ML20141J523

Human Engineering Discrepancy Review & Closeout Process for Davis-Besse Dcrdr Program

ML20141J523
Person / Time
Site:	Davis Besse
Issue date:	04/18/1986
From:	TOLEDO EDISON CO.
To:
Shared Package
ML20141J521	List: ML20141J518 ML20141J523
References
PROC-860418, NUDOCS 8604280163
Download: ML20141J523 (128)

Text

ENCLOSURE 1

. Page 1 of 6 HUMAN ENGINEE*11NC DISCREPANCY REVIEW AND CLOSE0UT PROCESS FOR THE DAVIS-BESSE DETAILED CONTROL ROOM DESIGN REVIEW PROGRAM INTRODUCTION The following guidelines have been established to control the review and documentation of the HED closecut process. These guidelines are to be used during the evaluation of the 29 safety significant HEDs to determine the adequacy of corrective actions to be implemented during the current outage, and to provide justification for those HEDs not to be corrected during this outage. These guidelines will subsequently be used to develop the detailed procedure in support of this process.

The evaluation of the 29 safety significant HEDs will begin with the preparation of detailed documentation for each HED. The documentation will be based on the final HED forms originally prepared under the DCRDR program and will be expanded to include information on specific components which were generically listed on the original HEDs. The clarification of the components included in an HED is to be performed by experienced operators with input from a Human Factors specialist on the interpretation of the basic HED problem. The HED reports developed for the 29 safety significant HEDs are to be reviewed by the Independent Process Review Committee established as a part of the System Review and Test Program cs described in the Davis-Besse Course of Action. Their review will supplement that of the Review Team established for the HED closecut process as described below.

HED DOCUMENTATION HEDs are to be consistently documented on a form containing the fields of information included in Attachment 1 to these guidelines. The following guidelines describe the information to be included in each of the fields.

Field Name Description Title The title should be a short description of the problem, sufficient for identification by DCRDR team members.

HED Number Each HED will be individually numbered using the original HED numbering code.

Category The category of an HED is used to describe the significance of an HED with respect to error potential and safety consequence. The categorization system is consistent with that described in the original DCRDR Summary Report as supplemented by the January 31, 1985 letter to the NRC on Safety Significance Ranking. The first item in the category field expresses the error potential.

8604280163 860418 f ADOCK 05000346 ~

PIHR

e ESCLOSURE 1 Page 2 of 6 III indicates that the potential for operator error on the basis of the problem is very low.

II indicates that the potential for operator error is sufficiently high to warrant an evaluation of the safety significance.

I indicates that an error associated with the HED has occurred.

For those HEDs with an Error Assessment categorization of I or II, a.further evaluation of the problem with respect to safety significance will be performed.

C is assigned if the error will not . result in a violation of Technical Specifications or lead to unsafe plant operation.

If the error can lead to a violation of Technical Specifications or unsafe plant operation, a safety significance category of A or B is assigned.

A is assigned if the components involved are safety related.

B is assigned when associated components are non-safety related.

An additional evaluation of those HEDs categorized A or B is performed to more clearly indicate the degree of safety significance of the respective probles. The final categorization codes are H. M, and L.

H indicates that the potential error associated with the HED may lead to a complete loss of safety function.

M signifies that the error may result in a degradation of safety function or challenge to a safety system.

L indicates that the error could potentially result in a challenge to a safety system.

As HEDs are categorized, the uso of these guidelines should not preclude placing an HED in a more significant category if the accumulative and interactive effects of other related HEDs warrant.

~

4 ENCLOSURE l' Page 3 of 6 Status The HED may be reviewed and approved in any of three.

stages. "Inc. Dis. App." indicates that interim disposition approval has been given. No final disposition has been established, nor has the HED been corrected, but the disposition correctly reflects the current plans for the HED including where necessary justification of deferral. " Disp. Closed" indicates that the disposition identified in the HED is sufficient to correct the HED in its entirety even though the corrective acticn has not been taken. " Closed" indicates that corrective actions have been taken which completely address the HED and no further action is required. ,

Date Originated This is the preparation date on the original HED form.

Items Involved Information in the Items Involved field should be sufficient to identify all components associated with the HED. In some cases, generic references to a class or group-of components may be appropriate if further clarification provides no useful information in the assessment and disposition of the HED. 3 Information in.this field may include additional subfields as necessary, for example . panel numbers, specific component identification numbers, component  :

descriptors, and. if HED assessment is to be performed ,

on a component basis, and additional category subfield is appropriate which will list the

. assessment categories as described in the Category -

field above for each of the components. The category of the most significantly ranked component becomes the category of the HED.

Problem 1 2 Description This field should contain a description of the Human Factors probles as it applies to the components listed. Where applicable the problem should be generically described for groups or types of-components, but if the scope of the HED is-sufficiently broad, a subgroup or component level probles description may be required.

NUREG-0700 PARA This field contains a listing of those NUREG-0700 sections associated with this HED.

Data Source This includes a brief descripticn of the activity or document which originated the HED.

m EWCLOSURE 1 Page 4 of 6 Specific Error The Specific Error is a brief statement of the type of error possible as the result of the condition described.

Assessment

-Justification This section includes the justification for the selection of HED category. This section should contain a_ statement explaining why generic assessment of HEDs with multiple components is to be performed, if appropriate. If the.HED is to be categorized at a subgroup or component level, the justification for ,

each is to be provided. In cases where large groups of components are individually categorized, information which might otherwise be placed in the Problem Description or Disposition sections may be factored into the Assessment Justification to maintain a logical flow of information.

Disposition This section will contain a narrative description of the status of corrective actions for this HED and its justification. For those HEDs which are to be fully corrected, this narrative will contain a description of the modification and an evaluation of why the modification addresses the original HED. The detail of the description 'and justification will be commensurate with the complexity of the HED and its corrective action. Where a corrective action addresses only part of an HED or where a corrective action will not be implemented on an HED until a later time, justification will be provided stating why the delay is acceptable and indicating where appropriate any applicable compensatory actions.

The level of detail provided on the justification shall also be in accordance with the complexity of the HED and its safety significance. Fcr those HED partially or fully corrected by a modification, the disposition will include a description as to why the modification does not create any new HEDs including reference to the separately documented Human Factor Review of the modification. Where modifications have been implemented to correct an HED on an interim basis pending subsequent implementation of a permanent corrective action, the narrative should generally address plans for final correction, including FCR numbers if appropriate.

Schedule This field includes a briaf statement of planned schedule for corrective actions yet to be taken.

A >

ENCLOSURE 1

. Page 5 of 6 Interim / Final Disposition Approval The Chairman of the HED Review Team is to circle Interim or Final in signing this location to signify Review Teas approval of 'che HED in its interim disposition approval or disposition closed status.

Final Imple-mentation Approval The HED Review Team Chairman signs in this location to signify that the Review Team has approved the closure of this HED.

REVIEW OF HED CORRECTIVE ACTIONS The final procedure for the control of reviews of proposed HED corrective

. actions will require that the human factors review of changes be conducted as early as possible in the development of the change. For example, the review of changes controlled by the FCR process should involve human factors expertise in the development of the FCR, the initial conceptual '

design activities, and the. detailed design development activities. For the purposes of documenting the evaluation of the 29 safety significant HEDs, the review of the proposed changes must be made at a specific point in time and may, therefore, be conducted on changes in any stage of their

- development from initial design to final implementation.

For each HED with proposed corrective actions affecting the operators interface with the Control Room to be implemented prior to restart, a review will be performed by a human factors specialist to assure that the proposed change does not create any new HEDs. This review will be guided by a checklist type form (see Attachment II) which will lead the human factors specialist through the evaluations necessary to determine what degree of review is_ required and ultimately conclude _that all pertinent requirements ' nave been satisfied, and that no new HEDs have been developed, or if they have, that they have been appropriately documented. During this review process, the documentation necessary to describe the modification should be collected to facilitate the disposition documentation activity.

HED DOCUMENTATION REVIEW The HED documentation will be reviewed and approved by a group of individuals with at least one representative f rom each of the following three areas of expertise: human factors, Station Operations (minimum R0 license with on shift experience), and Nuclear Engineering. Each of these individuals will meet NUREG-0801 qualifications. Their review shall insure that the scope of the HED indicated on the Items Involved and Problem Description sections are appropriate and that the Category and Assessment-Justification are appropriate. Their r-view shril also ensure that the description of the corrective actions acequately addresses the HED and does not create new HEDs (or if they do, that new HEDs are appropriately

- documented), or that the justification for postponement of corrective actions is correct and adequate. Agreement on the adequacy of the disposition should be unanimous.

HEDs should be reviewed during formally conducted meetings of the group

ENCLOSL*RE 1

- Page 6 of 6 with meetirg minutes identifying partic' pants, a list of the HEDs reviewed, and the results of the review, including a-record of any disagreements and their final resolution. A chairman will be appointed who will sign off on the HED identifying the approval as either an interim approval if additional corrective action is required to completely close out the-HED, or as final approval if the HED is to be closed.

-The signed HEDs shall be collected in a notebook and subsequent updates to HEDs with interim approvals will be similarly reviewed and approved until final approval is obtained with successive copies of the HED included in the notebook.

6 JRL/400

ATTACHMENT I PAGE: - of -

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: HED NO:

CATEGORY:

STATUS:

DATE ORIGINATED:

ITEMS INVOLVED:

. PROBLEM DESCRIPTION:

NUREG-0700 PA_RA:

DATA SOURCE:

SPECIFIC ERROR:

ASSESSMENT JU3TIFICATION:

DISPOSITION:

SCHEDULE:

INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMFLEMENTATION APPROVAL: DATE JRL/006

ATTACHMENT 2 KED No.

t

. Sheet 1 of 2 Page 1 of 2 HUMAN FACTORS VERIFICATION OF DESIGN IMPROVEMENT BRIEF DESCRIPTION:

TYPE OF VERIFICATION: Initial Interim Implementation BASIS OF REVIEW:

Documentation Review (specify document number)

FCR Request FCR Concept Design FCR Detailed Design Maintenance Work Order Procedure Other Hardware Assessment AFFECTED COMPONENTS:

THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

Yes No N[A A. Comparison with NUREG-0700 guidelines B. Comparison with T/A I&C reqts C. Operations review and comments D. Walk-throughs E. Other (specify)

ATTACHMENT 2 HED No.

Sheet 2 of 2 Page 2 of 2 TE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT TE DESIGN IMPROVEMENT:

Will fully satisfy the human factors concerns in the HED.

Will partially satisfy the human factors concerns in the HED.

Will not satisfy the human factors concerns in the HED.

JUSTIFICATION:

TE DESIGN IMPROVEMENT (WILL) (WILL NOT) RESULT IN ANY NEW EDs. (IDENTIFY NEW EDs If APPROPRIATE.)

JUSTIFICATION:

FURTHER HUMAN FACTORS REVIEW (IS) (IS NOT) REQUIRED. ,

JUSTIFICATION:

l 3EVIEWER: DATE:

1 HED/001 )

l l l I

- - _ . - , - - - . - - - ~ - - - - - - - _ . . - - -.

y ENCLOSURE 2 Sheet 1 of 3 MINUTES HUMAN-ENGINEERING DEFICIENCY REVIEW MEETING DAVIS-BESSE NUCLEAR POWER STATION APRIL 14, 1986 Present: . Louis Simon.. Chairman Operations Engineering (SR0 License)

Cal Hoffer Reactor Operator (R0 License)

Allen Elliff Essex Corporation Jacque Lingenfelter Operations Engineering Craig Hengge IPRC Bob Brodsky IPRC Mike Derivan IPRC (SRO License)

Ed Hughes IPRC Don Nitti IPRC Gary Shanker IPRC Dwight Harrison IPRC The newly prepared documentation of the 29 HEDs originally categorized as safety significant (Category A or B) was reviewed during this meeting.

The review included an evaluation of the scope of the HED as defined in the list of Items Involved and in the Problem Description. The Assessment Justification was reviewed for completeness and accuracy, and the Disposi-tion was reviewed for the acceptability of corrective action and/or justification of deferral. The proposed Schedule was reviewed for accepta-bility.

The results of the review are as follows:

HED No. Title 1.7.010 No Lamp Test; Dual Bulbs or Dual Approved with comments Filament Bulbs 1.7.011 Pushbuttons/ Indicator Lights Have Approved Shorted Out During Bulb Replacement 3.1.037 Annunciators With Inputs From More Approved with comments Than One Plant Parameter Setpoint Is Not Avoided 4.1.004 Accidental Actuation of Controls Approved with comments Positioned Too Close Together 5.1.002 Indicator Lights That Indicate Sys- Approved with comments tem or Equipment Status When Off 5.1.006 Parameter Range Exceeds Scale Value Approved I

ENCLOSURE 2 Sheet 2 of 3 HED No. Title 5.1.007 Pointers on Meters Do Not Fail Approved with comments off scale 5.1.009 Multi-Scale Meters That Are Confus- Approved with comments ing to Read 5.1.029 Meters With Pointers That Have Para- Approved with comments llax Problems 6.1.012 Labels That Are Not Placed Above the Approved with comments Panel Elements They Describe 6.1.015 Temporary Labels. Magnetic Labels. Approved with comments and Information Tags Obscure Com-ponents 9.2.001 SFRCS Display Arrangement Does Not Approved with comments Support Verification of Actuation l Tasks 9.2.004 Related Controls and Displays Not Approved with comments Located Together 9.2.005 Misleading Panel Arrangement For ICS Approved with comments Input Select Switches 9.2.006 Violation of Operator Expectancy - Approved SFAS Trip Buttons l

9.2.007 Displayed Auxiliary Feedwater Flow Approved with comments Indication Not Sufficiently Accurate 9.2.018 Availability / Consistency of SFRCS Approved with comments Information 9.2.020 SFAS Incident Isolation Component Approved with comments l Arrangements Are Inconsistent 9.2.028 Potential For Misleading Feedwater Approved Flow Indication 9.2.030 Reactor Coolant System Temperature Approved with comments Display Visibility 9.2.033 Spatial Relationship of Auxiliary Approved with comments Feedwater Components 9.2.042 Steam Generator Level Inputs to Approved with comments SFRCS and Control Room Indications Differ

ENCLOSURE 2 Sheet 3 of 3 HED No. Title 9.2.043 SFRCS Block For Startup Feedwater Approved with comments Valves Located Outside of Control Room 9.2.047 Decay Heat Pump /HPI Pump Mimic Approved with comments Relationships Are Unclear 9.2.054 SFRCS Manual Initiation Switches Approved with comments Are Not Located or Arranged to Support Emergency Task Sequences 9.2.065 Unreliable Control Room Displays Approved with comments {

l 9.2.083 Information Displays Not Available Approved with comments  !

in Control Room 9.2.084 Information Displays Not Available Approved with comments in Control Room 9.8.007- Displays That Do Not Provide the Approved with comments Precision Accuracy Required f */ Y Yb

-HED Review Group Chairman Date 1

JRL/401 w , - . .

ENCLOSURE 3 HUMAN' ENGINEERING DISCREPANCY (HED) REPORTS

l. . . . . .

~

- - - _ _ _ _ = . _ _ - _ _ _ _ _ _ _

PAGE 1 0F 11 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: No Lamp Test; Dual Bulbs or Dual HED NO: 1.7.010 Filament Bulbs CATEGORY: lA-L STATUS: Int. Dis.Apr DATE ORIGINATED: 7/22/83 ITEMS INVOLVED:

Panel ID Component ID Component Description Category C5703 HIS MU2B Letdown Isol III HIS 3971 Mu Pump Suction III HIS DH11A Control Power Off Ind III C5704 HIS DH12A Control Power Off Ind III HIS DH11 Decay Heat Suction III HIS DH12 Decay Heat Suction III HIS DH1517 Decay Heat Suction III HIS DH1518 Decay Heat Suction III HIS DH830 Decay Heat X Connect III HIS DH831 Decay Heat X Conenct III C5705 HIS RC11 PORV Block III HIS RC2-6 PORV Pilot Lvr Position III HIS RC2-1 Press Spray Control Viv III HIS RC10 Press Spray Block Viv III HIS 2735 Aux Spray to Pressurizer III HIS 2736 Aux Spray to Pressurizer III C5706 HIS 3869 AFP Discharge IIA-L I HIS 3870 AFP Discharge IIA-L HIS 3871 AFP Discharge IIA-L HIS 3872 AFP Discharge IIA-L C5709 HIS 5889A AFP Steam Inlet IIA-L

} HIS 5889B AFP Steam Inlet IIA-L lc I C5716 HIS HP32 HPI Minimum Flow Isol III f HIS HP31 .HPI Minimum Flow Isol III

( .:IS DH64 DH to HP1 Piggyback III H1; DH63 DH to HPI Piggyback III i

l o . - r .

w DAVIS-BESSE HUMAN.ENGINERING DISCREPANCY (HED) REPORT HED NO: 1.7.010 PAGE 2 0F 11 Panel ID Component ID Component Description Category C5717 HIS ICS11B Atmospheric Vent Valve IIA-L HIS ICS111 Atomspheric Vent Valve IIA-L HIS 107A Mn Sem Line 2 to AFTP2 IIA-L HIS 107E Mn Stm Line 2 to AFTP2 IIA-L HIS 601A MFW Containment Isol IIA-L HIS 106A Mn Stm Line 1 to AFPT 1 IIA-L HIS 106E Mn Stm Line 2 to AFPT 2 IIA-L HIS 612A MEW Containment Isol IIA-L HIS 394 SG Warm Up Drains IIA-L HIS 375 SG Warm Up Drains IIA-L ,

C5721 HIS 779 MFW Block Isolation IIA-L HIS 780 MFW Block Isolation IIA-L HIS 611 Steam Generator Drains IIA-L HIS 603 Steam Generator Drains IIA-L PROBLEM DESCRIPTION:

Lamp test, dual bulbs or dual filament bulbs are not provided for the majority of the indicator lights on the control boards. Since the presence of a light is the primary means by which light indicators communicate a message, it becomes essential that the light signal be physically reliable.

Unreliable bulbs (burned out) can cause loss of information and misinter-pretation of displayed information by the operator. Most of the light indications in the Control Room have more than one light to indicate status such as open or close indications on a valve or on and eff indications on a pump. The normal condition for most indications is one or the other light illuminhted, and the operator is alerted to an obnormal condition when no lights are on. For valves that the operator or an automatic control system has changed the position of, the operator must wait for the stroke time of the valve to verify the new desired position. Thus, a burned out bulb would alert the operator to an abnormal response but could delay verifica-tion of the new desired position. (At Davis-Besse both lights are off during a portion of a valve's stroke time. Also, both lights are off if the valve has no power with a few exceptions where separate power is pro-vided for position indicating switches.) In some cases additional indications such as flow indication or alarms can be used to verify proper valve position. If an automatic system has repositioned a component and the new position indicator light is burned out, the proper function has been performed, but the operator's ability to verify proper operation has been delayed.

The indicators listed in this HED are those that have a potential for delaying operator verification of proper system response as required by Emergency Operating Procedures.

Control Room indicators that have dual bulbs, lamp test checks and dual indicating status are not included in this HED.

DAVIS-BESSE HUMAN ENGINERfNG DISCREPANCY (HED) REPORT HED NO: 1.7.010 PAGE 3 0F 11 Electrical breaker position indicators are not included in this HED. The Control Room indication is green light on for breaker open and red light on for closed.- The absence of a light alerts the operator to an abnormal condition. Bus voltage meters and alarms warn of an abnormal condition.

Most pumps also have amp meters and often flow indiction is also available.

Electrical breaker position change is instantaneous, and the operator is immediately aware of a real failure of a breaker to operate. Pump and fans that are started by the Safety Features Actuation System (SA) have Safety Features Actuation Monitor (SAM) lights which separetely verify proper component operation. A dim SAM light indicates that a SA signal is present, and the c9mponent is in its proper SA position. A SAM light off indicates 1) No SA signal OR 2) an SA signal, but the component is NOT in ,

its proper SA position. The SAM lights are grouped in SA incident levels.

and an unlit (burned out) SAM light is easily recognized. In this case the operator would have to verify proper component position by other indication. The SAM lights are tested routinely by a surveillance test.

Switches with two positions that instantaneously light a status light (such as AFPT governor mode selector switch) are not included in this HED.

These switches are only operated by the operator. The position indication is instantaneous, and the operator would be alerted to a burned out bulb.

The indication does not prevent proper component operation.

SA operated (Containment isolation and Engineered Safety Features equipment) valves are partially included in this HED. Valves that are only automatical-ly operated.by the SA system are not included as SAM lights provide a direct backup. SA operated valves that are also operated by the Steam and Feedwater Rupture Control System (SFRCS) are included in this HED. (SAM lights do not indicate upon SFRCS actuation.)

NUREG-0700 PARA:

6.4.3.3C(l), 6.5.3.lA(1)

DATA SOURCE:

Questionnaire TP-1.7B6(IS)

TP-1.7B6(20)

DAVIS-BESSE HUMAN ENGINERING DTSCREPANCY-(HED) REPORT HED NO: 1.7.010 PAGE 4 0F 11 SPECIFIC ERROR:

Misinterpretation of Displayed Information - Loss of Information ASSESSMENT JUSTIFICATION:

- When this HED was originally evaluated, operator interviews indicated that an error had occurred. Thus, a category of 1 was given. Since numerous safety-related components were associated with this HED, and the specific evaluation of the consequences of a misinterpretation of each indicator light was not performed, a generic safety significance category of "A" was assigned. A specific evaluation of each listed item resulted in the additional significance categorization of "L" since the consequences of individual misinterpretations was determined to be minor. The list of componente that have a potential for delaying operator verification of safety system operation was determined to be a listing of valve positions.

These valves all have at least two indicators - open and closed. The individual component categories listed in the Items Involved Section reflect the most recent review of each item with respect to error assess-ment and safety significance. This HED remains categorized as IA-L overall since the operators interviewed reportedly experienced problems.

However, since no specific examples of failures were provided, the following evaluations do not assume problems have occurred and no individual error assessment categories of I are assigned. The following is a justification for each of those items.

Component ID Cors onent Description HIS MU2B Letdown Isolation Emergency Operating Procedures direct the operator to close

- this normally open valve in case of a reactor trip to conserve RCS inventory. A burned out close indicator light would alert the operator to an ab-normal condition. Letdown flow indication is provided near this hand indicating switch (HIS).

Also, the Emergency Procedures direct the operator to close an air operated valve in series if MU2B has no power. The error assessment of this component problem is, therefore, low and is categorized as III.

DAVIS-BESSE HUMAN ENGINERING DISCREPANCY (HED) REPORT HED NO: 1.7.010 PAGE 5 0F 11 Component ID Component Description HIS 3971 Makeup Pump Suction Emergency Operating Procedures 3-Way Valve from Makeup direct the operator to "close"

-Tank (MUTK) or from MU3971, i.e. , to shif t suction Borated Water Storage from the MUTK to the BWST under Tank (BWST) various plant conditions.

Failure of the "close" indicat-ing light will not prevent the valve from being in its correct position. The operator will be alerted to an abnormal condition with both lights out. The error

_ assessment of this component problem is, therefore, low and is categorized as III.

HIS DHllA Decay Feat Suction from Emergency Operating Procedures '

HIS DH12A the Reactor Coolant do not require the use of these System (RCS) Control HIS's.

Power Off indication HIS DH11 Decay Heat Suction from The Emergency Procedures do HIS DH12 the RCS direct placing a DH pump on suction from the RCS per the System Operating Procedure.

The System Operating Proce-dure directs closing the local breaker to place power on these valves and then dire'ets proper opening of these valves. Any burned out light bulbs would be observed and corrected at this time. Therefore, a burned out light is insignificant.

Appendix R Fire concerns re-quire that the local breaker be opened for DH11 and DH12 during power operation. Therefore, HIS DHl. HIS DH12, HIS DH11A and HIS DH12A all have no lights during power operation. The control power off indication is only lit when power is available -

local breaker closed - and the operator has pushed HIS DH11A-12A to remove control power from the Control Room. No operator con-fusion should result from this condition. All four HIS's are next to each other and have no lights lit. The operators know

DAVIS-BESSE HUMAN ENGINERING DISCREPANCY (HED) REPORT HED N0: 1.7.010 PAGE 6 0F 11 Component ID Component Description that the local breakers are open and know how to restore valve powe r. The error assessment of this component problem is, there-fore, low and is categorized as III.

HIS DH1517 Decay Heat Pump Suction Emergecy Operating Procedures

'HIS DH1518 from RCS direct the operator to change the position of these valves under ,

'HIS DH830 Decay Heat Loop Cross- various emergency conditions.

HIS DH831 connect Isolation (Except DH1517 and DH1518 which the Emergency Procedure directs HIS 2735 Auxiliary Spray to to be operated per the System HIS 2736 Pressurizer Operating Procedure).

