Evaluation of HCR Methodology Implementation in PSA and Control Room

Evaluation of HCR Methodology
Implementation in PSA and Control Room

Human Factors Review for Jose Cabrera
Nuclear Power Plant
Effective December 6, 2006, this report has been made publicly available in
accordance with Section 734.3(b)(3) and published in accordance with
Section 734.7 of the U.S. Export Administration Regulations. As a result of
this publication, this report is subject to only copyright protection and does
SED WARNING: not require any license agreement from EPRI. This notice supersedes the
N
export control restrictions and any proprietary licensed material notices
A L
LICE
Please read the License Agreement

on the back cover before removing embedded in the document prior to publication.
R I
M AT E
the Wrapping Material.
Technical Report
Evaluation of HCR Methodology
Implementation in PSA and Control
Room Human Factors Review for
José Cabrera Nuclear Power Plant
Product ID # 000000000001000028
Final Report, May 2000
EPRI Project Manager

F. Rahn
EPRI • 3412 Hillview Avenue, Palo Alto, California 94304 • PO Box 10412, Palo Alto, California 94303 • USA
800.313.3774 • 650.855.2121 • askepri@epri.com • www.epri.com
DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITIES
THIS DOCUMENT WAS PREPARED BY THE ORGANIZATION(S) NAMED BELOW AS AN
ACCOUNT OF WORK SPONSORED OR COSPONSORED BY THE ELECTRIC POWER RESEARCH
INSTITUTE, INC. (EPRI). NEITHER EPRI, ANY MEMBER OF EPRI, ANY COSPONSOR, THE
ORGANIZATION(S) BELOW, NOR ANY PERSON ACTING ON BEHALF OF ANY OF THEM:
(A) MAKES ANY WARRANTY OR REPRESENTATION WHATSOEVER, EXPRESS OR IMPLIED, (I)

WITH RESPECT TO THE USE OF ANY INFORMATION, APPARATUS, METHOD, PROCESS, OR
SIMILAR ITEM DISCLOSED IN THIS DOCUMENT, INCLUDING MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE, OR (II) THAT SUCH USE DOES NOT INFRINGE ON OR
INTERFERE WITH PRIVATELY OWNED RIGHTS, INCLUDING ANY PARTY'S INTELLECTUAL
PROPERTY, OR (III) THAT THIS DOCUMENT IS SUITABLE TO ANY PARTICULAR USER'S
CIRCUMSTANCE; OR
(B) ASSUMES RESPONSIBILITY FOR ANY DAMAGES OR OTHER LIABILITY WHATSOEVER

(INCLUDING ANY CONSEQUENTIAL DAMAGES, EVEN IF EPRI OR ANY EPRI REPRESENTATIVE
HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES) RESULTING FROM YOUR
SELECTION OR USE OF THIS DOCUMENT OR ANY INFORMATION, APPARATUS, METHOD,
PROCESS, OR SIMILAR ITEM DISCLOSED IN THIS DOCUMENT.
ORGANIZATION(S) THAT PREPARED THIS DOCUMENT
Data Systems and Solutions
Science Applications International Corporation
ORDERING INFORMATION
Requests for copies of this report should be directed to the EPRI Distribution Center, 207 Coggins
Drive, P.O. Box 23205, Pleasant Hill, CA 94523, (800) 313-3774.
Electric Power Research Institute and EPRI are registered service marks of the Electric Power
Research Institute, Inc. EPRI. POWERING PROGRESS is a service mark of the Electric Power
Research Institute, Inc.
Copyright © 2000 Electric Power Research Institute, Inc. All rights reserved.
CITATIONS
This report was prepared by
Data Systems and Solutions

10260 Campus Point Drive
San Diego, California 92121
Principal Investigator
G. W. Hannanman
Science Application International Corporation

8301 Greensboro Drive
P.O. Box 50132
McLean, Virginia 22102-3600
Principal Investigator
S. A. Fleger, CHFP
This report describes research sponsored by EPRI and Unión Fenosa Generación S.A.
The report is a corporate document that should be cited in the literature in the following manner:
Evaluation of HCR Methodology Implementation in PSA and Control Room Human Factors
Review for José Cabrera Nuclear Power Plant, EPRI, Palo Alto, CA, and Unión Fenosa
Generación S.A.: 2000. Product ID # 000000000001000028.
iii
REPORT SUMMARY
EPRI provided an independent review of human reliability and human factors assessments for
the José Cabrera Nuclear Power Plant (CNJC).
Background
Current CNJC Probabilistic Safety Analysis (PSA) dominant risk sequences are driven by errors
in performing certain procedures. Human reliability estimates in internal events PSA are based
on the human cognitive reliability (HCR) methodology. This model was used in analyzing the
CNJC PSA human reliability assessment to calculate the probability of cognitive errors.
The initial HCR model uses qualitative assessments of the control room interface based on
several qualitative criteria. The plant's owner, Unión Fenosa Generación (UFG), maintains that
this assessment of the control room interface creates an excessive penalty on operator-estimated
average times and is reflected in CNJC PSA results.
Objective
To bring in outside experts in the areas of human reliability and human factors engineering to
perform independent reviews of the CNJC control room interface.
Approach
This report focuses on activities involved in reviewing the modeling. The key activities included
• Review issues, assessments, and proposed plant improvements with engineers selected by
UFG
• Visit the CNJC plant and its control room to discuss PSA scenarios with operations staff
• Simulate critical procedures by having the operating crew talk and walk through the
procedures
• Review Human Factors application of NUREG-0700
• Visit the training simulator to review the man/machine interface.
Results
The report provides an integrated list of recommendations that were made during the review
process. The list includes those recommendations provided by UFG as supplemented by the
human factors and human reliability independent reviews.
v
EPRI Perspective
A Probabilistic Safety Analysis is prepared for every nuclear power plant in the United States
and for most international plants. Human factors and human reliability analyses can identify
ways in which a plant's design and operation can be improved. The proposed recommendations
for CNJC must be considered as a whole, and each upgrade should be coordinated with others
under consideration.
000000000001000028
Keywords
PRA
PSA
Human Factors
HRA
vi
EPRI Licensed Material
ABSTRACT
This document presents the results of a collaboration project between UNIÓN FENOSA
GENERACIÓN, S.A. (UFG) and EPRI. There were two tasks in the collaboration. The first was
to provide an independent review, evaluation and report on the use of the Human Cognitive
Reliability (HCR) methodology in the Probabilistic Safety Analysis (PSA) of José Cabrera
Nuclear Power Plant (CNJC). The second task was to provide an independent review, evaluation
and report on the human factors approach used in the CNJC control room.
The results of the reviews are presented in this report along with recommendations based on both
human factors review principles and risk reduction potential.
vii
CONTENTS
1 INTRODUCTION.................................................................................................................. 1-1
Overview ............................................................................................................................ 1-1
Independent Reviews ......................................................................................................... 1-3
Organization of Report........................................................................................................ 1-3
2 HUMAN RELIABILITY ASSESSMENT REVIEW................................................................. 2-1

Review of Issues ................................................................................................................ 2-1
Plant Visit ........................................................................................................................... 2-1
Control Room Interface .................................................................................................. 2-2
ES1.3 Procedure Simulation .......................................................................................... 2-2
Local Actions in Procedure ES1.3 .................................................................................. 2-3
Training Simulator .......................................................................................................... 2-3
HCR/PSA Assessment ....................................................................................................... 2-4
Summary of Current HCR Methodology Application ........................................................... 2-4
Suggestions for HCR Application in the PSA ...................................................................... 2-6
Discussion of Proposed Modifications................................................................................. 2-7
3 HUMAN FACTORS REVIEW............................................................................................... 3-1

Approach ............................................................................................................................ 3-1
Review of DCRDR Methodology Application at José Cabrera NPP .................................... 3-2
Operating Experience Review (OER) ............................................................................. 3-2
System Function and Task Analysis (SFTA) .................................................................. 3-2
Control Room Inventory ................................................................................................. 3-3
Control Room Survey..................................................................................................... 3-3
Verification of Task Performance Capabilities ................................................................ 3-3
Validation of Control Room Functions ............................................................................ 3-3
Human Factors Deviation Assessment and Disposition ................................................. 3-4
Walkdown of Control Panels............................................................................................... 3-4
ix
Observations from Walkthrough of ES 1.3 .......................................................................... 3-5

Recommendation A: Relocate Safety Related I&C from Back Panels to Front Panels........ 3-7
Recommendation B: Installation of Video Camera on Panel P-18....................................... 3-7
Recommendation C: Installing Multiple Video Cameras on Back of Panel’s
P-3 and P-4 ........................................................................................................................ 3-8
Recommendation D: Installation of a Back Panel Megaphony System ............................... 3-8
Recommendation E: Implementation of an Independent Reader/Checker Program............ 3-9
Recommendation F: Addition of a Critical Safety Status Indication System to the
Assistant Supervisors Console ........................................................................................... 3-9
Comments on UFG’s Recommendations from Human Factors Perspective ....................... 3-9
Additional Human Factors Recommendations .................................................................. 3-10
4 SUMMARY OF PROPOSED MODIFICATIONS................................................................... 4-1

List of Recommendations ................................................................................................... 4-2
Combined Recommendations............................................................................................. 4-2
Upgrade to Fair Interface ............................................................................................... 4-4
Upgrade to Good Interface............................................................................................. 4-4
Upgrade to Good Plus Interface ..................................................................................... 4-4
5 REFERENCES..................................................................................................................... 5-1
Key References .................................................................................................................. 5-1
Additional References......................................................................................................... 5-2
x
LIST OF FIGURES
Figure 1-1 Diagram of Control Room Layout ........................................................................... 1-3
xi
LIST OF TABLES
Table 2-1 Evaluation of Risk Reduction Potential in Proposed Modifications........................... 2-9

Table 3-1 Human Factors Back Panel Problem/Resolution Matrix........................................... 3-7
Table 4-1 Combined Recommendations ................................................................................. 4-3
xiii
LIST OF ACRONYMS
CDF Core Damage Frequency

