ML20198F343

Technical Evaluation of Dcrdr for Nine Mile Point Nuclear Station,Unit 1

ML20198F343
Person / Time
Site:	Nine Mile Point
Issue date:	10/04/1985
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML17055B971	List: ML20198F343
References
CON-NRC-03-82-096, CON-NRC-3-82-96, RTR-NUREG-0737, RTR-NUREG-737 SAIC-85-1865, NUDOCS 8511140331
Download: ML20198F343 (34)

Text

'

. ATTACHMENT TO NRC SE ON DCRDR SAIC-85/1865

=

s TECHNICAL EVALUATION OF THE DETAILED CONTROL ROOM DESIGN REVIEW FOR NIAGARA MOHAWK POWER CORPORATION'S NINE MILE POINT NUCLEAR STATION, UNIT 1 October 4, 1985 Prepared for:

U.S. Nuclear Regulatory Comission Washington, D.C. 20555 Contract NRC-03-82-096 Prepared by:

Science Applications International Corporation 1710 Goodridge Drive McLean, Virginia 22102 f*.)

coh f< N

FOREWORD This Technical Evaluation Report (TER) documents the findings from an evaluation of Niagara Mohawk Power Corporation's Detailed Control Room Design Review for its liine Mile Point Nuclear Station. Unit 1. Science Applications International Corporation's (SAIC's) evaluation was performed in support of the Human Factors Engineering Branch of the Division of Human Factors Safety under Contract NRC-03-82-096, Technical Assistance in Support 1

of Reactor Licensing Actions: Program III. SAIC previously participated in the review of the Program Plan and in the in-progress audit at Nine Mile Point Nuclear Station.

O i

1

TABLE OF CONTENTS Section Pa28 BACKGROUND . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 DISCUSSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Establishment of a qualified multidisciplinary review team. . . . 3 i Function and task analyses to identify control room operator tasks and information and control requirements during emergency operations. . . . . . . . . . . . . . . . . . . . . . 5 A comparison of display and control requirements with a control room i nventory. . . . . . . . . . . . . . . . . . . . . 7 A control room survey to identify deviations from accepted human factors principles. . . . . . . . . . . . . . . . . . . . 10 Assessment of Human Engineering Discrepancies (HEDs) to determine which are significant and should be corrected . . . . . . . . . 11 Selection of design improvements. . . . . . . . . . . . . . . . . 13 Verification that selected improvements will provide the necessary correction and verification that improvements will not introduce new HEDs . . . . . . . . . . . . . . . . . . 15

~

Coordination of control room improvements with changes from other programs such as the safety parameter display system 1 (SPDS), operator training, Reg. Guide 1.97 instrumentation, and upgraded emergency operating procedures (EOPs). . . . . . . 16 Operating Experience Review . . . . . . . . . . . . . . . . . . . 18 Analysis of Proposed Design Changes and Schedule for Implementing Design Changes . . . . . . . . . . . . . . . . . . 19 Justificattor.s for HEDs to be left uncorrected. . . . . . . . . . 19 CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 APPENDIX A - HE0s for which some corrective action is proposed . . . 24 APPENDIX B - HEOs rejected for correction . . . . . . . . . . . . . . 25 APPENDIX C - Invalid HE0s . . . . . . . . . . . . . . . . . . . . . . 28 l

-n,- ,e.- ,.--na- -._,,,.nm.., -,---....--..,-e,,--.---,,--.~,,,,w,,, - - --..,v-- , ------n-- --a,,.,-- --- --- ,-,-,,- -

TABLE OF CONTENTS (Continued)

Section e Pag.e, APPENDIX D - HEOs undergoing additional study ........... 29

. APPENDIX E - Generic HEOs ..................... 30

- s e

Technical Evaluation of the Detailed Control Room Design Review for Nine Mile Point Nuclear Station Unit 1 BACKGROUND Licensees and applicants for operating licenses shall conduct a Detailed Control Room Design Review (DCRDR). The objective is to " improve the ability of nuclear power plant control room operators to prevent accidents or cope with accidents if they occur by improving the information provided to them" (NUREG-0660 Item I.D - Reference 1). The need to conduct a DCRDR was confirmed in NUREG-0737 and Supplement 1 to NUREG-0737 (Reference 2).

DCRDR requirements in Supplement I to NUREG-0737 replaced those in earlier documents. Supplement 1 to NUREG-0737 requires each applicant or licensee to conduct a DCRDR on a schedule negotiated with the Nuclear Regulatory Commission (NRC). ,

NUREG-0700 (Reference 3) describes four phases of the DCRDR and provides applicants and licensees with guidelines for their conduct. The phases are:

i

1. Planning

2. Review

3. Assessment and implementation

4. Reporting.

The requirements of Supplement I to NUREG-0737 indicate the need to include i

a number of elements in the DCRDR. They are:

1. Establishment of a qualified multidisciplinary review team.

2. Function and task analyses to identify control room operator tasks and information and control requirements during emergency

( operations.

3. A comparison of display and control requirements with a control room inventory.

I

4. A control room survey to identify deviations from accepted human factors principles.

t 5. Assessment of human engineering discrepancies (HEDs) to determine which are significant and should be corrected.

6. Selection of design improvements.

7. Verification that selected design improvements will provide the necessary correction.

8. Verification that improvements will not introduce new HEDs.

9. Coordination of control room improvements with changes from other programs such as the safety parameter display system (SPDS),

operator training, Reg. Guide 1.97 instrumentation, and upgraded emergency operating procedures (EOPs).

Licensees are expected to comp 1ete Element I during the DCRDR's planning phase. Elements 2 through 4 during the DCRDR's review phase, and Elements 5 through 8 during the DCRDR's assessment and implementation phase.

Completion of Element 9 is expected to cut across the planning, review, and assessment and implementation phases.

A Summary Report is to be submitted at the end of the DCRDR. As a minimum it shall:

1. Outline proposed control room changes.

2. Outline proposed schedules for implementation.

3. Provide summary justification for HEDs with safety significance to be lef' uncorrected or partially corrected.

The NRC staff evaluates the organization, process, and results of the DCRDR.

Results of the evaluation are documented in a Safety Evaluation Report (SER) published within two months after receipt of the Summary Report.

2 i

DISCUSSION

Niagara Mohawk Power Corporation (NMPC) submitted to the NRC a DCRDR Program Plan for the Nine Mile Point Nuclear Station, Unit 1 (NMP-1) on September 30, 1983 (Reference 4); NRC staff comments on that Program Plan were forwarded to NMPC on January 25,1984 (Reference 5). In addition, the NRC Project Manager for NMP-1 arranged for NMPC to provide a DCRDR status briefing on August 17, 1984. NRC staff comments on information provided at that meeting were forwarded to NMPC on October 1,1984 (Reference 6).

Based on review of the DCRDR Program Plan, the NRC staff, supported by SA~IC, j conducted an in-progress audit of the NMP-1 DCRDR. An in-progress audit report was forwarded to NMPC by letter dated February 14,1985 (Reference 7). The Project Manager for NMP-1 arranged for a meeting to be held May 9 l and 10, 1985, between NMPC and the NRC staff to discuss concerns identified during the NRC's in-progress audit of the NMP-1 DCRDR. NRC staff comments on information discussed at the meeting were forwarded on June 6,1985 (Reference 8).

! NMPC submitted a three-volume Summary Report for NMP-1 on July 1,1985 (References 9 and 10). The current SAIC technical evaluation of the NMP-1 DCRDR, provided below, is based on all information available to date and is arranged in order of the DCRDR elements identified in Supplement 1 to NUREG-

0737.

Establishment of a qualified multidisciplinary review team. The organiza-tion for conduct of a successful DCRDR can vary widely, but is expected to i conform to some general criteria. Some of these criteria from NUREG-0800 l are described below. Overall admini.strative leadership should be provided by a utility employee. The DCRDR team should be given sufficient authority to carry out its mission. A core group of specialists in the fields of human factors engineering, plant operations, instrument and control engi-t neering, and nuclear engineering are expected to participate with assistance j as required from other disciplines. Staffing for each technical task should j bring appropriate expertise to bear. Human factors expertise should be included in the sta ffing for most, if not all, technical tasks. Finally, 1

1 3

i

1 the DCRDR team should receive an orientation which contributes to the suc- l cess of the DCRDR. Section 18.1, Appendix A, of NUREG-0800 (Reference 12) describes criteria for the multidisciplinary review team in more detail.

The Summary Report includes a description of NMPC's DCRDR management and sta f fi ng. A program manager from Niagara Mohawk's Nuclear Technology Department has been de' legated the responsibility for establishing and meeting the program requirements based on the NRC's regulations and guidelines. This assumption of management responsibility of the DCRDR by NMPC's staff is consistent with the guidelines of the NRC. The review staff is described as a combination of a BWROG Team, a program team comprised of both NMPC and Advanced Resources Development (ARD) Corporation (human factors consultants to NMPC), and NMPC's engineering and operation organiza-tions.

The first phase of the review process was carried out by a BWROG-sponsored team in 1981. Examination of the resumes included in the Program Plan of this BWROG review team indicated that a well-qualified multidisciplinary team was assembled for that effort. For the review / analysis and assessment /

resolution phases of the DCRDR, the licensee indicates that a program team was used. Examination of the resumes of the program team indicates that each of the disciplines described in Section 18.1. Appendix A. NUREG-0800, was available. In addition, the Summary Report indicates that additional expertise was provided by shift operators attending requalification training on the NMP-1 simulator. While implementation and verification activities are being accomplished by using established NMPC procedures in the Engineer-ing and Operations organizations, these activities will be coordinated by the Program Manager.

One concern raised during the audit and addressed during the May 1985 meeting is that the team performing the task ana :ysis did not appear to have all the necessary expertise needed to conduct the DCRDR task analysis. At the meeting, NMPC responded by stating that an adequate team, including nuclear systems engineers and nuclear operations experts, had been assembled. This concern is resolved by the resumes and task assignments l documented in the Summary Report.

l l

4 l

e l

As noted, the Summary Report provides a description of NMPC's DCRDR l management and staffing. Resumes are provided for the principal DCRDR team j members who participated. Evaluation of these resumes and of the DCRDR team organization lead us to conclude that a qualified team has been assembled )

and that personnel assignments generally meet the NRC requirements and l l guidelines.

Function and task analyses to identify control room operator tasks and information and control requirements during emergency operation. The pur-pose of the function and task analyses is to identify the control room operators' tasks during emergency operations and to deterr:ine the informa-j tion and control capabilities the operators need to perform those tasks. An acceptable process for conducting the function and task analyses is:

1. Analyze the functions performed by systems in responding to transients and accidents in order to identify and describe those tasks operators are expected to perform.

2. For each task identified in Item 1 above, determine the

' information (e.g., parameter, value, status) which signals the need to perform the task, the control capabilities needed to perform the task, and the feedback information needed to monitor task performance. Operator tasks will have been identified and

described (in Item 1 above), 'and the information and control capabilities needed to perform those tasks are being identified (in Item 2).

