms, without, at the same time, changing them from the unacknowledged (fastflash) to the acknowledged (steady on) state.

(2) Highlighting or prioritizing,.by some method, the alarms occurring in a multiple alar.n situation that require special operater action.

Dividing the acknowledge functions according to operator's responsibility--essentially separating the console left, center and right acknowledge features.

These recommendations will be expanded in the report of the alarm system review.

5. There are several problems identified with the controls and displays associated with the once through steam generators:

a. Three different level instruments are employed for various purposes. The startup (250 inch span) and wide range (630 inch span) instruments share a common zero (six inches above the lower tubesheet) and are calibrated in inches.. The op; rating range instrument (292 inch span), on the other hand, utilizes a different zero (106 inches above the lower tubesheet) and is calibrated in percent of range. Any or all of these instruments may be used by the operator in e -

cooldown, or shutdown, following a trip are considered satisfactory.) The adequacy of displays and controls provided for this contingency can therefore not be measured against a specific and proven procedure. The review team recommends engineering studies to develop a workable strategy for manual control at power be performed. These studies should consider:

Use of turbine first stage pressure as an anticipatory (steam demand) variable against which feed flow could be matched in the short term.

Use of steam pressure as a long term control variable analogmis to level in a recirculating steam generator.

Use of a slower operating speed for the feedwater regulating valve in the manual 1 mode.

6. Radiation monitoring system outputs are currently displayed on panel PRF. The electronics for these displays are also located in this panel. The system, as is, presents several problems:

a. Frequent maintenance is required by the electronics, and a technician is therefore often working in the aisle between panel PRF and console CR. This represents a distraction to the operators, and is an impediment, if access '

to the back panels is required.

l

b. The readings of individual monitors are difficult to distinguish from the operator's i

' normal station at the console. It should be noted, however, that individual channel alarms and alerts are visible at the console station, and, with improved labeling, the identity and j function of these channels should be readily l discernible.

c. The radiation readings are not visually

connected with the systems with which they are l associated.

None of these shortcomings is considered sufficiently serious to warrant, at present, the replacement of the existing radiation monitoring -

system. However, when obsolescence dictates t

l replacement of the system, a new location for system electronics, remote from back panels, should be selected. The new system should be provided with remote readouts, which could be placed at locations more consistent with their correct interpretation.

7. Control of decay heat removal during cooldown currently requires operation of cooler inlet and bypass valves a?, a local station. This station is not equipped with appropriate temperature indications to allow the operator to gauge the results of his action, Instead, temperature indications are displayed on the main control console. As a consequence, cooldown contrcl is awkward, involving two operators, and a telephone link. This situation could be remedied by adding appropriate valve controls to the control room console, or alternately, providing appropriate displays and improved controls at the local station. A study to determine the optimun solution to this shortcoming should be performed.

8. The CRT for reading out computer information presently installed in the control room is not operational (necessary readouts are obtained via line printers and an alphanumeric display at the computer console). The capabilities to read out computer information on a CRT is considered desirable. The review team recommends that means for accomplishing this be provided.

GPU is developing for the longer term more advanced computational and display systems. The review team's evaluation indicated several areas where consolidated display information would be desirable. These include:

l Primary coolant inventory including flow rates between repositories for this inventory.

Steam, feed, and condensate system inventory including a time history of condensate makeup and dump valve positions (from which to infer leak rate).

Absolute and relative control rod position indications (on a single display) to allow more rapid checkout of the rod control system following refueling.

I

9. The distribution of electric power to plant

( equipment is generally arranged in mimics on back l

E . 1

i ..

panel PR and console CR. There are, hcwever, a number of concerns, since the use of these controls by the operators is infrequent, they may not be as familiar with the line-up of these controls as with other more frequently used controls. These concerns include the following:

• Lack of information describing what specific loads receive power from specific buses.

• Intermingling of breaker controls on panel CR with makeup and other pump control 3.

Lack of clear association between ammeters and related feeders, voltmeters and related buses, and synchroscope controls.

Improved mimicing, system demarcation, and more effective labeling can correct these deficiencies.

Shape coding for electrical system control handles can be employed to distinguish them from pump motor controls.

10. The control room operator presently has no unambiguous means to distinguish between functioning and nonfunctioning instruments and controls, particularly when.the nonfunctioning situation is brought about by loss of a. power supply. The revic.

l tean believes that this should be remedied. The following corrective actions should be considered:

• Addition of appropriate power supply annunciators and indications to allow the operatcc to determine easily tnat a segment of his

instrumentation and control system has lost l

power.

1 l Addition of distinctive midscale " meter zero" marks to all Bailey meter scales, to assist the operator in detecting a single defective meter. >

D. Conclusions on Related Topics In addition to the above conclusions and recommendations, the review team has drawn conciusions and made recommendations on several topics more broadly related to l the man-machine interface:

l

1. In-plant communications, particularly between control l room operators and auxiliary operators, should be j improved, as outlined in Appendix D.

i t

2. Though the control room environment generally conforms with the criteria of Reference (1),

improvements can be made. Details are provided in Appendix C. Principal improvements recommended are:

a. a means of humidifying incoming air to eliminate excessive dryness in cold weather, and a means to improve air filtration during normal operation,

b. light baffles or other means, to reduce glare on i the consol.e from overhead lighting,

c. carpeting to reduce noise (to a level such that the day shift ambient is approximately equal to present night shift ambient), to reduce glare, and to reduce operator fatigue,

d. a rigorous, preplanned approach to inspecting, adjusting (for intensity) and replacing light bulbs for console and panel devices, and

e. revised audible intensities for alarm annunciators to levels uniformly intelligible to the operator.

None of the above is considered crucial to plant safety or reliabi.ity, but their implementation would be expected to improve operator alertness and morale.

The findings and recommended actions as a result of this survey are listed in Table III-1, together with appropriate references to the body of this report and to appendices.

l l

i I

l l

l

TACLE III-l

• Summary: Findings and Recommendations ,

(1)

Findings Recommended Action Ref. Section

1. Nameplates: letters small; Improve letter size, clarity. III-B.2 cluttered inconsistent nomen- Replace temporary ]

consistent nomencla,abels.

Provide B-II.B.4 clature; temporary labels. ture.

2. System Demarcation: existing Provido panel demarcation, group III-B.1,2 functional groups not clearly labels, color coding to identify B-II.A.1 identified. functional groups.

3. Pushbutton Controls: component Modify labeling, increase letter III-B.3 identification on control is size. Provide uniform light B-II.A.6 obscured by actuation and intensity. Show pair relation- U-II.B 1 tagging; variable light ships in large arrays.

intensity; large arrays.

d 4. Word Indicator lightis: letters Improve labeling, increase letter III-C.1 i small; variabic light size. Provide uniform light III-D.2 intensity. intensity. C-III.B.2,3

5. Vertical Meters: poor scale Provide new scales and additional III-B.4 demarcation, inadequate labeling. Evaluate overhead B-II.C.2,3 labeling, glare on meter faces. light baffling to reduce glare. C-III.B.2

6. S_hapo Coding: close proximity Use shape coding of handles to III-B.5 of pump controls and breaker distinguish pump controls from B-I.A.5 controls with identical breaker controls, handles.

7. Engineered Safeguards Panel: Redesign to match the new logic III-C.1 difficult to read from front and to provide rapid system B-II.A.3 of console; low indicator diagnosis from front of console. C-III.B.2,3 brightness; not designed for Improve indicator brightness and now actuation logic. provide push-to-test feature.

(1) References designated by: " Report Section (or Appendix) - Subsection"

• Findings and recommendations relative to alarms will be presented in a . .

. .. i .. ; r a ry. c . po r t .

Findings Recommended Action Ref. Section

. 8. Emergency Pecdwater Lineup: Provide complete mimic of III-C.2 scattered groups of feedwater emergency feedwater sources and B-II.A.8 valve controls; no EFW flow flow indication.

indication.

l

9. Letdown Isolation: requires Provide isolation function with III-C.3 operator to leave center con- valve that is controlled from B-I.D.1 sole shortly after reactor console center (MU-V-3).

trip.

10. Turbine Trip: lube oil check Modify procedure so operator may III-C.3 on back panel requires stay at station longer. B-I.D.2 operator to leave station

' 11. Reset of Low Pressure Provide automatic reset of III-C.3 w Bistables: reset required bistables or relocate reset con- B-I.B.1 remote from control room with trols to main conrole in control 8

limited time available. room.

12. Annunciator Audibility: Prdvide uniform audibility. III-C.4

• variabic alarm audibility C-III.C (too loud and too sof t) .

13. OTSG Control: No coordination Coordinate meter scales for level III-C.5 between startup, operating indications. Study modifying main B-I.A.2 and full range level indi- feed regulating valve controls cators; fast response feed- to improve manual control if water regulating valve. possible.

Findings Recommended Action Ref. Section

. 14. Radiation Monitoring System: Not considered serious enough to III-C.6 requirca frequent maintenance warrant wholesale replacement. C-III.J

. in front on panel PRP; diffi- Should be relocated when obsoles- E-III.C cult to read individual conce dictates replacement.

monitors from conter console; readings not visually related to corresponding system.

15. Strip Chart Recorders: low CRT trending with hardcopy III-B.6 mechanical reliability, capability may fill some recorder B-I.A.2 difficult cbtaining rate of needs. Alternate manufactures B-II.C.5 change data. may not be an improvement or E-III.B adaptable. Long term, develop and test new recorders.

Ej 16. Decay IIeat Cooler Control: Provide capability on consolo to III-C.7 decay heat cooler flow con- regulate decay heat closed cycle B-I.B.3 trol remote from temperature cooler flow. (Dil-V-2A/B and feedback indication in con- Dil-V-65A/B)or improve local trol room. codtrol and instrumentation.

17. CRT Display: current display Repair or Replace. Necessary in- III-C.8 not operational. formation is available on line B-II.C.6 printers. Long term GPU is devel-oping advanced computer display systems.

18. Electrical System Control: Expanded use of mimics, color III-C.9, inadequate mimics, ambiguous coding, shape coding, additional B-I.A.5 -

control / display relation- labeling.

ships, inadequate labeling.

e Findings Recommended Action Ref. Section

19. Communications: page system Upgrado page system and other III-D.1, inadequate, excessive burden communications equipment.. Review D-1 through 11 on operatoru during emergen- need for requiring execusive C-III.L cies, operator /ex-plant communications during emergency events.

20. Control Room Environment: Provido minimum humidity control III-D.2 low humidity; unnecessary and dust filtration. Carpet C-III.A,B,C noise; dust accumulation; floor to reduce noise, reduco -

perception of room as glare, and improve operator

" bright". comfort and morale.

21. Indicator Light Test: major- Daily bulb inspection and re- III-D.2.d u Ity of pushbutton and placement schedule will provide C-III.B.3 m indicator lights do not improved indicator reliability.

include test feature. (See 7 also).

(annunciators control rod drives, and turbine controls

• do have a lamp test feature.).

22. Non-Punctional Instrument Provido annunciators to identify III-C.10 Detection: no unambiguous when power supply is lost and B-II.A.4 means to distinguish failed include distinctive scale marks -

instruments. at " meter zero".

Findincs Recommended Action -

Ref. Section

23. Circuit Breakers for Emergency Arrange breaker pump A together, F-1 Feedpumps: confusingly arrang- breakers for pump B together.

ed.

24. Three Button Controlled Motor Rearrange pushbuttons to put stop F-2

' Operated Valves: reversing button in center, provide spring ilirection withot t using stop loaded covers for open and close button causes loss of valve pushbuttons.

control. .

25. Reactor Coolant Temperature Rearrange meters and selectors. F-3

' and I.T Displayu and Selectors:

y confusing arrangement.

8 26. Source and Intermediate Range Arrange intermediate range dis- F-4 Neutron Level and Hate Dis- plays the same as source range plays: d'Ifferent arrangements displays, of similar variables.

27. No.1 Seal and Labyrinth Ap Arrange No.1 seal Ap displays for F-5 Displays for Reactor Coolant all pumps together; likewise Pumps: confusing dual scale labyr'inth Ap's.

meters. .

28. Filter Ap Displays for Reactor Interchange. F-6 Coolaat Pump Seals: Return Ap proceeds injection Ap.

29. ESAS Dvoacs, Roset, Enable Clarify labels. F-7 and Defeat Pushbutton Label-ing: confusing terminoEgy. .

e e

l Recommended Action -

Ref. Section Findines Improve labeling. F-8

30. ESAS Manual Actuation Push-button Labeling: consequences of operating the pushbutton ,

unclear.

Relabel switch positions for each F-9

31. Selector Switch for Mini-Meters on ICS Controllers : controller.

switch position terminology misleads as to actual meter ,

signal.

32. P.cactor coolant Bleed Tank Reverse handing of selector switch. F-10 Selector Switch on the LMDS Pancl: switch positions are 8 C, B7 A, while displays and u other indications are A, B, C.

Move pushbutton array next to F-ll

33. Selector I a_shbuttons for meter, by interchange with another ,

Steam Generator Startup range Level Instruments: does not display.

iET]oin the related meter.

34. Synchronizing lights: Reduce light intensity. .F-12 ,

too bright.

• Use common units, consider revers- F-13

35. Displays for LP Turbine Ex-haust Pressure and Main Con- ing sense of vacuum meter.

denser Vacuum: related dis-plays have differing units ,

and are opposite in sense.

e e

a 4

e

f e e _

\

e O

e e W

n o

i t

c e -

S -

f

• e 4 R 1

- e F -

t n e e

sa i t r

eo cp e n am o pi s

i t e c or A l o om d s n,

e or d ce n h e et m ho m t o r N c f o.

e if s y

R e eda vel odp .

mes eei Rnd s y r t G ei d l i i o t e c u e

R l a

d n n ig a e r

s s a .

g r my n e l t fl i e oa d M n n eo i e ri F l at o a s er n me o op Cso 6

3 i a tH I i; ,,

5 i

• 1 1

i i

1 t

i l

l IV i

I I

r I

\

{

1

IV. REFERENCES

1. Military Standard MIL-STD-1472B, Human Engineering Design Criteria for Military Systems, Equipment and Facilities, 31 December 1974, Department of Defense, Washington, D.C. 20301.

2. T. B. Malone, M. Kirkpatrick, K. Mallory, D. Eike, J.

H. Johnson, and R. W. Walker (The Essex Corporation),

Human Factors Evaluation of Control Room Design and Operator Performance at Three Mile Island-2, NUREG/CR-1270, January 1980, U. S. Nuclear Regulatory Commission, Washington, D.C. 20555.

3. H. P. Van Cott and R. G. Kinkade, Editors, Human Engineerino Guide to Ecuipment Design, Revised Edition, 1972, Superintencent or Documents, U. S.

Government Printing Office, Washington, D.C. 20402 Stock Number 008-051-00050-0/ Catalog Number D 4.10:EN3.

O i

I l

t I

l l

[

/

e O l

f i

).

V

\

s .

V. APPENDICES 1

A. Guidelines for Control Room Review B. Control Room Findings and Observations C. Control' Room Environmental Review D. Communications

- E. Equipment Maintenance Experience F. Supplenentary Findings O

e

,g h

_ -.A. 3

n C A

I l

t l

I 1

l l

l l

e

't

• o APPE!! DIX A GUIDELINES FOR CONTROL ROOM REVIEW

i e TMI UNIT 1 GUIDELINES FOR CONTROL ROOM REVIEW TABLE OF CONTENTS SUBJECT PAGE I. PURPOSE - - - - - - - - - - - - - - - - - - - - - 1 II. OPERATIONAL GUIDELINES -------------

2 A. Functions Performed in Control Room - - - - - 2 B. Items Provided to Operators in the Control Room --------------------

3 C. Availability of Personnel - - - - - - - - - - 4 D. Arrangement Priority ------------ 4 E. Key Process Variables - - - - - - - - - - - - 5 III. HUMAN ENGINEERING GUIDELINES ----------

7 A. General Guidelines ------------- 7 B. Guidelines for Controls - - - - - - - - - - - 10

1. Location ---------------- 10

2. Operation - - - - - - - - - - - - - - - - 10

3. Protection --------------- 11

4. Identification -------------

12

5. Maintenance - - - - - - - - - - - - - - - 12 C. Guidelines for Displays - - - - - - - - - - - 13

1. Location ----------------- 13

2. Scales ------------------ 13 i 3. Identification -------------- 14

4. Maintenance - - - - - - - - - - - - - - - - 15

5. Recorders - - - - - - - - - - - - - - - - - 15

6. CRT Displays ---------------

16 D. Overall Control Room Environment ------

17 l

l l

l i

i

s.

. c TMI UNIT 1 GUIDELINES FOR CONTROL ROOM REVIEW I. PURPOSE The purpose of these guidelines is to provide a basis upon which to evaluate the TMI Unit 1 Control Room. They are intended to assist in the identification of those aspects of the current control room which may need improvement and to provide guidance for any modifications. Where the existing control room does not follow these guidelines, it does not necessarily imply that a hardware change must be made.

Judgment on a case-by-case basis must be used. The potentially negative training aspects of changing an existing configuration, the seriousness of the potential problems, and the practicality of hardware changes must all be weighed in determining what should be done when an existing control room feature fails to meet one of these guidelines. Some hardware changes may be desirable and practical; however, in many instances the most practical way to meet the concern that the guideline addresses may well be through the use of new procedures and training which would be specifically directed at compensating for the existing configuration.

It is to be expected that future system design considerations, as well as operational considerations, will generate changes to the control room over and above those resulting from the control room review. It is intended that these guidelines would be applied to such changes to ensure that they are compatible with the overall control room design.

l l

e C II. OPERATIONAL GUIDELINES

, A. Functions Performed in Control Room The control room operators who man the main console should be provided with appropriate controls and displays to perform a set of defined functions. Controls and displays, including annunciators, which are not needed to perform those defined functions tend to divert the control room operators' attention and should not normally be provided to them. It should be an objective to move out or keep out of the control room itself those personnel, controls, and displays which are not related directly to the defined functions. In any case, those _

other functions which may be done in the control room should be arranged so that they can be done by personnel other than those manning the main console and panels without causing interference or distractions.

The functions of the control room operators manning the main consolo are defined to be the following:

1. Maintain control of the reactivity of the reactor core.

2. Maintain control of the energy production by the reactor, its transfer in the reactor coolant i system, its transfer in the steam generators to the l steam system, its transfer in the steam and feed systems, the conversion of some of it to electricity in the turbine generator, and the rejection of the remainder through the condenser and circulating water system.

l

3. Maintain an adequate inventory of thermodynamica11y and chemically suitable water in the primary (reactor coolant) system.

I

4. Maintain an adequate inventory of thermodynamically and chemically suitable water in the secondary (steam) system.

l 5. Distribute electrical power and other necessary services (such as air and cooling water) to the plant auxiliaries and control the production and the distribution of emergency electric power.

