ML20206R619

Technical Evaluation of Comm Ed Dcrdr of Dresden Station, Units 2 & 3

ML20206R619
Person / Time
Site:	Dresden
Issue date:	09/03/1986
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML17199F983	List: ML20206R619
References
CON-NRC-03-82-096, CON-NRC-3-82-96 SAIC-86-1144, NUDOCS 8609110151
Download: ML20206R619 (51)

Text

4

,' . ENCLOSURE 2 TECHNICAL EVALUATION

. OF COMMONWEALTH EDISON COMPANY'S DETAILED CONTROL ROOM DESIGN REVIEW -

0F DRESDEN STATION, UNITS 2 AND 3 September 3, 1986 Prepared by:

Science Applications International Corporation 17I0 Goodridge Drive McLean, Virginia 22102 l

Under Contract to:

U.S. Nuclear Regulatory Commission

, Washington, D.C. 20555 1

Contract No. NRC-03-82-096 Is G

l l

l' i_

8609110151

, 0903 Ci- mUuCe 500 37

. -. z=_: = .- . _

, 4 .

t a t

L TABLE OF CONTENTS Section Eagg 1 INTRODUCTION. . . . . . . . . . . . . . . . . . . . . . . . . 1 2 EVALUATION. . . . . . . . . . . . . . . . . . . . . . . . . . 1 2.1 Establishment of qualified multidisciplinary review team 1 2.2 Function and task analysis to identify control room operator tasks and information and control require- -

ments during emergency operations. . . . . . . . . . . 3 2.3 Comparison of display and control requirements with a

. control room inventory . . . . . . . . . . . . . . . . 5 2.4 A~ control room survey to identify deviations from accepted human factors principles. . . . . . . . . . . 8 2.5 Assessment of HEDs to determine which are significant and should be corrected. . . . . . . . . . . . . . . . 9 2.6 Selection of design improvements . . . . . . . . . . . .

• 15 2.7 Verification that selected improvements will provide the necessary correction and will not introduce new HEDs . 17 2.8 Coordination of control room improvements with changes from other programs such as the Safety Parameter-

)

Display System, operator training, Reg. Guide 1.97 instrumentation, and upgraded emer procedures . . . . . . . . . . . .gency operating

.......... 18 4

2.8.1 Reg. Guide 1.97 and Safety Parameter Display tystem . . . . . . . . . . . . . . . . . . . 18 2.8.2 Upgraded E0Ps. . . . . . . . . . . . . . . . . 19 2.8.3 Training . . . . . . . . . . . . . . . . . . . 20 2.9 Other DCRDR activities . . . . . . . . . . . . . . . . . 21 2.9.1 Operating experience review. . . . . . . . . . 21

. 2.9.2 Review of remote shutdown facilities . . . . . 23 2.10 DCRDR res ul ts . . . . . . . . . . . . . . . . . . . . . . 23 2.10.1 Control room improvements and justifications for not correcting or only partially correcting significant HEDs. . . . . . . . . 23 2.10.2 Implementation schedules . . . . . . . . . . . 24 3 CONCLUSION. . . . . . . . . . . . . . . . . . . . . . . . . . 25 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1

. _ . ..__a_ ..___._ _- . ._ . .__. - _-- __ _

TABLE OF CONTENTS Section East APPENDIX A - NRC Comments on the Differences Between NUREG-0700 Guidelines and Ceco Checklist . . . . . . . . . . . . 28 APPENDIX B - Comments Resulting From the Review of Three Cancelled HEDs. . . . . . . . . . . . . . . . . . . . . . . . . 32 APPENDIX C - HEDs for Which the Proposed Implementation Schedules Were Found to Be Unacceptable . . . . . . . . . . . . 34 APPENDIX D - HEDs for Which Corrective Actions or Justifications for Noncorrection Were Proposed but Were Found to Be Inadequate. . . . . . . . . . . . . . . . . ,. . . . . 37 S

b e

e 11

e t

TECHNICAL EVALUATION .

0F COM10NWEALTH EDISON COMPANY'S DETAILED CONTROL ROOM DESIGN REVIEW

. OF DRESDEN STATION, UNITT 2 AND 3

. 1. INTRODUCTION 1

Comonwealth Edison Company (Ceco) submitted the Sumary Report 'for the Dresden Station, Units 2 and 3 Detailed Control Room Design Review (DCRDR) to the Nuclear Regulatory Comission (NRC) in May 1985. That report was

, reviewed by Science Applications International Corporation (SAIC) personnel ,

on contract to the NRC. As a result of SAIC's review, the NRC requested that Ceco supplement the Sumary Report for the Dresden Station DCRDR. That supplement was_provided in February 1986. The review of the suppleme'nt led SAIC to conclude tha't additional information as identified in the Conclusion Section of this document is required from CECO to ensure that all require-ments as stated in NUREG-0737, Supplement I are satisfied. This information should be provided in a second supplement to the Sumary Report.

2. EVALUATION SAIC has reviewed all information on the Dresden Station, Units 2 and 3 DCRDR available to date. The purpose of the review was to evaluate whether DCRDR requirements in Supplement I to NUREG-0737 had been satisfied. The evaluation was performed by comparing information provided by Ceco with criteria in Section 18.1, Rev. O, Appendix A of the Standard Review Plan.

l. SAIC's evaluation of the DCRDR for Dresden Station, along with a sumary of the criteria from the Standard Review Plan, is provided below.

2.1 Establishment of a cualified multidisciolinary review team The organization for conduct of a successful DCRDR can vary widely, but is t expected to conform to some general criteria. Overall administrative L leadership should be provided by a utility employee. The DCRDR team should be given sufficient authority to carry out its mission. A core group of specialists in the fields of human factors engineering, plant operations, '

~

instrument and control engineering, and nuclear engineering is expected to participate with assistance as required from other disciplines. Staffing to 1

l

+ .. - . - - .. - - T  : -_- __- - . _ _ _ . - - . .

k accomplish each DCRDR element should bring appropriate expertise to bear. I Human factors expertise should be included in,the staffing for accomplish'- l ment of most, if not all, DCRDR elements. Finally, the DCRDR team should receive an orientation which contributes to the success of the DCRDR.

. Section 18.1, Appendix A, of NUREG-0800 describes criteria for the multi-disciplinary review team in more detail.

, Management and administration of the Ceco DCRDR at Dresden Station was the responsibility of the Technical Services Nuclear Department. Within this department, the DCRDR program administrator reported to the Technical

4 Services Nuclear Department manager who reported directly to an assistant vice president and hence to a Ceco executive vice president. Furthermore, it appears that the review team, as established, did have the freedom to carry out the review and access records, information, and facilities as i

needed.

. The Dresden DCRDR team consisted of a group of professionals from Ceco and i Advanced Resource Development Corporation (ARD). Expertise of~ the team i

included:

e Instrumentation and control engineering

. e Nuclear systems engineer / architect with control room design experience e Operations e Human factors engineering.

l '

l Nine subject matter experts (SMEs) were available to work on the project as l needed. They provided the appropriate level of plant design and operational knowledge. Our review of DCRDR team and SME resumes indicated that person-nel had appropriate qualifications to conduct the DCRDR. The skill mix of

. the team is consistent with the guidance provided in NUREG-0800.

A task assignment summary matrix was provided in the Supplement to the Final Summary Report that indicated which team specialists were involved with each of the different phases of the DCRDR project. It indicated that the necessary skills were available and that they were properly . utilized. It was also ascertained that the Ceco DCRDR team members were adequately oriented concerning the nature and requirements of the DCRDR.

2

- ~ - ,,~g. -m,- , , . , .,%,,__ , _ . , , _ _ _ _ _ ,. ._ _ ,,,[_.

I In summary, the reviewers conclude that CECO has met the requirement of -

establishing a qualified multidisciplinary review team.

2.2 Function and task analyses to identify control room operator tasks and information and control reauirements durino emeroency ooerations The purpose of the function and task analyses is to identify the control room operators' tasks during emergency' operations and to determine the -

information and control capabilities the operators need to perform those tasks. An acceptable process for conducting the function and task analyses

~

is:

1. Analyze the functions performed by systems in responding to transients and accidents in order to identify and describe those tasks operators are expected to perform.

2. For each task identified in Item I above, determine the information (e.g., parameter, value, status) which signals the need to perform the task, the control capabilities needed to perform the task, and the feedback information needed to monitor task performance.

Displays and controls are not identified at this stage. Operator tasks have been identified and described, and the information and

. control capabilities necessary to perform those tasks are being

, determined. .

3. Analyze the information and control capabilities determined in Item L

2 above to determine those characteristics essential to adequate i task performance. Information characteristics include parameter f type, dynamic range, setpoints, resolution / accuracy, speed of

. response, units and need for trending, alarming, etc. Control "

characteristics include type (discrete or continuous), rate, gain, l response requirements, locking functions, and feedback information associated with control use.

The described process is orescriotive. It should identify, in detail, what operators need to do in order to control the systems which mitigate the l consequences of transients and accidents. It should also identify an appro- '

priate functional interface between the operators and those systems. In 3

.m _ _ .__. - _ m.. . _

- - - - = - - --

d addition to their use in the DCRDR, the function and task analyses should -

provide the basis for complete and technically adequate emergency operating procedures (EOPs). Identification of tasks and necessary information and control capabilities should be based on engineering anafyses and should be independent of displays and controls in the control room.