3. Analyze the information and control capability needs identified in I Item 2 above to determine appropriate characteristics for displays j and controls to satisfy those needs. Information characteristics include parameter type, dynamic range, setpoints, resolution / accu-racy, speed of response, units and the need for trending, alarm-

ing, etc. Control characteristics include type (discrete or

continuous), rate, gain, response requirements, locking functions, i and feedback information associated with control use (Reference 12).

1 5

d The described process is prescriptive. It should identify in detail what operators need to do in order to control the systems which mitigate the consequences of transients and accidents. In addition to its use in the DCRDR, it should be the basis for complete and technically adequate E0Ps.

i i The Nine Mile Point Summary Report provides a discussion of the task analy-

$ sis activity on pages 4-97 through 4-107 (Reference 10). As described in j both this document and during the May 8 and 9,1985, meeting between NMPC

. s and NRC, the task analysis consisted of an analysis of the Nine Mile Point 1 l EPGs. These EPGs had been developed from the BWROG EPGs, Revision 3, which i " provide a functional analysis that identifies, on a high level generic information and control needs" (Reference 11).

1 NMP-l's methodology for the task analysis, as described on pages 4-97 through 4-107, was carried out in the following manner. i

)

l

1. The team members completed a " Task Description Form" for all steps and contingencies represented in the EPGs. This resulted in the identification J of operator tasks, task number, and the procedure step numbers that correspond with the task. Table 4.3.1 in the Summary Report provides an example of a completed Task Description Form.

2. A " Task Analysis Instrumentation Requirement Form" was completed for

! each task identified in the " Task Des ~cription Fo rm." Human Fac to rs j Specialists, NMP-1 reactor operators, senior reactor operators, nuclear l design engineers, a nuclear systems engineer, and a nuclear trainer partici-L pated in filling out the forms. The form is composed of subtasks or action steps of which the task is comprised. This stage of the task analysis l included the collection of information to describe operator tasks in terms of the information and control needs. Figure 4.3.1 of the Summary Report contains the " Task Analysis Instrumentation Requirement Form" which was used to assemble task analysis data. The form includes the following character-istics of the information and control needs for operator tasks:

a. Action step

b. Operator identifier

c. Verb (task action)

d. Equipment (object of the task) 6

e. Control (equipment, position, identifier, type, other characteris-tics), type of feedback, feedback state

f. Information (equipment, type, state, identifier, units, range, ,

divisions, other :haracteristics)  !

l g. Other performa ,a tquirements

h. Exit or coments The task analysis data was assembled for later use to " verify the availability and suitability of control room instrumentation, to provide a context within which to survey the control room, and to provide a base of understanding on which to assess human engineering discrepancies" (page 4-106, Reference 10).

Based on the description of the task analysis activities in the Summary Report as well as on discussions held during both the in-progress audit (Reference 7) and the May 1985 meeting (Reference 8), the reviewers find that NMP-1 has completed a task analysis using technically sound methodology and performed by a team composed of the appropriate subject matter experts.

Although the NRC staff and their consultants had found gaps in task analysis

~

documentation during the May 1985 meeting, the team concludes that these findings were of no significant consequence to the results. This conclusion is reinforced by findings from the May 1985 meeting in which NMP-1 committed to improving any flaws in its documentation.

A comparison of display and control requirements with a control room inven-tory. The purpose of comparing display and control requirements with a control room inventory is to determine the availability and suitability of displays and controls required for performance of the E0Ps. Success of this

! element depends on the quality of the function and task analyses and the control room inventory. Display and control requirements should be derived j from analyses which are sufficiently detailed to support development of complete and technically adequate E0Ps. Characteristics appropriate to the task should be described for each display and control need identified by the function and task analyses. The control room inventory should be a complete

! representation of displays and controls currently in the control room. The inventory should include appropriate characteristics of current displays and controls in order to allow meaningful comparison with the results of the 7

b

_._r., . _ _ , - _ _

function and task analyses. Unavailable or unsuitable displays and controls should be documented as HEDs.

4 NMP-l's control room inventory consists of both an automated and a manual l data base. The automated inventory was supplemented by control room equipment whose characteristics were not fully described in the data base.

f The data base was organized into four component types, each having its own separate verification process. The four components are controls, indica-tors, controllers, and annunciators.

! All operator work areas of the control room were inventoried, i.e., control boards, peripheral consoles, back panels, and desks. The inventory was collected using previous data compiled by NMPC Operations and by assistance from NMPC Operations when necessary. A human factors specialist converted it to a format that would be suitable for comparison with the information

] and control needs identified by the task analysis activity.

i During the in-progress audit, the NRC audit team had observed deficiencies in the inventory and in the verification process. Those deficiencies con-sisted of gaps in the data base due to inaccurate data transfer, omission of equipment from the inventory, and the computer processing output. However, NRC held a meeting to discuss these deficiencies and others during the May 1985 meeting at which time NMP-1 indicated that the process had been improved and that the task analysis and the comparison of its results with a control room inventory had met with success. The audit team's concerns witii

the deficiencies in the verification process have been alleviated by the results of the May 1985 meeting.

The Summary Report provides a thorough description of the process to verify

) information and control capabilities in the control room (pages 4-132

through 4-136). NMPC indicates the process resulted in an auditable trail l through the data base printout and the HEOs which it revealed. Much of the automated verification process was manually checked in instances where a mismatch between a need and the control room appeared on the printout. For example, a Human Engineering Observation (HE0) was generated for a manual j

check of annunciators to meet the required need for availability and legend

{ content. There were a total of 42 HE0s generated from the' verification

! process.