G. Maintain control of radioactive material which may be contained in any of the systems under the control room operators' control. This includes the 1

l

~

responsibility to maintain the leaktight integrity of the reactor building.

7. Maintain control of the inventory and location of fissionable material during refueling. (Fuel storage pool activities while the reactor is operating should not be the control operators' responsibility).

8. Maintain control of and complete entries in the operators' logs, procedures, and checklists.

9. Maintain administrative control of the maintenance, repair, testing, calibration, etc. in those systems under their control.

10. Initiate those fire fighting actions which are controlled from the control room, e.g., activating deluge valves, starting pumps, obtaining help in fire fighting. In addition, the operators are responsible to initiate those actions in the systems under their control which may be needed to compensate for fire damage.

The following are examples of items which should not be the responsibility of the control room operators' manning the main console or panels:

1. Security or access control except access which may affect the leaktight integrity of the reactor building.

~

2. Communications not directly related to their responsibilities.

3. Routine Operation of the liquid waste disposal system.

4. Routine chemical control in support systems.

5. Control of fissionable material external to th'e i

reactor when the reactor is operating, B. Items Provided to Ooerators in the Control Room The controls and displays presented directly to the control room operators manning.the main console and panels, i.e. those directly visible to them when they are at their normal stations, should be limited to those for which a clearly defined need can be established.

Additional guidelines which may be applicable to the location of controls and displays in the control room l are:

's e

1. A control or display may have to be located in the control room if its location elsewhere would not l

permit its use in a timely manner.

i 2. A control may have to be located in the control room if the only location for the displays needed to operate the control is also in the control room.

3. A control or display used only for' test purposes or only for certain planned plant evolutions may have i to be located in the control room if it involves the use of other controls or displays which are located only in the control room.

Note that these guidelines may not require the controls and displays be located so that they are presented directly to the operators stationed at the console.

C. Availability of Personnel The control room arrangement shall be such that any anticipated off-normal operational evolution can be effectively carried out in the short term with the personnel complement present for the normal evolution then underway. Specifically, the response to off-normal conditions may not assume that any more personnel are available for the first ten minutes than would normally be present in the control room when the initiating event occurs. After this time, other on-site personnel can be assumed to be available if they have no other duties in the event. After two hours off-site personnel who are ,

on call can be assumed to be available. <

^

f l D. Arranaement Priority The control room and panel arrangements should provide, i

in a convenient manner, those controls and displays which are needed for normal planned plant evolutions and steady state operation (plant startup and planned shutdown, steady state power, hot standby, and refueling); however, higher priority for arrangement should be given to the controls and displays which are involved with the operators carrying out their assigned l

responsibilities under those off-normal conditions which are both highly likely and which require timely action. These events include:

i o

1. Reactor and turbine trip;

2. Partial or complete loss of feedwater;

3. Loss of coolant accidents, particularly those from valve opening or major seal failures;

4. Partial or complete loss of control or instrumentation power or air; and

5. Overcooling accidents, particularly those from steam system valves stuck open or excessive feed.

I E. Key Process Variables In addition to the displays provided specifically to achieve redundancy of some information provided to the operators, it should be an objective to provide the operators with the means necessary qualitatively to confirm the reasonableness of the information they are precented on certain key process variables. These means should preferably be diverse from the normally used displays.

These key process variables fall into three general categories: reactor reactivity balance, reactor coolant conditions, and steam system conditions. They include 4

such specific items as:

1. Reactor Reactivity

• When critical, the operators should have the process

! variables necessary to assess whether the reactivity contributions of the following are in the expected relationship: tod pcsition, boron concentration, power level, coolant temperature, and prior operating I

history.

• When subcritical, the operators should have the process variables necessary to assess the shutdown margin of the reactor and whether the- following are in the expected relationship: rod position, boron concentration, coolant temperature, prior operating history, and neutron level.

2. Reactor Coolant Conditions

• Inventory of reactor coolant (pressurizer level)

1

\ b O I

i

• Thermodynamic state of coolant (temperature and pressure)

Coolant flow rate l Radioactivity in coolant

3. Steam System Conditions Inventory of secondary coolant (hotwell, steam i generator, heater shell, and drain tank levels)

Steam pressure Feedwater flow i

Radioactivity in steam 4

h f

l I

4 e

f I

~

i I

i f

r -~v,,e,- ,wes e-- , ~ - , - - - ~ ~

. o III. HUMAN ENGIN _ orlING GUIDELINES The guidelines for the human engineering review of the TMI Unit 1 C' trol Room will be those contained in MIL-STD-1472B, Human .gtneerina Design Criteria for Military Systems, Equioment and Facilities, wnere they are applicable. Since the military standard is directed toward military applications and covers types of equipment which are not in the control room, some parts of it are inappropriate. The guidelines listed below are those which are particularly important to the control room review, amplified and clarified for direct application to the control room. It is recognized that in the course of the review, situations may be encountered which are not adequately addressed by MIL-STD-1472B and the guidelines included below. In such cases other human engineering references may be consulted, for example:

• Van Cott, H.P. and Kinkade, R.G., Human Engineerina Guide to Equicment Design, Government Printing Office, 1972.

• Woodson, Wesley E. and Conover, Donald W., Human Engineering Guide for Equicment Design, University of California Press, 1964.

A. General Guidelines

1. The controls and displays should have compatible locaticns, that is:

Where timely operator action may be needed, the sources of information from which the operator coacludes that he needs to take action, and that action is permissiole, should be located close to where the control action is taken.

• When a control action is taken, the operator who

! takes the action should have immediate feedback that the controlled element has responded and, if practical, that the plant or system itself has responded. This usually involves the location of the related displays close to where the control action is taken.

2. Consistent and unambiguous methods should be provided to inform the operators of the operational status, e.g., open or closed valve position, and of the conditions, e.g., temperatures or flow, in those systems under their control. Likewise, status and conditions in other systems in the plant which could affect the action the operators may take should be provided in a consistent and unambiguous manner.

3. Where a control or display is intended to provide information to the operators as to whether conditions are "off-normal," this should be done in a consistent and unambiguous manner. This should include consideratior of what conditions are to be defined as

" normal" in a particular system as well as avoiding confusion between indicating status (see item A. 3, above) anu b dicating " normal" or "off-normal."

4. There should be some means for the operator to know that a control or display is not functioning p.operly. It is particularly important to know when a display or control has lost power. The most desirable situation would be to have the malfunction evident to the operators without any action on their part, e.g., by having a unique " cower lost position" for a meter. This may be impract:~al. If so, other ways to make the operator aware of iailures may have to be used, such as:

Providing means for periodic testing of a control or display, Providing the operator with inmediate feedback (see A. l. above) , or Providing redundant or diverse displays which allow cross checking.

For some critical items it may be appropriate to utilize several ways to make the operators aware of malfunctions and to provide them with special training and guidance in the procedures.

5. Communicatino of a control. room operator with an auxiliary operator outsi6e the control room shall be considered the same as cperating a control or reading a display. These communications should not require the use of commun' ation links which may involve l interference or may be unavailable because of other activities. The communications should consider the potential for unusual environmental conditions:

noise, respirators, etc. Voice communications should be carried out in a formal and consistent manner which identifies the initiator and receiver of the message and provides for repetition and confirmation of each transmission.

6. Tag-out of a control or display should:

Be unambiguous as to which control or display is tagged, Not obscure the identification of the control or display which is tagged, and Not obscure any other control's or displays or interfere with operations.

7. For any changes to the console and panels, replacement and servicing should be considered. In that case such guidelines on maintainability as the following should be applied:

Replacement and servicing should not require the removal of other items on the panel.

Replacement or servicing of an item should not involve operations which preclude proper operator response to a plausible off-normal event. This includes putting an excessive number of other items out of service in order to perform the maintenance.

Replacement should involve a minimum risk-of improper reconnection.

Replacement or servicing should involve a minimum risk to personnel.

Replacement or servicing should involve a minimun risk of inadvertent actuation of other controls.

If some specific problems with maintenance has been experienced in the TMI-l control room, these should be considered in the control room review.

8. The capabilities required of the operators to perform the assigned functions should be reasonable in terms of work load, span of mental concentration, physical endurance, amount of memorization, and time available to perform a function. The assigned functions should be consistent with the physical capabilities required of the operators.

9. Changes to existing arrancements should be sufficiently distinct that when an operator uses the new control or display it is unlikely that previous a training and habits will cause errors. Consideration should be given to using completely different types i

l

. o of controls in such applications, for example, using pushbuttons in place of a rotary switch rather than changing the direction of rotation of the rotary switch.

B. Guidelines for Controls

1. Location

a. The most often used controls should be given priority in location, except where this would conflict with the use of controls or displays for off-normal conditions.

b. Controls for off-normal conditions should be placed in a readily accessible location but clearly distinguished from controls used for normal conditions.

c. The progression of controls, numerically or alphabetically, should be consistent throughout the panel. It is preferred that they progresc left-to-right and top-to-bottom.

d. All controls for multiple elements should have the same arrangement, that is, either horizon.tal or vertical,

e. If controls are operated in sequence, they should be located in a consistent left-to-right or top-to-bottom progressicn.

f. Where multiple controls affect the same element, e.g., valve control pushbuttons, their relationship should be consistent and readily apparent to the operator without detail comparison of the legends.

i g. Mirror image groups of controls should not ba l used.

2. Operation

a. The control should be capable of operation

without special aids for the operator, e.g., a j stool, screw driver, or special tools, except l

where required to prevent inadvertent actuation.

b. The forces and motions required to actuate the control must be within the capabilities of all the plant operators.

l - 10

m 0

c. The direction of operation should follow a consistent set of conventions, for example:

• Rotary valve controls should rotate clockwise to close the valve. .

• Pushbutton valve operators should have the "open" button on top, if vertically arranged; if horizontally arranged, the "open" button

l. should be on the right, i

• Rotary controls for circuit breakers and electrical motors, (except valve operators) should rotate clockwise to turn the item "on,"

i.e.. close a breaker or start a motor.

• The " Auto" position of a rotary control should be a consistent direction of rotation.

• "On" or " start" pushbuttons should be above the "stop" pushbuttons.

• Rotary controllers should rotate clockwise to increase the controlled quantity.

d. The direction of motion of the controller should be consistent with the direction of motion of the display whic.. responds to the control.

e. Key operated controls should follow a standard set of conventions, e.g., detents oriented upward and slot vertical is the condition with the key removed.

3. Protection

a. Adequate distance between controls and between groups of controls to allow the 07erator casily to recognize the controls and to avoid inadvertent actuation should be provided,

b. Controls which may be confused and which have serious consequences if actuated, should be protected or special steps taken to highlight or distinguish them. This may include such means as covern, separate handles, the use of two hand 3 to operate, or key operated controls,

c. Controls which may be inadvertently actuated by clothing, cleaning operations, etc., should be relocated or protected.

._ y

. o

4. Identification

a. Each control should be positively identified with both a descriptive name and a particular i identifying number for the controlled element.

b. Nomenclature should be consistent with that used in the procedures and system diagrams and that on related displays.

t

c. Legend plates should be located over the control to which they apply. If this cannot be done, some special visual clue of the unusual relation should be provided to the operator.

d. Where special precautions apply to the operation of a control this should be clearly stated and it should be clear to what control (s) they apply,

c. Legend plates on controls should meet consistent standards of letter size.

f. Legend plates on controls should meet consistent standards of durability. Temporary label plates should not be used.

g. The color of legend plates should conform to a i consistent code, for example:

r Identification labels should be black letters on a white background.

Precaution labels should be red with white letters.

Information of a reference nature for the assistance of the operator should be white letters on a black background.

5. Maintenance

a. All light bulbs should be commonly stocked types and should be replaceable from the front of the panel without special tools and without risk of inadvertent actuation of the control.

l l

l l

l l

t C. Guidelines for Disolays

1. Location

a. The display should be located properly with respect to its related controls. (See Criterion II.A.l.).

~

b. The orientation of multiple displays should be consistent with normal conventions for progression of numerical or alphabetical quantities, i.e., top-to-bottom or left-to-right.

c. The orientation (horizontal or vertical) of an

array of displays should be consistent with the orientation of related controls.

d. The operation of the control related to a 11 splay should not obscure the display.

2. Scales l a. The graduations on a scale should be consistent with the resolution required by the operator.

b. The scale range should be adequate for all normal and off-normal conditions under which the display 1

is required.

c. The major scale divisions should be a usual numerical progression. Scale multipliers should be avoided, but where used should be in a consistent location and easily read. Only multiples of 10 should be used.

d. The units of the scales should be consistent betacen rate and integral displays for related items. For example, all the flows into or out of a tank should be provided in consistent units of volume and time and the tank contents should be displayed in units which are consistent with the units of the flows.

e. Where multiple displays are provided of the same parameter, e.g., wide and narrow ranges, these instruments should have consistent scale units and consistent zero points. For example, steam generator start-up, operating and wide-range 2 level instruments could all be referenced from the top of the lower tube sheet as "zero".

f. The arrangement and scale design of multiple i displays should involve a minimum risk of (

confusing the readings, e.g., erroneously matching the pointer on one instrument with the f scale on another.

. 3. Identification

a. Each display should be identified with both a descriptive name and, where applicable, an identifying number which relates the indication l unambiguously to a particular instrument or sensor.

b. The nomenclature should be consistent with ' hat used in the procedures and system diagrams aad that on related controls.

c. Legend plates should normally be located over the display to which they apply. If this cannot be done, some special visual clue of the unusual relation should be provided to the operator,

d. If the limits or set points of the displayed variable are needed by the operator when the display is used, then they should be presented in a clear and unambiguous manner. It is particolarly important that memorization of numbers by the operators be minimized. The method of identifying set points and limits should be consistent among the displays,

c. Legend plates on displays should meet consistent standards of letter size. Note that if the display is intended to be read from a distance longer than normal, the size of lettering may need to be increased above that normally provided.

f. Temporary label plates should not be used,

g. The color of the legend plates used on displays should follow the same general rules as for controls (see B. 4.g. ) .

h. Where colors are used as an integral part of the information displayed, a consistent coding should be used. Color codes may include:

• Red to show that a component, usually a motor, or breaker-is "on" or energized.

, e

' Green to show that a component, usually a motor or breaker, is "off" or de-energized.

A yellow display to indicate that a system is in a transitional condition or that a

" bypassed" condition exists.

A white display to indicate a status condition.

4. Maintenance

a. Replacement of bulbs should take place '_om the front of the panels and all light bulbs should be commonly stocked types. Special tools should not be required,

b. The risk that a display will be reassembled in such a manner that it gives erroneous information, for example, by switching lighted windous, should be minimized.

5. Recorders

a. A recorder should meet the same requirements for visibility, scales, units, etc., as any other display.

b. Where multipoint or multi-pen recorders are used, the recorded data should be unambiguous.

c. When different inputs can be selected for the same recorder, switching transients should not be such that they can be mistaken for signal changes.

d. When different inputs can be selected for presentation there should be some positive way to determine what specific input the trace

, represents.

l

! e. The amount of the recorded trace which is visibic should be adequately long to cover the time span of interest to the operators. Reference to portions of the trace which are not visible

! should not involve blocking other critical displays or controls or risking inadvertent actuation of controls,

f. The recorder should provide for a tolerance on the timing for changing paper or ink of at least two hours. That is, chart paper and ink should I --_ --

. a be replenished when there is at least two hours of recording left. This is to insure that if an emergency evolution takes place there will be at least a two hour capability to follow it without servicing the recorder.

g. It is preferable for charts to have time as the horizontal coordinate increasing to the right.

h. Changing chart paper or ink should require a minim >m of time and should not block other critical controls or displays.

G. CRT Displays

a. A CRT display should not be used simply to repeat information already available to the operator from other console or panel displays.

b. The loss of any CRT display or other single failure in the associated hardware (power supplies, computer, keyboards, etc.) should not preclude the performance of an emergency procedure.

c. Information orientation and zones, titles, label locations and parameter locations should be standardized. Standard sets of characters, symbols, and abbreviations should be used.

d. Color assignments should be consistent from display-to-display and should be consistent with color conventions used on the console and panels.

i

e. Mimic displays should be oriented from left-to-right or top-to-bottom unless this conflicts with t

existing panel mimics or the arrangements of items on the panels. Procedures steps or decision " trees" should be oriented from top-to-bottom. Time'should be displayed from left-to-right.

l f. Each display should have a descriptive title.

This title should be in a consistent location and I have a consistent color and format.

g. Display characters should be selected from a standard set (such as ASCII). The height should be 0.20 to 0.25 inch. The height to width ratio should be 1:1 to 3:2. The stroke width should be l one-sixth of the character width. Capital letters should be used, i

j o ,

1

h. The display loading (text and graphical content) i should be limited to about 25 percent, excluding the title and any alarm notes,

i. The refresh rate of the displays should be 60 Hz or more.

D. Overall Control Room Environment The overall control room environment should be suitable i for the operators to carry out their required functions. This includes consideration of the following:

r j 1. Adequate temperature

• and humidity

• control should be provided.

2. Adequate ventilation

• should be provided.

2

3. Adequate lighting

• should be provided for both normal I and emergency conditions. In an emergency, lighting l should be provided even in the event of temporary failure of the diesel generators to start.

4. The noise level

• should be adequately low. There should not be conditions in the plant operation which result in large changes in noise level.

! 5. There should be adequate provision for the control of 4 traffic in the control room and accommodating i visitors or observers without adversely affecting .

, operations.

3

6. There should be adequate provision for the storage of

personal items.

7. There should be adequate workspace for the operators i to use reference material and to support any on-the job training.

8. There should be adequate provisions for storage and use of the following without blocking access to any controls or displays:

i l

l P

• ttIL-STD-1472B values should be used as a basis for judging adequacy of these conditions.

1 L

O e

a. Procedures

b. Manuals

c. Diagram and Drawings

d. Logs

e. Personnel Rosters

f. Other files

9. There should be direct and defined access to the supervisor's office.

10. There should be adequate rest room and kitchen facilities.

11. There should be adequate and defined access for maintenance of the control room equipment including availability of technicians, tools, and spares.

12. There should be adequate access from the control room to the remainder of the plant.

13. The control room and its associated spaces should contain adequate provisions for communications. This includes particular consideration of the following:

• Means for paging in the rest rooms, kitchen and any other associated spaces should be provided.

l

• Communication facilities should be provided for the shift supervisor, shift foreman, and other personnel in the control room so that they do not i

interfere with or confuse the communication links used by the operators on the main console and panels.

15. The control room should be free of personnel hazards I

such as: Items which could trip the operators, sources of electric shocks, etc.

16. There should be adequate safeguards on the systems which control temperature and ventilation so that, in case of failures in these systems, proper working I

conditions can be re-established before excessive l deterioration occurs.

