ML19322C389

Human Factors Methods for Nuclear Control Room Design

ML19322C389
Person / Time
Site:	Crane
Issue date:	06/30/1979
From:	Eckert S, Seidenstein S, Seminara J LOCKHEED MISSILES & SPACE CO., INC.
To:
References
TASK-TF, TASK-TMR NP-1118-SY, NUDOCS 8001160925
Download: ML19322C389 (62)

Text

{{#Wiki_filter:r1 ^ ', Human Factors Methods for Nuclear Control Room Design NP-1118-SY - Research Project 501-3 Summary Report. June 1979 Prepared by LOCKHEED MISSILES & SPACE CO., INC. RO. Box 504 Sunnyvale. California 94086 Principal investigators Joseph L. Seminara Sharen K. Eckert Sidney Seidenstein Wayne R. Gonzalez Richard L. Stempson Stuart O. Parsons Prepared for Electric Power Research Institute 3412 Hillview Avenue Palo Aitc, California 94304 [ EPRI Project Manager Randall W. Pack Nuclear Power Division 8001160 ff[ f L-

6 e ORDERING INFORMATION Requests for copies of this report should be directed to Research Reports Center (RRC). Box 50490. Palo Alto. CA 94303, (415) 9619043 There is no charge for reports requested by EPRI member utihties and affihates. contnbuting nonmembers U S utihty associations. U S government agencies (federal. state. and loca!) media and foreign organizations with which EPRI has an information exchange agreement On request. RRC will send a catalog of EPRI reports Copyright C 1979 Electnc Power Research Institute inc EPRI authorizes the reproduction and d stribution of ali or any portion of this report and the prepara ion of any derivative work based on this report in each Case on the Condation that any SUCh reproduction distribution. and preparation shalf acknowledr e this report and EPRI as the sou ce r g NOTICE This report was prepared by the organization (s) named below as an account of work sponsored by the Electric Power Research Institute Inc (EPRI) Neither EPRI members of EPRI the organization (s) named below dor any person acting on their behalf (a) makes any warranty or representation express or imphed with respect to tne accuracy completeness or usef ulness of tne in'ormation contained in tnis report of that the use of any information apparatus. method or process d'sclCsed an this report may not intringe pnvately owned rights or (b) assumes any liabilities w,th respect to tre use of or for damages resulting from the use of any irformation apparatus method or process disciosed in this report Prepared by Lockheed Mssiles & Space Co, Inc. sunnyvaie. Caktomia

8 EPRI PERSPECTIVE An earlier review of the control rooms of operating nuclear power plants uncovered many design problems having potential for degrading operator per formance. As a re s ul t, the f ormal application of human f ac tors principles was found to be needed. This report demonstrates the use of human factors in the design of power plant control rooms. The approaches shown in the report can be applied to operating power plants, as well as to those in the design stage. This study document ed human f ac tors techniques required to provide a sustained concern for the man-mach ine interface from control room concept de finition to sy stem implementation. It goes f ar beyond present control board design practic-es. However, control board designe rs intending to use this re port as a design , model should be aware of three limitations of the study. First, although design i engineers supported the human fac tors analyses, the depth of the study was limited by the lack of their participation as an integral part of a design team.

Second, the use of only three selected subsystems limited the study scope, so that overall c ontrol room layout and sy stems integration aspects were scarcely addressed.

Third, the designs were based on analyses of startup, change of power level, and shutdown operations, and were modified by less detailed analyses of a few emergen-cy sequences. A more thorough design approach would include detailed analyses of all events shown to be significant by safety and reliability studies and by re-views of plant operating histories. The rummary re port will be of interest to anyone involved in control room design I. or in opera tor perf ormance. The full report will be of interest to anyone deeply l involved in the design of power plant control rooms. Designers of other types of control rooms, such as dispatch centers or process plants, may also benefit from the report. j 111

3 i. Three. closely related projects are in progress. Publication of the final report for RP1126, " Human Fac tors Review of Power Plant Maintainability," is expected in late 1979. Completion of an improved approach for p rocedu re s, RP1396, " Test of Job Performance Aids' for Power Plants," is scheduled for early 1980. Final-report publication for RP769, " Performance Measurement System for Training Simulators," is planned for late 1980. These studies address both nuclear and fossil fuel power plants. Randall W. Pack, Project Manager Nuclear Power Division + t I f i 2 i I f I i I i f iv l e r,-, e n- -v-rr,, ,~~v.. -, - - ---r-,.,---,4-w--,, 1 +

---

t

.-m- . -, ~. -, +

j s ABSTRACT ' Human f ac tors engineering is an interdisciplinary specialty concerned with influ-encing the design of equipment systems, f ac ili t ie s, and operational environments to p romote safe, e f ficient,. ind re liable ope ra tor performance. Human f ac tors approaches were applied in. the design of representative nuclear power plant con-trol panels. First, methods for upgrading existing operational control panels I were examined. Then, based on detailed human factors analyses of operator infor-mation and control requi rement s, designs of reac tor, feedwater, and turbine-gene ra tor. control panels were developed to improve the operator-centrol board interf ace, thereby reducing the potential f or operator errors. In add ition to examining present generation concepts, human fac tors aspects of advanc ed sy s tems and of hybrid combinations of advanced and conventional designs were investigated. Special attention was given to warning system designs. Also,- a survey was conducted among control board designers to (1) develop an overview of design practices in the industry, and (2) establish appropriate mea sure s leading to a more systematic concern for human fac tors in control board design. The study concludes that there is an urgent need for a human fac tors engineering design guide, tailored to the special demands of the utility industry. Similarly, there is a need for a human fac tors standard which the utilities could use in specify-ing, developing, or evaluating new control room designs. The study also provides suggestions for future research direc tions. s v l t i a---

A ACKNOWLEDGMENTS We a re indebted to many individuals and organizations for their assistance, guid-ance, and cooperation in the design and execu tion of this study. While we were f ortu na te in obtaining the cooperation of all major reactor vendor organizations snd several Arch ite c t-Enginee ring (A-E) fi rms, the Westinghouse Corporation assumed a lead vendor role in providing the study team with sy s tems information required for human factors ana ly se s. Also, Westinghouse made available its Training Center and staff for operational re v1 =.7 of many of the design concepts presented in this re por t. Joe Franz, Ma:ager of the Process Computer Activity, and John O 'Brien, a member of the Human Sciences organization, we re our primary contac ts with Westinghouse. Several consultants participated in the study. Jeff Barnum, of the NUS Corpora-tion, provided the study team with the initial system familiarization training and insights into operational prac tices. Tom Sheridan, of the Massachusetts Institute of Technology, served as a consultint in the areas of human performance modeling and computer automation. Joseph L. Seminara, LMSC Randall W. Pack, EPRI June 1979 vii

t t Section 1 INTRODUCTION AND

SUMMARY

This study explored the feasibility and value of applying human fac tors engineer-ing' methods developed in the aerospace and military contexts to the design of se lec ted nuclear p owe r plant control panels. Human fac tors aspects of both con-ventional and advanced control and display approaches we re considered. The study also reviewed pre sent control boa rd design prac tice s to determine how best to incorporate human f actors concerns in the design process. This study was the direc t outgrowth of an earlier eighteen month study identified as EPRI RP (Research Proj ec t) 501-1 and entitled, " Human Fac tors Review of Nuclear Power Plant Control Room Design." In the earlier effort, a Lockheed Missiles & Space Company human f ac tors team reviewed five p re s ent-gene ra tion operational control rooms and their corresponding simulators. By means of extensive structured interviews with operators in operational plants and with tra ine rs associated with simulator-based operatot training centers, a number of operational problems were uncovered. Human f ac tors checklists, based on applie'd in evaluating man-machine aerospace standards and design criteria, were interfaces in the five control rooms reviewed. The study team also spent many hours directly observing operator tasks in both operational and simulated cont ol rooms. Analyses of representative opera tor emergency tasks we re conducted along with procedu re evaluations. Reported opera tiona l errors were probed for human f ac tors implications and a variety of physical measures were taken in de fining the opera tiona l environment and in evaluating anthropometric fea ture s of control rooms. The human f ac tors problems revealed by these methods we re extensively photo-documented for post-site visit analyses and to illustrate the problems observed in the final reports. I The study revealed both major and minor problems in the design of control rooms, which increased the potential for operational errors and unnecessarily added to the - training burden and the rigor of selection criteria for operator cand ida te s. l' The re sults of this initial study are documented in a summary re por t (EPRI NP 1-1 i y ,-9-g-- 3 -g -_-i

E 3M P. dated ember 1976) and an extensivo '.O n fim rarcre : EPE ':P W. ~~ ac ::verber 1970. A: nough hu man factors en gine e r i ng has a histors ever thirty vears. the hu r.an f ac tors design principles initially developed for military and space programs to ensure operator e ff ec tiveness and reliability have not been generally or consis-tently applied to the design of power plant ope ra t i onal work spaces. For example, four out of the five control rooms reviewed revealed serious violations of anthre-pometric standards where i ndicati ons were placed bey ! viewing limits and cont ols were. located beyond acceptable reach limits. Control rooti c on fi gu ra t ion s var.'d widely, with some designs making for awkward ope ra ti ons necessiti.*ing add' 'onal manning when compared with more efficient con fi gu ra t i on s. The extenstve

t. s e of b ackrack areas which take cpera tors away f rom the primary sphere of control and the prac tice of mirror-imaging control boards in multi-unit control rooms we re found to be particularly disadvantageous from the human f ac tors standpoint.

Control b oard designs were generally found to be excessive in size, lacking in functional arrangement of elements (sometimes necessitating a two-man ope ra t ion of a control and its associated display), and generally lacking in clarity of interrelationships between panel elements. In short, the control b oa rd s reviewed had not been de si gned to p romote error-f ree operation, especially during potentially stre ss ful circumstances. The number and magnitude of problems revealed in the initial human fac tors effort clearly indicated the need f or additional research and led to the follow-on e f f ort, EpRI RP 501-3, described in this re por t. The p re sen t study applied human fac tors engineering approaches in deriving solutions and recorne nda ti ons pertaining to the problems highlighted in the earlier study. The study scope ranged from an investi-gation of means for upgrading existing operations? control rooms to an examination of human fac tors concerns in advanced control rooms of the fu tu re. METHODOLOGY This study applied well-established methodologies in developing and evaluating var-ious control board design concepts. Figure 1-1 depicts typical human factors pro-gram elements extending from the initial concept development phase to system opera-tion. The p re s ent study simula ted an actual control b oard development program including (1) system analysis, (2) func tion s and task analysis. (3) pre liminary b oard de sign e ff orts, and (4) design verification efforts using mockups a nd rep re-santative members of the operator p opu la ti on.

was bcyond the scape of this studv t

irp M ent dy namic simulations for test and ev2? ation purposes. In addition.

a 4 LLD:: M XKUP3 .-+ c.L....... g;..g.7

ES!CS N

STU !E3 ec e m !ER g RF2EARCH SOFTWARE < :EJEwrMEE \\ STIEM E** FEFJOE. A TE!! UC FAO*3RS " ~!gA;g-r-wr UEIU CRITERIA & E E7A!./ JAI!ON rxn:u srE;1rI. 1 guyzag A:.LOCATIO5 MENT 3 CATION 3 ~,,,, j TRAINING RG7IRI-TA31 MEES A?iA!.YSIS PROCEDURES nc i i i m aALs i 8 t i l CONCEPT i DEVELOPMENT l IMPLEMENTATION I i l i Figure 1-1. Human Fac tors Program Elements the study was aimed not at developing hardware designs ready for p roduc tion, but rather at showing how to incorpora te human f ac tors methods and design principles into control board designs for nuclear power plant control rooms. Subsystem Selection A review of control and display approaches for the entire nuclear power plant con-trol room is beyond the scope of the present study. It was the re fore necessary to limit the study to a set of representative subsystems within the bounds of project funding. Selected subsystems had to be those that, in combination, would represent the design problems that typify the control board design process, and those that had evoked general operator and trainer concern in EPRI RP 501-1. The subsystems selec ted were reactor control, steam generator feedwa ter control, and the + turbine generator. l 1 1-3 l

Study TaAks Sub sequen t to a review of the relevant literature, the following tasks were c onduc t ed: Analyses -of Control and Display Requirements. A series of analy-ses, f rom broad sy s tems analyses to de ta iled task analyses, were conduc ted to identify and examine re levant man-mach ine inter-faces. The end-product of this series of analytic efforts was a determination of the operator's informational needs and control options. Upgrading Existing Control Boards. The fi rs t concern in investi-e gating c ontrol b oard design approaches was to enhance control board designs that are current ly operational or those that are near-operational and consequently dif ficult to modify in any sub-stantial way. Recognizing tha t a 40 year life span is projected for nuclear power plants, the study explored measures that might be taken to upgrade the existing con figura tions from the human f ac tors standpoint, without interrupting or delaying power generation. e Human Engineering Conventional Control Boards. This task in-volved the development of new conventional control board designs. Starting with the control and display requirements identified in -the analysis task, human f ac ters panel-design prin-ciples were applied in arriving at panel layou ts for the three systems of concern in this study. Warn ing System App roache s. Problems with existing annunciator e wa rning designs we re reviewed and candida te approaches were developed to re so lve observed de ficienc ie s. Charac teris t ic s of visual and auditory cueing devices we re reviewed and a number of candidate audio-visual warning concepts were advanced. e Design Verification. The human f ac tors design approaches devel-oped in the preceding tasks were subjec ted to the scrutiny of b oard design personnel and trainers with operational b ack-g round s. Designe rs reviewed the proposed arrangements from the standpoint of such constraints as separation and seismic require-ments, while reviewert with operational experience examined the panel layouts in terms of the demands of a representative set of normal and off-normal operational scenarios. Advanced Computer-Based Cathode-Ray Tube (CRT) Approaches. Each e of the major control room design organizations was visited to detercine future trends in control room design. A detailed exam-ination of the major direc tions being followed in CRT formatting was conduc ted in the light of human f ac tors considerations. Hybrid Systems. A readily discernible fu ture trend is the inte-e gration of advanced compu te r-bas ed CRT capability with conven-tional board designs. The advantages and potential drawbacks of these " hybrid" concepts were examined. e Design Practices Survey. In order to establish the feasibility of i nc orporating human f ac tors principles a nd considerations in ontrol board designs, it was necessary to develop some 1-4 y-

f appreciation of current design practices and an understanding of the c ons traints facing the designer. Accordingly, a 30-item struc tured interview was developed and ade.inis t e red to 20 designers from major design organizations. e Fu ture Study Needs. 'Ihis study revealed a number of possible extensions to the work conducted to da te, including the need for human factors design guides and standards. Also, research topics are advanced for developing empirical data bearing on a number of pressing design issues raised in this effort. This brief outline of study tasks is intended to serve as a road map through the remainder of this report. ANALYSES OF CONTROL AND DISPLAY REQUIREMElfrS A necessary initial phase of the human factors approach to equipment design is to develop a detailed understanding of the man-machine interface. This requires the application of a variety of analytic techniques based on a comprehensive under-standing of the system and its func tional charac ter istic s, and a delineation of operator information needs and associated control options. Systems Analysis 4 Systems analysis wa s initiated with an intensive review of nuclear power plant c on figu ra ti ons, the physical hardware and basic elements of the sy stems selected for study, control system characteristics, control board elements for a Pressur-ized - Water Reac tor (PWR) plant, and operational practices associated with normal and off-normal operations. In the course of this review and analysis of the 4 selected systems, representative system schematics for a generic plant were devel-op ed. A functional inter face sequence analysis was also performed, as shown in Table 1-1, to interrelate the operations of the three selected systems. i In addition to these preliminary systems analysis activities, the study team visited the Nuclear Steam Supply Systems (NSSS) vendor organizations in order to expand the base of system inputs required for analysis. While all the major NSSS vendors supported the study at various stages of the program, it was still neces-sary to select a lead vendor for the primary source of systems data. Analysis could not be performed expeditiously on all vendor designs because of variations in system design app roache s. Westinghouse assumed the role of lead vendor and invited the study team to spend one week in detailed discussions with the various func tional system designers. Westinghouse also provided relevant system descrip-tion documentation required for subsequent analytic efforts. 1-5 l

4 ' Table 1-1 SEGMENT OF FUNCTIONAL INTERFACE SEQUENCE FOR START-UP Turbine-Generator Reactor Control System Feedwater System System Pull shutdown rods Prepare to go critical Take the reac tor critical Increase to baseline Transfer control of Pre pare for roll steam genera tor water Increase to 5% power level from auxiliary Begin roll feedwater to main feedwater regulating Increase speed bypass valves control coolant tempe r-Per form trip tests ature while turbine is brought up to speed and Achieve operating genera tor is synchronized speed l Begin to pull rods Establish operating and increase power with voltage torbine load Synchronize to grid i Transfer control to Inc rea se load (1%/ min) main feedwater regu-lating valves Place in automatic Transfer main steam control genera tor feedwater control to automatic control Monitor steam gener-ator level, steam flow, pressure, and feedwater pumps Warm-up standby main Achieve desired load feedwater pump and level place standby pump in operation On going monitoring On going monitoring On going monitoring Functions and Task Analyses Based on the systems analysis, the study team was able to identify the major func-tions and subfunctions that the opera tor mu st perform in the course of monitoring 'and regulating the system. Operator involvement in these sub func tions l 1-6

s wa s further broken down into discrete tasks. In analyzing each specific task or man-machine interaction, the following fac tors were considered: e Decisions to be made e Ac tions to be taken Ongoing plant prece sse s e e Control parameters e Control limits This process re sulted in the listings illustrated in Table 1-2. This systematic examination of sequential operator-control board interf aces sas intended to reveal display requirements and control options to be included on the control boards, f } Decision-Making Analyses In the course of conducting func tions and task analyses, the more important or complex decisions f acing the opera tor were singled out for more detailed decision-making analysis. A graphic logic flow for use by the operator in arriving at a decision was developed. For example, the d ec ision-making process requi red to determine if the rods are moving properly is illustrated in Figurs 1-2. At each step in the process, the analysis a t temp t ed to determine the informational needs of the operator to allow him to resolve the problem appropriately. Precautions Analysis Plant operating procedure s sometimes provide the operator with separate listings of special precautions. These listings proved to be a useful source of analytic data. Each precau tion re lating to specific subsystems was examined in terms of error potential and possible means for ensuring error-free operation. In some instances, it was apparent that a suitable indication or alarm was required to p revent a potential operation error. In other cases, reliance on procedures appeared adequate. In still other instances, the possibility for error seemed sufficiently great that mechanical or electrical interlocks to " design out" errors appeared worthy of further investigation. Table 1-3 provides a segment of. the precautions analysis performed for the reactor control system. Control-Display Requirements Based on the series of analyses described above, lists of control and display requi rements we re developed, some of which are p re s ented in Table 1-4. These requirements nerved as the foundation for the designs presented in this re por t. 1-7 --e n-

Table 1-2 SEGMENT OF THE FUNCTIONS AND TASK ANALYSIS FOR RT. ACTOR CONTROL SYSTEM Task ID Function Process Process Control Sub func tion Decisions Actions

Response

Parameters Parameters 4 Increase Power to Baseline Power Level (10-8 amps) Establish start-SUR less than Full rods Rods withdraw LVDI Digital up ra te (SUR) 1 DPM7 CR increases position counter less than 1 SUR increases CR trend decade per SUR minute (DPM) Monitor inter-IR le' vel IR level mediate range greater than (IR) level to 10-117 determine when on range Switch nuclear i decade Reposition Switch instrumentation overlap? NIS position system (NIS) recorder IR level recorder from switch lowest source range (SR) to IR level IR level on highest IR displayed? recorder Continuously SUR less than CR trend; monitor SUR 1 DPM? SUR IR and SR level Switch second I decade Reposition Switch HIS recorder overlap? IR switch position pen to IR level greater IR level channel than 5 x displayed ~II 10 ? IR displayed? It is important to note that, for economy of e ffort, the analyses were based on three operational modes: start-up, change of load, and shut down. These modes, however, do not begin to describe the full range of normal and off-normal opera-tional scenarios. Consequently, at a later date, when the firs t cut at panel designs was completed, a visit was made to the Westinghouse Training Center to review the initial analytic conclusions with respect to a more varied series of normal and emergency operations. These activities will be discussed further in the context of the design verification task. 1-8

P p p N N speed roup 1 - y y digital 888 " E,- group 2 ok? N count + I? g igital = Y* VIyr i 12 LVDT bottor Y increasing h Y position j light ut? .v s bank \\ 7 p sitions p-Y nereasing rods are NIS responses Y moving ? indicate rod an-up nereasing/ withdrawal 4 properly 7 i e Y audio ncreasing count P i .ontro I I = 228. Y_, , 228, Y = 228? mov ng? D<228? ank posi-n ^ A lo - Y N y N N y p I"RI ng? ng? P ) V V \\ l k Y N L A >128? > 128 C> 128't I N N N l i Figure 1-2. Decision-Making Analysis: Are Rods Moving Properly? 1 1 l

Table 1-3 SECMENT OF THE PRECAUTIONS ANALYSIS FOR THE REACTOR CONTROL SYSTEM ... PP.ICAl* IONS AD LD'ITATION? $YSTN DEF10'; FENPtTNDATIONS 3. Criticality must be anticipated any time the The estimated critical position could be input, and control rods are being withdrawn or when boron a computer could examine this ECP and the actual dilution operations are in progress, rod position. An interlock could be procided to prev ef. ud withdrawal if an ECP is not input. 4. If criticality is to occur at conditions (i.e., This is currently handled procedurally. It is temperature, xenon, and boron concentrations) good practice to always utilize an inverse different from those for which previous criticality count rate curve. If this were done automatically data is available and the differences are such as by the computer, it could always be plotted to to cause an increase of 0.5%.1K/K (500 cpa) er monitor approach to criticality. more in core reactivity (as determined by procedure F. " Estimated Critical Rod Position Calculation" of Chapter 50), the approach to criticality must be guided by plotting an inverse count rate versus control rod position. 5. Do not exceed a startup rate ($13) of one decade The NIS trips would probably prevent reactor per minute (1 DPM) unless authorized for special start-up nasch faster than 1 DPM. It may

tests, be beneficial to have a separate trip on SUR.

6. When the reactor is suberitical, positive reactivity This is currently handled procedura11', An shall not be added by more than one method at a interlock could prevent rod withdrawal time. simultaneously with dilution when suberitical. 7. The rod withdrawal and insertion progran shall be There are currently rod blockages and trips to followed except during low power physics tests, ensure the rod program is being fc11 owed. control rod exercises and special approved tests. A direct display of rod program position and actual rod position would assist the oparator in satisfying this precaution. UPGRADING EXISTING CONTROL BOARDS In addressing control board design approaches in terms of human factors considera-tions, our first concern was with the modifications it can be made to existing control board s that are operational or ne ar-opers. ciona l. There are pre sently about seventy operational plants and more than an equal number of new plants where the control boards either have been designed or are in various stages of assembly and checkout. In applying human factors to existing operational designs, however, a number of compromises must be made, since there is little opportunity to change the position of components, rewire panel elements, change circuitry logic, etc. Consequently, much of the analytical work described above could not be applied to existing b,ards, because interruption of plant operation may not be allowed. 'Ihis groundrule limited us to a variety of surface or " cosmetic" approaches which, if implemented, would considerably improve board operation, but would not fundamen-tally optimize the boards. Board Enhancement Possibilities Problems cocinonly observed in the course of earlier control room reviews were ca teg oriz ed as follows: (1) those that could be add re ss ed on a back fi t basis 1-10 m

-Table 1-4 DISPLAY REQUIREMENTS FOR THE REACTOR CONTROL SYSTEM t 2 2, 3 Parameter Units Range Accuracy j g Comnen t s NUCLEAR INSTRUMEh7ATION 1. Source Range (2 channels) a. Count rate Counts 1 to 106 +7% of the X Need quanti-per _ Tinear tative display second full acale plus trending analog capability voltage b. Startup ra te Decades -0.5 to 5.0 17% of the X per linear minu te full scale analog voltage 2. Intermediate Range (2 channels) a. Flux level Ampe re s 10 11 to +7 of the X Need quanti-(A) 10~3 linear tative display full scale plus trending analog capability voltage and +3% of theIinear full scale voltage in the range o f 10*' to 10-3 A b. Startup ra te Dec ade s -0.5 to 5.0 +7% of the X per Tinear minute full scale analog voltage 3. Power Range (4 channels, 2 chambers-each) a. Calibrated ion Percen-0 to 125% 12% full X Need quanti-chamb er tage of power tative display current (top full current of all 8 and bottom power values, plus uncompensated current trending ion chasbers) capability b. Flux differ-Percent -30 to +30% +4% X ence of the dif-top and ferent i bottom ion J chambers I l c. Average flux Percent 0 to 120 +3% of full X of the top of full power for and bottom power indication ion chamber +2% for i recording 1-11

while the plant remained opera t iona l, (2) those that could be remed ied during an e x t end ed planned outage, and (3) those that did not lend themselves to b ack fit remedies. The firs t category is of immediate interest here and included the following concerns and remedial measures: e Functional Demarcation of Related Panel Elements. While re la ted panel elements are often grouped in meaningful clu s ters on the b oard s, these clusters of controls and displays are us' ally not func tionally demarca ted such that the relationships a re immedi-ately apparent to operators. Figure 1-3 shows a massive array of undi f f erentia ted panel elements which force a " hunt and peck" search for specific controls imbedded in a mass of many other identical controls. Where the panel elements have been arranged in a logical operational format (though this is not always the case), taped lines of demarcation can be add ed to highlight sub-groups of panel components. e Labeling. Demarca ti'on of panel groupings should be supplemented by a system of labeling that accentuates func tional subdivisions and avoids the re pet it ivene ss of pre sent labeling prac tice s. Each subpanel area should be provided with a distinctive summary kh Y~ i w w n' w , m...s. m., c... e..-: 4 .\\.y p_ /rri N'j 9,4Q, !? / q 7 -g

• \\. g f..

s, n. E .\\/ f +.:-

1..:

s s. s: o e L.. a* - --- o.= A ~= L L -: ? ~ e..- a.. s J--

4..::

m: ac A,b La b *- h :: in ta b c. L <- t b?.C .j: 6-ss O d- $, r. g$ h& . g c-g( i l l l Figure 1-3. Massive array of identical control and display units l with no clearly identified subpanel groupings or summary labeling. Y

label, larger than labels applied to individual panel elements. Labels should also be placed consistently in relation to panel components, pre ferably above the components. Label coding prac-tices should be instituted uniformly, such as using red back-grounds for important controls; the consistency and clarity of abbreviations should also be reviewed. e Coding of Controls. One of the most serious problems with coding of controls is the p res ence of large arrays of undifferentiated or identical controls collocated in a given area of the control b oard s. Such arrangements have caus ed inadvertent operation of improper controls. Existing control boards should be examined for control coding possibilities, e.g., shape coding, color cod-ing, or combina tions of such coding practices. Substitutions of control handles of different shapes can generally be accomplished with little or no impact on operations. e Meters. Meter limits should be reviewed for each panel and a consistent cod ing prac tice should be developed, such as green normal operating band, amber marginal bands on either side of normal, and red ou t-o f-limi t bands on the high and low side as a pp ropria te. These color bands should be affixed directly to the meter scale where it is possible to do so by easy removal of the meter cover. Meter scales which do not conform to human f actors principles of design should be re placed, and room illumination should be modified where glare and re flections from meter faces obscures their readability. e Indicator Lights. The color coding of indicator lights should be reviewed to ensure consistency.- Coding possibilities for the annunciator system should be examined to differentiate between major problems and less significant information displays. e Chart Recorders. Some of the chart recorders currently in use are overloaded and largely illegible. Some parameters of insnedi-ate interest to the operator are buried and not available for as much as four minutes. Either additional recorders must be added, or meters should be sub stituted for important parame ters, or a fast rec order cycle provision should be added to existing recorders. This list of possibilities for improving current operational control rooms is not complete because each control room is a unique situation and should be reviewed on an ind ividual basis for specific human fac tors reconmenda tion s. For example, multi-unit control rooms where two units have been mirror-imaged offer special problems and no easy solutions. i It is important to note that operators have been quick to discover the above-mentioned conty room de ficiencies. They have attempted to make " quick fixes" to l l the board s to imp rove - their operability and avoid operational errors. For example, adj acent identical control knobs have been painted different colors for coding purposes. Many such fixes have, unfortunately, been prompted by an opera-tional mishap. Also, remedial measures have not been a pplied systematically to 1-13

the boards or in' any controlled fashion. Proper enhancement of existing control a care fully planned and concerted effort between plant opera-rooms will require tions, engineering, and management. Human Factors Enhancement: Examples To provide examples of methods for retrofitting existing operational panels, sev-eral representative panels were selected for study. An analysis was made of human f ac tors p roblems, and modification possibilities were considered. The cases illu s tra ted reveal a number of surface changes possible within the limits described in the introductory remarks for this section. Applying human factors on an "af ter-the-f ac t" basis is generally a compromise and not always satisfying from either a human factors or aesthetic viewpoint. Figure 1-4 shows a Steam Genera tor Feedwater Sy stem control panel. The panel allows monitoring and control of three steam generators having two motor driven main feedwater pumps and one steam driven auxiliary pump. The most striking observation in reviewing this panel is the lack of apparent relationships between discrete panel elements. The operator must examine the legend on each individual switch, indicator, or meter to make any sense out of the panel. Figu re 1-5 shows an a t tempt to functionally demarcate the panel shown in Figure 1-4. The various functional groups of panel elements are bound together by taped line s. Within each grouping, sununary labels are introduced, thereby reducing the time required in scanning each individual panel element label. Space constraints made it impos sible to place labels consistently above or consistently below com-ponents. Furthermore, a white / black / gray coding approach is adopted for controls associated respectively with Steam Generators A, B, and C. In assigning this code I i to the panel elements, it readily becomes apparent that no consistency was observed in the ordering of A, B, C Steam Generator elements. In some cases, a top-to-bottom A, B, C orientation is observed, such as MAIN FEEDWATER ISOLATION. In other cases, a contradictory b o t tom-to-to p A, B, C order exists, such as AUXILIARY FEEDWATER THROTTI.E VALVES. In other cases, a left-to-right A, B, C order is presented. In addition to coding the controls by color or shape, meters should be color-banded to highlight normal and out-of-tolerance readings. 1 Reorganization of Existing Control Boards In the preced ing para g raph s, a number of surface changes to the existing boards were propos ed for conside ration in an a t tempt to improve the operator-control board inter face. Since we established as a groundrule the avoidance of disrupting 1-14

plant opera t ions, such retrofits were minor in nature and the improvements achiev-able were correspondingly limited. In this subsection we will consider more extensive mod ifications to existing operational boards, assuming that the plant will be down for several months and that th is outage has been planned for some time. This planned down-time provide s an opportunity to upgrade control boards that have p roven especially troublesome from an operational or training stand-point, in some cases because of extensive backfits over the years. Redesign of control boards under the circumstances described will, in addition to all the fac tors considered earlier in this section, allow freedom to regroup panel elements in more logical func tional relationships than might have originally been the case. Also, panel elements that have proven useless or obsolete can be removed f rom the boards to eliminate unnecessary clutter or distractions. Su f fi-cient space may be saved on benchboard s to allow room for resting procedures on the board without risking inadvertent activation of controls. Figures 1-6 and 1-7 provide an example of the possible modifications. Techniques of outlining, bordering, color c oding, and labeling we re incorpora ted into the revisi on s. Panel elements were re ta ined within their re spec tive major console sections and the primary organization of major elements was not changed. A major change accomplished is the vertical alignment of the series of control-display elements associated with each of four steam generators. HUMAN ENGINEERING CONVENTIONAL CONTROL BOARDS Up to this point, the focus has been on human f ac tors approaches for upg rading existing operational control boards. In this section, however, conventional con-trol panel designs were developed based on the requirements of a totally new plant. During the analysis, control and display requirements for the operator to safely monitor and control the plant were identified. The decision-making and task activities of the operator were examined to ascertain the ac tual usage of these data. From this in f orma tion, any adjacency requirements and appropriate presenta-tion modes were also identified. For example, in the decision making analysis presented in Figure 1-2, we find that the operator is required to compare the rod positions indicated on the digital counters with the LVDT position indicators. It would be operationally desirable to present these displays in the same form and in the same general area on the control panel. However, in most operational plants, the digital counters are placed on the benchb oard while the LVDT's are on the vertical panel and pre sent rod position in analog form. In the human I l-15 l

[CamdetEnntmE il I E L5 2 5 D D D E5 r t-- I.. I~ ' [J t-E: i E: m2EclainDiGC ! r-b- [~- F. f. (strd W E M @ !ciES e m. \\ t.

t..

t.. L L Dsisista:s 1,, l r=J r= l cs i+

=

umm n-E BD g lAlwisiaIA IAlr: I rs i ci l+ D Qg gAIAlsimis jol l l l+ piiii l i r= i r=l s m i DD 8D 8D 8 8D RD eD -s m -m A k l g D D =0 .g asssi T T T.y q% w y ED 50 3-DD ED 50 DD m h rzrtsnm up r ssi m arevTm -n:= -. Q QQ Q o c a o n o a m mTr=2 ms munam EE!!5lHilE Ete&fB EEii5i!3E3 Nfva g g. o M ^=:==' Q Q QR 9) o m M 'p' fl.. EEliEiiB \\ s- =' r2 h n i. i W i i } e'. !o'! le' . g.;.. m m m m ggglg -- u ; d l igj

g

p' DD DD DD DD i_;

m Esgrp:ss;;g %+- m f) f UE! iU2 bb h@ Qh. (j M9; lMW ET Figure 1-4. