ML18052A678

Experimental Validation of Critical Function Monitoring Sys, Executive Summary

ML18052A678
Person / Time
Site:	Palisades
Issue date:	03/31/1984
From:	Hollnagel E, Hunt G, Marshall E NORWAY, GOVT. OF
To:
Shared Package
ML18052A677	List: ML18052A675 ML18052A678
References
NUDOCS 8609050088
Download: ML18052A678 (26)

Text

OECD HALDEN REACTOR PROJECT INSTITIJTT FOR ENERGITCKNIKK OECO HALDEN REACTOR PROJECT

. P.O. BOX 173. N-1751 HALDEN* NORWAY THE EXP~RIMENTAL VAL~OATlON OF THE CRITICAL FUNCTJON MONITORING SYSTEM E:XECUTIVE

SUMMARY

8609050088 860829 y l PDR

• ADOCK 05000255 '.

P*

PDR

---

DECD HALDEN REACTOR PROJECT ___

THE EXPERI~NTAL VALIDATION OF TiiE CRITICAL FUNCTION MONITORING SYSTEM EXECUTIVE

SUMMARY

by E. Hollnagel, G. Hunt, E. Marshall March 1984

FOREWORD The experimental operation of the Halden Boiling Water Reactor and associated research programmes are sponsored through an international agreement by Institutt for Energiteknikk, Norway; The Danish Ministry of Energy; The Finnish Ministry of Trade and Industry; Kern-forschungsanlage Jiilich GmbH, representing a German group of companies, working in agree-ment with the German Federal Ministry for Research and Technology; The Italian Comitato Nazionale per !'Energia Nucleare e Alternativa; The Japan Atomic Energy Research Institute; Netherlands Energy Research Foundation; The Swedish Nuclear Power Inspectorate; Central Electricity Generating Board representing a group of Nuclear Research and Industry organi-zation_s in the United Kingdom; and from U.S.A.: United States Nuclear Regulatory Com-mission, and as associated parties: Combustion Engineering, Inc., Electric Power Research Institute, and General Electric Co.

ABSTRACT The experimental validation of the Critical Function Monitoring System (CFMS) was car-ried out by the Halden Project in co-operation with the manufacturer, Combustion Engineer-ing Inc. (CE), the Technical Research Centre of Finland (VIT) and Imatran Voima OY (IVO).

The CFMS is a computer based system to assist the operating crew of a nuclear power plant to avoid or more quickly identify and respond to abnormal plant conditions. The experiments took place at the PWR training simulator situated at the IVO Loviisa Nuclear Power plant in Finland. The purpose was to assess the impact of the CFMS on operator performance when handling serious plant disturbances. The CFMS project, which lasted more than 18 months, covered all essential details: initial planning, development of a CFMS training programme, spe-cification and ins.tallation of data recording equipment, practical training of operating crews, exp~rimentation and dat.:.* collection, data processing, analysis and evaluation. An effective, modular tape-slide training programme was used for initial.instruction. The subjects were twelve crews of experienced operators from the Loviisa nuclear power plant, undergoing their semi-annual retraining at the simulator. The experiments, which employed a 'within group comparison' design, made substantial use of both video and audio recordings, in addition to computer derived measurements. Two transients were developed which presented the opera-tors with two equivalent, severe and complex plant disturbance scenarios. The analysis com-bined quantitative and qualitative methods; and used a detailed timeline description as the basis for answering questions abo.ut the impact of the CFMS. In terms of the overall quantita-tive-- analysis, two specific hypotheses were investigated: ( 1) that operators using the CFMS would maintain critical functions more effectively, and (2) that effective maintenance of criti*

cal functions was equivalent to improved plant safety. Both the overall results and the more detailed, qualitative investigation of timeline data supported these hypotheses. In. addition, the CFMS project demonstrated successfully the methodology developed at Halden.

5

CONTENTS Page:

INTRODUCTION..........................................

9 BACKGROUND...........................................

9 PARTICIPANTS...........................................

9 OBJECTIVES.........................'....................

9 OBJECTIVES ACHIEVED.................................... 10 THE CRITICAL FUNCTION MONITORING SYSTEM................. 11 TH.E ANALYSIS(fRAINING/EXPERIMENTATION/ANALYSIS PARADIGM........*..................*.............. 11 THE EXPERll\\lENTAL DESIGN................................ 15 THE TRANSIENTS......................................... 16 THE TRAINING........................................... 16 THE SUBJECTS.............*............................. 16 THE EXPERIMENT AL PROCEDURE............................ 16 DATA TYPES............................................. 17 DATA ANALYSIS STAGE 1 *CO-ORDINATION OF DATA TYPES........ 17 ANALYSIS STAGE 2 *OVERALL CREW PERFORMANCE............. 18 ANALYSIS STAGE 3

• CFMS USE BY INDIVIDUAL CREWS............ 19 THE POST EXPERIMENTAL INTERVIEWS..*..................... 19 POST EXPERIMENT AL FEEDBACK SESSIONS..................... 20 DISCUSSION OF METHOD................................... 21 SUM,MARY OF CONCLUSIONS................................ 21 REFERENCES.........*.......*.......................... 23

INTRODUCTION This report provides an. executive summary of the. experimental validation of the Critical Function Monitoring System. It is intended to provide the reader with a condensed account of the essential features of the project, as well as the main results. For a detailed description of all aspects of the project, including the data analysis and results, the reader is referred to a number of separate reports which are summa*

rized in-the list of references.

BACKGROUND In the nuclear industry it has become widely recognized that information presentation in Nuclear Power Plant control rooms is often in*

adequate. During adverse plant conditions in particular, the man-machine interface may not provide the necessary support for the operator's decision making. A proposed solution has been to provide the operator with a display of a limi*

ted number of critical plant functions derived from a number of plant parameters. The Criti*

cal Function Monitoring System (CF.MS) is on~

example of such a system. The critical functions have been selected so that the operator can make a timely and correct determination of the.

plant state even under adverse conditions.

The fundamental concern of an experimental validation. is to assess whether a system per*

forms according to specifications, and to deter*

mine whether it provides the expected benefi*

cial effects on operator performance. Very little exists in the way of an established metho-dology for such a test. The Halden Project undertook to perform an experimental valida*

tion of the CFMS, i.e. to assess its impact on operator performance under realistic condi-tions. It was carried out at the Loviisa Nuclear Power Plant PWR training simulator in Finland, using t\\\\O complex transient scenarios (cf.

Meijer, l 982a).

PARTICIPANTS The CFMS project was carried out by the OECD Halden Reactor Project in co-operation with the following organizations:

Combustion Engineering, Inc,. Nuclear Power Systems, Instrumentation & Controls Engineering,

Windsor, Connecticut, liSA (CE).

Imatran Voima OY, Helsinki & Loviisa, Fin*

land (IVO)

• Technical Research Centre of Finland, Elec*

trical Engineering Laboratory, Espoo, Fin*

land (VIT)

Both CE and VIT are members of the Halden Reactor Project, and the co-operation with IVO was established through VTT. The ex*

change of technical data concerning the simu*

lator and plant was arranged by VIT. The whole undertaking was co-ordinated by the Man-Machine System group of the Halden Pro*

ject, using the eXisting channels of co-operation within this organization. The Halden Project was also responsible for development of the ex*

perimental method and for designing the trai-ning programme to be used at Loviisa. Assisted by experts from CE, IVO, and VIT, HP carried out the analysis and organized the reporting of the results.

OBJECTIVES The overall objective of the CFMS project was, of course, to make an experimental validation of the CFMS, i.e., to obtain data which would show the impact of the Cf MS on operator per*

formance, hence on operational safety. This was specified in the following objectives:

1. To record and measure reliably operator per*

formance both with and without the use of the CFMS in situations where the safety of the reactor was challenged.

2. To assess the correspondence between the ex*

pected and actual effects when the CFMS was used. This relied on an analysis of the data from the experimental sessions, as well as the pre-defined criteria for performance categori-sation.

3. To. indicate the predictions that can be made about operator performance when the CFMS is used in real-life. To identify the assumptions that underly these predictions and the data on which they are based, and hence express the degree of confidence that can be assigned to them.

9

4. To assess the problem~ising from introduc-ing a new computerised system into an exist-ing. control room and operating practice.

The main hypothesis under test in the project was the following:

During a severe process transient, plant safety with the CF:VIS will be superior to plant safety without the CF.\\IS.

This was also expressed as two subsidiary hypo-theses:

(i)

Operators using the CFMS will maintain critical functions more effectively.

(ii)

Effective maintenance of critical func-tions is equivalent to improved plant safety.

According to the design principle of the CB,IS, the operator needs the following to accomplish the safety functions: ~ 1) sufficient and intelligible information, (2) comprehensive procedures, and ( 3) adequate training. The experimental validation of the CF.\\lS tested the first of these three conditons, on the assumption that the two others were fulfilled. It thus became an essential part of the experimental design to ensure that this was so. The experimental design is presented in greater detail in Hollnagel &

.\\farshall ( 1982).

OBJECTIVES ACHIEVED This section summarises the extent to which the objectives described previously were achieved.

l. The methodology successfullv permitted re*

liable and accurate recording of operator per-formance, throughout the experimental runs.

It should be noted that operator activity, particularly with respect to CF:MS use, could not have been observed accurately without the use of video recording. Genercilly, the data collection techniques provided a wide data base for subsequent analysis. The results clearly illustrated the complementary role of qualitative and quantitative data in this type of experiment.

10 e

Both of the selected transient scenarios ce:--

tainly challenged reactor safety; several of the defined critical functions were jeopardised,

2. The data obtained permitted assessment of the way in which the CF'.\\IS was used and the effects of this use on a number of measures of plant safety. The way in which this assessment was carried out and the main conclusions ~re summarised in this report.

Overall, we concluded that operating cre\\\\*s did use the CF:VIS to obtain useful information during the test transients and statistical e\\i*

dence suggested that increased use of the CF.\\IS reduced the threat to critical functions.

In terms of operator performance categories the CF:VIS \\Vas most often used for confir-mation of alarms; it was only infrequently used in planning and decision for action. In this connection, operators found the concept of success paths difficult to understand. This was largely due to insufficient instruction and:'

or inconsistencies between CF.\\IS displays and existing panels.

3. Great care must be taken when making general statements on the basis of experimental find*

ings of this type. Nevertheless. given that the subjects were all experienced operators, who took the task very seriously, and that the experimental environment was almost identi-cal to the plant control room, then it was concluded that the content validity was sufficient to allow inferences about the func-tion of the system m a real-lifo situation. J.S summarised below:

The Cf.\\IS fulfilled aspects of the need for an overview of the process during complex transients, particularly by assisting in early process status identification.

Loviisa crews operated the plant in a more function-based way than Is typical of L'.S.

operators. This suggests that a CF'.\\IS might be more effective in C.S. plants where the functional approach has only been applied recently in rather few stations.

The Loviisa control room already included an extensive CRT based information system which was complementary to the CF\\IS. In

control rooms where there is little CRT based information, as is the case in many U.S. plants,

~t might be expected that operators would be inclined to make more use of a CF~1S or similar system.

4. The general view of the Loviisa crews was that the CFMS would be useful at Loviisa. However, they proposed a number of improvements and modifications which are summarised in this report. Most of their recommendations were endorsed by experimental observations. Both emphasised the importance of a proper match between novel displays arid the existing repre*

sentation of the process in terms of instru*

mentation and control panels.

When implementing a new information system, there must be a carefully planned training pro*

gramme for operating staff which should pro*

vide a thorough introduction to both theoreti-cal and practical aspects. In this case, greater opportunity for more in-depth insquction would certainly have improved use of the CFYIS.

THE CRITICAL FUNCTION MONITORING SYSTEM The Critical Function Monitoring System must be understood against the background of traditional alarm systems. In such systems the operator is expected to identify the cause for an alarm and correct it if possible. The emphasis is thus on individual faults, rather. than on the system as a whole. In contrast to this, the CFMS principle asserts that safe operation of the plant can be accomplished by maintaining a limited number of critical functions. The CFMS con*

tained seven critical functions:

1. Core Reactivity Control

2. RCS Inventory Control

3. RCS Pressure Control

4. Core Heat* Removal

5. RCS Heat Removal

6. Containment Isolation

7. Containment Temperature/

Pressure Control Containment isolation was, however, not imple*

mented in the Loviisa installation. The full details of the CFMS used in the validation are shown in Figure l, which for each critical function shows its constituent 'legs'.

The CFMS assists the operator in keeping the system under control, by providing him with highly processed information about the status of each of these functions. fo addition the CF.MS provides detailed information which helps the operator select from the available 'success paths'.

A success path is any remedial action which will relieve the threat to an alarmed critical function.

The CFMS installation in the control room consisted of a colour graphic VDU. and a small operator keypad which was used for requesting CFMS displays and acknowledging the CFMS alarms. This was placed adjacent to the central console to facilitate video recording. The CF\\15 console used in the experimental validation is shown in Figure 2, while the layout of the control room is shown in Figure 3. The CFMS, as installed at the Loviisa simulator, did not con*

tain an audible alarm. The CFMS has been de*

scribed in greater detail in Meijer (1982b) and Meijer & Rohde ( 1983 ).

THE ANALYSIS/TRAINING/

EXPERIMENTATION/ANALYSIS PARADIGM During the initial planning it soon became clear that an overall structure for the experi*

mental design was necessary. This was specified as the Analysis/Training/Experimentation/Ana*

lysis (ATEA) paradigm, and presented and dis*

cussed at a workshop meeting on Human Factors Experiments.and Validation of Operator Aids in Halden, March 1982.

In the A TEA paradigm the organisation of an experimental validation is divided into four se*

queritial stages. Each stage itself specifies pro:

blems and issues that must be considered:

ANALYSIS of system purpose and require*

men ts:

• Specify system purpose and conceptual contents Specify man-machine system function Specify expected effects and consequences Define critical parameters and performance indicators

• Derive 'ideal path' for performance

• Identify constraints (time, money, people, customer's expectations) 11

CORE REACTIVITY CONTROL Rods not Down Reactivily Increasing Boron Concentralion Low REACTOR COOLING SYSTEM PRESSURE CONTROL Pre55urizer Pressure Pressurizer Pressure Gradient Cold.Stress Temperature Coolant Boiling CONTAINMENT ISOLATION (not implemented)

CORE HEAT REMOVAL CONTROL Core Temperature High Loss of Natural Circulation Boiling in Core Boiling in Loops PRIMP.RY CIRCUIT HEAT REMOVAL Steam Generator Level Low Loops Isolated Inadequate ECC Figure 1. CFMS matrix display as implemented at Loviisa REACTOR COOLING SYSTEM INVENTORY Pressurizer Level High Pressurizer Level Low Quench Tank Pressure High Quench Tank Level High Quench Tank Temperature High Pressurizer Relief Valve Open Pressurizer Shutdown Level High Emergency Makeup HPSI CONTAINMENT TEMPERATURE AND PRESSURE Containment Spray Flow Low Containment Pressure Increasing Containment Pressure Low Containmenr T emperalure High

B DD D B D D D

~ 0 I FORWA; I I EXECUTE I B 8 AC KNOW-LEDGE Figure 2. Diagram showing layout of CFMS keypad used at Louiisa 13

PRIMARY CIRCUIT REACTOR TURBINE COMPUTER DISPLAYS FUNCT.PANEL TURBINE CONTROL SECONDARY CIRCUIT

\\

~ ~

.... ~

!:: \\

REACTOR "TURBINE

~ \\

OPERATOR

. OPERATOR u \\ <J CFMS DISPLAY

~ _,,,,, ""'

,..~--

ANO KEYPAD

~

~

',I

--,U-**l ___ I ___. ----1-T:;)) COMPUTER ODDD DISPLAY

~

\\

~

\\~ __................

g

~

SHIFT rJ_,-

SUPERVISIOR

(/ V IOEO CAMERA ALARM PRINTERS Vl

~

w r-V)

V)

~

u er:.

r-u w

.....I w

1-'iguri: 3. Pla11 of l.oviisa simulator control room slww1.ng exil*ting consoles, the CFMS display am/ position of the video camera used to record operator activity e

TRAINING of subjects:

Derive training requirements from analysis Estimate theoretical training and practical training Design training programme Design training aids Implement training programme Evaluate training results EXPERIMENTATION, test of the system under specified conditions:

Specify experimental design Describe experimental conditions Define performance measurements Record operator performance Measure critical parameters Record overall system performance ANALYSIS of performance data:

• Analyse performance registrations

• . Describe actual, formal, and prototypical performance Analyse and evaluate critical parameters

• Evaluate _total system performance Interpret results in terms of stated purpose The A TEA. paradigm was successfuliy used throughout the project to integrate the HP ex-periment planning. The experience gained will be used to modify and extend the paradigm, so that it can serve as an important tool in future validation studies.

TiiE EXPERIMENTAL DESIGN A fundamental concern in validation studies is that the description of crew performance is as reliable and _accurate as possible. The basic con-ditions for a between-groups design are that there are one or more dependent variables from which the effect of the independent variables can be assessed, and that the groups would give a similar performance had the independent vari-ables not been manipulated. None of these con*

ditions can be expected to hold for a realistic validation study, even if the groups are "objec-tively" presented with the same situation. There*

fore, rather than using a between-groups com*

parison, it was mnre pertinent to make a detailed analysis of the performance of each crew in a uniform way, with particular emphasis on WHETHER, WHEN. HOW, and WHY the CH.. tS was used. Accordingly, since a between-groups design was not practicable, the experiment used a wi thi~group _design in which each group served as its own control.

In essence, the experimental design attempted to reduce to a minimum the part of the variance of the results which was due to unknown factors.

In terms of traditional terminology, the reli*

ability of the data was, in this way, increased. As part of the prior analysis of the experimental conditions, a set of 47 factors were identified which might influence the observed performance.

These were divided into six groups as shown below:

l. THE EXPERIMENTAL ENVIRONMENT E.g., Simulator Fidelity & Equipment Reli-ability.

2. THE TRAINING OF THE SUBJECTS E.g.,

Robustness of Training & Training Schedule

3. THE TASK E.g., Credibility of Transients & Procedural Support

4. THE CFMS Intrinsic Char;icteristics E.g., Colour Code, Symbols & System Response Time Extrinsic Characteristics E.g., Display Compatibility & Appropriate*

ness of Transients

5. OBSERVATION METHODS E.g. Recording Equipment & Observer Experi-ence

6. PERSONAL AND SOCIAL CHARACTER-ISTICS E.g., Motivation & CFMS 'Leaks' All of the 47 independent factors are discussed in detail in Hollnagel & Marshall (1982). The experiment was designed so that information was available about each factor, thereby allowing its influence to be assessed.

15

THE TRANSIENTS In order to suit the CFMS experimental de~

sign, two transient scenarios were prepared by staff at VTT. The principal features incorporated in the transient design were as follows:

• They should be difficult They should be roughly equivalent in com*

plexity The duration should be approximately thirty minutes

• They should present a 'realistic' process situation

• They should challenge several Critical Functions

• They should be unfamiliar to the operators

• They should fit into the retraining pro*

gramme The CFMS transient scenarios were developed by VTT in order to comply with these conditions and there was considerable discussion between VTT, IVO and CE before the final versions w~re agreed upon. Briefly, Transient 1 was essentially a LOCA compounded by problems in the sea*

water pumps, containment sprinklers and HPSI system. Transient 2 consisted of a complete power blackout together with a failed open pressuriser relief valve. A detailed account of the transients is given in Kautto (1983).

THE TRAINING In order to make an effective validation of a new operator support system it is essential that the operators are well prepared by means of careful pre-training before any experimental trials take place. A systematic and consistent training programme was constructed for opera*

tors taking part in the CFMS experimental vali-dation. The programme consisted of a series of tape-slide modules each followed by exercises designed to check that previously learned material had* been understood. The operators

- gave written answer5 to the exercises, and any wrong answers were corrected. The training pro*

gramme contained the following main modules:

1. Introduction to the System

2. The Seven Critical Functions

3. CFMS Display Structure 16

4. Alarms

5. Access to the CFMS Displays

6. How to use the CFMS In addition to this class-room instruct~n, oppor-

. tw1ity was provided for structured, hands-on practic.e with. the display system itself. A detailed account of the training programme and instruc-tional material can be found in Marshall et al.,

(1983).

The results from the training exercises indi-

• cated that both introductory and theoretical aspects were learned adequately. However, it was also evident that the operators lacked practical experience in the use of the display during severe process transients. This is not sur-prising, given that the total time allowed for training was restricted to roughly one working day. With regard to the training technique in general, operators said that although they were not familiar with programmed instruction of this type, they found the training method both interesting and very efficient.

THE SUBJECTS

.. The entire complement of operators from both units of the Loviisa nuclear power station participated as subjects in the experiments. The subjects were thus all experienced operators who were familiar with working at the simulator.

There were twelve crews each consisting of three operators: a shift supervisor, a reactor operator,*

and a turbine operator. All had at. least two years of operating experience, excluding commis-sioning time. Further background information can be found in Hollnagel et al., ( 1983 ).

THE EXPERIMENTAL PROCEDURE In order to maximise control over the experi-ment, the following procedure was adopted:

l. Establish a 'Cold' Performance Baseline.

The crew was exposed to one of the tran-sients without the use of the CF:VlS, and without prior instruction about the CBlS.

This provided information on how the crew handled a complex transient without the CFMS. The CF:VIS was, however, in opera-tion outside of the control room during this run to record the status of the critical functions.

2. Training in the use of the CFMS.

Following the first transient, all crew mem*

bers were trained in the use of the CF~*tS by means of the specially designed training programme outlined above.

3. Repetition of the first transient.

As a final stage in the introduction to the system, each crew again attempted the first transient with the CFMS in operation and available in the control room. This served the dual purpose of a check on the crew's proficiency in using the CFMS, and a check that the introduction of the CFMS did not interfere with their performance.

4. Actual Test Transient.

On the following day, the crew attempted the second process transient with the CFMS in operation, and available in the control room. This run constituted the prin*

cipal data source in the experiment.

5. Questionnaires and Interview.

The actual test transient was followed by a debriefing session. The operators filled out a questionnaire, and were interviewed by a process specialist who had observed their performance.

Each crew thus took part in three experiment trials. To balance out any special effect due to th~ sequence of the transients, six crews experi*

enced transient 1 before transient 2, and six attempted transient 2 before transient 1. The order of the two transients selected for the ex*

periments was distributed randomly among the twelve crews. The experiments took place at Loviisa from September through December 1982. The experimental procedure is presented in detail in Heimburger & Sammatti (1983) and Hollnagel & Marshall ( 1982).

DATA TYPES.

In accordance with the experimental design, three major categories of performance data were recorded:

Category 1: Directly Recorded Real-Time Data

• Video recording of operator activities, which provided ah account of operator movements.

Audio recording of verbal communication within crew, and between crey.* and instructor.

Computer registration of plant alarms and control room operations.

CFMS logs of di~play requests and a time his*

tory of analogue and binary parameters trans*

mitted to the CFMS from the simulator. as well as parameters computed by the CFMS it*

self.

Category 2: Derived Real-Time Data Critical function leg alarms.

• Plot files for analogue variables.

Critical control room operations and filtered plant alarms.

Merged time lines.

Category 3: Non Real-Time Data

• Training scores.

• Observer's action check list.

Questionnaires.

.. Post-experimental interviews.

Altogether these data types covered all essen*.

tial aspects of operator performance, and consti-tuted a sufficient basis for subsequent analysis.

They are described in greater detail in Hollnagel

( 1983 ). The processing and handling of the data was accomplished by means of a system of com-puter programs developed for the purp9se.

DATA ANALYSIS STAGE 1

• CO-ORDINA*

TION OF DATA TYPES All data obtained. during the testing sessions were transmitted to the Halden Project for use in evaluating the results of the experiments. All data types were subjected to a processing proce*

dure which converted the real time data to a common data format for ease of use during later analysis. This standardization procedure also provided for the translation of all Finnish text to English, as well as converting the times in all data records to elapsed time from the start of the experimental run.

The processed data files were then further re*

fined through the application of filtering and se*

lection programs which chose those subsets of the data which were most appropriate for the 17

e evaluation of CF:'vlS use, operator performance, and plant safety status based on specific aspects of the experimental transients. Summary statis-tics were extracted for use in later stages of the analysis, and important plant parameters were plotted along the same time scale fot each run.

Detailed timeline files were created for each ex-perimental session by combining several data subsets, namely operator comments and move-ments, signifi.cant plant alarms and control room operations, CFMS display requests, and critical function algorithm alarms from the CFMS itself.

Details of the data handling processes are given in Hunt et al., {1983).

ANALYSIS STAGE 2

• OVERALL CREW PERFORMANCE An important aspect of the CFMS experiment was to investigate and evaluate ways of obtaining quantitative measures of operator activities per-taining to use of the CFMS. Three major factor categories were derived from the experimental data: CFMS use by operators, CFMS status during experimental trials and plant performance para-meters. Statistic;tl techniques were applied to determine the relationship between these perfor-mance factors.

• One description of the overall crew perfor-manc*e was based on a quantitative analysis of measured operator and plant performance fac-tors. This approach to the analysis required the combination of a large amount of data from a variety of sources thereby providing a compre-hensive overview of CFMS use. The CFMS use could, however, not have been measured in anv detail without the use of the video camera in th~

control room. The visual record provided data about which of the operators was using the dis-play and the recorded verbal exchanges between crew members revealed a great deal of informa-tion about how they employed the CFMS in their response to the transient.

Clearly the operating crews did USQ.the CFMS

• to obtain useful information during the test tran-sient. The supervisors used the display the most and derived most benefit from it. Overview dis-plays were used to the greatest extent, the pri-mary circuit overview receiving the most atten-tion, followed by the CF Monitor and the core overview respectively. The main use of the CFMS was on the primary side, i.e. reactor operator 18 plus shift supervi!. This was mostly due to the nature of the transients.

Quantitative statistical analysis strongly rnz-gested a negative relationship between vario~s factors which measured the number of CF alarms and factors reflecting usage of the displays. This finding was in accord with the original hypothe-sis, but more detailed analysis of indi..,idual CFMS use would be required to establish am*

causal link between these measures. The correl~

tional analysis also confirmed the supervisor as a predominant factor in use of the system.

The amount of heat in the primary system seemed to be the overriding CF factor which was sensitive to use of the CFYlS for these transients.

However, there was no straightforward relation-ship between the plant performance parameters arid the CF status factors. A more detailed enqj.

neering analysis indicated that *the somewhat paradoxical findings observed were due to con-founding effects between some of the perfor-mance factors {Nelson, 1983 ). The extended analysis indicated that the Core Boiling perfor-mance parameter was the best indicator of plant safety. It correlated highly with CF status.

Overall crew performance was also described as it appeared from the key activities and obser-ver's checklists. The key activities checklist was

. defined by VTT, based on a description of the transients. The checklist was scored from the timeline description produced by HP. For each key activity it was noted whether the crew had carried it out, when it occurred, and, if possible, what the delay was from the appropriate signal or alarm. For the actual test transient, the use of the CFMS in relation to these activities was also noted.

The results revealed neither consistent nor ob-vious differences between crews in the sense that any one crew was significantly better or worse than another. Some activities were generally missed by the crews, independent of the use of the CFYlS. ~loreover, the analysis of key activi-ties clearly showed a substantial variation in how crews performed the task, with respect to num*

ber of key actions as well as their sequence. Re*

corded delays from alarm onset to action were too few to permit a general analysis, although one case showed significant improvement with CF'.\\15 use. As noted above, there were no audible alarm signals available from the CF:'.vlS.

This variation was also true for the number of key activities carried out, as well as their order.

No two crews-carried out the same key activities in the* same sequence, even though the experi-mental conditions were as similar as possible.

These findings supported the choice of a within-group rather than a between-group experimental design.

Analysis of the questionnaires showed that learning the CFMS was quite easy, both in terms of the underlying principles of the display and practical application. The primary display fea-tures were all easy to understand. Although con-sistency between CFMS and Loviisa information presentation was judged by some crews to be low, specific effects of this could not be detected from the questionnaires or from the analysis of the performance; operators, however, mentioned it in the post-experimental interviews. Opinions differed among the operators about the useful*

ness of the CFMS, more general applications being rated higher than specific ones. The expe-rimental. task (i.e.; coping with the transient scenarios) was considered difficult by all opera-tors.

ANALYSIS ST AGE 3 - CFMS USE BY INDI-VIDUAL CREWS The third stage in the analysis was to charac-terize in detail the performance of individual crews. The basis for this stage of the analysis was the key activities checklist, appropriate parts of the timeline, and a summary of CFMS utiliza-tion.

The use of the CFMS in connection with the key activities was analysed for each crew. CFMS use was described in terms of a basic model of decision making, i.e., detection, decision, and control. Analysis in these terms was, however, restricted because it would have involved exten~

sive extrapolation of data from the video and audio recordings. In addition such a study would have demanded the close co-operation of a Fin-nish speaking process expert over a considerable time period.

Even though the analysis was made from a subset of the complete performance description, it nevertheless provided detailed support for the conclusions reached in the second stage. The dis-plays that provided a general overview of plant status were most often used, and in many cases the CFMS provided operators with timely infor-mation relevant to the handling of the transient.

In this way the third stage of analysis, based on individual crew data.. provided support for the conclusions from the overall performance analysis. It showed when the operators used the CFMS, how they used it, and what the outcome of use was. The display was most often used in connection with detection or confirmation of alarms. It was only infrequently used in planning and decision for action, perhaps because opera*

tors found it difficult to understand the concept of success paths. The display pictures most often used were the primary overview and the CF~*1S monitor, i.e., those pictures which, in particular, provided an appropriate overview of the plant status. The detailed analysis suggests that the CFMS served the operators well and, in a num*

ber of observed instances, it did provide useful information.

1HE POST EXPERIMENTAL INTERVIEWS Observation and interviewing of each crew was carried out by IYO staff during and after the final experimental run (Rinttila & Makkonen, 1983). In addition to questions relating.directly to the CFMS, there were questions referring to

.the transients and about the use of other co.ntrol room facilities.

The observation during the transients was based on pre-planned lists of anticipated events, decisions and operations, which were discussed after the transient between the crew, the simula-tor instructor and the observer.

Naturally there was considerable variation in answers received during the interviews as there was in the use of the CFMS. The main points concerning the use of the CFMS are summarized below:

AVAILABLE TIME.

All crews agreed that familiarization time with the CFMS was too short.

CRITICAL FUNCTIONS.

Crews had certainly accepted the idea of criti-cal functions and regarded those, implemented at Loviisa, as reasonable and sufficient for safety supervision. They found them easy to remember, and agreed that it was crucial to control these functions whenever plant safety was at risk.

VALUE OF THE CFMS.

Six out of the 12 crews felt that the CFMS did 19

t.

not influence their actions during the experimen-tal transients, ~hereas the remaining six definite-ly considered that they had derived some benefits from the system. Nevertheless, each crew re-membered some useful piece of information re-ceived.via the CFMS. In addition, all operators felt that the CFMS should and could have been utilized more effectively.

PROCESS DIAGNOSIS.

Those crews who found the CFMS valuable, said. that it helped particularly in diagn.osing plant status. Diagnosis was performed faster and more reliably, because the CFMS directed their attention to the most essential safety functions.

The CFMS was often used for confirming diagnoses.

SYSTElYtA TIC TRANSIENT iWANAGEMENT.

A.s a more subjective judgement, the observer noticed that, in many runs, plant operation was more purposeful and systematic than on earlier occasions even though the CFMS transients were more complex and difficult than previous simu-latqr exercises.

USE OF DI SPLAYS.

The interviews confirmed that crews restricted CFMS use to first and second level displays. The

. main reason for this was that the third level dis-plays were largely the same as those already avail-able from the plant computer. Therefore these CFMS displays did not contain any new infor-mation. Further, diagram conventions used in the CFMS pictures did present some inconsisten-cies with the existing process mimics. This under-standable reluctance to use the lower level dis-play was aggravated because there was only one CF:V1S display unit available and thus overviews and detailed pictures could not be inspected si-multaneously.

SUCCESS PATHS.

Although success paths are an essential part of the CF:VIS concept the Loviisa operators did not apply them effectively. A number of reasons were suggested* for this:

The link between the critical functions and corresponding success paths was not clear enough.

The success paths were shown on third level pictures which were not often used by the operators.

20 The idea of success paths was not handled sufficiently during training.

The general view of the Loviisa crew was that a critical function system similar to the CF\\!S would be useful at Loviisa. However, they would not be' very happy with the implemented system as such, but proposed some improvements and modifications. These are summarized below.

One display unit was not sufficient. There should be two or three CF:VIS display units.

One unit could be dedicated to displaying the first level overview.

The reactor operator display units should be at the operator's desk.

The display hierarchy should be linked more clearly with the critical functions.

The critical function system should be inte*

grated better with the existing control room systems. Any unnecessary overlapping should be avoided.

The quality of the displays could be improved in terms of colour and definition.

A common proposal was that the CFMS should be restricted to overview displays only. On the other hand, suggestions were also made for extending the application of the CF\\.!S concept to non-safety functions. In this case the turbine operator would also benefit from the system.

When evaluating operator opm1ons of the CFMS, it should be remembered that these opi-nions were related to the system as it was imple-mented at Loviisa. These views, therefore, should not be generalized without careful consideration.

However, the findings, demonstrated clearly the importance of careful integration when instal-ling a novel system in an existing control room.

POST EXPERIMENT AL FEEDBACK SESSIONS Feedback sessions were held with the opera-tors after the completion of thP. first stage of data analysis. All operating crews were invited to these meetings where VTT, IVO and HP staff discussed general aspects of the project. The overall impression gained was that the operators enjoyed taking part in the experiment. They were interested in both the concept of critical functions and the CF:VIS display. They agreed

that the transients themselves were certainly challepging. with regard to video recording in the simulator control room, although operators had expressed some initial unease, they had not found the recording apparatus at all intrusive during the experimental runs.

DISCUSSION OF METHOD Since a behavioral study on this sea.le is diffi.

cult to repeat, and almost impossible to replicate, experimental planning is extremely important.

In this case planning for the experiment was cer*

tainly adequate and indeed contributed signifi*

cantly to the success of the project. It should, however, be emphasized that constraints must be made explicit as early as possible, both with regard to resources and the delegation of tasks and responsibilities.

Although none of the main points were missed, the planning of the data collection and analysis was not completely successful. The main problem was that preliminary planning did no~ go into sufficient detail with regard to data processing and analysis. It might have been ad*

vantageous to reduce the amount of total data collected, but this was very difficult to specify beforehand.

Overall the experimental method was found to be adequate for the purpose. Considerable variation in crew performance was clearly de*

monstrated, even under highly similar experi*

mental conditions. Consequently we would re*

commend that a between-groups design should only be used when the task is considerably less complex that this one. Furthermore, the analysis of the CFMS data provided a good illustration of the complementary role of qualitative and quan*

titative types of data analysis.

A basic question in the CFMS project was the content validity of the test. situation. The opera*

ting crews were all experienced operators, and the experimental environment was almost identi*

cal to the real plant control room. The analysis of the timelines showed that the operators took the situation very seriously, even though they considered that the experimental transients, while plausible, would be very unlikely to occur in reality. The CF.MS test installation was repre*

sentative in tenns of functional completeness, except that the operators lacked extensive prac*

tical experience with the system. In spite of this reservation we have concluded that in general.

the content validity of the test was sufficient to allow inferences about the function of the sys*

tern in a real-life situation.

SUMMARY

OF CONCLUSIONS For convenience this summary has been divi-dedinto two sections: Firstly, conclusions derived from the experiment about the CFMS itself, and secondly, conclusions about the experimental methodology.

The CFMS The main conclusions are listed in the follow*

ing table. These conclusions are based on analy-sis of three different broad segments of the ex*

perimental data base:

1) Overall quantitative assessment of CFMS use.

2) Detailed analysis, both qualitative and quanti-

. tative, of the individual summarized timelines.

3) Analysis of questionnaires and post-experi*

mental. interviews.

Analysis concentrated on the third experimen*

tal run when all crews were familiar with the ex-perimental setting and were most experienced with the CFMS. Because of the small sample size, conclusions based on one data category have, where possible, been supported by seeking con*

firmation in the other two major categories. In the table, 'l' indicates a primary source for the conclusions, while '2' shows sources which pro*

vided confirmation. The results thus illustrate how different types of analysis (qualitative and quantitative) can require and support each other.

In general it is concluded that operators did use the CFMS to obtain valuable information which assisted in their handling of the serious plant scenarios. Given the high degree of content validity in the experimental situation, and the wide range of the data base, it is considered reasonable to expect that these findings will generalize to the real plant environment. More*

over, it is inferred that cenain aspects of the experimental conditions tended to lessen the possible beneficial impact of the CFMS on operator performance:

Firstly, the Loviisa control room already in*

eluded an extensive CRT-based information sys*

. 21

tern. Therefore it was to be expected that during an unknown serious transient, operators would be inclined to resort to their own, more familiar, information system than to the less familiar CFMS. This would explaiil those occasions where the CFMS was used for confirmation after the transient had been brought under control. It could be suggested that in control rooms where there is little or no CRT-based information, as is the case in many U.S. plants, operators would be more inclined to utilize a CFMS or similar device.

Secondly, it became clear during the project that the Loviisa crews operated the plant in a more function-based way than U.S. operators. In other words, Loviisa operators' responses to a serious transient tended to be both less event based and less procedure oriented than would be the case in the U.S. This would again suggest that a CF:\\1S might be more effective in the U.S.

where the functional approach has only been applied recently and in relatively few plants.

Finally, it was clear that the CEMS fulfils to a considerable degree the. need for a process over-view to assist in the early identification of plant status during a transient. However, the experi-ment revealed the importance of compatibility between the mode of information representation used in new displays and existing instrumenta-tion.

The Methodology The planning of the experiment showed the importance of making constraints explicit as early as possible, with regard to resources and delegation of tasks and responsibilities. Advance planning of data recording, processing, and ana-lysis was not sufficiently detailed, but these mat-ters are difficult to specify a priori. The experi-mental method was adequate. CFMS use could not have been measured in any detail without the use of video and audio recordings. Despite some initial unease, the recording apparatus was not found to be intrusive.

The analysis of key activities clearly showed.

substantial variation in crews' perfqrmance in terms of the number of key activities and their order, despite highly similar experimental condi-tions. Scoring of crew performance was consis-tent between crews.

Training results indicated that introductory and theoretical aspects were learned adequately.

2'.?

The idea of success paths was not treated suffi-ciently during training. Operators also lacked ex-tensive *practical experience with the use of the display during severe process transients. Ques-tionnaire analysis showed that learning the CFMS was quite easy, both for principles and pr.actices. Operators found the training method both interesting and efficient.

Crew members were all experienced operators and the experimental environment was almost identical to the plant control room. The opera-tors took the situation very seriously. Consisten-cy between CFMS and Loviisa information pre-sentation details was low, but specific effects were not detected. It was concluded that the content validity of the experiment was sufficient to allow inferences about the function of the system in a real-life situation.

The methodology developed by HP was clear-ly adequate and as such presented an advance in the available, proven techniques for the valida-tion of man-machine interfaces. From the outset the objective of the project was to evaluate the CF~S. during unknown serious nuclear plant events in an exi'sting, realistic control room en-vironment. We feel that this was accomplished with some significant success.

ABBREVIATIONS ATEA CE CF CF:'vlS ECCS HP HPSI IVO LOCA OECD PWR RCS VDU VTT

~ Analysi!!/Training/Experimentation/

• • Analysis

- Combustion Engineering Critical F*unction Critical Function Monitoring System Emergency Core Cooling System

- Halden Project High Pressure Safety Injection

- Imatran Voima OY

- Loss of Coolant Accident

- Organization for Economic Co-oper-ation and Development

- Pressurized Water Reactor

- Reactor Coolant System

- Visual Display Unit

- Valtion Teknillinen Tutkimuskeskus (Technical Research Centre of Fin-land)

REFERENCES The followi.ng pages list the documents that have been published as a part of the CF:VIS pro-ject. For each document a brief characterization of its contents is given. Note that the accessibi-lity of some documents may be restricted. Fur-ther information can be obtained by writing to the organization where a document was original-ly issued, normally the organization of the first author.

Heimburger, H. & Sammatti, P. (1983 ). Ex-periences of the practical arrrangements at the Loviisa training simulator (LOKS) during the CFMS project. Helsinki, Finland: Technical Re*

search Centre of Finland and Imatran Voima OY.

(Paper presented at the Enlarged Halden Pro*

gramme Group Meeting, Loen, Norway, 24th

• 27th May, 1983.)

The paper describes briefly the experiences gained from the preparation of the test site and the practical execution of the experiments. The time table of one experiment and the task distri-bution among the research staff is included. Some improvements to the LOKS itself and to the ex-perimental arrangements are discussed. Based on the experiences from the Loviisa t~ng simula-tor a conclusion is that it was useful to combine the training and the research aspects.

Hollnagel, E. ( 1983 ). Description of data types in the validation of the critical function monito-ring system. Halden, Norway: OECD Halden Re*

actor Project HWR-61.

This report was written as part of the prepara-tion for the CFMS project. It gives a description

• of the various types of data that could be recor-ded in the experiment and relates them to the purpose of the CFMS project. It also discusses the nature of man-machine systems experiments, in contrast to 'engineering' experiments and

'human factors' experiments.

Hollnagel, E., Hunt, G.L & Marshall, E.

( 1983 ). The experimental validation of the criti-cal function monitoring system. Preliminary ana*

lysis of results. Halden, Norway, OECD Halden Reactor Project HWR-111. (Paper presented at the Enlarged Halden Programme Group Meeting, Loen, Norway, 24th* 27th May, 1983).

The report presents a detailed description of the CFMS experiments, starting with the back-ground for the Cf:\\,fS project. It contains a tho-rough discussion of the three stages of the data analysis, including the statistical analysis, the analysis of the questionnaires, and the analysis of the individual crew performance. The data and results needed to support these analyses are in*

eluded in the report.

• Hollnagel, E. & Marshall, E. ( 1982). The me**

thodology of the CFMS project. Halden, Nor*

way: OECD Halden Reactor Project HWR-7i.

This report was written as part of the prepara*

tions for the CFMS project. It presents the me*

th~d in detail, and relates it to earlier studies of a similar nature. It identifies the factors that can influence the outcome of the experiment, and discusses them one by one, with emphasis on the way in which their influence can be assessed and possibly controlled.

Hunt, G.L., Marshall,* E. & Hollnagel, E.

( 1983 ). Data management in large-scale simulator experiments. Halden, Norway: OECD Halden Reactor. Project HPR-302. (Paper presented at the Enlarged Halden Programme Group Meeting, Loen, Norway, 24th - 27th May, 1983 ).

Three categories of experiment data (simulator state information,.C°FMS state information, and audio/video recordings of control room activity) were identified along w:ith the methods and hardware needed to acquire them during all test transients at Loviisa. The resulting data sets were transferred to Halden Project computers, trans-lated from Finnish to English, converted to a standardized data record format, and synchro-nized (in time) for each of 36 transient runs.

Subsets of the data were formed into a detailed timeline record of each transient for later detailed review by analysts. Other subsets were proces-sed to derive statistical, analytical and graphical representations of CFMS use and operator/plant performance.

Kautto, A. (1983). The transients of the criti-cal function monitoring system ( CFSM) valida-tion test. Helsinki, Finland: Technical Research Centre of Finland. (Paper presented at the En-

. larged Halden Programme Group Meeting, Loen, Norway, 24th* 27th May, 1983).

This paper, written from the point of view of safety, gives an account of the Loviisa process (Pressurized Water Reactor) in order to make it easy for the reader to understand the transients 23

developed for the CFMS validation experiments.

The reliable way to test a system for supporting the operator's decision making is to use a full*

scope simulator, because that makes it possible to generate 'riew' accident sequences by the in-teraction of simultaneous malfunctions, changing the order of malfunctions, and varying the seve-rity of the. malfunctions~ The CFMS test transi-ents took advantage of these features, which are fully described in this paper.

Kautto, A., Marshall, E.C., Rohde, K. & Mak-konen, L ( 1983 ). The experimental validation of the critical function monitoring system. (Paper presented at the IAEA&NPPCI Specialist's Meet-ing on Nuclear Power Plant Training Simulators, Otaniemi, Finland, 12th-14th September, 1983.)

This paper provides a description of the Loviisa process and how*the CFMS was implemented in the simulator control room. It also contains a fairly detailed outline of the transient scenarios used in the experiments.

Marshall, E., Hollnagel, E. & Tuominen, L.

( 1983 ). The experimental validation of the criti-cal function monitoring system. The* training programme. Halden, Norway: OECD Halden Re-actor Project HPR-303. (Paper presented at the Enlarged Halden Programme Group Meeting, Loen, Norway, 24th* 27th May, 1983.)

In order to make an effective validation of a new operating system it is essential that operators are well prepared by means of careful pre-trai-ning. A systematic and consistent training pro-gramme was constructed for operators taking

. part in the trials. It consisted of a series of tape-s tide modules, written exercises and opportunity for structured, hands-on practice with the display itself. Results from the programme indicated that introductory and theoretical aspects were learned adequately. This conclusion was b*orne out by responses to the questionnaire filled out by all subjects after the experiment. However, it is evident that, due to the restricted time avail-able, trainees lacked practical experience in use of the display. Nevertheless, operators found the programmed approach to training both interes-ting and efficient.

Marshall, E., Makkonen, L., Kautto, A. &

Rohde, K. (1983). An account of the methodo-logy employed in the experimental validation of the critical function monitoring system. (Paper presented at the IAEA/NPPCI Specialist's Meet-ing on Nuclear Power Plant Training Simulators, Otaniemi, Finland, 12th* 14th September, 1983 ).

An experiment on this. scale cenerates a gre:n deal of valuable data. In this case, it took the form of video-tape recordings of operator activi-ty, computer logs of plant parameters and con-trol actions, as well *as observational records. In addition, questionnaires and interviews were ad-ministered by instructors after the experimental sessions. This paper describes methodological aspects of the overall analysis and shows how these diverse data sources were combined to pro*

duce a coherent overview for assessment of the impact of the CFMS on plant operation.

Meijer, C.H. (1982a). On the validation of operator aids for nuclear power plants. (Paper presented at the Halden Project Workshop on Human Factors Experiments and Validation of Operator Aids, Halden, Norway, 9th* 10th :\\<larch 1982).*

This paper addresses some of the more general aspects of the validation of operator aids for nu-clear power plants. The validation is discussed in terms of the generic requirements for operator aids and the steps needed to verify that these re-quirements have been fulfilled. The. early con-cepts of the Criticcil Function Monitoring Sys-tem (CFMS) programme, as jointly performed between Combustion Engineering, Inc., the OECD Halden Reactor Project, and the Technical Research Cen.tre of Finland, are highlighted.

This programme included the validation of the CFMS at the Imatran Voima OY owned and operated Loviisa PWR training simulator facility at Loviisa, Finland.

Yleijer, C.H. ( 1982b). Computer-based opera*

tor support systems. Windsor, Connecticut:

Combustion Engineering, Inc., IPD82*53. (Paper presented at the Third Coorporate Technological Awareness Conference, Atlanta, Georgia, 29th.