HIS HP32 High Pressure Injection All of these valves are motor HIS HP31 Minimum Flow Isolation operated and normally powered with either an open or close HIS DH64 Decay Heat Pump Discharge light lit. Therefore, a HIS DH63 to High Pressure Injection burned out light would indicate Pump Suction an abnormal condition to the operator. Changing the light bulb would be the operator's normal action to verify proper valve position, and would quickly resolve the concerns with this HED.

This would result in a very short

. delay in performance of Emergency Operating Procedure actions. The only case for these listed valves where this delay could be at all significant would be a delay in verification of opening DH63 and DH64 to allow Decay Heat High Pressure Injection Pump " piggy-back" operation for Feed and Bleed operation. Feed and bleed analysis shows that Makekup Pumps provide sufficient cooling, and RCS pressure remains above DH/HPI piggyback pressure for at least two hours. Therefore, a slight delay in piggyback operation will not adversely affect E0P per-formance. The error assessment of this component problem is, therefore, low and is categorized as III.

f DAVIS-BESSE HUMAN ENGINERING DISCREPANCY (HED) REPORT hep NO: 1.7.010 PAGE 7 0F 11 Component ID Component Description HIS RC11 PORV Block Emergency Operating Procedures (Isolation Valve) direct the operator to change the position of these valves under HIS RC2-6 PORV Pilot Lever various accident conditions. The Position PORV is also automatically opened at 2450 and closed at 2400.

These valves have an open and a close light and are located to-gather on the front console. Tht; operator would be alerted to an abnormal condition with no light indication. The PORV has an annunciator alarm to indicate flow triggered by an acoustic monitor.- Two channels of acous-tic monitors also provide flow indication meters and position lights on the Post Accident Monitor (PAN) panels. Also, two channels of position lights are provided on the front console near HIS RC2-6. This was in-stalled this outage (FCR 85-171) and resolves the concerns for this HED for HIS RC-2-6. There-fore, a failed PORV pilot lever position light on HIS RC2-6 would not prevent the operator from

. verification of proper PORV operation as required in Faergency Operating Procedures. The PORV block motor operated isolation valve (HIS RC11) is used as a backup to PORV operation. When desired to have flow through the PORV, the PORV block valve RC11 must be open and when desired to ensure flow has stopped through the PORV, the block valve is closed. Therefore, a failed indicator light on RC11 will have no significance on per-formance of Emergency Operating Procedures. The error assess-ment of this component' problem is, therefore, low and is  !

categorized as III.

-DAVIS-BESSE HUMAN ENGINERING DISCREPANCY (HED) REPORT HED NO: 1.7.010 PAGE 8 0F 11 Component ID Component Description HIS RC2-1 Pressurizer Spray Emergency Operating Procedures Control Valve direct the operator to re-position these valves under HIS RC 10 Pressurizer Spray Block various accident conditions.

(isolation valve) Both valves are motor operted have an open and closed indica-tion. The spray control valve also has an amber light for 40%

to 45% open indication which is the position the valve goes to ,

when in automatic and a high pressure condition occurs. The operator would be alerted to a condition where no lights are lit. The spray control valve would have no lights lit if placed in a throttled position by the operator. He would know of this condition and in this condition high or low pressure signals would automatically position the. valve to a lit position upon an RCS pressure change. The valves are in series and located together on the front console. If a bulb failed the operator can quickly check the position of the other valve and observe RCS pressure and pressurizer heater opera-tion to determine if spray is occurring. If the amber light is burned out and the operator wants spray flow, he can posi-tion the valve to open and check the 100% open red light.

Thus a burned out light would not significantly delay the performance of Emergency proce-dures. The error assessment of this component problem is, therefore, low and is categorized as III.

J

p I

. -.DAVTS-BESSE HUMAN ENGINERING DISCREPANCY (HED) REPORT HED NO: 1.7,010 PAGE 9 0F 11 Component ID- Component Description HIS 3869 AFP Discharge Energency Operating Procedures MIS 3870 AFP Discharge direct the operator to verify HIS 3871 AFP Discharge proper SFRCS automatic posi-HIS 3872' AFP Discharge tiening of these valves.

HED 9.2-001 "SFRCS Display Arrange-ment Does Not Support Verification

'HIS 5889A' AFPT Steam Inlet of Actuation Tasks" addresses the HIS $8895 (at AFFT Air Operated) problem with location of these (and other) controls on various

-HIS ICS11B ' Atmospheric Vent Valve Control Room panels. HED 9.2-033 .

'HIS ICS11A (Air Operated) " Spatial Relationship of Auxiliary Feedwater Components" addresses HIS 106A Main Sta Line 1 to AFFT 1 the problem with location of these MIS 106E Main Sta Line 1 to AFPT 2 (and other) contr,als on various HIS 107A Main Sta Line 2 to AFPT 2 Control Room panels. A burned HIS 107E Main Sta Line 2 to AFPT 1 out light could delay the operators HIS 601A , Main Feedwater-Contain'Isol ability to verify proper position HIS 612A. Main Feedwater Contain Isol of these valves although a no HIS 394 Steam Generator vara up lights lit condition would exist HIS 375 drain (air operated) and alert the operator to a problem.

HIS 779 Main Feedwater Block The proper operation of the SFRCS HIS 780 (control valve isolation) can be inferred from the control HIS 611 Steam Generator drain room indications as further described.

HIS 603 containatne isolation Based on other HED's associated with SFRCS, the category of this HED for SFRCS related components is conservatively set at IIA-L.

The following discussion provides additional detail for each of the SFRCS actuated components.

HIS 3869 AFP Discharge These valves are associated with HIS 3870 AFP Discharge Auxiliary Feedwater Pump Operation.

HIS 3871 AFP Discharge The function of the AFWPs in an HIS 3872 AFP Discharge accident is to both, start taking steam HIS 5889A AFPT Steam Inlet from the proper Steam Generator and HIS 58895 AFFT Steam Inlet pumping AFW into the proper SG and HIS 106A Main Sta Line 1 to AFPT 1 maintaining proper level in that SG(s) .

HIS 106E Main Sta Line i to AFPT 2 SG 1evel and pressure indication and HIS 107A Main Sta Line 2 to AFPT 2 alarms can verify proper SG level. AFPT HIS 107E main Sta Line 2 to AFPT 1 discharge pressure, speed and flow indication is available to verify proper AFFT operation.

p i-DAVIS-BESSE HCMAN ENGINERING DISCREPANCY (HED) REPORT HEQ NO: 1.7.010 PAGE 10 0F-11 HIS ICS11B Atmospheric Vent Valve These valves are associated with HIS ICS11A Atmospheric Vent Valve. isolation of steam from the SG's and HIS 394 SG Mara Up Drain function to stop steam releases and HIS 375 SG Wara Up Drain conserve steam to operate the AFPTs.

HIS 611 SG Drains These valves are all closed during HIS 603 SG Drains normal plant operation and receive SFRCS close signals. It is unlikely that a delay in verification of Emergency Operating Procedures would occur.

HIS 601A Main Feedwater Cont Isol These motor operated normally open- ,

.HIS 612A Main Feedwater Cont Isol isolation valvts are associated with HIS 779 Main Feedwater Block isolation of r ain feedwater to the SGs HIS 780 Main Feedwater Block and function to isolate MFW due to leaks or control malfunctions causing an overfeed conditions. They are in series with a bypass control valve around 779 and 780.- The bypass control valve also receives a SFRCS close signal and has a demand meter in the Control Room. Therefore closure of Valve 601 stops all feedwater to SG#2 and closure of 612 stops all feedwater to SGil. Closure of the bypass control valve and its associated block valve stops all feedwater flow to it's SG.

Also feedwater flow indication is l available to indicate all feedwater flow has been stopped to each SG.

DISPOSTION:

The Control Room operators routinely tou,r the Control Room to survey controls and indications. Their instructions to inspect indication for burned out light bulbs have been emphasized to assure their responsiblity is clear.

This survey is an effective mechanism for identifying bulb failures for ,

the normally lit indicator on the valve switch listed in this HED.

The displays indicated in this HED will be examined in the Displays Study after restart. As described in the ASSESSMENT JUSTIFICATION section the impact on performance of the Emergency Operating Procedures is minor. The

! potential for error is most significant for the Components actuated by the SFRCS. The design and installation of a new SFRCS panel as described in HED l HED 9.2-033 will improve this HED by adding redundant indication for some ,

j components.

l l

i l

. - ,. ,m- , ,_ ,.._ -. . . . - _ _ . . _ _ _ _ _ _ , _ _ . - - - - - , _ - , - , _- . - - . _ _ _ -

DAVIS-BESSE HUMAN ENGINERING DISCREPANCY (HED) REPORT HEb NO: 1.7.010 PAGE 11 0F 11 SCHEDULE:

The directives for the operator's Control Room tour already exist.

Improvements made as a result of the SFRCS special study will be implemented during the next (5th) Refueling Outage.

J s INTERIM FINAL DISPOSITION APPROVAL: O.v a _. e* ~ DATE

'[0' FINAL IMPLEMENTATION APPROVAL: DATE 9

PAGE: 1 of 2 PAVIS-BESSE FUPAN ENGINEERING DISCREPAECY (HED) REPCRT TITLE: Pushbuttons/ Indicator Lights Have Shorted HED NO: 1.7,011 Out Durirr Pulb Replacement CATEGORY: IA-M STATUS: Closed DATE ORIGINATED: 7/22/83 ITEMS INVOLVED:

The potential for this problem exists on most Control Roem indicator lamps.

PROBLEM DESCRIPTION:

Dur'.ng indicator lamp replacement, the pctertial for creating an electrical short in .

the control or indicator circuit exists because the metal bulb extractor can contact the gcounded leep heusina during the process. Depending upon the control or indiccrer circuit cerfiguration, unplanned control actions or power supply failures rey result.

NUREG-0700 PARA:

6.4.3.3C(3) and 6.5.3.1A(3) l l

DATA SOURCE-Operator interviews TP-1.7F6(17)

TP-1.7B6(21)

SPECIFIC ERRCR:

Loss of information or inadvertent control actuation.

ASSESSMENT JUSTIFICATION:

Since this problem has reportedly occurred at Tcledo Edison and at other utilitics, the error assessnent category is I. Since the error can affect safety related j equipment with a wide range of correouences includir.g the potential for degrading a safety function, it is assigned a safety significance category of A-M.

DISPOSITION:

)

This "'.s has been rectified by seplacing the metal bulb extracecr with a simple plo.c!c version which precludee the grounding problem. Additionally, the replace-cent of indicator lamps in the switchyerd panel is now performed by electricians sin:e those lamps are powered by 120VAC and have a higher potential for arcing.

The indicator lanpn on the switchyard panel have the highest potential for causing urplanned control actions. These corrective actions were taken in Decerber of 1984 j ard have eliminated the problem. No new HEDs have been introduced ac n reruit of these changen (see attached Verification of Design Improvement form).

1 l

-/

I DI0IS-BESSE HD'AN E!;GINEERING DISCREPANCY (HED) REPORT

.HED NO: 1.7,011 PAGE 2 of 2

!- SCHEDllE:

Complete.

INTERI O!SPOSITION.AP ROVAL: DATE FINAL-IMPLEMENTATION' APPROVAL: MaJ . M . r. DATE '/-/9-j c; i.

l l

l l

l l

l l

l l

l l

l i JRL/006/3 l

l I

HED No. l. 9. o l l Page i of 2 HUMAN FACTORS VERIFICATION OF' DESIGN IMPROVEMENT BRIEF DESCRIPTION: Podbw&ns/Inditah Liokfs h % g.,

w skodec) cak d M loujb (ep(A M u i TYPE OF VERIFICATION: Initial Interim X Implementation BASIS OF REVIEW: .

Documentation Review (specify document number)

FCR Request ,

FCR Concept Design FCR Detailed Design Maintenance Work Order Procedure Other i

X Hardware Assessment ( plashc. bullo (ef ce.c.anie k

d Moo l)

AFFECTED COMPONENTS:

inest co,drel room indicak /wps.

THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

Yes No J N

A. Comparison with NUREG-0700 guidelines . )( .

B. Comparison with T/A I&C reqts X C. Operations review and comments >(

D. Walk-throughs X E. Other (specify)

I HED No. . _ l . '1. o l l Page 2 of 2 THE HLHAN FACTORS PEVIEW RESULTED IN A FINDING THAT THE DESIGN IMPROVEMENT:

)<, Will fully s atisfy the hwnan factors concerns in the HED.

Will partially satisfy the human factors concerns in the HED.

. Will not sat isfy the human factors concerns in the HED.

JUSTIFICATION: dSe ob p\dttke Isd b t'e MGce me d b Cl femoves e opor+oni Scr arc _i na, /5 hovko out i Xi J owr-abs haa been di re cied 4e le-t elec4wc tans c bne;e ec8 b albs et s wi%k uo rcl pa nel a s V / 8 G W L N e v" SQ N CLchem N We ven$ OOerO&

l n l u (G , lANe'f C YE PYPCY lAliN Y p(UUIC(c( CN A L&11rN v.a yrl Ja M_1 I

/

THEDESIGNIMPROVEMENT13ECI(WILLNOT)RESULTINANYNEWHEDs. (IDENTITY NEW HEDs IF APPROPRIATE.)

JUSTIFICATION: Osr. e[ a shc_ 4-eed remov EtS oppo du ni k < o s cina s

/ s k erL 1a a ect. 4e eker conPrel voont chcwes mvo(vec\ .

J FURTHER HLMAN FACTORS REVIEW (IS) (TJ:: Sled REQUIRED.

JUSTIFICATION: Gz)-tskede rv im okerne nkcMew 16 corno .

Lv i a. r a icJo4 cw sukk Adard xmol wi// ror5 tri<6

%ffw'o w a rava eC el$clriebaa eho Ne.m.J .e N O tL M kW L i t (f A l hf%

I

?fV) L16' T A Cl{ ,

4 f i

HED/001 l

l

T PAGE 1 0F 3

. DAVIS-BESSE-HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Annunciators With Inputs From More Than One HED NO.: 3.1.037 Plant Parameter Setpoint Is Not Avoided. CATEGORY: III STATUS: Int. Dis. App.

DATE ORIGINATED: 11/01/83 ITEMS INVOLVED:

See component list attached.

PROBLEM DESCRIPTION:

Annunciators with inputs from more than one plant parameter setpoint is not avoided.

NUREG-0700 PARA:

6.3.1.2C(1)

DATA SOURCE:

Operator Interviews TP-3.1B4(1b)

SPECIFIC ERROR:

Misinterpretation of annunciator. Delay in identifying alarms. See disposition section for consequences of specific errors.

ASSESSkENTJUSTIFICATION:

The annunciator alarms have been grouped and categorized as follows:

1. Tank Levels

2. Electrical Breaker Status

3. System Temperatures

4. Others

-~

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO.:3.1.037 PAGE 2.0F 8

1. Tank Levels

a. Applicable Annunciators: (Panel, Row Column) 2-1-4 9-2-4 13-2-3 15-2-5 2-2-3 9-3-4 13-2-4 15-3-3 2-2-4 9-5-4 13-2-5 15-3-4 2-5-3 10-2-3 13-2-6 15-3-5 2-5-4 10-2-4 13-3-3 3-1-1 11-3-4 13-3-4 3-2-2 11-3-6 13-3-5 4-4-4 13-1-3 13-3-6 7-5-4 13-1-4 13-5-1 9-1-4 13-1-5 14-3-4 9-1-7 13-1-6 15-2-4

b. Clarification (1) Many of the above alarms have associated level indicators displaying information to the operators in the control room. Upon receipt of the applicable annunciator, the operator would then refer to the indicator associated with the alarm.

(2) Exceptions:

The following annunciator alarms do not have an associated indicator in the centrol room.

2-1-4 BA Mix Tank Lvl

. 9-1-4 New Lube Oil Strg Tk Lvl 9-2-4 dsed Lube 011 Strg Tk Lvl 9-5-4 Aux Bir Drum Lvl 10-2-3 MFPT 1 Lube Oil Tk Lvl 10-2-4 NFPT 2 Lube 011 Tk Lvl 13-1-3 LPFW Htr Drn Tk 1 Lvl 13-1-4 LPFW Her Drn Tk 2 Lvl 13-1-5 HPFW Her 1-4 Lvl 13-1-6 HPFW Her 2-4 Lvl 13-2-3 LPFW Her 1-2 Lvl 13-2-4 LPFW Her 2-2 Lvl 13-2-5 HPFW Her 1-5 Lvl 13-2-6 HPFW Her 2-5 Lvl l 13-3-5 HPFW Her 1-6 Lvl 13-3-6 HPFW Her 2-6 Lvl 14-3-4 EHC Fluid Lvl l

[

DAVIS-BESSE HUMAN ENGINEER 1hG DISCREPANCY (HED) REPORT HED N0.:3.1.037 PAGE 3 0F 8 15-2-4 MSR 1 1st Stg Dt Lvl 15-2-5 MSR 2 1st Stg Dt Lvl 15-3-3 TG Lube Oil Tk Lvl 15-3-4 MSR 1 2nd Stg Dt Lvl 15-3-5 MSR 2 2nd Stg Dt Lvl 1-2-7 Emer DG FOST 1-1 Lvl Hi/Lo 1-2-8 Emer DG FOST 1-2 Lvl Hi/Lo

c. Tank Level Annunciators, Exceptions; Consequences of Specific Error The annunciators listed above under Item (2), exceptions, do not have associated control room panel indicators. Consequently, upon receipt of an alarm the control room operator would contact an operator working '

outside of the control room for clarification of the applicable tank level status. The level alarms listed are actuated at a high or low setpoint. The operator external to the control room has local indicators available to him to allow specific interpretation of the deviation. It is determined that no significant adverse consequence will occur due to specific error and therefore rate this item as Category III.

d. Impact On E0P Exception As prescribed by the station emergency operating procedure, there are no safety related operator actions associated with multiple input tank level annunciators. The annunciators identified in exceptions (2) are not related to safety related equipment except Diesel Generator Fuel Oil Storage Tanks (week tanks). The annunciators for these two windows have had their input from high level removed and the windows renamed LOW LEVEL.

2. Electrical Breaker Status

a. Applicable Annunciators: fianel, Row, Column) 1-1-5 Essential Bus E-1 Brkrs NTNM 1-1-6 Essential Bus F-1 Brkrs NTNM

b. Clarification:

The above listed alarms have multiple input plant parameter setpoints in that associated breakers actuating the alarm may be open, closed or withdrawn. There are twelve breakers which are monitored by each alarm. These breakers and the conditions of the breakers to cause an alarm are 114ted in the Station Alarm Procedure AP 3001.05.4. Upon receipt refer to AP 3001.05.4 which provides direction on which breakers to check locally. The control room operator would then request an operator working outside of the control room to clarify the deviation.

In addition, the breakers inputting the alarm feed electrical power to equipment which have status indication in the control room. The following is a breakdown of the breakers inputting the alarm and examples of the powered equipment status:

r

's DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO.:3.1.037.

PA'GE 4 0F 8 (1) Ala re: 1-1-5 Essential Bus E-1 Brkrs NTNM Control Room Panel Breaker Alarming Cond; tion Mounted Equipment Status (Examples of)

BCE 11 open or withdrawn Control Room Panel mounted open/ closed indicators BCE 11 BCE 12 closed or withdrawn Control Room Panel mounted open/ closed indicators BCE 12 *'

BE 105 withdrawn Ctat Air Cooler 1-3 on/off status indicator BE 106 open or withdrawn Essential Pressurizer Heaters on/off status indicators.

BE 107 open or withdrawn Essential valve status; i.e. DH9B; DH7B; NU40; RC10 etc.

BE 110 open or withdrawn Ctat Air Cooler 1-1 on/off status indicator BE 111 withdrawn #1 Ctat Spray Pump on/off status indicator BE 113 closed or withdrawn T/G Lift Pump on/off indicator'(if on E side supply) .

BE 118 open or withdrawn RE4598AA or RE4598AB Radiation Monitors (behind Ctrl Room Panels.)

(2) Alare: 1-1-6 Essential Bus F-1 Brkrs NTNM Control Room Panel Breaker Alarmina Condition Mounted Equipment Status (example of)

BDF 11 closed or withdrawn Control Room Panel mounted open/ closed indicators BDF 11 l

BDF 12 open or withdrawn Control Room Panel l mounted open/ closed indicators BDF 12.

l i

l.<

I

' I b DAV?S-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED h0.:3.1.037-PAGE 5 OF 8 l BF 105 withdrawn Ctat Air Cooler i 1-3 on/off status i

indicator.

i-BF 110 open or withdrawn Ctat Air Cooler 1-2 on/off status indicator.

BF 111 withdrawn Ctat Spray Pump 1-2

[ on/off status indicator.

! BF 115 open or withdrawn Essential Valve status, L ie; CF5A, CF2A, CF1A,

• AF 599, etc.

l BF 114 open or withdrawn Essential Pressurizer Heater on/off status indicators.

l BF 113 open or withdrawn T/G LIPT Pump on/off l

status indicators (if on F side supply)

BF 118 open or withdrawn RE4598BA, RE4598BB Radiation Monitors

! (behind ctri room

!- panels).

I-

c. Consequence of Specific Error; Electrical Breaker Status

. As identified both alarms listed receive input from 9 breakers status and if in an unusual or "not normal" condition, will subsequently cause further control room panel indication status changes. Therefore, the consequences of the specific error for the multiple input conditions providing input to these alarms are considered low. It is determined no adverse consequences will occur due to specific error therefore ' rate this item a Category III.

d. Impact On E0P Execution As prescribed in the Station Emergency Operating Procedure, there are no safety related operator actions associated with these two electrical breaker status multiple input annunciator alarms.

3. System Temperatures

a. Applicable Temperatures 2-3-3 BA Add TK 1 Temp 2-3-4 BA Add Tk 2 Temp 12-5-1 SG 1 Out Sta Temp 12-5-2 SG 2 Out Sta Temp

f I

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO.:3.1.037 PA'GE 6 0F 8 f' b. Clarification The above alarms have associated temperature indicators which display information to the operators in the control room. Upon receipt of the alare, the operator would then refer t.o the indicator associated with the alarm for a specific interpretation of the deviation.

c. Consequences Of Specific Error; System Temperatures The consequence of this item is low due to the availability of tempera-ture indicators provided in the control room. No adverse consequences will occur due to specific error, therefore, this item a Category III.

d. Impact On E0P Execution As prescribed by the Station Emergency Operating Procedure, there are not safety related operator actions associated with the multiple input  :

system temperature annunciators.

4. Other Annunciators (Panel, Row, Column)

a. Applicable Annunciators 2-4-2 RC Letdown or MU Flt DP 6-1-4 RCP Seal In Total Flow 7-5-3 Misc. Wst Matr Tk or F1t Trb1 9-2-1 N Header Press 2

16-4-3 Gen H2 Gas Press

b. Clarification Items 2-4-2, 6-1-4, 9-2-1 and 16-4-3 bave associated control room indicators to allow specific interproi.ation to the deviation. Upon receipt of the alarm the control room operator would refer to the applicable indicator.

(1) Exceptions Item 7-5-3 does have multiple inputs to the annunciator. This is however a non-safety related system. Upon receipt of the alarm the control room operator would refer to the operator outside of the control room for interpretation of the deviation. Status of the inputs to this annunciator are available to the local operator.

c. Consequences Of Specific Error; Other Annunciators With the exception of item 7-5-3, the annnunciators have associated indicators which allow the operator to further assess the alarm input status. The Control Room operator will not be misled by this alarm.

His task upon receiving this alarm is to notify the local operator to check local status. Therefore, the consequences of Specific Error is viewed as low. Item 7-5-3 is related to a non-safety system and l l

l l

l I

f DAVIS-BESSE HLHAN ENGINEERING DISCREPANCY (HED) REPORT HED NO.:3.1.037 PAGE 7 0F 8 therefore consequences is considered low as there is time for the local operator to perform the assessment. It is determined no adverse consequences will occur due to specific error therefore rate this item a Category III.

d. Impact On E0P Execution As prescribed by the Station Emergency Operating Procedure, there are no safety related operator actions associated with the above listed multiple input annunciators.

DISPOSITION: ,

As indicaced in the Assessment Justification, these annunciators have no impact on the implementation of the emergency operating procedure, and potential for incorrect operator action is low.

The long standing nuisance alarm reduction program has addressed many problems with multiple input alarms which has improved the reliability of alarms to reduce confusion from unnecessary alarms. The program has also resulted in the elimina-tion of some multiple inputs such as the Emergency Diesel Generator Week Tank (011) level alarm modified by FCRs85-174 and 85-014. -

SFRCS alarms have also been modified during this outage (see HED 9.2.018 for details).