I l

I l

l l

l l

W 9 4 B

O r

APPENDIX B CONTROL ROOM FINDINGS AND OBSERVATIONS I

I L.

e a CONTROL ROOM FINDINGS AND OBSERVATIONS TABLE OF CONTENTS _

SUBJECT PAGE I. OPERATIONAL FINDINGS - - - - - - - - - - - - - - - - 1 A. Functions Performed in the Control Room ---- 1

1. Control of Reactor Core Reactivity - - - - - 1

2. Control of Energy Flow - - - - - - - - - - - 2 i

3. Reactor Coolant Inventory, Thermodynamic State and Chemistry ------------ 8

4. Secondary System Inventory, Thermodynamic State and Chemistry ------------ 10

5. Distribution of Electrical Power and Other Services - - - - - - - - - - - - - - - 11 B. Controls and Displays Provided to Operators in the Control Room -------------- 13 C. Availability of Personnel ----------- 14 D. Arrangement Priority - - - - - - - - - - - - - - 16 II. HU:iAN ENGINEERING ----------------- 18 A. General -------------------- 18

1. Control / Display Relationships ------- 18

2. Operational Status of Valves, Pumps, etc. -

18

3. Normal, Off-Normal Codes - - - - - - - - - - 19

4. Detection of Non-Functional Instruments and Controls - - - - - - - - - - - - - - - - 19

5. Control Room Communication - - - - - - - - - 19

6. Tag-out of Controls and Displays - - - - - - 20

7. Maintainability of Replacement Hardware --

20

8. Physical and Mental Capabilities of Operato.s 20

9. Distinction Between Revised Control Arrange-ments and Existing Control Arrangements --

21 D. Controls - - - - - - - - - - - - - - - - - - - - 21

1. Location - - - - - - - - - - - - - - - - - - 21

2. Operation ----------------- 22

3. Protection - - - - - - - - - - - - - - - - - 23

4. Identification - - - - - - - - - - - - - - - .

5. Maintenance ------------'--- 24 C. Displays - - - - - - - - - - - - - - - - - - - - 24

1. Location - - - - - - - - - - - - - - - - - - 24

2. Scales - - - - - - - - - - - - - - - - - - - 24

3. Identification - - - - - - - - - - - - - - - 25

4. Maintenance ---------------- 26

5. Recorders ----------------- 26

6. CRT Displays - - - - - - - - - - - - - - - - 27

o o LIST OF FIGURES PAGE Control Room Arrangement - - - - - - - - - - 28 FIGURE 1 I

1 I

1 i

i

I CONTROL ROOM i FINDINGS AND OBSERVATIONS i

l

! The purpose of this Appendix is to summarize the findings of the j . Review Team, relative to the TMI Unit 1 control room.

The findings follow the outline of the guidelines used to evaluate i the control room. These guidelines have been included in this

report as Appendix A. For a general layout of the control room in plan, as well as individual p&r.c' and console designations, refer to Figure 1 at the end of this section.

i I. Operational Findings A. Functions Performed in the Control Room i

l. Control of Reactor Core Reactivity.

't l

The controls and displays associated with the control j of reactivity are, in general, logically grouped for both normal and off-normal operations.

J l Specifically, the short term reactivity controls--the i

in-hold-out switch, the group and rod selector switches, and the pushbuttons associated with modo selection for the rod control--bear a satisfactory

relationship to the displays which feed back the

! results of their usa. The displays include rod group I position indication for immediate feedback, reactor

flux level (i.e., neutron power) and its rate of j

change (during startup evolutions) for short term feedback, and reactor coolant average temperature for longer term feedback.

The reactivity changes brought about by changes in boric acid concentration when the reactor core is critical are fed back to the operator via observed changes in rod position. When the reactor core is I subcritical (rods fully inserted) - this feedback does

! not exist and the control becomes administrative. In

' this situation, predictions of concentration are calculated, based on the boric acid concentration in the water to be' injected and the concentration in the coolant prior to injection. .The initial concentrations are based on analyses of grab samples l by the plant chemist.

i I

s a Confirmation that the desired concentration has been achieved is likewise based on grab samples. This situation is not essentially different from most Phas; instruments to measure boric acid concentration on-line have not been particularly reliable or accurate. The need for careful administrative control of water additions and for confirmed analyses of boric l

' acid concentration is clear. No specific changes to

! present practices are recommended.

Following refueling, when rod drive mechanisms are electrically disconnected, correct electrical i

connections of control rod power and position indicators must be confirmed. With the current system of displaying relative (secondary standard) and absolute (primary standard) indications of individual rod position, this evolution is time consuming and awkward. It involves use of indications and controls at backpanel PC, console section CC, the operator's computer console (see Figure 1) , and the rod control i panels in the cable spreading room below the main control room. The present operation does not

' constitute a risk to the safety of plant, equipment,

, or operations. However, by presenting a consolidated position display on a CRT visible to the operator at CC, significant time (several hours) could be saved in each post-refueling startup.

l l

2. Control of Enerov Flow.

When the unit is operating at power, the normal control of the flow of energy -- from the reactor through the reactor coolant system, steam generators, and steam system to the turbine generator and l condenser -- is automatic. The controls and displays l

required to monitor the automatic operation of the systems which control energy flow are grouped l

sensibly. Controls are arrayed from the center of l

console CC leftward to and including CL. The control l systems include:

1 l

a. Reactor power (neutron flux)

6. Total steam generator power

c. Individual steam gencrator power fraction

_2_

s s i

d. Feed pump discharge pressure / steam generator pressure difference

e. Steam turbine power / speed

f. Generator power-factor / voltage Additional controls and displays are necessary for control of energy flow during shutdown. These are discussed in later paragraphs.

For effective control of the electric power produced by the unit, the energy flow must be brought into equilibrium at a desired rate. In addition, the time history of energy flow must be such that the desired amount of energy is stored in the reactor coolant and in the steam system (that is, the reactor coolant must be at the desired te:aperature and the steam must be at the desired pressure). To accomplish these functions, the automatic control (and the operator, if he is manually controlling the unit) must be able to measure variables indicative of both the energy flow rate and the stored energy level. The way this is done in TMI-1, and the review team's observations, where portinent, are outlined in the paragraphs which follow. The emphasis of the discussion is on the manual control of each system since the relationship between controls and displays is of greatest importance in this mode. However, the discussion also provides insight on the adequacy of the displays, and control indicators from the standpoint of monitoring the operation of the various automatic control subloops. These relationships are also important since the control subloops normally operate in automatic.

Reactor Power Control Reactor power, as measured by neutron flux, is displayed both in digital and analog format near the center of console CC; as discussed in section 1 above, the location of displays is satisfactory.

Total Steam Generator Power Control Steam generator power (or more precisely the capability of the steam gene:ators to produce power) is proportional to total feedwater flow. This total is not measured or displayed but individual feodwater flows to each steam generator are displayed. These displays together are considered an adequate indication of total steam generator power capacity.

j

e >

They are side-by-side toward the lefthand end of console CC. Regarding location, the feedwater displays are satisfactory.

Reactor Power / Steam Generator Power Dynamic Eneray_

Balance The stored energy of the reactor coolant system is inferred by measuring reactor coolant average temperature. A digital display of this parameter is at the center of console CC. The rate of change of average temperature is also important since it is a measure of the mismatch in reactor power and steam generator power. A recorder displaying average temperature, from which such information could, in concept, be obtained is logically located on CC, between the reactor power and feedflow (steam generator power) information. However, because of a poor choice of the length of time displayed and because of a very slow chart speed, good rate of change information cannot be obtained from the present recorder. The review team recommends that a revised (faster) recorder speed for the average temperature recorder, or other means to display average temperature rate, be implemented.

Steam Generator Power Fraction The power fraction for each steam generator relative to the other is inferred from the difference in coolant temperature at the outlet of each steam generator. This variable, delta-Tc, is displayed on console CC (left) appropriately located above individual feedwater flow controls, and the controller which normally apportions the demand signal to these controls.

Individual Steam Generator Dvnamic Enerav Balance The control strategy and procedures for manually controlling the once through steam generator. energy balance do not appear to have been adequately _ defined, and operators sufficently trained, to achieve effective plant operation in this mode (a very brief procedure is included as an appendix to the Integrated l Control System operating procedure *). Fortunately, i

i i

• OP 1105-4 i

l l l

l l i i

t

s ,

the automatic control has been generally reliable.

Nevertheless, the review te:im considers that an effective manual control procedure for the once through steam generators is highly desirable from a plant availability viewpoint.

Effective manual control of the steam generator energy balance at power requires knowledge of the mass flow out of and into the steam generator (to anticipate ar.d

! avoid large energy imbalances) and some measure of tSe energy stored. The energy flow rate out of the steam l

generators to the steam turbine is not directly measured on TMI Unit 1. The automatic control system is structured such that the steam flow information is '

not required for effective operation. It should be noted that the main turbine first stage pressure is an -

effective inferential indication of total steam flow. This parameter is measured for purposes of turbine control, but not displayed on the console.

With respect to the energy stored in a once through steam generator this energy may be inferred from steam pressure. This variable is displayed to the operator on console CC but he does not appear to have been trained in effective use of it.

The remaining variable of importance to-the once-th;ough steam generator dynamic energy is the mass flow into the secondary side--the feedwater flow. As indicated above, the controls and displays associated with feedwater flow are satisfactorily grouped on console CC. But discussions with the operators

~

indicate that there may be a problem with these controls, as they relate to the once through steam generator. This additional difficulty is the rapid stroke time (6-10 seconds) of the feedwater regulating valves. A short actuation of the master flow control switch can result in a significant imbalance in feed and steam flow. This is sufficient to produce a relatively rapid, and accelerating, change in stored energy in the reactor coolant system. The attendant change in volume changes reactor pressure dramatically. The operator is thus forced to concern himself not only with the steam generator variables but the reactor variables as well.

The general subject of effective manual control of the once through steam generators a' power should be studied in depth. The product of this study would be an effective manual control strategy, the displays required for it, and the procedures and training '

required to put it into effect.

o .

Feedoumo Discharce Pressure / Steam Generator Pressure Difference Control To provide satisfactory control of water flow to each once through steam generator by each feedwater regulating valve, the difference between feedpump discharge pressure and steam generator pressure is controlled. This control is accomplished by controlling the speed of the feedpump drive turbines. The controls for turbine speed for each of the two feedpumps are grouped along with associated displays on console CL (with the controls for the remainder of the condensate system). Although this location is eight or so feet from the remainder of the steam generator controls, the walkthroughs indicated that the separation is not a serious hardship.

It should be noted that the controls for the two feedpumps are in a mirror-image arrangement. But, as noted elsewhere in this Appendix, this arrangement appears less likely to lead to mistakes than any feasible alternative.

Steam Turbine Power-Sneed Controls for the main steam turbine stop valves and control valves are located, along with associated displays on console CL (right hand end). These displays and controls are in two prepackaged assemblies, provided by the turbine vendor. The general arrangement is satisfactory, although labeling is, in some instances, obscure.

Electrical Power Control The controls and displays for electrical energy flow from the generator (used when the unit is at power) are appropriately clustered on CL. Nomenclature, interlocks, and controls traditional to the power industry are used. It should be noted that the automatic and manual positions for the generator voltage control selector (manual for manual excitation control and automatic for voltage regulator control) are opposite the auto / manual positions of most other selectors on the console. However, because the selection of automatic or manual voltage control is a deliberate, visually confirmed, and isolated action, and because an attempt to turn the switch in the wrong direction will be resisted by the switch detent, this deficiency is not considered serious enough to warrant modification.

Energy Balance Control with the Reactor Subcritical Control of the energy flow when the plant is subcritical (i.e., shutdown) involves:

(1) Control of steam flow from, and inventory of, the once through steam generators, until a coolant temperature of about 250 *F is reached.

(2) Control of the rate of energy removal via the decay heat system at temperatures below 250 'F.

Generally, the information necessary to perform each of these functions is presented in the control room at logical locations. However, specific deficiencies were found as follows:

(1) The desired steam generator level during cooldown is near the top of the range (97%) of the display used by the operator for its control (manual control is employed during these evolutions). The acceptable band for the variables is +3, -2% of range (equivalent to about +7 and -3 inches of height). The resulting manual control task is arduous and requires continuous attention. The widerrange level indicator could be used in conjunction with a wider control band (about + 20 inches),

and a different set point to solve this problem. Although this instrument is not presently temperature compensated, its use, even with manual temperature compensation would be superior to the present control scheme.

(2) The energy removal rate of the decay heat system is controlled by bypassing closed cooling water around the decay heat closed cooling heat exchanger. To perform this function, inlet and r bypass valves are controlled by manual (air) loading controls at a location remote from the l control room. It is understood to be a very l coarse control. The temperature information necessary to controlling the flow is read out in the control room. The result is an awkward, i oscillatory control system involving two l

operators and a telephone link. This situation should be remedied by adding appropriate valve controls to the control room console, or alternately, providing appropriate displays and improved controls at the local station.

l

3. Reactor Coolant Inver. tory, Thermodynamic State and Chemistry For effective control of the volume of liquid water in the reactor coolant system, the operator requires information not only about the volume of wa or in the coolant system itcelf, but also about the volume of water in storage tar.Ps, which may be transferred to, or has been transferred from, the coolant system. In addition, to detect and then act effectively in off-normal situations, informction on the volume of water in locations to which coolant can leak, such as the reactor building sump and the reactor coolant drain tank, is needed.

Effective control also requires knowledge of the flow rates of coolant between storage tanks and coolant system, and through defined leakage paths such as relief valve discharges.

The displays necessary for the control of the reactor coolant inventory in the short term -- pressurizer and makeup tank levels, and makeup and seal injection flows -- are visible from the control room operator's normal station at console CC. During normal operation, the controls which he exercises in connection with these displays are the pump switches, valve pushbuttons, and level controllers for the makeup pumps, seal injection flow, makeup flow and letdown flow. These are likewise clustered on console CC. Exceptions are the controls for makeup pump 1C and for certain high pressure injection block valves. Alternate controls for makeup pump 1B are also not on CC. These controls are on console CR, which location was chosen to comply with the regulatory requirements for electrical separation of safety related components, as interpreted at the time Unit 1 was designed.

The location of the controls for makeup pump 1C and associated valving is considered undesirable from the human factors viewpoint. The concern is that an operator, in endeavoring to start makeup pump 'C, will activate a similarly configured adjacent control, or vice versa. In addition, there is a risk that in starting pump 1C he will fail to open the <

suction valves for that pump. These shortcomings may )

be mitigated by effective labeling and demarcating of controls, but will not be entirely eliminated.  ;

Operator training will be necessary (and has been  !

used in the past) to guard against incorrect operation of pump 1C.

l

The displays necessary for long-term coolant control such as water levels in bleed tanks A, B, and C, and for quantitative assessment of off-normal situations, such as reactor building sump level and reactor coolant drain tank level are dispersed throughout the control room. The location of the bleed tank levels (on the LWDS panel) is considered acceptable. These instruments are used during deliberate operational evolutions such as heatup and cooldown; when the operator needs information, he can walk over and get it.

With regard to the information necessary to detect and assess any off-normal reactor coolant inventory situation brought about by a leak, the alerting function is effectively fulfilled by the main annunciator system. A breach of reactor coolant system integrity -- by a rupture of any size in a pressure boundary or an unintentionally opened or leaking valve -- will manifest itself in a change in one or more of the following:

• A change in water level in the reactor building sump and/or reactor building pressure and, possibly, an increase in activity levels as detected by the reactor building airborne activity monitor or An increase in reactor coolant drain tank level, or

• An increase in steam Evstem inventory as evidenced by an increase in steam generator water level, or c~;ndensate water storage tank level, or an in:: ease in airborne activity in the discharge of the main air ejectors, or

• An increase in the liquid level in the intermediate cooling system surge tank or in the decay heat closed cooling susge tank.

Each of the above variables is alarmed by the main annunciator system at a location immediately visible to the operator at console CC. Furthermore, the walk-throughs indicated that operators are aware of locations of analog indicators needed to make a quantitative assessment of leaks. It is considered that the present location of displays as. required for coolant volume inventory is satisfactory. If CRT type displays of computer stored information are

-9_

utilized in the future to supplement current hard wired indicators, a consolidated inventory display should be included.

The thermodynamic state of reactor coolant is currently inferred from the pressure at the reactor vessel outlet and from the temperatures of hot and cold leg coolant. This information will be supplemented in the near future by addition of a subcooling display. The consolidated display of the reactor coolant thermodynamic conditions is considered sufficiently important to highlight. Such a consolidated display is recommended.

The chemistry of the reactor coolant is controlled administratively by sampling the water ir. the coolant system itself, and by the various tanks from which makeup is pumped. No changes are recc.nmended to the current practice.

4. Secondary System Inventory, Thermod/namic State and Chemistrv The total water inventory of the steam, feed, and condensate systems resides principally in the following locations:

Condenser hotwell The 6th stage heater drain tank Condensate water storage tanks Steam generators

• The shells of 4th, 8th, 10th, and 12th stage heaters The piping of the feed and drain systems Negligible mass is stored as steam in the extraction and main steam piping systems.

During normal operations, mass is shifted among the above locations, particularly among the condensate water storage tanks, hotwell, steam generators, ano the sixth stage heater drain tank. Analog displays of these latter inventories, in the form of level measurements, are dispersed on consoles CC (left-hand end) and CR. The control of inventory is automatic: when hotwell level rises above a preset value, condensate is dumped to the storage tanks;

\

when hotwell level drops below a preset value, water is pulled (by condenser vacuum) from the storage tanks to the hotwell, The operator is not provided with any manual controls for makeup or dumping, nor is he given the open-closed status of the automatic valves. It is considered that manual controls for makeup and dump valves are unnecessary; should the automatic control fail, time generally permits an operator to assume local manual control.

However, the absence of valve position indication, and more specifically, its history, is considered a shortcoming. From this information, makeup flow, and changes in it can be inferred. Leaks in the steam feed system are likely to start small. The first symptom of such a leak will be a continuous and abnormally high rate of makeup from storage tanks to hotwell. The control room operator does not have the information from which he could detect such a condition. The review team considers that some improvement in the secondary system inventory information, and its rate of change is warranted.

This may be accomplished by improved computer display and integration of system parameters as discussed in Section III.C.8 of the report.

( 5. Distribution of Electrical Power and Other Services l

Controls and displays for the distribution of electric power to plant machinery are generally arranged acceptably in mimics on back panel PR and on console CR.

There are, however, a number of concerns:

a. The electric system normally requires little attention--it is lined up when the plant is started up and remtins so unless an upset-in the power distribution system occurs. The result is that the operators may not be as familiar with the line-up of these controls as with other mote frequently used controls.

The use of a mimic in such situations is considered extremely desirable. The clarity of the mimic which is currently provided can be

! improved. In addition,.the operator is not provided with information on what specific loads l receive power from specific buses. In upset l

l l

situations, this information can be important.

