ML20205G606

Emergency Operating Procedures Generation Package Implementation Audit Rept,North Anna Power Station,Units 1 & 2

ML20205G606
Person / Time
Site:	North Anna
Issue date:	08/31/1986
From:	NRC
To:
Shared Package
ML20205G610	List: ML20205G606
References
TASK-1.C.1, TASK-TM GL-82-33, NUDOCS 8608190564
Download: ML20205G606 (73)

Text

p-U ENCLOSURE AUGUST 1986 EMERGENCY OPERATING PROCEDURES GENERATION P CKAGE IMPLEMENTATION AUDIT REPORT NORTH ANNA POWER STATION, UNITS NO. 1 AND NO. 2 VIRGINIA ELECTRIC AND POWER COMPANY OLD DOMINION ELECTRIC COOPERATIVE -

DOCKET N05. 50-338 AND 50-339 D

e

.- ,-.,--% y.-. , e--w,e w- ------==--<e-- *-o-g-, ww += - - -* **- - r = *1"-

_(

6 '

EXECUTIVE

SUMMARY

INTRODUCTION Following the Three Mile Island (TMI Regulation developed the "TMI Action) Plan" (NUREG 0660 ac -

required licensees of operating reactors to reanalyze transia ,

also required the NRC staff to develop ents

.. The plan a and accidents expanded L(Item I.C.9). efforts NUREG-0899in the writing, reviewing, and monitoring n egrated and Operating Procedures", rep, resents the NRC staff's lo" Guideli upgrading (PGP) to prepareE0Ps E0Ps. and describes the use ng-term of aprogram " Procedures for G on Package"-

Letter 82-33, Response Capability." " Supplement 1 to NUREG-0737 - RequirSubm c guide, a discussion of the program for verification , a writer'sand procedures, and a description of the operator upgraded E0Ps. training ation gram for the of the pro Audits of the emergency operating procedures gene process that are of are high undertaken quality to determine whether the PGP apration purpose is to determine w, hat, if anyusable, and technically accurate.pro quality E0Ps are being developed .

nsureby the indus that high REVIEW PROCESS / METHOD An audit of the North Anna PGP implementation prog Battelle Human Affairs Research of 1986 three maj(or a sitetasks:

visit was made on May 5-8,1986). e a oratories Center (PNL) and (HAR The a,udit consisted ofdurin o A desk review was conducted on a sample softo the North determine if the Westinghouse Owner's Group (WOG) Eme Guidelines rgency Response o the guidance (ERGS) were adapted appropriately and ,

provided in the North Anna writer's guide o North Anna staff were interviewedon,about and training programs for E0Ps validation,the ve determine whether the sample of E0PsThe ere used to North A emergency and were usable by the oper,ators.as written, would mitigate an FINDINGS Desk Review.

ERGS to determine technical accuracy and a compa e WOG North Anna writer's guide to determine written y. accurac e E0Ps with the The technical review involved a comparison of the E0Ps discrepancies following four mainbetween areas: the E0Ps and the WOG with the WOG ERGS ERGS. can Thebe cl assified into the i

.(

o Location of Notes and Cautions o Deletion / Revision of ERG Steps o Specification of Equipment / Controls / Indications o Procedure Transitions.

The comparison of the sample of the E0Ps with the North Anna writer's guide

, format and content instructions indicated that the sample of E0Ps differed from the instructions in eight areas:

o Incorrect use of Notes and Cautions o Incorrect use of logic terms or simple action steps where logic ste

- should be used o Steps that contained more than one action step o Incorrectly and inconsistently written referencing and branching instructions o Use of undefined action verbs o Use of undefined abbreviations and acronyms o Use of vague terms, such as "if required" o Other differences dealing with punctuation, checkmarks, and miscellaneous misspelling and typographical errors.

Verification Program. Verification is defined by Nortli Anna to be a determination that the E0Ps followed the technical guidance in the WOG ERGS and that the E0Ps are written in accordance to the North Anna writer's guid

. Instructions. The audit team determined the following important points:

o The PGP described a team approach to verification, whereas the verification was conducted by a Shift Technical Advisor (STA) in addition to his normal duties, o The checklist that the STA had available to conduct the verificatto '

was not thorough and cid not include items listed in the PGP.

o The large number of differences found in the desk review indicated that the verification was not being conducted effectively.

Validation Program. Validation is defined by North Anna to be a determinat

, that the procedures are usable by the operators and that the procedures, if.

l followed, will correctly mitigate an emergency. The audit team determined

! following important points about the validation program:

o The PGP described a team approach to validation, whereas the i validation program was conducted by a Senior Reactor Operator (SRO) observing the use of the procedure during a requalification trainint session on the simulator.

o The validation checklist did not include all of the items that were i listed in the PGP (most notably, no usability evaluation was done),

and there was no formal mechanism for receiving feedback from the training staff, o The E0P validation had only employed single failures, whereas the PC i specified that multiple failures (simultaneous and sequential) woulc be used to validate the E0Ps. .

o Simulator results indicated that the validation was not being conducted effectively. .

11 I

-_(

8 Training Program. Training on the E0Ps was found not to comply with what hac been specified in the PGP. The following items were noted:

o Classroom training on philosophy and technical basis had been provide two years ago by-Westinghouse and no operator evaluation was conducted. .No additional training is planned in this area, o The projected implementation date for the E0Ps was -June 30, 1986. It is highly unlikely, given the proposed training schedule, that the operators could be trained on all the procedures on the simulator prior to June 30. ,

o North Anna staff have not yet determined what kind of continuation '

training will be given on the E0Ps.

~

i CONCLUSIONS North Anna PGP Implementation Process. From the above findings the audit tea.

concludes that the North Anna PGP implementation process does not follow the

, implementation program delineated in the PGP. Because of this, the procedure i

presently contain numerous technical errors and human factors weaknesses that would lead an operator to unsuccessfully handle an emergency if the procedure were followed verbatim.

PGP Implementation Process Audits. This was the fourth audit of E0Ps. The problems found with the North Anna procedures are quite typical of the problems found with the procedures at the other audited plants. Thus, the audits to date have shown that the existence of an acceptable PGP does not i necessarily result in E0Ps that are of high quality, usable, and technically >

accurate.

, PGP Audit Process. This audit went much more smoothly and allowed the collection of much more programmatic data than previous audits. This was due i to using checklists (protocols) for gathering information about the plant's i

werification, validation, and training programs; using a checklist for evaluating the outcome of the simulator exercises; preplanning the site visit

with allowance of adequate time to accomplish the necessary tasks; and the experience gained by the auditors from previous audits.

l RECOMMENDATIONS i North Anna PGP Implementation Process. It is recommended that North Anna re-evaluate the PGP implementation process that they are using. The present process does not follow the outline of the process provided in the-PGP, and

( the audit team believes that this is the reason why the procedures are not ye adequately written. Thus, it is also recommended that the E0Ps that are already written not be placed into the control room until the upgraded PGP l program is implemented.

PGP Implementation Process Audits. Based on the North Anna audit and the previous three audits, the following recommendations are made:

o NRC should " encourage" each utility

• to implement their E0Ps in

! accordance with their PGP. This " encouragement" can be in the form o-i reduced audit frequencies or fines for nonconformance.

o NRC should inform plants that submittal of PGPs and E0Ps copied

directly from the INP0 Writer's Guide and vendor generic guidelines it t

generally not sufficient to fulfill NRC requirements.

o INP0 or NRC should increase the human factors awareness at utilities

. through seminars or regior.21 meetings.

iii

t PGP Audit Process. i methodology used It isinrecommended this audit--i.e.,that usefuture the protocolsaudits follow developed the f simulator exercises and verification, validation, and addition or thetraining p portion o,f the audit.it is recommended that a protocol be rough . In developed I if they have participated in a previous auditThe number of members o . 1 emergency procedures should be provided for review.a plant's preparation and conduct of fewer simulator exercises..This would also allow the should allow sufficient time for a meeting of the audit team (NRC

, technical expert, human following factors the site visit. expert) prior to the site visit and meeting a debrie 9

i D

tv

s TABLE OF CONTENTS EXECUTIVE

SUMMARY

............................i i

1.0 INTRODUCTION

............................ 1 2.0 REVIEW PROCESS / METHOD . . . . . . . . . . . . . . . . . . . . . . . . 1 7.1 Desk Review. . . . . . . . . . . . . . . . . . . . . . . . . . . 2

7. 2 Review of Verification, Validation, and Training Programs. . . . 2 2.3 Exercise of Procedures . . . . . . . . . . . . . . . . . . . . . 2 2.3.1 Simulator . . . . . . . . . . . . . . .-. . . . . . . . . 2 2.3.2 Control Room. . . . . . . . . . . . . . . . ... . . . .-. 3 3.0 FINDINGS. . . . . . . . ... . . . . . . . . . . . . . . . . . . . . . 3 3.1 North Anna PGP Implementation Process. . . . . . . . . . . . . . 3 3.1.1- General Findings. . . . . . . . . . . . . . . . . . . . . 3 3.1.2 Specific Findings . . . . . . . . . . . . . . . . . . . . 4 3.1.2.1 Comparison of E0Ps with Technical Guidelines . . 4 3.1.2.2 Comparison of E0Ps with the Writer's Guide . . . 4 3.1.2.3 Comparison of the Verification / Validation Program with the Program Description in the PGP. . . . . 6 3.1.2.4 Comparison of the Training Program with the

, Program Description in the PGP . . . . . . . . . 7 3.1.2.5 Simulator Exercises. . . . . . . . . . . . . . . 7 3.1.2.6 Control Room Walkthrough . . . . . . . . . . . . 8 i

3.1.3 Summary of North Anna PGP Audit Findings. . . . . . . . . 8 3.2 PGP Audit Process. . . . . . . . . . . . . . . . . . . . . . . . 9

4.0 CONCLUSION

S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 L

l 4.1 North Anna PGP Implementation Process. . . . . . . . . . . . . . 9 l 4.2 PGP Implementation Process Audits. . . . . . . . . . . . . . . . 9 l 4.3 PGP Audit Process. . . . . . . . . . . . . . . . . . . . . . . . 9 5.0 RECOMMENDATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . 10 5.1 North Anna . . . . . . . . . . . . . . . . . . . . . . . . . . 10 5.1.1 North Anna PGP Implementation Process . . . . . . . . . 10 5.1.2 North Anna Procedures . . . . . . . . . . . . . . . . . 10 i

5.2 PGP Implementation Process Audits. . . . . . . . . . . . . . . 10 i

5.3 PGP Audit Process. . . . . . . . . . . . . . . . . . . . . . . .

11 AttachmentA--AuditTeamMembersandSiteNtroductoryandExit Briefing Attendees . . . . . . . . . . . . . . . . . . . . A.1 l_ Attachment B--Desk Review of E0Ps. . . . . . . . . . . . . . . . . . . . B.1 l

i Attachment C--Verification / Validation Checklist. . . . . . . . . . . . . C.1 Attachment D--Training Checklist . . . . . . . . . . . . . . . . . . . . D.1 Attachment E--Simulator Exercise Checklists. . . . . . . . . . . . . . . E.1 Attachment F--Control Room Walk-Through Checklist. . . . . . . . . . . . F.1

! V

t

1.0 INTRODUCTION

I Following the Three Mile Island (TMI) accident, the Office of Nuclear Reactor Regulation developed the "TMI Action Plan" (NUREG-0660 and NUREG-0737), which requined licensees of operating reactors to reanalyze transients and accidents and to upgrade emergency operating procedures (EOPs) (Item I.C.1). The plan also required the NRC staff to develop a long-term plan that integrated and ,

4 J expanded efforts in the writing, reviewing, and monitoring of plant procedures !

(Item I.C.9). NUREG-0899, " Guidelines for the Preparation of Emergency Operating Procedures", represents the NRC staff's long-term program for upgrading E0Ps and describes the use of a " Procedures Generation Package" (PGP) to prepare E0Ps. Submittal of the PGP was made a requirement by Generic 4

Letter 82-33, " Supplement I to NUREG-0737 - Requirements for Emergency Response Capability." Each PGP is to include technical guidelines, a writer's guide, a discussion of the program for verification and validation of the procedures, and a description of the operator training program for the upgraded E0Ps.

Audits of the emergency operating procedures generation package implementation ,

process are undertaken to determine whether the PGP approach results in E0Ps that are of high quality, usable, and technically accurate. A secondary

purpose is to determine what, if any, changes need to be made to the NRC staff's program for review of the PGP implementation process to ensure that high quality E0Ps are being developed by the industry.

This report describes the audit of the Virginia Electric and Power Company PGP implementation plan for the North Anna Power Station. Section 2 of this report discusses the methodology used to assess the application of human factors principles and to determine the technical accuracy of the procedures that were developed in accordance with the approved PGP. Section 3 describes' the findings of the audit in terms of the North Anna PGP implementation process and the NRC staff PGP audit process. Sections 4 and 5 provide conclusions and recommendations, respectively, regarding the North Anna PGP implementation process, the PGP implementation processes at the plants audited to date, and the NRC staff PGP audit process.