CNJC José Cabrera Nuclear Power Plant
CR Control Room
CSN Nuclear Safety Council, (Consejo de Seguridad Nuclear)
DCRDR Detailed Control Room Design Review
EOP’s Emergency Operating Procedures
EPRI Electric Power Research Institute
ERG’s Emergency Response Guidelines
HCR Human Cognitive Reliability
HEP Human Error Probability
HFE Human Factors Engineering
HFR Human Factors Review
HRA Human Reliability Assessment
HFPP Human Factors Program Plan
I&C Instrumentation and Control
LOCA Loss of Coolant Accident
MMI Man-machine Interface
NRC Nuclear Regulatory Commission
OER Operating Experience Review
PSA Probabilistic Safety Analysis
PSF Performance Shaping Factor
PTL Paint, Tape and Label
PWR Pressurized Water Reactor
SFTA System Function and Task Analysis
SI Safety Injection
SPDS Safety Parameters Display System
THERP Technique for Human Error Rate Prediction
UFG UNIÓN FENOSA GENERACIÓN, S.A.
UFISA UNIÓN FENOSA INGENIERÍA, S.A.
WOG Westinghouse Owner’s Group
xv
1
INTRODUCTION
Overview
The Electric Power Research Institute (EPRI) located in Palo Alto, CA established a working
agreement with UNIÓN FENOSA GENERACIÓN, S.A (UFG), Madrid, Spain, owner of the
José Cabrera Nuclear Power Plant (CNJC). This agreement supports limited independent reviews
of the PSA/HRA and human factors assessments for CNJC. The Nuclear Safety Council,
Consejo de Seguridad Nuclear (CSN), the Spanish Regulatory Authority, considers elements of
the CNJC control room man-machine interface (MMI) to be a poor design.
The current CNJC Probabilistic Safety Analysis (PSA) dominant risk sequences are driven by
errors in performing the human action for switch-over from once through injection to
recirculation. The human reliability estimates in the internal events PSA are based on the human
cognitive reliability (HCR) methodology. This model was used in the analysis of CNJC PSA
human reliability assessment, to calculate the probability of cognitive errors. The THERP
methodology was used to calculate the probability of manual errors associated with each human
action.
As background, the initial HCR model uses qualitative assessments of the control room (CR)
interface based on several qualitative criteria. The MMI criteria were categorized into five
groups: extremely poor, poor, fair, good, and excellent. The extremely poor category requires the
operators to interpret indirect information to detect a cue for action. The poor interface has
displays available for the cue(s) needed in the accident, but they are not human engineered. The
fair interface has paint, label and tape demarcations by systems for the valves, pumps, and
instruments, but requires the operators to integrate the information for cues. The good interface
has the cue information integrated with alarms and procedures (e. g., safety parameter display
system (SPDS)). The excellent interface has advanced operator aids to support accident
management.
As shown in Figure 1-1 the CNJC CR consists of a two-panel configuration, with one panel
directly in front of the other panel. Critical instrumentation for monitoring and controlling the
reactor and turbine are located on both the front panel and the back panel. Following a reactor
trip and completion of the primary control actions, the operators must move to back panels to
verify and operate additional systems in order to accomplish the additional actions required in
the Emergency Operation Procedures (EOP’s). This panel arrangement impedes the vision and
communication between the Assistant Shift Supervisor and the Reactor Operator, and
consequently, does not allow continuous vigilance of the parameters and verification of control
actuations taken by the operator stationed at the back panel.
1-1
Introduction
In the current version of PSA, the CSN assesses the man-machine interface as “Poor” for this human
action. UFG maintains that this assessment of the CR interface creates an excessive penalty on
the estimated average times by the operators (according to the HCR modeling process), and this
is reflected in the CNJC PSA results.
A SPDS panel has been added to the back of panel P-3 facing panel P-9 in the CNJC CR as
support to the operation. In this system the plant’s critical emergency parameters are displayed.
Headphones have also been added to enhance communications between the back panel operator
and the procedure reader. These aids to operation have been taken into account in CNJC PSA,
and in the opinion of UFG, qualifies the man-machine interface factor used in the PSA as
“Good.”
Thus, disagreements exist between the CSN and CNJC PSA when it comes to qualifying the
man-machine interface. The CSN qualifies the man-machine interface remains as “Poor”, and
CNJC PSA qualifies it as “Good.” This difference has a large impact on the estimated core
damage frequency.
One improvement possibility for changing the classification to “good” or “very good” is to move
instrumentation on the back panel to the front panel. This proposed action would be a major
redesign for a plant that has been operating safely for many years.
For these reasons UFG sought the independent reviews of the PSA/HRA and the human factors
review of the CR interface from qualified reviewers. Tasks were designed to bring in outside
experts in the areas of human reliability/PSA and human factors engineering (HFE) to perform
independent reviews.
1-2
Introduction
Figure 1-1
Diagram of Control Room Layout
Independent Reviews
Reviews of the PSA and CR were conducted during the same time frame as two independent, but
concurrent tasks. The aim of human reliability/PSA task was to evaluate and report on the use of
the HCR methodology in the PSA of CNJC. The aim of the human factors review was to
evaluate implementation of the CNJC CR human factors reviews and qualitatively assess the
quality of the man-machine interface. The review team also qualitatively assessed UFG’s
recommended changes to the CR for their risk reduction potential and safety improvements.
These recommendations did not to consider economic factors such as cost of implementation nor
length of operating life expected at the plant.
Organization of Report
This report consists of three additional Sections. Section 2 describes the PSA/HRA review,
Section 3 explains the Human Factors review, and Section 4 summarizes review of
recommendations proposed to enhance the CNCJ CR man-machine interface.
1-3
2
HUMAN RELIABILITY ASSESSMENT REVIEW
This section focuses on the activities involved in review of the PSA/HRA modeling. The key
review activities for both the HRA/PSA and human factors review elements were carried out in
parallel for the two tasks:
• Review of the issues, assessments and proposed plant improvements with engineers selected
by UFG,
• Visit CNJC plant and CR to discuss PSA scenarios with operations staff,
• Simulate procedure ES1.3 for performing the switch-over from once through safety injection
to recirculation by having the operating crew talk and walk through the procedure,
• Review Human Factors application of NUREG–0700 (see Section 3 for additional details),
• Visit local sites in the plant for accomplishing manual valve changes to achieve switch-over
to recirculation,
• Visit training simulator to review the man machine interface (MMI),
• Review HRA modeling in detail,
• Hold discussions with UFG’s staff, and
• Present draft results on review findings and opinions on the proposed recommendations.
Review of Issues
The review team was initially briefed on the issues by a team of engineers selected by UFG and
chaired by Mr. Aquilino Rodríguez Cases, CNJC’s general manager. The main presenter was
Mr. Pedro Ortega Prieto, head of the nuclear engineering department for UNIÓN FENOSA
INGENIERÍA, S.A. (UFISA), who presented an overview of UFG’s current business, the basic
safety issues associated with the José Cabrera’s CR interface, and proposed actions under
consideration for reducing risk at the plant. Mr. Antonio Garcia Romero of Empresarios
Agrupados presented the details of the HCR method applied in the PSA’s current version (3) and
special sensitivity studies for assessing the effect of improved CR interfaces. Mr. Juan A. Burillo
Castano of Tecnatom s.a. presented details of the CR interface reviews using NUREG–0700.
The briefing provided an excellent basis for understanding the key issues raised by the CSN.
Plant Visit
On days two and three the review team and UFISA engineers visited the plant site. At the plant
the CR and the back panel was inspected from both the human factors and HRA viewpoints to
2-1
Human Reliability Assessment Review
understand the equipment available and information interfaces. The plant host was Mr. Carlos
Pomar Alfaro of UFG, who is Chief of Operations with about 30 years experience at the plant as
a senior reactor operator.
Control Room Interface
The control panel interface is typical of CRs for plants of this vintage. During the original design
the highest priority was given to normal operating controls and first line safety functions.
Secondary backup actions were seen as less important, thus I&C for less likely manual alignment
actions were placed on the back panels. Such systems can clearly be operated in a safe manner
by relying on the skill and experience of the operators. The reliability goals for these actions can
be maintained with a strong training program, and practice. However, for the task of
recirculation switch-over the CR MMI has been classified as “poor” by the CSN when applying
the HCR model.
Based upon this limited independent review of the layout at the plant, the review team believes
that the CSN assessment is accurate. There are three main reasons for a “poor” assessment,
which is applicable to the HCR model.
1. The shift supervisor who is reading the procedures could not see information on the
P-9 panel,
2. The panel indications and demarcations are not well separated from a functional viewpoint
(also, there are no mimics to support the local operators in verifying the relationship between
the valves, pumps, systems and indications), and
3. Confirmation of the action is by verbal response from the operator who changes valve
positions at the control panel.
Thus, improving verification and communication would improve the reliability assessment, even
though the operators currently compensate for the “poor” interface with experience and skill.
ES1.3 Procedure Simulation
Mr. Carlos Pomar Alfaro, Chief of Operations, directed selected members of the operating crew
to simulate the ES1.3 procedure for train A for switch-over from once through safety injection
(SI) to recirculation. The simulation began by assuming that the cues for switch-over had been
reached (i. e., low water level in the injection supply tank and enough water in the sump to
support pump suction). Since the training simulator is only a graphical interface, the crew ran
this simulation of the ES1.3 procedure using selected members of the on-duty plant crew in the
main CR by going through the procedure pretending that a LOCA had occurred. Each operator
went to panel locations, simulated the actions and verifications, and then verbally communicated
that required actions were accomplished. For local actions, a time delay was introduced to
simulate the actual time it takes to operate the manual valves. The time it takes to perform these
actions were known from many previous tests.
2-2
This series of manual steps is modeled in the PSA as one human action with different allowed
times depending on the size of the LOCA modeled in the sequence. The actions included in the
HCR time estimate consist of all the steps for aligning trains A, B, and the jet pump assuming
that trains A and B were failed. The HEP is then based on the probability of running out of time
when trying to align the jet pump, after the failures in trains A & B were detected.
Three items were identified which could improve the reliability assessment for implementing the
procedure. These are: the need to be able to “kick out of the procedures” when a response not
obtained occurs with no new option given in the procedures, the need for better verification of
responses that are obtained, and the need for a clear cue to implement the procedure.
Plant personnel justified the current process by noting that kick outs would be done when a
SPDS safety function monitor indicates red. Confidence in the procedures is very high at the
plant, because the procedures have been tested many times, verified using a test facility at Ispra,
Italy to simulate a one-loop design, and tested against experience. The review team proposed the
use of a check-off process while reading the procedures to verify each completed step. This
would enhance the ability to avoid repeating or skipping steps, although the operational staff felt
comfortable using the procedures in the way they are currently configured. The crew had a very
high confidence that the procedure integrity was good enough to handle all cases.
Local Actions in Procedure ES1.3
To verify the reliability of local actions required to re-align five manual valves of train A to
switch-over to recirculation SI, the review team went to each local location to verify
communication, operability, and timing assumed for the HCR model. Because communication
between the CR and local operation is by phone and loud speaker, a verbal communication test
was initiated. The test indicated that rapid responses between the CR and local site are typical.
The loud speaker provided communication from the CR to the local area, where local operators
provided feedback via phones. Phones were available to local operators within 20 meters from
any valve location. Valves 1267/1266 8832A/B, 8834 were labeled with tags, and were chained
and locked to prevent inadvertent operation. The key for these locks is controlled by the CR
operators and could be handed to the local auxiliary operators through an opening in the door to
the auxiliary building. If the key was lost, then bolt cutters, available in the CR, could be used.
The auxiliary operator would be put on alert status following a trip, and therefore has about
1 to 2 hours to review procedures and prepare for the local actions.
Based on the review of the local actions the times used appeared to be appropriately modeled for
internal events.
One improvement proposal is to motorize the valves needed to align train A. This would permit
the CR operators to reposition valves from the CR instead of relying on local actions.
Training Simulator
The plant uses an interactive graphic simulator to train operators on the use of procedures. The
review team visited the training facility and noted that the trainers could simulate many
2-3
transients that could verify use of the procedures during complex accidents. To simulate the
movement of operators between the back and front panels, a flat panel touch screen
representation of the current layout has been proposed as an upgrade option. This option applies,
if the current configuration is retained. The flat panels could be re-programmed so those new
configurations can be tested. If the panels were changed so that the front panel includes all of the
important information from the back, the need for such a training facility would be reduced. The
other option is to build a full scope simulator, which accurately models the plant interfaces for
physical operation of the switches.
To summarize, current training provides a complete simulation of plant parameters in response to