Although no other specific actions to resolve this HED are required, it will be considered in conjunction with other annunciator HEDs in the Annunciator Special Study.

SCHEDULE:

The annunciator special study will begin after restart.

n h u .

[NTER / FINAL DISPOSITION APPROVAL: MA [b(:'?n% DATE V

FINAL IMPLEMENTATION APPROVAL: DATE i

T-DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO.:3.1.037-PAIGE 8 0F 8 PANEL- RC TITLE 1 1.5 Essential Bus El Source Brkrs NTNM 1.6 Essential Bus F1 Source Brkrs NTNM 2 1.4 BA Mix Tk Lvl 2.3 BA Add Tk I Lvl 2.4 BA Add Tk 2 Lvl 3.3 BA Add Tk 1 Temp 3 .'4 BA Add Tk 2 Temp 4.2 RC Letdown or NU FCT DP '

5.3 RC NU Tk Lvl NU16-1 5.4 RC NU Tk Lvl NU16-2 3 1.1 Ctat Refueling Canal Lvl

• 2.2 SFP Lvl j 4 4.4 RC Przr Lvl [

5 - Not per NUREG 0700 p.6.3.1.2c(1) 6 1.4 RCP Seal in Total Flow 7 5.3 Misc Wst Matt Tk or Fit Trb1 [

5.4 RC DT Lvl 9 1.4 New Lube Oil Stra Tk Lvl 1.7 Fire Wtr Stra Tk Lvl 2.1 N Nde Press 2.4 UkedLubeOilStraTkLvl 3.4 Dsl Oil Stra Tk Lvl 5.4 Aux Bir Dra Lvl '

10 2.3 MFPT 1 Lube Oil Tk Lvl 2.4 MFPT 2 Iube Oil Tk Lvl 11 3.4 EE Surge Tk Side 1 Lvl 3.6 EE Surge Tk Side 1 Lvl 12 5.1 SG 1 out Sta Temp 5.2 SG 2 Out Sta Temp '

13 1.3 LP FW Ntr Drn Tk-1 Lvl 1.4 LP FW Ntr Drn Tk 2 Lvl 1.5 HP FW Ntr 1-4 Lvl 1.6 HP FW Ntr 2-4 Lvl 2.3 LP FW Mtr 1-2 Lvl i 2.4 LP FW Mtr 2-2 Lvl  :

2.5 HP FW Xtr 1-5 Lvl 2.7 HP FW Ntr 2-5 Lvl 3.3 Dear Stra Tk 1 Lvl 3.4 Dear Stra Tk 1 Lvl 3.5' HP FW Mtr 1-6 Lvl  !

3.6 HP FW Xtr 2-6 Lvl l 5.1 Cnds Stra Tk Lvl i 14 3.4 Ehe Fluid Lvl 15 2.4 MSR 1 1st Stg Dt Lvl 2.5 MSR 1 1st Stg Dt Lvl 3.3 T-G Lub Oil Tk Lvl 3.4 MSR 1 2nd Stg Dt Lvl 3.5 MSR 2 2nd Stg Dt Lvl l 16 4.3 Gen 11 Gas Press 2

TF 011

[

t-PAGE: I of 3 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Accidental Actuation of Controls Positioned HED NO: 4.1.004

! Too Close Together CATECORY: IA-L STATUS: Int. Dis. App.

DATE ORIGINATED: 7/19/83 ITEMS INVOLVED:

Panel ID: C-5703 HIS-3971,'"Fros'MU Tank /From BWST" HIS-MU54, " Makeup Tank H2 For Hydrogen Supply Valve" Panel ID: C-5705 I

HIS-2735, "DH Auxiliary Spray Isolation Valve" (No. HIS-2735 Label)

HIS-2736, "DH Auxiliary Spray Thrt Valve" HIS-RC10. "RC PRSR Spray Isolation Valve" HIS-RC2-1, "Rd PRSR Auto Spray Valve" HIS-RC2-2, '* neater Bank 2 336 Kw E-61" HIS-RC2-3, " Heater Bank 3 504 Kw E-62 F-61" i HIS-RC2-4, " Heater Bank 4 364 Kw F-61 F-62" HIS-RC2A, " Essential Bank 1 126 Kw E-12A" HIS-RC28. " Essential Bank 2 126 Kw F-12-A" PROBLEM DESCRIPTION:

i The makeup system and pressurizer spray and heater controls listed above on the respective panels are arranged in close proximity to one another. The FORV and PORV Block controls are also located near the Spray and Spray Block controls.

There is suf ficient room for proper manipulation of each of the controls, but their close proximity and the associated clustering of labels can result in confusion in the selection of appropriate controls, resulting in the inadvertent actuation of the wrong control.

NUREG-0700 PARA:

6.4.1.2A DATA SOURCE:

Operator interviews TP-4.lB6(4)

SPECIFIC ERROR:

Inadvertent control actuation.

ASSESSMENT JUSTIFICATION:

The Control Room operators have reported that errors of this nature have occurred, therefore, the error assessment category is I Discussions with the operators identified the above controls as having the described problem.

a

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED N0:.4.1.004 PAGE 2 of 2 Improper actuation of the components on Panel 5703 would not adversely impact the safety related function of maintaining makeup pump suction because appropriate interlocks exist to protect the pump. Improper operation of these controls during the performance of Emergency Operating Procedures could delay the transfer of Makeup Pump suction to the Borated Water Storage Tank which is performed to ensura an adequate borated water source to the Makeup Pumps. An automatic transfer to the BWST will occur on low MUTK level if the operator fails to perform this transfer.

Thus the impact on performance of the Emergency Operating Procedures is minimal.

Improper actuation of a component on C-5705 would result in an opposite char.

expected response in Reactor Coolant System pressure which would alert the operator as he is taking manual pressure control at the time. Also, alarms ,

would warn the operator prior to a reactor trip or safety features actuation.

Other pressure controls in automatic would attempt to correct any improper manual actuacion and, thus make improper actuation pressure excursions slow acting. Improper operation of a single pressurizer pressure control switch would have a minimal effect on a transient during the performance of Emergency Operating Procedures. Directives in the Emergency Operating Procedures would compensate for an error and would stabilize the plant. Improper actuation of the components on Panel C-5705 could impact the safety function of pressurizer pressure contral by creating a temporary pressure excursion which could challenge safety systems by resulting in a reactor trip or possible safety features actuation.

Operation of the PORV instead of the spray could cause a plant trip. Therefore, l the safety significance category of this HED is A-L.

DISPOSITION:

This HED will be substantially resolved prior to restart by labeling enhancements.

The confusion between switches on panel C-5703 vill be eliminated by the addition of a 3-way valve symbol and modified switch engravings (see the attached drawings).

Demarkation lines will be provided to help minimize the confusion associated with controls on C-5705. The complete correction of this portion of the HED will require a complete re-labeling of the associated components. These labeling changes vill be identified in conjunction with the Label and Locations Aids Study to be completed after restart, and the labeling modificatiens will be implemented in the next (5th) refueling outage.

Additional consideration is being given to placing a cover over the PROV controls.

The decision on such a change will be finalized, and the modificacion, if any, will be installed prior to restart.

SCHEDULE:

1 Label changes are to be completed prior to restart. Additional consideratfan will be given to this HED in the Label and Loca: ions Aids Special Study after . start.

TERIM FINAL DISPOSITION APPROVAL: 4 nd. DATEj YIb FINAL IMPLEMENTATION APPROVAL: DATE _

l JRL/006/4 l

7 HED No. 'l l t '.I

. Page 1 of 2 HUMAN FACTORS VERIFICATION OF DESIGN IMPROVEMENT BRIEF DESCRIPTION: 60 t dfthct[ 0 be E!t c Or c' i hoS s N cn c ek h o Olec.P hetr[!w

TYPE OF VERIFICATION: _,

Initial X Interim Implementation BASIS OF REVIEW:

N Documentation Review (specify document number)

FCR Request FCR Concept Design FCR Detailed Design Maintenance Work Order Procedure

)( Other Il clekn d pre ces-d t o6k cl%g, a dac ke dh Hardware Assessment AFFECTED COMPONENTS:

Sea t a s+ n WGD 4.l 004

)

THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

A. Comparison with NUREG-0700 guidelines Yes y

No J N

B. Comparison with T/A IEC reqts x C. Operations review and comments v D. Walk-throughs w.

E. Other (specify) 66,tch h .4 x

HED No. O '

'd Page 2 of 2 TE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT TE DESIGN IMPROVEMENT:

X Will fully satisfy the human factors concerns in the ED.

Will partially satisfy the human factors concerns in the HED.

Will not satisfy the human factors concerns in the HED.

JUSTIFICATION: /.c he/s 6,i,/ 9tn e [a ,, 5 . , , m a ev , , g cm p virr[

50c3 e no~ h ud// o le arla ibakC 'L-che,a s.a{

o u vr<e h. ele en. L L Damw c Amu <-d wmma t9 id<h o, 57c5 unll clarG ede f nc & Pmsar w/

buu, m w e n ,c{c {}e ,a Hc!.4v da,a't CN hop Anp:>w& '

I I Lahoh I, ace hven h w$u d te , ca c endar,cr wd4HFeNud(L J J TE DESIGN IMPROVEMENT M (WILL NOT) RESULT IN ANY NEW EDs. (IDENTIFY NEW EDs IF APPROPRIATE.)

JUSTIFICATION: b /,m /5 Fhe b vc et u o .cet [ decenien lo a JLtcu c$<nzen s Mo d ?n & HED FURTER HUMAN FACTORS REVIEW (IS) REQUIRED.

JUSTIFICAT10N: $nt D lc a nudo el fH h 6McorrienI 5 lw Alrf t

Yf CLi s't W (GW .

L E

i REVIEWER: 1 DATE: M /d ((

HED/001 L/

I 4

6 H e o f I ACTJAL SI Z6 ,

3 4

J

. T.

I  %

r- , a. ~(

(F e

t 3 + p 1 5 3

& Ik **- l '9 "

l C H A ** &f s To BC MnOE I. LACUL 3 %"X 1/g" Mf4 LhotL L ETTTA 4 (to U fMf Sucre) ) 'N' Hok, tjy"w' O f A"O '/t'B*ADen An o ot rwien L t 1TE /2

$ELfLTaA A. Mrw Covet, wore Leirr/s (FAereMu m) colo A Rto covs A , wMrTE si Trt AS 3 Ho w Cav tA w,TM L E Tres s (, M O ) coI* A AED Co vcA , wMort LETTE/S l v. .

+ Mew C ovt A wnTM L E TTE A$ ( OWST) celox GREEM CoveA , woor[ L E TTrp s C Mrw LoveA worn LE TTEA$ ( FleM 11kS T) Colot GActos C ovcA , w H o rf Lc 77EP S 4 $fw LplEl wMerf BACKG/ounO, BleCK. .S yre Sa L L

t r- - --

r PAGE: 1 of 8 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Indicator Lights That Indicate System or HED NO: 5.1.002 Equipment Status When Off CATEGORY: IIB-L STATUS: Int. Dis. App.

DATE ORIGINATED: 7/26/83 ITEMS INVOLVED:

Panel ID Component ID Component Description Categorv C5713 EHC Panel #1 Turbine Panel Lights III C5713 EHC Panel #1 Master Trip Solenoid Valve (2) III C5713 IL2410 Lube Oil Vapor Extractor III C5713 EHC Panel #1 Turbine Panel Load Limiting Light III -

C5709 ILICS38B-A Aux-Shutdown Panel Lights (4) III C5705 ILRC2-5-ILRC2-9 C5710 ILSP13B1-2-3 & Al-2-3 Turbine Bypass Valves (6) IIB-L C5710 ILICS11B-11A Atmospheric Vent Valves (2) III C5706 IL3302-IL3303 Source Range High Voltage (2) III C5705 ILRC2-6 PORV Light DC Control Power Available III C5702 ILMU11 Feed and Bleed Permissive III C5705 IL285 Pressurizer Spray Bypass Valve III C5715 ILX(Total 38 Lights) DC and Instrument AC Bus Breaker III Positiocs (38)

C5722 NNI-YAC, YDC, XAC, XDC NNI Power Available Indications (4) III C)716 IL1530 IL1531 Containment Spray Valve Throttle III Indications (2)

PROBLEM DESCRIPTION:

The indicator lights identified show equipment or system status when the light is off. In such cases, a failed bulb may be misinterpreted. Although all indicating lights indicate some form of status in their off condition, most controls and indications have two or more indicating lights which are illuminated to show various system status conditions; for example, the open or close indications on a valve or on and off indications on a pump. The indicators listed in this HED have only one ,

light to provide status indication.

NUREG-0700 PARA:

6.5.3.1C(1)

DATA SOURCE:

Operator interviews TP-5.1B6(2)

SPECIFIC ERROR:

Misinterpretation of indicator light status

DAVIS-BESSE HUMAN ENGINEERIEG DISCREPANCY (HED) REPORT HED N0:,5.1.002 PAGE 2 of 8 ASSESSMENT JUSTIFICATION:

When this HED was originally evaluated, a general error assessment was applied to all the listed indicators. It was conservatively assumed that most of the indica-tors could be misinterpreted in the event of a failed light bulb, the error assess-ment category was determined to be II. Since numerous safety related components were associated with this HED, and the specific evaluation of the consequences of a misinterpretation of each indicator light was not performed, a generic safety  ;

significance category of "A" was assigned. A specific evaluation of each listed item resulted in the additional significance categorization of "L" since the con-sequences cf. individual misinterpretations was determined to be minor. The individ-ual component " category" listed in the Items Involved Section reflect the most recent review of each item with respect to error assessment and safety significance.

The following is a justification for each of those items.

Component ID Component Description d

EHC Panel #1 Turbine Panel Lights The turbine panel lights indicate turbine control system status.

Any lights that are normally off and come on to indicate an abnormal status also trigger an annunciator to warn the operator.

These lights have dual bulbs and a lamp test feature. Therefore, the error assessment potential is very low and this component is categorized III. 6 EHC Panel #1 Master Trip Solenoid Valves The Master Trip Solenoid Valve

. A,B (NTSV) indication is provided to allow on-line testing of each MTSV (PT 5193.11). Each light is normally on and goes off when pushed for testing. Also, dual bulbs and a lamp test circuit is provided for this panel. The error assessment of this component problem is, therefore, low and is categorized as III.

IL2410 Lube Oil Vapor Extractor The turbine generator lube oil vapor extractor is normally in operation as indicated by the Control Room lights which are normally on. A failure of the indicator light would result in an investigation by local examina-tion of the system operation.

Loss of the vapor extractor ,

requires no immediate operation I action. Consequently the error

)

I DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED N0:*5.1.002 PAGE 3 of 8 assessment potential is very low and this component problem is categorized III.

EHC Panel #1 Turbine Panel Load Limiting Light Although separately listed, the load limiting light on the turbine panel is also a control status light. This light is normally off and comes on to warn that the turbine valves have reached a load limit. An annun-ciator is also triggered. It is .

part of the turbine panel lights listed previously and also has dual bulbs and a lamp test of feature. The component problem has a corresponding III category.

ILICS38B-A Aux. Shutdown Panel Lights The auxiliary shutdown panel ILRC2-5 lights are illuminated when ILRC2-9 control power is assumed locally at the shutdown panel for the corresponding safety related components. An annuncistor exists to redundantly indicate the transfer of control power to the shutdown panel. Consequently the error assessment potential is very low and the component problem has been categorized as III.

ILSP13B1, 2, 3 Turbine Bypass Valve Lights For each of the six turbine ILSP13A, 1, 2, 3 bypass valves, the individual valve light comes on when the valve is some small percentage open (10-20%). A failed indicator could allow a turbine bypass valve to be fully open without other direct Control Room indication.

This could result in the equivalent of a small steam leak with respect to primary system response, but would not present a significant operational problem. At power, this condition may go unnoticed until the feedwater to generator output power mismatch is detected.

In a shutdown condition, this would result in a slow depressuri-zation of the steam generator which would allow the operator

F DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO: 5.1.002 PAGE 4 of 8 sufficient time to identify the leak by local observations and take corrective action, i.e.,

close a manual isolation valve.

If the operator failed to take action, the steam generator depressurization caused by these non-safety related valves would ultimately be terminated by the safety related main steam isola-tion valves actuated by SFRCS.

This would be a challenge to a safety system, therefore, this component problem has been categorized as IIB-L.

ILICSilB Atmospheric Vent Valve Lights The indicator light for each ILICSilA atmospheric vent valve is illumi-nated when the valve is almost completely open. Consequently, the failure of the indicator is insignificant since the additional flow through the valve from a point of indication to full open is minimal. A separate control switch in the control room has open and closed indications that will also show AVV position and the automatic control station has a demand meter for the control signal to the valves. As a result of.the location of the main steam lines, the atmospheric vent valves, and the Control Room, the noise created by an atmospheric vent valve even partially open is easily detect-able in the Control Room. The potential for failing to recognize that an atmospheric vent valve is open, as the result of the indicator light failure, is relatively low. Therefore, this component problem is categorized as III.

IL3302 Source Range High Voltage The source range high voltage IL3303 indicator light is illuminated to show that the source range reactor power indication is energized during shutdown condi-tions. This is not a safety

DAVIS-BESSE HUMAN EEINEERING DISCREPANCY (HED) REPORT HED N0:.5.1.002 PAGE 5'of 8 significant condition. Failure of the light at power coincident with a failure of the redundant deenergization interlocks would only result in shortening the useful lifetime of the detectors.

A failed indicator light during shutdown conditions would prompt the operator to check the source range indication for proper operation. This simple check of system operation would provide an ,

indication of the high voltage condition. Therefore, the potential for misinterpreting a bulb failure is low, and this component problem is categorized as III.

ILRC2-6 PORV Control Power Lights The PORV indicator light shows that control power exists to the power cperated relief valve solenoid. This light is normally on unless the control circuit is deenergized. If work requiring that the circuit be deenergized is not ongoing, a failed indicator light would prompt an operator investigation. The potential for misinterpretation of a failed indicator is, therefore, very low, and this component problem is categorized as III.

ILMUll Boration Permit _ The feed and bleed permissive lights indicate that conditions are acceptable for the simul-taneous primary system makeup and letdown to change RCS ooron concentration. Failure of the light during conditions which would otherwise permit feed and bleed would prompt an operator investigation or to use the alternate method of' boron concen-trating control via the batch method. Failure to perform a feed and bleed operation results in an increase in the amount of water that must be processad for an RCS boron change, but doesn't prevent boron concentration

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO: .5.1.002 PAGE 6 of 8 changes. The potential for misinterpretation of the failure and safety significance are, therefore, very low, and this component problem is categorized as III.

IL285 Pressurizer Spray Bypass Valve The pressurizer spray bypass valve indicator light is a position indicator on a manually positioned valve. The valve is normally closed and the light is .

on when the valve is not closed.

The valve can only be repositioned from inside Containment. The spray bypass valve would only be used in an unusual case where the normal spray valve had failed closed and would only be used with close communication with the Control Room. If the spray bypass valve were not fully

- closed, more than the normal number of pressurizer heaters would be energized to maintain Reactor Coolant System pressure.

The unusual response cf pressurizer heater and RCS pressure would be quickly identified. The potential for misinterpretation of the failed indicator is very low; consequently, this component problem -is categorized III.

ILXXX DC and Instrument AC Bus Breaker The DC and instrument AC bus (Total 38 Positions breaker position indications Lights) provide bus alignment information.

A failed indicator would prompt an operator to investigate whether normal bus voltage conditions exist, which is easily identifiable through annunciators and voltage indications. The potential for misinterpreting a failed indicator is very low, and this component problem is catego-rized as III.

5 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED N0:,5.1.002 PAGE 7 of 8 NNI-Y-AC NNI Power Available Indications The NNI power available indica-NNI-Y-DC tions are normally energized.

NNI-X-AC If authorized work requiring that NNI-X-DC the power supplies be deenergized is not ongoing, a failed indicator would immediately prompt an operator investigation. Actual failure of an NNI power supply would be immediately indicated by plant response and related annunciators. The potential for misinterpretation of a failed indicator is very low, and this component problem is categorized as III.

IL1530 containment Spray Valve Throttle The throttle position lights on IL1531 Indication containment spray valves come on to show that the containment spray valve is in its proper throttled position following the transfer of decay heat suction to the emergency sump after the Borated Water Storage Tank has been emptied into Containment.

Failure of these lights would, therefore, prompt operator action as he attempts to verify that proper throttling occurs. An indication of reduced containment spray flow would provide assurance of proper valve operation. The valve full open and closed lights and the SFAS Safety Actuation Monitor (SAM) lights are also available to show proper valve operation on the initial actua-tion of Containment Spray. The potential for misinterpretation of this indicator is, therefore, low, and the component problem is categorized as III.

DISPOSITION:

Other than the IIB-L categorization of the turbine bypass valve indicator lights, the individual indicators identified in this HED provide useful operator information and are not easily misinterpreted. The specific review of these indicators has resulted in their categorization as III and no further action is required.

I DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO:,5.1.002 PAGE 8 of 8 The Turbine Bypass Valve indicating lights are an aid to the operator during the performance of the Emergency Operating Procedure. They are not his only indication.

Emergency Operating Procedures direct the operator to verify proper steam header pressure control. These indicating lights are not directly referenced in the Emergency Procedure. Operator actions are directed to determine which SG is causing an overcooling event by comparing several parameters on both SG's and key valve positions (Turbine Bypass Valves included) three turbine bypass valves are controlled by one control station therefore all three valves should open together and one light off indicating that TBPV is closed will not prevent the operator from identifying improper control of that steam lines TBPV's. The operator is directed to attempt manual control of any valves causing overcooling. If an overcooling event cannot be corrected by the operator, he is directed to manually actuate the SFRCS. The SFRCS would automatically actuate to terminate the overcooling. Therefore, improper operation of these indicating lights will not prevent proper conduct of the Emergency Operating Procedure. Corrective actions for this problem, if required, will be developed during the Displays Special Study. No other actions are required prior to restart.

4 SCHEDULE:

The Turbine Bypass Valve indicating lights will be re-examined in the Displays Special Study to be conducted after startup.

FINAL DISPOSITION APPROVAL: d n[s *

< res DATE 9'/4 '8C i FINAL IMPLEMENTATION APPROVAL: DATE I

JRL/006/5

PACE: 1 of 3 DAVIS-BESSE FEMAN ENGIhEERING DISCREPANCY (ItEDI REFCRT TITLE: Parameter Range Exceeds Seele Value MED N0: 5.1.006 CATEGORY: IIA-M STATUS: Int Dis. App.

DATE ORIGINATED: 7/26/83 ITEMS INVOLVED:

Category PIRC2B4, 2B3, 2A4 2A3, 2B4A, 2A4A, RCS Wide Range Pressure III FINL'31, Makeup Flow Indication IIA-M FI4630 FI4631, Auxiliary Feedwater Flow IIA-M -

PPOBLEM DESCRIPTION:

The parameters indiented by the meters listed have possible ranges that are too large for the scale, and additionel wide range instrumentation is net provided.

UUREO-0700 PARA:

6.5.1.2D (3)

DATA SOURCE:

Operator interviews TP-5.lB6(14)

SPECIFIC ERROR:

Misinterpreta, tion of displayed values.

ASSESSMENT JUSTIFICATION:

The maximum indicated value for the Reactor Coolent System (RCS) pressure is 2500 psig. Normal RCS operating pressure is 2155 psig, and the resulting margin to the 2500 psig maximum indicatien fe sufficient for all operator control actions.

Although the potential for RCS pressures in excess of 2500 psig does exist under certain special circumstances, no useful operator actions can be taken at pressures in excess of this value that would not already have been taken prior to reaching 2500 psig. Since operator knowledge of specific.RCS pressures in excess of 2500 psig is not required, the potential for misinterpreting the display is very low. This component problem is categorized as III.

The actual auxiliary feedwate. . low rate and makeup flow can potentially exceed the maximum indicated value on the respective meters. Misinterpretation is, therefore, possible, and the error assessrent category for these two indicators is II.

The Auxiliary feedwater flow indication can go to full scale when an Auxiliary Feed Pump is started and during operation of the AFW System due to the cyclic operation of the Auxiliary Feed Punp Turbines (AFPT). The normal AFW flow required for decay

DAVIS-BESSE htEAN ErGIMEFRING DISCREPANCY (HED) PFPCRT HED NO: 3.1.006 PACF 2 of 3 heat removal is apprcxirately SLO gpm and is within the 1000 gpn rerre cf the AFW flow instruments. When ebe etcan generator level is being increared, the AFV flow indication can be pegged high.

Emergency operetfog procedures direct the operator to ensure AFW System operatten and rayfrun flow until the proper steam generator level is reached. In additier te AFW flow, the operator has pump discharge pressure and pump speed irdication and should not be misled by e flev rmter that is pegged high. The key paraneter the 4

operator is directed to maintain is proper stear generator level.