7 To accomplish this, the generic Boiling Water Reactor Owners' Group (BWROG) i Emergency Procedure Guidelines (EPGs) were made plant-specific by SMEs who eliminated references to those systems and equipment not found at Dresden.

Systems unique to Dresden's response to transients and accidents were added.

Once the site-specific document was developed, operator actions which were implied or stated were written as task statements. All unique tasks were identified, coded with a task number, and grouped into the prevailing system being exercised or acted upon. -

The tasks subsequently were broken down into task elements and/or action steps by SMEs in order to reflect a step-by-step procedural set of actions that must be carried out in order to accomplish the task. These task reduction activities were' accomplished by having the SMEs respond to a series of questions about each task such as task conditions, initiating cues, frequency performed, and performance criteria.

This process was performed outside the control room as much as possible. As described by the licensee, the task analysis performed for DCRDR purposes was not done from a "what exists" perspective, but rather from the perspec-tive of "what should be." However, to be more thorough, the SMEs frequently

[ referred to available resources such as procedures, piping and instrument

! diagrams, electrical schematics, and additional expertise. While this process was not accomplished completely independent of the control room, the

. DCRDR team members, in an iterative process, continued to probe SME responses to ensure that their responses reflected "what should be" as opposed to "what exists" in the control room.

4 While task development was under way, display and control requirements were collected and coded on Task Analysis Instrument and Control Requirement Forms for each action step. Like the task elements, the -display and control requirements were coded from a "what is needed" perspective for action -

steps. Coded variables included displayed parameter and type of display,

)

4 i

- . . - .---.m.- ,,,g,,,,,,,yn , , - , . - -,------,,,,,,-,w,--

manual control type and action, automatic controller type, parameter units, .

range, and division. -

The primary factor that indicated that these "in control room" task analysis steps did not bias the results of the analysis was the existence of numerous "no-matches" which often resulted in human engineering. discrepancies (HEDs).

The human factors specialist (HFS) also led the SMEs taking part in the analysis with appropriata questioning to make sure that they did not bias their requirements-based analysis through their familiarity with the control room. In the reviewers' judgment, Ceco's DCRDR for Dresden Station has satisfied the NUREG-0737, Supplement I requirement for function and task analysis.

,. 2.3 Comoarison of disolav and control reauirements with a control room inventorv The purpose of comparing display and control requirements with a control room inventory is to determine the availability and suitability of displays I

and controls required for performance of the E0P's. Success of this element depends heavily on the quality of the function and task analyses and the control room inventory. Display and control requirements should be derived from analyses which are sufficiently detailed to support development of complete and technically adequate E0Ps. Characteristics appropriate to the

? task should be described for each display and control need identified by the function and task analyses. The control room inventory should be a complete i representation of displays and controls currently in the control room. The inventory should include characteristics of current displays and controls

appropriate to meaningful comparison with the results of the function and task analyses. Once an adequate control room inventory is developed, a systematic comparison of information and control capability requirements with existing controls and displays should be made. Displays and controls determine'd to be unavailable or unsuitable should result in documented HEDs.

l All displays, controls, controllers, annunciators, and other equipment in i

the control room with which the operators interact were included in the Dresden inventory. Consistent with NUREG-0700 guidelines, HFS and nuclear l systems operators compiled the inventory using direct observations in the .

control room and instrumentation diagrams of the control room panels. Each 5

7 ,

piece of equipment on the control boards and its relevant characteristics -

were identified by codes that had been used to characterize equipment requirements from the task analysis. Inventory data was stored in a com-

, puterized data base n.anagement system.

once the inventory was completed, a verification of' equipment availability and suitability was accomplished. There were two aspects to the verifica-

~

tion process. First,_ it was determined whether appropriate equipment was available in the control room to perform each task required by emergency i' operations. This was performed by checking for the existence of required instrumentation in the control room. If the required instrumentation was found to be present, then a code number representing that particular item was entered onto the data recording sheets confirming the availability. of the required instrumentation. However, if the required displays or controls did not match what was physically available in the control room, this was

, coded on the data collection form as a discrepancy or "no match." Many HEDs were identified as a result of this process.

1 Second, for equipment that had been identified as available, criteria speci-fied on pages 6-33 through 6-35 of the May 1, 1985 Summary Report were used to determine whether the characteristics of each piece of equipment made it a suitable . for the task. These criteria were found to be acceptable. The

, latter step, performed by using the computer system, compared the character-istics identified during the task analysis phase and the control room inven-tory. Any "no match" items were noted as deviations, and an effort was made p- to resolve these deviations. Those deviations that could not be resolved

[

were recorded as HEDs. As a result of comparison of' the control . room i inventory with task analysis results, numerous HEDs were identified. CECO has met the control room inventory requirement of Supplement I to NUREG-0737.

Ceco conducted a validation review at Dresden to determine whether the functions allocated to the control room operating crew could be accomplished effectively within both the structure of the established emergency proced-ures and the design of the control room as it exists.

l l In the Dresden Summary Report, the licensee indicates that it will validate -

the control room functions using a real-time simulator "run through" of all 6

l

- - - 2 : L - . = =:: = = .. =....= -.=: = - = = . .-_ _ _____

l

• 1 I

major unit systems at every control room workstation. The events which were -

used in the validation were:

I e A normal reactor startup e A normal reactor shutdown

- e A small break loss of coolant accident (LOCA)

^

e Inadequate core cooling e An anticipated transient without reactor scram following the loss -

of offsite power e A reactor scram e A main steam line break inside the drywell.

The DCRDR coordinator, who is a licensed BWR senior reactor operator (SRO),

and an HFS arranged for and supervised the validation effort at the Morris simulator. Operating crews consisted of two Dresden SRO-licensed managerial

, personnel and two certified Dresden simulator instructors. During the event simulation, which was recorded on videotape, operators were instructed to call out all relevant actions, directions of movement, the displays and

) indicators used as well as their responses. The event and recording efforts were terminated when the SME determined that the crew had successfully ~

mitigated the event.

After recording the events, an HFS and an SME jointly reviewed and analyzed the data on an as close to a procedural step-by-step basis as possible.

During this review process, the Dresden procedures were referenced, the HFS would stop the tapes for viewing as needed, and the SME would clarify 4

operator actions. Where the HFS observed instances in which equipment availability, suitability, or location could be enhanced, or in which operator uncertainty due to procedural ambiguity could be minimized, HEDs were written.

Using a real-time simulator, the licensee implemented a validation procedure consistent with the guidelines of NUREG-0700. The validation of control room functions contributed to the Dresden DCRDR by generating six HEDs.

7 v ge -er --

• e y. p +g-e ,-.e-e-e+-. .y-w. - - - - - m-ew-w--a.er-----.-w,----,v--,- _ .---e-. - = - - - - - - -

.e 2.4 A control room survey to identify deviations from accented human .

factors nrincioles

• The key to a successful control room survey is a systematic comparison of the control room with accepted human engineering guidelines. One accepted set of human engineering guidelines is provided by Section 6 of NUREG-0700.

r Discrepancies between the control room and human engineering guidelines should be documented as HEDs. .

To conduct the survey, HFSs and CECO operations personnel observed and

~

measured control room features using human factors guidelines derived from those in Section 6 of NUREG-0700. As indicated on page 6-42 of the Dresden Sumary Report, some CECO guidelines differed from those presented in NUREG-

.0700. The licensee stated that "many of the items were quantified, or reworded, so as to make them clearer and more concise for evaluation."

Objections to some of these Ceco checklist criteria were raised during the f February 1984 NRC in-progress audit at Dresden. While the Ceco checklist f criteria were reevaluated to resolve the NRC objectives, the results of this .

reevaluation process were not documented in the Dresden Sumary Report. At  ;

the June 1985 Quad Cities pre-implementation audit, a copy documenting the differences between NUREG-0700 guidelines and CECO checklist was presented. [

. Due to the extensive coordination between the Quad Cities and Dresden l DCRDRs,- it was assumed that the revised Ceco guidelines presented at the  ;

Quad Cities audit represents the revision resulting from the in-progress  !

audit mentioned in the Dresden Sumary Report. In the February 1986 Supple-ment to the Final Sumary Report, the licensee indicated that the Dresden Ceco checklist revision is the same as that presented at the Quad Cities audit. ,

During the pre-implementation audit at Quad Cities, differences between NUREG-0700 and the Ceco checklist were reviewed in detail. This review j indicated that several differences are based on (1) misprints in NUREG-0700;  !

(2) qualitative guidelines which Ceco chose to make quaeitative to improve

- review objectivity; and (3) very minor differences on guidelines of lesser significance. The NRC found these modifications to be acceptable. However, the NRC audit team documented two concerns regarding Ceco's modifications of NUREG-0700. -

8

' * * * * * *--Om== .-.e e . ,es. wa.e. .g.+ , , , , , ,

s The first concern was that a majority of differences between the guidelines .

of NUREG-0700 (Section 6) and the Ceco checklist were in areas which required evaluation using task analysis results. Since the task analysis was accomplished only on emergency operations, Ceco revised the applicable NUREG-0700 guidelines to show that they were limited to emergency operations. The audit team agreed with this interpretation as long as k

improvements to instrumentation used in emergency operations do not result in inconsistencies with nonemergency (and thus unimproved) instrumentation.

J To avoid adding to operator confusion, improvements to instrumentation used

in emergency operations should be applied to all similar instrumentation.