an accident, whereas the proposed graphic simulation of the back panels would add the ability
for operators to train on the positions they would take during the accident. The skill of operating
the panel switches can be practiced, if necessary, on a panel simulator with switches similar to
those on the panel or using plant simulators for other locations. These options are short of a full
scope simulator.
HCR/PSA Assessment
The assessment is expected to account for specific CR features, the specific quantitative
implementation and use in the CNJC PSA. Considering the assessment of poor for the CR
interfaces, the total failure probability is about 0.5 for a large LOCA, and somewhat less for
other LOCAs and a SG tube rupture scenarios. Because of the conservative modeling approach
for this HRA action, it is the major contributor in the plant’s PSA.
Very detailed assessments that follow very specific rules have been used to assess the timing for
each step (about 60 steps) and interaction with the plant equipment (5 manual valves for train A).
The median time for action of all the steps is between 27 minutes as measured during procedure
simulations, and 29 minutes, as assessed in the PSA. Following observation of the simulated
event at the plant, the timing for this action in the PSA is appropriate, however the quantification
process is overly conservative.
Summary of Current HCR Methodology Application
The initial version of the HCR methodology has been used in the CNJC PSA to calculate the
probability of error of the cognitive part of the human action. Later versions of the HCR model
have incorporated simulator data to verify and support the hypotheses of the initial HCR model
(EPRI NP-6937-L). However, only very limited simulator data were available to support
adjustments to the median response time (T1/2) by the use of K factors. Therefore, application of
K factors in the initial version of the HCR model requires the appropriate use of engineering
judgement.
The performance shaping factors used by the HCR model (stress, man-machine interface,
training and average time) have been estimated via questionnaires. All CNJC shift personnel
answered the questionnaires.
2-4
In the case of average time, the estimation has been made taking into account the specific
features of CNJC CR (front and back panels), the time for reading EOPs, the time spent
performing actions at back panel ((including the movements between panels), and time for local
actions outside the CR. The timing was verified by observation of the crew simulation of ES1.3
(steps 1-9).
The estimated average time has been penalized with a “stress” K factor.
HCR model estimated probabilities of error have been treated as MEDIANS of a lognormal
distribution, and then transformed into MEANS based on the uncertainty factor assigned to the
lognormal distribution for their utilization in the quantification. However, the factors of
uncertainty applied, (e.g., generic values of 5 and 10), are the conservative bounding ones
recommended by Swain in Table 7-2 of NUREG/CR-1278. A more realistic assessment of
uncertainty for generic actions is 3 as described on page 7-4 of NUREG/CR-1278. This is in line
with simulator observations in the HCR simulation data project that followed the development of
the initial HCR model. Furthermore, for realistic assessments human actions in LOCA events
Swain recommends the use of an uncertainty factor of 5 in Table 7-2. Thus, more realistic
uncertainty factors are 3 and 5, instead of 5 and 10.
Although CNJC qualifies the man-machine interface as GOOD, in the PSA it has been qualified
it as POOR for this human action following the position of CSN (i. e., using procedure ES1.3).
The difference in this qualification has a significant impact on the PSA results, given the
conservative nature of the assessment. For the dominant sequences the reduction in HEP ranges
from 76% to 95% for a good rather than poor MMI as assessed in the CNJC PSA rev. 3.
SPDS panels exist in CNJC CR and at the P-3 back panel (CRT COLOR in Figure 1-1) to
support operation and other functions. In this system the plant’s safety parameters and their
trends are provided. The SPDS supplies very good information interfaces, and therefore can be
considered as an improvement beyond a basic human factored control board. This aid to
operation has been taken into account in the CNJC PSA, by qualifying the man-machine
interface factor as “GOOD” on the basis of the SPDS.
The review team noted that even with the SPDS, the information on back panel is not available
to the shift supervisor in charge of the procedures. A new SPDS page could be added to the
SPDS system to fully justify a GOOD rating. For a GOOD rating in the original HCR model, it
was assumed that the control panel had been human factored. This includes demarcations for
each system and painted or taped lines connecting the valves and pumps. This simple step has
not yet been completed. Therefore, the review team concurs with the POOR rating for the MMI
as currently configured, because the shift supervisor has no way to independently verify that
switch-over actions have been taken. This increases the potential for errors in communication,
and in reading the procedures to continue without corrective actions if needed.
The review team suggestions for reaching a GOOD estimate are:
1. Provide P-9 panel safety information to the procedure reader via the SPDS so he can
independently verify the effects of each action,
2. Move back panel information to front panel for direct visual for the procedure reader, and
2-5
3. Install mimic diagrams and demarcation lines on the back panel to indicate which areas apply
to which systems, and practice procedures on an improved training simulator with a separate
back panel.
Suggestions for HCR Application in the PSA
The application of the HCR model in the CNJC PSA for the switchover action was very
conservative; that is, it over predicts the error probability. The following recommendations are
suggested to improve the use of HCR methodology in the PSA, and to enhance its use for
updating the model to consider various human factors improvements. These suggestions should
have a significant impact on reducing the overall core damage frequency, but they do not remove
the switch-over action as the most important one from a risk viewpoint. The following
suggestions address reductions in the modeling conservatism.
1. Improve the integration of the HCR assessment results with the system models. The current
HCR modeling in the PSA assumes that the steps for aligning trains A, B, and the jet pump are
required in all cases. The HCR model should include two additional cases. These are: (1) when
Train A is successful the HCR model needs only consider the steps for aligning Train A, and
(2) when Train A fails and Train B is successful then only the steps for aligning Train A and
Train B should be considered. The current model applies to the case when Trains A and B fail
and the jet pump is used. The correct method is to apply only those steps needed to align a
successful injection path. This methodology change would reduce the risk contribution of the
LOCAs by a large amount with no change in the current system.
2. Consider the time delay from the first cue to delayed cues for starting the switch-over action.
The current model application assumes the cue for switch-over to be a signal with no
pre-warning. In the case of ES1.3 an initial cue for this action starts about 1.5 hours earlier than
the cue of low water level in the water storage tank. This allows for pre-planning for the
switch-over when the safety injection first starts. Improved HCR models better account for
actions based on secondary delayed cues following an initial cue. This consideration would
produce a small HEP reduction.
3. Improve models for human error modes associated with the CR and local action steps. All
steps in the procedure are assumed to contribute to failure based on time, however the local
actions for manually operating the valves during the sequence appear to be subsumed in the HCR
time modeling assessment. Given the need to evaluate the risk change for motorizing the manual
valves, the contribution of manual errors in these actions should be made explicit to account for
key control, and manual action timing. This would better support sensitivity assessments. This
methodology issue might be risk neutral, although eliminated with motorized valves.
4. Subtract the time required for the manual local action steps from the total time available to
determine the time remaining for detection, assessment and planning the switch-over. The
current application considers carrying out the steps as contributors to the median response time
rather than subtraction from the total time. After reviewing the use of the procedures at the site, it
appears that the high cognitive content of using the procedures does justify the current use of the
steps as contributors to the median time.
2-6
5. Expand the number of performance shaping factor criteria (PSF) for more refined sensitivity
assessments. The HCR performance shaping factor criteria for changes in the man-machine
information interface need to be refined for intermediate values. (e. g., good +, or - might include
a combination of features which don’t fully meet a good human factors condition). This would
permit evaluations of various ranges of improvements and allow for finer risk sensitivity studies.
To account for PSFs the HCR model used in the PSA calculates the median response time as
T1/2 = T1/2 nominal * (1+K1)*(1+K2)*(1+K3)…(1+Kn).
Where Kn etc. represent adjustments to account for the PSFs such as stress, operator experience
and the quality of the MMI. K values are provided in the initial HCR model for the poor, fair,
good and excellent MMI. While this approach was not fully supported in the analysis of
simulator data, it does provide a simple way to adjust the median response time when accounting
for different improvements.
6. Apply type 5 (recovery actions) to the PSA cutsets (accident sequences), which are not
considered directly in the fault trees. This permits better assessment of the accident dependencies
and reexamination of all actions in the context of the accident sequence. This typical PSA step
has not been performed. This process typically reduces the assessed risk value by some
percentage.
Discussion of Proposed Modifications
The review team was asked to provide opinions on several proposed changes to the plant that
have risk reduction possibilities. Recommendations have been sought to resolve the
man-machine interface issues and improve the co-ordination of the actions between the operator
in charge of this panel, and the Assistant of the Shift Head, who reads the EOP. The following
key risk reduction ideas have been proposed.
1. Use of a video camera to verify that the operator is at the back panel,
2. Motorize five manual valves so that no local actions would be required for switch-over to
recirculation using train A,
3. Rearrange the panels so that the information on the back panel is visible to the shift
supervisor, and
4. Provide a back panel simulation in the training building. (The current graphical interface
provides training on the procedures with CRTs).
Following discussions on these elements with the plant staff and the review team, a table was
constructed to provide a qualitative judgment of how these and other modifications might
support risk reduction at the plant. Table 2-1 provides a qualitative assessment from the
perspective of the HRA/PSA modeling. The actual risk change would have to be evaluated with
the risk model.
2-7
In elements 3 and 7 of Table 2-1 improvement factors have been estimated for their potential
impact when using the HCR model. These estimates are applied as multipliers on the median
time values. For example the multiplication factor on the median time would change
from 1.78 to 1.57 as follows:
New factor after implementing changes 2 and 5 becomes

T1/2 = T1/2 nom * (1+0.78)*(1-0.1)*(1-0.02) = T1/2 nom * 1.57.
This is important to the overall core damage frequency (CDF) in rev 3, because the top 50%
contributors include the switch-over as a key action. The total CDF is 8.91E-5/year, which is in
the upper level for PWRs in the US. Thus, as a rough approximation the example above would
reduce the switch-over HEP by about 20% and this would reduce the total core CDF by about
5%. The most effective upgrade is to motorize the valves, which was estimated in the CNJC PSA
sensitivity assessment to reduce the CDF to 5E-5/year, which is typical of the average US PWR.
2-8
Table 2-1
Evaluation of Risk Reduction Potential in Proposed Modifications
Recommended Actions grouped from Qualitative Assessment of Risk reduction