2.0 REVIEW PROCESS / METHOD l The audit of the North Anna PGP implementation program was conducted by the NRC, with assistance from Battelle Pacific Northwest Laboratories (PNL) and

, Battelle Human Affairs Research Center (HARC) personnel, during April and May

! of 1986 (a site visit was made on May 5-8,1986). Audit team members and

attendees at the site introductory and exit briefings are listed in Attachment A. The audit consisted of three major tasks. First, a desk review was I conducted on a sample of the North Anna E0Ps to detemine if the Westinghouse l Owner's Group (WOG) Emergency Response Guidelines (ERGS) were adapted appropriately and if the E0Ps followed the guidance provided in the North Anna writer's guide. Second, North Anna staff members were interviewed about the i verification, validation, and training programs for E0Ps using interview '

protocols. Third, using the North Anna simulator and a typical operating crew, various simulated emergencies were conducted to detemine the usability of the E0Ps and whether the E0Ps, as writt.en, would mitigate several emergencies. The third step also used a control room walk-through to determine whether the control and display nomenclature in the E0Ps matched that in the control room. These three' tasks are discussed in more detail in i the pages following.

1

4 t

2.1 Desk Review The desk review consisted of a comparison of the E0Ps against the WOG ERGS and the North Anna writer's guide, and a concurrent evaluation of the adequacy of the E0Ps based on the reviewers' professional expertise, work experience and judgment. The same seven procedures were used for the two different desk-top reviews:

o EP-0 Reactor Trip or Safety Injection o EP-1 Loss of Reactor or Secondary Coolant o EP-2 Faulted Steam Generator Isolation o EP-3 Steam Generator Tube Rupture o ES-1.3 Transfer to Cold Leg Recirculation o FRP-S.1 Response to Nuclear Power Generation /ATWS o FRP-H.1 Response to Loss of Secondary Heat Sink.

During the desk review, the E0Ps were compared for consistency with Rev.1 (HP) of the WOG ERGS, noting the major differences between the ERG base plant and North Anna. This review was conducted by two NRC-certified operator license examiners. These examiners have conducted written and operating (simulator and oral) examinations at numerous PWR (Westinghouse) plants including North Anna. -

The E0Ps were also reviewed to determine the extent to which they were written following format and content instructions in the North Anna writer's guide.

This review was conducted by social psychology researchers with expertise in human factors and several years of experience working on NRC projects related to reactor operations.

2.2 Review of Verification, Validation, and Training Programs Before conducting the site visit, protocols were developed to guide interviews regarding the implementation of the verification, validation, and training prcgrams. While at the plant, operations and training personnel were questioned about implementation of the programs, so that a comparison of the PGP program could be made to the program actually implemented.

2.3 Exercise of Procedures The procedures were exercised using the two techniques described below.

2.3.1 Simulator The first type of exercise of the procedures was conducted on the North Anna plant-reference simulator. The exercise had three objectives:

o to determine whether the E0Ps are usable for the given level of qualifications, training and experience of the operating staff o to determine whether the E0Ps are compatible with the minimum number, qualifications, training and experience of the operating staff o to determine whether the E0Ps here able to effectively mitigate various emergency situations. ,

Five simulator exercises were developed to cover the subset of E0Ps that had been reviewed for the audit:

2

1 l

'f )

o Reactor Trip with ATWS o Steam Break Inside Containment o Steam Generator Tube Rupture with Loss of Reactor Coolant  ;

o Loss of Heat Sink with Bleed and Feed Required l o LOCA Outside Containment. l These scenarios were chosen because they exercised a major portion of the E0Ps under review, they covered a variety of emergency situations, and they highlighted weak or questionable areas of the E0Ps uncovered during the desk review.

In additian to these scenarios, one simple exercise was run first as a

" warm-up" and an additional exercise was run at the end at the request of the r Region II personnel who were watching the exercises.

Checklists were used to evaluate the simulator exercises. Each auditor answered the questions in the checklist for each scenario based on the actions of the operator he observed.

2.3.2 Control Room The second type of exercise of the procedures was conducted in the control -

room. The exercise had two objectives:

o to determine whether the controls / displays that are identified in the E0Ps as being in the control room are indeed there o to determine whether the control / display nomenclature described in the E0Ps was comparable to that in the control room o to detemine whether the displays could be read to the accuracy Y

desired in the E0P.

In order to meet these objectives, a control room check of all nomenclature and accuracy requirements in EP-0 was conducted with the assistance of an operator.

3.0 FINDINGS Findings regarding the North Anna PGP implementation process and findings regarding the PGP audit process are described in the following sections.

3.1 North Anna PGP Implementation Process General and specific findings regarding the North Anna PGP implementation process are presented in the following sections.

3.1.1 General Findings There were three general findings regarding the actual development and use of the North Anna E0Ps and that proposed in the PGP. First, the PGP was developed by corporate staff and not by plant staff who were to be involved in writing the procedures. This caused some problems during the PGP review process. Second, the writer's guide in the PGP was actually written for the Emergency Plan Implementing Procedures (EPIPs). The North Anna E0P procedure-writing staff found the writer's guide lacked guidance regarding some femat and content issues and discussed the need to develop a plant-specific E0P writer's guide with the audit team. Third, the E0Ps are planned to be implemented in the control room using a " reader-doer" concept.

That is, one person (the " reader") is to read the procedures, asking for data 3 -

I

g, when needed and directing actions when the procedures indicate to do so. The licensed operators (the " doers") in the control room respond to the requests for information or for control actions. Because of staffing considerations, the reader is not necessarily a licensed control room operator, and therefore may not necessarily have had training on all of the E0Ps that may be required to adequately use the E0Ps to mitigate an emergency.

/

3.1.2 Specific Findings A summary of the findings from comparisons of the E0Ps with the technical guidelines and the North Anna writer's guide (i.e., desk review), and the

' review of the verification, validation, .and training programs (i.e., site visit),.are presented in the following sections.

3.1.2.1 Comparison of E0Ps with Technical Guidelines The technical review involved a comparison of the E0Ps with the WOG ERGS. The discrepancies between the E0Ps and the WOG ERGS can be classified into four main areas. The specific comments are provided in Attachment B. The following is a summary of the major issues for each of the headings.

Location of Notes and Cautions. Notes and Cautions are to be placed -

immediately prior to the step to which they apply or, if appropriate, on the procedure fold-out page. Notes and cautions were often placed after the step to which they applied, not included on the fold-out page, used unnecessarily, or not used when they should have been.

Deletion / Revision of ERG Steps.' Many ERG steps were not included in the North Anna E0Ps or were revised to the extent that their content was in question.

Sufficient justification for these deletions / revisions was rarely documented.

Specification of Equipment / Controls / Indications. The ERGS required input of plant specific information in many of the steps. The North Anna E0Ps provided Tome, but not all, of this plant specific information.

Procedure Transitions. Transitions to subsequent procedures within the North Anna E0Ps were often made earlier or later, or were made based on different criteria, than the corresponding transitions within the ERGS without providing technical justification.

3.1.2.2 Comparison of E0Ps with the Writer's Guide The human factors review involved a comparison of the E0Ps with the North Anna writer's guide. The discrepancies between the E0Ps and the writer's guide were grouped into eight main areas. The specific comments are provided in Attachment B. The following is a summary of the major issues for eacn of the headings, listed in descending order of importance.

Notes and Cautions. As defined in the writer's guide, Cautions are to describe a hazardous condition, which can cause injury or equipment damage, and should describe the consequences of the. hazardous condition. Notes are intended to provide supplemental information to the operator. Cautions and Notes are not supposed to contain action statements. The human factors review determined that most of the Cautions and Notes in the sample of E0Ps contained action statements--both simple action statements and conditional action statements. In addition, the Caution statements are not written according to the writer's guide--1.e., the statements do not describe the hazardous condition or the consequences of the hazardous condition.

4

4-Loaic Terms. The writer's guide presents definitions and format instructions 4

regarding the writing of conditional (logic) statements using logic terms.

Three major issues were seen with regard to the use of logic terms. First, the E0Ps contain cases where a conditional step is incorrectly structured. In some cases, a single high-level action statement (with its substeps) should be rewritten as one conditional step. In other cases, two adjacent high-level action steps should be rewritten as one conditional step. Second, the logic terms AND and OR are often misused or not used in cases where they are necessary for clarification. Third, the " Response Not Obtained" column often includes a conditional statement stating that IF the response in the left column is not obtained, THEN do something. Since this direction is implied in the basic philosophy of the two-column fomat, this statement is redundant and unnecessary.

Action Steps. The writer's guide specified that an action statement should only contain one instruction so that the operators will not skip over any i steps. Many of the " Response Not Obtained" substeps contain more than one

, action statement. In addition, the writer's guide specified that substeps in an E0P should not be split between two pages. There are several instances where the substeps are split between two pages.

Referencina and Branchinc . Referencing other procedures and branching to other procedures can be cisruptive and cause unnecessary delays. Therefore, it is important that the format and structure of the referencing and branching i

instructions be clear and follow writer's guide instructions. Most of the referencing and branching instructions in the E0Ps do not follow the writer's guide instructions.

1 Action Verbs. The meaning of the action verbs used in the E0P should be

! clearly understood by the operators. Action verbs used in the E0Ps should be taken from the approved action verbs that are listed in Table 1 of the writer's guide. Numerous action verbs in the E0Ps are not in the approved

action verb list.

1

Abbreviations and Acronyms. Table 2 of the writer's guide included a list of L acceptable abbreviations and acronyms. The E0Ps contained abbreviations and

. acronyms that are not included in the list.

Definitions. A number of action statements in the E0Ps are written in a vague manner or use terms that are undefined, which can result in an action statement that may be unclear to the operator. For example, the operators are often told to do something "if required" or "as required" with no criteria or references provided as to what the requirements are.

Other. Other discrepancies between the writer's guide and the E0Ps include the following. Step headings were often written in the imperative form when the actual instruction was provided in subsequent substeps. Sometimes the expected responsa to an action statement was written incorrectly. Check marks were used in the E0Ps, but their meaning was not clear. Asterisks were used in the E0Ps, but their meaning was not clear. Punctuation and emphasis were not used correctly in many places in the EO)s. Finally, there were miscellaneous problems found, such as miss)ellings and typographical errors.

5

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . ~ _ _ _ _ _

~

p 3.1.2.3 Comparison of the Verification / Validation Program with the Program Description in the PGP Although verification and validation were not separately defined in NUREG-0899, North Anna followed the definition developed by INPO for verification and validation. The PGP review found this acceptable. Thus, the i

two programs are described separately in this section. One comment relevant to both programs is that there is no written commitment in the Administrative Procedures to verify or validate changes to the E0Ps that occur after. Revision 1 is implemented.

Verification. Verification was defined by the plant to be a determination i

that the E0Ps follow the WOG ERGS and that the E0Ps are written in accordance with the North Anna writer's guide. The verification is conducted using a 1

checklist designed for the job. The following issues were raised with regard j- to the North Anna verification program.

First, the PGP stated that a team would conduct the verification. However, a single STA was asked to do the verification process for a given procedure. In 1.

addition, the verification was not the STA's major assignment, and according to comments made by the plant staff, the STAS did not appear to be that I

' interested in doing the verification task. Second, the STA did not have a -

' thorough checklist for conducting the verification. With regard to the writer's guide, only four checklist items were used. With regard to the ERGS, ,

the checklist items were also incomplete. For example, it did not ask the verifier whether any of the action steps were in a different order than in the ERGS and whether this new order could be technically justified. Third, the

< large number of discrepancies between the E0Ps that had been verified and the North Anna writer's guide and ERGS (see Attachment B) would indicate that the verification was not being conducted with the amount of detailed comparison i that had been specified in the PGP.

i Validation. The purpose of the validation process is to determine whether the procedures are usable by the operators and whether the procedures can guide the operators' actions so as to mitigate emergencies involving single failures and multiple failures. There were several areas in which the validation program differed from that specified in the PGP.

First, the PGP specified that a team concept would be used for the validation, involving human factors expertise, operating expertise, and procedure writing expertise. No human factors or procedure writing expertise was used. The i validation was accomplished by a single SR0 observing the use of the procedure during a requalification training session on the simulator. Second, the checklist for validation did not cover all the areas specified in the PGP. It did not document the participants in the validation nor did it ask for a usability evaluation of the procedure. Third, there was no formal method for receiving feedback from the training staff on the validation of the procedure.

Fourth, the validation to date had only employed single failure testing and did not meet the criteria in the PGP for using. multiple failure testing during the validation. ,

The completed checklist that was used to ev'aluate the verification and i validation programs is presented in Attachinent C.

l l

l 6

4 3.1.2.4 C@mparison of the Training Program with the Program Description in the PGP The planned training program for operators was not what was anticipated by the audit team given the training program description in the PGP. First, the l operators received some classroom training from Westinghouse approximately two l years ago for one week on the basic philosophy of the ERGS. There is no plan to give this classrcom course again, even for operators who did not receive

! the initial training. The operators were not tested on the Westinghouse training, as was specified in the PGP. Second, the PGP implied that most, if not all, of the operators would be given simulator training on most, if not all, of the EOPs. However, since the E0Ps were not fully written yet because t -

of the need to fill in setpoint information, since the procedure

, implementation date was to be June 30, 1986, (this date will probably be l pushed back as a result of the audit), and since the operators are only scheduled to be in the simulator for about one more day before June 30, it is clear that the operators would not be able to be trained on all procedures before they are implemented. Third, the PGP specified-that the operators

, would be evaluated on the simulator training: the simulator evaluation is a team evaluation, not an individual evaluation. Fourth, North Anna staff had not determined what kind of continuation training regarding the E0Ps will be given. Finally, the E0P reader, since he is not necessarily a licensed control room operator, may not necessarily have been trained on all of the '

E0Ps when he is called on to do the reading during an emergency.