It is considered that these deficiencies can be corrected by more effective labeling and mimicing.

b. The controls for the two vital power distribution systems, including the speed and voltage controls for standby diesel generators, are located on two separate segments of console CR. As with the makeup pump controls, the separated locations, in combination with general use of pistol grip switches, may lead to operation of an incorrect circuit breaker. Effective labeling and demarcating may partly correct this situation.

In addition, the use of different handles for pump motor controls and circuit breaker controls will help. Accordingly, such steps are recommended

c. Certain circuit breakers are interlocked with synchroscope switches; the synchroscope switch handle must be in place to open the breaker. The association between synchroscope switches and breaker switches is not clear, but could be made so by appropriate labeling and mimicing. This is recommended.

d. Ammeters are provided for certain feeders, but the association between meter and feeder is not always clear. It is believed this can be corrected by more effective mimicing. This is recommended.

e. Associative lines and labels are needed for displays related to the 480 volt buses and are recommer.ded.

f. A pair of voltmeters, along with a single synchroscope, is provided for use during all synchronizing operations. Which voltmeter reads system (running) voltage and which reads the station m chine voltage is not clear from the labelir.',. Revised labeling is recommended.

g. The " auto" and " manual" positions of the diesel generator exciter mode selector switches are opposite the auto and manual positions of many other mode selectors on the console. As with the analogous control on the main generator, the operation of these selector switches is

deliberate. Consequently, this inconsistency is probably not sufficiently serious to warrant the considerable difficulty in implementing any modification.

In general, controls and displays for cooling water services are sensibly grouped (again except where regulatory requirements for separation necessitates a less desirable grouping). It is believed effective labeling and demarcating can reduce the problem brought about by separation. In addition, the use of distinct handles for pumps versus breaker controls should help significantly. Such steps are recommended.

B. Controls and Disclavs Provided to Ooerators in the Control Room with respect to the specific displays and controls provided to the control room operators, a few specific shortcomings were noted:

1. The 1600 psi engineered safety actuation bistables are currently manually reset, by pushbuttons in the relay room (which is in the control structure below the control room). In a LOCA situationr the actuation of high pressure injection at 1600 psi is likely to reverse the decay of coolant pressure when the leak is of moderate size. If the 1600 psi ESAS bistables are not manually reset before the pressure rises above 1700 pri (the nominal set point of the reset bistable), the high pressure injection cannot be terminated in an orderly manner, i.e., the actuating bistables cannot be reset. For some leak l

scenarios, it is implausible that the centrol room

! operator will reach the bistable reset pushbuttons before pressure reaches 1700 psi. It is recommended l that this deficiency be corrected.

2. Should an operator inadvertently (or intentionally) trip makeup pump 1B, with normal system alignment, it is not possible for hin to reset the circuit breaker l

in the control room. He must go to the switchgear l cabinet in which the circuit breaker is housed f (several floors below the control room) . While the l

remaining two makeup pumps are adequate to fulfill l

emergency injection requirements, the ability to l reset the B pump breaker from the control room is I clearly desirable. This modification is recommended.

t

3. As has been discussed, the control of bypass flow around the decay heat exchanger is difficult and awkward. This can be corrected by providing controls for the inlet and b3 pass valves for the decay heat exchanger, to allow control of cooling flow from the control room, or by other modifictions described previously.

4. The fire protection system does not include a smoke or fire detector for the front of the auxiliary boiler. Depending on the size of the fire, an operator may or may not be able to get to the boiler to shut it down. This concern is being addressed by GPU.

C. Availability of Personnel Sufficient numbers of control room operators are present to perform effectively and/or supervise the operations required in both normal and off-normal evolutions. This conclusion is based on the review team's understanding of planned control room staffing, when TMI-l resumes operation. For normal operation at power, this staffing is as follows:

1. One (licensed reactor operator) control room operator (CRO) normally stationed at the console, monitoring plant operation.

2. One (licensed senior reactor operator) shift foreman, normally stationed at his desk in the controiroom or at the operator's computer console. The foreman provides additional surveillance and backs up the CRO.

3. One (licensed reactor operator) control room operator (CRO) responsible for administering the blocking and tagging of equipment to be taken out of service for maintenance or test, and for administering the removal of blocks and tags to return such equipment to service. This operator is' stationed at a desk within 30 feet of the console, and, as will be described, is in a position to assume important control responsibilities in the event of an upset such as a reactor trip.

4. An additional (licensed reactor operator) control room operator (CRO) is normally stationed in or near the control room and is available within several minutes or less, should his services be required.

l l

l l

e .

5. The shift supervisor (a licensed senior reactor operator) is normally stationed in his office adjoining the control room, but may be patrolling the plant. He is generally within several minutes of the control room, and is called upon to relieve the shift foreman if the occasion arises.

6. A shift technical advisor (a degreed engineer) is normally in, or within several minutes of, the control room.

The most limiting manning situations which arise with operation at power as an initial condition are upsets which involve significant changes in the operational status of the plant. These generally are accompanied by trips of the reactor and turbine. In these situations, effective control of reactor inventory, energy flow, and steam machinery, requires:

The CRO stationed at the console to confirm reactor shutdown and assume control of coolant inventory -- a responsibility that requires his full attention for a period of at least 5 to 10 minutes.

• The blocking and tagging CRO to leave his desk (his normal responsibilities, being administrative, can be deferred) and to assume responsibility for monitoring the safe shutdown of the turbine machinery, initiating standby lubrication systems as necessary. He also monitors the continuing operation of the feed system (i.e., the maintenance of a satisfactory steam generator energy and mass balance) and the steam system (the turbine bypass or atmospheric steam dump systems which set the cooldown rate and the temperature of the reactor coolant).

• The shift foreman oversees and backs up these operators, reading the applicable procedures aloud, and ensuring that steps are complied with. He also endeavors to detect unusual alarm conditions (though this is made difficult by the normal occurrence of 20-40 alarms in the train of a reactor and turbine trip).

If the sequence of events following the initial trip is unusual, accompanied or initiated for examp7.e by a loss of feed water, or a significant upset in the auxiliary power distribution, a third man at the console may be required (for manual control of feed flow, for example or

e .

for ensuring that one or both diesel generators start and pick up load). Until the third CRO can assume this station, this need is filled by the shift foreman.

For unusual sequences, an additional evaluation capability is also desirable, since the foreman must necessarily devote much of his time to consulting procedures and to confirming operator action. This function may be filled by the shift supervisor or shift technical advisor, or both, usually stationed at the operator's computer console. This advisor also consults the alarm printer, and reads out information from the computer.

For planned evolutions such as heatup and startup, additional manning is also required (over and above the single CRO and shift foreman formally charged with plant control during normal operation at power). However, the walk-throughs indicated that the manning levels required for these evolutions are less limiting than the off-normal evolutions.

D. Arrangement Priority The majority of controls and displays are arranged in uncluttered, logical groups. Exceptions, as noted elsewhere, are generally due to regulatory requirements, j particularly those regarding separation of redundant

! safety systems. With regard to priority of arrangements, the key is that operators be able to execute their responsibilities in off-normal situations without leaving their normal stations in front of the console.

! In general, this is the case. Control arrangements are i such that most operations can be performed by the two (or, in unusual situations, three) operators (as described in the previous section) at the console, without crossing traffic patterns. There were, however, I three specific operations which require the operators to circle behind the console, to the vertical back panels:

1. When the walk-throughs were performed, automatic isolation of letdown flow on reactor trip was l accomplisned by closure of isolation valves MU-V-2A l and 2B, Effective control of inventory in the absence of a leak will require reinstituting letdown

. flow, usually within five or ten minutes of the i trip. Reopening MU-V-2A and 2B requires operation of i switches on back panel PCR.

l l

The review team understands this situation will be corrected by utilizing the automatic closure of MU-V-3 to isolate letdown flow. MU-V-3 can be reopened by operating a pushbutton on the makeup (right-hand) section of console CC.

2. Current procedures . quire manual startup of turbine auxiliary oil pumps (to ensure adequate lubrication during coastdown) immediately following turbine trip. This operation is performed by the second (steam plant) console operator at back panel PLF. While startup of these pumps is ultimately required, the coastdown of turbine speed is normally slow enough to defer this start for at least five minutes -- that is, until energy flow and steam generator inventory have equilibrated. The review team recommends that this deferral be incorporated in the procedure.

3. If a reactor trip or a drop in reactor coolant pressure or an increase in reactor building pressure should cause initiation of one or several engineered safety features, the operator determines the status of this system by means of a lighted array on panel PCR. Should all safety features actuate, the board presents an all-blue light display.

However, should a feature f ail to actuate -(indicated by a yellow light), the operator must go to PCR to determine what feature has failed. He must make this determination to be able to take appropriate backup action. Display legends are not readable from the console.

Furthermore, with the four differing levels of engineered safety features planned for installation prior to Unit 1 restart, correct operation of a single level will be difficult to confirm by light pattern. The review team, therefore, recommends a rearrangement and relabeling of panel PCR (including so improvement in the intensity of the blue lights) that the confirmation and troubleshooting functions can be performed effectively by the operator at the console.

II. HUMAN ENGINEERING A. General

1. Control /Disolay Relationships As has been discussed, the majority of controls and displays are arranged in logical groups. However, there is no demarcation of these groups to allow the operator to easily distinguish among them. The displays associated with a particular control are both recognizable and readable from the station where the operator uses that control.

2. Operational Status c' Valves, Pumps, Circuit Breakers, etc.

TMI Unit 1 utilizes a generally consistent color code supplemented by a positional stereotype to inform the operator of the operational status.

The status color code employs red and green. It is in common use by utilities and is, unfortunately, counter to the "stop-go" stereotype these colors tend to connote. As applied at TMI Unit 1, green means off, de-energized, not flowing. The red (on, energized, f'owing) light is to the right of or above the green (c ;, etc.) light. Note that this color code results in red indicating closed for circuit breakers but open for valves (while green means the opposite).

Because the existing status color code is strongly ingrained and because it is supported by a positional stereotype, the review team does not recommend a change. However, the use of red and green color to indicate status information other than the above conditions should be eliminated. (In a few instances, for example, red and green are used currently to indicate trip and normal, or high and low speed, cespectively.)

The controls for the pressurizer heaters are somewhat misleadingly labeled. As a consequence, controls for some groups appear to be inconsistent with controls for others. This def!ciency can be corrected by improved labeling of switch positions and this is recommended, l

f

\

3. Normal, Off-Normal Codes A yellow indicator light is generally used in the TMI-l control room to connote an off-normal condition. For example, a mismatch between the demanded position and actual position of a circuit breaker is indicated by a yellow light. The use of the yellow color code should be extended to include the tripped condition (since this condition indicates a mismatch between the demanded state for the machinery and its present state). A consistent color code is not presently used for a tripped state.

As indicated previously a blue / yellow color code is used to display the status of the engineered safeguards actuation system in the event this system is called upon to operate. In this situation, the color blue is used to connote the satisfactory operation of a safeguard feature. Yellow is used to connote the failure to operate of a particular safeguard feature. The use of yellow in this case is consistent with its use elsewhere (to display the off-normal starf,. The present blue indicator lights are of ten diff: Cult to distinguish (from no light),

but it is *- iaved that improvements in light intensity will remedy this situation (see Section I.D.3 of this Appendix).

4. Detection of Non-Func"ional Instruments and Controls The TMI-l control room operator presently has no unambiguous means to distinguish between functioning and non-functioning instruments and controls. The

review team considers that this situation should be

! remedied. The following corrective actions should be considered:

addition of appropriate power supply annunciators l and indicators to allow the operator to determine i easily that a segment of his instrumentation and

! control system has lost power.

addition of distinctive midscale " meter zero" marks to all Bailey meter scales, to assist the operator in detecting a single defective meter.

j 5. Control Room Communications A limited evaluation of control room communications j was performed. Results are contained in Appendix D.

O O

6. Tag-out of Controls and Displays The review team noted the following shortcomings in the present tagging system:

• Valve labels are often engraved on the operating pushbuttons. Use of a tagout sticker on a pushbutton obscures the identification of the valve the pushbutton operates.

• 'The tags which have been used in the past at TMI-l are large and can obscure controls and displays adjacent to the tagged control.

The review team considers that the first difficulty above will be corrected by improved labeling (adjacent to, not on the pushbuttons). The review team also considers that new, smaller tags, now in use, will considerably reduce the likelihood of a tag on a specific control obscuring the adjacent displays.

7. Maintainability of P.eolacement Hardware Any specific hardware changes that are made to the control room as a result of this review shall be checked for maintainability.

8. Physical and Mental Cacabilities of Oper.ators The review team found no control operations which overtaxed the physical capabilities of the operators.

The procedural walk-throughs uncovered several areas where the present control configuration may tax the memory or concentration of operators.

The difficulties in controlling steam generators (i.e., feedwater flow) during startup and manually at power have already been mentioned.

In addition, the arrangement in rectangular arrays, of the pushbuttons required to line up the valves of the emergency feedwater system, the turbine bypass and steam dumps, and emergency feed pump turbine steam system, place an excessive burden on the operators' memory. Specifically, these arrangements require the operator to memorize.the pipe and valve arrangement and numbering for these relatively complicated systems. Since these systems are operated infrequently, and in moments of stress, such reliance on memory is considered undesirable.

e.

l The review team recommends the controls for valves mentioned above should be arranged in mimic fashion.

Existing labeling practice does not consistently list for a control or display the name and number of the associated device. This too is considered to place an excessive burden on the memory of the operator (operating procedures f requently refer only to name cut number of a display or control) . This deficiency should be corrected by improved labeling.

9. Distinction Betweer Revised Control Arrangements and Existina Control Arranaements Modifications to existing systems should comply with this guideline (to wit, the changes should be sufficiently distinctive that previous training and habits will not cause error). In this connection, walkthroughs of the new arrangements should be conducted to ensure compliance.

B. CONTROLS

1. Location The review team considers that the location of controls in the TMI-1 control room are generally in accordance with the guidelines. Often used controls such as the in-hold-out rod control switch and the set points and controls associated with the Integrated Control System are centrally located on panel CC. As indicated elsewhere, controls required for off-normal conditions are given suitable priority and are generally distinguishable from those used for normal conditions.

The progression of controls is numerically and alphabetically consistent throughout the control room. That is, a , b, and c are left-to-right or top- '

to-bottom.* Controls for multiple elements are similarly arranged.

• An exception is the Heating and Ventilation Panel (Section A is to the right) . Because the A and B sections are clearly labeled and because of the non-vital nature of this panel, correction is considered unnecessary.

Few controls are operated in a specified sequence.

There is a sequence for switching the various analog loops of the integrated control system from manual to automatic control. This sequence is generally a left-to-right progression.

Because the valve designator is engraved on the pushbuttons in extremely small type, which pushbutton applies to which valve is not always readily apparent. Improved labeling to correct this is recommended.

There are two instances of mirror image control groups in the Unit 1 control room:

Controls for the main feed pumps and their turbines are mirror-imaged. After careful evaluation, the review team considers that this imaging makes less likely the incorrect operation of feed pumps or their auxiliaries.

Demarcation shall be used further to enhance the main feed pumps control group.

• Some of the controls on the Heating and Ventilation panel are mirror-imaged. Incorrect operation of these controls is unlikely to result in serious consequencs. Therefore, its correction in the short term is not considered warranted.

2. Operation Controls are generally in compliance with human factors guidelines.

Special tools are not required except in the case of synchroscopes where a special removable handle is used as part of an interlocking system.

! Forces and motions are within the l

capabilities of operators and directions of operation of controls follow a consistent set of conventions.

l (It should be noted that rotary controls for valva operators rotate clockwise to open rather than close l

the valve. This convention does not appear to trouble the operators, is universally used and is ingrained. The convention is consistent with

" clockwise on". Also, the operating switch does not

U' * -'

resemble a valve handwheel. The valve control convention should not be changed.)

3. Protectior.

In most cases, controls are satisfactorily protected from inadvertent operation. Panel arrangement is uncluttered so that inadvertent operation through mistaken operation of an adjacent control is considered unlikely. Exceptione are the intermingling of makeup, service cooling, and diesel generator controls, and arrays of valve push buttons which have been previously noted and for which corrective measures have been recommended.

Some of the pistol grip switch handles are set back about one inch from the front (operating) edge of the console. This arrangement has some potential for inadvertent switch actuation (due to an operator hitting against a handle). It should be pointed out that there have been no incidents of this kind and that the switches' detent action provides substantial resistance to a change in position from a small force on the handle. On balance, however, additional insurance against inadvertent operation is considered desirable. The review team recommends that additional protection be provided. One possibility which should be considered is the provision of a guard to the console edge which would double the set back distance. If this course is taken, measurements should be made to ensure that the reach distance to switches on the back board section of the console does not become excessive. Suitable guards for the pushbuttons are provided at present, where warranted.

4. Identification Labeling of controls is not generally in accordance with the guidelines and should be corrected.

Specific deficiencies include:

Label plates whose letter size is too small Temporary label plates Inconsistent use of label plate color codes, specifically black on white and white on black Failure to include both descriptive name and identification number for control elements.

5. Maintenance Maintenance findings relative to controls and displays are given in Appendix E.

C. DISPLAYS

1. Location As noted elsewhere, displays are generally located properly with respect to related controls.

For the most part, operation of controls does not obscure related displays.

Separation requirements sometimes result in widely separated displays (core flood tank levels are an example). More effective labeling should reduce the impact of this separation, and is recommended.

2. Scales Most of the displays of the TMI control room are Bailey vertical edge-type indicators. Specific findings are as follows:

Graduations of most indicators are consistent with resolutions required by operators. (There are exceptions--for example, the sodium-thiosulfate tank level cannot be read to the two percent level stated by technical specification.) The technical specification should be changed.

Scale range of most indicators is generally adequate for both normal and off-normal conditions. Digital indicators'present a problem in this regard. It is not obvious from a simple inspection of their reading to determine if a level indication is at the top or bottom of its range.

Scale divisions are often in unusual progressions. Multipliers are often used and are difficult to read.

Units of scales of related displays are not chosen for easy correlation. For example, indication of tank level is not usually given in gallons but flow rates are often in gallons per minute.

e- ,

• Multiple displays of the same variable on occasion do not have consistent scale units (e.g. , decay heat cooler temperatures) .

• Steam generator startup, operating and wide range level instruments are not referenced from a common point. Also, startup and wide range level are calibrated in inches; operating level is in

! percent.

l

• There is some risk that the scale design of certain dual Bailey displays will result in confusion of the two readings. The dual scales for the pressure meters for turbine extraction steam, and the differential pressure meters for the reactor coolant pump labyrinth seals and number one seals are particularly confusing.

• As discussed in Appendix C, vertical meter faces exhibit glare, which can interfere with their reading.

Correction of these deficiencies as well as those identified in 3 below can be brought about by selected scale replacement, improved labeling and light modifications. Such actions are recommended.

3. Identification The identification of displays often does not comply with the guidelines. Specifically:

• Both the descriptive name and ID number for a display are often not given.