1

! 8

In conclusion, the reviewers find that a thorough and systematic process was developed and implemented to meet the control room inventory requirement of Supplement 1 to NUREG-0737. Specific results of the verification process (Human Engineering Observations) are reviewed in detail and reported on in a ,

later section of this TER. '

In addition to the verification of task performance capabilities, NMPC conducted a validation review to determine whether the functions allocated '

to the control room operating crew could be accomplished effectively within both the structure of the established emergency procedures and the design of the control room as it exists.

The NMP-1 simulator was used for the validation effort that employed the techniques of walk-through and talk-through. Four events were selected for conducting the walk-through of the NMP-1 simulator:

1. Small LOCA Inside Containment

2. High Activity in Condenser Off-Gas

3. Reactor Failure to Scram

4. Main Steam Line Break Outside Drywell The talk-through effort demonstrated responses for each of the four selected events and all tasks identified in the NMP-1 DCRDR task analysis. These two validation efforts were conducted during the fall of 1984.

The four events for the validation walk-throughs were selected from the currently used special operating procedures for emergency conditions.

Exercising of the four major sections of the EPGs and examination of the tasks identified in the task analysis were the basis for event selection.

The inadequate core cooling event is not examined during the walk-through.

However, the talk-through portion of the validation effort examines all tasks from the task analysis resolving potential concerns that the four events selected were inadequate to exercise all emergency tasks.

Operations personnel walked through procedural steps of the four emergency events selected. During the event simulations, an NMP-1 operations trainer narrated what was being recorded on video tape. Afterward, a' human factors specialist reviewed the video capes using validation criteria described in 9

.. . j 1 l

l 4

the Summary Report. Evaluation of each procedure step was recorded on a '

Validation Review Worksheet.

For each of the four selected events and all tasks identified in the NMP-1 ,

task analysis, an operator demonstrated the tasks and equipment responses to a human factors specialist. Additionally, the human factors specialist I i asked questions when needed. This exercise familiarized the human factors l specialist with the operator's needs and control room characteristics for j . performing emergency tasks., Using the criteria described in Table 4.7-1. for

! control board / control room design criteria employed during the walk-through,

evaluations were recorded on a Validation Review Worksheet.

The licensee implemented a validation procedure that appears to be l consistent with the guidelines of NUREG-0700. While the four events chosen for walk-through are not entirely consistent with those suggested in NUREG-0700, it appears that all control room workstations are exercised when 4 considering the talk-through effort. The validation efforts were conducted j using the real-time NMP-1 simulator. From the validation activities i performed, 26 new HEOs were generated.

1 A control room survey to identify deviations from accepted human factors j principles. The key to a successful control room survey is a systematic l comparison of the control room against accepted human engineering l guidelines. One accepted set of human engineering guidelines is provided by Section 6 of NUREG-0700. Discrepancies between the control room and human engineering guidelines should be documented as HEDs.

t The NMPC survey was conducted during two separate efforts. The first effort l was conducted by the Boiling Water Reactor Owners Group (BWROG) in July 1981 using the BWR survey. The second survey, which used the criteria and guidance from the BWR " Supplemental Checklist," was conducted with the

( assistance of ARD Corporation during the summer of 1984. This supplemental l effort was extended to include the NMP-1 remote shutdown capability.

f Furthermore, during this supplemental effort, a review of all control room l

modifications since July 1981 was conducted using both the original and the supplemental BWR checklists. These survey efforts resulted in the identification of HEOs that were documented both on standard'ized forms and in a photographic log.

r 10

i During the in-progress audit, the NRC developed several areas of concern related to the completeness of NMPC's survey:

)

o Cosununications o- Annunciators o Control Room and Remote Shutdown Panel Environment o Emergency Equipment.

Subsequently, NMPC has made an effort to address these areas of concern and has documented its efforts in the Summary Report. After the audit ARD Corporation (NMPC's consultants) resurveyed the control room in a quality assurance effort by sampling the thoroughness of the original surveys.

Having reassessed the documentation and the control room, NMPC has assured itself that the areas of annunciators, emergency equipment, and communica-l tions were sufficiently addressed by the BWR supplemental survey. However, l

it was determined that additional environmental measurements such as /

[ temperature / humidity and air velocity were needed for both the control room and the remote shutdown capability. This environmental survey work resulted in two HEOs documented against the remote shutdown capability. Also, the Summary Report indicates that an extensive review of the fire panel was conducted resulting in the generation of nine HEOs against the panel.

Niagara Mohawk performed a control room survey of NMP-1 using the BWROG control room checklist in 1981 and the BWROG supplemental checklist in 1984.

l This effort is in accordance with NRC Generic Letter 83-18 (Reference 11)

! which indicates that the members are expected to complete both the original and the supplemental checklists using the methodology described in the plan 1

for the initial BWROG checklist. Furthermore, NMPC has addressed the NRC concern that several areas of the survey may have been weak. This was

accomplished by reassessing the previous survey work and conducting addi-l tional survey activities. The reviewers conclude that NMPC has sat,isfied

this requirement of NUREG-0737, Supplement 1.

Assessment of HEDs to determine which are significant and should be cor-rected. Based on the guidance from NUREG-0800 and the requirements of i NUREG-0737, Supplement 1, all HEDs should be assessed for significance. The

! potential for operator error and the consequence of that error in terms of f plant safety should be systematically considered in that assessment. Both l

t 11

the individual and aggregate effects of HEDs should be considered. The result of the assessment process is a determination of which HEDs should be corrected because of their potential impact on plant safety. Decisions on whether HEDs are significant in terms of potential impact on plant safety should not be compromised by consideration of such issues as the means and potential cost of correcting those HEDs.