Although the significance of en auxiliary feedwater flow indication that haa pegged high is minimal, the significance claseffication of this particular component problem has conservatively been placed at A-M beceuse of considerations of other

. Human Engineering discrepancies associated with the Auxiliary Feedwater Systen and its autocatic actuation system, the SFPCF.

Although a specific knowledge of rakeup flow rate is not necessary for proper system operation, the inforration is useful in the operctor's evaluation of the proper feed and bleed cooling required by the Emergency Operating Procedure in the evert of loss of all feedwater. Consequently, the safety significance of thic component problem is categorized as A-M.

DISPOSITION:

Although an expanded range indication of Reactor Coolant System prerrure is not necessary to support operator actions, an additional wide range pressure indication of 0-3000 psig is to be installed per FCR 66-03f to support Regulatory Guide 1.97 requirements. This indication would be usefv3 to support post-accident analysis.

As discussed ,in the Acceerrent Justification Fection, the successful completion of the Energency Operating Procedure actions is not dependent on speciff e euriliary feedwater flow indication. A wide range auxiliary feedwater ficw indication is, however. planned for incorporation into the modifications associated with the SFRCS special study. The new wide range indication is to be installed during the next (5th) refueling outage.

FCR 85-328 bar been implemented which increases the range of the preiious 0-160 gpm makeup flow indication to 0-500 gpm. This range increase vill very effectively bracket the maximum anticipated two pump flow of 350 gpm. As indicered by the attached Verification of Design Ieprovement form, this modification introduces no new EEDs. The modification expanded an existing scale that is included as a part 01 a dual scale indicator. The low range makeup indication of 0-40 gpm has not been modified. While the HED on ru1tiple scale incicators has not been corrected (see HED 5.1.9), no new HEDs have been initiated and the widened scale deer cddress this HED with respect to the makeup indication completely.

SCHEDULE The installation of the wide range makeup flow will be completed under FCP F5-328 prior to restart. The wide range auxiliary feedwater flow indication will be installed during the next (5th) refueling outage.

5

j; i ' DAVIS-BESSE h EAE EFGINFFRING DISCREPANCY (FED) PEFCRT f- HED NO: 5.1.006

FKF 3 of 3

.. - . ,; i INTERI. FINAL DISPOSITION' APPROVAL: ' tM44 d-(>>- DATE # #M *.Vd l

FINAL IMPLEMENTATION APPROVAL: DATE i

l l

I-

+

i l.

j- t l

l l

c I

f-l l

I i

JRL/006/6 L

i

(

,,v. - -

+ . , , , , . . , - - . - , , . , - - . . , , , , - , , - - - . - , , - , - - , , . , , , . - - , - - - . - - - , , , - , . ..~,----n.l

HED No. 5~.I,occ

. Page 1 of 2 HL%C FACTORS VERIFICATION OF DESIGN IMPROVEMENT BRIEF DESCRIPTION: hd.Y1vvie_ke v- (6.Me EMC.eect s s cede _

J

\li tAA. (MA%, Qow s wdicdesh -

TYPE OF VERIFICATION: Initial

)( Interim Implementation BASIS OF REVIEW:

X Documentation Review (specify document number) k FCR Request FCR Concept Design FCR Detailed Design Maintenance Work Order Procedure Other Hardware Assessment AFFECTED COMPONENTS:

$ q,{<e lou 3 i ndiCE*f S THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

M No 7

N]A A. Comparison with NUREG-0700 guidelines l B. Comparison with T/A I&C reqts X )

C. Operations review and comments X D. Walk-throughs X E. Other (specify) )(

l l

HED No. 6. / . o C6 Page 2 of 2 THE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT THE DESIGN IMPROVEMENT:

Will fully satisfy the human factors concerns in the HED.

X Will partially satisfy the human factors concerns in the HED.

- Will not satisfy the human factors concerns in the HED.

JUSTIFICATION: l-lOty1& n & & S w eerns l'ac utlirs a inet & de O J v makeu How rme a re L itu edw w r-c e 8s-328,

/ d i O FeR 25-2,21 wtll prowde mal <e a flow mehcaW orJer a raene of o - s co eJIo m ~T* n co m o Sle,w J

is ^5 5 0 n o w u5[tirbr IS undl O O -Sco a c m YGAttue. . F (4<rterb h FCQ W-3 M grisp hrF M ovivv nles I

%N v

id v5Yh 6 i

J s s (WILL NOT) RESULT IN ANY NEW HEDs. (IDENTIFY THE DESIGN IMPROVEMENT %)

NEW HEDs IF APPROPRIATE.

JUSTIFICATION: k-s -b o't k i ny:) Mchew udO k y%.c14Aed M dose,tt. HF reutd of FCR. S S - 3 2 8 u A ll cowH nue ho m u re Mai e <a ow t+F prt v2C.i oles i i i Y$_ r Y (O ( OW (U $ MW .

I U FURTHER HUMAN FACTORS REVIEW (IS) REQUIRED.

JUSTIFICATION: bM e t A n fedia u) e FCL d he oO oA- bulk 4 ecuhcddrx- ra h cewhol raem usin /c cf +o AIUI?_E6-o7co cauto O

'd REVIEWER: SL) i DATE:

g .

HED/001

PAGE: 1 of 3 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Pointers On Meters Do Not Fail Offscale HED NO: 5.1.007 CATEGORY: IIA-M STATUS: Int. Dis. App.

DATE ORIGINATED: 7/26/83 ITEMS INVOLVED:

Meter /I.ocation Description Category PI SP12B Steam Generator Pressure III PI SP12B Steam Generator Pressure III LI SP9B1 Steam Generator Level IIA-M LI SP9Al Steam Generator Level IIA-M FYI HP 3A High Pressure Injection Flow III FYI HP 3B High Pressure Injection Flow III FYI HP 3C High Pressure Injection Flow III FYI HP 3D High Pressure Injection Flow III FI DH 2A Decay Heat Flow III FI DH 2B Decay Heat Flow III PROBLEM DESCRIPTION:

When these instruments fail the failure of the meter is not apparent to the operator and the pointer fails center scale as opposed to off-scale. The Bailey 1 Meter equipment supplied with the NNI and ICS systems will fail to center scale on loss of power to the meter but these are monitored by an annunciator alarm circuit for blown fuse. The individual meter (s) affected by che blown fuse can be determined by the operator therefore the failure would be apparent to the operator before he would take action based on the meter reading. This set of meters is therefore not included in this HED. The meters listed above are not supplied power by the NNI or ICS Systems. The redundant pressurizer level indicators on panel C5705, LIRC14-3 and LIRC14-4, also fail center scale when the meter power is lost.

These meters are powered via separate safety grade power supplies. The failure would be apparent before action was taken by comparison of the meters to each other and comparison with the temperature compensated pressurizer level recorder on the same panel. These meters are therefore not included in the HED.

NUREG-0700 PARA:

6.5.1.1F DATA SOURCE:

Operator interviews TP-5.1B6(15) Questionnaire data = 11 out of 13 TP-9.8B6(13) Questionnaire data = 12 out of 13

i DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO. 5.1.007 j PAGE 2 0F 3 4

SPECIFIC ERROR:

With no method of determining the meter is failed, if the meter pointer failure position is on scale, the operator might take action based on the failed meter. ,

i

, ASSESSMENT JUSTIFICATION:

A new idministrative Procedure has been implemented which requires a control rcom

(' orerator to fill out a Critical Systems Checklist and a Critical Parameters Checklist prior to assuming duties in.the control room. Readings from all the meters on this HED are on the checklists. A center scale indication on flowmeters FYI HP3A, FYI.HP3B, FYI HP3C, FYI HP3D, FI DH2B, and FI DH2A would be immediately

• apparent to the operator at this time as a failed indicator based on the pump status (off) which is also on the checklist. The operator will then be aware of the failed meter status and will not take actions based on the meter reading.

, The error assessment category for these six meters is therefore category III.

1 A center scale indication on PI SP12B or PI SP12A would be immediately apparent to the operator at this time as a f ailed indicator based on comparison with plant status, og it is not possible for one SG to be operating at 600 psig (center scale) and the other SG to be operating at 900 psig at steady state power. For these 1 l conditions to be true the reactor and SFRCS System would have tripped and a plant l transient would be in progress. The operator will then be aware of the failed

' meter status and will not take actions based on the meter reading. The error ,

assessment category for these two meters is therefore Category III.

i A center scale indication on LI SP9B1 or LISP 9Al could possibly be diagnosed as a

. normal indication in the highly unlikely condition that the comparison was .being made at the one unique power level that corresponds to this level. These i indicators vary in a linear fashion from 40" at 28% power to approximately 160" ,

j. at 100% power. The center scale failure position is 125". The operator uses i i -this indication in the Emergency Procedure (EP) for two different tasks. The  !

first is for a reactor trip without an SFRCS isolation trip the operator is required to verify NFW response is proper. The guidance given to make this

verification is that MFW flow (recorder and indicator on the same panel) and i SG level decrease. The step was written to require checking both parameters j for the specific reason of not wanting the operator to take action based on one

! - indication which might be failed. At this time the operator would notice the level indicator at center scale not decreasing and would make a comparison with i the two other level indications (different ranges which overlap the range of the meter failed at center scale) on the same panel and realize the indicator was

failed. Further, the contingency action identified in the EP to be taken if i the verification cannot be made is addressed by the operation action required to prevent SG overfill. The EP step requires tripping the MFPs only if MFW flow will not decrease to a SG and the same SG 1evel ic increasing. This step is

again written to prevent inadvertent action in case of a failed indicator. At

this point the operator would clearly identify the level meter as failed since by operator training he knows it is not possible to decrease MFW flow to a SG and not cause the level to decrease. He has three level indications and two l flow indications on the same panel to use for this task. The error assessment l category for these two meters for this task is therefore Category III.

4 1

l i

,, . . _ _ ~ . - - _ _ _ _ . - _ - _ _ _ _ . _ . _ , . _ _ , . _ . . . . - - , _ _ _ _ . . _ _ . , . , . _ _ _ _ _ . , . _

I DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO. 5.1.007 PAGE 3 0F 3 The second task in the EP which requires the operator to use this indication is af ter an SFRCS actuation (which by design also causes the reactor to trip) to verify proper SG level control by the AFW System. At this point if the operator failed to make a comparison with the other two ranges of SG level mentioned in the first task he could defeat the safety function for this AFW train by taking manual control and attempting to lower the level by decreasing AFW flow. Although the operator is not likely to continue this action until the SG is dry (based on two other SG level indications and the operators expectancy of seeing SG 1evel decrease when feedwater flow is decreased) the error assessment category is II.

Since the potential exists for degrading a safety function the significance category is A-M.

DISPOSITION:

Although the potential for operator error as a result of this problem exists, a redundant safety grade SG level meter is going to be installed in the control room for each SG. This meter will be supplied by a transmitter which is independent of the present LI SP9B1 and LI SP9Al instrument string. Addition of these redundant SG 1evel strings will provide a safety grade meter for comparison use by the operator when performing the required tasks in the EP. The operator will then have a method of positively determining the meter is failed and will not take action based on an indication with a non-apparent failure. The addition of new safety grade SG level instruments is planned in conjunction with installation of the new SFRCS panel (HED 9.2-001 HED 9.2-033) and is planned for completion in the 5th refueling outage.

The meters listed in this HED are powered from essential power from the Auxiliary Shutdown Panel.

SCHEDULE:

Modifications from the SFRCS special study will be implemented in the next (5th) refueling outage.

[ f. C (INTERIMFINALDISPOSITIONAPPROVAL: N M v. o die % DATE h UU FINAL IMPLEMENTATION APPROVAL: DATE TF 015

PAGE: I of 2

. ' DAVIS-BESSE '

' HUMAN ENGINEERING DISCREPANCY (HED) REPORT 4

-TITLE: Dual Meter Indicators that are Confusing to Read HED NO: 5.1.009 CATEGORY: IIA-M DATE ORIGINATED: 7/26/83 ITEMS INVOLVED:

Category FINU31/FIMU34. Makeup Flow Indication tiigh/ Low Range IIA-M P1505/FI4521, Auxiliary Feed Pump 1 Discharge Pressure / Flow IIA-M PI509/FI4322. Auxiliary Feed Pump 2 Discharge Pressure / Flow IIA-M ,

-PROBLEM DESCRIPTION:

The meters listed each have two pointers and two scales within a single meter

- case. Both have been identified as being potentially confusing to read. The

makeup flow indication has.two scales which represent a low range and a wide range flow and can be confusing to read because of the close proximity of the scale graduations. The Auxiliary Feed Pump discharge pressure and flow indications for both Pumps 1 and 2 have caused confusion with respect to which scale indicates which parameter.

1-NUREG--0700 PARA: >

3.3.2.4-DATA SOURCE:

Operator interviews

! ' TP-5.1B6 (17)-

, TP-5.186(18)

- SPECIFIC ERROR:

It is possible for an operator to become confused when reading dual scale meters and take: inappropriate action.

ASSESSMENT JUSTIFICATION:

The dual meter indicators listed provide potential for confusion when reading the meters. The two dual indicating meters associated with the Auxiliary Feed Pumps may be considered together with respect to this HED, while fhe assessment of the makeup flow indication must be considered independently.

Although the discharge pressure and flow indicators of the Auxiliary Feed Pump meters may be confused for one another, proper operation of the Auxiliary Feed- ,

water System is more directly indicated by steam generator levels and pressures

. such that an incorrect operator action on the basis of an incorrectly read discharge pressure or flow alone is very unlikely. Auxiliary Feed Pump turbine speed is also available for each turbine to provide additional indication of

,- pump operation.

1

i-

. DAVIS-BESSE HUMAN ENCYNEERING DYSCREPANCY (HED) REP 0kT ,

HED NO: 5.1.009 PAGE 2'of 2 1

Although the error assessment potential as the result of this HED alone is low, it has been conservatively categorized as IIA-M af ter consideration of other related HEDs affecting SFRCS and Auxiliary Feedvater Systems (see HED 5.1.006,

.9.2.001, 9.2.007, 9.2.020, 9.2.033).

The scale arrangement and the makeup flow indication may cause the operator to misread the indicated makeup flow. However, Emergency Operating Procedures direct

the operator to maintain maximum makeup flow when makeup flow is required, and, therefore, the operator should not take inappropriate actions based on an erroneous reading. Although the potential for performing inappropriate actions as a result of

this condition is low, the meter can be confusing to read, and considering the

, significance of RCS makeup flow in the feed and bleed cooling mode as a backup to normal and auxiliary feedwater, the category of this component problem is IIA-M.

DISFOSITION:

I Different labeling enhancements are currently being evaluated for application to j the Auxiliary Feed Pump meters prior to restart. The intent of the enhancement 1 is to'more clearly identify the individual scales. This problem will be com-i plately addressed in the SFRCS Special Study. The Auxiliary Feed Pump indications i are to be included as a part of the centralized SFRCS panel arrangement to be installed in the next (5th) refueling outage.

, The' wide range indication of makeup flow has been expanded to include the maximum anticipated flow range as described in HED 5.1.006. This will reduce potential  ;

}' confusion in high makeup flow situations, but does not directly address the scale

-problem. In conjunction with the range modification, the meter scale must be changed. The specific modifiction is currently being developed, and a new scale i face or the installation of two meters will address this concern completely prior to restart. s i

i SCHEDULE:

i The labeling enhancement for the Auxiliary Feed Pump indicators will be finalized and installed prior to restart and final corrective action will be taken during the

next (5th) refueling outage in conjunction' with SFRCS panel installation. Corrective

, action for the makeup flow infication will be developed in conjunction with the j correction fo HED 5.1.006 prior to restart.

i

O q INTERIM FINAL DISPOSITION APPROVAL: h u4 d/* x DATE bM 6 FINAL 1MPLEMENTATION APPROVAL: DATE i

i

[ JAL/006/7 4

i i

i I

I

PAGE: 1 0F 2

. DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Meters With Pointers That Have Parallax HED NO: 5.1.029 Problems CATEGORY: IIA-6 STATUS: Int. Dis. App.

DATE ORIGINATED: 9/1/83 6 ITEMS-INVOLVED:

Panel Component ID Description Catego ry 5798 .TIRC3B6/TIRC4B2A Loop 1 Temperature III TIRC3A6/TIRC4A2A Loop 2 Temperature III TI4628 Incore Temperature III 5799 TIRC3B5/TIRC4B4 Loop 3 Temperature III TIRC3AS/TIRC4A4 Loop 2 Temperature III TI4627 Incore Temperature III PROBLEM DESCRIPTION:

Pointers on meters on the Post Accident Monitor (PAM) panel are not mounted close to the scale causing parallax problems. This could make it difficult to obtain a proper reading and cause an operator to misread the display. The significance of this problem and effect on performance of Emergency Operating Procedures is described in the Assessment Justification section.

NUREG-0700 PARA:

6.5.2.2B(2)

DATA SOURCF.:

Operator Interview TP-5.1B3(31) ~

SPECIFIC ERROR:

Misread the display and fail to take action or take improper action based on that teading.

A3SESSMENT JUSTIFICATION:

.The Post Accident Monitoring (PAM) Panel is by design intended to be a backup monitoring system. The only meters on the PAM panel which are referenced by the Emergency Procedure (EP) to be used for an operator task are the incore thermocouple meters (TI 4627 and TI 4628) and the wide range hot leg temperatures (TIRC3A5, TIRC#B5, TIRC3A6 and TIRC3B6) and the margin to saturation meters (TDI 4950 TDI 4951). The margin to saturation meters are large digital displays and are not associated with the problem described in this HED. The incore thermocouple meters are the primary

[ indication to be used for determination of inadequate core cooling (ICC) ]

conditions. Entry into the EP section for ICC and the operator actions in f

DAUIS-BESSE HUMAN ENGINEERIWC DISCREPANCY HED NO. 5.1.029 PAGE 2 0F 2 the ICC section are based on the indications from these meters. The meters are readable to the accuracy required by the procedure. The meters are readable to one half of one scale increment (5*F) accuracy which is more accurate than the technical basis which defined the procedure steps.

The error assessment category for these meters is therefore III.

The wide range hot leg temperatures are only used as a backup indication to the four control panel mounted hot leg temperature meters (two of the control panel meters are safety grade and two are NNI system powered).

The operctor task required by the EP is the initiation of the " Feed and Bleed" cooling mode, af ter a complete loss of all feedwater to the SGs, when either loop hot leg temperature reaches 600*F. The PAM panel meters ,

are only required by the EP if all the control panel hot leg temperature indication has been lost. In the unlikely event all four control panel hot leg temperature meters are lost the operator would have to make the determination based on the PAM panel hot leg meters which are also read.oic to 5*F accuracy. The EP criteria of initiation at 600*F is more than 5*r below the initiation temperature required by analysis. The error assessmect category for those meters is therefore III.

If these PAM panel hot leg temperatures are also lost the incore thermocouple temperature meters mentioned above are used by the operator. These have the same readable accuracy as the hot leg temperatures as mentioned above.

Considering other HEDs related to the PAM panel this HED has been conservatively upgraded to II.A-L.

DISPOSITION:

As described in the Assessment Justification section continued operation with the present design of the PAM panel will not adversely affect performance of Emergency Operating Proce'dures. However, due to other HEDs associated with this panel the special studies on displays to be completed after restart are expected to recommend major changes to these displays. These changes are expected to be completed in the 5th refueling outage.

SCHEDULE:

The Display Study generated corrective actions with respect to the PAM panel will be implemented in the next (5th) refueling outage.

d -

INTERIM / INAL DISPOSITION APPROVAL:  % X(++m % . DATE WM6 FINAL IMPLEMENTATION APPROVAL: DATE l

l TF 012 )

l l

l

PAGE: 1 of 2

. DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Labels That are not Placed Above the Panel HED NO: 6.1.012 Elements They Describe CATEGORY: IIA-L STATUS: Int. Dis. App.

. DATE ORIGINATED: 10/01/83 ITEMS INVOLVED:

Most Control Room labels centaining the instrument identification numbers.

PROBLEM DESCRIPTION:

The majority of the lat>'s centaining instrument identification numbers and some .

descriptor labels are not located above the associated component. Some labels are located on the pushbutton switch perpendicular to the control board or may be located under the components or to the side.

0700 PARA:  !

4 6.6.2.1A

DATA SOURCE

Operator interviews TP-6.1B3(9) TP-6.1B3(10)

TP-6.1B3(11)

SPECIFIC ERROR:

Potential for identification of the wrong component.

ASSESSMENT JUSTIFICATION

This problem is generic to all Control Room labeling and since the potential for some error:does exist, the error assessment dategory is II. Although the problem is generic to all Control Room components, therr!)re encompassing some safety related equipment operators do not base their actions on instrument' number identifiers or descriptive labels only, and routinely verify the results of control manipula -

tions through other indications. Taken ey itself this HED has relatively low error potential and safety signficance but, it has been conservatively categorized as II A-L in light of other labeling HED's.

DISPOSITION:

This problem is to be addressed during the Label and Location Aids Special Study which will integrate the resolution of all other labeling related HEDs. As indicated in the Assessment Justification, this HED is considered less significant because of the operator's restricted use of component identification by instrument ID number or descriptive label and by the routine practice of verifying control actions with other indications. Deferring resolution of this HED until the Label and Locations Aid Special Study is, therefore, justified.

DAVIS-BESSE HDIAN ENGINEERING DISCREPANCY (HED) REPORT HED NO:*6.1.012 PAGE 2 of 2 SCHEDULE:

The Label and Location Aids Special Study will begin following restart.

' khERI FINAL DISPOSITION APPROVAL: u / e - DATE N M'[$

FINAL IMPLEMENTATICN APPROVAL: DATE 6

4 JRL/006/8

PAGE: 1 of 2

- DAVIS-BESSE ,

HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Temporary Labels, Magnetic Labels, and Informa- HED NO: 6.1.015 tion Tags Obscure Components CATEGORY: IIA-L STATUS: Closed DATE ORIGINATED: 10/1/83 ITEMS INVOLVED:

Most control room components.

PROBLEM DESCRIPTION:

Temporary labels, magnetic labels, and information tags obscure components and other .

labels. The most notable problems are the information tags placed over Cutler Hammer hand indicating switches.

-NUREG-0700 PARA:

6.6.2.4A D.TA 3 SOURCE:

Operator interviews TP-6.lB3(19)

TP-6.lB3(45)

TP-6.1B3 (48)

TP-6.1B3(49)

SPECIFIC ERROR:

Delay in or failure to identify equipment status.

ASSESSMENT JUSTIFICATION:

The potential for this problem exists throughout the Control _ Room, and the HED is given an error assessment category of II. Alth) ugh this problem is generic and the practice of handling information tags and placing labels may potentially affect safety related equipment, the effect of the problem is primarily to delay the operator's completion of normal assessment activities. The significance categsry is, therefore, A-L.

DISPOSITION:

A new procedure for the control of Control Room labels and tags has been established as a part of Administrative Procedure AD 1803.02, " Operational Information Tags".

This procedure clearly states the importance of hanging tags or placing labels in such a manner that other components or labels are not obscured.

For Control Room hand indicating switches, a plastic shroud with a sliding plexiglass front will be installed on switches requiring labeling to permit the use of stickers containing the necessary information, which will be placed on the sliding plexiglass cover. This will insure that no other indication is obscured. The use of the plastic shrouds is also controlled by AD 1803.02.

DAVIS-BESSE HUMAN ENGINEERING DISCREPAbCY (HED) REPORT HED NO:,6.1.015 PAGE 2 of 2 The use cf this new procedure will eliminate the previous problems and completely addresses this HED. The new procedure for controlling tags and labels does not create any new HEDs (see attached Verification of Design Improvement form). The use of the plastic shroud on hand indicating switches still permits the placement of important operating information while assuring.that no other components are obscured. This corrective action, therefore, closes this HED.

SCHEDULE:

Complete.

INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMPLEMENTATION APPROVAL: . d /H 4< G pu c ,b[e de iis 1y) t< llb>t -ho42 0b5 OLA t- ex~>vir~ru+ 3 J /

TYPE OF VERIFICATION: Initial X Interim Implementation BASIS OF REVIEW: .

N Documentation Review (specify document number)

FCR Request FCR Concept Design FCR Detailed Design Maintenance Work Order

,X Procedure A I) /803 OL "6MAbota[ b bwobe

' '/ '

Other Hardware Assessment s AFFECTED COMPONENTS:

/// Ccbe f MC??t wh THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MA4NER:

Yes Ne N/A A. Comparison with NUREG-0700 guidelines T

~v 6.61 M-B. Comparison with T/A I&C reqts C. Operations review and comments ( + vei.i.