• Nomenclature of displays often is not consistent with that used in procedures.

• Legend plates often are difficult to read and on dual displays are confusing as to which display they apply.

• Limits on normal operating ranges are usually not depicted on displays. (It should be noted that use of a normal range.on most displays is difficult. What is normal depends on the mode of plant operation and can vary widely.)

• Temporary label plates are often used.

The deficiencies of displays relative to identification can be corrected in large part by .

. ,y .

.. .~.-~..__ .

s

-f.m

7. o * -'

p; 3 ' -, -

I  %  ;

'I . .:

3 ./

.. s j

i.t.t!!! lg1 -

gl . . g IdI!)h.i li..

jjit;i .3

5 *g art lIh

.,i tri. m l,

• .I*t 3

-, . j .

&r.! l d, 7

it.it.i!.e.;.:.3, . -

8 i i+..g . u.

ri

• ' I f! h im 3, tjff!4 r i i t, 8 .r !se c

> t.g

• i l

{ . g......... ...

6 j i . ,

j --

t .

1 . 4

• g, ... )

l t 7

j  !- e  !- -1 - -

, lej

. . .j. , -<;  ; . . -

t i F---I ij ,I-' -

T--

@l U}

i ,' 1  ; a-. -  :- -

t y .

. ,\ ,...

s t, '\

• l ,

i t, I \

I .i N

, 4 g /

/ .- ..

R.%

~

/

/

/ .

f

.! j.

/

/ eA w

3. ! h,

\ '--

l t. . l /  ;/ / A '

a. . It!

, , / .- / e s a4

{,l (__, * ' . _. __

~

,/ i

, ,/

• g *

/ /

f - e l j * . -

( e f ~~~

.--7 - . . - - _ - - - . .

d g A tb:s

, 1.-; .

,/ g.--.-, it.

4 6 e.

1g. . . _ _ - 1. . -

- , t.

! (:: l P,---

; ,  ! -

. 1. f - .

g I "'y . Q:k; .-

L..-

! I ' *

! , i -

'L a il .

j  : ,i ! l ' i:

.  ! 't j i . ,

5,

' i M -- I 7

I t

i

'l. t;e -

1 t

+

i / ..

r

,;.!l . .i . _ . . .: =. ,.,  :

', j - . _ . - - - - ,g  ;

- ;  ;,2 1

a_. 8 i.

e m._

1

.- g

. , 4 + < i

,p

,{ -

l t '

i I ', ;e .

. . e at e. r T. *

• 1 I

'{'u i.. -l .I

.' {!f h. *J. ,. I T.

• es , , s.

j Ill i  ! . V\ ' Jii!I  !

L.J, N

,s a w e. . ..

1

,. ,T-

.- \ .= s-,

m. esr. p a . h . . gN. $. %., f.

, , . p -, _

\ N s'- tt ,

g *

\. . " " ' " " '

'S

. x- N x' l

.j.L I c . ..

, S: -

i -s a e

t l j. 1 t.

{ g .- o_

y

) .. ..

, . , N .

e i

, x '

2 N

i N ~.. _

i

/ < h . r i  :'  ;

i f:'

N/ ti ~.,..'4 .

8 1 .

e f -

• r - ' ] ; M.  ;

..g.

l

~ G g I

l.

} i ei 4

IP (*

sI I * ' i i

... I,l , .

6 i* 4

-  : 1.;

s.

P J

t)* g 4 4 5 Of i I I4tl jr- t i,<t* i

~ , ~.-. n.e- ,

i I

'tD . y '; " .. ". l.-,

.. ,l

..... 2

p. j . .. e . ~

-~:,_

. .d .

7, s - .- - -- -

e.,.g>,.

. . .. -->. ..w ..,.. L e ., ,ar:

,., . . ~ . , .-

< . - , 4

.s -3,y

.10.'g@'t Q_w.i s > -e --

1

.; .p 1

.y. g. & ::c- .s w l. .:

. t.

t

, .c.m

,_v

,,s,.y t? .

, '., W . . . ,lr,.(C, .'...,'

k' _ .. ... ' _ -

.  ? .

_' i ** - * "

T

w 0 D

• l l

C t

i e 9

• O er E I

l

?

o

O 9 APPENDIX C CONTROL ROOM ENVIRONMENTAL REVIEW O

O O TMI UNIT 1 CONTROL ROOM OVERALL ENVIRONMENTAL REVIEW Table of Contents Subject Page I. Introduction and Purpose- - - - - - - - - - - - 1 II. Summary and Conclusions - - - - - - - - - - - - 2 III. Survey Results and Recommendations- - - - - - - 5 A. Air Conditioning - - - - - - - - - - - - - 5 B. Lighting - - - - - - - - - - - - - - - - - 8

1. Illumination Levels- - - - - - - - - - 8

2. Luminance Levels - - - - - - - - - - - 12

3. Bulb Inspection and Replacement- - - - 17 C. Noise- - - - - - - - - - - - - - - - - - - 20 D. Control Room Personnel and Activities- - - 28 E. Documents- - - - - - - - - - - - - - - - - 30 F. General Storage and Supplies - - - - - - - 31 G. Access to Supervisor's Office ------

31 H. Eating Facilities ------------

32 I. Restroom Facilities ----------- 32 J. Tools and Test Equipment --------

33 K. Control Room Interface with Plant ----

33 L. Communication Equipment --------- 34 IV. References --------

,--------- 37

LIST OF FIGURES Page Figure I -

Temperature and Humidity Measurements- - - - - - - - - - - 6 Figure II -

II.umination Measurement Lc:ations - - - - - - - - - - - - 10 Figure III -

Control Room Location vs Illuminance - - - - - - - - - - - 11 Figure IV -

Sound Level Measurements- - - - - 22 Figure V -

Control Room Furniture Arrangem.9nt - - - - - - - - - - - 26 LIST OF TABLES Page Table I -

Illumination Measurements- - - - - 9 Table II -

Luminance Measurements - - - - - - 13 Table III -

Alarm Sound Level Mesurements- - - 25 I

, . - - , e - - ~ . . , , , < - - - . , ,

• O TMI-UNIT 1 CONTROL ROOM OVERALL ENVIRONMENTAL REVIEW I. Introduction and Purpose The purpose of this review was to assess the adequacy of the TMI Unit 1 overall control room environment to support the activities which have to take place in tne control room. It was conducted by qualitative observations and quantitative measurements of specific control room environment parameters such as light, noise, and temperature, and through interviews with control room operators from two different shifts.

Section II presents a summary of the findings and recommendations of the review.Section III provides a detailed discussion in each of the areas investigated. For each of these areas, the results are preceded by a statement of possible concern which the review was intended to address, followed by a summary of the findings and then recommendations, as necessary. Quantitative standards (see references,Section IV of this appendix) have been applied, where appropriate, to provide a basis for evaluating light, sound, and temperature conditions in the control room. In other cases, the evaluation is a qualitative assessment of whether there is significant potential for operations in the control room to be adversely affected by the conditions described by the findings.

1 l

l

II. Summary Conclusions and Recommendations The review indicated that the overall control room environment (air-conditioning, light, noise, etc.) was generally satisfactory. There are, however, creas where improvements are needed to correct specific problems or where the existing conditions are marginal and appear capable of being substantially upgraded. Although it is difficult to assign specific potential operator errors to these conditions, two of the conditions appear to be particularly important in the short term. These are the problems with indicator light intensity and alarm sound levels. The other problems and recommendations, although considered important to operator performance, are of less immediate concern and can be implemented over a longer period, after the necessary design details are completely defined. These short term and longer term problems are discussed below.

A. Short Term

1. Indicator Licht Intensity and Bulb Testing The lighted indicators (both lighted pushbuttons and window lights) on the console and panels have a great deal of non-uniformity in their luminance. In some cases the lighted indicator is so dim that it is i

difficult to determine whether the light is on. This l problem is particularly prevalent with the blue lights on the Engineered Safeguards Actuation System Panel i

(PCR), where some lights have to be shaded with the j

hand from the overhead light to confirm that they are i on. The problem also appears to a lesser degree on

some green indicators for closed valves. The l luminance variability is also undesirable, even if the lighted condition is detectable, since it makes the

! visual presentations different to the operator even though the component status is no different.

In addition to the observed luminance intensity differences among the lights, most of the indicator lights also have a more fundamental problem; namely, the design of the plant indicators has made no provision for testing of light bulbs. Only the rod control, turbine control, and annunciators have a

' light test feature. There also does not appear to be a regular program of panel walkdowns to detect burned out bulbs or a program of regular bulb replacement.

However, informal inspection and replacements are made by operators on a fairly frequent basis. This report recommends a specific program to determine the cause (s) of the differences in luminance intensity among the indicators and to upgrade them to a uniform visible luminance. The report also recommends L

adoption of a detailed program of periodic light bulb surveillance and replacement to reduce the potential for burned out light bulbs to result i.n a loss of any indication.

2. Alarm Sound Levels The levels of sound from the various alarm panels in the control room, except in one case, are only slightly above the ambient noise level. Although their distinctive frequencies appear to allow the operators to distinguish them when sounded individually, if several were to occur at once, it is questionable whether they could be distinguished by the operators.

The sound level of the alarms should be selected for consistent level of intelligibility above maximum ambient noise level. This will require an increase in the sound level of some of the alarms and a decrease (e.g. , H&V) or change in frequency for others.

Sufficient levels of signal-to-noise ratio should be achieved in the appropriate octave bands to avoid masking of alarms by both background noise and other alarms, while at the same time allowing adequate communication among the operators. To achieve the desired frequency, volume, and modulation of alarm signals, it is recommended that octave band measurements and in-control room testing of alarm combinations should be conducted. Comparison to quantitative standards (Reference 1) and qua?.itative judgement should be combined to determine satisfactory alarm levels.

B. Long Term

1. Air Conditioning l

l The air conditioning system for the control room is I designed to limit the maximum humidity in the control l room to relatively low values (less than 50 percent). The minimum humidity is not controlled. In the winter, when the outside humidity is low, the air in the control room can become uncomfortably dry. In l addition, control of airborne dust in the control room is particularly important because cleaning operations l

are disruptive and involve some risks of inadvertent control actuation. The current normal filtration system for the control room air has only relatively coarse filtration (in accidents a high ef ficiency system is brought into service).

s

)

In both of these areas, humidity and dust control, it appears that improvements in the air-conditioning system should be evaluated in detail. The concern is not serious. However, if experienced heating and ventilating engineers can establish that practical and reliable changes can be made to the existing system, to provide control of minimum relative humidity and an upgraded dust removal capability, then the review team would recommend such changes.

2. Carpeting to Reduce Ambient Noise Level The noise level in the control room is acceptable by some standards. However, it is desirable to keep the noise to a low, practical level in order to improve communications. In the case of the TMI-l Control Room carpeting of the present tile floor would have a substantial effect on reducing the ambient noise levels. Carpeting would also have a beneficial effect on operator comfort by reducing fatigue (since they are on their feet almost constantly) and by improving the light balance in the room.

It is therefore recommended that carpeting, meeting the requirements for flammability, static electricity, etc.

as outlined in this report, be installed in the control room.

l 3. Light Baffling to Reduce Glare The vertical meter faces on the console have glare. The problem is more pronounced in GE (curved glass) vertical meters than on the (flat glass) Bailey meters, but is I also present on these meters and on other console l

components. Although this glare does not appear to l preclude reliable reading by the operators, it is desirable to reduce it. Observation indicates that the major portion of this glare is from the reflection of l those overhead lights in the center of the control l room. It is recommended that baffles for these lights in

! the center of the room be evaluated.

i III. Survey Results and Recommendations A. Air Conditioning The concern is whether the condition of the air in the control room, e.g., its temperature, humidity, cleanliness, or volumetric flow rate, is controlled adequately so that it does not detract from the operator's performance.

4 Measurements of the wet-bulb and dry-bulb temperature in the control room indicate an " effective temperature" of 64-65'F. This is at the minimum value recommended by MIL-STD-1472B (Reference 1)* and is acceptable, although marginal. These measurements (summarized in Figure I) are consistent with the operators' subjective opinions that the control room was " generally cool."

The air conditioning system for the control room does not provide humidity control other than a chiller which saturates the incoming air at approximatley 54*F (if the initial moisture content is high enough). The chilled air then passes through heater banks and (nters the control room to maintain a temperature set by the operators on the wall thermostat (usually about 70*F).

The measured relative humidity of 42% in the control room is slightly less than 45% as reccmmended by MIL-ST3-1472B (Reference 1). During the winter months when the outside air is colder and contains less moisture, the relative humidity could drop to 15% or less. In this regard, one of the operators did complain that the room was too dry.

Adequate ventilation to the control room should provide a minimum of 30 cubic feet per minute per man with approximately two-thirds outside air (Ref erence 1) . The ventilation system is designed to deliver approximately 8,700 cfm to the control room (Reference 4) with outside air content varied according to temperature and other conditions. The operators indicated the ventilation was satisfactory.

The ventilation system includes smoke detectors, combustible vapor detectors, and radiation monitors that initiate emergency mode operation automatically with

• References are listed in Section IV at the end of this l

appendix.

• e FIRC PROT Cf 7tCM %e

• CCLuc ( VAss t Trup e.

1. I #

COM784o6f*ANC% , ,,

.s p .. .

LJ

., s . , Xerox 9400 r ,,.r=<

PAhlh J

(

t 58*Fwb . :.

I i "' 72*Fdb #I l

a.

11P'"l li$i"" 42%RH o.

=

w N. _v s i i 55.5*Fwb b 7 5 hJ

c. 68 *Fdb 42 %RH c.

ijI t

~ /

\{ , u....

I  %,g- a M

G' .---

56.6*Fwb 70 *Fdb. _q U

4

_ 42 %RH k

,:\; ,

E P2 $

I 1.1 r s _

Jb

. .... j _

.i 55.5*Fwb "

. 68 'Fdb 'e'.

'+* .

9 42 %RH ~.

sua .sn ituv.u, i

• c- l o' en _ ___

-- l n em, e s :.o _

s...,.,, ,,

. w j  ;

0l'l2l5' '

P,5 van sq

] -

e cem.w , ,

3' E 1 .

^' e.

Iq

• d.',. f .

_s FIGURE I TEMPERATURE, HUMIDITY MEASUREMENTS, June 5, 1980

• Fwb-wet bulb

'Fdb-dry bulb

%RH -Relative Humidity 6-I

followup manual action required. During an emergency, the outside air supply fans are shut off and recirculation fans are used. The emergency air system includes roughing filters, high efficiency, HEPA (High Efficiency Particulate Air) filters, and charcoal filters.

Cleaning in the control roc: !s confined mainly to wet mopping the floor by maintenance personnel with the operators occasionally applying a feather duster to the console and panels. The operators indicated that in the past when buildup of dirt has become excessive, " field days" are declared and the operators do the cleaning.

There was a small but visible amount of dirt buildup on the console and panels, particularly on the top of the back panels. This could have been partially due to various modification activities in the control room. In addition, dust was mentioned as an irritant by one of the operators.

Recommendations Two aspects of the air conditioning system appear to be capable of improvement:

1. Control of Minimum Humidity The low humidity which will occur in the winter has an adverse effect on operator comfort and may contribute to problems with static electricity. Low humidity is unlikely to create a short term operational problem affecting plant reliability but could contribute adversely to operator comfort. If simple and reliable methods are available and adaptable to TMI Unit 1 to improve humidity control, then their incorporation is recommended.

2. Normal Air Filtration Cleaning operations in the control room should be minimi.ed since they inevitably result in noise and disruption, further, actual cleaning of the console and panels involves some risk of inadvertent actuation. If simple and practical methods to substantially improve the air filtration from the current method are available, then this would be a worthwhile modification.

In both of these cases, evaluation of the current arrangement by experienced heating and ventilation engineers would appear desirable as a first step to establish what changes are necessary to upgrade the TMI system. Then these changes can be reviewed to determine whether they will have significant effect on the reliability or emergency operating characteristics of the system.

B. Lighting The concern is whether the lighting in the control room provides adequate visibility for the operators and does not have the potential to interfere with er distract the operators. Tnat is, lighting should be such that (a) operators can read legends, nameplates, meters, other indicators, and procedures (b) glare does not interfere with reliable identification or reading of instruments; and (c) the operators do not suffer from eye fatigue.

Measurements were taken to assess the quantity (illumination levels) and quality (glare, brightness, contrasts) of light in the control room. Light measurements were taken using a Tektronix Digital Photometer (Model J16) coupled with a Model J6511 illuminance probe for illumination measurements and a Model J6523 narrow angle (l') luminance probe for brightness measurements. Both probes were corrected to l match the standard CIE photopic curve (relative i

sensitivity of the eye to light). The illuminance probe angular response was cosine corrected to provide accurate response to incident light in a 180* field of view.

! 1. Illumination Levels The primary lighting source in the control room at the time of the measurements was the normally operated set of overhead tiuorescent lights (even numbered rows) .

The illumination measurements were taken in the plane of the task for the various locations; on the benchboard and backboard, the vertical back panels at l

aproximately 72-inch and 30-inch elevations, and various writing and work surfaces. Table I summarizes the illumination measurements. Refer to Figure II for the location of the measurements. Figure III provides l

a graphical representation of the illumination data.

l l

l

e e Table I Illumination Measurements (foot-candles)

Loc. ft-cd Loc. ft-cd Loc. ft-cd 26 22 51 71

' 1 103 111 27 38 52 2 60 28 24 53 112 3 104 54 115 4 64 29 49 30 27 55 92 5 100 56 45 6 60 31 43 32 28 57 90 7 101 58 77 8 59 33 33 34 26 59 76 9 100 85 35 52 60 10 60 11 92 36 29 -

12 58 37 54 13 90 38 38 14 60 39 53 15 95 40 45 16 59 41 55 17 98 42 54 18 64 43 56 19 48 44 46 20 35 45 38 21 48 46 35 22 32 47 106 23 40 48 111 24 24 49 101 25 29 50 110 1

- 9-

.,-w- c- - - - ..+s

. e

)2 5

9

>e '

%,(96E 3?,. 0 w' wSb

. . . y 3

w t

!#0sf

$$ $6i*t

,v .

6 5

r( ,

o 7

. 5 a

.7 h y 5 ,u. y n lh 56 44 l t

e v

w Q g__ M~5 #

/

M

=;.-

R e

a 90 12 1 .

n 34 22 6 44 2 8 f 7

1 3 2 M R

=.

. 6 w 5k l

' 1 fN 75' 1 A 2 p3l

\

f

, J_

_ 7 1 2 78 22 m 1 1

_ .p 4

.z fY s

-\ L -

_ l" 1

5_

i' 3

^ 5 l s5_ 4 10 g 9 0 90 8 55 1 23 $

f* _ 5 2 l 4

9 - 5

e. l" C.2- 9

. 4 7 8 12 a s c E 33

_ o

?

w t

12 44 5 /

_ $ 4 3

. . 3 3 4 4

0 3 6

1 5 3 2 2

. 8

• t

..- 7 3 3

- 90 3 5 34 jca ['

• j lii

( $ } y I 4

3

, , . { {.,*,o

- P. j- '3 2 9

1'.,* .