31st March, 1982).

This paper addresses the Combustion Engi*

neering, Inc., approach to meet some of the later needs for improvements to the man-machine in*

terfaces that aid the operator to monitor, con*

trol, and diagnose the plant during normal and abnormal operation. The principles of an early version of a Critical Function Monitoring Sys*

tern ( CFMS ), as an aid to the plant operator to monitor and control a finite set of critical plant safety functions, are discussed in detail. The ap*

proach is based upon C-E's many years of expe-rience *in designing and licensing PWR's and deve-loping its NUPLEX 80-TM advanced control center for this type of plant.

Meijer, C.H. & Rohde, K. {1983). The CFMS:

An aid to improve man-machine interaction.

Windsor, Connecticut: Combu5tion Engineering, Inc. (Paper presented at the Enlarged Halden Programme Group :Vleeting, Loen, Norway, 24th

- 2ith May, 1983).

It has been widely recognized that the existing man-machine interfaces in nuclear power plant control rooms are not adequate to effectively aid the operator in diagnostic or decision making activities. The critical function monitoring sys-tem ( CFMS ), developed by Combustion Engi-neering, addresses this problem by providing the operator with an integrated display of a minimum number of plant parameters, designed to provide a timely and accurate determination of the safety status of the plant. A unique feature of the CFMS is the implementation of sophisticated al-gotjthms, oriented at plant dynamics, which re-present the operator's basic cognitive process as related to the determination of critical function status. The CFMS has been installed in operating plants in the USA, and preliminary evidence in-dicates that it has been well accepted by the operating crews as an effective operator aid.

Nelson, P.R. (1983). Loviisa CFMS algorithm

• performance factor correlation analysis. Wind-sor; Connecticut: Combustion Engineering, Inc.,

Internal Note F46222.

This report contains the results of an analysis of the correlation matrices of. CFMS algorithms versus plant performance factors, made in terms of plant safety. The findings indicate that core boiling was the dominant performance factor.

This factor exhibits a positive correlation with the majority of CFMS algorithms. It is suggested to upgrade available data on overall performance in order to derive alternate performance factors or enhance those already utilised.

Rinttila, E. & Makkonen, L. (1983 ). The ex-perimental validation of the critical function monitoring system. Results from post*experimen*

tal interviews in CFMS validation. Helsinki, Fin*

land: Imatran Voima OY. (Paper presented at the Enlarged Halden Programme Group Meeting, Loen, Norway, 24th* 27th ~ay, 1983).

Each crew was interviewed after the final ex*

perimental run by an IVO appointed specialist

• who had also observed the experiments. The interviews were based on a prepared list of ques-tions. One conclusion from the interviews and observations was that the idea of critical func-tions was accepted by the Loviisa crews. Because of insufficient time for familiarization and certain deficiencies in the CFMS implemented at Loviisa, the operators could, however, not make as much use of the CFMS as they would have liked to. A system such as the CF~IS would nevertheless be useful in the Loviisa control room if some im-provements were made to the displays and if the system ~as better integrated with the existing control room.

Wahlstrom, B., Smidt-Olsen, H., Rinttila., E. &

Meijer, C.H. (1983). Experimental validation of an operator support system using a training simu-lator. (Paper presented at the IAEA Internatio-nal Symposium on Operational Safety of Nuclear Power Plants, Marseilles, France, 2nd - 6th May, 1983.)

It has been widely recognized in the nuclear industry that the man-machine interfaces in nu-clear power plant control rooms might not ade-quately support the operators' decision making during -adverse plant conditions. One proposed solution has been to provide the operators with an aid by displaying a small number of critical plant parameters selected to achieve a timely and correct determination of the plant state du*

ring these conditions. Very little evidence, how; ever, exists on the benefits of such operator aids and how they should be used in an actual con-trol room environment. The paper describes a project. to experimentally validate a so-called Critical Function Monitoring System in terms of its usefulness to the operators in handling two complex adverse transients run on a full-scope training s_imulator.

25

SUMMARIZED CONCLUSIONS BASED ON EXPERIMENTAL RESULTS Overall Detailed Questionnaire Assessment Analysis

& Interview Increased CFMS display use reduced 1

2 number of CF alarms.

CFMS was most often used for detection 2

1 2

or confirmation of alarms; only infre-quently used in planning and decision for action.

It was difficult to understand link 2

1 between success paths and CF.

The success paths were shown on third 1

2 2

.level pictures which were infrequently used by the operators.

General uses of the CFMS rated higher 1

2 2

than specific uses. In particular, the overview display (primary and CF monitor) were used the most.

The test task was considered difficult 2

1 by all operators.

Crews did use the CFMS to obtain useful 2

1 2

information during test transients.

Amount of heat in primary system was 1

2 the CF factor most affected by CFMS use. Core boiling was dominant plant performance factor.

Supervisor was the predominant 2

1 user of the CFMS.

CFMS should be better integrated with 1

the existing control room systems.

There should be several dedicated CFMS 2

1 display units.

26

l11

~--

Pm.. rinr Z11 C.n no T r*ftd 1 100 Dhtlt1y Dirwtery m

c.......

m

,,...I 101

'"'"" l i" zzz PriMe;ry JM c.......

101 C FMS M1111itor

10)

~

._O_*_t_*_f_R_,_... _'J~

Jlt

....,~

Jll CFMS Oi1pl1y Hi~nrchy lmplP.ment~d at Loviisa JU

.... St_

Z44 c...........

JJ4

222 AUG/8)/1912 222't11e PAIH,PJJAJN HASJAtASf YP' I 9L892 HATALA" P'UHALLUSILO TAYTTYY VAROVl[NTTllLI AUKJ HATALllAVICSI TJ ULOSLAIK/LllAVl[IJ NORHAALILISAVESI TK 1

5 2

41 y......... IUURI I

JAAHDYTE KIEHUU v.-1e.-ee1 IUURJ GRAD. 1 KYLHAHAURAUSLAHP'OT.

HATAJAAHDYTYI TH IS OCllRtRl6

• OORIN IAATO 13 PRIMAARIPIIRI e

e POP-V 1 RTA POP-V IR TA

.A.-UlltUllKUTUS ltAINICISTIH L

e.ee 9

T a,...

.JUN/96/ltt&

0919: 15 P5ec PRIMARY

...-~~--- TO 4HJCNCH

~4Nt<

E50R

~GOLO *;!A 5*2~ 3 LETDOWN CH.ARGING 4 BORON

.HOT-A

\\,

'\\, TO PZR

\\. SP9'AY

\\

81

")"'?

61' 59~ LIQ 2959 6't3 VAP HG AHP5 TCOLO IA 5'2'+

P59A 556 CS-A OP CS-P OP E50A TCOLO 18 52~

P59e TAVG

~e PCS HT UP e

63 63 0£6./HR

..