In response, Ceco's February 1986 Supplement to the Final Summary Report indicated that " improvements to instrumentation used in emergency operations  ;

will be applied to all similar instrumentation to ensure consistency." This

response adequately addressed the above concern. .

The second concern of th audit team was Ceco's modification to the following three NUREG-0700 guidelines: 1.2.3.D.2; 1.2.3.F.1, 1.2.3.F.2; and

3.2.1.C. The differences between NUREG-0700 and the Ceco checklist for I

these three guidelines, along with Ceco's justifications and the NRC audit f team's comments, are provided in Appendix A. The NRC recommended that CECO

. modify these. guidelines so they will be in accordance with NUREG-0700

. criteria and then recheck the control room for these three items. As indicated in the Supplement to the Final Summary Report, the licensee concurred with the NRC position and has modified the three guidelines and reevaluated the control room accordingly.

l l

Ceco's control room survey at Dresden generated a total of 588 HEDs. The

{ quality and quantity of these HEDs indicated that a systematic and complete i survey has been performee. The reviewers conclude that the licensee has met i the reguirement to conduct a control room survey as stated in Supplement I to NUREG-0737.

i 2.5 Assessment of HEDs to determine which are sianificant and should be corrected

HEDs should be assessed for significance. The potential for operator error

! and the consequence of that error in terms of plant safety should be system-l atically considered. Consideration of the combined effects of HEDs sn f g i

w T

'4 . .

a operator performance should be specifically included in the assessment -

process (e.g., the control room survey identified.a number of HEDs related to a particular display - all of those HEDs may affect the operator's ability to read that display). The result of the assessment process is a determination of which HEDs should be corrected because of their potential impact on plant safety. Decisions about whether HEDs are significant in terms of potential impact on plant safety should not be compromised by consideration of such issues as the means and potential cost of correcting those HEDs. ,

\

The assessment of HEDs generated by the previously described DCRDR activities was accomplished by the HED Assessment Team (HEDAT) composed of the lead HFS, the DCRDR coordinator, the I&C engineer, the Station Nuclear Engineering Department station project engineer, and the Station Assistant Superintendent for Operations. The team met and reviewed the HEDs. Based on team consensus, HEDs were classified into one of three categories (I, II, or III) based on the level of safety relatedness of the equipment in question. The HEDAT then determined to which of three levels (A, B, orc) of severity each HED should be assigned within each category using specified criteria relating factors described on page 5-3 of the Program Plan, including the plant safety implications of the HED. -

The HEDAT-assigned categories according to an HED's safety significance are as follows:

Category I: Discrepancies associated with engineered safeguard systems (ESS) or engineered safety features (ESF).

(

Category II: Discrepancies associated with plant systems not included r in Category I. .

l.

Category III: Discrepancies not falling into either Category I or II.

! The HEDAT assigned levels of severity as follows:

Level A: HEDs with documented errorr, with documented control-based problems or, in the judgment of the HEDAT, which .

10 f

t.

- +,. ,,w-. .-

, , , , - _ - N- ? - -------N,,

u. . - .

l

.. may have .a significant impact on plant safety and/or .

1 productivity. -

r Level B: HEDs 'which may have a moderate influence on plant per-formance (consequences may delay or impact the efficient l

operation of the plant, but not significantly)'.  !

Level C: HEDs with a relatively minimal impact on plant , perform-ance (consequence of human error will not lead to degraded plant safety system).

f First, the licensee's assessment process identified whether the discrepancy involves a plant safety system. Second, this process identified those discrepancies that have already occurred. Finally, the licensee addresses the consequences of the potential error on plant performance and safety <

rather than projects the probability of the error occurring. In the

. reviewers' judgment, this approach satisfies the criteria to assess HEDs.

As defined above, it appeared that the classification of Category I was only l

applicable if the deviation was associated with either ESF or ESS. This limitation presented a concern since systems other than ESF and ESS can impact plant safety. However, at the Quad Cities pre-implementation audit, Ceco indicated that all HEDs with plant safety implications as described in

the Final Safety Analysis Report (FSAR) and a numter of support systems l would be classified as Category I HEDs. Due to the extensive coordination between the Quad Cities and Dresden DCRDRs, this is true for Dresden as well.

Level assignment was the determining factor in the recommendation to correct HEDs. Ceco stated that HEDs in Level A should be corrected, while HEDs in Levels B and C may or may not be corrected, depending on their relative operational significance. Once assessed, personnel from the Station Opera-tions and Station Nuclear Engineering Departments met with the lead HFS, the i DCRDR coordinator, and the.I&C engineer to review the assessed HEDs and j decide which to correct. Those HEDs to be corrected were differentiated c

from those not to be corrected, and justifications for HEDs not to be l corrected were prepared. -

i 11 r

I

From a review of both the Program Plan and the Sumary Report assessment -

phase methodologies, certain differences were found. While the following differences were discussed in the August 1985 Sumary Report Evaluation, the NRC audit team indicated that further documentation by Ceco would be desirable for clarification. The licensee provided additional information in the Supplement to the Final Sumary Report that addresses these five differences delineated in the Sumary Report Evaluation for Dresden Station.

The NRC audit team comments and the clarification provided by Ceco on the above differences are documented as follows:

1. Comment: Provide the reasoning behind Ceco's switch from the rating system to be used during the assessment phase as presented on page 5-3 of the Program Plan to the consensus method that actually was used by CECO. -

CECO Response: A three-tier rating system was used for HEDs. A consensus format was used which facilitated the practical understanding of the impact each HED may have on operator performance. Each member contributed a unique perception to the HED which helped shape the opinion of the group based on cur guidelines. In this process, each member had equal opportunity to influence the final decision on every HED. Each member made individual decisions which were used as input to determine the

consensus rating of each HED.

2. Coment: Provide the reasoning why the pre-assessment form described on page 5-3 of the Program Plan and included in Appendix I

A of the Summary Report was not considered to be necessary and was not used by CECO.

The integration of materials onto the data base Ceco Response:

management system negated the need for a separate pre-assessment

[ form originally discussed. Code numbers representing specific

[

(human factors) problems and consequences were incorporated l directly on the HED form before the assessment.

i I .

I h

12 l

= * - .

3. Comment: Provide the reason why Ceco changed from the four-tiered -

level rating system of ABCD as presented on page 5-5 of the generic Program Plan to the three-tiered level rating of ABC used a by CECO.

l. CECO Response: The original rating system utilized four signifi-cance levels:

1*

Level A - HEDs which are documented errors.

, Level B - HEDs with an overall high significance rating.

Level C - HEDs with an overall moderate significance rating.

Level D - HEDs with an overall minimal significance rating.

Both Level A and B HEDs were deemed equally signif.icant.

Therefore, they were combined into a single level -

" Level A."

Level C and D HEDs were then renamed Levels B and C, respectively.

4. Comment: Provide assurances that cost factors will not impact decisions to correct HEDs as presented by Ceco at the audit -since this is contrary to the statements on page 7-2 of the Summary Report.

CECO Response: Safety significance and operator performance were the only criteria used to assess HEDs. Cost factors were not discussed during assessment. Cost factors necessarily are con-sidered and do affect the decision involved in evaluating the various options available for corrective actions.

5. Comment: Provide assurance that the audit team's understanding that benefit ratios will not be considered during the assessment phase since page 7-3 of the Summary Report indicates otherwise.

Ceco Response: Safety significance and operator performance were the only criteria used to assess HEDs. Benefit ratios were not discussed. Benefit ratios, however, do affect the decisions for

, corrective actions.

13

~ * ** .*

4 Based on the discussions at the Quad Cities audit and the above documenta- -

tion, the reviewers conclude that Ceco has satisfactorily resolved these

-differences in the assessment methodology.

During the Quad Cities audit, it was also noted that many HEDs were a '

cancelled by the HEDAT. If cancelled, the HED was dropped from the

. computerized data base and received no further processing. A subsequent audit of these cancelled HEDs revealed a weak link in the documentation system. The records of the HEDAT review process as to why certain changes and cancellations were made were.not complete. For instance, the cancelled HEDs were often noted " cancelled, not a HED" with no further explanation.

The record provided to the audit team was the rough notes of the Ceco DCRDR coordinator. The NRC indicated that if the same process was used at Dresden Station, more detailed minutes of all HEDAT reviews should be kept, noting

the disposition and reasons for actions taken on all HEDs.

In response to the above comment, Ceco submitted (in the Supplement to the Final Summary Report) the justification for cancelling thes'e HEDs.

. Originally, 20 HEDs were cancelled at Dresden Station. Of the 20 cancelled

HEDs, the licensee has reinstated six of these that have been assessed accordingly. The 14 remaining HEDs were presented in Appendix F of the

~

Supplement to the Final Summary Report. This material was reviewed and a j majority of the justifications were found to be acceptable. However, the justifications for cancelling three of the 14 remaining HEDs were determined to be inadequate and are discussed in Appendix B of this report.

During the assessment process, all HEDs were reviewed individually by the i HEDAT. Some of these HEDs were grouped together for presentation in the Summary Report. During the Quad Cities audit, it was noted that the categories and levels assigned to the grouped HEDs in the Summary Report frequently did not reflect the categorization and level of the most sig-nificant HED in the group. The worst case noted was a grouping of four HEDs either classified as IA or IB individually; however, when grouped, they were assigned the classification IIIC. The reviewers requested that if Dresden followed this practice, the licensee should review all grouped HEDs in the Summary Report for proper assignment of category and level.