5 t

N a

. [* ,

- f* -

- T- ],

h

.~..,

! L.

c o .8w

. Ec2 zM os 3"r>"c_-Qm2H yE$, ga a y. i

. e mo o 3 cw cli . :s LECEND:

V READING / WORK STATIONS (CENTRAL)

Q CONSOLE DENCl! BOARD A CONSOLE DACKBOARD D VERTICAL PANELS (72 INCIIES)

O VERTICAL PANELS (30 INCi!ES)

NUMBERS INDICATE LOCATIONS ON FIGURE II 120 l I 48 50 _52 47 3 l 7 5 ,

1 100 i 17 l 9 15 11 13 80 U 60 i

A

.2 l

19 21 29 i

35 w1 42 44 31 40 q

40 45 27 33 38 46 20 22 l

25 l 36 0 32 34, 24 20 4

26 l t

a a e a a e a e e a 6 l

l LOCATIONS VERSUS ILI.UNINANCE FIGURE III l l

The measured illumination on the console benchboard averaged about 98 foot-candles (fc), about 60 fc on the inclined backboard, and approximately 109 fc on the desks and primary work stations. The illumination levels are lower on the vertical back panels (average 45 fc at 72-inch elevation and 34 fc at 30-inch elevation) with a range from 22 fc to 56 fc. The MIL-STD (Reference 1) recommends 50 fc (30 fc minimum) for console surfaces, meter reading, and ordinary seeing tasks. For general office work, 70 fc is recommended (50 fc minimum). For panel fronts, 50 fc is recommended (30 fc minimum). These values are consistent with those recommended in Reference 3 (IES Lighting Handbook).

The illumination levels on the console, desks and primary work stations exceed recommended minimums.

The average illumination levels on the back panels are generally within the minimum and recommended values for vertical panels. Illumination levels at specific locations on the vertical panels do fall slightly below the 30fc recommended minimum, however, the opinion of the review team, based on their observations in the control room, is that the existing illumination levels at the locations are quite satisfactory.

The " quantity" of illumination refers to the level of illumination (foot-candles) falling on the seeing The operators expressed general satistaction t

task.

with the illumination levels; their perception was i that the room was " brightly" and not " dimly" lit.

2. Luminance Levels Luminance measurements (photometric brightness) were

! taken at various locations in the control room to assess brightness and contrast ratios of panel and annunciator indicator lights. A one degree field of view luminance probe was used with focusing capability i

as close as 18 inches, enabling measurements on a spot l 0.32 inch in diameter. The luminance of a surface is

the characteristic that makes "seeing" it possible.

Luminance is a function of the self luminance (if any) of the task (i.e., word indicator light) plus the reflected incident light (illumination). Table IT l

describes the location of the luminance measurements and gives the value of luminance in foot-lamberts (fL).

l l

L.

O o Table II (Cont'd) fL Description Overhead Annunciator Panels 27 E-3-3 (on) 46 E-3-2 (on) 11 E-2-2 (off) 11 E-1-1 (Red-on) 8 F-2-1 (off) 23 F-1-2 (on) i Push Button Indicators 7

CO-V10B (green-off) 8 CO-V10B (red-on) 3 CD -714B (red-off) 12 EF-V2B (green-on) 12 HD-V5B (red-on) 16 HD-V5A (red on) t Motor /3reaker Indicator Lights 13 Red on (dim) 27 Red on (bright) 104 Green on 7

Green off 18 L. P. Turbine Exhaust meter face 53 (glare)

Curved Lens covered meters (G.E.) 30 (off-glare) 64 (glare)

Curved Lens covered meters - CR 37 (glare)

Bailey meter face Main Console Panel 23 CR-bench 14 CR-back 21 CC-bench 12 CC-back 19 CL-beach 12 CL-ba:k

O e Luminance measurements (and observation) indicate wide variation in brightness among lighted pushbuttons and word indicator lights of similar type on the console and back panels. For many of the blue indicator lights on the Engineered Safeguards Actuation System (ESAS) panel (PCR) , a determination as to whether they are lit or not requires shading the indicator to prevent washout due to the overhead lights. For some of the green pushbutton switches on the console, the luainance measurements are very close to the console

' background and because of the similarity in color are not readily identifiable whether they are on or off.

The reasons for the wide variability are not known; however, because adjustable resistors are installed in the console lighting circuits to improve bulb life, maladjustment of the resistors may be a cause.

Alternately, the problem may simply be a buildup of dust in the lights themselves or inconsistency in the type and number of lighted bulbs in the indicators.

Although all the console and panel lights appear to be subject to the observed variability, the operators indicated only the blue lights on the ESAS panel are difficult to identify.

The most commonly used bulb in the indicators is a T l-3/4 28 volt type 387 or type 327. Both types of bulbs are identical in size and draw the same current, however the 327 bulb is about 10% brighter than the 387 but has about half the rated life. The slight increase in luminance provided by the 327 bulb is not considered significant enough to outweigh the benefit of the longer life 387 bulb. The type 387 bulb has a rated life of 3000-4000 hours on dc voltage (7000 hours0.081 days <br />1.944 hours <br />0.0116 weeks <br />0.00266 months <br /> rated life on 28 vac per Reference 11). Lamp life is rated as the average of a large group. A typ-ical morta:ity curve indicates about 50% of the bulbs have burned out by 100% c ' rated life; about 2% have.

burned out by 50% of rate, life (Reference 3) .

The " quality" of illumiracion refers to the distribution of luminances in the visual environment and how they affect comfort, safety, and ease of Glare is the primary concern with quality of seeing.

illumination. There are two general forms of glare --

discomfort and disability. "Discoafort glare," as its name implies, produces discomfort and may affect human performance or visibility. " Disability glare" does not cause discomfort, but reduces the visibility of objects by superimposing veiling luminances on the task.

eme

O e Observation of the panel indicated significant glare on all of the vertical curved lens G.E. meters with much less glare on the flat lens Bailay meters. The glare is due to reflection of the overhead lights primarily in the central rows located above the computer console. Glare on the meters was considered annoying to one operator, but resulted in no

" conscious effort" by another operator to be able to read the meters with glare. Discomfort glare (excessive brightness) was a complaint of one of the operators who expressed an opinion that the room was "too bright." Measurement of the luminance (foot-lamberts) of surfaces in the field of view indicates luminance ratios in excess of For the example, recommended value the floor of and 3 to 1 (References 2 & 3).

desk surface luminance compared to the console panels is about 6 to 1. Measurements of luminance of luminaires in the field of view indicate they are not a source of direct glare which would contribute significantly to the "too bright" feeling the operator mentioned. The light tile-covered, waxed and polished floor appears to be a significant contributor to making the room appear "too bright."

Recommendations

1. Steps should be taken to provide uniform brightness for lighted pushbuttons and indicator lights while maintaining satisfactory bulb life.

To identify the cause and establish the proper corrective action thirty to forty indicators of varying brightness should be selected for evaluation. Based on the procedure described below appropriate corrective action can then be determined for all of the indicators.

• Evaluate the luminance of an indicator l

(qualitative or quantitative).

• Measure the voltage across the light circuit.

• Determine the type and number of lighted bulbs. If fewer than the design number of bu)bs are lit, determine if the cause l

i is with the bulb or the electrical circuit.

• The great majority of indicators use T l-3/4 inch, 28 volt bulbs. These should be replaced with new type 387 bulbs (G.E. , Sylvania, etc.). For indicators requiring other types of bulbs, further evaluation is necessary.

• Clean the indictor lenses and confirm the appropriate filters are in place.

• Adjust voltage applied to the light circuit -- 28 vdc to the majority of indicators, others must be evaluated individually.

Re-evaluate the luminance of the indicator.

Assuming that new bulbs, clean lenses and correct voltage eliminate the problem, all indicators should be adjusted as described above.

2. Steps should be taken to reduce glare on the vertical meter faces from overhead lights. Treatment to the meter faces to prevent specular reflection, for example, the use of polarizing filters or diffuse surface coatings has been evaluated. Polarizing filters (Polaroid's CP-70 circular ' polarizer) significantly reduces glata but unfortunately has about 40% transmissivity. Consequently, reading the meters becomes very difficult. Diffuse surface coatings reduce glare but also reduce transmissivity and are subject to abrasion and wear. If practical, baffling or shielding of the overhead lights should be evaluated. Specifically, the American Louver Company "Paracube I" metallized louver is recommended for evaluation. An experienced lighting contractor would be best qualified to assess the feasibility of system modifications (as well as provide alternate recommendations). The current illumination levels on the console are sufficiently high that baffling could probably be used without reducing light levels below acceptable levels.

3. Bulb Inspection and Replacement No test procedure or regular bulb changeout schedule is implemented for the control console pushbutton switches or indicator lights (the GE turbine controls, the

" Diamond" control for reactor control rods, and the alarm annunciators have a push to test feature). Burned out bulbs in indicators are changed by the operators when it is convenient. Changing the bulbs in the overhead annunciators requires an operator to stand on the top of 7

the console backboard when a ladder is not available.

The overhead fluorescent bulbs are changed by maintenance personnel, as required.

' Recommendations

1. Adopt a specific schedule and procedure for identifying and replacing burned-out light bulbs.

Retrofitting of a light test circuit into the existing instrumentation circuits is not considered practical and, in fact, may involve substantial risks. Failures in test circuits can lead to very confusing displays or even changes in the system's behavior.

Implementing a regular inspection schedule to identify and replace burned out bulbs will help insure reliable As discussed above, indications from panel lights.

type 387 bulbs are recommended for all (applicable) indicator lights due to their longer life over the type 327 bulbs. The approximate life for the type 387 bulbs is expected to be 3500 hours0.0405 days <br />0.972 hours <br />0.00579 weeks <br />0.00133 months <br /> at 28 vdc operation. Because some bulbs will burn out in less time than their rated life and others will last longer, after three or four bulb lifetimes of operation the occurance of bu:b burn out will become random if bulbs are replaced as they burn out. With random bulb failures, the probability of a bulb being burned out at a given time is equal to the fraction of rated life elapsed between inspection intervals.

Alternately, this is equal to the fraction of bulbs that will burn out during an inspection interval.

Using a rated life of 3500 hours0.0405 days <br />0.972 hours <br />0.00579 weeks <br />0.00133 months <br />, this implies that less than 5% (.05) of the bulbs will burn out in a we6k and less than 1% (.01) in a day (24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period).

The indicator lights on the panel can be divided into two categories: i) indicators designed for only one indicators designed bulb to indicate status, and 11) for more than one bulb :o indicate status. Indicators designed for two or more bulbs to indicate status l

include the Master Specialties 10E pushbutton indicators (approximately 400) and some of the Series 1100 (Roto-Tellite) word indicator lights (approximately 100) . The majority of the Series 1100 indicators and the pump and motor switch (G.E. model SB-1) status lights are single bulb indicators (approximately 400) .

There are approximately 500 indicators or pushbuttons using two or more bulbs to designate status. If it is assumed that there are only two bulbs per indicator, the probability of both bulbs in a single indicator failing in a one week inspection interval is 0.25%.

This implies that for 500 indicators with two or more bulbs it is likely that one indicator will have two failed bulbs.

A weekly inspection interval would lead to about 5 per cent of the single bulb indicators being burned out. For the single bulb indicators reducing the inspection interval to once per day (less than 1% of average life) ensures that less than 1% of the indicators is likely to fail between inspections.

The essential elements of a light inspection procedure include a walk-down by the operators on a daily basis (night shift is probably least disruptive) to inspect the valve push button indicators, word indicator lights, and motor control and breaker indicator lights:

a. The push button indicators come in pairs (sometimesshould indicators in threes) be and at least lit (i.e., one of a valve is the two either

' open or closed). If neither is lit operators If any one of the bulbs should confirm why not.

in a multi-bulb indicator is out, all bulbs should be replaced. Replacing all bulbs at one time minimizes entry into the switch reducing the potential for inadvertent actuation. It should be noted that this increases the probability that all bulbs in the same indicator will burn out at once; her.ce, the reason for applying a daily inspection to the multi-light indicators rather than weekly (the odds of two bulbs being burned out simultaneous]y with this inspection schedule are less than 1 in 1000) . The unlit indicator is considered to have remained unlit since the last inspection, thereby not using up a portion of its rated life. This assumes that normal operation of the plant does not produce a situation where a component's state (e.g. , open or closed) is cycled between inspection intervals or that the time of day of the inspection is coincident with a cycling component always being in the same position. Exceptions to this must be identified and alternate inspection times defined. A change in indication of the pushbutton switches usually accompanties a deliberate action by the operators. At the time of actuation the operators confirm the action by the indicator light.

e e

b. The word indicator lights are either two color, one bulb for each color, or one color with two bulbs. The two color indicators should have one color or the other lit. Daily inspection will identify burned out bulbs (less that 1%)

c. The pump motor control indicator lights and miscellaneous lights should also be inspected daily. The lights confirm operation at the time of switching. During the inspection, light l indicators should be matched with handle position i and flags (if present).

d. Some equipment is operated very infrequently, if at all, other than during surveillance testing. Light bulb inspection and replacement, if necessary, should be specified as an integral part of the surveillance procedure for that equipment.

2. Provide a specially designed ladder for chancing bulbs in the annunciator panels. The ladder should provide the following features:

a. Narrow enough to be easily moved along -the walkway and around the corners between the console and back panels.

b. High enough to provide stable support to the operators when reaching for the uppermost annunciator light boxes.

c. Should not slip or move while in use.

d. Other operators should be able to get around it while in use,

e. Should be easily portable and placed out of the way when not in use.

j C. Noise The major concern is whether noise in the control room can, under some conditions, distract or annoy the operators to the extent their performance could be degraded or communications impaired.

Sound level measurements were taken in the control room using a General Radio sound level meter 1565-B { ANSI Type 2). The meter range is 40 to 140 db referenced to 20 micro-Newtons per square meter with A, B and C weighting

networks. The A weighting was used for all measurements. These weighting networks cause the sensitivity of the meter to vary with frequency and intensity of sound like the sensitivity of the human ear. The A weighting network is less sensitive to low frequency to the same extent that the ear is less susceptible to injury by low frequency sounds; consequently, human ear response is adequately predicted by the A weighting network which forms the basis for most occupational safety standards (Reference 2). The results are summarized in Figure IV. Measurements indicated without notes were due to general background prior to 4:30 p.m. Notes attached to Figure IV indicate exceptions.

The noise level in the control room was in the acceptable range for " Operational Areas," that is, areas requiring frequent telephone use or frequent direct communication at distances up to five feet (Reference 1). The general background noise level was 62-65 dBA during the day shift measured in front of console center. This at the upper end of the range specified in MIL-STD-1472B for operations centers. The personal opinions of operators from two crews were that noise levels were too high.

Communication with the shift foreman at his desk (approximately 20 f eet away) is posible only with very loud voices.

I I

I

{

l l

l l

l l

l

~

T 4 e O d .

FtRC PROTCC7tCN  % e

• O t t.u c. L V ALv t.1 tu p e.

1. 8 .#

C OttT 5 gob 98ANgt, , ,

+

gm i 1

g

- .. XEROX LUL .T ATWet f'A H L.L 75(5) _

.i .

suclA%5tl ~,'<t pq

[

3 4-1 1 9 1'1%'- g

• )I!,

t., _p r I_s 65 ",< ,e g Il

= ;I T'. ' cz _ 3e

\q

~ /

\f u.

e . -

,;, i .

Y Q. ' 80(4)

'7 --

67 62-65 ,,_o 63 62 U

(Operating) _ 67(1) 65 70(2) l  % 3 -~ 75-80(3)

.5- si' 60-61(6) ce P- -

a s r ti r

.a N

f*

n s.

r 8 .,

4 63 -

a

. *e

. .  : '~~

p gg

.. o-h en ,w, s. .:.o 70

)

. . .. , i m. ,,

'o ejtj> 4 P...).s s.nq -

I Cenwd i ,

I i '

~

..a h--

c: I  :'. ., .

mb ,

SOUND LEVEL dbA FIGURE IV (See Notes) 22 -

i

. e i NOTES Figure IV (1) With Datalogger Printer j (2) With Radios (security radios)

(3) With Page i

(4) Next to IBM typewriter (approximately 2 ft) 1 (5) Xerox operating approximately 3 ft away (6) General level after 4:30 p.m. Much less Page, Radio, XEROX activity also.

i

)

i

= <

The alarm noise levels were measuredTable to determine the III summarizes increase in level over background.With the exception of the results from the Heating the six alarms.

and Ventilating panel alarm horn (76 dBA),

none of the alarms provided readings more than one or two dB above background. The sound level cf the alarm from In spite of the panel PL is negligible over background.the operators indicated varia low noise levels, pitch and directionality of alarms enables them toThey do not perceive identify which alarms are sounding.

that the alarms are hard to hear.

Reference 1 specifies that the signal-to-noise ratio for an alarm should be 20 dB in at least one octave band between 200 and 5000 Hz. The intent of this specification background noise.

is to avoid masking of signals byIn addition to conce speech interfetence must also be considered in alarm frequency and volume selection. The alarm sound level measurements were based on an averaging over all frequencies (A-weighted) to provide relevant In this regard, data sound regarding speech interference.

level measurements in excess of 65 dBA would produce speech interference levels beyond recommended values forThe H&V the control room (Reference 1) .is qualitatively very loud and to 12 dBA over ambient annoying. It requires immediate acknowledgement by the interference operators to silence the alarm and prevent with communication.

Some of the noise in the control room could be identified with particular local sources. These include the IBM Datalogger printer, the page phone (produces sound A major levels in excess of 75 dBA), and personnel.

source of noise appears to be extra personnel traffic through the control room to use the Xerox machine in the back of the room (out of sight behind the back panels) .

The control room is noticeably quieter (3-5 dBA) after the day shift has ended.

Since the time of this survey, the control room desks and bookcases have been rearranged in a manner which provides This is shown f

more regulated access to the control room. allows non-control room This rearrangement on Figure V.

personnel to conduct their necessary business with the shift foreman or the switching and tagging operator This is a without entering the main part of the However, in room.

the long run substantial improvement.

limiting noise in the control room from non-control room personnel ultimately rests with the operators and 2

e s TABLE III Alarm Sound Level Measurements Alarm dBA readings taken with general quiet background at 60-61 (after 4:30 p.m.). Measured in front of CC-bench.

Annunciators A-N 63 alternating tone 1.