The completed checklist that was used to evaluate the training program is presented in Attachment D.

j 3.1.2.5 Simulator Exercises The E0Ps that were used to mitigate the simulated emergencies had definite technical and human factors problems associated with them that affected the ability of the procedures to direct the operators to mitigate each emergency.

These problems included:

I o The E0Ps are planned to be used in the control room using a

" reader-doer" concept. The audit tea;n had three concerns regarding the reader. First, as discussed in the general findings, the " reader" may not have been trained on the E0Ps that he is to read and follow.

l Second, there is some concern about having a nonlicensed operator directing the actions of licensed operators and executing the decision i points in the E0Ps. Third, the operating crew often "got ahead" of

! the procedure reader due to their familiarity with the procedure.

This could aggravate the situation if an incorrect action is taken, or even if a " correct" action is taken too early.

o Some of the procedures had endless "do loops" in them which cycled the reader through the same steps and did not allow him to move to other parts of the E0Ps that would mitigate the emergency.

o One procedure had steps listed in an incorrect manner, thus requiring that the operators do something out of the optimal order for. recovery.

o Because of the use of simple action steps instead of conditional (logic) steps, sometimes the reader was confused as to what action should be taken.

• o Sometimes the expected action (e.g., no safety injection initiated) was confusing to the reader, because he anticipated that the expected action would be that, for instance, safety injection had occurred.

This caused the reader to go to the " Response Not Obtained" column incorrectly.

7

l l

l Several other problems were seen with the use of the E0Ps. These included:

o During one emergency where safety injection had been mistakenly skipped, the SR0 spent approximately five minutes helping the R0s to l recover to the correct situation. During this. time, the SRO was not l able to stand back and keep the broad picture of what was occurring, I which is the designated job for the SR0 during an emergency.

o The simulator control room was quite crowded, and the operators ran into each other on several occasions as they were moving around the control panels. This was due to some equipment that may be placed in the control room and was simply in the simulator as a mock up during the exercises.

o The Critical Safety Function manual, which it to be used by the STA during an emergency, contained a graph with n - ',ual increments--it was marked off in increments of 167 units on the '" axis and 133 units on the "x" axis. This basically made the graph uiusable.

- The completed checklists that were used to evaluate the simulator exercises are presented in Attachment E.

3.1.2.6 Control Room Walkthrough _

The control room walkthrough uncovered several problems including:

o Some of the display increments on control room instrumentation would not allow an operator to read at the required accuracy.

o Certain labels in the procedures were inconsistent with those in the control room.

The specific findings of the control room walkthrough are presented in Attachment F.

3.1.3 Summary of North Anna PGP Audit Findings The seven procedures that were reviewed were found to have numerous differences from the WOG ERGS and from the North Anna writer's guide. Some of the differences from the ERGS followed sound engineering judgment and were believed to improve the E0Ps. Other differences, however, were not sound and would have, for instance, led to endless looping within a procedure and would not have allowed the operators to mitigate the simulated emergencies had they not left the procedure. While some of the human factors findings were of minor safety importance (e.g., misspelling and typographical errors), the discrepancies from North Anna writer's guide instruction regarding Notes, Cautions, and conditional statements could have led the operators to make improper judgments regarding how to proceed through the procedure, and were therefore judged as being important to plant safety. Many of the discrepancies between the E0Ps and the North Anna writer's guide resulted from verbatim use of the WOG ERGS.

The verification and validation processes, in addition to not finding the above discrepancies, did not follow the outline for the programs that was listed in the PGP. Most importantly, a te'am concept was not used for verification and validation, the checklists for verification and validation did not cover nearly all of the important points that the programs should have been addressing, and the validation was done during operator requalification training and did not involve multiple failures.

8

V .

Classroom training on the philosophy and technical basis of the E0Ps had been ,

. presented by Westinghouse approximately two years ago. No plans were in place to update this training. In addition, if the June 30, 1986, implementation date for Revision 1 of the E0Ps is to be met, it is very unlikely that all of j the operators will receive training on all .of the procedures by that date.

Thus, the intent of the PGP was likely not going to be met by the June 30 implementation date.

3.2 PGP Audit Process The audit at North Anna went well. For this audit, unlike previous audits, a protocol was used to lead questioning on the verification, validation, and training programs. In addition, a partial package of procedures, with annotations describing where the operators should be going in the procedures during the simulated emergencies, was used to provide a " road map" to the audit team during the simulator exercises. This package also contained evaluation forms so that the audit team could evaluate the procedures following each simulated emergency. Finally, enough time was allowed for the audit team to summarize its findings and prepare for the exit briefing with plant staff. In summary, this audit went considerably better than previous audits largely because of the use of additional protocols for standardizing the data collection. _

4.0 CONCLUSION

S Conclusions are presented in the following sections regarding North Anna's E0Ps and PGP implementation process, the PGP implementation process that has been observed at four plants to date, and the PGP audit process.

4.1 North Anna PGP Implementation Process The audit team concludes from the findings of the technical and human factors desk-top reviews and from the simalator exercise of a sample of the E0Ps that the North Anna PGP implementation is not achieving its desired goals. Issues regarding the multidisciplinary team approach to writing, verifying, and validating the procedures and issues regarding the training of operators on the upgraded procedures need to be resolved before the North Anna program will adequately fulfill the commitments contained in the PGP.

4.2 PGP Implementation Process Audits The findings for North Anna are not unlike the findings at the previous three audits. In all cases, the process described in the PGP had not been followed fully in writing, verifying, and validating the procedures. In no case had the multidisciplinary team approach been used, as described in the PGP, which is seen by the audit team as one of the major reasons why the procedures that have been reviewed are not without technical error and are incorrectly written. A contributing cause to the incorrect writing of the E0Ps from a human factors perspective is the often verbatim use of the generic technical guidelines (e.g., WOG ERGS). Thus, the audits to date have shown th4t the existence of an acceptable PGP does not necessarily result in E0Ps that are of high quality, usable, and technically accurate.

4.3 PGP Audit Process .

This audit went considerably better than previous audits. This was due, in part, to the development and use of checklists (protocols) for gathering information about the plant's verification, validation, and training programs, 9

, to the use of a checklist for evaluating the outcome of the simulator exercises, to the additional time spent planning the site visit which allowed adequate time at the site to accomplish the necessary tasks, and to the experience gained by the auditors from previous site visits.

5.0 RECOMMENDATIONS Recommendations are presented in the following sections regarding North Anna's procedures and PGP implementation process, the PGP implementation process audits, and the PGP audit process.

4

5.1 North Anna Recommendations are presented in the following sections regarding North Anna's 4

procedures and PGP implementation process.

5.1.1 North Anna PGP Implementation Process

, It is recommended that North Anna reconsider its PGP implementation program in order to address the issues that were raised during the audit. More

, specifically, it is recommended that North Anna implement the E0Ps in accordance with their PGP and redefine the use of the procedure reader to use an individual who can direct the actions of the other operators and has had -

training on the use of all E0Ps.

5.1.2 North Anna Procedures It is recommended that the North Anna procedures not be implemented as they now exist. Although only one procedure had been both verified and validated, it was clear that the verification and validation process was not going to 1

identify important differences like those the audit team found during their desk review and simulator exercises. Thus, North Anna should use the instruction provided in the PGP to revise the existing procedures before they Tre implemented.

I 5.2 PGP Implementation Process Audits As the E0Ps are not beir,g implemented in the manner that is described in the PGP,'and'since all of the PGPs for these plants had been evaluated by the NRC

. as being adequate for proceeding with the PGP implementation, the i implementation problems appear to have more to do with the resources put into the process by the plants than with the PGP programmatic plans. In order to solve the problem, it is recommended that the NRC use some method to inform

the plants that the audits, to date, have been disappointing and that there is concern that the PGPs are being implemented inadequately. More specifically, the following recommendations are made

o NRC should " encourage" each utility to implement their E0Ps in accordance with their PGP. This " encouragement" can be in the form of reduced audit frequencies (if this is the course of action developed i to ensure the long term acceptability of the E0Ps) or, if necessary, in the form of a fine for noncompliance with their plant administrative procedures.

~

, o NRC should inform plants that PGPs and E0Ps copied directly from the i

INPO Writer's Guide and vendor generic guidelines are generally not 3 sufficient to fulfill NRC requirements. The INPO Writer's Guide i should not be used verbatim in areas where plant usage may differ

(e.g.,verblists, abbreviations, acronyms). The vendor generic 10 E _. -

guidelines are not meant to be used verbatim, they must only be used as the technical basis for procedure steps written using the instruction provided in the PGP.

o INPO or-NRC should conduct " human factors principles" seminars. The utility people we have dealt with were, on the whole, open minded and would be more receptive and interested in what we are doing had they some background in the area. T;1ere could be a real cost-effective benefit to the NRC in greater compliance and cooperation if utilities had a clear understanding of what was expected of them and why.

5.3 PGP Audit Process Because the audit went very smoothly at North Anna and all relevant data were

collected, it is recommended that future audits follow the outline and use the checklists that were used for the North Anna audit. It is also recommend that an additional checklist be developed for the control room walk-through. A checklist similar to Attachment F may serve this purpose. In order to decrease the resources necessary to conduct the audit, the number of members

, on the audit team may be reduced if they have participated in a previous audit. The number of procedures that are reviewed may be reduced as part of the audit, although all of the plant's E0Ps should be provided for review and at least one procedure of each type, where different types of E0Ps exist, should be reviewed. The review of fewer procedures could also allow the preparation and conduct of fewer simulator exercises. The site visit schedule should allow sufficient time for a meeting of the audit team (NRC, technical expert, human factors expert) prior to the site visit and a debriefing meeting following the site visit.

i f

e 11

G ATTACHMENTS Attachment A--Audit Team Members and Site Introductory and Exit Briefing Attendees Attachment B--Desk Review of E0Ps Attachment C--Verification / Validation Checklist Attachment D--Training Checklist Attachment E--Simulator Exercise Checklists Attachment F--Control Room Walk-Through Checklist

/

i 12

i Attachment A Audit Team Members and Site Introductory and Exit Briefing Attendees Audit Team Members Name: Affiliation:

Jim Bongarra NRC H. Brent Clayton NRC Leo Defferding PNL Robert Gruel PNL William Kennedy NRC William Rankin PNL

- Introductory Briefinc Attendees (in addition to aucit team)

Name: Affiliation: _

Russ Anderson Virginia Power Larry Edmonds Virginia Power Tom Harding Virginia Power E. R. Smith, Jr. Virginia Power Exit Briefina Attendees (inadditiontoauditteam)

Name: Affiliation:

Russ Anderson Virginia Power Larry Edmonds Virginia Power Donald Fellows Virginia Power E. Wayne Harrell Virginia Power J. H. Lebesstier Virginia Power E. R. Smith, Jr. Virginia Power D. J. VandeWalle Virginia Power A.1

O Attachment B--Desk Review of E0Ps This attachment contains the specific findings of the desk review of the sample of E0Ps. Each E0P is listed separately, with the technical concerns listed first followed by the human factors concerns. After the first procedure, subsequent human factors comments denote only the location of concerns; the reader should refer back to the first procedure for a discussion of each topic. An asterisk following the ERG STEP nunber in the technical comments indicates that the specific comment is applicable to the Westinghouse ERGS as well as to the North Anna E0Ps.

This attachment contains the findings of the desk review as presented to North Anna plus additional items discovered during the site visit: it contains many items which were appropriately addressed by the utility staff during the audit visit.

=

9 B.1

NORTH ANNA PGP AUDIT 1-EP REACTOR TRIP OR SAFETY INJECTION Technical Review NAPS ERG STEP STEP COMMENT Entry condition 2 should be expanded to address symptoms that require Reactor Trip / Safety Injection.

1. 1. A NOTE regarding the foldout page should be added prior to i Step 1: a foldout page should~be used and should contain the applicable information from the ERG foldout page.

4. 4.* The contingency should be expanded to address symptoms that require Safety Injection. A foldout page, which is not utilized,

, could contain this information.

6. 15. Substep b should be wholly contained on a single page.

11. 8. 1) The first substep should be "Two LHSI pumps - RUNNING", and the corresponding contingency is then " manually start pumps".

The remaining substeps will have to be relettered accordingly.

4

2) "Go to Step 11" should be "Go to Step 12".

9. Operation of CCW pumps should be checked.

12. Containment ventilation isolation should be checked (might be checkedinAttachment2).

13. 14. Substep a should check if containment pressure has remained less than 27.75 psia.

14. . The reference to "1-AP-47" should be "2-AP-47".

, 15. 19. Justification for different AFW flowrate based on no running RCPs should be provided.

17. 21. 1) Caution before this step is unnecessary or misplaced; it should be placed prior to Step 32. 2) Step continuation between substeps a and b should be removed.

19. -

Caution before this step should be on the foldout page as it is a continuously monitored step.

23. 25. Same comment as on Step 15.