NMPC's process to assess HEDs is described in Section 5.2 which details the steps that the Assessment / Resolution Team proceeded through. The process was performed from a team approach with a " circular and iterative fashion... over (about one month)" (Reference 10, page 3-9).

The steps of the procedure can be sumarized as follows:

The HE0 was -described by the human factors specialist, and a review of the equipment involved was carried out. The HE0 was placed in one of four categories (functional considerations, subject to cosmetic type resolution.

l already resolved, or an invalid listing - not really an HE0/HED) (Reference 10, pages 5-6, 5-7). The team c6mpleted this assessment for all HEOs/HEDs before proceeding. NMPC indicates that this initial categorization was carried out for all HEDs to permit an understanding of the " character and categorization of all HEOs before considering the details of solutions" (Reference 10, page 5-7).

After the first phase was complete, the licensee states that, "The first two steps were reiterated to bring out more detail and to allow for new consid-erations" (Reference 10, page 5-7). At this time the licensee considered the HEOs' impact on safety. Criteria used to assess safety significance are provided in Table 5.2-1 of the Summary Report and show that three categories (substantial, significant, insignificant) were used to separate degrees of sa fety impact. The review team's licensing member discussed the HEOs' potential impact on the plant's safety. Subsequently, the team derived the HE0s' quantified safety-significant risk categories. As documented and described in the Summary Report this step to derive the HE0s' impact on plant safety responds to one of the NRC concerns from the November 1984 audit.

l 12

\

Another concern raised'during the NRC audit was that the assessment be based on the potentiti aggregate effects of HEOs. It appears that NMPC addressed this concern by reiteration of the process for previously rejected HEOs. On page 5-9 of the Summary Report, NMPC states that "ALL previously rejected HEOs were reconsidered ... to be sure they were adequately considered.,

initially and to see if they should be fit in with other HEOs being fixed, for consistency and coherence." On pages 5-43 and 5-44 of the Summary Report, NMPC indicates that as a result of concerns expressed in meetings of May 8 and 9,1985, additional assessment of HE0s previously rejected were performed. The assessment was performed by an ARD human factors specialist who was leading activities of the DCRDR for NMP-2. The independent assess-ment resulted in 24 differences; 24 HEOs changed from " insignificant" to "significant." Reconsideration of these by the full team resulted in recategorization of about half of the 24 HEOs, In conclusion, the reviewers find that NMPC's Summary R,eport describes a technically adequate process to assess HEOs for their impact on plant safety to determine whether they should be corrected. Also, NRC concerns that resulted from the November 1984 audit and the meetings of May 8 and 9, 1985, have been addressed. This requirement of Supplement 1 to NUREG-0737 has been satisfied.

Selection of design improvements. The purpose of selecting design improvements is, as a minimum, to correc't safety-significant HEDs. Selec-tion of design improvements should include a systematic process for development and comparison of alternative means for resolving HEDs. Both enhancement and design modification may be considered.

NMPC describes the process to select design improvements on pages 5-8 through 5-18 of the Summary Report. The process resulted in a human factors manual and an integrated cosmetic package, which are also described in the Summary Report.

At the time of the in-progress audit, HE0s had been grouped into preliminary categories to represent the general approach for their correction. Details for design correction were not developed yet. The Summary Report provides a '

full discussion of HE0 corrections that is summarized in Table 5.1-1. That table shows results of the program as follows:

13

Resolved In-progress 38 Completed 44 Fix Cosmetic 133 Functional 42 Invalid

Categorized 12 Uncategorized 84 Rejected Cosmetic 63 Functional 114 Based on the Assessment / Resolution process, to develop details for HE0 corrections, two major correction packages resulted. Corrections fall into either the integrated cosmetic package or functional fixes (equipment

, changes / adjustments, program / study activities and training / informational /

procedural changes). A third category includes HEOs that are either fixed or are in the process of correction. A detailed compilation of corrections is provided in Appendix 0 of the Summary Report and is reviewed in an appendix to this report.

The process to develop solutions for HEOs was conducted by a team who developed an overall understanding of the types and categories of HE0s documented during the assessment process. With this overall picture of the HEOs and their character they proceeded to reiterate the assessment of HEOs in order to bring out considerations for individual fixes. Representatives from operations and other plant aspects were brought before the team.

Listings of potential fixes were developed using Tables 5.2-2 and 5.2-3, i

entitled: Human Factors Considerations for Proposed HE0 Fixes and Inter-

actional Impact Considerations for Proposed HE0 Fixes. The team decided

! upon a correction based upon cons _ensus. As a result of the process, all i cosmetic fixes which addressed conventions (or surface changes) were grouped and applied to the entire control room, producing the integrated cosmetic package. Previously rejected HE0s were evaluated in light of this package

~

14 l

l for consistency factors. The priorities for HE0 correction were also deter-mined based upon importance.

Functional fixes, those not addressed by the integrated cosmetic package, are summarized in Table 5.3-2 of the Summary Report. Although some of the design details are not final, NMPC indicates its intention is to complete them all by the Spring 1986 outage.

In conclusion, the reviewers find that NMPC used a technically adequate process to develop design improvements to correct safety-significant HEDs.