2. H&V 76 horn

3. PRF 61-63 change tone

4. PL negligible over background

5. LWDS 61-62.5

6. Computer 60-62 high pitch Each alarm turned on one at a time.

l l

i 1

-g ', .,s f'r e bf j rr . . . - .3 4Q (1W'),y*%, . 5-) %. ; + , t jy#,' f t.'4r+

. :{,/ 4 , - .,(P 7.Q ;i,

.w

,f_i,..+... + <

-4 s> i1 l s.,*. 2 . , Y :.

i, i

i y.

c - ,

).

1

? 2 '*( * - '

e,w

~~~ , ' r " ' C** h'

' *^  ! l 'I g -

g } s. . ,;;: . ~ y, : e:*

\

~

Q f I

.j

', 0 . P.g .

){.fs.g-,h.9. 1 !I f.4 oh-[, ,u e, ,j r-l> l .s. . . Ij g ij g a

"I'*

f:i.iv.}:I...I.l ga e l- b II Il f' ,

.i

,e_o t-Il

e. tit.

[ .............

j l I k l, J [ 4 e) t a f ,

4

! . I {

_ _ . _ . - ~ - . . _ _ .

, l h i

i; l '.**

i $

II  !. ,. j

. -.,- -- y

. - . _ . l9,,, .*8 , . ..

i I '7 g. . . ,i ,,

! i  : .

-l-t-l-! y', .-- l[ [

j ,: l t

!i. l,lyl.--  ; .::: 1' -

, .. w - . - -

t ..

i 4,

N .

2 i

, j !*I , , \  ! l

,, -y < . . . . .

.x I I

A '

1: I - ,

si ; .j i-~~'

'!] f L ,

y, *

• 'V v

• f' ,3 l

, c- ----- l h,< >

./ i s L-.--

, t

, I g .- , *,; ,

, . . k . .. !

.l. ll15, - I,.

. . ,1 t ,1 . / t l1 'l [t I, I.m lb.*-d.e,,

ki{i} -

s l

-N

'.{.I} l k't l-i P

• ], .{!}E , g (,a i + i . }' ,, 1-.

f

'f;

.t -

. < m .,'..e .! a ..

s. 'i. H t

*n,- e i ,

m .gN s

' I I l  ! k [iw lhi

.6 ,

I 3

t e: ,

.f l

..i m .- .- .

I .

is < l 14 \

• ; * ' e ,.-

• 7 .4 P-i

) l e 4 1, it gl i L '.41 .

e g,' ,1 l 6 L ' l~ ,

i < . ;g -

--N g

i . ggw, i

. *--4*-

Ii ,! , -

_ . . - _. 1-x x_ ' ~ p' . . '

[%

i T , ' s.' s \. V '\ . L i (l

Nx -

fr r3 s

s

, x,. s , . t 3; ,

6 i-(  %. / )

4 6

l} ( [

l

4 e

i N' i! '......,i  ;

Ia I

i l z w.,

l u-j l a: .

+ li I, .

f 7 -'~ ] t -j i i k i

f:

• 4 t t II

~

) .. \\  !

l* *I I i 'ij

- - : li; ,[ t  ;!

, , . . i  !

!!,7

! 4 ..

i

. - - - - - - - - - - f~l -

[';

• QQ Q "

• i ~ /

4 t.

'. t l t

oc o o l ,... .. . I i

j e y'p '.#. ,

A g i i -- -

- f- w. .ne, , .s __

management who must enforce the existing limits on access into the room.

Recommendations

1. Provide an acoustical hood for the IBM Data-logger until it can be eliminated by switching its output to one of the Texas Instrument printets. Acoustical hoods should also be provided for the TI printers if hoods which do not interfere with readability can be obtained.

2. Eliminate page phone calls being broadcast into the control room unless they are for the control room operators (see Appendix D).

3. The floor in the control room is a hard, smooth, surface which both reflects and to some extent generates noise.

Based on its estimated sound absorbing qualities, and that of carpet, it is expected that carpeting the control room would provide noticable improvement in the sound icvels in the room. Carpet is one of the most effective acoustic materials available. It prevents generation of noise at the floor level and absorbs much sound energy without decreasing the effectiveness of projected sound. It is estimated chat carpeting the control room floor.would reduce sound levels 2-5 dB. This amounts to the difference observed between the day shift and the noticeably quieter evening shift. Carpet also improves the environment aesthetically and results in better morale and less fatigue (Reference 6). This latter point is particularly important since the operators are on their feet essentially all the time they are working at the console and panels. Studies have also indicated carpet improves safety (Reference 7) by reducing the hazards of slipping and the dangers of being hurt in a fall. Carpet would also provide some improvement in the lignting balance in the room by selecting a darker color to reduce the " brightness" of the floor. (See the discussion under lighting,Section III.B.)

Appropriate flammability properties must be achieved if carpet is installed. Carpet meeting Class A requirements (most stringent) of the National Fire Protection Association (NFPA) Life Safety Code is available for this purpose. Conformance with an additional specification not yet included in the NFPA Life Safety Code (e.g. ,

Flooring Radiant Panel Test, Reference 10), also appears desirable. Carpet meeting this specification is also available.

Maintainability and low static electricity are two other considerations in carpet selection. Carpeting will eliminate the need for periodic wet-mopping of the floor but regular vacuuming will be required. Carpeting installed in removable segments will ease replacement if necessary. There appears to be no significant difference in the maintenance burden. Carpeting is commercially available from a number of different sources which provides very low static electricity. A static electricity level less than 1.5 kv is recommended (Reference 13) for the control room to ensure avoiding interference with computer equipment and instruments.

Reference 12 provides the basis for testing electrostatic p,ropensity of carpets.

4. The sound level of the alarms should be selected for consistent level of intelligibility above maximum ambient noise level. This will require an increase in the sound level of some of the alarms and a decrease (e.g., H&V) or change in frequency for others. Sufficient levels of signal-to-noise ratio should be achieved in the appropriate octave bands to avoid masking of alarms by both background noise and other alarms while at the same time allowing adequate communication among the operators. To achieve the desired frequency, volume, and modulation of alarm signals, octave band measurements and in-control room testing of alarm combinations should be conducted. Comparison to quantitative standards (Reference 1) and qualitative judgement need to be combined to determine satisfactory alarm. levels. In this regard, a separate review of the alarm system is being performed. Recommendations from that review may include alarms with variable tone and frequency as well as volume control and distinct patterns to achieve the desired intelligibility. In the short term, the low alarm levels should be investigated to determine if temporary modifications can be implemented to increase'the sound levels. The causes may include low design nominal sound l

power levels, incorrect voltage or inefficient mounting (muffled output).

D. Control Room Personnel and Their Activities The concern is whether there are conditions under which the number of people in the control room and their activities could impair the operator's effectiveness.

During power operation on the day shift the typical complement of operators in the control room consists of one shift foreman (SF) and two to three control rocm operators (CRO's).

Auxiliary operators may be called in occasionally for

% -r

emergency procedures as well as other documents required for providing the operational support and diagnosis expected from the support center.

E. Documents The concern is whether the operators can locate and use the procedures, logs, and other documents when they are needed, and further, do this expeditiously and without interfering with other operations. These observations supplement the walk-throughs which examined how procedures are used.

Several documents are located in book shelves in front of or near the center console for quick access by the operators.

These include:

1. Emergency and Abnormal Event Procedures (Series 1202 and 1203:

2. Alarm Response Procedures

3. Technical Specifications

4. Chemistry Results

5. Concentration Curves, Tank Level Curves, and Pump Performance Curves

6. Final Safety Analysis Report

7. Steam Tables

8. Instrument Identification Book

9. Procedure Revision and Sign-Off Book

, 10. Electrical Diagrams and Valve Listings (208, 209, and 307 l

series drawings).

Nearby file cabinets contain the normal operating procedures including a working copy, file copy and "last use" copy. The operators generally make a Xerox copy of the working copy for current use. The file copy always remains in the cabinet.

Flow diagrams (302 series drawings) are located on a table near console left.

The Xerox machine is also used to make copies of data sheets and portions of procedures or documents for the use of

- 30 -

4 auxiliary op2rators to perform operations out in the plant or record data. As such the Xerox machine is an integral part of the document system in the control room.

The shift foreman maintains an operating memo book, and various logs and administrative files. The Special Operating Procedures and Temporary Change Notice (SOP-TCN) log is kept at the shift foreman's desk and signed off by the operators at the beginning of each shift. Operators' log sheets are written up at the switching and tagging operator's desk area or at the console.

Recommendations Accessibility of logs, procedures, and other documents required by the operators during normal and emergency operation of the plant appears to be adequate. However, lay-down space for procedures convenient to the operators at console center is limited. The IBM datalogger and TI computer printers are taking up needed work space at the console. Any rearrangement of the computer terminal area, for example, to add CRT's, should include the provision for substantially more space. In the short term, elimination of the IBM datalogger is recommended both to increase laydown space and as discussed in Section III.C, to reduce the noise level.

F. General Storage and Sucplies The concern is whether necessary supplies te support the control room activities are available when needed without interfering with plant operations.

Light bulbs for the console pushbuttons and indicator lights are stored in the switching and tagging desk along with small office supplies. Supplies for the Xerox machine are stored on the " patio" (a storage area adjacent to the control room) or in the hallway.

, The file cabinets are used for storage of blank forms.

l Equipment for the strip chart recorders, pens, ink, and paper, are stored in desks or on the patio.

l l The operators indicated no significant problems with j availability or access to supplies for the control room.

G. Access to Supervisor's Office l The concern is whether the supervisor can gain access to the control room expeditiously when needed and, conversely,.that s'

. s he can get back to his office so he can communicate with various outside agencies without impacting the operations in the control room.

The supervisor's office is located at the rear of the control room separated by a large window. Two doors, which can be locked from the inside, can be used to access the control room. Communication with the shift supervisor from the control room is accomplished using a telephone or visually through the window. The operators indicated there are no

! problems associated with access to or from the shift supervisor's office. The shift supervisor's office at TMI Unit 1 is very effectively placed since activities at the main console can be easily monitored.

H. Eating Facilities The concern is whether the operators can eat without interfering with the effective control of the plant.

Control rocm personnel usually eat at their work stations in the control room. No eating area is provided. Personnel generally bring their lunch and store it in whatever location is convenient and out of the way in the control room. A small concession operation is run by the instrument shop located adjacent to the control room where operators can get soft drinks, hot dogs, or candy bars; a water fountain is located on the east wall of the control room.

Eating in the control room by the operators does not appear to present a problem. In fact, it seems to be the best thing to do from an operations standpoint because it avoids changing operating personnel in the middle of the shift. If the operators were to leave the control room for lunch, a shift changeover briefing with sign-outs and sign-ins would be required. The operators exercise their own good judgement by not placing food or beverages in hazardous locations.

l I. Restroom Facilities The concern is whether the facilities are adequate to assure that the number of personnel required to support the control room operations will be available in a timely manner.

Two restrooms are located adjacent to the control room, one in each corridor about twenty feet outside the control room doors. A page speaker is located in each restroom. The page speakers can be turned off but the operators indicated that if this occurs they usually can hear other page speakers. Access to and from the restrooms is considered to be satisfacory.

l 1

1

~

l

. 6 J. Tools and Test Eauipment The concern is whether tools or test equipment could distract the operators or interfere with operations because of the manner or location in which they are used or stored.

No tools are generally stored in the control room. When tools or instruments are there, it is usually because the maintenance personnel (I&C or electricians) are working on some piece of equipment. The instrumentation which requires the most adjustment and calibration is the radiation monitoring system. These instruments are located on vertical panel PRF. The presence of I&C personnel in the walkway between console right and the vertical panels impairs the ability of the operators to get to the vertical panels (in particular, ESAS) in the most efficient way (access is still available by going around the left end of the console).

In addition to ladders, equipment, and personnel in the walkway, calibration instruments are also placed on top of the console backboard panels, potentially blocking a view of the vertical panels.

Recommendation The inconvenience afforded by the presence of the radiation monitoring system on panel PRF is not considered serious enough to require immediate replacement and relocation of the instruments. However, when obsolescence dictates replacement of the system a new location for system electrorics, other than the back panels, should be selected. The new system should provide remote readouts placed in locations consistent with the system to which they apply.

K. Control Room Interface with the Rest of the Plant The concern is whether the control room operators have adequate access to the rest of the plant for personnel, documents, and other equipment.

There are three exits from the control room, two on the north wall and one on the west wall. The normally used exits are door, opening the west door leads to the " patio" where strip chart recorder supplies, Xeroxing supplies, and operators' personal items are stored. Re-entry through this door requires a key which may be obtained from the shift foreman or shift supervisor. Otherwise, re-entry to the control room is accomplished by going out a door at the north end of the patio and re-entering through the " key-card" controlled main door.

e

• In the event A failure of the security " key-card" system occurs, someone inside the control room or a guard must be summoned (page system) to gain access to the control room.

This has the potential to slow access to the control room by outside personnel but is not considered significant since the number of operators necessary for plant operation remain in the control room at all times.

Pickup and delivery of control room " mail" is taken care of by the operations secretary.

L. Communication Eculoment There are many cases in which the control room personnel must communicate with personnel inside and outside the plant. The concern is whether this can be accomplished without adversely impacting the control operations. Some aspects of the communications system were evaluated in the course of the walk-throughs. Appendix D provides recommendations and conclusions on the communications system as a result of the walk-throughs.

The communication equipment used by the operators includes telephones, page phones, and radio sets. The telephones are located on the desks in the center of the control room and on the table space around the computer in front of console center. There are nine telephones located in the central area. These include dedicated " hot lines" to the Nuclear Regulatory Commission, Pennsylvania Emergency Management Association, radiological control, the observation center, and Unit 2 control room. Four phones are for general use and for making other required notifications during an emergency condition. These phones are conveniently located for use by an operator at the console, at the shift foreman's desk, and at the switching and tagging operator's desk, or desk where an extra control room operator may be seated. Identifying which telephone is ringing among the array in the control room is usually done by feel since many of them do not have lights; however, one or two do have distinctive rings. Tangling of phone cords occurs but was not mentioned as a problem. Other phone-like communication equipment for internal plant use includes the page phone system and the emergency intercom phone. Radio communication equipment for plant security, civil defense monitoring and for operator communications with Unit 2 and radioactive waste control are located in front of console center.

The operators expressed dissatisfaction with the page system for internal plant communications for the following reasons:

o 6

• 3 channel system is inadequate - there is cross-talk between chanels and it is difficult to get a line

• Unit 2 shares channel 1

• Inadequate mobility in control room - operators are unable to reach all control panels while maintaining page communication Head sets are uncomfortable

• Difficult hearing and understanding page speakers in plant In addition, the page ' system was identified as a significant contributor to unpleasant and unnecessary noise in the control room.

The walk-throughs of the emergency procedures identified a significant communications burden on the control room operators and shift supervisor during an emergency event. The number of phones observed in the control room re-enforces this concern.

The concern is that attention by the most experienced personnel is diverted from those activities relating to proper operation of the plant at a time when needed the most, in order to perform communications of an informative nature to organizations not in a position to actually help resolve a problem.

Recommendations

1. The page system operations procedures and equipment require a complete review to evaluate the requirements of the system and what equipment is available to best meet those requirements. Any modification to the system should directly address the current problems described above.

2. Re-evaluate the external communications requirements placed on the operators and shift supervisor during an emergency event. Determine if fewer calls can be made by the operators and rely more on a communication network outside the control room.

1 I

m,%._.

e 6 mM

3. Each phone should have a flashing light indicator to help the operators identify which phone is ringing as well as prominent color or shape coding to assure that a handset is not " hung-up" on the wrong body.

4. Cords for the page phone handsets located at each end of the console should be lengthened to accommodate the console width. Also, a third handset should be provided at console center. Handsets are also desirable at the Heating and Ventilating Panel, the Liquid Waste Disposal System Panel, and the Vertical Back Panel PCR (accessible to ESAS and radiation monitoring panels).

5. A' dedicated emergency telephone circuit (medical-fire-radiation) should be provided. This "911" function could be fulfilled by adding another channel to the page phone system.

6. A portable radio communcations system is provided for operator use. Such a system could be potentially very useful, as a backup to phone communications, or for long term special purpose test or maintenance operations.

During the review, the operators indicated these portable radio units can not be " keyed" in the control room without risk of inadvertantly tripping the reactor protection system. Portable radio communications should be investigated and unacceptable features corrected.

.- _. 1

'. i IV. REFERENCES

1. Human Enaineering Design Criteria for Military Systems, Equipment and Facilities, MIL-STD-14728, December 31, 1974.

2. The Industrial Environment - Its Evaluation and Control, U.S.

Dept. of Health, Education & Welfare, National Institute for Occupational Safety and Health, 1973.

3. IES Lightina Handbook, Illumination Engineering Society, Fifth Edition,1972.

4. Systcm

Description:

Control Building Ventilation System, Metropolitan Edison Co., Three Mile Island Unit 1, Issue Date: March 26, 1970, Gilbert Associates, Inc.

5. MPR Associates (H. Estrada) letter to GPUSC (Robert Locke) dated July 11, 1980, regarding TMI-Unit 1 Control Room Communications Review Conclusions and Recommendations.

6. Human Factors Review of Muclear Power Plant Control Room Design, EPRI NP-309 March 1977.

7. Facts About Contract Carcetinc, The International Wool Secretariat, LonCon SUlY SAE, November 1975.

8. Flammability Testing for Carpet, I. A. Benjamin and S. Davis, Center for Fire Research, National Bureau of Standards, April, 1978.

9. Telephone and written communication between MPR Associates (L. Buck) and representatives of Milliken Carpets, Bigelow Carpets, Mahafco Industries (Mohawk Carpets), and The Wool Bureau.

10. Floorino Radiant Panel Test 1978, NFPA 233, National Fire Protection Association, Boston, MA. (The comparable ANSI j test is ASTM E 648-78).

11. General Electric Sub-Miniature Catalog 3-6252R1, February, 1975.

12. Electrostatic Propensitv of Carpets, AATCC Test Method 134-1975, American Association of Textile Chemicals and Colorists.

l l

i l

l l

- b

13. Carpeting Guide for Commercial Buildings, reprinted from

" Buildings, the Construction and Building Management Journal" Stamats Publishing Co., Cedar Rapids, Iowa, 1972.

14. NFPA 101 Life Safety Code, 1976, National Fire Protection Association, Boston, MA.

15. Surface Burning Characteristics of Building Material, ASTM E84-796, American Society for Testing and Materials, Philadelphia, PA. (The comparable NFPA standard is NFPA 255).

I

. 6 .

D

. 4

'W""-m-m-9 """" r -- p. _ , _ ' -'

v - - , _ _,,

. h.

I l

I APPENDIX D I

COMMUNICATIONS l

l l

l t

1 I

l i

l l

t

• b CONCLUSIONS AND RECOMMENDATIONS REGARDING COMMUNICATIONS This appendix documents the conclusions of the review team regarding control room communications, which have evolved from its review of control room human factors.

The fundamental purpose of the control room review is, of course, not to r.ddress problems in overall communications.

However, communications were analyzed to the extent that they affect the ability of control room operators (1) to cause operations to be carried out or observations to be made at locations remote from the control room and (2) to receive aural feedback that such operations and observations have been performed. In addition, administrative communications not directly associated with operating the plant may distract control room operators from their fundamental responsibility--

to control the process of power production. Evaluations of the existing communications in this regard were also made.

The conclusions and recommendations which have been drawn regarding communications are based on (1) discussions with the operating staff during and following walk-throughs of operating procedures, and (2) noise level measurements and observations in the present Unit 1 control room, made as part of an environmental survey. Specific conclusions and recommendations are as follows:

1. The present system involves use of a 3-channel page phone for most in-plant communications, including (i) Process control-related communications (ii)

Communications in emergencies such as fire, medical or, unplanned releases of radioactive material (iii) Administrative communications such as maintenance traffic e This system is unsatisfactory on several counts; most l fundamentally, it is necessary for all call channels to be l