Remarks
Human Factors and HRA potential
Just moving the panel information to the front
Relocate all safety related I&C from back panels panel does not by itself create a good interface. This could range from a negative to positive risk
to front panels by redesigning the control room The process would require significant human impact taking into account training on a new system
interface. factors involvement to ensure that the principles and the degree of human factors enhancement.
of information flow and layout are observed.
SPDS needs to be available to people
A SPDS panel was installed on the back of the The SPDS contributes to an improved CR interface,
responsible for taking action, back panel
turbine panel directly across from panel P-9, to although not directly to the switch-over action
operations are for taking action, monitoring, and
visualize the plant’s safety parameters in 1997. issues. Small reduction (10% on some sequences)
verification.
Install a megaphony system that is independent

Reduction on errors in communication which are
of the current plant system, and exclusively
This is a good action to improve communications. not directly modeled, but could be represented by a
aimed at communications between the rear and
-.1 to -.2 adjustment on median time.
front panels.
Install a single video camera on Panel P-18 or This provides a view that the operator is at the This item was not aimed to reduce risk, but rather it
multiple video cameras on back of Panel’s P-3 panel, but detail of the action or verification of was proposed to address a HF CR deviation. It
and P-4 so that the Assistant Shift Head can readings or positions would require significant may contribute to human error by distracting the
"see" operations at the P-9 panel. manipulation of the camera. procedure reader when manipulating the camera.
This addresses verification of all human actions

Adding critical safety system status indications
on the back panel and locally by observing the
at Supervisor’s Console. This provides an This item should change the control room interface
effect of the action through the control system.
interactive graphical representation of back from poor to good under the current HCR model
This means that the procedure reader checks
panel information on the SPDS or other monitor structure and result in a 50% reduction in risk.
each step as completed both verbally and via the
for the procedure reader.
change on the SPDS.
The manual errors for these actions are not in the

contributing cutsets, however their impact is
Motorize selected valves that require local This will reduce errors associated with CR local covered in the conservative assessment using the
operation during switchover to recirculation to communications, getting keys, selecting correct HCR model. If the model was revised the motor
increase automation of the task. valves, and manual errors in opening the valves. failure would replace the failure to align, and
manual backup could be considered as a recovery
action. (50% reduction in sequence frequency).
The risk reduction on the errors in reading gauges

Reduction on errors in reading instruments.
should be reduced by 5 to 10 % (This could be
Provide new lighting (implemented) Should be supplemented by human factors review
represented as a -.02 to -.03 factor in the current
of each gauge.
HCR application.
This will reduce errors associated with omitting
steps or repeating steps. Becomes more
Implement a verification process when reading
important if the reader also verifies the action Small reduction in risk on some sequences
procedures
taken either by video camera or by use of a
computer display.
The will reduce errors associated with selection
Implement an independent reader/checker and reading errors on the back panel. This
Risk reduction benefit is unclear.
program relieves the procedure reader from verification
responsibility.
Practice the location and movement of operators This would improve the training aspect, but might
Study on CR operator activity using control
so that they know where all the control interfaces cause some inadvertent action that leads to a trip of
room as a simulator
are located. the plant. (Overall slightly risk reducing).
If the new ones are digital and data can be stored
electronically, they could enhance data retrieval
Replace strip charts on P-9 with new digital This recommendation was proposed to address a
and reduce storage cost. They might help with
recorders HF CR deviation. Risk reduction benefit is unclear.
verification of actions if provided on the front
panel.
This will improve the capabilities of training to
address location of operators during accident
Provide an interactive graphical representation Improves the training level in the HCR model and
scenarios. It still lacks the capability to improve
of back panel in a training simulator upgrade. may switch some activities from rule to skill.
skills on the operation of switches and control
interfaces.
Bringing in independent experts on a periodic This activity could have a risk reducing effect
Review of man-machine interface by
basis can help crews and safety systems be initially and then verify that the results are
independent third parties
prepared at all times for human factor type issues. maintained.
2-9
3
HUMAN FACTORS REVIEW
This section describes the assessment of the Human Factors review.
Approach
The CNJC CR consists of a two-panel configuration, with one panel directly in front of the other
panel. Instrumentation for monitoring and controlling the reactor and turbine are located on both
the front and back panels. During accident sequences, the operators must move to back panels to
verify and operate certain systems in order to accomplish the Emergency Operation Procedures
(EOPs). This panel arrangement impedes the vision and communication between the Assistant
Shift Supervisor and the Reactor Operator, and consequently, does not allow continuous
vigilance of the parameters and verification of control actuations when the operator is stationed
at the back panel.
CNJC has implemented compensatory measures to improve the co-ordination of the actions
between the Reactor Operator in charge of this panel and the Assistant Shift Supervisor who
reads the EOP. These measures include:
• Installation of a SPDS on the back of the turbine panel directly across from panel P-9, to
visualize the plant’s safety parameters, and
• The provision of headphones with built-in microphone permits enhanced communication
between the operator at the P-9 panel and the operators at the front panels of the CR.
Despite these changes, CSN, the Spanish regulatory authority, considers the CNJC CR
man-machine interface (MMI) to be a poor design.
The human factors evaluation consisted of three parts:
1. A high level review of the Detailed Control Room Design Review (DCRDR) conducted on
the CNJC CR between the years 1990 – 1992;
2. A CR walk-down to:
– verify that the recommendations identified during the DCRDR have been implemented or
adequately justified, and
– ascertain the extent to which any panel changes made subsequent to the DCRDR conform
to the human factors guidance contained in NUREG-0700;
3-1
Human Factors Review
3. A desktop review and a real-time walk down of the first 9 steps of ES 1.3 Realignment of
Recirculation.
Review of DCRDR Methodology Application at José Cabrera NPP
The first step of the independent evaluation involved review of past human factors efforts
conducted at CNJC. Between 1990 and 1992, a DCRDR was conducted by a Spanish
engineering consulting firm, Tecnatom, s.a. The DCRDR documentation consists of a 3 volume
technical report containing the program plan, methodology, and results; an Executive Summary;
an electronic database containing human engineering findings, recommendations and
dispositions; a photographic control panel inventory; and a file containing the results of the
operator interviews. Since the DCRDR was performed approximately ten years ago, the basis for
the DCRDR was NUREG-0700 (revision 0). Approximately one-half day was available for the
review of the DCRDR methodology and findings. The brief review of the DCRDR
documentation suggests that the DCRDR process closely followed the methodology
recommended by the guidance contained in NUREG-0700.
Operating Experience Review (OER)
A review of CNJC’s operating experience was conducted which included an examination of the
plants performance records and a survey of the plant’s control room (CR) operations personnel
were interviewed in an attempt to identify any special knowledge the operations staff had
regarding operators. The purpose of this review was to identify factors that may contribute
to plant or operator performance problems that could be alleviated by improved human
factors engineering. The plants performance records were examined over a 22 year period.
NUREG-0700 states that the plant-specific review could be limited to material from the past
five years if the plant has been operating longer. The fact that the CNJC records review went
back to when the plant went on-line (an additional 17 years than that suggested in the regulation)
suggests that the reviewers made a sincere effort to identify performance issues. In addition to
the records review, the CR operations personnel were interviewed in an attempt to identify any
special knowledge the operations staff had regarding problems in CR design that could have a
negative impact on plant performance. The reactor operators, turbine operators, supervisors and
assistant supervisors from all shifts participated in this survey.
System Function and Task Analysis (SFTA)
A review of the plants systems, functions and operator tasks were conducted to help establish the
CR information and control requirements necessary for safe plant operation. The Westinghouse
Owner’s Group (WOG) Emergency Response Guidelines (ERGs) served as the basis for the
SFTA. The WOG ERGs, in turn, served as the basis for development of the plant’s symptom-
based emergency operating procedures. The design of the José Cabrera NPP is unique in that it is
a one-loop plant. To account for differences in the ERGs and the findings of the SFTA, special
engineering studies were conducted. These studies included the development of simulation
models (i.e., Project BL-40 at LOBI, Ispra, Italy; engineering code RELAP/Mod 2) to identify
accident times and sequences expected after postulated accidents and the actions necessary to
mitigate the accidents.
3-2
Control Room Inventory
A complete photographic inventory of José Cabrera’s CR control panels I&C was generated. The
objective of the inventory was to establish a set of reference data for all displays, controls and
equipment in the CR for comparison with the requirements identified in the analysis of operator
tasks. The photographic inventory is neatly organized in a three ring binder and categorized to
facilitate rapid retrieval of particular controls and displays. Unique attributes of the plant’s
Instrumentation and Control (I&C) were identified and documented in a separate computer
database. In addition to its use to help verify the availability and suitability of the CR
instrumentation and control, the inventory was used to help select the best location for adding
new controls and displays for the new main feedwater control system.
Control Room Survey
A systematic comparison of CR design features to human factors engineering criteria was

conducted to identify any characteristics of I&C design, equipment layout, and environmental
conditions that do not conform to the precepts of good human factors practice. The nine review
areas contained in Section 6 of NUREG-0700 were included in the review. The approach
included measurement, interviews, observation and checklists, and document review. Deviations
from good human factors engineering practice were documented for later review by a
multidisciplinary review team.
Verification of Task Performance Capabilities
The verification phase of the DCRDR consisted of two steps: First, verification of the presence
of information and control capabilities necessary to implement each task identified in the task
analysis, and second, verification that the man-machine interfaces provided by the controls,
displays and other CR equipment are effectively designed to support task accomplishment. The
purpose of these verification steps was to assure that the CR operators can perform their tasks in
the CR with a minimum potential for human error.
Validation of Control Room Functions
A validation was carried out in the CNJC CR to ensure that the functions allocated to the
operators can be effectively accomplished using the new symptom-based EOPs within the
constraints of the existing CR design. The validation was carried out using the interactive
graphic simulator. The simulator was used to gather time values between initiating events
(e.g., alarm annunciation), subsequent operator actions (e.g., control actuations), and expected
plant responses as displayed on control panel instrumentation. Using estimated time values, the
operators walked through the EOPs while observers attempted to identify the quality of the
interaction between operators and between the operators and the existing display systems.
3-3
Human Factors Deviation Assessment and Disposition
The human factors deviations identified as part of the DCRDR were subjected to a risk-based
assessment process. The assessment was done by a multidisciplinary review committee
composed of experts from the areas of production, engineering, operations, PSA, human factors,
maintenance and I&C. The human factors findings were dispositioned based upon the four-point
categorization scheme that was developed and assigned by the committee of experts. Resolution
of category I findings are mandatory, category II findings are of high priority, category III
findings are recommended, and category IV findings are non-mandatory. Time did not allow for
an adequate review of the human factors deviations identified during the DCRDR. Similarly,
only a small sample of the results of the assessment and implementation process could be
evaluated. Based on this sampling and the number of existing human factors problems found
with the control panels (see Walkdown of Control Panels section below), it was concluded that
the process for identifying human factors deficiencies, dispositioning discrepancies and
implementing CR modifications was not as thorough as it could have been.
Walkdown of Control Panels
A walkdown of the control panels was undertaken to verify that the recommendations identified
during the DCRDR had been implemented, and to ascertain the extent to which any panel
changes made subsequent to the DCRDR conform to the human factors guidance contained in
NUREG-0700. Generally, many of the human factors findings identified in the DCRDR had
been addressed. However, problems with the MMI were still observed, several of which do not
appear to have been identified in the DCRDR. A sample of the human factors problems
identified during the walkdown include:
• Control indicator light receptacles are not uniquely keyed allowing open/on status placards
(i.e., legend displays) associated with valves/pumps to be accidentally inserted in close/off
receptacles,
• Many of the control indicator legend lights were dim making it difficult to quickly and
accurately determine the status of equipment,
• Glossy (high reflective) paint is used on the control panels contributing to excessive glare on
the indicators exacerbated by poor overhead lighting,
• Functional summary labeling was missing for many of the systems and subsystems on the
control panels,
• Mimic lines depicting flow paths or loops of a given system have not been applied to the
control panels,
• Systems and subsystems have not been functionally grouped. Demarcation lines and panel
shading to accentuate related controls and displays and to help differentiate I&C pertaining to
unrelated systems has not been applied to the control panels,
• Display scale zone markings to help the operators quickly and accurately assess the
operational implications of various readings such as upper limits, operating range, and lower
limits have not been added to the displays, and
3-4
• Vertical indicators were observed with scales increasing by units other than 2, 5 or 10. The
ranges were not immediately apparent when the display is indicating in the positive or
negative range, or with pointers pegged high or low. Thus, the inappropriate scale precision
and/or sensitivity, it is not immediately apparent if a display has failed or become
inoperative.
Since completion of the DCRDR in 1992, approximately 100 modifications have been made to
the control panels. While these changes are viewed as positive and generally contribute to
improvements in plant and operator performance, the changes were made without subjecting the
proposed modifications to a human factors review. UFG recognizes that the equipment added to
the control panels should have undergone a human factors analysis prior to implementation. As a
result, plans are underway to apply the guidance in NUREG-0700 to the newly added I&C. It
should be pointed out that NUREG-0700 was revised in 1996. Rev 1 was mainly a revision of
the NUREG to expand the scope of the document to include general computer-based interfaces,
local control stations, and computer-based alarm systems. Except for the latter, most of the
guidance came from the existing guidance sources referenced in the original version of
NUREG-0700. The follow-on review is scheduled to take place between 1 March and
31 May 2000. The human factors review is planned to be completed prior to the outage currently
scheduled to begin in July 2000. The plan is for any control panel modifications identified as
necessary as a result of the human factors deficiency assessment process to be implemented
during the summer outage. It is recommended that the follow-on human factors review use the
criteria contained in NUREG-0700 Rev. (1).
Observations from Walkthrough of ES 1.3
The CR operators performed a walkthrough of the first nine steps of procedure ES 1.3, switch-
over from once through injection to recirculation. The procedure requires the operators to
perform a series of steps for aligning train A, train B, and the train C jet pump (several of which
require the remote “manual” opening of valves by auxiliary operators out in the plant). This
sequence of events was selected for the walkthrough because in the PSA it was modeled as the
dominant human action and greatest contributor to risk. While more detail on this simulated
event from a probabilistic HRA/PSA perspective can be found in Section 2, there are important
human factors issues identified during the walkthrough that need to be noted.
The sequence of events requires the operators to control the plant from both the front and back
panels. A major problem with parallel control boards is that I&C located on the backpanels is
obscured by the front panels, making it difficult for the supervisor to verify operator responses.
Such a design is in fact a violation of NUREG-0700 criterion 6.1.1.1 (b) (NUREG-0700
Rev. (1), criterion 7.2.1-2). It states that “operators should not have to leave the primary
operating area to attend to control room instrumentation on back panels during operational
sequences in which continuous monitoring or the timing of control actions may be critical”.
Due to the poor control panel arrangement in the CR, the sequence of events for the ES 1.3
procedure requires the operators to alternate between the front panels and back panels to take the
necessary control actions. Feedback of plant response is verified by checking indications
similarly located on both front and back panels.
3-5
As stated earlier, the main problem as identified by UFG is that the I&C on the back panels are
obscured by the front panels. Further analysis of this problem reveals that there are really five
separate human factors concerns. These concerns are:
1. Inability to verify control actuation’s,
2. Inability to verify proper display settings,
3. Operator travel delay increases risk for time critical actions,
4. Miscommunication between Assistant Supervisor and Operators, and
5. Interference between the Reactor Operator and Turbine Operator.
To correct this problem, an example recommendation has been proposed by CSN to relocate
critical safety I&C from the back panels to the front panels. UFG has countered with the addition
of closed-circuit TV cameras and megaphony to improve operator performance due to the poor
control panel location. Recommendations in addition to the solutions already proposed include:
• The implementation of an independent reader checker program.
• The addition of critical safety system status indicators at the Assistant Supervisors Console.
• A combination of the above.
In summary, a total of six CR backfits have been proposed. These include:
A. Relocating all safety related I&C from back panels to front panels
B. Installing a single video camera on Panel P-18
C. Installing multiple video cameras on back of Panel’s P-3 and P-4
D. Installing a megaphony system
E. Implementing an independent reader/checker program
F. Adding critical safety system status indications at Supervisor’s Console
In an attempt to systematically address the control panel location problem, a matrix of human
factors concerns and proposed resolutions has been constructed. This matrix is presented in
Table 3-1 below.
3-6
Table 3-1
Human Factors Back Panel Problem/Resolution Matrix
Human Factors Concern
Recommendation 1 2 3 4 5
A Partial No Yes Yes Yes
B No No No No No
C Partial Partial No No No
D No No No Yes No
E Yes Yes No No No
F Yes Yes No No No
Each recommendation is systematically addressed from the human factors perspective below.
Recommendation A: Relocate Safety Related I&C from Back Panels to

Front Panels
Relocating critical safety equipment to the front panels addresses three of the five human factors
concerns with the existing control panel location, and partially solves another concern. The only
concern not addressed is the Assistant Supervisors ability to verify parameter status from his
workstation. Removal of displays from the back panel to the front panel, or even the addition of
redundant indicators to the front panels, still does not allow the Assistant Supervisor to
accurately verify the status of critical safety parameters. The distance from the Assistant
Supervisors workstation to the front control boards is too great to allow for efficient, confident
and reliable verification. In some cases, however, the Assistant Supervisor will be able to verify
control actuations, but only if the operator is not standing directly in front of the Assistant
Supervisor and only if the Assistant Supervisor is looking at the operator at the time of control
activation. The relocation of I&C to the front panels does result in decreased operator travel
times between control systems thereby increasing the response time (favorably) for control
actuations and indicator verification. Similarly, the probability of miscommunication between
the Assistant Supervisor and the operators is reduced due to greater proximity between the team
members. Finally, the potential for interference between the Reactor Operator and Turbine
Operator should be reduced due to better collocation of the necessary controls and displays.
Recommendation B: Installation of Video Camera on Panel P-18
Installing a video camera on the top of control panel P-18 and a monitor on the Assistant
Supervisors workstation will allow the Assistant Supervisor to see the reactor and turbine
operators behind the front panels. This recommendation was proposed to address a HF CR
deviation, however, none of the human factors concerns in Table 3-1 would be addressed. The
position of the camera atop the P-18 panel will provide the Assistant Supervisor with a profile
3-7
view of the operators as they interact with the I&C on the back panels. However, due to the
position of the camera, the Assistant Supervisor will be unable to verify that the proper controls
have been activated, nor will they be able to verify through secondary means (e.g., reading
indicator level flows, levels) that the plant is responding as intended. The great distances
between crew members still exists resulting in the attendant problems of miscommunication
between operators, the potential for interference as the operators walk between the front and
back panels, and the corresponding time delay between operator control actions.
Recommendation C: Installing Multiple Video Cameras on Back of Panel’s

P-3 and P-4
The installation of video cameras to the rear of Panel’s P-3 and P-4 and the addition of a video
monitor on the Assistant Supervisor’s workstation were proposed to address a HF CR deviation.
It will partially address two of the five human factors concerns. Outfitting the Assistant
Supervisor’s workstation with pan, tilt and zoom controls for the cameras should enable the
supervisor to verify that the proper controls have been actuated and may allow for the
verification of display status. However, such verification is highly dependent upon the location
of the operator with respect to the camera and the attendant controls and displays. This back-fit
still does not address the additional travel delay imposed on the operators due to poor control
panel location, nor the potential for miscommunication between the Assistant Supervisor and the
panel operators, or interference among crew members. Recommendation C also introduces a new
human factors concern. The additional equipment that would be necessary to control the cameras
to monitor back panel activities would increase the workload of the Assistant Supervisor. The
increase in workload could result in sufficient distraction from the Assistant Supervisor’s
primary task (i.e., managing operator response via the EOP instructions) resulting in a vigilance
decrement. This vigilance decrement could result in reduced situation awareness of plant
conditions thereby contributing to an increase in operational risk.
Recommendation D: Installation of a Back Panel Megaphony System
The installation of microphones to the back panels would solve one of the five human factors
concerns. With microphones added to selective regions of the back panels, the operators should
be able to communicate with the Assistant Supervisor without shouting, thereby minimizing the
probability of a communication error. None of the other four human factors concerns would be
addressed by this backfit, however. Such a system would also require the addition of speakers on
both the back panels and at the Assistant Supervisors workstation. It is not recommended that the
voice signals be routed through the CR paging system, as this would contribute to an increase in
the ambient noise levels in the primary operating area. While communication headsets would be
a possibility, this system does not seem to be favored by the operators. CNJC has added
communication jacks on the rear of the front panel to enable remote telephony between the
operators and the Assistant Shift Supervisor. However, the system was not observed to be in use.
It’s possible that the length of the communication cables that would be necessary for the
operators to monitor the length of the back panels would cause a trip hazard. Depending on the
particular technology, the weight of the headset could be uncomfortable for the operators.
Wireless communication is a possibility, but there is a risk of stray signals causing interference
with the I&C.
3-8
Recommendation E: Implementation of an Independent Reader/Checker