- [,f," .it .. i D. Walk-throughs X 2 E. Other (specify) V

HED No. b/to

. Page 2 of 2 THE HU:1AN FACTORS REVIEW RESULTED IN A FINDING THAT THE DESIGN IMPROVEMENT:

C Will fully satisfy the human factors concerns in the HED.

Will partially satisfy the human factors concerns in the HED.

Will not satisfy the human factors concerns in the ED.

JUSTIFICATION: T& c,) [t 0.e ( CItr cd k ,v -nt.orucdcedcc[ a 4

e L Iu l > c.dd w c M;, m chhm e i&Ma la cs one h14k L wetLll <t Just Mt{J W o R)fo brt 4 6 uf - d <t N'

(~y 'f {w /a ci f(M[it slutencls /taee lu lce(b cc/ a 3 41 4-lt-en / OkelrVPfu G ddU6/ ($P CE>tCMW) M c}/a tNo.

THE DESIGN IMPROVEMENT M (WILL NOT) RESULT IN ANY NEW HEDs. (IDENTIFY NEW EDs IF APPROPRIATE.)

JUSTIEICATION: Yb- lc< < 2 .L( w $c{ Mcf CCu.< V Nl'Ds, ou-y Mard % a ., . b povad % % au- "

i nc.mw 4L wstati:.i m A b sc3,e z - '

/

FURTHER HUMAN FACTORS REVIEW (IS NOT) REQUIRED.

JUSTIFICATION: ((a con csm # /f tY# D [(40 e

% adduuad Amt+ vaare;aAvus J %

i hca4hr YULCllt(1 &o 0ce$for /&&t- 44 OlkW)'

04th /

OfcM Int al aru:

I bYL e O /[C 3 : Ok

/

M/ _kL)' f ,G b . /e/ L'f REVIEWER: \ DATE: e HED/001 l

l l

l l

l

PAGE 1 of 5 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: SFRCS Display Arrangement Does Not Support HED NO: 9.2.001 Verification of Actuation Tasks CATEGORY: IIA-M STATUS: INT. DIS. APP.

DATE ORIGINATED: 5/7/84 ITEMS INVOLVED:

See component list attached.

PROBLEM DESCRIPTION:

Controls and displays of the Steam and Feedwater Rupture Control System (SFRCS) and SFRCS actuated equipment are located on various Control Room panels (see list of items involved). On either a manual actuation or automatic actuation of SFRCS, the Control Room operator cannot see all associated displays from one location to confirm proper SFRCS actuation.

The SFRCS is a fully automated system and proper system operation is not dependent 1xt operator verification, but in the event of incomplete or improper automatic actuation, the control display arrangement would delay the operator's identification and response to the problem.

NUREG-0700 PARA:

6.8.1.1.A, 6.8.1.1.B DATA SOURCE:

The problem was identified during the verification and validation walk-through.

I SPECIFIC ERR'OR:

Delay in complete verification or omission of verification of proper SFRCS actua-tion.

ASSESSMENT JUSTIFICATION:

The items involved in this HED include all indications and controls specifically

-associated with the verification of system acutation. This HED addresses the ability to verify system actuation and the problem is generic to all components; therefore, specific evaluation ef each is not required. The error assessment category is II since the problem was identified during the verification and validation process and

, since no actual operator errors attributable to this problem have been identified.

L-If improper SFRCS actuation went undetected as a result of this error, the safety 1

related function of maintaining proper steam generator heat removal capabilities

[ .could be degraded; therefore, the significance categorization is A-M.

DISPOSITION:

I Although the overall problem identified in this HED has not been specifically l

addressed by a hardware modification at this time, major system design changes are currently being developed which will resolve this problem.

4, c - , ..- . .

DAVIS-BESSE HUMAN ENGlMEERIEG DISCREPANCY (HED) REPORT HED NO: ,9.2.001 PAGE 2 of 5 The SFRCS special study identified in the DCRDR Summary Report provides the focus for the integrated look at all SFRCS related HEDs. . Preliminary results of this integrated review of SFRCS problems has identified the need for improved Control Room information on SFRCS input parameters (see HED 9.2.42) and SFRCS actuation logic status (see HED 9.2.018), in addition to a centrally located arrangement of SFRCS controls and displays necessary to permit a rapid verification of proper actuation. The design development effort necessary to assure that SFRCS related HED's are optimally addressed has been initiated and the implementation of these changes is currently scheduled for the next (5th) refueling outage.

The existing configuration of SFRCS controls and displays is acceptable because of the design modifications that have been implemented during the current outage and because of the control room operators training and past experience with the SFRCS '

system. ,

This HED is associated with the verification of proper SFRCS system actuation.

Consequently, those system design changes which reduce the likelihood of improper system actuation or which improve the operators ability to perform the verification will lessen the significance of this HED. Several system design modifications have

, been implemented during the current outage which increased the probability of I proper actuation. The modifications made to the physical arrangement of the SFRCS f manual actuation switches (see HED 9.2.054) have assured proper SFRCS response to a manual actuation.

I Modifications made to the SFRCS system logic and to actuated equipment also increase l the probability of propar actuation, including for example, the configuration of the

} Auxiliary Feedwater system steam supply in the standby mode (maintaining steam headers in the hot condition) has improved the reliability of the starting and continued operation of the Auxiliary Feed pump turbines. The reliable operation of motor operated valves has been improved by new maintenance and testing techniques.

The SFRCS system logic has been modified to prevent total isolation cf both steam generators.

The operators ability to identify the cause of an SFRCS actuation has been improved by changes made to the annunciators associated with SFRCS actuation (see HED 9.2.018) which gives the operator additional time to perform the task of actuation verification.

The control room operators are very familiar with the layout of SFRCS related controls and displays. Operator training has routinely stressed proper SFRCS actuation. The improper manual SFRCS actuation which occurred on June 9,1985 was very quickly recognized by the operators. Additional equipment malfunctions which occurred on June 9, 1985 were also quickly recognized by the operators.

The SFRCS has had many actuations in the past, some of which have involved individual component failures which the operators have always identified and corrected with the present configuration. This rapid identification of improper system actuation is possible because verification of the major SFRCS system functions can be quickly accomplished without verifying the specific status of each actuated component. The specific operator task in the Emergency Operating Procedure (EOP) related to this HED are statements that require the operator, after any auto or manual SFRCS actuation, to " verify proper SFRCS actuation for the trip parameters present". The specific guidance in the procedure on how to accomplish the step lists the annunciators used

l 1

DAVIS-BESSE HUMAN ENGTEEERING DISCREPANCY (HED) REPORT j HED N0:.9.2.001 PAGE 3 cf 5 to determine the trip parameter and references a Table which should be used to j verify the components have actuated correctly. The Table is layed out by trip  !

parameter, to give desired component state and control room panel location. The effect of an operator error in this task would only be relavent if an improper component actuation had acutally occurred. A failure of the SFRCS to properly actuate would lead to an RCS overcooling or overheating symptom. The symptom based EP would direct the operator to a procledure section which deals with all the possible causes of the symptom.

The operators have also been trained that overcooling or overheating are always caused by loss of SG inventory or loss of SG pressure control. The appropriate procedure section will require a reverification of proper SFRCS actuation.

Since the operator has entered a procedure seccion that specifically addresses secondary plant failures, and.his training and plant knowledge also tells him he has a failure related to SG inventory and pressure control, any initial verification error wculd be corrected at this point as he makes the reverifica-tion specifically looking for a failed component. Based on the fact that the symptom based EP requires continual verification end checking for cause until the symptom is mitigated and based on the fact this has not been a specific problem in the past, operation of the plant in the present configuration is justified until the change can be made in the 5th refueling outage.

SCHEDULE:

Implementacion of corrective actions identified by the SFRCS Special Study will be implemented during the next (5th) refueling outage.

D INTERIM / FINAL DISPOSITION APPROVAL:

f YNQ f

a&> nm_ DATE bM Yb FINAL IMPLEMENTATION APPROVAL: DATE f

1

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT

~HED N0: 9.2.001 PAGE 4 of 5 COMPONENT LIST FOR HED 9.2.001 Panel No. Instrument No. De.acription C5709 'HIS-3871 Auxiliary Feed Pump No. 2 Discharge to Steam Generator No. 1 Isolation Valve HIS-3872 Auxiliary Feed Pump No. 2 Discharge to Steam Generator No. 2 Isolation Valve HIS-5889A Auxiliary Feed Pump 1 Steam Inlet Valve HIS-5889B Auxiliary Feed Pump 2 Steam Inlet Valve PI-505 Auxiliary Feed Pump 1 Discharge Pressure PI-509 Auxiliary Feed Pump 2 Discharge Pressure .

FI-4521 Auxiliary Feed Pump 1 Feedwater Flow FI-4522 Auxiliary Feed Pump 2 Feedvater Flow SI-815 Auxiliary Feed Pump Turbine No. 1 Speed SI-816 Auxiliary Feed Pump Turbine No. 2 Speed CS721 HIS-780 Main Feedwater to Steam. Generator No. 1 Block Valve HIS-779 Main Feedwater to Steam Generator No. 2 Block Valve HIS-611 Steam Generator No. 1 Drain Valve Isolation HIS-603 Steam Generator No. 2 Drain Valve Isolation f .

C5712 FIC-ICS33B Main Feedwater Startup Flow Control Valve 1 hs- ZI-SP65 Main Feedwater Flow Control Valve Position 1 FIC-ICS33A Main Feedwater Startup Feedwater Control Valve 2 ZI-SP6A Main Feedwater Flow Control Valve Position'2 LI-SP9B1 Steam Generator No. 1 Startup Range Level LI-SP9Al Steam Generator No. 2 Startup Range Level C5799 F1-4630 PAM Panel Auxiliary Feedwater Flow to Steam Generator 1

, C5798 FI-4631 PAM Panel Auxiliary Feedwater Flow to Steam Generator 2 j C5706 HIS-3869 Auxiliary Feed Pump No.1 Discharge to Steam Generator No. 2 Isolation Valve HIS-3870 Auxiliary Feed Pump No.1 Discharge to Steam Generator No. 1 Isolation Valve

< C5717 HIS-ICS11B Main Steam No. 1 Atmospheric Vent Valve HIS-ICS11A Main Steam No. 2 Atmospheric Vent Valve HIS-394 Steam Generator 1 Main Steam Warm-Up Drain Isolation

. Valve HIS-375 Steam Generator 2 Main Steam Warm-Up Drain Isolation '

Valve HIS-101 Main Steam Isolation Valve No. 1 HIS-100 Main Steam Isolation Valve No. 2 HIS-601 Steam Generator 2 Main Feedwater Stop Valve HIS-612 Steam Generator-2 Main Feedwater Stop Valve  !

HIS-608A Steam Generator 1 Auxiliary Feedwater Isolation Valve HIS-608B Steam Generator 1 Acxiliary Feedwater Isolation Valve

HIS-599A Steam Generator 2 Auxiliary Feedwater Isolation Valve HIS-599B Steam Generator 2 Auxiliary Feedwater Isolation Valve HIS-106A Main Steam Line No. I to Auxiliary Feed Pump Turbine 3

No. 1 Isolation Valve HIS-106E Main Steam Line No. 2 to Auxiliary Feed Pump Turbine

, No. 1 Isolation Valve HIS-107A Main Steam Line No. 2 to Auxiliary Feed Pump Turbine

No. 2 Isolation Valve a

t

• b DAVIS-BESSE HLHAN "NGINEERING DISCREPANCY (HED) REPORT

~HED NO:.9.2.001 PAGE 5 of 5 COMPONENT LIST FOR HED 9.2.001 i Panel No. Instrument No. Description

~

HIS-107E. Main Steam Line No. I to Auxiliary Feed Pump Turbine No. 2 Isolation Valve.

.r 7

I- ,

i I

-l

- I a

a JRL/006/2 4

l I I

, _. ._ - _ _ _ _ _ _ . ._. - . _ _ _ _ - - . _ _ - - _ . . . . _ . _ , , _ - - - . _ . , , . _ . . _ _ .. , _ ._._-,_.. _ _ . . , . . _ _ _ . __._..._..._.--,,~,_._1

PAGE: 1 of 2

. DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Related Controls and Displays Not Located HED NO: 9.2.004 Together CATEGORY: IIB-L STATUS: Closed DATE ORIGINATED: 5/4/83 ITEMS INVOLVED:

Reactor Crolant System (RCS) temperature input to Integrated Control System-(ICS) select switches HS-RC3B and HS-RC3A PROBLEM DESCRIPTION:

The identified hand switches are used to select the respective reactor coolant hot leg loop temperature for display and temperature compensation for the corresponding Reactor Coolant System (RCS) loop flow signal. The hand switches are located on the back panel along with the temperature indication such that the selected tempera-ture can be read as the hand switch is manipulated. The indication of ECS loop flow is, howevar, located on the front console and is not visible by the individual manipulating the switch. This loop flow feeds the ICS and can affect the feedwater controls.

Although the operator can view the selected temperature while manipulating the control, the use of the temperature signal as temperature compensation for reactor coolant flow can have a pronounced effect on reactor coolant flow. Consequently, the process of switching from one temperature signal to another may have a minor impact.on indicated temperature, but have a sufficient impact on reactor coolant flow to cause a feedwater system transient.

Manipulation of this control is not required as a part of the emergency operating procedure, and the outputs feed no safety related systems. Selection of the tempera-ture indication not normally selected ir useful only to determine proper operation of the instrument string.

NUREG-0700 PARA:

6.8.1.1A

.6.9.1.1 l

DATA SOURCE:

l Operator comment during verification and validation.

SPECIFIC ERROR:

Inadvertent creation of a feedwater system transient.

ASSESSMENT JUSTIFICATION:

The problem and therefore its assessment for both of these switches is identical.

Although manipulation of these controls has not resulted in any reactor / turbine trips, the potential does exist under certain circumstances. The error assessment category is II.

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT

.HED NO:.9.2.004 2 AGE 2 of 2 The associated equipment is not safety related, cannot degrade any safety function

~

and are not referenced ~in the Emergency Operating Procedure. The significance category is, therefore, B-L.

DISPOSITION:

The facility modification FCR 82-023A (not specifically initiated as a result of this HED) has resolved this problem. The modification was intended to improve ICS relia-bility by modifying the control system dependence on reactor coolant flow inputs.

The inputs to the ICS have been modified to use reactor coolant pump operating status in place of reactor coolant flow. The reactor coolant pump status provides suf ficient information for the ICS to determine required feedwater flow and is considerably more reliable than actual flow indication. Actual flow indication is switched into the ICS in the event of a a reactor coolant pump trip.

As a result of this modification, the potential transients caused by selecting an inaccurate or failed temperature indication have been eliminated. The need to monitor reactor coolant flow indication on the front console while manipulating the temperature selectors has been eliminated.

No new HEDs are created by this modification since reactor coolant pump status provides appropriate information to the ICS, and the modification created no other impact on the Control Room.

An interim corrective action was earlier identified for this problem. The corrective action was to eliminate the procedural requirement to periodically select the unused temperature input to verify proper operation. With the implementation of FCR 82-023A this procedural restriction is no longer required.

SCHEDULE:

Complete.

INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMPLEMENTATION APPROVAL: E zN DATE u-A Jg JRL/006/10 i

PACE: 1 of 2 <

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Misleading Panel Arrangement For ICS Input HED NO: 9.2.005 Select Switches CATEGORY: IIA-M STATUS: Int. Dis. App.

DATE ORIGINATED: 5/7/84

~

ITEMS INVOLVED:

HS SP12B/PI SP12B, Steam Generator 1 Pressure HS SP12A/PI SP12A, Steam Generator 2 Pressure HS SP982/LI SP981, Steam Generator 1 Level HS SP9A2/LI SP9A1, Steam Generator 2 Level PROBLEM DESCRIPTION:

When two redundant parameter signals are available and selectable by hand switch,

.the' selected signal is normally indicated on an associated cisplay. In the case of these four switches and their associated indicators the signal displayed is fixed such that manipulating the apparently associated selector switch does not affect the display variable, but does affect the input-to the Integrated Control System (ICS) for control. These four switches have been labeled ICS INPUT SELECT to distinguish

-them from similar instrument select switches. These four switches are an exception to the general design of instrument select switches in the Control Room.

NUREG-0700 PARA:

6.8.1.1A and 6.8.2.1C DATA SOURCE:

Operator comment during verification and validation. '

SPECIFIC ERROR:

Incorrectly associating the display with the proximate control.

ASSESSMENT JUSTIFICATION:

The problems associated with the fnut switch / display combinations listed are l identical, and their assessment may be considered generic. The inconsistent i control display relationship creates the potential for an operator to incorrectly assume that redundant signals are available for these indicators. Although the potential for a misinterpretation of the display exists, inappropriate cperator action on the basis of a single display is unlikely since the Emergency Operating

' Procedure and operator training stresses the use of associated information wherever possible. These indicators, however, are used to support the' verification of proper Auxiliary Feedvater System operation and taken in conjunction with other associated HEDs on Auxiliary Feedwater and SFRCS (see HED 5.1.007, 9.2.001, 9.2.020, 9.2.033), the category of this HED has been conservatively set at IIA-M.

An additional consequence of this problem is the potential for an operator to incorrectly transfer an inaccurate or failed signcl into the Integrated Control System. Although the effects of such an error would be quickly identified by

DAVIS-BESSE HUMAN EEGINEERING DISCREPANCY (HED) REPORT HED NO:.9.2.005 PAGE 2 of 2 Control System actions, under certain conditions the error may result in a reactor trip. Station procedures require a preferred instrument switch lineup and clearly require the operator to check the indication via the computer prior to selecting an alternate instrument. Therefore, it is unlikely that an operator would transfer a failed signal into' the ICS during power operation.

DISPOSITION:

Different labeling modification are being evaluated as an enhancement for this HED prior to restart. The options under consideration are intended to indicated the specific relationship between the indicator and the hand switch, and since the selected option will only be applied to these specific switch / display combinations, the inconsistency with the convention used in the remainder of the control room will be clearly evident. This labeling modification will provide an acceptable resolution to this particular condition, however, this HED will be considered further in conjunction with the SFRCS Special Study.

SCHEDULE:

The labeling enhancement will be finalized and implemented prior to restart and any additional corrective actions identified in conjunction with the SFRCS Special Study will be implemented in the next (5th) refueling outage.

%)

INTERIM FINAL DISPOSITION APPROVAL: Mb S- ( w e m DATE O'/$3I FINAL IMPLEMENTATION APPROVAL: DATE 1

JRL/006/11

PACE: 1 of,2 DAVIS-BESSE HUMAN ENGINEERING DISCRFPAFCY (HED) REPORT TITLE: Violation of Operator Expectancy - SFAS Trip HED NO: 0.2.006 Buttons CATEGORY: IA-L STATUS: Dirp. Closed

.DATE ORIGINATED! 5/7/84 ITFMS INy0LVED:

FIS-2020, HIS-2021, HIS-2022. HIS-2023 - SEAS Trip and Reset Buttons PROBLEM DESCRIPTION:

The Safety Features Actuation System (SFAS) manual tiip and recet pushbuttons are

. located in a row near the top of the SEAS panel. The reset pushbuttons are of.the same round shape and type as the reactor and turbfre trin pushbuttons and the SFAS trip pushbuttons are squa.Te. During the verificatier end validation walk-throughs, the operators indicated that in one case an operator , essed the reset pushbutton instead of the trip'pushbutton.

.NUREG-0700 PARA:

l 6.8.2.4A DATA SOURCE:

Operator comment during verification and validatier.

SPECIFIC ERROR:

Activation of improper contrel.

ASSESSMENT JUSTIFICATION

• The four setc of trfp and reset buttons listed are identical in appearance; therefore assessment of this HED is generic. Since tiil: error has reportedly occurred, the error assessment category is I. Although the ette* can nocenterily delay the acturtien of the Safety Features Actuation System-(SFAS), Phe operator would quickly recognize his error as he attempted to verify proper syst m actuation.

Also, the system is fully automatic and, if required, would actuate at t. e appropriate setpoint. Therefore, the rfgnificance category is A-L.

DISPOSITION:

The similarity between the SFAS reset buttons and other trip pushbuttons can be mirfni=ed with appropriate labeling. The SEAS trip buttons themselves are of a different type and are easily distinguishable from the reset buttons. The pushout-tons are relatively hi Fh on the panel and the " reset" label over the top of the butten cay be partially obscured for operators of less than average height. This condition prenotes the tendency to rely on the recet/ trip button shape similarity.

This probles will be corrected by placing an additional reset and trip label bel'w the four pairs of pushbutton controls (see attached label sketches) in order to provide e preminent identification of the trip and reset functions. This cddf.tferal labeling does not gererete any new HEDs (see attach. .erf~ication of Design Improve-ment farn). The available panel space providen ceple ro

• for the labeling.

e -

DMJf 3-I. ESSE lid'AN ENGINEERING DISCREPANCY (PET) FFPORT uED NO: 9.2.006 PACE 2 of 2 LIEPOSITION (continued):

No other" actions to correct this HED are necessara.

SCHEDULE:

The labels will be added prior to restart.

J ~ .~ ,

INTEFIP.FIFA DISPOSITION APPROVAL: Me /htm DATE 9-/9-85 FINAL IMPLEMENTATION APPROVAL: DATE l

i i

I i

i JRL/006/12 f

v , . . . . _ . _ . ,

y HED No. '/ _' s'(c-Page 1 of 2 HUMAN FACTORS VERIFICATION OF DESIGN IMPROVEMENT BRIEF DESCRIPTION: iC l0 It , n c- r 05 i dry (v gu.C h6_o c 4 f -

srAs h;o b< h TYPE OF VERIFICATION: M Initial Interim Implementation BASIS OF REVIEW:

Documentation Review (specify document number)

FCR Request FCR Concept Design FCR Detailed Design Maintenance Work Order Procedure Y other 5 k A-6 fr( preod.edcwhb u d {dkck-Q Hardware Assessment AFFECTED COMPONENTS:

$16 7_ ol C ffI$ 2 o . 2.

p.c5 2 ott gxs 2.o2F THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

Yes No J N

A. Comparison with NUREG-0700 guidelines x B. Comparison with T/A I&C reqts Y C. Operations review and comments <

D. Walk-throughs X E. Other (specify)% A L rec ie V

~

HED No. ~{..

Page 2 cf 2 THE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT THE DESIGN IMPROVEMENT:

I Will fully satisfy the human factors concerns in the HE3.

Will partially .=atisfy the human factors concerns in the HED.

Will not satisfy the human factors concerns in the HED.

JUSTIFICATION: bei he Is in e m% c{ ti. ill c i v c , (,. Id..'sItb \

& m g 4 <.zilc A Ed & ps . t uj/ cts . %$k a ul c% < h.o hu %, e . s en bd veen nuit au :s om:lar $cweenanin Ic w a 6FAs i+sd h a //ou 3 Gyr a a a.1hd . NLa re is m,nimal er c> h a h. {r .Let

+fu cberalcrs m,s 44n,,, -l(w sFAs res t /> u Hen $ a Ir ,

W +1/t . .I THE DESIGN IMPROVEMENT (W (WILL NOT) RESULT IN ANY NEW HEDs. (IDENTIFY NEW HEDs IF APPROPRIATE.

JUSTIFICATION: kre. ,_v- 9 e-f Io b clu em1m[s

, i s'(W[n edh _

Accl lain e (S cins w oe,o fes. d Ale wc HGk j I h 4/o d.

J s

FURTHER HUMAN FACTORS REVIEW (IS) REQUIRED.

JUSTIFICATION: L ,rh .n b d .a n h 1 ,<ccara d k b _

reviewed A-< n ew lue,ar [n c/crs i <nd,~dedccr , 1 6

l i

// ,/"7 I

REVIEWER: / </, - (O /V__ .! \ . DATE: W ^ ~ / 'I' '

~

l HED/001 i

l l

E i

d it E D j . 3. - (o E 5" I P

'Tl O

'_ __ t _ _i V, x* . 5

_i_ '

I 'q' ,l 'fe L 3 i

~1 S"

C H M8 GE3

/. foes 9- t oca rr e % L CHANGES

~

~

A -(T Al P) En<.H Lt itrA % "M'6M A*0 f/6*~oce An o I//6 f*A Ge<0rps , drTwstM LfTTE/S ,

n .a u e e L.