monitored continuously in the control room. The review i

l team's observations indicate that the page is so loud that it can mask essentially all other aural communication in the control room while it is in operation. The " normal" day shift background noise was measured at approximately l

l 63 dBA. During page calls the level rose to abodt i 75dBA. There is also a significant risk that messages of importance to plant control will be lost in the noise of l

l

o b general administrative traffic. Accordingly, it is recommended that the three communications functions--

process control, emergency, and administrative--be separated.

2. The process control function should be fulfilled by providing at least one telephone circuit devoted exclusively to plant operation. An additional channel in j

the existing page phone system could be employed.

However, the current "open ended" method of contacting auxiliary operators (Aos) remote from the control room (by means of load speakers dispersed throughout the plant) is unsatisfactory. Instead, the review suggests that a system along the following lines be investigated.

A beeper aould be provided to each auxiliary operator. Each beeper would be such that a specific AO could be selectively contacted by a control room operator or shift foreman. The beepers would be equipped with automatic, " signal received" retransmission capability. In this way appropriate action could be taken if, following an attempt to contact an AO, he did not call back on the operations telephone circuit.

3. Specific locations for phones on the operations circuit Of need to be carefully reviewed with the operating staff.

particular concern is the location of permanent instruments or jacks for portable instruments in the reactor building.

During the walk-through of the plant heatup procedure there were several operations (venting, balancing of injection flows to coolant pump seals, etc.) where operators indicated that the ability to communicate back were less than satisfactory.

4. The arrangement of communications instruments (used for plant operations) on the main control console is not satisfactory.

Handsets are provided at each end of the console but the cords are too short. If an operator picks up the instrument at console left for some continuing communication function, he is l

l not able to carry it to console right to perform an operation there. The review team recommends that the cords for handsets at either end of the console be lengthened to accommodate the console width. Also, a third handset should be provided at console center. Finally, handsets at the following control room locations are also desirable:

Heating and Ventilating Panel Liquid Waste Disposal System Panel Vertical Back Panel PCR (accessible to ESAS and radiation monitoring panels) l

> 1 To allow these handsets to be used effectively, the operator should be able to hang up an instrument at one location and pick up an instrument at another without losing the party on the other end.

is for

5. Present practice, upoi reactor trip or turbine trip, the shift foreman to announce this event over the page phone loudspeaker systems. This announcement is intended to initiate specific responses by Aos (e.g. , starting of tne auxiliary boiler). The review team understands that there have been instances where the shift foreman has failed to make the announcement, probably because of the pressure of other responsibilities. There have been other occasions where Accordingly, the the review AOs have not heard the announcement.

team suggests that consideration be given to having a distinct tone, sounded either on the loudspeaker system or on beepers or both, which is initiated automatically upon these two trips.

6. The present practice of monitoring administrative page phone traffic on a loudspeaker audible to all operators in the control room should be stopped. However, the review team considers that the control room operator charged with the responsibility for blocking and tagging should monitor thisWe traffic in a way which does not distract other operators.

suggest that he be provided with a single earpiece headset for this purpose. Monitoring of this same trafficFinally, in the shift the supervisor's office may also be appropriate. shift foreman should a traffic, possibly by means of a low volume directional loudspeaker at his desk.

7. A dedicted emergency (medical-fire-telephone circuitThis "911" function could be radiation) should be provided.

fulfilled by adding still another channel to the existing page phone system.

( The control room, because it is continuously manned, is t

necessarily the focal point of communications in emergencies l

of this type. Therefore, all traffic on the emergency phone

! circuit shculd be continuously monitored by loudspeakers in t

the control room. The ability to speak on the emergency circuit should be provided on all instruments in the control room and the shift supervisor's office.

8.

The review team understands that the control console operators have the ability to monitor the (fire, security radio, as well as rescue, etc.). The external local emergency radio conditions under which the control room operator needs to monitor these radios should be limited and spelled out.

l

r .

• h

9. Because of the large number of telephones in the control room, the location of sound and differences in ring cannot be counted upon to distinguish which phone is ringing. All telephone instruments should have a visual indication of ringing (flashing light) as well as prominent color or shape coding to assure a handset is not " hung up" on the wrong body. The number of phones which ring should be severely limited.

10. Plant operators indicated that the general quality of the page transmission was poor and thatThe in particular review teamthey are observed, subject to substantial cross talk.

in the turbine hall, for example, that the page calls are often unintelligible. It is also noted that frivolous use of the page phones, i.e., hysterical laughing, " mad bomber" I

whistles, etc., is prevalent. Appropriate displinary and educational actions to stop this practice should be carried i out.

11. A portable radio communications system is provided for operator use. Sach a system could be potentially very useful, as a backup to phone communications, or for long term However, the l special purpose test or maintenance operations.

review team was informed that these portable radio units cannot be " keyed" in the control room without the risk of In addition, the inadvertently tripping reactor protection.

use of the existing system for Unit 2 operations severely i

restricts its availability. Portable radio communications chould be investigated and unacceptable features corrected.

i l

1 l

l l

L_

\

i k

E I

I l

L -.

4 APPENDIX E EQUIPME!T MAINTENANCE EXPERIENCE I

\

l l

i l

l l

l l

l

h TMI UNIT 1 CONTROL ROOM CONSOLE AND PANEL EQUIPMENT MAINTENANCE EXPERIENCE I. Purpose and Introduction This appendix reports the results of a review of the l

maintenance experience with the equipment mounted in l

the console and panels in the TMI Unit 1 Control Room. The equipment includes various switches, meters, indicator lights, strip chart recorders, annunciators, and some other more specialized controls and displays. The purpose of this review was two-fold:

first, to establish what, if any, equipment in the control room has required a great deal of maintenance, and second, to establish whether modifications to the consoles and panels rliould utilize essentialy the same type components as currently used.

l l

l i

1 I

l l

l l

l

. L II. Summary, Conclusions, and Recommendations Except for two general areas (see below) the controls and displays in the TMI Unit 1 Control Room have required very little maintenance. Consequently, it is recommended that no major changes in type of equipment or their manufacturers be made and that any new equipment be selected, where practical, to be similar or identical to that which has already given good service.

The two types of egaipment which account for the overwhelming majority of the maintenance in the TMI Unit 1 Control Room are the strip chart recorders and the radiation monitoring equipment. Although the plant staff appears to be coping with the maintenance burden caused by this equipment, there are significant incentives to reduce maintenance in the control room to a minimum. Maintenance operations inherently disrupt the normal day-to-day operations, change traffic patterns, generate dirt, and increase the risk of spurious signals and false trips.

It is not considered that either the recorder or radiation monitoring problem represents a condition requiring a short term solution. However, because of the substantial lead time in design and testing involved in making the improvements, work in these areas should be initiated as soon as TMI Unit 1 is back in operation.

The general character of the two problems and a recommended approach to their solution are summarized below:

r f

• Strip Chart Recorders - The electro-mechanical features of these devices have had a hostMany of of problems: inking, paper transport, etc.

them are difficult to read and some are obsolete These are problems which can only be designs.

corrected by completely new units. However, replacement of the units should proceed in a careful, methodical fashion, i.e., develop good specifications which include both functional and human factors requirements, survey industry experience, obtain and test out pilot models.

When designs have been proven by test and experience, then the control room units can be replaced. As an alternative to electro-mechanical recorders consideration should be given to the use of CRT's with hard copy

3 1

. W capability and in combination with the plant computer. Again, as with recorders, this course should be thoroughly checked for reliability and human factors before it is adopted.

• Radiation Monitorina Eauiement - Presently this equipment is designed so that the electronics packages and the displays and controls presented to the operators are in a single location on the panels. Maintenance of this equipment requires access mainly from the front of the panel. Thus, as maintenance personnel perform work on their equipment, they partially block the view of the control room operators to the displays as well as partially block the aisle and make access to controls on the panel more difficult. Due to the nature of the monitoring equipment and the frequency of calibration work, the above described conditions exist quite frequently. In anticipation of the eventual need to replace the present equipment, specifications and designs should be developed for a radiation monitoring system where only the remote displays portion of the monitoring system would be placed on the panel and the electronics packages would be placed elsewhere. This would permit the maintenance and servicing of the electronics, which require the bulk of the attention, to be performed with a minimum of interference with the functions of the r

control room operators.

I l

t I

I I

l t

. w III. Discussion A. Maintenance Records Maintenance records are kept on a system basis.

For example, two controls which are identical but which are in different systems would have their records in different files. It was concluded from discussion with plant personnel that there was no practical way, within a reasonable time, to extract the records for those portions of the systems which were in the control room. In lieu of this, I&C and electrical maintenance personnel were interviewed to establish what components have required major maintenance. Although not precise quantitatively, the observations paralleled those of the control room operators as to what equipment has required maintenance.

B. Stric Chart Recorders A number of variables are presented to the operators using strip chart recorders. Such i recorders serve one or both of two functions:

a. Presentation of rate of change (trend) information to an operator. Such information l

provides anticipatory feedback to the l

operator and assists him in providing stable effective control of the process variable.

! b. Record keeping - legal or engineering l

requirements may dictate retention of trend

! information in permanent form. In the present TMI-l system, these recorders are a major cause of maintenance activities.

Problems have occurred with all types; l- however, the personnel were of the opinion that their major problems have been with the Bailey recorders on the console and the GE recorders on PCL. The Leeds and Northrup and thc Foxboro recorders were judged to be somewhat less troublesome, but none was trouble free. In the case of the GE units the maintenance is further complicated by.the l

obsolescence of the units and the difficulty of obtaining spare parts.

l The problems were usually of mechanical or I electro-mechanical origin, i.e., trouble with L

o .

inking systems and paper transport. Field modifications have been made to some units; however, troubles persist. It should be noted that the human factors aspects of recorder maintenance are not well conceived, i.e., they are hard to work warh on.

It should also be poin'.ed.out that many of these recorders have relatively poor human factors designs from an operator's view point: difficult to read scales, limited visible trend time, too compressed a time scale (so that quantitative rate of change information cannot be addressed), and difficult-to-distinguish printed points. The Bailey recorders also suffer from a particularly troublesome problem: the recorder printer is occasionally prevented from bottoming out by a mechanical interface with the ink-sack. The process variable appears to be upscale when in fact it is at the bottom of the scale.

These kinds of problems do not appear to be amenable to piecemeal solutions, i.e., in most cases the fundamental design is at fault and no reasonable modifications are likely to improve the situation very much. It may be possible to reduce the use of strip chart l

l recorders by the use of CRT displays and computer trending. However, the degr3e to which this can be done is currently uncertain.

I It is recommended that planning be based on the eventual replacement of all the current recorders, with priority to replacement of the Bailey and GE units. In parallel, an effort to evaluate CRT's and computer systems should go forward. Since the staff is currently able to cope with the maintenance burden and since it is necessary to test and prove out any new units before installation, the replacement will have to take place over a fairly long term, i.e., after the restart of Unit 1.

The recommended aproach to the replacement of the strip chart recorders would involve:

. w r

• The preparation of specifications for the various recorders to be replaced (these would cover human factors as well as functional requirements).

• The performance of an experience survey to ascertain whether, in the power i

industry or elsewhere, reliable, effective recording equipment is currently in service.

• The procurement and testing of lead units of the various types needed based on the above specifications and survey.

• The installation and use of " pilot" models in various locations in the plant, but not '.n critical locations such as the control room, to obtain first hand practical experience.

After these steps are successfully completed, then the actual replacement of the existing units can be effected with little risk of problems with the new units.

C. Radiation Monitorina Eauicment i

The I&C personnel confirmed the observations of the control room operators that there is maintenance work on the radiation monitoring equipment on PRF on virtually a daily basis. This in itself, would not be a human factors problem in the control room except for the fundamental arrangement and location of the equipment involved. The radiation monitoring equipment differs in basic arrangement from most of the other items on the panels in that it is more than just displays and controls, it includes packages of electronic components as well. Furthermore, i access is gained to the equipment largely from the front of the panel. As a consequence, the aisle between the radiation monitoring panel (PRF) and the main console (CR) is often partially or completely blocked by technicians and equipment.

The operators and technicians are very aware of the problems and some ways to facilitate the work have evolved.

(

t A Y%

F l

l

1

- 1

% l m - v.

APPENDIX F I

SUPPLEMENTARY E'INDINGS l

1 l

t I

I I

l t

l l

l l

l r

i i

s ame a

l .

e ~

s SUPPLEMENTARY FINDINGS A number of shortcomings were uncovered during the walkthroughs and by the separate review of individual controls and displays which do not fit logically into the format of Appendix B. This appendix documents these findings with recommended corrective action.

1. The circuit breaker controls for the electrically driven emergency feedwater pumps are confusingly arranged (controls for A and B pumps, from alternate power supplies, are in two separate locations). This can be corrected by relocating both controls for A pump together and both controls for B pump together, while providing a suitable fire barrier between each pair for each pump.

2. A number of motor operated valves are equipped with a three button control arrangement (open-close-stop). By means of the stop button, a valve can be stopped in an intermediate position for purposes of throttling the flow through it. If the operator wishes to reverse the direction of travel of such a valve in mid-stroke -- to close it after he has started to open it, for example -- he must first stop it, by depressing the stop button. If he fails to do so -- if he presses the close button after pressing the open button --

he will trip the circuit breaker for the valve operator, i

thereby losing his ability to reposition the valve from the control panel. A remedy for this shortcoming can be effected by:

a. positioning the stop button between the open and close buttons, to avoid inadvertently pressing a button which could trip the breaker and to provide a visual reminder of the need to employ the stop button, and l

I

b. providing spring loaded transparent plastic covers over the open and close buttons, to ensure that only one can be pressed at a time and that such action is deliberate.

3. The array of reactor coolant temperature and temperature difference displays, and the. instrument selectors associated with these displays on console CC backboard is confusing.

For example, coolant loop delta-T's (hot leg minus cold leg temperatures) are displayed on a dual scale vertical meter adjacent to a visually similar vertical meter displaying delta-T , the temperaEures. These difference in loopdelta-T variables, A and loop and B cold leg-are delta-Tc, completely different in their nature: the former is indicative of loop power / flow ratio; the latter is a measure of the difference in energy flow from the two steam l l

l l

1 i

i

\

a u

'T generators. A third display of the reactor delta-T, the average of loop A and loop B delta-T's is in a different location, some distance removed from the associated loop A and loop 73 delta-T's.

These problems can be remedied by interchanging several of the displays and selectors, to obtain a more sensible arrangement.

4. The source and intermediate range neutron level and startup rate instruments, grouped in two clusters on console CC, are arrayed differently. The source range instruments are grouped as follows: Channel A level, Channel B level, Channel A rate, Channel B rate. On the other hand, the intermediate range instruments are grouped: Channel A level, Channel A rate, Channel B level, Channel B rate. .The source range arrangement is superior; the two level instruments are used to check one another; likewise, the two rate instruments. The control parameters are, in effect, average level and average rate. The problem can be solved by rearranging the intermediate range instruments.

5. The differential pressures across the reactor coolant pump primary (No. 1) seal and the pump's thermal barrier (labyrinth) are displayed, for each pump on a dual scale vertical meter (four meters, one per pump). The differential pressure ranges for the two variables are different, resulting in a confusing common scale for each dual meter. More important, the physical significance of the two readings -- No. 1 seal delta-p, and labyrinth delta-p, are very different and not necessarily directly associative. A more easily and quickly interpretable information arrangement would group the four No. 1 seal delta-p readings together, and the four labyrinth delta-p readings together.

6. The water flow to and from the reactor coolant pump seals is filtered on each end of the circuit, and the differential pressures across each filter are displayed. The displays are presented on a dual scale vertical meter. The left-right order of the displays opposes intuition; the seal return filter delta-p is on the left, the seal injection filter delta-p is on the right. This shortcoming can be remedied by reversing the displays.

7. The labeling of certain pushbuttons associated with certain necessary manual operations of engineered safety functions is confusing. For example, the pushbuttons which enable the low reactor pressure-actuated engineered safety features --

1 l

s these buttons must be pushed during a startup after pressure is raised above 1600 psig -- are labeled byoass reset.

Improved labeling, which more precisely describes the consequences of the operator action, will remedy this shortcoming.

8. Six pushbuttons are provided by means of which the operator can manually initiate certain sets of engineered safeguards. The labeling of the pushbuttons is inadequate; the consequences of depressing a specific pushbutton, (e.g.,

what isolation actions take place, whether coolant injection l is initiated) is unclear. Improved labeling will remedy this.

9. Most controllers of the Integrated Control System are equipped with small vertical meters. These meters are i provided with two-position selector switches. Typically, in l one of the two positions, the meter indicates the controller l output -- the demand signal fed to a downstream controller, valve positioner, or other device. The second position of the selector is most often used to cause the meter to display a signal which will provide orderly ("bumpless")

transfer from manual to automatic control, for the specific analog control loop governed by the controller. But the selection switch positions are confusingly labeled: the l controller output position is labeled "POS", presumably meaning " position", and the manual-auto transfer position is labeled " MEAS VAR", meaning " measured variable". This deficiency can be corrected by more specific labels tailored for each controller.

l

10. On the Liquid Waste Disposal System Panel the selector j switches which line up valves for directing reactor coolant i

to and frca Bleed (water storage) tanks A, B and C are handed opposite to other displays and controls associated with these tanks. The order of tank displays is A,B,C; switch positions are C,B,A. There is a possibility of i inadvertently aligning the wrong tank to receive letdown coolant or to p ovide makeup coolant. This shortcoming can be remedied by reversing the handing of the switch (rewiring, and restructuring the detent) . Improved switch labeling and a revised style knob could be incorporated to prevent confusion resulting from the change.

11. Pushbuttons for selecting which two of four steam generator startup range level instruments are to be displayed on the startup range level meter are located adjacent to the operating range level meter. They are at some distance i

from the startup range level meter. This shortcoming can be l corrected by interchanging the selector pushbuttons with another level display.

l l

.