Program
A reader/checker is an individual, separate from the existing operating crew, whose job function
during transient events is to accompany the Reactor Operator and Turbine Operator as they
transit the control panels to independently verify that they have carried out the appropriate
actions as required by the EOPs. The addition of a reader/checker would address two of the five
human factors concerns. By accompanying the CR operators during plant transients, the
independent reader/checker would be able to verify that the proper controls were actuated and
that the plant is responding properly (as suggested by the control panel instrumentation). This
particular backfit does not address the remaining problems of travel delay, miscommunication,
and interference. In fact, the addition of a new “crew member” would theoretically exacerbate
any problems with crew interference.
Recommendation F: Addition of a Critical Safety Status Indication System

to the Assistant Supervisors Console
The recommendation is to install either new page(s)/screen(s) on the existing SPDS system, or a
new dedicated monitor display system at the Assistant Supervisors Console that could be used to
verify control actuations taken by the CR operators while at the back panels, and to verify plant
parameters. This backfit addresses two of the five human factors concerns. The advantage of this
recommendation is that it provides immediate and accurate feedback to the Assistant Supervisor.
An added advantage of this backfit is that because the system can utilize signals that are
presently used to drive the SPDS system, the system can be installed at a relatively minimal
expense. This backfit does not address the remaining problems of travel delay,
miscommunication, and interference.
Comments on UFG’s Recommendations from Human Factors Perspective
As a way of reducing risk, UFG has proposed four human factors improvements in regard to the
present CR panel configuration. These improvements are identified below:
New recorders – Digital color graphic recorders will be added to the control panels to replace the
existing paper trend recorders. In addition to improving reliability and maintainability, the
recorders should make it easier for the operators to quickly grasp trends. It is recommended that
the MMI of the recorders be subjected to a thorough human factors review before the recorders
are installed on the panels. Interfaces for multifunction displays can be very difficult to operate.
If designed improperly, navigation through various display functions can be frustrating at best.
The CR operators should be involved in the review of the recorders MMI, and should have input
into the selection process. The recorders should be installed on the control panels in accordance
with recommended visual zones for vertical panels and bench boards as identified in
NUREG-0700 Rev. (1).
Lighting – A CR lighting survey for normal and emergency operation was conducted as part of
the DCRDR and submitted to CSN for review. The regulatory agency identified the need for
additional work in several areas e.g., lighting for additional modes of operation, surveying
3-9
different panels and at multiple locations on a panel. CNJC has agreed to conduct additional
surveys and to use the criteria identified in NUREG-0700 Rev. (1). The review team
recommended that a lighting survey be conducted as soon as possible, and that deficiencies be
corrected in a timely manner.
Megaphony – As described earlier in this report, CNJC has added communication jacks to the
rear of the front panels and procured headsets for the operators to facilitate communication
between the operators on the back panels and the Assistant Shift Supervisor. According to the
operators interviewed, the current headset system is not utilized unless the operators found it
necessary. They are normally not needed. Reluctance to use the headsets may be due potential
trip hazards caused by the transmission wires, or uncomfortable headsets. Therefore, UFG is
continuing to explore alternative communication systems such as wireless headsets and control
panel microphones with remote speakers. If hardwired microphones and speakers are installed,
the voice signals should not be routed through the CR paging system as this would contribute to
an increase in the ambient noise levels in the primary operating area.
TV cameras – The addition of closed-circuit TV cameras have been proposed as a human factors
risk reduction method. As described earlier in this report, the addition of a single camera or
multiple cameras will not address all of the human factors concerns associated with a back panel
CR configuration. In fact, a single camera won’t address any of the concerns, and multiple
cameras could actually contribute to an increase in risk. For these reasons, the addition of a
closed-circuit TV system is not recommended.
Additional recommendations for reducing risk include modifications to the graphic simulator and
valve motorization for safety injection recirculation. A detailed discussion of these
improvements is provided in Section 2 of this report.
Additional Human Factors Recommendations
As a result of this high-level human factors evaluation of the José Cabrera Nuclear Power Plant
CR, the following recommendations are offered:
Install a new critical safety status indication system, including megaphony, at the Assistant Shift
Supervisors Console
The addition of new screens on the SPDS display, or a dedicated display to verify the status of
critical operational status of the I&C on the back panel, is recommended as the preferred way for
reducing the risk caused by a front and back panel CR configuration (Recommendation F above).
With the addition of microphones on the rear panels and a small dedicated speaker at the
Assistant Supervisors console (Recommendation D above), three of the five human factors
concerns with the front/back panel arrangement are satisfied. The two remaining concerns,
1) operator travel delay increasing risk due to time critical actions, and 2) interference between
the reactor operator and turbine operator can be solved analytically.
3-10
Results from the PSA suggest that by motorizing the valves involved in switch-over to
recirculation, the additional time gained translate into a significant reduction in risk. Additional
information that is more detailed pertaining to risk reduction can be found in Section 2 of this
report.
While observing the walk though of procedure ES 1.3, Switch-over to recirculation, the Reactor
Operator made three trips to the back panel. During the same event, the Turbine Operator made
one trip to the back panel. No interference was observed between the two operators. However, to
adequately demonstrate that interference is not a problem, it is recommended that a link analysis
be conducted on the procedure. A link analysis diagrams the movements of the operators as they
transit the boards while interfacing with the I&C. Link analysis is a useful analytical tool in that
it shows the travel routes taken by the crew based on their response to the plant evolution. The
link analysis should be done in real-time using time sequence data generated when the evolution
is run on the graphic simulator. The procedure for conducting link analysis is described in
NUREG-0700 as well as in its supporting reference documentation.
Combining Recommendation F (add critical safety system indicators at Supervisors console)

with Recommendation A (relocate I&C to front panel) would satisfy all of the human factors
concerns. However, the removal of I&C to the front panels is not necessarily recommended as
the preferred method of reducing risk due to the possibility of interference with previous
training. The problem of potential interference with operator’s past training or learning needs to
be considered carefully. There are two issues that need to be considered. First, will the change
result in interference with prior learning? Second, if it does, will the increase in performance
resulting from the change be greater than the potential detriment in performance due to
interference with previous learning? Transfer of training or learning depends on stimulus and
response similarity, and the similarity of performance strategies between different tasks. If it is
more difficult to learn a new task as a result of having learned an earlier task, then negative
transfer may occur. Negative transfer is most likely to occur when similar stimuli indicate
different, but confusable, responses. Negative transfer may appear in the form of intrusive errors,
which typically should be avoided, in dangerous or expensive contexts. In addition to the
significant cost associated with a control panel redesign, a new I&C arrangement would
necessitate the relearning of response sequences which operators have been employing
successfully without incident for over 15 years. The introduction of new response patterns could
result in an inadvertent control actuations or time delays, at least initially as the operators gain
familiarity with the new control panel arrangement. However, a well designed training program,
when utilized with a verified and validated set of EOPs in conjunction with a simulator should
reduce the potential for negative transfer.
Utilize a certified human factors professional to help establish a systematic human factors
program at CNJC
Ideally, it is recommended that a human factors engineer be hired to help establish the human
factors program at the José Cabrera Nuclear Power Plant. If permanent employment is not
possible, than a board certified human factors professional (CHFP) should be employed under
contract to help train a person designated by UFG to implement and administer human factors
programs. Ideally, this individual would be housed within the safety department to help
minimize or prevent any conflicts of interest which often arise when the human factors
professional is associated with the engineering department.
3-11
The role of the human factors engineer would be to develop a Human Factors Program Plan
(HFPP) to systematically address all of the human factors related activities that are presently
ongoing or planned at CNJC. To this end, it is recommended that the following human factors
activities be addressed by CNJC as soon as possible, and that these activities be addressed in an
integrated HFPP. It is recommended, therefore, that the HFPP should address how CNJC will
plan for and conduct the following human factors activities:
• Resolution of open human factors deficiencies from the 1990-1992 DCRDR,
• NUREG-0700 Rev. (1) review of I&C added to the control panels subsequent to the 1990-
1992 DCRDR,
• A plan for ensuring that human factors criteria are considered in future CR modifications, as
well as future plant modifications (e.g., maintenance issues),
• A plan for addressing the existing human factors concerns identified during the independent
review and documented in the Walkdown of Control Panels section of this report,
• A plan for assessing the importance of human factors deficiencies from a risk perspective,
and for implementing the proposed resolutions, and
• A plan for ensuring that human factors criteria are properly considered in the design of the
new graphics simulator display screens.
• The HFPP should conform to the guidance presented in NUREG-0700 Rev. (1) and
NUREG-0711.
Include Human Factors Engineering in the design of the new graphic simulator
The design of the new graphic simulator display pages will require significant input from the
HFE professional. Much guidance has been developed in the past several years pertaining to the
design of the MMI for computer-based display systems. IEEE Standard 1289-1998, “Guide for
the Application of Human Factors Engineering in the Design of Computer-based Monitoring and
Control Displays for Nuclear Power Generating Stations,” provides much useful guidance for the
developers of these new digital display systems. The particular mode of interaction with the
display will require careful consideration. For example, there are human factors advantages for
using a touch panel display to allow the operators to interface with two-dimensional
representations of the CR panel controls and displays. Much useful guidance in this area, as well
as in the area of MMI simulation design, can be found in research reports coming out of the
Halden Reactor Project. These reports should be consulted throughout the design process.
Conduct a Human Factors review of I&C installed subsequent to the last DCRDR
It is estimated that over 100 design changes have been made to the control panels since the
DCRDR was performed over 10 years ago. It is recommended that the review criteria in
NUREG-0700 Rev. (1) be applied in a systematic fashion to these control panel changes to
identify characteristics of the new I&C, equipment and their physical arrangements that may
detract from operator performance.
3-12
Implement changes to the control panels that were dismissed or omitted from the DCRDR
A walkthrough of the CR resulted in the identification of many human factors deficiencies.