~

24. 26. The procedure transitions to 1-ES-0.2, SI TERMINATION, FOLLOWING SPURIOUS SI. 1) The ERG at this point transitions to 15-1.1, SI

< TERMINATION. Justification sh'ould be provided as to why ES-1.1 is not transitioned to. 2) ' ES-0.2 in the ERG is NATURAL CIRCULATION C00LDOWN. This difference should be explained (i.e.,

i is the NC Cooldown procedure handled. as as AOP7).

26. 28. The caution after this step should be located before this step.

B.2

27. 32. 1) The first caution before this step should reference the need for manual restart of safeguards equipment if offsite power is lost following SI reset. 2) The second caution before this step should be justified or deleted as it refers to actions that are not specified in EP-0.

33. A step regarding reset of Containment Isolation Phase A and B should be included after Step 27.

34. A step regarding establishment of instrument air to containment should be included after Step 27.

28. 29. Substep b should specify which radiation monitors should be checked (refer to Step 21).

29. 30.* The auxiliary building sump level indicators (LI-DA-111A,B) should also be checked to determine if there is a LOCA outside containment (refer to EP-1, Step 17).

31. 35. The transition to EP-1 should be corrected. As written, a transition to EP-1 can be made on high but decreasing RCS pressure, whereas the ERG only allows a transition if RCS pressure is less than the shutoff head of the LHSI pumps. '

32. 36. Any additional equipment that should be loaded on the diesel generators should be specified at this point (e.g., the pressurizer heater banks referred to in the caution prior to Step 17).

- - In Attachment 1 (pp. I and 2 of 4), the quench, inside recirc.

and outside recire, spray pumps should be referred to as

" RUNNING", not "0 PEN".

e a

B.3

Human Factors Review

1. Notes and Cautions According to the writers guide, cautions should be used to describe a hazardous condition, which can cause injury or equipment damage, and should describe the consequences of the hazardous condition. In addition, cautions should not include action statements. Unfortunately, the example of a caution on page 33 of the writers guide contains an action step (" Seal injection flow -

should be maintained..."), which has led to the use of caution statements in the EPs that contain action statements. Notes are intended to provide supplemental information and are also not supposed to contain action steps.

.The cautions and notes that contain action statements are listed below. They should be changed to meet the writers guide instructions. Sometimes cautions can simply be rewritten to delete the action step. (For example, the writers guide example " Seal injection flow should be maintained to all RCPs to reduce seal degradation," contains an action statement, does not describe the hazardous condition, and does not specify the consequences of the condition.

It could be rewritten, " Loss of seal injection flow [the hazardous condition]

will cause RCP seal degradation [the consequence of the hazardous condition]).

However, other cautions and the notes listed below should be analyzed to -

determine whether they should be changed to action steps and used in that manner in the procedure.

CAUTION Page 7 (Both are action statements)

Page 8 (Does not describe hazardous condition and consequence)

Page 10 (Conditional statement. Should be on next page)

Page 11 First--Should this be a Note?)

Second--Action statement)

Page 12 Conditional statement) i NOTE All Notes in Attachments 1 and 2 are action statements

, 2. Logic Terms a) The writer's guide presents definitions and format instructions regarding conditional statements and logic terms. Format instructions for .

conditional statements that contain the use of AND and OR within a list of conditions are especially important. The EPs, however, include a number of examples of lists of conditions that are presented in paragraph form.

Also included are a number of lists of conditions that do not use the appropriate logic term to denote whether the instructions should be considered alternatives or combinations. The following steps should be revised accordingly.

Step 4 (rt. col.) Paragraph form. Also, Step 4a should be removed. .

Step 15 (rt. col.) Logic sta,tements embedded within logic statements.

Step 17 Rewrite as conditional statement Step 18 Rewrite as conditional statement Step 20.a (rt. col.) Paragraph form Steps 23 and 24 Rewrite as one conditional statement i

B.4

Step 31 Rewrite as conditional statement.

Uses AND and OR in one conditional statement.  :

Step 31.a (rt. col.) Paragraph form I Step 32 Rewrite as conditional statement i b) In Section 7.3 of the writer's guide, RESPONSE NOT OBTAINED COLUMN, it is stated that, "The instructional steps in this column are contingency actions to be performed if the normal actions cannot be perfonned or if ,

the expected response is not obtained." For this reason, it is not clear why many of the response not obtained steps are structured as IF, THEN statements in which the IF portion is of the form "If the response is not obtained...." Since the operator should not go to the right column unless the response is not obtained, the use of a contingency.IF statement is redundant. The operator should simply be told to carry out the THEN portion using a simple action statement. Unfortunately, the example in Section 7.1 of the writer's guide is not done in this manner. However, in

' ' all the EPs and FRPs there are mixtures of conditional statements and simple action statements in the response not obtained column. A decision should be made as to which method will be used and then the steps should be made consistent (we prefer deleting the conditionals and making them simple action statements). '

3. Action Steps a) The writer's guide specified that an action statement should only include one instruction. Many of the " Response Not Obtained" substeps contain more than one action step. A decision should be made as to whether these statements should simply be separated by line spacing or whether the sub-substeps should be numbered. The following steps from the right column are affected:

Step 3 Step 4 Step 13.b Steps 16.b and 16.c Steps 17.a 17.b and 17.c Step 18.a Step 23.a. 23.b, 23.c, and 23.d '

Step 29.a b) The addendum to the PGP dated May 31, 1985, states that a comment expressing the desirability of limiting steps to one page when possible would be added to the writer's guide, and the EPs adhere to approved format requirements. However, if a step could not be finished on a page, then the bottom of the page would be labelled " step x continued on the next page" and the following page would have the full step title followed 3

by " continued." Two differences noted in the EPs is that " STEP X CONTINUED ON NEXT PAGE" is in all capitals and that " continued" is either specified as " CONT" or " cont." A decision on capitalization should be made, and the word continued should be spelled out completely or the abbreviation for it listed in Table 2 of the writer's guide.

Step 6 Step 16 Step 23 B.5

I.

4. Referencing and Branching Referencing of and branching to other procedures and sections or procedures can be disruptive and cause unnecessary delays. Therefore, it is important that format and structure be consistently applied. The following types of inconsistencies in references and transitions were found in the EPs. They should be corrected.

a) The writer's guide indicates in Section 7.13, Emphasis, that the instruction for branching is to be written as "GO T0". It is written as "go to" in all cases b) The writer's guide provides format instructions for branching to other procedures in which the procedure number only is used. In addition to this format, two other fomats are used. One includes procedure number, 4

i title and step number (even if Step 1) and the other format includes procedure number and title. The fomats used in the EPs are more complete and thus preferable to that specified in the. writer's guide. _ We recommend that a future revision of the writer's guide include the expanded fomat.

At this time, they should be made consistent.

Procedure number and title Steps 4 (rt col.) and 14 ,

Procedure number, title and step no. Steps 1.b, 9.b, 16.b, 20.a, 21.a. 22, 26.b, 28.b, 29.a, 31.a (all rt. col.) 3 and 24 c) The writer's guide provides directions for referencing other procedures and implies (see example in section 7.21, page 50 of writers guide) that the term GO TO is to be used. However, in Section 8.8.9, the tem " refer to" is also used in a reference situation. Within the body of the EP, however, referencing is accomplished through the use of the term "as per."

We prefer the use of " refer to" for referencing, although what is needed here is consistent usage. The following steps should either be corrected to correspond with the guidance given in the writer's guide or the writers guide should be changed to specify the use of "as per."

Step 32.a (rt. col.)

Step 32.b

5. Action Verbs In a number of locations in the EPs, action verbs or terms are used that are not included in Table 1 of the writer's guide, Action Verbs. The following should either be added to the Table or replaced with verbs from that list:

Push Step 2.a Place Steps 2.b and 7 (rt. col.) and 31.b and Attachment 2 Actuate Steps 4, 10.a and 13.a.1 (all rt. col.)

Dump Step 15 (rt. col.) ,

Re-energize Caution, page 7 Continue Steps 17.c (rt. cor.) and 25.b Attempt Step 23.d (rt. cot.)

Make up to Caution, page 10 Reset Step 28.a Evaluate Steps 29.a and 30 (rt. col.)

Try Step 32.a (rt. col.)

Restore Step 32.a (rt. col.)

8.6

Rediagnose Step 33 Perform Attachments 1 and 2 Secure Attachment 2 Inform Attachment 2

6. Abbreviations and Acronyms In a number of locations in the EPs, abbreviations and acronyms are used that are not included in Table 2 of the writer's guide, Abbreviation and Acronym List. The following should either be added to Table 2 or replaced with abbreviations or acronyms from that list:

AC Steps 3 (rt. col.) and 32 PSIG . Steps 11.a, 18.a and 31.a PSIA Step 13 psig Steps 13.b and 16.c (rt. col.)

and cautions, pages 8 & 12 CC Step 13.a.3 (rt. col.)

PRZR Steps 16 and 23.d TC Step 23 ECST Caution, page 10 recirc. Attachments 1 and 2 -

7. Definitions A number of statements in the EPs are worded in a vague manner or use tems that are undefined, resulting in an action statement that may be unclear to the operator. The following statements should be revised to be more explicit as noted:

Step 4 (rt. col.) Define "i f required".

Step 28.a Define "as required" 1

8. Expected Responses

, Section 7.2 of the writer's guide describes the format for expected responses to high level action steps. However, in the following steps the expected i response is CHECK FOR FLOW. The expected response should simply be FLOW.

Step 6.b Step 9.a Step 11.b Step 17.b

9. Checkoffs The writer's guide states in Section 6.0, "Although not precluded, the procedure should not include any checkoff, signature or initial spaces for the individual steps." However, further clarification on the writers guide provided to the NRC indicated that the North Anna procedures would include checkoff spaces. Each major step in the procedures reviewed does include a checkoff space. However, the function of the checkmark symbol is not known, and the symbol is used above some checkoff spaces and not above others. The meaning of the checkmark symbol should be made clear in the writer's guide,

< and it should be used consistently in the procedures.

i B.7

10. Asterisks The use of asterisks is widespread in the EPs. Because asterisks are never mentioned in the writer's guide, their function is undefined. It appears that they are being used as " bullets" to delineate items in a list. It.is recommended that use of asterisks be limited to one clearly stated function, if any, and that the writer's guide be revised to include a definition of its use. It is likely that a checkoff provision would be more useful to the operators than the asterisks.

11. Punctuation and Emphasis

~

In a number of locations in the EPs, punctuation or emphasis techniques are used that conflict with the instructions listed in the writer's guide. The following should be corrected as noted:

a) In Table 3 of the writer's guide, it is specified that a procedure name should be in initial capitals and underlined. In every reference to the title of a procedure in the EPs, the title is given in all capitals.

b) In Table 3 of the writer's guide, it is specified that referenced step numbers are to be underlined. In no reference to step numbers in this EP _

are the numbers underlined.

c) Section 7.13 of the writer's guide specifies that logic terms should be underlined. In the caution found on page 10 of 1-EP-0, there is no emphasis given the word "when" in a WHEN, THEN, logic sequence. In Step 12, hyphens should be removed from the logic OR.

d) The writer's guide specifies that " Additional emphasis may be used as specific requirements dictate." It also states that "The key is to use the LEAST emphasis possible." The use of capitalization and underlining in the E0Ps is extensive. A number of words are given the same emphasis as logic terms, which may be confusing to the reader. The need to emphasize the following words should be checked.

BOTH Steps 2.b, 3, 4, 10.a and 13.b (all rt. col.)

l ONE Step 3 (rt. col.)

IS Step 4 (rt. col.)

UNTIL Caution, page 7 GREATER Caution, page 7 LESS Caution, pages 7 and 12 De Caution, page 12 and Step 20 Direct Step 14 TRENDING Step 15 CLOSE Step 18 (rt. col.)

Un Steps 20.a and 26.b (rt. col.)

ANY Step 22 (rt. col.)

12. Miscellaneous .

The following typing errors should be corre'cted in the next revision of the procedures:

Step 1.b rt. col. "to to" should be GO TO Step 2.b rt. col. Substep "b" used twice.

Step 2.b rt. col. Missing period.

Steps 3 and 12 Missing dash between high level B.8

action step and expected response.

Step 8 Missing colon after expected response.

Step 15 (rt. col.) Missing comma before THEN.

Step 16.a (rt. col.) Missing period.

Step 17.a Followed by an inappropriate

" step continued" message.

Steps 17.d, 23.a and 27 Period in left column should be removed.

Step 29.a (rt. col.) "conditiona" should be " conditions."

Step 32.a ( " "

) " buses" should be " busses."

Step 7.a (rt. col.) Two substeps "a" are shown Step 10.a.2 ( "

) Does not line up correctly Attachment 2 Two steps "1" Attachment 2 Continiuing 7

I 4

e B.9

NORTH ANNA PGP AUDIT 1-EP LOSS OF REACTOR OR SECONDARY COOLANT Technical Review NAPS ERG STEP STEP COMMENT Entry conditions should be expanded to include ECA-0.2 and FRP-C.2.

1. 1. 1) A NOTE regarding the. foldout page should be added prior to Step 1: a foldout page should be used and should contain the applicable information from the ERG foldout page. 2) A NOTE

regarding maintenance of seal water flow to the RCPs should be added prior to Step 1.

1. 1. Additional SI flow indicators (FI-1961,1962,1963) should also be checked in substep b to verify SI flow (refer to EP-0, Step 17).