NMPC developed improvements paying attention to the need for an integra'ted and consistent control room. The Summary Report also indicates that solutions are to be considered with respect to other on-going modification programs such as the Safety Parameter Display System (SPDS) and the new E0Ps. Full satisfaction of this requirement, however, will depend upon NMPC's completion of those further studies that are required to develop HE0 solutions (see Appendix D of this TER). Also NMPC is reminded that any HEOs/HEDs that result from the coordination of the DCRDR with other programs will need to be assessed and entered into the process to select design improvements. ,

Verification that selected impr_ovements will_ provide the necessaryJorrec-tion and verification that improvements will not introduce new HEDs. A key criterion of DCRDR success is a consistent, coherent, and effective interface between the operator and the control room. One good way to satisfy that criterion is through iteration of the processes of selection of design improvements, verification that selected design improvements will provide the necessary correction, and verification that improvements will ,

not introduce new HEDs. According to NUREG-0800, techniques for the verifi-l cation process might include partial resurveys on mocked-up panels, applied l

experiments, engineering analyses, environmental surveys, and operator interviews. NRC staff believe that each iteration of the selection and verification processes should reduce inconsistencies in the operator-control room interface while increasing the coherence and effectiveness of that l interface. The consistency, coherence, and effectiveness of the entire operator-control room interface is important to operator performance. Thus, evaluation of both the changed and unchanged portions of the control room is necessary during the verification processes.

i l 15

The Summary Report provides a description of the process by which selected design improvements were verified. The integrated cosmetic package was presented on the plant simulator for review by two shifts of operators who completed a questionnaire regarding the usefulness of the changes. As a result of this verification activity, new observations by the operators, e.g., protective covers for some pushbuttons, were recommended. The review of changes on the simulator led to iteration of the corrections with discus-sion between operators and human factors personnel considering alternatives to the designs. Adjustments and sometimes elimination of changes resulted from operator input. The verification process also included reapplication of the appropriate sections of the checklist survey to the design changes on i the simulator in order to identify any new problems.

Verification of the functional fixes is to be conducted in conjunction with NMP-1 quality control procedures, engineering review and other fix completion activities. These fixes are gathered in one package and are processed through the NMPC-established plant modification proceaure. These are to be completed before or during the 1986 refueling outage. The verifi-cation for these corrections will be carried out both during the plant review and after the fix is completed. Mechanisms will include a check-off that the work has been completed, a human factors review that the fix was effective, and a query to NMP operators that their concern was reasonably resolved.

In conclusion, the reviewers find that NMPC has implemented the f required process to verify that HEDs are corrected and that no new HEDs are created. Full satisfaction of the requirement will depend on the completion of the process to verify that all design improvements correct HEDs and do not create new ones. This process needs to be applied to those HEDs that are still being analyzed for design improvement and any HEDs that result from completion of changes to the control room from other programs such as the SPDS and the upgraded E0Ps.

Coordination of control room improvements with changes from other programs j such as the safety parameter display system (SPDS), operator training, Reg.

i Guide 1.97 instrumentation, and upgraded emergency operating procedures.

Improvement of emergency response capability requires coordination of the DCRDR with other activities. Satisfaction of Reg. Guide 1.97 requirements 16

and addition of the SPDS will require modifications and additions to the control room. Those modifications and additions should be specifically addressed by the DCRDR. Exactly how they are addressed will depend on a number of factors including the relative timing of various emergency response capability upgrades. Regardless of the means for coordination, the result should be integration of Reg. Guide 1.97 instrumentation and SPDS equipment into a consistent, coherent, and effective control room interface with the operators. NUREG-0800 provides further guidance to accomplish this requirement.

1 The NMPC Summary Report describes the coordination of activities on pages 5-40 through 5-48. The integration of the DCRDR with the NMP-1 E0Ps and SPDS may involve new task analysis activities for new or different tasks that arise from the preparation of the NMP-1 E0Ps. The NMP-1 E0Ps are currently under preparation and will be completed by Fall,1985. Thise E0Ps will be I validated by review against the task analysis by ARD Corporation.

Differences will be examined for the existence of new operator task needs and may result in HEOs.

Operator training for the changes brought about by the DCRDR will proceed by the same mechanisms as for all plant or procedural changes. This includes incorporation of plant modifications into the Operator Requalification Training program. Some operators have been familiarized with changes during their review of modifications as part of the verification activities.

Formal training of the modifications will occur at the simulator during Fall,1985 at which time operators will also be trained on the E0Ps and SPDS.

The SPDS is not structured into the E0Ps but will be validated at the time E0Ps are v'alidated, as mentioned above. Human factors evaluation of the SPDS was conducted during both the control room survey and the review of the Emergency Operations Facility. The review included the CRT display formats and other instrumentation to assess compliance with human factors standards and compatibility with the control room. The EOF workspace layout, worksta-

! tion anthropometry, staffing, procedures, and communication links were all reviewed against NRC and human factors guidelines. Due to the construction

) activities at the EOF, no HE0s were generated but comments were provided.

HEOs associated with the SPDS were generated during the control room survey.

17

NMPC indicated that the human factors design manual is expected to serve as a reference standard for future control room changes. This manual could be helpful for future integration of Reg. Guide 1.97 instrumentation as well as for the addition of any oth?r equipment to the control room.

Nine Mile Point illustrates the timing for the interaction of the coordina-tion requirement in Figure 5.4-1. It appears that this requirement to integrate activities for control room improvements has been thoroughly s scoped out and that with completion of all modifications to the control room NMPC will have satisfied this NUREG-0737, Supplement I requirement.

However, NMPC should report any human factors deficiencies that arise with the validation and implementation of the E0Ps, SPDS and 1.97 instrumentation for NRC review. Also, any new deficiencies resulting from this coordination activity should be entered into the processes to assess HEDs and select the design improvement and to verify the correction.

Operating Experience Review Although not a requirement of- Supplement I to NUREG-0737, review of operating experience is beneficial to the DCRDCR. NMPC has performed an operating experience review in the NMP-1 DCRDR. The review included an operator survey (questionnaires and interviews) and an historical review.