3 (At &WT) EMM LiTTE A bb HisM An3 Yr* wsOr / H 0 */A f* A J*toits, dr7wefa'r if 77e*/J

+ ( dss-sose ), (nas-Losa), (Mt s-toso) (MIS-Joss) OfitTF L Accis I ( It'a = 3dae ), (#st Ja 3&), (##5* ac al) (,#ta =301} } gg w Lp ag L ,$

Sl5 6 S h " $4d6. A $ D l/b** gl0$

f* A LA0tl3 BfTVEfp LC Tri/1 LE TTYA $n ZF p'y" Mi& M MO'/q woo! AMO '/f" f0A nt4 06A L, Colen,of L A 3CL$ / tag,$

L f 77E A3 Black on wN sTF D Ack &AcvHD

PAGE: 1 of 2

' DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Displayed Auxiliary Feedwater Flow Indication HED NO: 9.2.007 Not Sufficiently Accurate CATEGORY: IIA-L STATUS: Disp. Closed DATE ORIGINATED: 5/8/84 ITEMS INVOLVED:

FI-4521 and FI-4522, Auxiliary Feedwater Pump 1, 2 Flow Indication PROBLEM DESCRIPTION:

The normal Auxiliary Feedwater flow indication on the main control console is less accurate than the flow indication on the Post Accident Monitoring (PAM) panel. The indication on the PAM panel is derived from a differential pressure sensor, while the flow indication on the main console is based on an ultrasonic flow device. The ultrasonic flow device is less accurate and occasionally results in indicated flow discrepancies between the two indications. The differential pressure based indication on the PAM panel is more accurate but inconvenient to use with Auxiliary Feedwater controls on the main console.

NUREG-0700 PARA:

6.5.1.1.A DATA SOURCE:

Operator comment during verification and validation.

SPECIFIC ERROR:

Decision errors based on inaccurate information in using ultrasonic flow indication.

Time delay in using PAM panel indication.

ASSESSMENT JUSTIFICATION:

.The problem associated with both Auxiliary Feed Pump flow indications are identical, and this HED can, therefore, be generically assessed. The inaccurate or unreliable flow indication and the resulting discrepancy between flow indications can potentially cause confusion. As directed by the Emergency Operating Procedure the operator, however, does not take control action on the basis of a single indication, and proper Auxiliary Feedwater System operation is more appropriately verified using steam generator levels and pressure. Auxiliary Feedpump operation can further be verified through pump speed and pump discharge pressure indications. While the

~

operator may benefit from a general indication of Auxiliary Feedwater flow, no operator actions are based on Jhe specific Auxiliary Feedwater' flow rate. The error potential of this HED by itself is relatively low. Taken in conjunction with other SFRCS and Auxiliary Feedwater System HEDs (see HED 5.1.006, 5.1.007, 5.1.009, 9.2.001, 9.2.005, 9.2.020, 9.2.033),- this HED has been conservatively categorized as IIA-L.

e DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO:.9.2.00' PAGE 2 of 2 DISPOSITION:

These instruments now have a more rigidly defined refueling channel calibration requirement and monthly channel check requirement which did not exist at the time of the operator interviews. This requirement will provide improved reliability and accuracy which fully addresses this HED. This problem will be further addressed in conjunction with the SFRCS Special Study. The ultrasonic flow devices will be replaced with differential pressure based instrumentation, which will also have an expanded range to correct the related portion of HED 5.1.006.

These modifications are to be implemented in the'next (5th) refueling outage.

SCHEDULE:

Refueling calibration and monthly channel check surveillance test procedures have been established. Corrective actions resulting from the SFRCS Special Study will be implemented within the next (5th) refueling outage.

INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMPLEMENTATION APPROVAL: c -f ~ DATE 9 4 8d 4

)

JRL/006/13 1

PAGE: 1 of 3 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: - Availability / Consistency of SFRCS Information HED NO: 9.2.018 CATEGORY: IIA-M STATUS: Int. Dis. App.

DATE ORIGINATED: 5/7/84 ITEMS INVOLVED:

Alara Location Description

. 8-6-1 SFRCS Full Trip 12-1-3 SFRCS Channel 1 DP Half / Full Trip

' 12-1-4 SFRCS Channel 2 DP Half / Full Trip 12-2-3 SFRCS Channel 1 SG Level Half / Full Trip 12-2 SFRCS Channel 2 SG Level Half / Full Trip 12-5-3 SFRCS Channel 1 Main Steam Low Pressure Trip 12-5-4 SFRCS Channe12 Main Steam Low I ressure Trip PROBLEM DESCRIPTION: '.

. The status of Steam and Feedwater Rupture Control System (SFRCS) logic including the SFRCS trip conditions is difficult to identify.

The existing SFRCS alarm arrangement provided annunciators for the status of each  !

SFRCS actuation channel, but did not clearly identify the condition which tripped j- the respective actuation channel. For example, a low steam generator pressure in 4

Steam Generator I would cause the annunciator labeled "SFRCS CH 1 MAIN STEAM LOW j- PRESSURE TRIP" and the annunciator labeled "SFRCS CH 2 MAIN STEAM LOW PRESSURE TRIP" to alarm, indicating that both SFRCS actuation channels had sensed the low pressure condition. However, the alarm window provides no indication of which steam generator ,

pressure condition caused the trip.

I An additional condition which complicates the operator's ability to identify SFRCS logic status is that the SFRCS alarms generally indicate either a half or a full

j. trip of either actuation channel. Each SFRCS actuation channel consists of two

~

l redundant sensing channels. If either sensing channel detects a tripped condition, the SFRCS actuation channel will register a half trip. A full trip occurs when both sensing channels register the condition. The annunciator "SFRCS CH 1 SG LEVEL HALF / FULL TRIP" would alara when either sensing channel of Actuation Channel 1 I registered a low steam generator level condition. SFRCS equipment is actuated primarily on a full SFRCS trip. Therefore, this alarm condition can lead to confusion

, as to whether equipment should or should not be actuated. An additional SFRCS annunciator labeled "SFRCS FULL TRIP" located on a separate annunciator panel can, however, be used to confirm that a full trip condition exists.

An additional problem with the SFRCS annunciators is that the SFRCS trips and the e associated alarms do not seal it, even though actuated equipment will remain in its

safety position. This can result in confusion when a momentary trip condition develops which causes a full SFRCS trip and actuates equipment prior to clearing.

During such an event, the operator might inadvertently acknowledge and reset an SFRCS related annunciator as he acknowledges and resets other Control Room annuncia-l tors that may exist at the time of the event. He could then be confused as to why

! SFRCS actuated equipment was in its safety condition without a corresponding indica-J tion of a trip.

W m ,m.-- .- --n. .-,,e--+,,e-,w, .-- ,_mw,w-,,,,--,-----,-n.--..--.e-- .,w,--,,,,-_--,

,-,r, ,,,,-a-s -e-v-, -w-, - - , w, ,,e,- ,.w--

DAV25-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED'NO:.9.2.018 PAGE 2 of 3 NUREC-0700 PARA:

6.1.1.1A DATA SOURCE:

. Operator comment during verification and validation.

SPECIFIC ERROR:'

' Decision errors due to lack of information. Confusion or delay in verification of system operation.

ASSESSMENT JUSTIFICATION:

This HED is associated with a general condition involving the annunciators listed, therefore, the assessment of this HED is generic.

While this condition has caused operator confusion on several-occasions, there have been no clearly identif'.able operator errors as a result of this condition. Tha error assessment category is, therefore, II.-

This condition can cause a delay in the verification of proper SFRCS actuation and

~could potentially interfere with the SFRCS function if the operator were to take incorrect actions as a result of this condition. The likelihood of the operator taking incorrect action on the basis of these indications alone, however,- is very

' low. Other control room indications such as steam generator level and pressure can help identify the cause of an SFRCS trip. Taken in conjunction with other HEDs associated with the SFRCS (see HED 9.2.001, 9.2.033, 9.2.042, 9.2.054), the significance of this HED has conservatively been set at IIA-M. .

DISPOSITION:

FCR 85-232 has modified the annunciators associated with the low steam generator pressure condition such that separate annunciators for a low pressure condition on Steam Generator 1 and/or 2 now exist. Clarification of the loop dependency of this condition is useful in that'the equipment actuated on a low steam generator pressure differs depending on the steam generator which first reaches the .aw pressure trip setpoint.

The annunciators associated with the other plant conditions which cause SFRCS trip l have been modified by FCR 85-232 to reflect SFRCS logic changes initiated during the current outage. The SFRCS Channel 1 (and 2) DP Half / Full Trip has been changed to SFRCS Channel 1 (and 2) High Level /DP Half / Full Trip. Similarly, SFRCS Channel 1 (and 2) Steam Generator Level Half / Full Trip has been changed to SFRCS Channel 1 l (and 2) Low Level / Reactor Coolant Pump Half / Full Trip. These annunciator changes group the plant conditions which result in the same type of SFRCS actuation into a common annunciator. Therefore, the operator can easily determine the expected SFRCS response on the. basis of a single set of annunciators. Although the annunciators will not clearly indicate which of the conditions caused the trip, the operator's task of identifying proper SFRCS actuation can be completed since the expected response is the same for either condition. While the loop dependency of other

DAVIS-BESSE HUMAM EWGINEERING DISCREPANCY (HED) REPORT HED NO:,9.2.018 PACE 3 of 3 trip conditions such as low steam generator level or steam generator to feedwater differential pressure have not been separated, equipment actuation on these conditions does not depend on where the condition occurs.

An additional modification to the "SFRCS Full Trip" ancunciator completed by FCR 85-167 now causes that annunciator to seal in with any full SFRCS trip and requires the operator to press a separate dedicated reset button on the main console to clear this annunciator.

For additional details on the operators' use of these annunciators in the verification of proper SFRCS actuation as directed by the Emergency Operating Procedure, see HED 9.2.001.

These changes have resolved the problems associated with the SFRCS annunciator configuration. This configuration will be further studied as part of the SFRCS Special Study, and additionsl changes to the SFRCS annunciators should be completed in the next (5th) Refueling Outage.

These modifications produce no new HEDs (see the attached (erification of Design Improvement form).

SCHEDULE:

The modifications discusses in the Dispositions section associated with FCR 85-232, ,

and 85-167 have been completed. Additional changes resulting from the SFRCS Special Studies will be implemented in the next (5th) refueling outage. .

3 m ERIy/FINALDISPOSITIONAPPROVAL: h ad h*wr> t DATE UM 8d FINAL IMPLEMENTATION APPROVAL: DATE JRL/006/14

~

n-HED No.

'29

. Page of 2 l'

HUMAN FACTORS VERIFICATION OF DESIGN IMPROVI. MENT BRIEF DESCRIPTION: p d r '. ; / r N 'r/ w /(J r e ce y e ,$ [/dj r s m 2 l7 k - k ,rovsrct4lyy9 TYPE OF VERIFICATION: Initial Interim y' Implementation BASIS OF REVIEW:

I Documentation Review (specify document number)

V FCR Request 75 Ic.'7 sd PS ' 3p FCR Concept Design FCR Detailed Design Maintenance Work Order Procedure Other i Hardware Assessment AFFECTED COMPONENTS:

SPRc5 fuif Tri,p An,,,,,c,a Q 56 / LouJ L&v&L H4LF/FOLL 7/CiP Muuve ?A 7cQ 667 2 Low LEYEl +MLf/fULA S? v * ' A !"

THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

Yes No NJA A Comparison with NUREG-0700 guidelines X B. Comparison with T/A I&C reqts v C. Operations review and comments v D. Walk-throughs N' E. Other (specify) K

HED So.

U u Page 2 of 2 TE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT TE DESIGN IMPROVEMENT:

Will fully satisfy the human factors concerns in the ED.

X Will partially satisfy the human factors concerns in the HED.

Will not satisfy the human factors concerns in the HED.

JUSTIFICATION: b .e 16/ brit l v<[(d4-nQW.M72u /dC!/ i

}l??tfrC W $ce nf tir c S dhrY~'<j fc flk?~ c. -Y t +'s , >* l k ' sr. 6FRa'5 scJu L "A b d A,a/'stra! w 4eu.ta % Sn7es 5%4, cci// inJAknh Nb%

6tf/h'hdy c dri IlwCJ Ghet DCZ$k ha f.

TE DESIGN IMPROVEMENT ) (WILL NOT) RESULT IN ANY NEW EDs. (IDENTIFY NEW EDs IF APPROPRIATE.)

JUSTIFICATION: /'U /'(< 6 J 970U7tb C/6/ib to GY N k //1 i? 1GNC)t (tdf ke [ ]y / cbx b r9 Ge< <f L G: sty a I t*1 cW 1 > /<*03 0 e N A Y ., b <- r" 3

• v

.hc!It,S ,

c f0y e'GAn ic&sckhe a cf ak 0 3phanc,

,7, . ,

)!.I'ffr-c7ec c:<<$cSc~m W ? in ;lEdm14<n t.2 v 4$

• @ ( 4[r.br.J '

22 t, k >v i

_I FURTHER HUMAN FACTORS REVIEW (IS) REQUIRED.

JUSTIFICATION: fu 5 recield c 6fkCS M/7urm a &*

nrects us// kr a dduwd A c/L S6eeS h4 U

% $ YD b ir/c M C f Y Y h h<7k ci W J'f S &$<

REVIEWER: M ' DATE: /

HED/001 n

d

PAGE: 1 of 3 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (NED) REPORT TITLE: SFAS Incident Isolation Component HED NO: 9.2.020 Arrangements are Inconsistent CATEGORY: IIA-M STATUS: Int. Dis. App.

DATE ORIGINATED: 5/8/84 ITEMS INVOLVED:

Panel C-5717: SFAS Isolation Panel RCP Controls / Displays in SFAS Incident Level 2 Grouping HIS-MU59C, RCP 1-1 Seal Ret Isol Viv HIS-MU59D, RCP l-2 Seal Ret Isol Viv HIS-MU59A, RCP 2-1 Seal Ret Isol Viv HIS-MU59B, RCP 2-2 Seal Ret Isol V1v HIS-MU66C, RCP 1-1 Seal Inj Isol Vlv HIS-MU668, RCP 2-2 Seal Inj Isol Viv HIS-MU33, RC Norm MU Isol Viv HIS-MU66D, RCP 1-2 Seal Inj Isol Viv HIS-MU66A, RCP 2-1 Seal Inj Isol Viv HIS-MU38, RCP Seal Ret Isol Viv AFW Controls / Displays Located in SFAS Incident Level 4 Grouping HIS-106A, MS Line #1 to AFPT #1 Isol Viv HIS-106E, MS Line #2 to AFPT #1 Isol Viv HIS-608A, SG 1 AFW Isol Viv l HIS-608B, SG 1 AFW Isol Viv HIS-608E, Open Circuit Half Trip Reset HIS-107A, MS Line #2 to AFPT #2 Isol V1v HIS-107E, MS Lir.e #1 to AFPT #2 Isol Vlv HIS-599A, SG 2 AFW Isol Vlv HIS-599B, SG 2 AFW Isol Viv HIS-599E, Open Circuit Half Trip Reset PROBLEM DESCRIPTION:

Components listed are (1) Reactor Coolant Pump (RCP) valve controls and displays on the Safety Features Actuation System (SFAS) panel which receive SFAS Level 3 signals, but are physically located among similar components grouped as Level 2, and (2)

Auxiliary Feedwater (AFW) controls and displays physically grouped with SFAS Level 4 components, but which receive no Level 4 SFAS actuation signal.

RCP controls / displays in Level 2, but which receive Level 3 actuation signal,

! are each clearly marked with " LEVEL 3 > 400" on the SAM (Safety Features l Actuation Monitor) lights associated with each component. Upon SFAS Level 2 actuation, all components in the Level 2 grouping should have lit SAM lights, as the prnel was originally designed. However, RCP components listed were changed to actuate at Level 3 in a prior outage, but were not moved. The

" yellow board" concept to ensure proper SFAS actuation, therefore, does not work.now because these ten components do not actuate until Level 3. Time to verify proper SFAS actuation and probability for operator error are, therefore, increased.

l i

i I

I

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (NED) REPORT HED NO: 9.2.020 PAGE 2 of 3 AFW controls in Level 4 do not receive Level 4 actu.itior. signals. They, therefore,-

cause the operator more difficulty in verifying proper actuation of Level 4 actuation because not all SAM lights in the Level 4 component grouping will light up upon Level 4 SFAS actuation. Although SAM light components are physically located adjacent to six of the ten AFW components, and Cutler-Hammer hand indicating switches are next to two others, all eight of these adjacent components are spares and not connected to anything. Having these similar, but disconnected, components adjacent to the AFW controls complicates the operator's task in verifying proper SFAS Level 4 actuation because the components look similar to Level 4 actuated components around them.

NUREG-0700 PARA:

6.8.1.1A 6.8.1.1B 6.8.1.1C l 6.8.2.1 6.9.1.1C 6.9.2.1A DATA SOURCE:

Verification and validation i SPECIFIC ERROR:

i l Additional time to verify proper SFAS actuation for Level 2 and Level 4, and increased probability of operator error in properly verifying.

ASSESSMENT JUSTIFICATION:

The problems associated with the listed components can be treated in two generic groups. The Reactor Coolant Pump controls and displays in SFAS Incident Level 2 and the Auxiliary Feedwater controls and displays located in SFAS Incident Level 4.

l The inconsistent grouping of controls and displays of SFAS actuated equipment could l

lead to incomplete or inaccurate verification of SFAS actuation. Controls

! associated with these groupings are isolation valves, and the function of containment isolation on SFAS actuation is completed by redundant isolation valves

( on most process systems. The consequences of incomplete or improper verification I

are, therefore, relatively minor.

No other significant HEDs exist with respect to the Reactor Coolant Pump controls and d! splays, therefore, this conditions has been categorized as IIA-L. Other j significant HEDs exist with respect to the Auxiliary Feedwater System and the SFRCS t (see MED 9.2.001, 9.2.033, 9.2.054), however, and this condition has conservatively categorized as IIA-M.

o l

DAVIS-BESSE HUMAN ENGlNEERING DISCREPANCY (HED) REPORT RED NO:,9.2.020 PAGE 3 of 3 DISPOSITION:,

Various options for a relabeling enhancement are currently being evaluated for installation prior to restart. The modification is intended to clearly indicated those components which are improperly placed in their respective groups. The modification will also include the removal of spare controls in the SFAS Incident Level 4 grouping next to the Auxiliary Feedwater controls. These enhancements will substantially improve the existing condition.

Complete resolution of the Reactor Coolant Pump controls and displays grouped in SFAS Incident Level 2 will require their relocation to the Incident Level 3 group.

Specific details of this modification will be developed as a part of the Displays and Controls Special Studies to be conducted after restart.

Final resolution of the Auxiliary Feedwater controls and displays grouped in SFAS Incident Level 4 will be identified in conjunction with the SFRCS Special Study and implemented in the next (5th) refueling outage. See HED 9.2.001 for an additional discussion on the impact of the existing arrangement of SFRCS and Auxiliary Feedwater related controls and displays on the use of the Emergency Operating Procedure.

SCHEDULE:

The labeling changes and modifications for removal of spare switches will be finalized and implemented prior to restart. The specific changes associated with removing the Reactor Coolant Pump controls and displays will be developed in

! conjunction with the Displays and Controls Special Studies to begin following restart. Additional changes to the Auxiliary Feedwater Components will be identified in conjunction with the SFRCS Special Study and implemented in the next (5th) refueling outage. , ,

INTERIM FINAL DISPOSITION APPROVAL: _ a hn DATE k d' 85 FINAL IMPLEMENTATION APPROVAL: DATE l

l l

l

, JRL/006/23 1

1 I

l l

t i

• t PAGE 1 of 2 LAVIS-LESSE FEMAN ENGINEERING DISCREPANCY (lied) PEFORT TITLE: Potential For Misle'ading Feedwater Flow HED NO: C.?.028 Indication CATEGORY: IB-L STATUS: C1cred DATE ORIGINATED: 5/7/84 ITElf_S ITVOI.VFD:

"FR SP4A, Loop 2 Pain Feedwater Flow Recorder Pare.1 C5712 FR SP4B, Loop 1 Main Feedwater Flow Recorder Panel C5712 ,

PR03LEP DFECPTPTION:

The Main Feedwater Flow Recorder for each loop can be fed a signal from either the corresponding wide range sensor or low range startup renror, depending upon the position of the Fein Feedwater Block Valve. The block vcive position interlock has occasterelly failed, resulting in a low (approximately 1.0 mlb/hr) flow indicatien and flow control signal to the Integrated Control Systen (ICS) from the startup flow l

element, when actual flow was normal for power operations (approximately 6.5 mlb/hr).

.This results in an incorrect interpretation of low flow and an incorrect response by the l  !CS to increase feedwater flow, resulting in.an overfeed conditice and a reactor trip er Icw primary system pressure or a Steam and Feedwater Rupture Control System (SFRCS) trip cv high steam generator level. The operator could be misled by this incorrect indication of feedwater flow and also take incorrect action.

NUREG-0700 PAP _A:

6.5.1.1B, 6.5.1.1E(1) l DATA SOURCE:

. Operator comm'ent during validation and verification s

SPECIFIC ERROR:

The automatic control system (ICS) has taken incorrect action and has cat a reactor trip. Operator action has been taken and in one case prevented a teactor trip. In erether case, a reactor trip occurred due to the difficulty in achievirg proper feedwater flow.

ASSESSMENT JUSTIFICATION:

The problem associated with these indicators is identical; therefore this HED may be assessed generically. Since the identified errors have occurred, the error ansessment category is I. The feedwater centrols and indications have no specific safety function, but can lead to a reactor trip, thus challenging safety j systems. The significance er.tegorization is, therefore, B-L.

DISPOSITION:

i j FCR 85-227 hen been implemented to remove the interlocks which transfer the irdicated l flow signals frcm the vide range sensors to the startup sencoro. The flow recorder

! is, therefore, always indicating vide range flew, which is sufficiently accurate for l the ICS and the operator to assure proper fee /ve.ter flow conditions even during icw l

l I

I.

DAVIS-BESSE HU.A!: erg!NEEPIFG DISCREPANCY (FED) REP 0t!

HE9 50: 9.2.0;S PAGE 2 of 2 feedvater fIrv'sterrup conditions. No physical ecdifications have been made to

. Certrel Reen hardware and deleting the use of the stortup flow indication doce not detract from the operator's ability to evaluate feedwate* flew ccnditions since the wide range indication is sufficiently accurate. Therefore, no new HEDs have been introduced by this modification (cce straebed Verification of Design Improvement form).

This HED has been completely add *essed by FCR 85-227.

SCFEDL'LE:

Complete.

INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMPLEMENTATION APPROVAL: M.;

r e DATE 4 ~/M~/6 J'

JRL/006/1

HED No. 3.2.2.8 HUMAN FACTORS VERIFICATION OF DESICN IMPROVEMENT BRIEF DESCRIPTION: 7eTN T s AL. Fo A v. is LEM:> s 46 F4GbwAh FLotA nelDiCATl oN TYPE OF VERIFICATION: Initial  !

Interia I X Implementation BASIS OF REVIEW:

l X Documentation Review (specify document number)

FCR Request 9

FCR Concept Design I FCR Detailed Design RR 3 f - 2 7. ~ 7 Maintenance Work Order Procedure Other

, Hardware Assessmett 1

AFFECTED COMPONENTS: I fRSP 4-A y Loo p 2. Ma.in F<elwa(w F(na Ram Aa,?Q csgsz. l l

FF.SP 4 -B , Loo e I (Oc.:n F.elw de Gloe bedes) ihnel eserl'2.

THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

Yes No

~ N/A A. Comparison with NUREG-0700 guidelines v B. Comparison with T/A I4C requests V C. Operatione review and comments V" D. Walk-throughs v E. Other (specify) /

THE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT THE DESIGN IMPROVEMENT:

/ Will fully satisfy the human factors concerned in the HED. '

Will partially satisfy the human' factors concerned in the BED.

Will not satisfy the human factors concerned in the HED.

JUSTIFICATION: kemayal of 1Aketlocks ser Fc R 36-7.'7'1 resded lh fecordess dshow#nn w gda. rer e Mew Mudy (dimich i a v i w oess Abi.Ib d

5 b wo h{ca.9 L 2_ u d b e, h . .

a f.WcMeoOSb , disaf"r oreblem S M ed in N&D Elienin dtd . @ M ew4

, Comkvmed 4bak Mde(W e Mdic. b d qvMc.1n U

GCC Mu & 946 =

& L f 'h.D(W1 &Y g THE DESIGN IMPROVENINT DIEtt!"(WILL NOT) RESULT IN ANY NEW RDs. (IDENTIFY NEW BEDS IF APPROPRIATE.)

kGA. M h c w - k e c. it. dW b JUSTIFICATION: h,o 1wr254Me4I neo d dkoesihon -

1 0 V FURTRER HUMAN FACTORS REVIEW (IS NOT) REQUIRED.

l JUSTIFICATION: Osmeyahrns M MA (MM

%(A. do m.e we-n feo a i

p

• g 1

(_.,/  !