2. -

1) The caution before this step should be located after this -

step (refer to EP-0, Step 18). 2) This caution should be on the foldout page as it is a continuously monitored step.

3. 2. The contingency to this step should be that all faulted SG(s) are i isolated; if not, then transition to EP-2.

4. 3. The caution after this step should be located before this step.

11. 8. 1) The contingency to substep c should instruct the operator to i reinitiate quench spray (substep 5) only if quench spray pumps were not stopped due to low RWST level, and to start containment recirculation fans (substeps 1 through 4) if quench spray pumps were stopped due to low RWST level. 2) Substep c.5 directs the operator to re-initiate quench spray, while substep d instructs the operator to isolate the (potentially running) quench spray

pumps. These substeps should be appropriately rewritten (add transition to Step 12 after re-initiation of quench spray?).

12. 8. A substep should be added after substep c which checks that i containment pressure remains subatmospheric and instructs

operator to restart RS pumps if it does not (refer to Step 11).

f i 13. 10. 1) This step should be located after Step 14. In the ERG, this step could be bypassed if RCS pressure was greater than the

, shutoff head of the SI pumps; no such bypass exists in the NAPS procedure. 2) The first caution after this step should ,

reference the need for manual restart of safeguards equipment if offsite power is lost following SI reset. .

' 14. 9. Justification should be provided for transition to ES-1.2, POST LOCA COOLDOWN AND DEPRESSURIZATION, in substep d as the ERG does j not transition until NAPS Step 24.

1

B.10

15. 11. Any additional equipment that should be loaded on the diesel generators should be specified at this point (e.g., the pressurizer heater banks referred to in the caution prior to Step 17 of EP-0).

16. 12. The contingency to this step, transitioning to ECA-1.1, LOSS OF EMERGENCY COOLANT RECIRCULATION, should be located after Step 18 as indications of a LOCA outside containment would only be discovered during the conduct of Steps 17 and 18.

17. 12. Additional auxiliary building radiation monitors (RMS-155,156) should also be checked to determine if there is a LOCA outside containment (refer to EP-0, Step.29).

25. 14. 1) References to RWST level should be "less than" or " greater than", not "at". 2) The contingency to this step should return the operator to Step 16 while waiting for transition to ES-1.3, TRANSFER TO COLD LEG RECIRCULATION. As written, the operator is allowed to transfer to ES-1.3 and/or the remainder of the procedure while still on the RWST.

27. 16. 1) The note before this step should specify which FRPs are not -

applicable. 2) The reference to FRP-I.3 in substep c should be clarified as the note preceding this step stated head vent FRPs are not applicable.

35. -

The redundant charging /SI and LHSI pumps that are removed from service should be on different buses to ensure SI flow in case of loss of power to one bus.

In Attachment 3 (pp. I and 2 of 4), the quench, inside recirc.

and outside recirc. spray pumps should be referred to as

" RUNNING", not "0 PEN".

e t

I B.11

a.

~

Human Factors Review

1. Notes and Cautions

CAUTION Page 2 (Does not describe consequences of 3 hazardouscondition))

Conditional statement 4 Conditional statement) 8 Should this be a note?)

"~ "

8 Should this be a note?)

10 Actionstatement)

NOTE Page 2 Attachment 2, page 2

2. Logic Terms

, a)

Step 1 Should be rewritten as a conditional statement

Step 2 Should be rewritten as a -

conditional statement Steps 7 and 8 Should be rewritten as one

. conditional statement Steps 9, 10, and 11 Should be rewritten as one conditional statement Step 10.a.1 (rt. col.) Paragraph form Step 11.c (rt. col.) Step 5) should not be numbered Step 12 Should be rewritten as a conditional statement Step 14 Should be rewritten as a conditional statement Step 15 Should be rewritten as a conditional statement Step 17.a (rt. col.) Paragraph form Step 17.b.2 Not a logic "AND" Step 17.b.2 (rt, col.) Paragraph form Step 18.a (rt. col.) Paragraph form Step 18a,b.1 (rt. col.) Paragraph form Step 18.b.2 (rt, col.) Paragraph form Step 24 Should be rewritten as a conditional statement Step 25 Should be rewritten as a conditional statement Step 25.a (rt. col.) Paragraph form

, Step 26 Should be rewritten as a conditional statement Step 27 Should be rewritten as a conditional statement enever

. told to vent Steps 28.b and 28.c . Should be rewritten as conditional statements Step 30 Not a logic "AND" i Step 31 Should be rewritten as a conditional statement Steps 32 and 33 Should be rewritten as one conditional statement B.12

s Steps 34 and 35 Should be rewritten as one conditional statement Attachment 2, Step 1.a (rt. col.) Paragraph form

3. Action Steps a)

Step la, b, and c '

Step 2a Step 6b Step-7a, b, c, and d Step 10.a.1 Step 16 Step 17.b.2 Step 18a, b.1 Step 26b Step 32a, b Step 34a, b, and c b)

Step 9 Step 17 Step 28

4. Referencing and Branching a) The writer's guide indicates in Section 7.13, Emphasis, that the instruction for branching is to be written as "GO T0". It is written as "go to" in most instances.

b)

Procedure number and title Steps 14 and 24.b Procedure number, title and step no. Steps 3.a, 4.b, 5.a, 16 (all rt. col.) and 8 c)

Step 15.a (rt. col.) and 15.c Step 20.c Step 21.b Step 23.b (rt. col.)

Attachment 2, Step 1.h (rt. col.) and 1.1 d) Step 27.c states, "The following are applicable references:" This reference should be restructured to conform to the decision made regarding 1

4c above.

5. Action Verbs .

Try Step 1.a (rt. col.)

Restore Steps 6.a*( "

),15 and 16 Repeated Caution, page 4 Attempt Steps 7.d,'17 and 18 Reset Steps 11.a, 11.c (rt. col.), 14.b and 15.b Reestablish Step 11.c.5 (rt. col.)

B.13

e Reinitiate Step 11.c.5 ( " )

Place Steps 12.c, 14.c, 20, 23 and Attachment 2 Try Step 15.a (rt. col.)

Coordinate . Caution, page 10 Detected Steps 17 and 18 Evaluate Steps 20, 22 and 36 Prepare Step 30 Inform Step 21 Return to service Step 22

Dump Step 26 i

Remov.e Step 33 Restart Steps 33 and 35 1

Transfer Attachment 2 i 6. Abbreviations and Acronyms i

PSIG Caution, page 1, Steps 2.a 6, 14.a.1 and 24

, PRZR Caution, page 4, Steps 6 and 7 ECST Caution, page 3 QS Steps 9, 10 and 11 PSIA Step 10.a.1 (rt. col.)

Chem Step 11.e.1 ~

Sfgd. Attachment 3, Step 3

7. Definitions Step 15.b Define "if required" and rewrite as a contingency statement Step 16 (rt col) Define "as required" Step 17.b.2 Provide specifications for "significant" Step 20.b Define "if required" Step 21.a Are the " required RCS samples" the ones that are listed? If so, restate to so specify.

Step 22.a Using the term "as a minimum" implies that other evaluations could also be specified.

Should other evaluations be specified?

Attach. 1, Step 2 Define "significant" and " applicable"

9. Checkoffs

10. Asterisks

11. Punctuation and Emphasis a) 1 b)

Step la, b, and c .

Step 2a

Step 3a i Step 4b

Step Sa Step 7a, b, and c Step 9a and 9.c.2 Step 10.a.2 Step 12a,b B.14 i

4 Step 13 Step 14.a.1, and 14.a.2 Step 16 Step 23a Step 24a Step 32a, b Step 34a, b, c c) In Step 9.c.1, the logic AND should be underlined and the hyphens removed.

d)

UN Steps 3.a.1, 4.b and 13 (all rt. col.)

UNLESS Step 6.c (rt. col.

BOTH IS Step 9.c.2 ((

• Step 10.a.1 ALL Step 11.c.4 ( "

LESS Step 26.c ( "

De Caution #2, page 8 and Step 3.a.1

12. Miscellaneous -

Step 14.c Auto-standy (Auto-standby)

Step 15.a Offiste (Offsite)

Step 7.a (rt. col.)

Two substeps 'a" are shown Step 10.a.2 ( "

) Does not line up correctly Attachment 2 Two steps "1" Attachment 2 Contintuing 1

i I

9 4

B.15

s .

NORTH ANNA PGP AUDIT 1-EP FAULTED STEAM GENERATOR ISOLATION Technical Review NAPS ERG STEP STEP COMMENT Entry conditions should be expanded to include each procedure (and step) which makes a transition to this procedure.

3. 3. 1) Thestatement".IFfaultedSG(s) identified,THENgotoStep 4" is not a contingency and will never be reached where it is located. It should be moved to the left hand column or deleted.

2) If the faulted SG can no longer be identified, then the e closure of the MSTVs isolated the fault: searching for a fault upstream of the MSTVs would be fruitless and should be deleted.

3) Substep a should be wholly contained on a single page.

t e

B.16

~

Human Factors Review

1. Notes and Cautions CAUTION Page 2 (None of the cautions contain a description of the hazardous condition anditsconsequence)

NOTE "

4 (Is it necessary?)

2.. Logic Terms _

3. Action Steps a)

Step la

, Step 3a (rt. col.

Step 4 (both col.

.b)

Step 3 Step 6 c) The guidance provided in the addendum to the writer's guide dated May 31, 1985, regarding splitting of steps states "No portion of a single substep may be continued from one page to the next." Substep 3a is split between pages 2 and 3. This should be corrected.

4. Referencing and Branching a) The writer's guide indicates in Section 7.13, Emphasis, that the instruction for branching is to be written as "GO T0". It is written as "go to" in all cases, except Step 7.

b)

Step 2.a (right column Step 6.c ( " "

l c)

Step 5.a (right column)

5. Action Verbs Identify Step 3 Try Step 3.a(rightcolumn) i Unlock Step 5.a (right column) .

Make-up

6. Abbreviations and Acronyms TDAFW Step 3.a (right column).

9. Checkoffs B.17

10. Asterisks Step 3.a Step 4 Step 5.a (right column)

Step 6.b

11. Punctuation and Emphasis a) l h) i d)

De Step 3 Un

10. Miscellaneous i Step 6 seondary (sec_ondary) i 4

s l

w 5

i i

5 a

i t B.18

l NORTH ANNA PGP AUDIT 1-EP STEAM GENERATOR TUBE RUPTURE Technical Review NAPS ERG STEP STEP COMMENT

1. 1. A NOTE regarding the foldout page should be added prior to Step 1: 'a foldout page should be used and should contain the applicable information from the ERG foldout page. ,

4. 3. 1) The contingency to substep c (page 4 of 24) should be to close the SG PORV(s) when the SG pressure is below the PORV set 2)- Substep c (pa

3) point.

Substep c (page 5 of 24)ge 5 ofhave should 24) ashould contingency be substep d.

to isolate

, the TDAFW pump if a MDAFW pump is running.

8. 7. This step should check intact, not ruptured, SG levels.

12. 11. Any additional equipment that should be loaded on the diesel -

generators should be specified at this point.

15. 14.* 1) Substep a and c should be contained on a single page as substep c refers to subset a for its decision logic.

2) Substep c should refer back to Substep a as ruptured SG pressure may have changed.

18. 17. 1) The use of AND and -OR- in substep b should be clarified:

the intended meaning is either both 1 and 2, or 3, or 4. 2) The contingency to substep b should specify whether the spray valve is to remain open or to be cicsed before the skip to Step 19.

t

19. 18. The use of AND and -OR- in substep b should be clarified: the intended meaning is either both 1 and 2, or 3, or 4.

I

~21. 20. Substep b should be wholly contained on a single page.

l 27. 25. Substep a (page 17 of 24) should be substep b.

29. 27. Substep b should be wholly contained on a single page.

31. 29.* The table does not provide guidance if ruptured SG(s) level is stable.

34. 32. The caution before this step should be located before Step 31 as Step 31 instructs the operator to turn on the PRZR heaters.

5 i

8.19 ,

• Human Factors Review

1. Notes and Cautions CAUTION Page 2 (Does not describe hazardous condition and consequence.

Should this be a Note?)

4 First--conditional statement)

Second--actionstatement) 5 conditional statement) 6 conditional statement) 7 Does not describe hazardous condition and consequence.

Should this be a Note?)

8 (conditional statement.

ShouldthisbeaNote?)

" 10 actionstatement)

" 12 Second--does not specify consequence)

" 14 written as a cross between action statementandcaution) 20 (action statement) 22 (First--conditional statement) ,

NOTE Page 2 (third--contains an action statement Attachment 1, page 1 (two conditional statements))

2. Logic Terms a)

Step 1 Rewrite as a conditional statement Step 1.c (rt. col.) Not a logic AND. Rewrite as two action statements.

Step 2 Rewrite as a conditional statement Step 3 Logic not clear. Should Steps 3 and 4 be rewritten as one conditional?

Step 5 Rewrite as a conditional statement Step 8 Rewrite as a conditional statement Step 13 Rewrite as a conditional statement Step 18 Logic not clear Steps 19.a,b Rewrite as a conditional statement.

Logic of 19.b is not clear.