The questionnaires were administered to 19 operators, or 59% of the person-nel, and covered topics such as workspace layout, environment, panel design, and the annunciator system. The interviews were conducted with eight of the operators. Findings were summarized with an associated frequency count and statement of the concern. HE0s were recorded for those findings that appeared to be potential human factors findings; however, other valid com-ments and suggestions were also recorded.

The historical document review covered the following:

1. Licensee Event Reports (LERs) for NMP-1

2. Scram Reports for NMP-1

3. Selected LERs, SOERs, and SERs found to be significant to BWR plants and DCRDR application l 18

Reports were screened to identify control room problems and for human factors implications. Those reports are provided in Appendix B of the Summary Report. A problem analysis report (PAR) form was completed for each report that resulted from the screening to record relevant information. The results of the review are contained in PARS; 7 from the LER review,1 from the Scram Reports,12 from NMP-1 LERs, SERs, and SOERs. Of the PARS written,2 resulted in HE0s; most of the problems that surfaced have been resolved for NMP-1.

Analysis of pronosed design changes and schedule for implementing design changes NMPC has reported all HEOs found during the DCRDR including the proposed design changes or those changes already completed. NMPC indicates most design changes will be completed by the end of the Spring 1986 refueling outage. Several design changes require further investigation to determine the correction and the schedule indicates completion by Spring 1988 outage. Appendices A and D contain listings of HE0s which the reviewers found to be inadequatel'y described and which were not reviewed for correction. Information to address these HE0s should be provided in order that all proposed design changes can be reviewed.

In conclusion NMPC has commited to correcting the majority of HEOs by the end of the refueling outage of Spring 1986. Those HE0s and the proposed corrections that were found unacceptable (see Appendix A) and those for which a correction is not yet proposed (Appendix D) should be described during a meeting and in a Supplement to the Summary Report.

Justification for HEDs to be left uncorrected Appendix B of this TER lists those HE0s for which the justification for not taking action was found to be inadequate. Appendix C lists HE0s categorized as invalid but were found unacceptable by the reviewers.

Section 1 of Appendix B contains those HE0s that could not be adequately evaluated due to a brief or ambiguous justification. Section 2 contains those HE0s for which the justification does n'ot address all issues 19

\

thoroughly. Section 3 lists those HE0s for which justification does not account for cumulative or interactive effects.

Section 1 of Appendix C lists HE0s rejected by NMPC as invalid findings.

The reviewers could not make an adequate evaluation of these because of information inadequacy. Section 2 of Appendix C lists HEOs for which the justification does not entirely address all issues. Those HEOs that could nat be evaluated, as listed in the Appendices, should be described further for NRC review. That information can be provided in a meeting and in a Supplement to the Summary Report to be submitted as required by the NRC.

CCNCLUSION In conclusion, NMPC has provided a thorough and comprehensive Summary Report of its procedures for its NMP-1 DCRDR. The NRC has conducted an in-progress audit and has met with NMPC on two occasions resulting in recommen-dations for improving its DCRDR procedures and methodology. NMPC has integrated those recommendations and has documented them in the Summary Report. The reviewers found NMPC to be responsive in the concluding phase of the DCRDR. Because some studies associated with HE0 design corrections and implementation of proposed design changes are incomplete, the DCRDR cannot be entirely closed out.

The following elements and associated activities of the DCRDR are incomplete:

1. The process to develop solutions to HEDs is incomplete due to studies or analyses still being conducted to resolve some HEDs.

Also, new HEDs that may arise during the coordination of design changes with other improvement programs (e.g., upgraded E0Ps) will need to enter the HED assessment and correction processes.

2. Full satisfaction of the requirements to verify that HEDs are corrected and to verify that no new HEDs have been created by design improvements cannot be provided until NMPC completes analysis of all HEDs and arrives at design resolutions or develops a justification for no correction. If new HEDs are found during l

1 20 l

e coordination efforts, solutions to correct them should also be verified by the same processes described in the Summary Report.

3. NMPC's process to coordinate control room improvements with changes from other programs is incomplete. Efforts to meet this requirement should include assurances that the centrol room supports the new E0Ps. Also, new HEDs that result from that effort and any other coordination function (e.g., implementation of the SPDS, Reg. Guide 1.97 instrumentation) should enter the DCRDR process to select design improvements and to verify those design improvements in order that changes to the control room are integrated and consistent.

4. NMPC should ensure continued involvement of the DCRDR team members in the current studies to resolve HEDs as well as the verification of the solutions.

5. NMPC should ensure that HEDs which are to be corrected according to the Human Factors-Design Manual comply with NUREG-0700 or accepted human engineering criteria.

6. Corrections or justifications for no correction of HEDs that are listed in Appendices to this report were found to be inadequate.

~

These HEDs should be reviewed by NMPC and resolved by further discussion in a meeting with NRC and by providing information in a Supplement to the Summary Report.

Information associated with DCRDR activities that have been found incomplete and are outlined in these conclusions should be discussed in a meeting and reported in a Supplement to the Summary Report. That informa-tion is required in order that a complete and valid technical review of the DCRDR is conducted.

i.1

1 REFERENCES

1. NUREG-0660, "NRC Action Plan Developed as a Result of the TMI-2 Accident," May 1980; Revision 1 August 1980.

l

2. NUREG-0737, Suppisment 1, " Clarification of TMI Action Plan Require-ments." U.S. Nuclear Regulatory Commission, December 1982.

3. NUREG-0700, " Guidelines for Control Room Design Reviews," U.S. Nuclear Regulatory Commission April 1983.

4. " Program Plan for the Control Room Design Review, Nine Mile Point. Unit 1," Niagara Mohawk Power Corporation, dated September 30, 1983.

5. Nuclear Regulatory Commission Staff Comments on the Nine Mile Point 1 Detailed Control Room Design Review Program Plan, dated January 25, 1984.

6. NRC Staff Comments on August 17, 1984 briefing concerning NMP-1 DCRDR status, dated October 1,1984.

7. Results of In-Progress Audit of Nine Mile Point Nuclear Station, Unit 1 Detailed Control Room Design Review, dated February 14, 1985.

8. Minutes of May 1985 Meeting Between Niagara Mohawk Power Corporation and the Nuclear Regulatory Commission, dated June 11, 1985.

9. Letter from C.V. Mangan (NMPC) to Dominic B. Vassallo (NRC).

Subject:

Final Summary Report for the Detailed Control Room Design Review, July 1, 1985.

10. Final Summary Report for the Detailed Control Room Design Review of Nine Mile Point Unit One, Volume 1: Methodology and Results, Volume 2:

Appendices A, B, C, and E, Volume 3: Appendix D. July 1985, Attachment to Reference 9.

22

I 1

11. Memorandum from S.H. Weiss, Division of Human Factors Safety USNRC to V.A. Moore, Chief, Human Factors Engineering Branch.

Subject:

" Meeting Summary--Task Analysis Requirements of Supplement I to NUREG-0737--May 4,1984 Meeting with BWR Owners Group Emergency Procedures Guidelines and Control Room Design Review Committees," May 14, 1984.

12. NUREG-0800 " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants " Section 18.1, Rev. O, " Control Room" and Appendix A to SRP Section 18.1, " Evaluation Criteria for Detailed Control Aoom Design Reviews (DCRDR)," September 1984.

O 23

I APPENDIX A i

i HE0s For Which Some Corrective Action is Proposed

1. The HE0 description and proposed corrective action is too brief, ambiguous, or must be seen on the panels prior to making a judgment to allow an adequate evaluation to be made.

x SPD-005.0 CS-011.0 0CS-024.0 OCS-039.0 0C5-179.0 VE R-011.0 QS-016.1 QS-025.0 QS-017.0

2. The proposed corrective action only partially corrects the discrepancy or not at all.

OCS-019.0 OCS-022.0 0CS-023.0 OCS-219.0 QS-004.0 VER-002.0 24

APPENDIX B HEOs Rejected for Correction HE0s for which justifications for not taking corrective action were provided but were found to be inadequate for one of the following two reasons :

1. The justification is too brief, ambiguous, or must be seen on the panels prior to making a judgment to allow an adequate evaluation to be made.

OCS-208.0 CS-042.0 OCS-191.0 .

QS-006.0 QS-008.0

~

QS-013.0 QS-016.0 QS-021.0 QS-029.0 QS-030.0 ,

VAL-004.0 VAL-005.0 VAL-016.0 VAL-025.0 VER-030.0 VER-034.0 ENV-002.0 0CS-095.0 OCS-231.0 OCS-232.0 SPD-001.0 SPD-010.0 VER-008.0 VE R-018.0 25

2. The basis of the justification is not adequate (i.e., the justification does not address operational or behavioral factors or issues).

CS-003.0 CS-009.0 OCS-062.0 CS-053.0 OCS-063.0 ENV-001.0 OCS-071.0 ENV-003.0 0C5-072.0 VER-017.0 0C5-074.0 VER-020.0 OCS-096.0 VER-025.0 OCS-168.0 VER-028.0 OCS-169.0 SPD-006.0 OCS-174.0 0CS-183.0 OCS-205.0 OCS-206.0 OCS-207.0 OCS-209.0 OCS-230.0 VER-019.0 CS-036.0 CS-045.0 CS-051.0 FP-002.0 OCS-87.0 OCS-88.0 0C5-152.0 OCS-153.0 OCS-160.0 OCS-161.0 OCS-162.0 OCS-233.0 COM-004.0 QS-022.0 QS-026.0 QS-035.0 VAL-008.0 VE R-039.0 26

3. The justification of individual HEDs does not consider the cumulative or interactive effect of other HEDs.

COM-00.9.0 COM-010.0 COM-011.0 COM-012.0 COM-013.0 COM-014.0 COM-018.0 COM-019.0 COM-021.0 COM-024.0 COM-026.0 COM-030.0 0

27

~

APPENDIX C Invalid HE0s HE0s categorized as invalid for which justifications were provided but were found to be inadequate for one of the following two reasons.

1. The justification (or HE0 description) is too brief, general, ambiguous, or must bes seen on the panels prior to making a judgment to allow an adequate evaluation to be made:

OCS-268.0 CS-057.0 -

0C5-033.0 OCS-037.0 0C5-038.0 OCS-040.0 0C5-070.0 OCS-275.0 QS-002.0 VAL-003.0 VAL-009.0 VAL-020.0 VAL-021.0 VAL-023.0 VER-035.0

2. The basis for the justification is not adequate (i.e., the justifica-tion does not address operational or behavioral factors or issues).

l OCS-212.0 COM-015.0 CS-013.0 QS-003.0 VAL-007.0 VER-023.0 ,

VER-036.0 VER-041.0 28 l

r -

o d

APPENDIX D HEOs Undergoing Additional Study HE0s for which no proposed solution or justification for not correcting is provided as the HE0 is undergoing study or additional review.

COM-027.0 COM-028.0 COM-029.0 CS-017.0 FP-004.0 OCS-167.0 QS-023.0 QS-028.0 FP-005.0 FP-006.0 FP-007.0

~

FP-008.0 OCS-246.0 0C5-247.0 0C5-248.0 0C5-249.0 0C5-250.0 0CS-251.0 29