PAGE: 1 of 2 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Reactor Coolant System Temperature HED NO: _9.2.030 Display Visibility CATEGORY: _ IIA-L STATUS: closed DATE ORIGINATED: 5/8/84 ITEMS INVOLVED:

Panel 5710: TI-RC4, Unit RC Tc TRS-RC3, RC Th Panel 5718: TI-RC4Bl. RC Tc NR Loop 1 TI-RC4A1, RC Tc NR Loop 2 ,

TI-RC3B1, RC Tc WR Loop 1 TI-RC3A1, RC Tc WR Loop 2 TI-RC4B2, RC Th NR Loop 1 TI-RC4A2, RC Th NR Loop 2 PROBLEM DESCRIPTION:

The problem is that whenever Tc and Th are outside of the 520' - 620'F range, the operator has no displays available at the C-5709 console to compare Th and Tc.

At the conscle (Panel C-5709), the only displays the operator has to work with are narrow range Tc, narrow range Th, and WT, all of which are operable in the range 520* - 620*F. No wide range displays of Th or Tc are available on the console.

Vertical panel C-5718 has wide range Tc, as well as narrow range Th and Tc, but does not have wide range Th.

T o PAM pane 1 has wide and narrow range indications for both Th and Tc.

Therefore, the only place in the Control Room where hard-wired wide range displays of both Th and Tc exist is the PAM panel. The PAM panel is approximately 15 feet to the lef t of the operator position at console C-5709, where the AFW controls are.

The operator cannot read the PAM displays from the console and must go over to the PAM panel to compare Th and Tc.

NUREG-0700 PARA:

6.8.1.1A 6.8.1.15 6.8.1.1C 6.8.1.2 1 6.8.2.1 DATA SOURCE:

)

Verification and validation

DAVIS-BESSE HUMAN ENGINEERZEG DISCREPANCY (HED) REPORT HED N0:.9.2.030 PAGE 2 of 2 SPECIFIC ERROR:

Display reading errors or timing delays in comparing Tc and Th.

ASSESSMENT JUSTIFICATION:

Tnis HED concerns a problem generically associated with the components listed and is therefore assessed generically. Comparison of Tc and Th is required in four situations: (1) verify primary to secondary heat transfer, (2) check for natural circulation, (3) check for inadequate care cooling, and (4) check for excessive heat transfer (overcooling).

The potential for error occurs whenever the operator is required to compare Tc to Th and Th is not within the range of 520' - 620*F. Whenever this situation occurs, the operator must either use the PAM panel displays or the SPDS to compare Th and Tc, None of these situations requires a time critical response that would be compromised due to the time required to use one of these positions in the Control Room to compare Th and Tc.

Although other significant HEDs exist with respect to the PAM panel indications (see HED 5.L.029, 9.8.007) this HED is not specifically affected by PAM panel indicator inaccuracies. The potential for operator error as a result of this problem is low and this HED has been categorized as III.

DISPOSITION:

Under normal post trip conditions, narrow range Tc and Th instruments will be on scale and adequate instrumentation exists on both the front console and vertical panel to verify natural circulation.

Because the tasks involving comparison of Tc and Th are not sufficiently time critical to preclude the operator obtaining Tc and Th from one of the locations in the Control Room where appropriate displays exist, no change to physically install a wide range Tc or Th'on the console is necessary.

Schedule:

Complete l

i INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMPLEMENTATION APPROVAL: M n DATE Y ~Mid l

JRL/006/21

PAGE: 1 of 3 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Spatial Relationship of Auxiliary HED NO: 9.2.033 Feedwater Components CATEGORY: IIA-M STATUS: Int. Dis. App.

DATE ORIGINATED: 5/4/84 ITEMS INVOLVED:

(see attached list)

PROBLEM DESCRIPTION:

The displays and indications associated with the AFW System are not centrally located, which complicates the task of verifying proper system operation. This HED is essentially the same as HED 9.2.001, applying to a subset of those components actuated by SFRCS.

NUREG-0700 PARA:

6.8.1.1B, 6.8.1.3A DATA SOURC_E:

Operator comments during verification and validation of emergency task sequences.

SPECIFIC ERROR:

Control substitution errors, display substitution errors, time delays in operating the AFW System, using displays or actuating controls out of sequence.

ASSESSMENT JUSTIFICATION:

This is a generic problem associated with all Auxiliary Feedwater System displays and controls, therefore, this HED will be generically essessed. Although the distribution of the Auxiliary Feedwater System controls and displays complica.te the task of verifying proper system operation, the necessary information is availab'e in the control room and proper system operation is not dependent on operator verification. While the components associated with Auxiliary Feedwater System operation are not centrally located, proper system operation can be verified without specifically verifying that each associated component has been properly actuated by SFRCS. Proper AFW System operation can be verified using steam generator level and pressure indications and additionally by monitoring primary system indications including pressurizer level and RCS pressure. When considered by itself the likelihood of improper operator action as a result of this specific problem is very low. Considering other HEDs associated with the SFRCS and AFW System (see HED 5.1.006, 5.1.007, 5.1.009, 9.2.001, 9.2.005, 9.2.007, 9.2.020, 9.2.054), this HED has been conservatively categorized as IIA-M.

l l

)

DAVIS-BESSE HUMAN ENOINEERING DISCREPANCY (HED) REPORT HED NO:.9.2.033 PAGE 2 of 3 DISPOSITION:

The controls and displays on vertical panel C-5717 are hand indicating switches used primarily to verify proper automatic SFRCS actuation of specific components.

Once proper SFRCS actuation of these components has been verified, further monitoring of the indications on C-5717 is not required unless an additional initiating event changes SFRCS actuation, in which case the Emergency Operating Procedure directs the operator to re-verify proper component actuation. Except for verification of specific component actuation, the operator uses the more centrally located controls and indications on the main console (panels C-5706 and C-5709) for continued monitoring of AFW System operation.

The disposition to HED 9.2.020, which will more clearly group the AFW related components on panel C-5717, will improve the ability of the operator to distinguish tha AFW controls / indications now nested in the SFAS Level 4 Incident group from similar and proximate controls. This will improve the operator's ability to properly identify the AFW components on C-5717, thereby mitigating the probability of error associated with this HED.

A major effort to centralize and improve the arrangement of SFRCS and AFW related components has been initiated in conjunction with the SFRCS Special Study. The implementation of the corrective actions identified are to be made duri4w the next (5th) refueling outage. Additional discussions on the impact of the existL g 'SFRCS and AFW control / display configuration on the use of the Emergency Operating Procedure is provided in HED 9.2.001.

SCHEDULE:

Corrective actions for this HED are to be developed in conjunction with the SFRCS Special Study and implemented in the next4(5th) refueling outage.

IINTERIM INAL DISPOSITION APPROVAL: bR ih u,~ DATE N M"Id C

FINAL IMPLEMENTATION APPROVAL: DATE

)

r DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED N0:.9.2.033 PAGE 3 of 3 COMPONENT LIST FOR HED 9.2.033 Danel No. Instrument No. Description C5709 HIS-3871 Auxiliary Feed Pump No. 2 Discharge to Steam Generator No. 1 Isolation Valve HIS-3872 Auxiliary Feed Pump No. 2 Discharge to Steam Generator No. 2 Isolation Valve HIS-5889A Auxiliary Feed Pump No. 1 Steam Inlet Valve HIS-5889B Auxiliary Feed Pump No. 2 Steam Inlet Valve PI-505 Auxiliary Feed Pump 1 Discharge Pressure PI-509 Auxiliary Feed Pump 2 Discharge Pressure FI-4521 Auxiliary Feed Pump 1 Feedwater Flow FI-4522 Auxiliary Feed Pump 2 Feedwater Flow SI-815 Auxiliary Feed Pump Turbine No. 1 Speed SI-816 Auxiliary Feed Pump Turbine No. 2 Speed C5799 FI-4630 PAM Panel Auxiliary Feedwater Flow to Steam Generator 1 C5798 FI-4631 PAM Panel Auxiliary Feedwater Flow to Steam Generator 2 C5706 HIS-3869 Auxiliary Feed Pump No. 1 Discharge to Steam Generator No. 2 Isolation Valve HIS-3870 Auxiliary Feed Pump No.1 Discharge to Steam Generator No. 1 Isolation Valve HIS-608A Steam Generator 1 Auxiliary Feedwater Isolation Valve HIS-608B Steam Generator 1 Auxiliary Feedwater Isolation Valve HIS-599A Steam Generator 2 Auxiliary Feedwater Isolation Valve HIS-599B Steam Generator 2 Auxiliary Feedwater Isolation Valve HIS-106A Main Steam Line No. I to Auxiliary Feed Pump Turbine No. 1 Isolation Valve HIS-106E Main Steam Line No. 2 to Auxiliary Feed Pump Turbine No. 1 Isolation Valve -

HIS-107A Main Steam Line No. 2 to Auxiliary Feed Pump Turbine No. 2 Isolation Valve HIS-107E Main Steam Line No. I to Auxiliary Feed Pump Turbine No. 2 Isolation Valve.

JRL/006/20

PAGE: 1 of 2 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Steam Generator Level Inputs to SFRCS and HED NO: 9.2.042 Control Room Indications Differ CATECORY: IA-L STATUS: Int. Dic. App.

DATE ORIGINATED: 5/1C/84 ITEMS INVOLVED:

Steam Generator level inputs to Steam and Feedwater Rupture Control System (SFRCS)

Steam Generator level inputs to Integrated Control System (ICS)

Control Room Steam Generator level indications LI-SP9B1 and LI-SP9Al PROBLEM DESCRIPTION:

Steam Generator level inputs feeding the SFRCS differ from those feeding llc ICS and the Control Room startup level indications. The instrument strings contain different types of components and are calibrated differently. Consequently, the indicated levels do not always agree. Operators have reported that this condition has led to

- SFRCS actuation on low steam generator level even though the Control Room meter indicated an acceptable level.

NUREG-0700 PARA:

6.5.1.1A and 6.5.1.1.E (1)

DATA SOURCE:

Operator comment during verification and validation.

SPECIFIC ERROR:

Interpretation errors, errors of omission (failure to correct decreasing steam generator level).

ASSESSMENT JUSTIFICATION:

Since such events have occurred, the error assessment category of this HED is I.

Although the instrument string indication differences can lead to an unnecessary SFRCS trip, the instrument strings are sufficiently accurate to assure proper SFRCS operation and Auxiliary Feedwater System level control such that no safety function is compromised. The significance classification of this HED is A-L.

i l

i L_

DAVIS-BESSE HUMAN ENGINEERING DfSCREPANCY (HED) REPORT HED NO:.9.2.042 PAGE 2 of 2 DISPOSITION:

FCR 85-201 has been implemented to modify the ICS low steam generator level limit.

The modification will increase the limit by 5 inches to a nominal 40 inches, thus providing an additional margin to the SFRCS low level trip setpoint. This modifica-tion itself should eliminate '2nnecessary SFRCS trips and does not create any new HEDs since only a control setpoint is affected.

An additional corrective action is to bc considered in the.SFRCS Special Study. The inclusion of a steam generator level indication from the SFRCS level input strings is being considered. This would provide the operator with a direct indication of the level signal feeding SFRCS.

SCHEDULE:

FCR 85-201 has been completed. Additional corrective action developed in conjunction with the SFRCS special study will be implemented in the next (5th) refueling outage.

A v0 /' ~

/FINALDISPOSITIONAPPROVAL: M h t4 4. /U4ht w DATE bh 'd FINAL IMPLEMENTATION APPROVAL: DATE JRL/006/15 l

l l

)

PAGE: 1 of 2

, DAVIS-BESSE EUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: SERCS Block For Startup Feedwater Valves HED NO: 9.2.043 Located Outside of Control Room CATEGORY: IIA-M STATUS: closed DATE ORIGINATED: 5/10/84 ITEMS INVOLVED:

Steam and Feedwater Rupture Control System (SFRCS) Block Switches for Startup Feedwater Valves. HIS-SP7AB, HIS-SP7BB, HIS-SP7CB, HIS-SP7DB PROBLEM DESCRIPTION:

In a total loss of feedwater event, the Control Room operator can use the startup feed pump to feed the steam generator through the normal feedwater lines by opening

.the startup feedwater valves. The startup feedwater valves are closed by SFRCS on a loss of feedwater and must be blocked to open. The SFRCS block switches are located outside the Control Room on s back wall of the Cabinet Room. Operation of these controls, therefore, requires the operator to leave the Control Room for a short period of time.

NUREG-0700 PARA:

6.1.1.1B 6.1.1.2A 6.8.1.1A DATA SOURCE:

Operator comment during verification and validation.

SPECIFIC ERROR:

Errors of task omission, temporal errors induced by task time demands, work overload errors.

ASSESSMENT JUSTIFICATION:

Specific errors in the use of these controls has not occurred. On June 9, 1985, the Control Room operator was required to leave the Control Room area to manipulate these controls, and the time away from the Control Room detained him from attending to other plant problems.

The error assessment category for this HED is II since no specific errors can be directly attributed to this condition.

A failure to properly actuate these controls would affect the safety function of supplying feedwater to the steam generators. The significance category of this HED is, therefore, A-M.

- DAVIS-BESSE HUMAN EEGINEERING DISCREPANC'l (HED) REPORT EED NO: ,9.2.043 FACE 2 of 2 DISPOSITION:

FCR 85-189 has moved the SFRCS block switches for the startup feedwater valves to the main control panel to support other tasks, as required. These modifications address this concern entirely.

The movement of the SFRCS block switches for the startup feedwater control valves to the main console created no new HEDs (see attached Verification of Design Improve-ment form). The block switches were appropriately grouped with their corresponding startup feedwater control valve controls.

SCHEDULE:

Complete.

INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMPLEMENTATION APPROVAL: s ec /+>r DATE N '/#U S e

4 JRL/006/16

HED No.

. Page 1 of 2 HUMAN FACTORS VERIFICATION OF DESIGN IMPROVEMENT BRIEF DESCRIPTION: 6 IIC C 6 h /<-e k hfJ.r -up h d +>:04) G fs'f \ kt k GJS [orcif ec/ ht< h,ike (! > rbe fic At TYPE OF VERIFICATION: Initial Interim V Implementation BASIS OF REVIEW:

Documentation Revies (specify document number)

FCR Request FCR Concept Design FCR Detailed Design Maintenance Work Order Procedure Other

-N Hardware Assessment s

AFFECTED COMPONENTS:

firs S Prik6 , pr5 SP788, His 5 P 7C B , !+IS SP'IDd NRS 6046, NRS L o e6, tJR5 Goca, r!Ks' ?.cb6 THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

Yes No N/A A. Comparison with NUREG-0700 guidelines y B. Comparison with T/A I&C reqts V C. Operations review and comments 4, D. Walk-throughs V E. Other (specify) M

ED No. '{ h 'l 5 Page 2 of 2 TE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT THE DESIaN IMPROVEMENT:

I Will fully satisfy the human factors concerns ir. the HED.

Will partially satisfy the human factors conc 0rns in the HED.

. Will not satisfy the human factors concerne. in the HED.

JUSTIFICATION: Ntc ber ( 6bMd8 d [cC_k Sieit !(II 3 /

$ LhuD 2rYC6 41' t.,P WS JCE ^ ?.CCA l'r^- X0 cf b M ma.d e :_ /49 Ytc N?d.e n ('CDr be f c (W - 7 </

4 fuIf Nas (!!5$ll-f rin a 4'OSek G\ (IAJY 0 f JUE

^

vis, h,yh h o afa/<J sR2bs wn fre/s n<<f.4&d'/c- -

l l

l THE DESIGN IMPROVEMENT ( ) (WILL NOT) RESULT IN ANY NEW EDs. (IDENTIFY  !

NEW EDs IF APPROPRIATE.

JUSTIFICATION: ku C c71cf 2..rA -  !# e x. /Nb

^(LL lE L .'aJC C e cl.

' dh$pk MWh)w l I

OCht$ tA$b l 'i.YES- O?OC chen WLb Y.: 0 D'c4 s 6licl vu ) ciank 0, Yv., n,c h lonw ,

J u wr .

L ~ %;4s'J wss,,', i plawud, FURTER HUMAN FACTORS REVIEW (IS NOT) REQUIRED.

JUSTIFICATION: Me // C P e, .{mcM (&s / nW /rl ereb (

i Qrmoh1 F tl j

HED/001

_ ,d, .

PAGE: 1 of 2 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Decay Heat Pump /HPI Pump Mimic HED NO: 9.2.047 Relationships Are Unclear CATEGORY: IA-M STATUS: Disp. Closed DATE ORIGINATED:

ITEMS INVOLVED:

Panel C-5716: HIS-DH6A, HIS-DH6B, Decay Heat Pump Control HIS-1523. HIS-1524,-HPI Pump Control Mimics PROBLEM DESCRIPTION:

4 The decay heat pump control is located directly above the high pressure injection (HPI) pump control on vertical panel C-5716. The decay heat mimic is orange and the HPI mimic is red. Each switch has indicator lights above and component label below.

Because of the proximity of the two switches, the similarity in color of the mimics for HPI and decay heat, and the fact that the component's label is somewhat obscured by the control switch, operators have inadvertently activatea the decay heat pump instead of the HPI pump.

NUREG-0700 PARA:

6.8.1.3A 6.8.1.3B DATA SOURCE:

Operator comment during validation and verification.

SPECIFIC ERROR:

. Control substitution. error. Operator activates decay heat pump while intending to activate HPI pump.

ASSESSMENT JUSTIFICATION:

If the HPI pump is started in a post-trip situation, the operator confirms activation from loop flows, pump amps, and related indications. If operator activates decay heat pump instead of HPI and fails to verify activation, degradation of ebility to manage the transient results until the operator realizes HPI has not been activated. Probability of error is I because error has occurred. Safety significance is A-M.

DISPOSITION:

This HED will be resolved by labeling and mimic modifications (see attached drawings). Component labels 'will be moved to the lef t side of each switch to improve label visibility. Modifications to the mimic to clarify proper association of the switch with the proper system mimic will be made. The mimic and label modifications will be implemented prior to restart. No new HEDs have been created by this change (see attached Verification of Design Improvement form).

DAVIS-BESSE Hl' MAN ENGINEERING DISCREPANCY (HED) REPORT HED NO:'9.2.047 PAGE 2 of 2 SCHEDULE:

This will be complete prior to restart.

INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMPLEMENTATION APPROVAL: ^7 n$ S/;nm. DATE

1. Y (a Y-/ ~

I JRL/006/22 l

I

a HED No. . . I Y

. Page 1 of 2 HUMAN FACTORS VERIFICATION OF DESIGN IMPROVEMENT BRIEF DESCRIPTION: $+ e . -t L!c et R .n a / v r u iT-1.1, ,, /1.). ,,, , <

. o . ,

h a Y \ 5 fuEJ a Lc u o ,C b cL y i

TYPE OF VERIFICATION: ,( Initial Interim Implementation BASIS OF REVIEW:

)( Documentation Review (specify document number)

_ FCR Request FCR Concept Design FCR Detailed Design Maintenance Work Order Procedure f Other 6lickeb b mfmic.enbRcr+ M Hardware Assessment AFFECTED COMPONENTS:

dl$ - Dd foA y De c o 4d Umf bc HS S - \ 6 *2.~f Mr FGmf hc

\ t(_5 f f(Yi THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

Yes No N/A A. Comparison with NUREG-0700 guidelines y B. Comparison with T/A I&C reqts X C. Operations review and comr.ents y D. Walk-throughs Y E. Other (specify) Rup3e [ ddck y

.g9 y 9, .,' }

e. of 2 THE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT THE DESIGN IMPROVEMENT:

I Will fully satisfy the human factors concerns in the HED.

Will partially satisfy the human factors concerns in the HED.

. Will not satisfy the human factors concerns in the HED.

JUSTIFICATION: Irt e /c ,r4 c [4'[/b; e ! VI. (et 4.nusic eII d '1

'Cet ecfif Yb 8k r>ftb u.7ll A / Gun ld d bu2 3 Lib ene 2 ns 11f-d:d >< ' f6 web /kaSn s ,, d' < b ,s

/n t' < cf k' i 4$2e'cn1  % 4o bif-nc.cn114 W u'd1 .1 e U Y'f i J tL< j'? c~t a b cf.

THE DESIGN IMPROVEMENT ( ) (WILL NOT) RESULT IN ANY NEW HEDs. (IDENTIFY NEW HEDs IF APPROPRIATE.)

JUSTIFICATION: [c ec[ [ttue A c +7s PTi /1C / O -f Ldd /E_

irecyN7 i

k .in 'fkr he% pro u #

FURTHER HUMAN FACTORS REVIEW (IS) ( ) REQUIRED.

JUSTIFICATION: b/b emi hW 4% o -

CukGs ccm$ S$LCLclk AsC C5L!e mv16-n ChrS l'eu7 eo) .

a

//

HED/001 t

i

/

I i

HED 9D-+7 Ac ruh L S I 7. c Ofl l~l I

i -

i WPI '

..? .-

( @Q ,,, a

~

> ,,-; t 4

@ _k C MM &CS To .B l~ M A DE I f* 3/q " po7790 Lmt W .

CeleA b ,

I

a. terrus (n e ) oty"nisa p&pl* \ l '

V+" w s O f c olor -

• D . _ _ . _ _ ,

A4RKkM6C h S S HowM l '~ h 3 DE L E TE 4 agg f _ _&_ _e g

4- Mtw LasnL color wM

• TE I6 L c7TTA s H P l ) c,IoA #14ck PllrAP J 6d4 A i

.-t ~ r -~

919-

/521- I A V i Y*@

LeTr'As 'h%*W h % or N Ad o de mt &M o tA s '4,,

ij s 'h.'R_NI_a__,__Jg i l

i l

LE717ss nasu&sa as sHowM i^ h, ,. a I ptLE17

PAGE: 1 of 7 ,

DAVIS-BESSE '

HUMAN ENGINEERING DISCREPANCY (HED) PIPORT TITLE: SFRCS Manual Initiation Switches are not KED NO: 9.2.054  !

Located or Arranged to Support Emergency CATEGORY: IA-H Task Sequences SlaTUS: Int. Dis. App.

, DATE ORIGINATED: 5/1/84 ITEMS INVOLVED:

Panel C-5721, SFRCS Manual Initiation Switches Components: HIS-4869A, SG 1-1 Low Stm Press HIS-4807AA, SG 1-2 Low Stm Press HIS-4869BB, SG 1-2 Low Stm Press HIS-4870BB, SG 1-1 Low Stm Press HIS-4869C, SG 1-1 FW AP HIS-4870C, SG 1-2 FW AP HIS-4869D, SG 1-1 Low Wtr Lvl HIS-4870D, SG 1-2 Low Wtr Lvl HIS-4869E, Loss of RCPs HIS-4870E, Loss of RCPs Related SFRCS Controls and Displays: See Attachment 1 PROBLEM DESCRIPTION:

This HED actually addresses three separate but related human factors problems: (1)

The Steam and Feedwater Rupture Control System (SFRCS) manual initiation switch layout is inconsistent and prone to human error. (2) The SFRCS manual initiation switches are separated from other related SFRCS controls and displays. (3) The SFRCS manual initiation switches are located lower than recommended guideline height on vertical, panel C-5721.

Attachment 2 to this HED is a sketch of the SFRCS manual initiation switch layout on C-5717 at the time the HED was generated. The Steam Generator Low Steam Pressure trip switches are located in the top two rows and arranged in an "X" pattern. To trip Steam Generator 1 on low pressure, the operator would hit the top row, left and second row, right switches. To trip Steam Generator 2 on low pressure, the operator l would hit the first row, right and second row, left switches. If the operator activates both switches in either the first row or the second row, he isolates both stean generators.

1 With regard to the second human factors problem, the operator must check displays on panel C-5717, C-5709, and the PAM panels to verify proper SFRCS actuation. KED 9.2.1 also addresses this problem. The Control Room operator cannot see all associated SFRCS displays from one location to confirm proper SFRCS actuation because the displays are located on several panels in the Control Room. Once manually initiated, SFRCS operation is fully automatic and not dependent on operator verification.

However, in the event of improper or incomplete actuation, the separation of displays from the manual initiation controls would delay the operator's identification of, and response to, the problem.

t

. - . . , , - - - - - -, .., -, --,,n-- - - - - - - --- -

n DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY.(HED) REPORT KED NO. 9.2.054' PAGE 2 of 7 The third human factors problem is that the manual initiation switches are located below guideline height on Panel C-5721.

NUREG-0700 PARA:

~

6.8.1.1A, 6.1.2.5A(2)

DATA SOURCE:

The problem was identified during verificatica and validation walk-through.

SPECIFIC ERROR:

Delay in complete verification of proper SFRCS actuation.

ASSESSMENT JUSTIFICATION:

The first human factor problem, SFRCS manual initiation switch layout, is Error Assessment Category I since the June 9,1985 incident involved an operator error isolating both Steam Generator I and Steam Generator 2 as a result of the crossover layout. Safety significance is A-H.