Steps 21 and 22 Should be rewritten as one conditional statement Step 27.b (rt. col.) Paragraph form Step 29 Rewrite as a conditional statement Step 32 Rewrite as a conditional statement Steps 36.a,b Paragraph form Step 37 Rewrite as a conditional statement Attachment 1, page 1 Paragraph form

3. Action Steps ,

a)

Steps 1.a,b,c Step 2.a Steps 3, 3.a Step 4.b B.20

I Step 6.b Step 7.a Steps 18.a,b,c Step 19.a Steps 21.a,b,c,d Steps 27.a and 27.b

-Step 29.a .

4 Step 31.b Steps 36.a and 36.b Step 37.b Step 38.a.2 b)

Step 4 Step'6 Step 15 l Step 18 Step 24 Step 27 Step 31 c) The addendum to the PGP dated May 31, 1985, dictates that "No portion of a single substep may be continued from one page to the next." In this EP, substep "b" of Step 21 is split between pages 14 and 15, and substep "b" of Step 29 is split between pages 17 and 18. This should be corrected.

4. Referencing and Branching a) b)  ;

Step 4.b rt col.

Step 6.b rt. col.

Step 7.a rt. col.

Step 14 rt. col.

Step 15.b rt. col.

Step 16 rt. col.

Step 17 rt. col.

Step 19.a rt. col.

Step 20.2 rt. col.

Steps27.a Steps 21.a,b,(c(rt.

b rt. col.) col.)

Step 41 c)

Step 29.b (rt. col.) -

Step 32.a (rt. col.) .

Step 32.c Step 38.a.2 (rt. col.)

Attachment 1, page 2, 1 Attachment 1, page 2, j d) The writer's guide provides directions for branching into other procedures using the term GO T0. However, in several plac.es in this EP, the term

" Initiate...." is used to direct the operator to begin a new procedure B.21

1

+

while c:ntinuing in the current EP. This format is not described in the writer's guide. The following should be revised to correspond to guidance provided in the writer's guide on branching:

Attachment 1, p. 1, a.2 (rt. col.)

Steps 36.a and 36.b Step 12.a (rt. col.)

Caution, p. 6

5. Action Verbs Try _ Steps 1.a. 1.b (rt. col.) and 32.a Continue Steps 1.c and 3 (both rt. col.)

, Identify Step 3

Reset Step 3.a rt. col.

Re-open Step 3.a rt.~ col.

Bypass Step 4.b rt. col.

Restore Steps 6.a and 12.a (both rt. col.)

< Make up to Caution, page 6 Restart Caution, page 8 Place Steps 13.b, 29.b.1, 29 b.5 and 4

Attachment 1, p. 1, d _

Dump Steps 15.b and 39 (both rt. col.)

Void Note, pages 10 and 12 Depressurize Steps 18, 19 and 31 Refill Step 18 Place in sttndby Step 22 Reinitiate Step 27.a (rt. col.)

Operate Step 27.a (rt, col.)

Perform Steps 29.a (rt. col.) and 31.a i

Lock Step 28.a (rt. col.) and Attachment 1, p. 1, e Set Steps 28.b and 28.c Use Step 31.b (rt. col.)

Re-energize Caution, p. 20 Turn on Step 34 Re-establish Steps 36.a. 36.b and 37.b (all rt. col.)

Transfer Attachment 1, p. 1, a.3

6. Abbreviations and Acronyms psia Note, p. 2 psig Cautions, pages 2, 5 and 8, Steps 4.a, 6.b, 13.1, 14 and 37.all right column),

Note, p. 9, and Step 29.b PSIG Steps 2.a. 13.1, 14 and 37.a SGBD Step 3 PRZR Cautions, pages 5 and 12, Notes, pages 9, 10, and 12 Steps 6, 18, 19, 20, 21, 27, 29 and 31 .

ECST Caution, p. 6 TC Steps 15, 17, 39 and 38.a (rt. col.)

apx. Step 29.b.5 and Attachment 1, p.2 AC Step 32 HX Step 37.b RPM Attachment 1, p.2 B.22

l 7. Definitions Step 15.b Define " maximum controllable rate" Step 24.e Define "as required" Step 27.a (rt col) Define "as necessary" Step 35 (rt col) Define "as required" Note, p. 22 Define " order of priority"

8. Expected Responses Section 7.2 of the writer's guide describes the format for expected responses to high level action steps. However, in Step 1.b the expected response is  !

CHECK FOR FLOW. The expected response should simply be FLOW. I

9. Checkoffs

10. Asterisks

11. Punctuation and Emphasis a)

~

b) c)

Step 3 Step 15.b (rt. col.)

Step 18.b Step 19.b Step 21.b Step 33 Step 41 d)

STOP Step 1.c rt. col.

CLOSE Step 2.a rt. col.

NON Step 4.b rt. col.

LESS Step 6.b rt. col.

ALL Step 7.a rt. col.

UNLESS Step 7.a rt. col. and Caution, p. 8 BEFORE Caution, p. 10 ANY Step 19.b

12. Miscellaneous Step 2.a "tahn" should be "than" Step 3 (rt. col.) Needs period Caution, p. 4 "maintanted" should be " maintained" Step 4.b "MTSV." should be "MSTV" Step 4.b (rt. col.) Need.scommaafter"...SG(s)"

Step 5.b "between nd 50%"

Step 13 "Stop-Low Head" should be "Stop Low-Head" Note, p. 10 "depressuization" should be "depressurization" Step 18.1 (rt. col.) Should be 18.2 B.23

a Step 18.c.1 "noraml" should be " normal" Step 27 Both substeps are labelled "a*

i -- Step 27.a (rt. col.) "reinitiated" should be "reinitiate" Step 27.b (rt. col.) "retnitiated" should be "reinitiate" 1

/

e N

W i

4 e

t B.24

NORTH ANNA PGP AUDIT 1-ES-1.3 - TRANSFER TO COLD LEG RECIRCULATION Technical Review l NAPS ERG STEP STEP COMMENT Entry conditions should be expanded to include ECA-2.1.

1. 1. The. third caution before this step should reference the need for manual restart of safeguards equipment if offsite power is lost following SI reset.

1. 1. A NOTE regarding the foldout page should be added prior to Step 1: a foldout page should be used and should contain the applicable information from the ERG foldout page.

2. This ERG step verifies CCW flow to the RHR heat exchangers. A step of similar intent verify service water to recirculation spray heat exchangers?)(should be added after Step 1. _

5. A step should be added to align the containment (recirculation) spray system for recirculation (this might be accomplished in the valve alignments made in Step 4).

6. 6. If the entry conditions are modified to include additional entry procedures, then the transition in this step should be replaced with " Return to Guideline and Step in Effect".

9 i

l -

l l

8.25

Human Factors Review

1. Notes and Cautions CAUTION Page 2 (First and second cautions--

Hazardous condition & consequence notspecified.)

(Third--Hazardousconditionand consequence not specified. Should this be a Note?)

(Fourth--Conditional statement) 3 (Written as an action statement)

2. Logic Terms

3. Action Steps

, 4. Referencing and Branching a) The writer's guide indicates in Section 7.13, Emphasis, that the instruction for branching is to be written as "GO T0". It is written as "go to" in Step 4 (right column). '

b)

Procedure number and title Step 6 Procedure number, title and step no. Step 4 (right column) c) Step 5.a contains the expected response " GREATER THAN THAT REQUIRED BY 2-SC-3.2). There are several problems with this phrase. First, it appears to be a reference and should be revised to correspond with writer's guide specifications using the term " refer to." Second, the procedure referenced is designated a procedure for Unit 2 and the EP being reviewed is designated for Unit 1. Either the procedure referenced should be designated for Unit 1 or the information required included within the text of this procedure.

5. Action Verbs Inform Step 5 Return to Step 6 (Should be GO TO)

9. Checkoffs

10. Asterisks

11. Punctuation and Emphasis a) b)

d)

START PUMPS Step 2.a (right column)

GREATER THAN... Step 5.1 FULL Caution, page 3 B.26

1, e) In Step 4, the emphasis shown for the word "cannot" is capitalization and underlining. In other EPs, this word is broken dowr into two words, with only "not" given the emphasis. No guidance is given in the writer's guide regarding this. We recommend that a future revision of the writer's guide include specific emphasis specifications for the word, and that the EPs be changed to be consistent.

/

~

1 4

s B.27

NORTH ANNA PGP AUDIT 1-FRP-S.1 - RESPONSE TO NUCLEAR POWER GENERATION /ATWS Technical Review NAPS ERG STEP STEP COMMENT

4. 4. 1) The use of "-AN0/0R " and "-OR " between substeps b & c and c

& d, respectively, should be clarified to provide information as to which~ option (s) should be used. 2) Substep c should be wholly contained on a single page. 3) The contingency to substep e should include verification of containment ventilation isolation.

6. 6.* 1) AFW throttling criteria based on SG level should be included to prevent main steam line flooding. 2) The contingency should specify which pumps are to be manually started. 3) The contingency should specify which AFW valves are to be manually aligned.

10. 10. Substep a should be wholly contained on a single page.

i B.28 I

Human Factors Review

1. Notes and Cautions NOTE Page 3 (conditional statement)

Attachment 1 actionstep)

Attachment 2 action step)

CAUTION Attachment 1 consequencesareimplied)

2. Logic Terms a) -

Step 2.a (rt. col.) Numbering not specified in writer's guide Step 4.a-e What is the logic for the actions?

i Steps 10 and 11 Should be rewritten as one conditional statement Step 12 Paragraph form c

l 'b) .

3. Action Steps a) i Step 4.e Step 7.b Step 11.d.1 Step 12

Attachment 2, Steps 1.b and 1.e b)

Step 4 Step 10 Step 11 c) The addendum to the writer's guide dated May 31. 1985, dictates that "No portion of a single substep may be continued from one page to the next."

Step 10 of this EP splits substep "a" between pages 5 and 6. This should be corrected.

t j d) According to the writer's guide, Section 7.19.c, location information is to be presented after the action instruction. Attachments 1 and 2 should be rewritten accordingly.

4. Referencing and Branching The writer's guide indicates in Section 7.13, Emphasis, that the instruction for branching is to be written as "GO T0". It is written as "go to" in all instances.

1

5. Action Verbs i Insert Step 1.b (rt. col.)

i Place Step 2.a.1 (rt. col.) and Attachment 2 1

, B.29 i

Runback Step 2.a.2 (rt. col.)

Bypass Step 2.a.3 (rt. col.)

Switch Step 4.b.1 Inject Step 4.c Perform Step 4.e (rt. col.)

Dispatch Step 5.a and 5.b (rt. col.)

Discontinue Attachment 1 Proceed Attachments 1 and 2 Contact Attachment 2

6. Abbreviations and Acronyms P-T-L Step 2.a.1 (rt. col.)

GV Step 2.a PRZR Step 4.e MSIV Step 9 FCV Step 11

7. Definitions Step 4.b The use of AND/OR is not specified in the writer's guide. The --

inclusive OR means AND/0R.

, Step 4.d Replace "if desired" with precise specifications for manual initiation of SI Step 4.e (rt. col.) Does IF NOT refer to whether block valves are opened or whether PRZR PORVs are verified?

. Why is verify statement needed?

Step 5.a,b (rt, col.) Who continues with this procedure?

Unclear reference.

Step 12 (rt. col.) "Otherwise" should be replaced with precise specifications for the adding of positive reactivity.

8. Expected Responses Section 7.2 of the writer's guide describes the format for expected responses to high level action steps. However, in Step 6.b the expected response is CHECK FOR FLOW. The expected response should simply be FLOW.

9. Checkoffs

10. Asterisks

11. Punctuation and Emphasis a) b) .

c) In Steps 4, 8 and 10, OR should be underlined and the hyphens removed.

d)

UN Step 8 (rt. col.)

BOTH Attachment 2 B.30

12. Miscellaneous Step 4.c.4 This step is included twice Step 4.e The right column shows 2135 PSIG as the goal and left column shows 2335 PSIG.  !

Attachment 1 Corrossive corrosive)

Attachment 2 Occure3 (occ(uged) b e

.i e

f I

8.31

. i NORTH ANNA PGP AUDIT 1-FRP-H.1 - RESPONSE TO LOSS OF SECONDARY HEAT SINK Technical Review NAPS ERG STEP STEP COMMENT

4. 5. 1) The caution before this step should reference the need for manual restart of safeguards equipment if offsite power is lost following SI reset. 2) The contingency a.3, "Go to Step 5", is unnecessary and should be deleted.

5. 5. 1) The FW isolation valves should be opened before Substep b:

if they cannot be opened, the operator should be directed to Step 12, " Check for loss of secondary heat sink". 2) If a main feedwater pump cannot be started, then the operator should be directed to Step 8 "Depressurize at least one SG to less than 600 psig". 3) If feedwater cannot be established to a non-faulted SG, then the operator should be directed to Step 8 "Depressurize at least one SG to less than 600 psig". -

6. 6. If feedwater flow cannot be verified to at least one SG, then the operator should be directed to Step 8, "Depressurize at least one SG to less than 600 psig".

7. -

This step should be deleted as it serves no useful purpose (refer to Step 5.a).

8. 7. 1) The contingency a.1, "Go to Step 9b", should be "Go to 8b".

2) The contingency to substep a.2 should be "Use one PRZR PORV."

i 9. -

This step should be deleted as it serves no useful purpose (refer to Step 4).

12. 9.* If the criterion for RCS " bleed and Feed" is not met, the operator is instructed to return to Step 1. This puts the operator in a loop he may have to conduct many times until some exit criterion is met.

15. 12.* The operator has to wait at this point for approximately one minute before he can reset SI, ye the caution before Step 13 states to conduct Steps 13 througt 19 as quickly as possible.

19. 16. Substep a should be wholly contained on a single page.

20. 17.* Criteria for terminating RCS heat removal and exiting the procedure (going on RHR7) should be provided.

21, 18.* Guidance for refilling a SG once a source of feedwater is available should be provided.

30. 29. 1) The transition to ES-1.1, SI TERMINATION, should be located after this step as a separate high level step: it does not l provide instruction on how to maintain pressurizer level. 2)

The transition should provide a step reference (Step 117).

B.32 l _ _

9 Human Factors Review

1. Notes and Cautions CAUTION Page 2 First--conditional statement)

Second--conditionalstatement)

Third--incorrectly written conditional statement) 3 First--Conditional statement)

" " Second--ShouldthisbeaNote?)

" " 5 ShouldthisbeaNote?)

7 Action statement)

" 8 Should this be a Note?)

9 Conditional statement)

NOTE Page 10 Actionstatement) 11 Should be in front of Step 24) 12 Action statement)

2. Logic Terms a)

Steps 1 and 2 Should be rewritten as one _

conditional statement Step 1.b (rt. col.) Paragraph form Step 2.d Should this be a separate step?

Step 4 (rt. col.) No logic term for 1-3.

Numbering not specified in writer's guide.

Steps 6.a,b Should be rewritten as conditional statements Step 8.a.1 (rt, col.) Paragraph form Step 8 (rt. col.) Paragraph form Step 9 (rt, col.) No logic term for 1-3 Step 12 (rt. col.) Paragraph form Step 14 (rt. col.) Paragraph form Step 18 Should be rewritten as a conditional statement Step 19 (rt. col.) No logic tem for 1-4

, Step 24 Should be rewritten as a conditional statement Step 25 Should be rewritten as a conditional statement b)

3. Action Steps a)

Step 1.b -

Step 5.a Step 6.a Step 8.a.1

. Step 11.a Step 14.a

. Step 26.b Step 29

. B.33 9w y

1 b)

Step 19 Step 28

4. Referencing and Branching a) The writer's guide indicates in Section 7.13, Emphasis, that the instruction for branching is to be written as "GO T0". It is written as "go to," except on page 10.

~

b)

Step 1.a (rt. col.)

Steps 26.a,b (rt. col.)

Step 30

, c)

Step 1.b (rt. col.

Step 2.b (rt. col.

Steps 5.a,b (rt. col.) -

Step 7 Step 10 Caution, page 9

5. Action Verbs Make up Caution, p. 3 Attempt Steps 2 and 5 Realign Step 2.b (rt. col.)

Dispatch Step 2.c (rt. col.)

Reset Steps 4.a and 9.a (rt. col.) and 15 Depressurize Steps 8 and 19.a (rt. col.)

Dump Step 8 Depress Step 15.a Request Step 15.a rt. col.

Restore Step 18.a rt. col.

Try Step 18.c rt. col.

Feed Step 19.a.4 (rt. col.)

Continue Step 21 i Place Step 27.a

6. Abbreviations and Acronyms

! psig Caution, page 2, and Step 8 PSIG Step 12 PRZR Caution, p.2, Note, p.11, Steps 8, 12, 19, 20, 26, 29, 30 AS Step 8 -

CHG Step 25 -

TC Step 25 .

9. Checkoffs

10. Asterisks B.34

4

11. Punctuation and Emphasis a) b)

c) In Step 14.a. the logic THEN should be underlined. In Steps 2.b and 12, the logic OR should be underlined and the hyphens removed.

d)

ANY agtfon,page2 ALL "

LESS IMMEDIATELY a ". and Steps 8 and 12 Steps 1 and 11 EVEN ep 8 BOTH Step 19

\

i l

i 1

l B.35

o Attachment C--Verification / Validation Checklist The verification and validation programs will be analyzed to determine whether the programs address each of the following specific elements.

1. Review the procedure that specifies the verification process to determine whether it includes the documentation listed below. In addition, review the completed documenta.!on for each of the activities to determine whether the requested actions /information are sufficient to cover the intent of the verification review as requested in NUREG-0899.

The North Anna E0P upgrade program is not yet specified in North Anna Administrative Procedures. All documentation regarding the program is in the PGP and in the forms used for verification and validation. These are discussed below, o Verification method used (in-plant review method or reference method as described in the PGP submittal)

North Anna used in in-plant review method.

o Discrepancies that were identified Yes, technical discrepancies were identified on the verification form.

However, the discrepancies were only for steps that were placed in a different sequence and did not include discrepancies where steps were deleted or added. A different form was used to address deleted steps, but added steps were not verified. Discrepancies regarding human factors issues made up four checklist items on the verification form. The four items did not adequately cover the important points in the writer's guide.

i o Resolution of the discrepancy l

Yes, the resolution for the step sequence discrepancy was noted. However, no space was on the form for resolving discrepancies for added or deleted steps. In addition, there was no space on the form for resolving the human factors discrepancies.

o Bases for the resolution of the discrepancy A resolution for step sequence changes was requested on the verification l form. However, no resolution was requested regarding added or deleted steps nor for human factors discrepancies.

o certification of verification of written correctness Not really. There is a place on the verification form that requests that four writer's guide areas be checked in the procedure. However, there is no space on the form to certify that the E0Ps were written correctly in these areas. In addition, the four items in no way covered the most important aspects of the writer's guide.

o Certification of verification of technical accuracy.

There is a place on the fonn to certify that the E0Ps are technically accurate.

C.1

O O

2. Determine to what extent the vertftcation/ validation process used the following methods:

o Desk-top reviews Desk-top reviews were carried out by STAS for the verification process, o Operating team review Operating teams did not review the procedures. During the training in which the validation was done, operating teams did carry out the procedures. However, the evaluation was done by an additional SRO or the trainer and not by an operating team.

o Simulator exercises Simulator exercises used during the training classes were used to validate the procedures. However, the simulator scenarios, to date, did not cover all of the procedures. In addition, the scenarios, to date, only included single failures.

o Control room walk-through A control room walk-through is to be used to verify instrument reading accuracy and E0P nomenclature accuracy relative to control room labels.

This exercise had not been carried out on any of the seven procedures that were reviewed.

3. Determine who (from a technical expertise perspective) was involved in the verification / validation program. Specifically determine how plant operators, subject matter experts, and procedure writers were involved.

One person at North Anna was solely responsible for writing the E0Ps. He had an operations background. Two STAS were involved in the verification process.

R0s and SR0s were trained on the procedures as they validated them. Some

~

consultants from Essex had looked at the procedures in " handwritten" form approximately 9 months prior to the site visit. However, their main interest was in the Control Room Design Review and whether the control room was laid out to facilitate carrying out the steps in the E0Ps.

4. Determine what roles were played by the participants (see 3. above).

See 3. above.

5. Determine that a list of scenarios had been developed for the verification / validation process. More specifically, determine that the following had been carried out:

o Specific criteria were used to select the scenarios .

Not at present. ,

o The scenarios included multiple failures (simultaneous and sequent!ial)

To date, the scenarios only included single failures.

C . -2

o The scenarios were broad enough to verify / validate all of the E0Ps To date, this had not occurred, o If the simulator could not be used to verify /vdidate all E0Ps, then determine what method was used to verify / validate the E0Ps that could not be done on the simulator This was to be done using a simulator walk-through followed by a desk-top review.

6. Determine that an administrative mechanism exists to receive feedback on the accuracy, readability, usability, and/or. completeness of the E0Ps from the following:

o Simulator exercises A evaluation form was used for the validation process. The fom, however did not cover readability or usability. In addition, there was no space ,

on the form for comments from the trainer or operating team, o Control room walk-throughs -

This was to be used to verify reading accuracy for displays and that the E0Ps had correct nomenclature regarding control and display labels.

However, a fom for verifying that this had been accomplishad was not yet available, o Desk-top reviews Desk-top reviews were used for the verification process. There was a form for specifying that the verification had taken place.

o Operating team reviews Operating teams did not review the procedures.

o Operator training Operator training was used to validate the E0Ps. There was a form that was filled out following the validation. However, the form did not x provide space for comments from the operating teams.

7. If different from the administrative mechanisms analyzed for checklist item 5., determine what kind of plan exists for correcting and revising the E0Ps as a result of the validation / verification processes.

No additional administrative mechanism. See 6. above.

8. Determine that there is written commitment and criteria (probably in plant

. Administrative Procedures) for validatirig/ verifying revisions to the E0Ps. ,

At present, there is no written commitment, other than in the PGP, to verify or validate revisions to the E0Ps.

C.3

O

9. Determine what process was used to take into account differences between Units 1 and 2 in the E0P development and verification / validation process.

North Anna has not addressed this yet, because they are only doing Unit 1 E0Ps at present. They stated that there are very few differences between Unit 1 and Unit 2. Thus, when they do Unit 2, they plan only to verify and validate the differences between the Unit 1 and the Unit 2 procedures.

10. Determine what methodology or rationale was used to guarantee that the E0Ps are compatible with minimum control room staffing.

This was not specifically addressed in their program. However, some of the validation was done with minimum control room staffing.

11. Determine whether there was a methodology used to determine the adequacy (i.e., availability, readability, and usability) of control room instrumentation and controls that are needed to carry out the steps in the E0Ps.

This is to be done via the Control Room Design Review, which is not finished at present.

12. Determine what kind of process was used to verify the correspondence between E0Ps and control room displays and controls.

The control / display titles in the E0Ps are based on the procedure writer's experience. The titles are not necessarily off of the control room label.

This determination is to be done during validation on the simulator.

l l

C.4 l

Attachment D--Training Program Checklist The PGP described a training process on the E0Ps that included initial training, continuing training, and training on E0P revisions. The training is to be given to all licensed operators, licensed operations supervisors, and Shift Technical Advisors. Interviews with cognizant training personnel and analysis of training program lesson plans and documentation will be carried out to determine whether the following training elements are addressed.

1. Determine how the lesson plans for E0P classroom . training meet the following objectives:

o Operators will be trained regarding the general format and structure of the procedures.

Approximately two years ago Westinghouse spent one week training the licensed operators on the technical basis and format and structure of the WOG ERGS, Rev. O. No additional training is planned in this area.

o Operators will be trained on the technical bases for each of the procedures. -

See above answer.

o Operators will be trained on the content of each procedure.

Operators will be trained on the content of the main procedures, i.e., the EPs, post-LOCA cooldown and depressurization, SG tube rupture recovery, and safety injection termination. However, they will not be trained on some of the other procedures, e.g., the functional recovery procedures.

o Operators will be trained on guidelines on the use of the E0Ps.

This was done in classroom and simulator training.

o Operators are evaluated on their classroom training.

The operators were not evaluated on their classroom training regarding the E0Ps.

2. Determine how the simulator training meets the following objectives:

o That a wide variety of scenarios (i.e., incorporating simultaneous and sequential multiple failures) will be used during simulator training so that all E0Ps are exercised.

This criterion is not being met. Up to this time, the operators have only i been trained on single failure events.

S o That all operators are trained on all procedures.

All of the operators will not be trained on all of the procedures by the June 30 implementation date.

D.1

o That operators are evaluated on their simulator training.

The crew is evaluated on simulator training, but individuals are not evaluated.

3. Determine what type of continuing training will be carried out regarding both classroom and simulator training.

Plans for continuation training have not been made at this time.

4.

Determine what self-taught, shift criteriaclassroom briefings, exist for instruction, deciding what kind of training and simulator needs -()1.e.

to be carried out with regard to revisions on the E0Ps.

No written criteria exist. However, the procedures and training staff will get together to determine whether the change was large enough to warrant additional training. Operations would have to request such training before the training staff can carry such training out. Training would be on the simulator, if possible.

5. Determine whether all of the E0Ps can be trained on the simulator. If such is not the case, determine what type of training is planned for those-E0Ps or parts of E0Ps.

Not all E0Ps can be trained on the simulator. In these cases, training is done through a desk-top talk-through or a simulator walk-through.

6. Determine whether and to what extent control room walk-throughs will be used for training purposes.

Only used for those scenarios that cannot be run on the simulator.

t 4

o D.2

l I

l Attachment E--Simulator Exercise Checklists Simulator exercises were run on the North Anna plant-reference simulator during the swing shift en May 6,1986. Five simulator exercises had been developed to cover the subset of E0Ps that had been reviewed for the audit:

Scenario 1--Reactor Trip with ATWS Scenario 2--Steam Break Inside Containment Scenario 3--Steam Generator Tube Rupture with Loss of Reactor Coolant Scenario 4--Loss of Heat Sink with Bleed and Feed Required Scenario 5--LOCA Outside Containment In addition to these scenarios, one simple event was run first as a " warm-up."

Also, an additional exercise was run at the end at the request of the Region II personnel who were watching the exercises.

North Anna is a dual-unit plant, and the control rooms for both units are located in the same room. The required shift staffing is one Shift Supervisor (SRO licensed), one Assistant Shift Supervisor (SRO licensed), and three licensed Reactor Operators (R0s). Regarding the three R0s, one is assigned to_

Unit 1, one is assigned to Unit 2, and the third works on the back panels for both units. Only one of the SR0s is required to be in the control room.

Thus, when an emergency event first occurs, North Anna's plan is for one RO to run the unaffected unit, and for two R0s and one SRO to staff the affected unit. Four other operators (who may or may not be licensed are also on duty in the plant and are to report to the control room as soon a)s possible following a reactor trip. One of these four operators (the most senior) will act as the reader for the E0Ps.

North Anna provided two R0s and one SRO for the simulator exercises. Thus,

.JRC audit team members served the function of the reader and the STA on most scenarios. During two scenarios, one of the R0s was used as a reader, and the simulator trainer filled in for him on the boards. .

The following pages contain the checklists that were used to evaluate the simulator exercises. The checklists are filled out only for the five planned exercises listed above. Checklist items that were not applicable did not receive a response.

i l

E.1

SIMULATOR EXERCISC CHECKLIST NORTH ANNA POWER STATION SCENARIO 1: REACTOR TRIP WITH ATWS 1.0 Can the operators follow the procedures as written? Yes No 2.0 Did the use of the procedures mitigate the transient? Yes No

/

2.1 If NO, did the operators have to leave the procedures and wing it?

Yes -

No 2.2 Did the operator add steps or exit to an unspecified procedure?

Yes No 2.3 Can the procedures handle concurrent multiple failures?

Yes No 2.4 Can the procedures handle sequential failures? Yes No 3.0 Can the procedures be used effectively by the minimum control room l staffing?

Yes No l

4.0 Are the transitions to other procedures clear and easily followed?

Yes l No l

l E.2

SCENARIO 1 (CONT.): REACTOR TRIP WITH ATWS 5.0 Do the diagnostics direct the operators to the correct procedure?

Yes No 6.0 Are the operators comfortable in using the procedures? Yes No 7.0 When the operator is following the procedure is his movement along the control board reasonable?

Yes No 8.0 Are the instruments and labels easily read and understood by the operators?

, Yes No 9.0 Are the readings requested in the procedures available directly from the instruments? _

Yes No 10.0 Is the relationship between the various procedures (E, ES, FR, ECA) and the status trees understood?

Yes No Operator Comments Observer Comments o The " expected" path often took the reader to the right hand column of the procedure. An inexperienced reader tended to remain in the left hand column when plant response was as expected.

o Operators got ahead of the procedure reader on occasions when they knew what was coming.

o Manual control of the atmospheric dump valve is by manipulation of a 10 turn pot, which had no direct relation to the desired steam pressure.

E.3

\

SIMULATOR EXERCISE CHECKLIST NORTH ANNA POWER STATION SCENARIO 2: STEAM BREAK INSIDE CONTAINMENT I.0 Can the operators follow the procedures as written? Yes E2 2.0 Did the use of the procedures mitigate the transient? Yes No

/

2.1 If NO, did the operators have to leave the procedures and wing it?

Yes -

No 2.2 Did the operator add steps or exit to an unspecified procedure?

Yes No 2.3 Can the procedures handle concurrent multiple failures?

i Yes No 2.4 Can the procedures handle sequential failures? Yes No 3.0 Can the procedures be used effectively by the minimum control room staffing?

Yes No 4.0 Are the transitions to other procedures clear and easily followed?

Yes No D

i E.4

SCENARIO 2 (CONT.): STEAM BREAK INSIDE CONTAINMENT 5.0 .Do the diagnostics direct the operators to the correct procedure?

Yes No 6.0. Are the operators comfortable in using the procedures? Yes U2 7.0 When the operator is following the procedure is his movement along the control board reasonable?

Yes No 8.0 Are the instruments and labels easily read and understood by the operators?

' Yes No 9.0 Are the readings requested in the procedures available directly from the instrLaents? .

Yes E2 10.0 Is the relationship between the various procedures (E, ES, FR, ECA) and the status trees understood?

Yes No Operator Comments f

Observer Comments o Items 1 and 6. The use of double negatives in some steps caused confusion in determining the correct path to follow.

o Item 9. Containment pressure was displayed in units of psig, while the E0P units were psia.

e b

e E.5

O l

SIMULATOR EXERCISE CHECKLIST NORTH ANNA POWER STATION SCENARIO 3: STEAM GENERATOR TUBE RUPTURE WITH LOSS OF REACTOR COOLANT 1.0 Can the operators follow the procedures as written? Yes E2 2.0 Did the use of the procedures mitigate the transient? Yes No a

2.1 If NO, did the operators have to leave the procedures and wing it?

s Yes -

No 2.2 Did the operator add steps or exit to an unspecified procedure?

Yes No 2.3 Can the procedures handle concurrent multiple failures?

Yes No 2.4 Can the procedures handle sequential failures? Yes No 3.0 Can the procedures be used effectively by the minimum control room staffing?

Yes EE 4.0 Are the transitions to other procedures clear and easily followed?

Yes No E.6

w SCENARIO 3 (CONT.): STEAM GENERATOR TUBE RUPTURE WITH LOSS OF REACTOR COOLANT 5.0 Do the diagnostics direct the operators to the correct procedure?

Yes No 6.0 Are the operators comfortable in using the procedures? Yes EE 7.0 When the operator is following the procedure is his movement along the control board reasonable?

Yes EE 8.0 Are the instruments and labels easily read and understood by the operators?

Yes No

' 9.0 Are the readings requested in the procedures available directly from the -

instruments?

Yes EE 10.0 Is the relationship between the various procedures (E, ES, FR, ECA) and the status trees understood?

Yes No Operator Comments o SI should have been initiated sooner as they could not deal with the SGTR until they manually initiated SI.

Observer Comments o Operators got ahead of the procedure reader on occasions when they knew what was coming (e.g., isolating a faulted SG).

o Items 1 and 6. 1) The operators were uncertain if they should reevaluate the desired core exit temperature upon transition back to Step 15.b of EP-3. 2) The operators were uncertain of the criteria to terminate RCS depressurization at Step 18 of EP-3 (the step used AND and -OR- in combination). 3) The operators were uncertain of what actions to take at Step 31 of EP-3 since the table does not provide guidance if ruptured SG(s) level is stable, o Item 3. The SRO had to perform some of the manipulations during the scenario. .

o Item 7. The operators "ran into each other." Movement was partially restricted by a mockup of proposed additions to the control room.

E.7

SCENARIO 3 (CONT.): STEAM GENERATOR TUBE RUPTURE WITH LOSS OF REACTOR COOLANT o Item 9. Step 4.c of EP-3 has the operator check if a PORV on a ruptured SG is closed. The operator could only check demand indication, not actual position indication.

/

b e

9 e

S l

l E.8

7 SIMULATOR EXERCISE CHECKLIST NORTH ANNA POWER STATION SCENARIO 4:

LOSS OF HEAT SINK WITH BLEED AND FEED REQUIRED 1.0 Can the operators follow the procedures as written? Yes Ng 2.0 Did the use of the procedures mitigate the transient? Yes No 2.1 If NO, did the operators have to leave the procedures and wing it?

Yes ^

No 2.2 Did the operator add steps or exit to an unspecified procedure?

Yes No 2.3 Car the procedures handle concurrent multiple failures?

Yes No 2.4 Can the procedures handle sequential failures? Yes No 3.0 Can the procedures be used effectively by the minimum control room staffing?

Yes No 4.0 Are the transitions to other procedures clear and easily followed?

Yes No e

i I

E.9 4

SCENARIO 4 (CONT.): LOSS OF HEAT SINK _WITH BLEED AND FEED REQUIRED 5.0 Do the diagnostics direct the operators to the correct procedure?

i Yes No 6.0 Are the operators comfortable in using the procedures? Yes Ng ,

7.0 When the operator is following the procedure is his movement along the control board reasonable?

Yes No 8.0 Are the instruments and labels easily read and understood by the operators?

Yes No 9.0 Are the readings requested in the procedures available directly from the instruments?

~

j Yes No l 10.0 Is the relationship between the various procedures (E, ES, FR, ECA) and the status trees understood?

Yes No Operator Comments Observer Comments o Operators got ahead of the procedure reader on occasions when they knew -

what was coming.

o Items 1 and 6. 1) As the criteria for RCS " bleed and Feed" was not

.immediately met in Step 12 of FRP-H.1, the reader returned to Step 1. The reader made countless loops until some exit criterion was met. 2) The operator had to wait at Step 15 of FRP-H.1 for approximately one minute before he could reset SI, yet the caution before Step 13 states to conduct Steps 13 through 19 as quickly as possible. 3) The operator was uncertain of how long to maintain RCS heat removal at Step 20 of FRP-H.1 and how (if?) he could exit the procedure (go on RHR?). 4) The operators were uncertain of what guidance to use in refilling a SG at Step 21 of FRP-H.1 once a source of feedwater was available.

t e

E.10

(

e V

SIMULATOR EXERCISE CHECKLIST NORTH ANNA POWER STATION SCENARIO 5: LOCA OUTSIDE CONTAINMENT 1.0 Can the operators follow the procedures as written? Yes Ng 2.0 Did the use of the procedures mitigate the transient? Yes Ng 2.1 If NO, did the operators have to leave the procedures and wing it?

Yes No 2.2 Did the operator add steps or exit to an unspecified procedure?

Yes No 2.3 Can the procedures handle concurrent multiple failures?

Yes No 2.4 Can the procedures handle sequential failures? Yes No 3.0 ~Can the procedures be used effectively by the minimum control room staffing?

No 4.0 Are the transitions to other procedures clear and easily followed?

Yes No e

E.11 l

v .

' SCENARIO 5 (CONT.): LOCA OUTSIDE CONTAINMENT 5.0 Do the diagnostics direct the operators to the correct procedure?

Yes E2 6.0 Are the operators comfortable in using the procedures? Yes EE 7.0 When the operator is following the procedure is his movement.along the control board reasonable?

Yes No 8.0 Are the instruments and labels easily read and understood by the operators?

' Yes No 9.0 Are the readings requested in the procedures available directly from the instruments? _

Yes No 10.0 Is the relationship between the various procedures (E. ES, FR, ECA) and the status trees understood?

Yes No Operator Comments o They knew they had a LOCA outside of containment, but by procedure they were not able to get to the procedure that handled the situation.

Observer Comments o Items 1, 2, 5 and 6. Due to a transition at Step 14 of EP-1, the operators l

were unable to get to Steps 16 through 18 of the procedure which would provide a transition to the appropriate procedure. The operators finally exited to the appropriate procedure on their own, l

l l

l l

(

d E.12

s' <

r; i Attachment F--Control Room Walk-Through' Checklist There are three objectives to be accomplished in the control room

, walk-through:

o To detemine whether the controls /dislays that are identified in the E0Ps as being in the control room are indeed there o To determine whether the control room nomenclature corresponds to the way in which instruments and controls are referred to in the E0Ps o

To determine whether the instrumentation can be read to the accuracy required to carry out the E0P.

In order to meet these objectives, EP-0 was selected for review. A control room check of all nomenclature and accuracy requirements in the procedure was conducted. Because the control room for Unit I was extremely busy at the time, the control room walk-through was carried out on the Unit 2 control

' room, even though the version of EP-0 that we were using was written for

. Unit 1. The operator, who accompanied us on the walk-through, believed that i

because of the high similarity between the control rooms, doing the

' walk-through on Unit 2 would suffice. The following discrepancies were found

' between E0P nomenclature or required accuracy levels and control room '

labelling and instrumentation.

1. There is a concern with regard to reading accuracy with Step 16c (right column), " CHECK PRZR PORVs AND SPRAY VALVES." Pressurizer pressure is to be checked to be less than 2255 psig. The instrument in the control room reads in 20 psig increments. From where the operator will be reading the instrument, he will not be able to read at the required accuracy. [ NOTE:

North Anna staff indicated that this problem had been identified in the Control Room Design Review and that it was to be corrected by placing an i

additional instrument in the control room.]

2. Attachment 1, page 1 of 4. Under the column OPEN (RED), the list of MOVs

' from MOV-SW-103A through MOV-RS-155A have two dashes in the designatten.

' The labels in the control room do not have the second dash. It appears that these labels in the control room are inconsistent with the other labels in the control room.

3. Attachment 1, page'3 of 4. a) Under " DIVERT TO IODINE FILTER, A00-HV-128 is labelled A0D-128 in the control room. b) Under " CLOSED (GREEN),"

i TV-SW-101A and TV-SW-101B are labelled TV-SW101A and TV-SW1018 in the control room. c) According to the control room labelling, TV-SW-110A and TV-SW-114A should read MOV-SW-110A and MOV-SW-114A. d) On page 4 of 4 under Step 4, MOV-RS-100B through MOV-RS-101B are written with two dashes.

The control room labelling does not include the second dash.

4. Attachment 2, page 1 of 3, under " CLOSED (GREEN)." All of the valves listed are trip valves and are labelled as TV-XX-XXXX in the control room.

The "TV " designation is not included in the Attachment. *

, 5. Attachment 2, page 3 of 3, under 4 2 Ventilation Panel," the control room vent dampers are listed as A00-HV-160-2 and A00-HV-161-2 in the procedure, a

but as MOD-HV-160-2 and M00-HV-161-2'in the control room. The operator

' that helped us in the control room was not sure whether the dampers for Unit 2 were motor driven or air driven, so was not clear whether the procedure was correct or the control room label was correct.

F.1

-. . _ _ _ - _-..- -.- - _ _ - _ - - _ - _ - - _--