Many of the deficiencies, such as those identified in the Walkdown of Control Panels section of
this report, appear to have been missed in the original DCRDR. Other deficiencies were
identified, but due to the deficiency assessment process utilized at José Cabrera, were not
implemented as part of the CR enhancement process. Many enhancements to the control panels
can be made through relatively simple paint, tape and label (PTL) enhancements. These PTL
enhancements (such as the addition of functional group summary labels, demarcation lines to
separate different systems, and control panel shading to help associate related I&C within a
functional group) should be implemented as soon as possible. Such human factors improvements
provide great benefit from a human performance perspective.
3-13
4
SUMMARY OF PROPOSED MODIFICATIONS
The current CNCJ PSA models and sensitivity analysis indicate that a significant risk reduction
can be obtained by improving the man-machine interface for switch-over of safety injection from
the once through configuration to the recirculation configuration. Preliminary estimates indicate
a potential for reducing the top cutset frequencies by about a factor of 2.
High human error probabilities are assessed in these PSA accident sequences, primarily because
the CR interface was classified as “poor.” The HCR model is sensitive to the degree of human
factors elements incorporated into the CR by such classifications.
A human factors CR review was carried out in 1992 following the then current NUREG-0700
guidance, and recommendations that passed the HFE deficiency assessment process were
implemented. Changes since 1992 have not been held to the same standard, thus for the
particular action of switching from the once-through path to the recirculation path the “poor”
MMI classification best captures the current situation.
Based upon this limited independent review of the current CR layout at the plant, the review
team feels that “poor” is a reasonable assessment for the MMI when implementing the
recirculation action. As discussed in Section 2, the review team developed three main reasons for
a “poor” MMI assessment, which is applicable to the HCR model, are:
1. The shift supervisor who is reading the procedures could not see information on P-9 where
the recirculation switch-over controls are located, therefore the Assistant Shift Supervisor
receives only poor information for verifying new cues via operator to operator
communication,
2. The panels are not well separated from a functional viewpoint, there are no mimics to reduce
the chance of selection errors at the panel, and
3. Confirmation of an action taken to the Assistant Shift Supervisor is also only by verbal
response from the operator at the back panel who changes valve positions.
Thus, improving the cue signals, verification and communication would reduce the potential for
errors in detecting cues, reading the procedures and communicating the status, even though the
operators can clearly compensate for the “poor” interface with experience, skill, and training.
These human reliability elements were confirmed in a review of human factors assessment
(as described in Section 3). In addition the Human Factors Independent review revealed other
improvement possibilities for changing the classification to “good”, or better. A list of
4-1
Summary of Proposed Modifications
recommendations that were developed during the review process from both the human factors
and HRA perspectives is discussed in the next section.
List of Recommendations
Table 4-1 provides an integrated list of recommendations that were made during the review
process. The list includes those recommendations provided by UFG, and supplemented by the
human factors and human reliability independent reviews.
Combined Recommendations
The proposed upgrade recommendations provide many good ideas, however, they must be
considered as a whole, and each upgrade should be coordinated with the others, because
improvements from one proposed upgrade could be canceled by other changes.
For example, in the formulation for the effects of performance shaping factors used in the
HCR model the effects of combined recommendations can be approximated by noting that the
K values in the formulation below can be either positive or negative. Care must be taken to
recognize that these factors can be non-liner in their relationships.
Combined impact on T1/2 = T1/2 nominal *(1+K1)*(1+K2)*(1+K3)…(1+Kn).
The objective is to reduce the combined impact value since it is used to increase or decrease the
expected response time of the typical crew. The difficulty comes in estimating the effects of the
K values for each proposed change to establish in-between values for characterizing the CR
interface for the SI cases. Improved formulations of HCR evaluation process have been
developed in EPRI projects that updates the version used in this PSA.
4-2
Table 4-1
Combined Recommendations
Recommendations from Human Factors and Qualitative Assessment of Risk Reduction

No. Remarks
HRA Sections Potential
Just moving the panel information to the front
Relocate all safety related I&C from back panels to panel does not by itself create a good interface. This could range from a negative to positive risk
1 front panels by redesigning the control room The process would require significant human impact taking into account training on a new system
interface. factors involvement to ensure that the principles and the degree of human factors enhancement.
of information flow and layout are observed.
SPDS needs to be available to people
A SPDS panel was installed on the back of the The SPDS contributes to an improved CR interface,
responsible for taking action, back panel
2 turbine panel directly across from panel P-9, to although not directly to the switch-over action
operations are for taking action, monitoring, and
visualize the plant’s safety parameters in 1997. issues. Small reduction (10% on some sequences)
verification.
Install a megaphony system that is independent of Reduction on errors in communication which are
3 the current plant system, and exclusively aimed at This is a good action to improve communications. not directly modeled, but could be represented by a
communications between the rear and front panels. -.1 to -.2 adjustment on median time.
Install a single video camera on Panel P-18 or This provides a view that the operator is at the This item was not aimed to reduce risk, but rather it
multiple video cameras on back of Panel’s P-3 and panel, but detail of the action or verification of was proposed to address a HF CR deviation. It
4
P-4 so that the Assistant Shift Head can "see" readings or positions would require significant may contribute to human error by distracting the
operations at the P-9 panel. manipulation of the camera. procedure reader when manipulating the camera.
This addresses verification of all human actions
Adding critical safety system status indications at This item should change the control room interface
on the back panel and locally by observing the
Supervisor’s Console. This provides an interactive from poor to good under the current HCR model
effect of the action through the control system.
5 graphical representation of back panel information structure and result in a 50% reduction in risk
This means that the procedure reader checks
on the SPDS or other monitor for the procedure based on the fact that the switch over action is a
each step as completed both verbally and via the
reader. contributor in the top 50% of the cut sets.
change on the SPDS.
The manual errors for these actions are not in the
contributing cutsets, however their impact is
covered in the conservative assessment using the
Motorize selected valves that require local operation This will reduce errors associated with CR local
HCR model. If the model was revised the motor
6 during switchover to recirculation to increase communications, getting keys, selecting correct
failure would replace the failure to align, and
automation of the task. valves, and manual errors in opening the valves.
manual backup could be considered as a recovery
action. (50% reduction in sequence frequency
according to the CNJC PSA sensitivity analysis).
The risk reduction on the errors in reading gauges
Reduction on errors in reading instruments.
should be reduced by 5 to 10 % (This could be
7 Provide new lighting (implemented) Should be supplemented by human factors review
represented as a -.02 to -.03 factor in the current
of each gauge.
HCR application.
This will reduce errors associated with omitting
steps or repeating steps. Becomes more
Implement a verification process when reading
8 important if the reader also verifies the action Small reduction in risk on some sequences
procedures
taken either by video camera or by use of a
computer display.
This will reduce errors associated with selection
and reading errors on the back panel. This
9 Implement an independent reader/checker program Risk reduction benefit is unclear.
relieves the procedure reader from verification
responsibility.
Practice the location and movement of operators This would improve the training aspect, but might
Study on CR operator activity using control room as
10 so that they know where all the control interfaces cause some inadvertent action that leads to a trip of
a simulator
are located. the plant. (Overall slightly risk reducing)
If the new ones are digital and data can be stored
electronically, they could enhance data retrieval
Replace strip charts on P-9 with new digital This recommendation was proposed to address a
11 and reduce storage cost. They might help with
recorders. HF CR deviation. Risk reduction benefit is unclear.
verification of actions if provided on the front
panel.
This will improve the capabilities of training to
address location of operators during accident
Provide an interactive graphical representation of Improves the training level in the HCR model and
12 scenarios. It still lacks the capability to improve
back panel in a training simulator upgrade. may switch some activities from rule to skill.
skills on the operation of switches and control
interfaces.
Bringing in independent experts on a periodic
This activity could have a risk reducing effect
Review of man-machine interface by independent basis can help crews and safety systems be
13 initially and then verify that the risk level is
third parties prepared at all times for human factors type
maintained or enhanced.
issues.
4-3
The following upgrade recommendations are qualitative and are based only on the limited review
discussed in the preceding sections.
Upgrade to Fair Interface
A first recommended set of upgrade elements is to (1) motorize selected valves (#6 in Table 4-1),
(2) provide a megaphony speaker system for communication and primary verification of steps
taken (#3 in Table 4-1), and (3) continue with current SPDS interface (#2 in Table 4-1). The
review team would classify this as a fair MMI interface for the switch-over action.
Upgrade to Good Interface
For upgrade recommendation (#5 in Table 4-1), the addition of new display screens on the
SPDS, or a dedicated display screen to verify the status of critical operational status of the I&C
on the back panel, appears to be the preferred way for reducing the risk caused by the current CR
configuration. With the addition of microphones on the rear panels and a small dedicated speaker
at the Assistant Supervisors console, three of the five human factors concerns with the front/back
panel arrangement are satisfied. Results from the PSA suggest that by motorizing valves
involved in switch-over to recirculation, the additional time gained translates into a significant
reduction in risk.
Thus the second recommended set is to (1) motorize selected valves (#6 in Table 4-1),
(2) provide a megaphone speaker system for communication and verification of steps taken
(#3 in Table 4-1), and (3) install a safety status indication monitor with P-9 safety information at
the Assistant Shift Supervisors Console (#5 in Table 4-1). With this set of MMI upgrades the
effects of actions taken on the back panel can be verified independently by the licensed operator
responsible for managing the accident. The review team believes that the design and
implementation of this SPDS type page can reduce key human errors associated with the internal
events LOCA sequences. However, it must satisfy human factors criteria and a multi-disciplinary
review process to select the type and location of the monitor, select the screen layout, and
interface features (e. g., IEEE Std 1289-1998).
The review team would classify this set of upgrades as a good MMI interface for the switch-over
action. The difference between these two cases is the verification feedback on the new console
page.
Upgrade to Good Plus Interface
The review team notes that the MMI could be upgraded to a good plus by installing panel
mimics and demarcation lines to the upgrades in the good interface for the switch-over action.
The second set of recommended upgrades would seem to provide the greatest benefit, with
design of back panel simulation displays for training as also potentially risk reducing, especially
for new crew members.
4-4
In theory recommendation (#1 in Table 4-1) could satisfy all the human factor issues and could
be classified as “good plus.” The review team notes that removal of I&C to the front panels
would require a major redesign program, and not enough is known to evaluate such hypothetical
designs. The review team does not recommend this as the preferred upgrade due to the attendant
increase in risk caused by negative transfer of training. A new I&C arrangement would
necessitate relearning the responses to sequences which operators have been employing
successfully without incident for over 15 years. The introduction of new response patterns could
increase inadvertent actuations or time delays, at least initially as the operators gain familiarity
with the new control panel arrangement.
4-5
5
REFERENCES
Key References
1. Fleger S. to Frank Rahn, EPRI, Task 2 Report: Human Factors Review of José Cabrera
Nuclear Power Plant Control Room, Science Applications International Corporation,
McLean, VA, 22 February 2000.
2. Hannaman G. W. to Frank Rahn, EPRI, Task 1 Report: Evaluation of HCR Methodology

Implementation in PSA for José Cabrera Nuclear Power Plant, Data Systems and Solutions,
San Diego CA, 22 February, 2000.
3. Hannaman G. W. and A. J. Spurgin, “Systematic Human Action Reliability Procedure

(SHARP).” EPRI NP-3583, Electric Power Research Institute, Palo Alto, CA, June 1984.
4. Hannaman G. W., A.J. Spurgin and Y. D. Lukic, “Human Cognitive Reliability Model for
PRA Analyses,” EPRI Project 2170-3, NUS Report 4531, Electric Power Research Institute,
Palo Alto, CA, October 1984.
5. “José Cabrera Nuclear Power Plant PSA,” Third Edition Summary Report Rev. 2
(Appendix E).
6. Presentation Viewgraphs from UFG on review of José Cabrera Nuclear Power co-funding
project, 16 February 2000.
7. Swain, A. D. and H. Guttmann, “Handbook of Human Reliability Analysis with Emphasis on