The second problem, separation of controls and related displays, is Error Assessment Category II. The June 9 incident did not demonstrate that the operators had diffi-culty diagnosing improper SFRCS actuation once the error in manually isolating both steam generators had cccurred. Safety significance is f-M.

The final problem, location of the SFRCS manual initiation switches below recommended minimum height, is Error Assessment Category II. Safety significance is A-L.'

DISPOSITION:

The first human factors problem under this HED has been fully corrected by hardware and logic modifications to rearrange and guard the SFRCS manual initiation switches.

Attachment 3 shows the revised layout which is now implemented in the Control Room.

The logic change involved separation of the steam generator high pressure trip from the steam generator hi-low pressure trip, and incorporating the steam generator high pressure trip switch function with the loss of RCPs trip switch function. The

-manual initiation switches were then laid out in the following order, top to bottom:

Row 1 SG 1/2 HIGH LVL Row 2 SG 1 STM PRESS LOW Row 3 SG 2 STM PRESS LOW Row 4 SG 1/2 AP STM/FW Row 5 SG 1/2 LOW LVL/ LOSS OF RCPs Row 1 is unguarded. Rows 2 and 3 are guarded with a clear plexiglass guard which has two doors held closed by a guard which will only allow one door to be opened at a time, thereby preventing inadvertent isolation of both steam generators. Row 4 is guarded with a clear plexiglass hinged door. Each a itch in the bottom row has an i

DAVIS-BESSE HUMAN ENGINEERI!G DISCREPANCY (HED) REPORT HED N0., 9.2.054 PAGE 3 of 7 individual guard composed of a plastic frame holding a clear plexiglass slide, which is slipped out to enable actuation of the manual initiation switch.

This arrangement (1) is a substant.ial improvement in operational and functional layout, and (2) is guarded in a manner which essentially eliminates the possibility of inadvertent improper actuation. This disposition completely addresses the human factors concerns in Part 1 of this HED.

Part 2 of this HED is totally redundant to HED 9.2.001. Please refer to that HED for further discussion of disposition and the associated justification.

The modification to the SFRCS manual initiation switch arrangement discussed as Part 1 of this HED placed the two switches m6st likely to be used by the operator for manual initistion of SFRCS at an acceptable height. The other four sets of manual initiation switches are still lower thsn desirable, but use of those switches in other than a test situation is very unlikely. This HED will remain under considera-tion as a part of the SFRCS Special Study. Additional modifications to the SFRCS manual initiation switches and SERCS acuated components identified in conjunction with this Special Study will be implemented in the next (5th) refueling outage.

SCHEDULE:

The acdifications to the SFRCS switch arrangement are complete. Additional modifications identified as a part of the SFRCS Special Study will be implemented in the next (5th) refueling outage.

m

, INTERIM / FINAL DISPOSITION APPROVAL:

f, f.' ~

/h%. DATE Y ' Y 'N, twr

% / - -

FINAL IMPLEMENTATION APPROVAL: DATE 1

JRL/006/24 l

e _--

DAVIS-BESSE HCMAN ENGINEERING DISCREPANCY (HED) REPORT KED NO.'9.2.054 PAGE 4 of 7 ATTACHMENT 1 COMPONENT LIST FOR HED 9.2.054 RELATED SFRCS CONTROLS AND DISPLAYS

!anel No. Instrument No. Description C5709 HIS-3871 Auxiliary Feed Pump No. 2 Discharge to Steam Generator No. 1 Isolation Valve HIS-3872 Auxiliary Feed Pump No. 2 Discharge to Steam Generator No. 2 Isolation Valve HIS-5889A- Auxiliary Feed Pump No. 1 Steam Inlet Valve HIS-5889B Auxiliary Feed Pump No. 2 Steam Inlet Valve PI-505 Auxiliary Feed Pump 1 Discharge Pressure PI-509 Auxiliary Feed Pump 2 Discharge Pressure FI-4521 Auxiliary Feed Pump 1 Feedwater Flow FI-4522 . Auxiliary Feed Pump 2 Feedwater Flow SI-815 Auxiliary Feed Pump Turbine No. 1 Speed SI-816 Auxiliary Feed Pump Turbine No. 2 Speed C5721 HIS-780 Main Feedwater to Steam Generator No. 1 Block Valve HIS-779 Main Feedwater to Steam Generator No. 2 Block Valve HIS-611 Steam Generator No. 1 Drain Valve Isolation HIS-603 Steam Generator No. 2 Drain Valve Isolation C5712 FIC-ICS33B Main Feedwater Startup Flow Control Valve 1 i ZI-SP6B Main Feedwater Flow Control Valve Position 1 FIC-ICS33A Main Feedwater Startup Feedwater Control Valve 2 ZI-SP6A Main Feedwater Flow Control Valve Position 2 LI-SP9B1 Steam Generator No. 1 Startup Range Level LI-SP9Al Steam Generator No. 2 Startup Range Level C5799 JFI-4630 PAM Panel Auxiliary Feedwater Flow to Steam Generator 1 C5798 FI-4631 PAM Panel Auxiliary Feedwater Flow to Steam Generator 2

. C5706 HIS-3869 Auxiliary Feed Pump No.1 Discharge to Steam Generator No. 2 Isolation Valve HIS-3870 Auxiliary Feed Pump No. 1 Discharge to Steam Generator No. 1 Isolation Valve C5717 HIS-ICS11B Main Steam No. 1 Atmospheric Vent Valve HIS-ICS11A Main Steam No. 2 Atmospheric Vent Valve HIS-394 Steam Generator 1 Main Steam Warm-Up Drain Isolation Valve HIS-375 Steam Generator 2 Main Steam Warm-Up Drain Isolation Valve HIS-101 Main Steam Isolation Valve No. 1 HIS-100 Main Steam Isolation Valve No. 2 HIS-601 Steam Generator 2 Main Feedwater Stop Valve HIS-612 Steam Generator 2 Main Feedwater Stop Valve HIS-608A Steam Generator 1 Auxiliary Feedwater Isolation Valve HIS-608B Steam Generator 1 Auxiliary Feedwater Isolation Valve HIS-599A Steam Generator 2 Auxiliary Feedwater Isolation Valve HIS-599B Steam Generator 2 Auxiliary Feedwater Isolation Valve HIS-106A Main Steam Line No. I to Auxiliary Feed Pump Turbine No. 1 Isolation Valve

~

q DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (PED) REPORT HED NO. 9.2.054 PAGE 5'of 7 ATTACHMENT 1 COMPONENT LIST FOR HED 9.2.054 RELATED SFRCS CONTROLS AND DISPLAYS Panel No. Instrument No. Descriptic7 HIS-106E Main Steam Line No. 2 to Auxiliary Feed Pump Turbine No. 1 Isolation Valve HIS-107A Main Steam Line No. 2 to Auxiliary Feed Pump Turbine No. 2 Isolation Valve HIS-107E Main Steam Line No. I to Auxiliary Feed Pump Turbine No. 2 Isolation Valve. -

DAVIS-BESSE HlMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO. 9.2.054 PAGE 6 of 7 ATTACHMENT 2 ORIGINAL SFRCS MANUAL INITIATION SWITCH LAYOUT l

l STRCS l l MANUAL INITIATION SWITCHES l

\

TRIPPED TRIPPED SG 1-1 LOW \ SG 1-2 LOW STM PRESS 0 \ 0 STM PRESS TRIP F TRIP F FI g\ F

\

\

\

SG 1-2 LOW TRIPPED \ TRIPPED SG 1-1 LOW STM PRESS 0 o STM PRES 3 TRIP F TRIP F F \ F

\

\

\

\

\

SG 1-1 SG 1-2 WdP O 0 FW A P TRIP F TRIP

{

N N

N

\

TRIPPED N TRIPPED SG 1-2 LOW SG 1-1 LOW N WIR LVL WIR LVL o o TRIP F \ TRIP F F N F N

N N

N LOSS OF TRIPPED TRIPPED LOSS OF RCPs 0 \ g RCPs TRIP F \ TRIP F \ F

'N e

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO. 9.2.054 PAGE 7 of 7 ATTACHMENT 3 REVISED SFRCS MANUAL INITIATION SWITCH LAYOLT

.s 5fRCS MANUAL INITIATION SWITCHES CHANNEL 1/3 CHANNEL 2/4 gg,gjg raserts raires3 tsvet EICE se.:/

raar a LEVEL rear e

r ls r r i ., s, A - \ \ \ \ ,

W' .

\

1 taire:9 ratersB as.:

stapasas FRESS ***

s e m 'r a n a s tev , SG-1 tes raar r rest r

'I r e ,

es U 4 l-

,.g- s a

' ' s - g. s =s y .

• s t . g 1"- t .

f 4 _

\ d s ]s s s % 's a

, s .) s' . N 'S . *

.s ) . '**

.\\

\ '

A

. ,eters, tsart. !r ss-2 PRESS y es.:

srurises

'*" . 5C-1 e era ris s s 5

rair r tsar r P-r r ]

u s.

, , s, e y- . e. em - .- .

s ,,- s-, . i g -

, - . _ - s s,\;-

ig rA k V V-A v \-N v w -ANwN-NNA w 6 N- si l \

A tairres fairess re-I/ l 4e fy '

es=3/

a rm / rv s e

• ier

, , ,,,, ses/rv i r e

(

y g' 'J\' \- w.'y

- . - s- '- ' ' .

s N

> N.

,N

,3 N, -

N \

N 4 g y \\4,

s. .

s s

t :erse rairrse ss. /

teret test Lesser L0W LEYEL/ _

e ses ,-et i / stenf a c r'. ,,,, e, ICPM e, se ts o r

,ei, a c e 'e r r

d s

, j KED Mo.

Page 1 of 2 HUMAN FACTORS VERIFICATION OF DESIGN IMPROVEMENT BRIEF DESCRIPTION: 5R205 /IIs.ta d I,,/4ct 4 cr< fn e ,d /w >

G. p e 'l lCC G$*'Y rr cLr r'd s.4cy cf & Gu pp~rf hpuc quacy b4k TYPE OF VERIFICATION: Initial Interim y Implementation BASIS OF REVIEW:

Documentation Review (specify document number)

FCR Request FCR Concept Design FCR Detailed Desigs Maintenance Work Order Procedure Other Hardware Assessment AFFEC'ED T COMPONENTS:

H6D \i< f (en< C. - 6 9 2 \ ( w 3 '~M 6*eua f tw THE HUMAN FACTORS REVIEW WAS CONDUCTED IN THE FOLLOWING MANNER:

i Yes No N/A A. Comparison with NUREG-0700 guidelines X l x i= B. Comparison with T/A I&C reqts C. Operations review and comments V D. Walk-throughs <

E. Other (specify) X' l

i

4 en -

ED No. 'I i Page 2 of 2 TE HUMAN FACTORS REVIEW RESULTED IN A FINDING THAT TE DESIGN IMPROVEMENT:

Will fully satisfy the human factors concerns in the ED.

( Will partially satisfy the human factors concerns in the HED.

. Will not satisfy the human factors concerns in the HED.

i br u h c.f m h q t v1 m b s_

JUSTIFICATION: i s c..a ckc a c_ t t 6 [ .<.,s c!IS ocsi4 tos So ebns c_ h H 6 D 9,2 Md. , b'c b c' OdC ch & ter k1C.2s c Asg aAks

• h &M a ssc nL:$ e helkbc J' 2e s. b

.I a

lc<o c c h en c mls 6 re m e u 6 I e e d 6 obem Iti%

a i s a Le l c

b.p Gud (D dee d i.MNA. l t c A e [ k f hs h i o, ,. k M 3eemb , I ye cch preocb. ke m Od4EV 1 r#trfe f.ot' 6 Mf4 T

Lo uUM a c 0 o a..A .% & tus(L M o . \

J TE DESIGN IMPROVEMENT ( ) (WILL NOT) RESULT IN ANY NEW HEDs. (IDENTIFY NEW EDs IF APPROPRIATE.)

JUSTIFICATION: C4 - hu k (m c,uA dk M ed4CM vn wuo HGDs e, Hitm c1 B tb 4, Z .9L c miecAM

.A cciGA hsci juXq(8 ch G0nNc0 (ustk we.rc$ {k w W c $ f 92. (C N8 %h bb4Ik'c4 *T{utcue, G.<u'$ w I I COLNb /te-tIh A:.sv S b [M & c$c[t:s Leck . VPu.cc vs s w :.r 8 ~

c;h ry3M ES a c3ndo awafc1c4, [obJet , i <, o .ucptie,(cA 7 I M int , m J m vorlrt ,, n e o per k m kr 4v se adcirie+ t mP7:P 27; ,

g y ,- g

- re cts etc<u FURTHER HUMAN FACTORS REVIEW (IS) ( REQUIRED. _

JUSTIFICATION: /c7 (M e Su.i da4 du crfler n ((

J L LL k ,Ac M W c h V 0 0b ('BY7 NcfL &# k cb d u < <

/h'I N __ N_ 'ICM ( . b _j $ Lg

/km Schrs i n r> J . 4 h < a% ci$ ow),SFA?(f i

001tef t27d k hD S k$.

1 r

• HED/001

PAGE: 1 of 2 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Unreliable Control Room Display HED NO: 9.2.065 CATECORY: IIB-L STATUS: Closed DATE ORIGINATED:

ITEMS INVOLVED:

Main turbine control valve and stop valve position indications en Turbine Control

[ Panel HIC-2540 l

PROBLEM DESCRIPTION:

I~

The indication of the main turbine control and stop valve position in the Control

, Room is unreliable. This is a design / maintenance problem associated with the instrumentation sensors in the field which can result in inaccurate Control Room indication.

l i NUREG-0700 PARA:

i 6.1.1.1 6.5.1.1B DATA SOURCE:

Operator comment during verification and validation.

SPECIFIC ERROR:

Delay in determining main turbine control and stop valve positions.

ASSESSMENT JUSTIFICATION:

Although this error has occasionally caused a delay in verifying valve closure following a reactor trip, no inappropriate operator actions have occurred as a result. The potential for a misinterpretation does exist, therefore, the error assessment category of this HED is II.

The emergency operating procedure requires the operator to use these indications

'following a reactor trip to verify that the turbine has tripped to prevent an undesirable overcooling. If the turbine is not properly trippe,d, the operator is directed to trip SFRCS to isola'.e the turbine. Confusion in evaluating the position of the valves could lead to an unnecessary manual SFRCS trip or could delay a required trip; although in a condition actually requiring an SFRCS trip, automatic isolation would occur on SFRCS low pressure trip.

This HED is, therefore, associated with non-safety related equipment which can challenge a safety system. The significance category is B-L.

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO:.9.2.065 PAGE 2 of 2 DISPOSITION:

The maintenance history of the position sensors for these valves has been reviewed during the current outage. A preventive maintenance schedule has been established for these sensors on the basis of the failure history. This action will substantially improve the reliability of these components which previously had no set preventive maintenance requirements. This action closes this HED.

SCHEDULE:

Complete.

INTERIM / FINAL DISPOSITION APPROVAL: DATE FINAL IMPLEMENTATION AFPROVAL: [bu2 JL'-mm-s DATE

-' d 5

JRL/006/15

PACE: 1 of 2 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Information Displays Not Available HED NO: 9.2.083 in Control Room CATEGORY: IIB-L STATUS: Int. Dis. App.

'DATE ORIGINATED: 5/02/84 ITEMS INVOLVED:

Integrated Control System (ICS) status indication PROBLEM DESCRIPTION:

There is no display in the Control Room to indicate when the Integrated Control System (ICS) is in Track Mode. The ICS Track Mode is an automatic control function which is initiated when automatic control of either the reactor, feedwater/ steam generator, or turbine generator can no longer be maintained.

The inability to maintain automatic control may be the result of a wide variety of controller system malfunctions or limitations which places a restriction on the power production capabilities of either the reactor or steam generator /feedwater turbine generator systems. The ICS then forces the entire plant to " track" the power production capability of the limiting system or subsystem. The ICS can, therefore, cause a reduction in power output in response to a control or system upset by automatically reducing reactor power, feedwater flos, or turbine generator output in just a few minutes to reach a new system equilibrium. The lack of an annanciator identifying the Track Mode of operation complicates the operator's response to the power reduction transient. There are indicating lights on the unit load demand station for manual and automatic ICS operation which would both be lit in the case of the ICS being in Track Mode. Therefore, some indication of this condition already exists. A more prominent indication such as an annuncittor would be easier to identify in a transient condition.

NUREG-0700 PARA:

6.1.1.1 6.5.1.1B DATA SOURCE:

Operator comments during verification and validation.

SPECIFIC ERROR:

Delay in determining ICS status, delay in response to transient.

ASSESSMENT JUSTIFICATION:

Since no prominent indication exists, the potential for not immediately recognizing the Track Mode exists, and the error assessment category is II.

Depending upon the cause of the transient or condition which placed the ICS in Track, the end result of the transient may be a reactor / turbine trip. In some cases, rapid operator intervention may be able to prevent a trip. Consequently, 1

- - _ - _ _ _ _ - - - _ _ _ _ l

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED NO: 9.2.083 PAGE 2 of 2 the inability to quickly determine the Track Mode of operation could possibly cont-ribute to an unnecessary reactor / turbine trip. The significance category is B-L.

DISPOSITION:

The appropriate corrective action for this HED is the addition of an "ICS in Track" annunciator. The specific corrective action for this modification including the location of the annunciator will be developed in conjunction with the Annunciator Special Study.

Although the inability to quickly identify the Track Mode of operation can complicate the operator's response, it would only r.ffect the end result of the transient in certain special circumstances where prompt operator action might prevent a possible reactor trip. Since the Track Mode of operation can be identified using existing indications in a time frame consistent with most needs, and since the Emergency Operating Procedure requires no actions with respect to the ICS Track Mode of operation, the addition of the "ICS in Track" annunciator need not be made prior to restart.

SCHEDULE:

The Annunciator Special Study will commence following restart.

,~ /. ' .

n TERIM/ INAL DISPOSITION APPROVAL:  % / hem DATE M W '((

FINAL IMPLEMENTATION APPROVAL: DATE JRL/006/17 i

9 PAGE: 1 of 2 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Information Displays Not Available HED NO: 9.2.084 in Control Room CATEGORY: IB-L STATUS: Int. Dis. App.

DATE ORIGINATED: 05/02/84 ITEMS INVOLVED:

Deaerator level control valve position indication PROBLEM DESCRIPTION:

There is no display in the Control Room to indicate the actual valve position of the .

deaerator level control valve, which complicates the operator's evaluation of secondary side transients affecting the deaerator level. The deaerator level control indicates the demand signal sent to the control valve, but not actual valve position. The valve has a history of sluggish operation, and the operator is not sure that the valve is responding daring a transient.

NUREG-0700 PARA:

6.1.1.1 6.5.1.1B DATA SOURCE:

Operator comment during verification and validation.

SPECIFIC ERROR:

[ Delay in determining control valve position, delay in evaluating secoddary side i

transient.

ASSESSMENT JUSTIFICATION:

1 Although this condition has not caused any reactor / turbine trips, it has led to

- confusion in post trip conditions and could potentially contribute to the inability l to ccrrect the transient at power, resulting in a reactor / turbine trip. Because this problem has occurred, the error assessment category is I.

The use of this control is outside the scope of the emergency coerating procedure.

Under some circumstances, it could contribute to a reactor /tv ne trip, but has no other bearing on safe plant operation. The significance t . agory is B-L.

DISPOSITION:

- The HED will be examined as part of the Display Special Study which will evaluate f the generic problem of demand versus actual indications.

I

DAVIS-BESSE HQ1AN ENGINEERING DISCREPANCY (HED) REPORT HED NO:.9.2.084 PAGE 2 of 2 Deaerator level indication is available in the control room and canbe used to infer the control valve position. Addition of the valve p6sition indication prior to restart is not required.

SCHEDULE:

The Displays Special Study will commence folicwing restart.

2-f<

INTERIM INAL DISPOSITION APPROVAL: n/p e ,  % DATE Y'/Yd[

FINAL IMPLEMENTATION APPROVAL: DATE l-JRL/006/18 1

l I

_ - - - - _ i

r-4 PAGE: 1 of 2 DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT TITLE: Displays That Do Not Provide the Precision HED NO: 9.8.007 Accuracy Required. CATEGORY: IIA-L STATUS: Int. Dis. App.

DATE ORIGINATED: 7/26/83 ITEMS INVOLVED:

Panel Component ID Description Category C-5798 TIRC3B6/TIRC4B2A Loop 1 Temperature IIA-L TIRC3A6/TIRC4A2A Loop 2 Temperature IIA-L TI 4628 Incore Temperature IIA-L C-5799 TIRC3BS/TIRC4B4 Locp 1 Temperature IIA-L TIRC3AS/TIRC4A4 Loop 2 Temperature IIA-L TI 4627 Incore Temperature IIA-L C-5712 LI SP9B1 Steam Generator Startup Level #1 IIA-L C-5712 LI SP9Al Steam Generator Startup Level #2 IIA-L PROBLEM DESCRIPTION: ,

Operators indicated that the displays listed above do not provide the precision or accuracy required.

NUREG-0700 PARA:

6.5.1.2A DATA SOURCE:

Operator Interview TP 9.8B6(14)

SPECIFIC ERRGR:

Misinterpretation of displayed information. Misread the display.

ASSESJMENT JUSTIFICATION:

The Post Accident Monitoring (PAM) Panel C5798 and C5799 is by design intended to be a backup monitoring system. The only meters on the PAM panel which are . referenced by the Emergency Procedure (EP) to be used for an operator task are the incore thermocouple meters (TI 4627 and TI 4628) and the wide range hot leg temperatures (TIRC3AS, TIRC3BS TIRC3A6 and TIRC3B6), and the margin to saturation meters (TDI 4950-IDI 4951). The margin to saturation meters are large digital displays and are not associated with the problem described in the HED. The incore thermocouple

- meters are the primary indication to be used for determination of inadequate core

. cooling (ICC) conditions. Entry into the EP section for ICC and the operator actions in the ICC section are based on the indications from these meters. The meters are readable to the accuracy required by the proc'edure. The meters are readable to one half of one scale increment (5*F) accuracy which is more accurate than the technical basis which defined the procedure steps. The error assessment category for these meters is therefore III.

T.

DAVIS-BESSE HUMAN ENGINEERING DISCREPANCY (HED) REPORT HED N0:'9.8,007 PAGE 2 of 2

.The wide range hot leg temperatures are only used as a backup indication to the four control panel mounted hot leg temperature meters (two of the control panel meters are safety grade and two are NNI system powerud). The operator task required by the EP is the initiation of the " Feed and Bleed" cooling mode, after a complete loss of all feedwater to the SGS, when either loop hot leg temperature reaches 600*F. The PAM panel meters are only required by the EP if all the control panel hot leg tempercture indication has been lost. In the unlikely event all four control panel hot leg temperature meters are lost the operator would have to make the determination based on the PAM panel hot leg meters which are also readable to 5*F accuracy. The EP criteria of initiation at 600*F is mcre than 5*F below the initiation temperature required by analysis. The error assessment category for these meters is therefore III.

If these PAM panel hot leg temperatures are also lost, the incore thermocouple temperature meters mentioned above are used by the operator. These have the same readable accuracy as the hot leg temperatures as mentioned above.

I Considering other HEDs related to the PAM panel, this HED has been conservatively upgraded to IIA-L for PAM panel indications.

The Steam Generator level indication is required to verify an adequate heat sink is available for post trip decay heat removal capability. Proper operation of the main L or auxiliary feedwater control systems is verified by observing proper post trip SC level. The SG startup level meters themselves can easily be read to enough accuracy to indicate adequate inventory for decay heat removal. HED 9.2.4^ addresses the concern that operators have with the precision of these meters in relation to SFRCS low SG trip.

DISPOSITION:

As described'in the Assessment Justification section, continued operation with the present design of the PAM panel will not adversely affect performance of Emergency Operating Procedures. However, due to other HEDs associated with this panel, the Special Studies on Displays to be completed after restart are expected to recommend major changes to these displays. These changes are expected to be completed in the 5th refueling outage.

The Disposition of HED 9.2.42 addresses concerns with the SG startup level indication.

The short term fix of increasing the margin between SG low level limit control and the SFRCS low SG level trip set point will reduce the likelihood of SFRCS trips and challenges to safety cystems.

SCHEDULE:

The Display Study generated corrective actions with respect to the PAM panel indica-tions will be implemented in the next (5th) refueling outage.

J - .

~

INTERIM FINAL DISPOSITION APPROVAL: G M t# D1 n -% DATE #I FINAL IMPLEMENTATION APPROVAL: DATE TF 014

/