In the Supple-ment to the Final Summary Report, Ceco ii.dicated that all HEDs have been -

p reviewed and grouped to reflect the correct categorization and level of the l

14

!,-. _ ' .. . m . .

most significant HED. A review of the affected HEDs indicates that the .

+ licensee has properly categorized grouped HEDs and has therefore satisfac-torily responded to the concern raised by the NRC.

Y In the reviewers' judgment, CECO has developed an acceptable process for HED assessment. However, the reviewers do not agree with Ceco's disposition of s the six HEDs listed in Appendix B of this report. In order to meet this

", requirement of Supplement I to NUREG-0737, the licensee should provide ,

assurance that those HEDs have been addressed by the assessment process and

~'

later elements of the DCRDR.

2.6 Selection of desian imorovements The purpose of selecting design improvements is as a minimum, to correct

! safety-significant HEDs. Selection of design improvements should include a systematic process for development and comparison of alternative means for resolving HEDs. Both enhancement and design modification may be considered. ,

i The selection of design improvements should work to bring the control room into agreement with acceptable human factors engineering guidelines. Exist-ing control room conventions (explicit or implicit) should be documented and reviewed for completeness of application and for conflicts with each other

[ and with accepted human factors engineering guidelines. HEDs may be I resolved by application of existing or revised control room conventions.

HEDs may also be resolved by explicit, new control room conventions which

[ should be developed and documented as part of the DCRDR process.

The Dresden Summary Report was incomplete in this aspect due to the large

( -

[ number of HEDs that were unresolved. The Summary Report indicated that many l studies and reviews designed to resolve HEDs were yet to be accomplished.

L The concern over the lack of progress in this phase of the DCRDR was trans-mitted to the licensee in the Summary Report Evaluation. The NRC indicated

(: that Ceco should document the details of the design packages that resulted I from these numerous reviews and studies. In response to the NRC request,

t. Ceco has presented in the Supplement to the Final Summary Report descrip-

[

tions of the control room design standards resulting from the completed

. studies and reviews:

e .

L.

15 e

e e

• ~$,~* . *

• i . f.

_-~~*" ! f ' ~ .' , ~._T*_.J n. . : ._ _ ,; N _~ _1_ _ u. -

e Abbreviation standard ,

e Control room labeling standard e Control room annunciator standard e Color coding standard e Background shading / demarcation / mimics  !

A review of the above control room design standards indicated that the majority conformed to the guidelines'of NUREG-0700. However, there were some concerns associated with the labeling and background shading /demarca-tion standards. According to the control room labeling standard, abbrevia-tions on labels should be five or less characters. However, there are several listings in the abbreviation standard that contained more than five characters. The licensee should review those abbreviations and the labeling standard to bring them into agreement. *

A concarn associated with the use of background shading for resolving HEDs was also ideatified. Independent of the number of colors used in .the licen-see's color-coding standard, which is within the NUREG-0700 color usage .

guidelines for enhancement (n-11), the background shading program introduces 4

23 additional colors that are associated with various systems found in the control room. Ceco's excessive use of color is unacceptable since it vio-lates the guidelines for color usage leading to a possible reduction in the effectiveness of this technique and possibly introducing operator confusion and errors. The licensee should reexamine the use of color, particularly in conjunction with the background shading at Dresden and provide assurance that the proposed applications will not be counterproductive. This concern

should be further addressed during the verification process.

?  :

A review of the standards for using lines of_ demarcation and mimics on the

! control panels raised a concern. While lines of demarcation are designed to

[ be 5/16" wide, mimic lines are specified to be 3/8" wide. The result is a negligible difference of 1/16" dimension which may lead to operator confu-sion. The licensee should resolve this problem.

In summary, the reviewers have serious concerns regarding several of the i proposed design improvements, including the excessive number of colors to be l introduced into the control room as a result of the color-coding background shading standards. The selection of design improvements should be carefully l

l 16

balanced 'with operations and engineering expertise as well as with human .

factors, expertise. Before the reviewers can conclude that Dresden's process for selecting design improvements is adequate and meets the requirement of Supplement I to NUREG-0737, the licensee must satisfy the concerns discussed above.

2.7 Verification that selected imorovements will orovide the necessary correction and will not introduce new HEDs .

A key criterion of DCRDR success is a consistent, coherent, and effective

. interface- between the operator and the control room. One good way to satisfy that criterion is through iteration of the processes of selection of design improvements, verification that selected design improvements will provide the necessary correction, and verification that improvements. will not introduce new HEDs. The verification processes should be completed j- prior to implementation of design improvements in the control room. Excep-tions might be workspace/ environmental HEDs for which " final verification" (i.e., final adjustment) may have to wait implementation of the design improvement in the control room. Techniques for the verification process might include partial resurveys on mock-up panels, applied experiments, engineering analyses, environmental surveys, and operator interviews. Each iteration of the selection and verification processes should reduce incon-sistencies in the operator-control room interface while increasing the coherence and effectiveness of that interface. The consistency, coherence, and effectiveness of the entire operator-control room interface is important to operator performance. Thus, evaluation of both the changed and unchanged portions of the control room is necessary during the verification processes.

In the Summary Report, CECO described a process which will provide verifica-tion of the effectiveness of corrective actions. Verification will be

performed using panel mock-ups incorporating the corrective actions, consul-tation with operators and systems experts, HFS reviews, and possible use of the control room simulator. Should verification show that a corrective action will have a negative effect on control room operations, the correc-tive action will be cancelled or altered as appropriate. If a corrective action is verified to correct an HED effectively without introducing another -

l HED, it may then be implemented in the control room.

17 i

~~ '

i_____._._,_.f_....___._.______._._____.______.

l The Summary Report Evaluation indicated that this verification process, when .

accomplished, should meet the requirement of Supplement I to NUREG-0737-However, having reviewed the proposed use of color and background shading, the reviewers are concerned that the techniques proposed for the verifica-tion process may have not-been applied in a manner that should result in a thorough process. First, it is strongly recommended that design improve-

. ments be verified as a package to the extent possible, to obtain a better overall picture of the effectiveness of the design improvements. Second, it ,

is particularly important that the verification be systematic.

In order to meet this requirement of Supplement I to NUREG-0737, the licen-see should demonstrate that a formal, systematic, and criterion-based veri-fication process was used to employ the techniques described by Ceco. Given the concerns raised in Section 2.6, this iterative process should pay par-ticular attention to the proposed use of color to improve the effectiveness of the control room. .

2.8 Coordination of control room imorovements with chanaes from other oroarams such as the safety carameter disolav system. ooerator train-inc. Reo. Guide 1.97 instrumentation. and unaraded emeraency ooeratino orocedures

i i

2.8.1 Reo. Guide 1.97 and the safety oarameter disolav system (SPDS)

Improvement of emergency response capability requires coordination of the DCRDR with other activities. Satisfaction of Reg. Guide 1.97 requirements and addition of the SPDS will require modifications and additions to the

( control room. Those modifications and additions should be specifically j addressed by the DCRDR. Exactly how they are addressed will depend on a l' number of factors including the relative timing of various emergency response capability upgrades. Regardless of the means for coordination, the result should be integration of Reg. Guide 1.97 instrumentation and SPDS equipment into a consistent, coherent, and effective control room interface with the operators.

According to the Dresden Summary Report, Reg. Guide 1.97-based instrument displays, design of the SPDS, and the DCRDR are being integrated with .

respect to the overall improvement of the operators' ability to comprehend 18

I plant conditions and cope with emergencies. However, the Summary Report did -

not provide any details concerning the integration. At the June 1985 Quad Cities' pre-implementation audit, Ceco presented a well-organized Project Activities Network diagram which illustrated the Station's coordination program. The audit team retiewed this coordination chart, and concluded that it was an acceptable tool for performing the coordination efforts.

. Consequently, the NRC requested that a similar document be submitted to facilitate the review process. However, in the Supplement to the Final Summary Report, CECc explained that the coordination diagram would not be submitted to 'the NRC because it was developed as an in-house documentation working tool and is subjected to constant upgrade and revision.

At the June 1986 pre-implementation audit conducted at LaSalle, another CECO plant with a similar DCRDR program, CECO indicated that the DCRDR function and task analysis will serve as the link between the DCRDR and both the SPDS and Reg. Guide 1.97. The function and task analysis will serve as the basis for. verifying the parameter selection and display design of the SPDS. Addi-tionally, Reg. Guide 1.97 instrumentation will be compared with the require-ments identified in the task analysis. Dresden DCRDR team members present

. at the LaSalle audit indicated that the same practices have been followed at l

Dresden. Based on the information presented in the Summary Report and at the Quad Cities and LaSalle audits, and due to the extensive coordination j between DCRDR efforts, it appears to the reviewers that the SPDS and Reg.

[ Guide 1.97 instrumentation will be effectively coordinated with the control room improvements resulting from the DCRDR.

7 2.8.2 .Uparaded E0Ps l

Ideally coordination of the DCRDR with upgrade of the E0Ps should begin with f a detailed task analysis which supports both. Coordination of the DCRDR and upgrade of the E0Ps, which begins with the generic emergency response guide-

! lines developed by the owners' group, is also possible. The result of coor-

! dinating the DCRDR with upgrade of the E0Ps should be a control room which supports complete and technically adequate E0Ps.

The Summary Report indicated that the corrective action modifications resulting from the DCRDR will be evaluated for their effects on the .

upgrading of E0Ps. Additionally, the results of the function and task 19

- - - . ..~.,-,....b._-__,_ .._-,,,.-....._dj,_,mr_

_[ * * $~_ !.,1" , _

-,__d-,*...L, [__ ,. , . ; I,.,,_.w. -_j',.._

y -.-m

_. 2 J _ _ _

_.-r

analysis will be used to verify the completeness of the E0Ps. At the .

June 1986 LaSalle audit, Ceco stated that the function and task analysis and the E0P upgrade had the same starting point--both began with the Rev. 3 BWROG EPGs. . Ceco further stated that it intends to verify that the informa-tion and control requirements are the same for the E0Ps and the control room. Dresden representatives indicated that this has been verified at Dresden and that differences between the information and control require-ments for the E0Ps and those for the control room were identified. The '

representatives also stated that these differences usually result in changes to the control room. -In order to satisfy this aspect of the coordination requirement, the licensee should provide assurance that any changes to the

[ control room as a result of these differences will be included in the DCRDR process.

2.8.3 Trainina-

. There are two aspects to coordination of the DCRDR with training. One is the use of training to resolve HEDs. The other is to familiarize operators with control room modifications and enhancement, which may be quite exten-sive. The result should be operators who are thoroughly familiar with their revised control room interface and who have the specific knowledge necessary I to deal with HEDs which are appropriately resolved by training.

The Summary Report states that the corrective action modifications resulting ,

from the DCRDR will be evaluated for their effects on operator training.

Provisions will be made for operator retraining when necessary to reflect

. the physical changes made in the control room. At. the LaSalle pre-implementation audit, Ceco further clarified this coordination by indicating that the control room modifications package is reviewed by senior operations and engineering personnel, and items that require additional /special training are flagged. The control room modifications package is also sent

l. to training, and changes are made to the simulators accordingly. Ceco should provide assurance that changes to the simulator will not result in delaying the implementation of corrective action modifications in the

[ control room.

In summary, information provided in the Summary Report and at the Quad .

Cities and LaSalle pre-implementation audits indicates that Ceco has a 20

+,,yw-,,-m

+-w g- ww pym w w.- -g.--,,_,w-a- +w_ M"---- Wy 7-*-----v--e- '===eww e_ _ -

coordinated program in place at Dresden to address each of the Supplement 1 .

to NUREG-0737 initiatives. However, the licensee should provide assuranct

that' changes- to the control room resulting from differences between the information and control requirements for the E0Ps and those for the control

. room will be included in the DCRDR process. In order to meet the Supplement 1 to NUREG-0737 requirement to coordinate control room

'.' improvements with changes from other improvement prngrams, the licensee should provide the requested assurance. .

l

?

. 2.9 Other DCRDR activities

'. Licensees and applicants may perform other DCRDR activities to supplement those required by Supplement I to NUREG-0737. Results of those activities should augment those of the required activities. .

2.9.1 Operatino exoerience review.

Ceco conducted a two-part operating experience review (OER) at Dresden to identify conditions which impact probability of operator errors which could

affect safe operation of the plant. A review of operating experience is not explicitly required by NUREG-0737, Supplement 1. However, it is an_ activity recommended by NUREG-0700 as contributing to the accomplishment of review

', phase objectives.

The first part of the effort, the historical event review, included a review of the operating history of the plant to document recurring problems and an examination of generic industry-wide problems applicable to the plant. Five sources of historical reports were collected and reviewed. In-house docu-mentation, including Dresden Licensee Event Reports, Dresden Deviation Reports, and Dresden Professional Committee Reports for six years, were i reviewed by an HFS. Industry-wide Significant Event Reports and Significant Operating Event Reports for the past five years also were reviewed by the

HFS. All reports collected were reviewed to identify those reports that

' involved control room operator errors, procedural and/or control board l equipment failure, and/or design arrangement errors.

Criteria were developed to identify and prioritize those reports which -

documented a control room problem as defined by specified criteria. Each l 21

-w- , - . - . -- ., ,,n , - - - - - - . . . - - , - - . , ,.,-.-,----,,,-n - -

high priority report that described a problem relevant to the control room -

was investigated to determine whether the problem already had been ade'-

quately addressed from a human factors perspecto . If the problem had not been adequately addressed and additional human engineering corrective action could be taken to minimize the probability of the problem recurring, a control room HED form was completed. Using this process, six HEDs were written from a review of 1500 reports.

The second part of the OER was an operator survey. The survey entailed administration of an open-ended, self-administered questionnaire to staff

. members, including nonlicensed operations personnel, licensed operations personnel, and licensed nonoperations personnel at Dresden. The sorvey was structured to address the nine content areas suggested in NUREG-0700. Of ninety-one surveys mailed out, thirty-eight (41%) were returned by mail to CECO and given to the HFS unopened. Confidentiality was ensured by assign-ing each questionnaire a number. The list of potential respondents and corresponding numbers was kept in confidence by HFS personnel.

As some information relevant to operator experience could not be solicited, easily by using a structured questionnaire approach, individual semistructured interviews also were conducted by the HFS with selected plant personnel. The objectives of ihe follow-up interviews were (1) to clarify ambiguities in an individual's written responses to the self-administered questionnaire; and (2) to gathe additional details pertaining to that individual's responses. Once interview data were collected, all information from the completed survey activities were compiled, reduced, and analyzed.

Findings, written as prospective HEDs, were reviewed later during the assessment process. Forty-three HEDs were identified as a result of the survey activities.

! In summary, Ceco's OER at Dresden was consistent with NUREG-0700 objectives l and guidelines. The two activities conducted resulted in the identification of 49 HEDs which were not identified as a result of other DCRDR activities.

In the reviewers' judgment, the OER contributed to the success of the l Dresden DCRDR.

22 l

,P ,

2.9.2 Review of remote shutdown facilitiei ,

Although not explicitly identified as a requirement in Supplement I to NUREG-0737, inclusion of a human engineering evaluation of the remote shut-down capability, within the scope of the DCRDR, has been recommended by the NRC. It was noted that the remote shutdown capability was not considered as part of the CECO review at Dresden. The review of this capability centri-E butes to the success of the DCRDR by improving control room design and operator effectiveness during abnormal or emergency conditions as might be experienced at the remote shutdown. In light of these benefits, the SAIC reviewers recommend that CECO consider a review of the remote shutdown capability using human factors engineering guidelines accepted by the NRC.

2.10 DCRDR 'results A Summary Report is to be submitted at the end of the DCRDR. As a minimum it shall:

1. Outline proposed control room changes

2. Outline proposed schedules for implementation

3. Provide sumary justifications for HEDs with safety significance to be left uncorrected or partially corrected.

Modification of the control room configuration should contribute to a signi-ficant reduction of risk and enhancement in the safety of operation. Long-term risk reduction should be considered as should. the potential for

! temporary declines in safety after modification due to the need for relearn-l ing. Means to combat temporary declines should be included as part of the implementation plan.

2.10.1 Control room imorovements and .iustifications for not correctina or oniv oartially correctina sianificant HEDs HEDs identified during the DCRDR were presented in Volume 2, Sections 1-13

[ of the Sumary Report. SAIC reviewed these HEDs and indicated in the 1985 l Sumary Report Evaluation that the original Sumary Report did not provide l proposed resolutions to many HEDs and that some of the justifications for not correcting HEDs were inadequate. To resolve these concerns, SAIC 23 i

[

requested the licen:ee to document the additional required information in a -

supplement to the Summary Report. The revised submission is organized into four parts:

1 e Part 1 - Corrective Actions Completed J e Part 2 - Reclassified HEDs (from cancelled) e Part 3 - Response Modified e Part 4 - orrective Action Accepted by NRC. .

4 The HEDs presented in these four parts of the revised Volume 2 (Vol. 2, Rev.

_1) were reviewed. While many HED resolutions were found to be acceptable, a significant number of HEDs previously evaluated as unacceptable were inade-quately addressed. As a result, these HEDs still require additional clari-t fication before they can be satisfactorily resolved. Appendix D of this report contains the complete list of HEDs for which proposed corrective actions, or justifications for not correcting, were found to be inadequate.

2.10.2 Imolementation schedules for imolementina HED correctioni Proposed schedules for implementing HED corrections were provided in the cover letter which accompanied the Summary Report when it was transmitted to the NRC. As cited in that letter, proposed schedules are predicated upon NRC approval of CECO's disposition of each of the HEDs as the schedule is sensitive to the size of the current scope of work. The schedules are subject to the availability of equipment, outage dates, and engineering

[ design lead time. Finally, the impact of Reg. Guide 1.97 was not factored into the' schedules. As a result, the proposed schedules submitted will be

[

l finalized after receipt of NRC input and completion of the Reg. Guide 1.97 review.

l li As proposed, the schedules for completion of the corr'ective actions have been designated as the completion of the first refueling outage or the second refueling outage for Dresden Station Units 2 and 3. Ceco identifies September 1986 and March 1988 refueling outages as the expected first and second dates for installation of DCRDR modifications at Unit 2. October l 1987 and April 1989 are the anticipated refueling outage dates for installation of modifications at Unit 3.

( 24 l:

L

-  :- = = = = ._

l l

l Appendix C lists HEDs where the schedule for implementing the proposed -

l corrective action appears to be inappropriately delayed. The majority of 1 these HEDs address either safety-significant problems or describe examples of inadequate labeling which may lead to operator confusion.. While the licensee has committed to correct these HEDs, the implementation is not scheduled to be completed until the end of the second refueling outage.

Supplement 1 to NUREG-0737 indicates that improvements involving enhancement programs should be done promptly. Additionally, corrections for safety-significant HEDs should be given priority for implementation. In light of these considerations, the licensee should revaluate the implementation of the:e HEDs and consider an accelerated implementation. .

3. CONCLUSION I The DCRDR for Dresden Station is incomplete. In SAIC's judgment, completion

of several activities is essential for satisfaction of the DCRDR requirements in Supplement I to NUREG-0737. Those activities are

1. Assessment of HEDs to determine which are significant and should be corrected.

^

a. Provide assurance that the three " cancelled" HEDs listed in Appendix B of this report will be reinstated and addressed by the assessment process and later elements of the DCRDR.

I 2. Selection of design improvements,

a. Reduce the excessive use of color in the control room, particularly the background shading and color padding.

b. Bring abbreviations and labeling standards into agreement.

L c. Resolve the problem that exists with the present design widths of lines of demarcation and mimics.

d 25 L_ _ ::-_ r r _ _ : - - . - -- . . . - - _ _ - .- -

D

3. Verification that sekected improvements will provide the necessary

~

correction and will not introduce new HEDs. -

a. Demonstrate that the verification proces. Ivas formalized and systematically applied to verify the appropriateness of all HED resolutions.

. 4. Coordination of control room improvements with changes from other ,

o programs such as Safety Parameter Display System, operator

training, Reg. Guide 1.97 instrumentation, and upgraded emergency operating procedures.

a. Provide assurance that changes to the control room resulting from differences between the information and control requirements for the E0Ps and those for the control room will be included in the DCRDR process.

b. Provide assurance that modifications to the simulator for training operators will not produce delays in upgrading the control room. ,

1

5. Other.

a. Consider conducting a human factors engineering review of the remote shutdown capability.

6. DCRDR results.

a. Resolve the inadequacies in the proposed control room improvements and the justifications for not taking corrective action for the HEDs specified in Appendix 0 of this report.

[

b. Provide assurance that the HED corrective actions listed in Appendix C of this report will be reevaluated for implementa-tion by the first refueling outage.

Evaluation of the Dresden DCRDR should continue until the completion of the .

above activities.

1 26 Tm'- r*^ --*v m- ase -- 'er-Nw--'-wP---e-=-*-"-*--'N-----T'*--------r-7-------w'-n-----w-d-T'-r-mnw--m'T *-WNf7-tM- - -+w-me - W*

REFERENCES .

1

" Commonwealth Edison Company Dresden Station, Units 2 and 3 Detailed Control

], Room Design Review Final Summary Report - Supplement 1," Commonwealth Edison Company, February 1986.

. " Generic Detailed Control Room Design Review Project Program Plan for Commonwealth Edison Company," Section 1-3 of Attachment to letter to H.R.

Denton from C. Reed, Commonwealth Edison Company, RE: Response to Generic Letter No. 82-33, April 14, 1983.

"NRC Staff Comments on the Commonwealth Edison Company Generic Detailed Control Room Design Review Project Program Plan," July 11, 1983.

" Commonwealth Edison Company Dresden Station, Units 2 and 3 Detailed Control Room Design Review Final Summary Report," Commonwealth Edison Company, May 1985.

t

" Detailed Control Room Design Review Summary Report Evaluation for Dresden Station, Units 2 and 3," Science Applications International Corporation, August 30, 1985.

" Audit Report of the Detailed Control Room Design Review for Quad Cities Station, Units I and 2," Science Applications International Corporation,

, August 5, 1985.

NUREG-0737, " Requirements for Emergency Response Capability," USNRC, Washington, D.C., November 1980 1 l'

p NUREG-0737, Supplement 1, " Requirements for Emergency Response Capability,"

i USNRC, Washington, D.C., December 1982, transmitted to reactor licensees via

(. Generic Letter 82-33, December 17, 1982 NUREG-0700, " Guidelines for Control Room Design Reviews," USNRC, Washington, D.C., September 1981.

NUREG-0800, " Evaluation Criteria for Detailad Control Room Design Review," ~

USNRC, October 1981.

27 l . _ _ . ,

- , - - - -, ,--~- . .r-,--~-,-.-+----<--- r - <- .<- ---,------r- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

l APPENDIX A

', NRC COMENTS ON THE DIFFERENCES BETWEEN -

NUREG-0700 GUIDELINES AND Ceco CHECKLIST o

9 e

L 0

I-2 9

4 28

"

• 4

• 6ep

--.--..%,_-- - - - _ _ - _ . , - , , - , .m.,--,, ,,.,-,, ,,- - , - .

• _. ._,-_.-.,..,.,3_ -, -y,,,w.,y .y y .-.--.---y,y.-. , . . , - . _ , -p, - - .- .,-- - ..

O The audit team disagrees with the modifications made by Ceco on th,e three NUREG-0700 guidelines discussed below:

F 1.2.3.D.2 0700 Other controls may be mounted as far back as 25 inches from

. the console edge. This distance accommodates the extended functional reach of the 5th percentile as defined.

q Ceco Controls are no more than 30 inches from the console edge.

JUSTIFICATION:

The extended functional reach of 5th percentile female is 28.9 inches without stretching. Locating controls 30 inches from the console edge is realistic in that most operators exceed the value of the 5th percentile female, i' and they will tend to bend slightly over the console to manipulate controls.'

, TEAM POSITION:

Extended functional reach is measured from a wall to the L tip of the right index finger with the arm extended and the l right shoulder extended out from the wall as far as possi-ble with the left shoulder against the wall. In order to minimize the potential for inadvertent activation of controls, the operator should not be forced to lean over the benchboard to operate controls on the back portion.

Since the measurement referred to in the guideline is taken i from the front edge of the benchboard, it is not equivalent to the extended functional reach measurement. In fact, it l- is 8 to 10 inches less than an extended functional reach.

At 25 inches foi control board depth, the guideline of NUREG-0700 has already accounted for some amount of bending ,

by 2011 operaters.

1.2.3.F.1 0700 For control and monitoring actions that must occur in sequence, all necessary controls and displays should be within the maximum extended reach and the viewing range of the seated operator from a single reference point. *!

29

• - ' ~ ~~

• e o O

1.2.3.F.2 0700 For the situation described in Item 1 above, and (for) .

sustained or precise control action, the operator should be )

able to reach the controls without having to bend / stretch significan'tly. l 4

CECO For the situation described in Item 1 above, and sustained or precise control action is required, the controls are within 29 inches.

9 JUSTIFICATION:

The extended reach for 5th percentile female is 28.9 inches without bending or stretching. By bending slightly she can reach the 29 inches. This limit more clearly quantifies the criteria. .

TEAM POSITION:

As in the previous guidelines (1.2.3.D.2), if a measurement could be used, the guideline would probably be that controls should not be farther than 25 inches from the front edge of the console. The reason a measurement was not used is that, depending on the task difficulty and duration, 25 inches may be too great a distance to reach.

3.2.1 C 0700 LIMITS - The signal should capture the operator's attention but should not cause irritation or a startled reaction.

CECO LIMITS - The signal intensity does not ' exceed 90 dB(A).

JUSTIFICATION:

The establishment of 90 dB(A) provides a standard to be utilized across all Ceco stations. This standard does not exceed the maximum intensity of 90-115 dB(A) found in Guidelines 2.2.6.C for maximum intensity for signals.

TEAM POSITION:

If a quantitative value were to be specified, it should be some maximum value over ambient noise level, not an -

absolute value of 90 dB(A). Depending on the ambient noise 30

- - -_ z _-__1::-- .- - _ . . . - - - _ _ _ _ _ - - - - - - _ - _ _

level, 90 dB(A) may startle or cause irritation to the -

operator. In addition, intensity is not the only signal quality that might startle or cause irritation.

'l k

.E S

9 0

e e

31

APPENDIX B COMMENTS RESULTING FROM THE REVIEW OF' THREE CANCELLED HEDs 4

4 e

B e

9 9

e 32

I

• O

Appendix F of the Supplement I to Volume 1 of the DCRDR Summary Report -

j presents the 14 HEDs that were cancelled as a result of further review by the HEDAT' which showed that the HED was not actually discrepant from the given criteria. Duplicate HEDs were also included in this list. These HEDs were reviewed and the following need to be addressed further.

HED Index No. 0318. naae F-5: This HED indicates that the setpoint for j the moisture separator tank hi-hi alarm does not provide the operators adequate time to respond before a serious problem develops. Ceco's response is that there are moisture separator tank high alarms on panel 90X-6 in the control room which give the operator advance warning

[

before hi-hi alarms are activated. The licensee needs to indicate what the time difference is between the high alarms and the hi-hi alarms and that this period of time is adequate for the operato'rs to

, perform corrective actions. In addition, the licensee should indicate j whether there is a procedure th'at will cue the operator into the l appropriate operation mode.

l-HED Index No. 0511. nace F-10: This HED indicates that during the j verification of task performance capabilities, switches were identified that did not have indicating lights. CECO's justification for cancel-i ing this HED is that the " switch positions are well labeled and provide sufficient indication. Indication lights are not necessary." This

?

response contradicts the HED finding that these switches need indica-tion lights. The licensee needs to justify its position further as to why the indicator lights are not needed.

HED Index No. 0538. naae F-13: This HED indicate that the main steam line flaw meters are in 10 pounds 6 per hour. However, it was suggested l that the meters be in % flow. Ceco's response is that all references to steam flow and feed flow in the control room are in pounds per hour.

1 The' reviewers have several concerns with the justification for cancel-

! ing this HED. First, Ceco did not indicate why the meters should be in i  % flow. The second concern is whether Ceco's response that all refer-ences to steam and feed flow in the control room are in pounds per hour include the emergency operating procedures and technical specifica-l

• tions. The licensee should respond to these two concerns.

l-33 i

- - + - . , . . ..

- ~ . _ _ _ _ _ . _ _ _ . , , _ _ _ _ _ _ . . , . . _ _ _ _ _ _ _ _.._ _ __

i i

i

@

• APPENDIX C 4

HEDs FOR MHICH THE PROPOSED

~ IMPLEMENTATION SCHEDULES MERE FOUND TO BE UNACCEPTABLE e

l .

f 4

0 I

. e 6

4 e

e f

4 4

4 34 i

I

---

v------.__. , _ _ . , __

HED corrective actions that need to be reevaluated for implementation .

by completion of the first refueling outage. If the licensee determines that it is not necessary to implement the corrective action by the first refueling outage, a satisfactory justification should be provided.

HED Index No. Eggg Comment 0507, 0593 05 Discrepant annunciator 0164 110 Category 1A 0518 154 Category IB 0521 156 Category IB

0522 157 Category IB 0527, 0601 161 Category IB 0537 164 Category IB .

0210 171 Category IB 0305 178 Category IB

. 0143 181 Easy to fix 0564 195 Category IB 0554 197 Category IB 0552 199 Category IB 0035, 0018, 210 Temporary labels which can be easily i

0066, 0056 removed by accident 0037 213 Category IB 0460, 0207 218 No labels describing primary function of equipment

}i 0073 222 Labeling associated with the service l .

air header meter should be cor.ected l by first refueling outage.

t 0041, 0071, 226 Inconsistent nomenclature between 0023 labels and procedures for LPCI operation 0189, 0188 231 No indication of switch positions 0045, 0187, 232 No indication of switch positions or 0059 of switch movement

0355 240 While a Category 2B HED, this source of l operator problems should be corrected.

35

. , . . , , - , , - - - , - - - - - - - - - - ' - ~ ~ - * " ' ~ - ~ ~ ~ ~ ~ ~ ~ " ' ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ' ~ ~

. l l

l HED Index No. Eigt Coment .

0052, 0031 242 Permanent labels are presently obscured by temporary labels. The corrective action should not wait until the second refueling.

0433 253 Category IB

. 0572 304 Category IB e

e 6

4 I

4 e

• , Q G

4 36

-~

...--._,:__. .=___- - - . = - . _ .._..:_..==:...-.. .- .=

i' APPENDIX D HEDs FOR WHICH CORRECTIVE ACTIONS OR ,

JUSTIFICATIONS FOR NONCORRECTION WERE PROPOSED BUT WERE FOUND TO BE INADEQUATE t

D

/

e s

+

6 e

37 4

...e.... . ~ -.

D1. The description of the ' proposed corrective action is too' brief, .

ambiguous, or general to allow an adequate evaluation to be made.

HED Index Nos. 0208. 0090. 0209. naae 86: The discrepancy described is that the background noise levels in the prinsary operating area exceed the recommended level of 65 dB(A). Ceco's response is that the ambient noise level will be reduced using noise-attenuating techniques and

^

' materials on sources of noise emissions. -Although CECO intends to correct this HED, it neither specifies what noise-attenuating techni-ques and materials will be employed to reduce ambient noise levels, nor specifies the sources of the noise emissions.' The licensee further 4

indicates that due to the complexity of the? required modifications, additional time will be needed to design and implement the corrective action. Ceco should provide a description of the techniques and mater-tals to be used to correct this HED.

J HED Index No. 0500. naae 28: The discrepancy described is that there is no indication for reactor water temperature during some emergency I

conditions. The response from Ceco is that the present method of determining reactor water temperature from reactor pressure and steam tables is sufficient. Furthermore, a cooldown table has been added to

. DEP 100-2 to aid the operator in determining necessary temperature for

calculating the cooldown rate and will be permanently labeled on panel d

90X-4. The review team is concerned that the operators may not have

] enough time to use the table in an emergency situation. Moreover, if -

[ an error were made during the calculations, what would be the effect on operator decision making and would there be sufficient time to recover?

! Questions concerning time criticality and effects of operator error on

{ the plant need to be satisfactorily addressed before accepting CECO's response to this Category IB HED.

)

i HED Index Nos. P.Agg 0514, 0606, 0609, 0618 150 l

0515, 0610 151 0516 152 0518 154 -

0520, 0599 155 i . 38  ;

1 a

I. . . .. . - . . . ,

HED Index Nos. Eggg

~

'0522 157 0523, 0524, 0597, 0525, 0600 158 0525, 0608 159 0526 160

' 0527, 0601 161 0528 162 ,

0529 163

.I

^

For the above HEDs, the licensee's responses are too general to fully

, address the discrepancies found so the NRC can adequately evaluate the final dispositions. The licensee should provide a description of the techniques and materials used to correct each individual HED. .

D2. The proposed corrective action only partially corrects the discrepancy.

HED Index No. 0517. naae 153: This HED indicates that the clean-up blowdown flow controllers have demand meters that lack units and response meters for actual valve position. While units will be added to the demand meters, Ceco does not address the lack of response meters for actual valve position. The licensee should resolve this discrep-ancy.

HED Index No. 0096 Paae 63:

Containment pressure 8 monitor is too far below (23 inches) the NUREG-0700 criterion. The proposed corrective solution is to move the recorder label onto the bezel, yet this does not make it easier to read the display. While the licensee indicates there is no history of readability problems, the low height of this Category I recorder (18 inches above the floor) is inappropriate. The licensee should consider relocating this recorder to a higher level.

D3. Acceptance of the proposed corrective actions for the HEDs is dependent upon the licensee's successful resolution of the NRC review team's concerns with the following programs: .

39

• • • • m' + . . - . . . . . , . . , , , , , , ,

. ~ _ _ _ _ _

o Color coding ,

o Labeling o Demarcat' ion / background shading

These concerns are discussed in the text of this report. Resolutions to these concerns should then be applied to the following HEDs.

HED Index No. Eggg HED Index No. Eggg I

L 0436 190 0373 278 0039, 0021, 0069 224 0167 279 s 0055, 0056 249 0168 280 0032 250 0448, 0202, 0483 281 0185, 0077 254 0463, 0209, 0484 282 0058 257 0179 283 0034 258 0170 288 289 0063 259 0173 0186 260 0171 293 0078 261 0376 294 0178 264 0172 295 0371 267 0403 298

- 0444 277 0217 306 D4. The justification for not correcting the HED and/or the description of the discrepancy is too brief, ambiguous, general or does not cover all cases, to allow an adequate evaluation to be made.

L HED Index No. 0231. naae 90: This HED indicates a lack of localization 4 cues for the annunciator warning system. Ceco's response is that multiple coding techniques are used for the annunciators including sound localization and visual cues. If these coding techniques are used in an effective manner, how was this HED identified? This problem L

was also cited during the operator survey (HED Index No. 0368, pg.

$ 104).

1 r ..

40

[

7

{.

t . _ . . . . _

The following HEDs were identified as having a similar concern:

HED Index No. Eggg Concern 0505 24 If manual HPCI operation is ever required by operators (e.g. when auto fails), an on-off position indication will be required 0233, 0108, 92 Contradictory response referencing , auditory 0237, 0191 coding techniques

~0368 104 Contradictory response referencing auditory

coding techniques 0435 166 Contradictory response; operators indicated a lack of positive feedback 0237 , 188 What colors are involved and is it '

possible for both lights to be on simultane-ously; if both lights come on and not enough ,

contrast, split legend light into two

05. The basis for the justification is not adequate for one or more of the i following reasons:

1. It does not address operational or behavioral factors or issues.

2 It does not sufficiently address the discrepancy.

. 3. It cites absence or previous operator error.

. 4. It cites utility, industry, or manufacturer's standard.

t l . HED Index No. 0097. nace 64: This category 1/C discrepancy cites

(~ radiation monitoring recorders that are 18.5 inches above the floor

'l (22.5 inches below the guidelines). The licensee states that the " low" y height does not pose any potential problem since they are recorders

[ with glass doors. Frathermore, operators can stoop if needed; yet this p minor inconvenience does not impact performance. While this discrep-l- ancy has not. caused any previous operator errors, the review team does l- not concur that such a significant deviation from the guidelines should l be left uncorrected. This recorder should be relocated within NUREG-l- 0700 guidance.

41 l

. 4

.I . .- . - . . - . . _ . . . .. ..

The following HEDs have been cited for similar problems. -

- HED Index No. Eggg Concern 0497 31 Operators need to know the status of the ,

. core spray area sump pump.s since they are part of a safety system. CEC should provide indication that pump has tripped. .

0486 37 Does excess movement between panels not affect operator performance?; If it does and this is time critical, resolve this HED.

0083 58 Category 1/C switches located 18 inches above floor; relocate to within guidelines 0434 100 Requires reflash. .

0339 102 Does time permit operator to reference.

procedures; if not, reconsider prioritiza-tion of alarms.

0180, 0069 141 A temporary fix at best; provide a more permanent solution; tape is not acceptable because it does not prevent going beyond end of selector range.

0129 146 Unidentified Category 1 thumbuster controls are one-half the recommended height; recom-mend that the utility provide controls con-forming to NUREG-0700 guidelines.

0359 183 Operators indicate that the procedure is ineffective; improve procedure to replace full core display lights 0385 271 This is inconsistent use of color coding;

should be corrected.

42

• e- e ese mise g, h + r ,y- --g-e-e+--- ----qe- -v--w&.r-=g -,y ---ry-m --~---.y-w.-.m,yr, - -- --

D6. Additional HED concerns. .

e HEDs where corrective actions have been' completed but the response is inadequate.

{* HED Index No. 0551. naan 11: This HED indicates that switch posi-tions and labels for the hydrogen addition system channel A (and B) selector switches are temporary (dyno-tape) as opposed to perma-nent. Ceco's response in the Summary Report was that the' controls

. and positions would be relabeled. In the Supplement to the Summary Report, Ceco states that the panel has been removed but did not indicate the new location of the panel or whether the replacement panel conforms to the human factors guidelines in Section 6 of NUREG-0700. If a replacement panel was not installed, the 11,censee should justify the absence of these component functions in the control room. Additional information is needed to provide assurance that this HED is satisfactorily resolved.

HED Index No. 0366. Daae 13: This operator survey-generated HED indicates that the computer system does not provide operators with five operating " aid" features they require. While three of the five discrepancies have been satisfactorily resolved, Ceco did not address the discrepancies related to drywell sump leakage rates and powerplex trend outputs. The licensee should address these two discrepancies.

t

. . e Thr'ee HEDs are associated with problems concerning dual mirror-

, imaged control rooms. Responses to two of the HEDs (Index Nos.

0583 and 0584, page 80) indicated that while "the panel arrange-

, ments across unit 2 and 3 are mirrored, the actual systems, with few exceptions are not." However, as described by HED No. 0364 (page 290), the location of components on the panels is not con-sistent: "What is on the right of a panel on Unit 2 is on the left side of the same panel on Unit 3." This appears to indicate that some panels are mirror-imaged across units. The licensee should clarify the inconsistency cited in the above HEDs. If there is a

, discrepancy resulting from the dual mirror-imaged control rooms, .

the licensee should resolve it accordingly. Additionally, the l l

43 l I

. l

. licensee should reexamine the use of color-coded guardrails to "

ensure that the proposed application is necessary and will not be counterproductive.

e Thefo1IowingHEDshaveadescription, response,and/orimplementa-

, tion that has been modified since the Summary Report. The licensee

-s should provide justifications for these modifications to the NRC.

HED Index No. Eggg Concern 0506 96 Modification of finding, response, and implementation 0446 126 Modification of response e The justification for not correcting the following HEDs does not consider the cumulative or interactive effect of other HEDs.

Reevaluate pushbuttons for cumulative / interactive effect of the discrepancies described below.

HED Index No. Eggg Concern 0110 128 Pushbuttons too small 0209, 0089 l'M Pushbuttons too hard to depress l 0121 136 Pushbuttons too close together 0388 297 Too many pushbuttons 0390 301 Matrix axes not labeled

, i l e The resolutions for the following HEDs include the use of an ergo-I nomically' designed stepladder. These discrepancies represent

controls and/or displays located beyond the specified height criterion. The reviewers have several concerns associated with the use of a stepladder to manipulate and view controls and displays.

First, if a particular action is time critical, operators may not

have or take the time to use the stepladder. Second, it is not clear how many stepladders will be present in the control room.

Given the number of HED resolutions that include the provision of a

l. stepladder and the locations of the panels involved, it appears .

that there could be a number of stepladders present in the control l

44

• * * ** = = +

F en= m e w g ,

f i

room. In contrast, if there are a limited number of stepladders _ '

available, a single stepladder could be needed simultaneously at two separate locations. A third concern is related to the storage

. of the stepladders. If the stepladdars are not stored properly, they could pose a hazard in the control room. At the same time, the stepladders must be readily available for use by the operators.

M One final problem associated with the use of stepladders is the potential for damage to low displays and/or inadvertent actuation of low controls. Other documented discrepancies indicate that there are several displays and controls that are very low (e.g. one

. recorder is only 16.5 inches above the floor). With displays this ,

low, it is quite conceivable that a stepladder could come into contact with them or obstruct viewing. For the above reasons, the l reviewers find the provision of an ergonomically designed steplad-der to be an unacceptable HED resolution. The licensee 'should reexamine the following HEDs and provide resolutions that will bring these HEDs into conformance with guidelines of NUREG-0700.

HED Category /

Index No. Eagg Level - Additional Concerns 0014 45 IB Name manual / auto stations 0576, 0577, 46 IB What are the controls cited 0586, 0580 0579 51 1C What are the controls cited 0091 60 IC 0092 61 IC 0108 69 IC 0265 71 2C 0267 73 1C 6119 75 IC 0049 79 2C This HED includes twenty unidentified displays

} D7. Part 4 of the Supplement to the Summary Repert presents HEDs that were accepted by the NRC. A review of these HEDs revealed that some of the

, corrective actions and/or implementations that wtr.e accepted by the NRC have been modified. Additionally, the reviewers found that Part 4 of ~

45

. m-- -, -~, --.5 . - - - . _ - ,,,,,---___1,- * - *9 t ir - .-r..-_,w,w, ,m,- ._,- -...,,,m..-. _,,, , , - - ,-

_ _ _ _ _ _ ._ _ . _ ~ .

.'... l l, the Supplement contains many HEDs for which the corrective; action and/or implementation was not accepted by the NRC. These HEDs were .  :

examined and the following indicates those HEDs that need to be l addressed.

i

) o HED Index No. 0170. nace 428: This Category I HED states that the

[a pointer tips on GE stripchart recorder scales are covering the scale graduations making scales difficult to read. Ceco's response in the Sumary Report was to adjust the pointers where apiiropriate by the second refueling outage. In the Supplement to the Sumary Report, Ceco states that the recorders are used for trend informa-tion only and that specific values of the meters do not signifi-cantly affect operation because enough of the numerals can normally be seen to read the meters. Consequently, the HED is accepted "as '

is" by Ceco. This change in the response and implementation is unacceptable to the NRC review team. CECO should provide assurance i that the corrective action proposed in the Sumary Report will be implemented by the second refueling outage.

! The following HEDs have been evaluated as having a similar inadequacy and need to be addressed by Ceco.

. HED Index No. EASA I* 0261 465 0300 498 l

r- o .The implementation date is different from the-implementation date i accepted by the NRC.

!, HED Index Nos. 0550 and 0613. naae 403: These HEDs state that the j range on the Containment Cooling Heat Exchanger Service Water Flow meter is too high for proper operation. Ceco's response is to re-scale the meters with the proper range. In the Sumary Report,

' Ceco indicated that this corrective action would be implemented by I- the first refueling outage. However, the implementation provided in the Supplement to the Sumary Report is the second refueling ,

I outage. The NRC review team does not accept this change in the I

46 i

I l

[ -- - ... -.. . - . . . . . . . . , . .

\ -~ *

. . - i implementation. CECO should rescale the meters by completion of -

the f.insi refueling outage as agreed upon,in the Summary Report.

o The justification for not correcting HEDs was not accepted by the

NRC. ,

HED Index No. 0243. naae 464: This HED cites excessive response O times on the computer and lack of response delay messages.. Ceco's

~

response states that this is not a serious problem since the opera-

~

tor receives visual feedback that the computer is executing the s program by means of the display frame being built. Upon evaluation of the Summary Report, the NRC indicated that this response is not acceptable because it does not consider the cumulative or inter-active effect of other HEDs. In addition, Ceco's response does not address operational or behavioral factors such as operator confu-sion and alienation resulting from long response times. Conse-quently, the justification for no corrective action is still

_ unacceptable and the licensee should resolve this HED.

The following HEDs have been evaluated as having a similar inadequacy and need to be addressed by Ceco.

! HED Index No. hgg Comment l-

0253 483 Specify which monitor is primary and use l- ,

that one.

0297 497 Specify the speed of the computer printer

[ and, if necessary, replace with higher speed printer.

3 o The implementation date was not accepted by the NRC.

1.

HED Index No. 0418. naae 502: This response to the operator survey indicated that the layout of the isolation condenser system does i

not conform to layout by function, sequence of use, or frequency of use. CECO proposes to use mimic lines and background shading to j enhance these control layouts. While the systematic application of -

l enhancement techniques is acceptable, the time frame for this '

I' l 47 5

1 . . .. . - . . - . .- -- .- - . - . . . . - - . . . -

a. c corrective action is excessive. The corrective actions using ,

enhancement techniques should be in place by completion of the first refueling outage. In the Supplement to the Summary Report, the licensee still proposes to implement the corrective action hy

., the completion of the second refueling outage. The licensee should

~

' assure the NRC that the control room enhancement program will be in

? place by the completion of the first refueling outage.

.- + -

[ The following HEDs have been evaluated as having a similar inadequacy and need to be addressed by Ceco.

3

. HED Index No. Eagg Comment 0419 503 Category 1A - Implement by first outage 0443 505 Category IB - Implement by first outage 0414 506 Category 1A - Implement by first outage

, 0412 507 Category 1A - Implement hy first outage 0475 508 Category 1A - Implement hy first outage 0476 509 Category 1A - Implement hy first outage a

f b

I l

t I

i l

l' I

i l

48 l

, -..s . . . . ..