Nuclear Power Plant Applications: Final Report,” NUREG/CR-1278, US NRC Washington,
D.C. August 1983.
8. Swain, A. D., “Accident Sequence Evaluation Program: Human Reliability Analysis

Procedure,” NUREG/CR-4772, US NRC Washington D.C., February 1987.
9. U. S. NRC, “Human Factors Engineering Program Review Model,” NUREG- 0711, US NRC
Washington D.C. July 1994.
10. U. S. NRC, “Guidelines for Control Room Design Reviews,” NUREG- 0700, US NRC
Washington D.C. 1981.
5-1
References
Additional References
11. Cooper, S. E., et. al., “A Technique for Human Error Analysis (ATHEANA),”
NUREG/CR-6350, US NRC Washington, D.C. May1996.
12. Hall, R. E., Fragola, J. R. and Wreathall, J. W., “Post Event Human Decision Errors:
Operator Action Tree/time Reliability Correlation,” NUREG/CR-3010, US NRC,
Washington, D.C. November 1982.
13. IEEE Std 1289-1998, “IEEE Guide for the Application of Human Factors Engineering in the
Design of Computer-Based Monitoring and Control Displays for Nuclear Power Generating
Stations,” Institute of Electrical and Electronics Engineers (IEEE) Power Engineering
Society, New York, NY May 1998.
14. Parry, G. W. et. al., “An Approach to the Analysis of Operator Actions in Probabilistic Risk
Assessment,” EPRI TR-100259, Electric Power Research Institute, Palo Alto, CA June 1992.
15. Spurgin A. J., et. al., “Operator Reliability Experiments Using Power Plant Simulators,”
EPRI NP-6937-L Vol. 1, Electric Power Research Institute, Palo Alto, CA January 1991.
16. U.S. NRC, “Individual Plant Examination, Submittal Guidance,” NUREG-1335, US NRC
Washington, D.C. August 1989.
17. U.S. NRC, “Human-System Interface Design Review Guideline,” NUREG-0700 Rev. (1),
US NRC, Washington D.C. 1996.
5-2
Target: SINGLE USER LICENSE AGREEMENT
THIS IS A LEGALLY BINDING AGREEMENT BETWEEN YOU AND THE ELECTRIC POWER RESEARCH
Nuclear Power INSTITUTE, INC. (EPRI). PLEASE READ IT CAREFULLY BEFORE REMOVINGTHE WRAPPING MATERIAL.
BY OPENINGTHIS SEALED PACKAGEYOU ARE AGREEINGTOTHETERMS OFTHIS AGREEMENT. IFYOU DO NOT AGREETO
THETERMS OFTHISAGREEMENT,PROMPTLY RETURNTHE UNOPENED PACKAGETO EPRIANDTHE PURCHASE PRICEWILL
BE REFUNDED.
1. GRANT OF LICENSE
EPRI grants you the nonexclusive and nontransferable right during the term of this agreement to use this package only for your own
benefit and the benefit of your organization.This means that the following may use this package: (I) your company (at any site owned
or operated by your company); (II) its subsidiaries or other related entities; and (III) a consultant to your company or related entities,
if the consultant has entered into a contract agreeing not to disclose the package outside of its organization or to use the package for
its own benefit or the benefit of any party other than your company.
This shrink-wrap license agreement is subordinate to the terms of the Master Utility License Agreement between most U.S. EPRI
member utilities and EPRI.Any EPRI member utility that does not have a Master Utility License Agreement may get one on request.
2. COPYRIGHT
About EPRI This package, including the information contained in it, is either licensed to EPRI or owned by EPRI and is protected by United States
and international copyright laws. You may not, without the prior written permission of EPRI, reproduce, translate or modify this
EPRI creates science and technology solutions for package, in any form, in whole or in part, or prepare any derivative work based on this package.
the global energy and energy services industry. U.S. 3. RESTRICTIONS
electric utilities established the Electric Power You may not rent, lease, license, disclose or give this package to any person or organization, or use the information contained in this
package, for the benefit of any third party or for any purpose other than as specified above unless such use is with the prior written
Research Institute in 1973 as a nonprofit research permission of EPRI.You agree to take all reasonable steps to prevent unauthorized disclosure or use of this package.Except as specified
consortium for the benefit of utility members, their above, this agreement does not grant you any right to patents, copyrights, trade secrets, trade names, trademarks or any other
intellectual property, rights or licenses in respect of this package.
customers, and society. Now known simply as EPRI,
4.TERM ANDTERMINATION
the company provides a wide range of innovative This license and this agreement are effective until terminated.You may terminate them at any time by destroying this package. EPRI has
products and services to more than 1000 energy- the right to terminate the license and this agreement immediately if you fail to comply with any term or condition of this agreement.
Upon any termination you may destroy this package, but all obligations of nondisclosure will remain in effect.
related organizations in 40 countries. EPRI’s
5. DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITIES
multidisciplinary team of scientists and engineers
NEITHER EPRI,ANY MEMBER OF EPRI,ANY COSPONSOR, NOR ANY PERSON OR ORGANIZATION ACTING ON BEHALF
draws on a worldwide network of technical and OF ANY OF THEM:
business expertise to help solve today’s toughest (A) MAKES ANY WARRANTY OR REPRESENTATION WHATSOEVER, EXPRESS OR IMPLIED, (I) WITH RESPECT TO THE USE
OF ANY INFORMATION,APPARATUS, METHOD, PROCESS OR SIMILAR ITEM DISCLOSED IN THIS PACKAGE, INCLUDING
energy and environmental problems.
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, OR (II) THAT SUCH USE DOES NOT INFRINGE ON OR
EPRI. Powering Progress INTERFERE WITH PRIVATELY OWNED RIGHTS, INCLUDING ANY PARTY’S INTELLECTUAL PROPERTY, OR (III) THAT THIS
PACKAGE IS SUITABLE TO ANY PARTICULAR USER’S CIRCUMSTANCE; OR
(B) ASSUMES RESPONSIBILITY FOR ANY DAMAGES OR OTHER LIABILITY WHATSOEVER (INCLUDING ANY
CONSEQUENTIAL DAMAGES, EVEN IF EPRI OR ANY EPRI REPRESENTATIVE HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES) RESULTING FROMYOUR SELECTION OR USE OF THIS PACKAGE OR ANY INFORMATION,APPARATUS,
METHOD, PROCESS OR SIMILAR ITEM DISCLOSED IN THIS PACKAGE.
6. EXPORT
The laws and regulations of the United States restrict the export and re-export of any portion of this package, and you agree not to
export or re-export this package or any related technical data in any form without the appropriate United States and foreign
government approvals.
7. CHOICE OF LAW
This agreement will be governed by the laws of the State of California as applied to transactions taking place entirely in California
between California residents.
8. INTEGRATION
You have read and understand this agreement, and acknowledge that it is the final, complete and exclusive agreement between you
and EPRI concerning its subject matter, superseding any prior related understanding or agreement. No waiver, variation or different
terms of this agreement will be enforceable against EPRI unless EPRI gives its prior written consent, signed by an officer of EPRI.
© 2000 Electric Power Research Institute (EPRI), Inc. All rights

reserved. Electric Power Research Institute and EPRI are registered
service marks of the Electric Power Research Institute, Inc.
EPRI. POWERING PROGRESS is a service mark of the Electric
Power Research Institute, Inc.
Printed on recycled paper in the United States of America
000000000001000028
EPRI • 3412 Hillview Avenue, Palo Alto, California 94304 • PO Box 10412, Palo Alto, California 94303 • USA
800.313.3774 • 650.855.2121 • askepri@epri.com • www.epri.com

Evaluation of HCR Methodology Implementation in PSA and Control Room

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Evaluation of HCR Methodology Implementation in PSA and Control Room

Uploaded by

Copyright:

Available Formats

Evaluation of HCR Methodology

Implementation in PSA and Control Room

Please read the License Agreement

Final Report, May 2000

EPRI Project Manager

(A) MAKES ANY WARRANTY OR REPRESENTATION WHATSOEVER, EXPRESS OR IMPLIED, (I)

(B) ASSUMES RESPONSIBILITY FOR ANY DAMAGES OR OTHER LIABILITY WHATSOEVER

ORGANIZATION(S) THAT PREPARED THIS DOCUMENT

Data Systems and Solutions

Science Applications International Corporation

This report was prepared by

Data Systems and Solutions

Science Application International Corporation

2 HUMAN RELIABILITY ASSESSMENT REVIEW................................................................. 2-1

3 HUMAN FACTORS REVIEW............................................................................................... 3-1

Observations from Walkthrough of ES 1.3 .......................................................................... 3-5

4 SUMMARY OF PROPOSED MODIFICATIONS................................................................... 4-1

Figure 1-1 Diagram of Control Room Layout ........................................................................... 1-3

Table 2-1 Evaluation of Risk Reduction Potential in Proposed Modifications........................... 2-9

CDF Core Damage Frequency

Human Reliability Assessment Review

Control Room Interface

ES1.3 Procedure Simulation

Human Reliability Assessment Review

Local Actions in Procedure ES1.3

Human Reliability Assessment Review

To summarize, current training provides a complete simulation of plant parameters in response to

Summary of Current HCR Methodology Application

Human Reliability Assessment Review

The review team suggestions for reaching a GOOD estimate are:

Human Reliability Assessment Review

Suggestions for HCR Application in the PSA

Human Reliability Assessment Review

Discussion of Proposed Modifications

Human Reliability Assessment Review

New factor after implementing changes 2 and 5 becomes

Human Reliability Assessment Review

Recommended Actions grouped from Qualitative Assessment of Risk reduction

Install a megaphony system that is independent

This addresses verification of all human actions

The manual errors for these actions are not in the

The risk reduction on the errors in reading gauges

This section describes the assessment of the Human Factors review.

The human factors evaluation consisted of three parts:

Human Factors Review

Review of DCRDR Methodology Application at José Cabrera NPP

Operating Experience Review (OER)

System Function and Task Analysis (SFTA)

Human Factors Review

Control Room Inventory

Control Room Survey

A systematic comparison of CR design features to human factors engineering criteria was

Verification of Task Performance Capabilities

Validation of Control Room Functions

Human Factors Review

Human Factors Deviation Assessment and Disposition

Walkdown of Control Panels

Human Factors Review

Observations from Walkthrough of ES 1.3

Human Factors Review

1. Inability to verify control actuation’s,

2. Inability to verify proper display settings,

3. Operator travel delay increases risk for time critical actions,

Combined impact on T1/2 = T1/2 nominal (1+K1)(1+K2)*(1+K3)…(1+Kn).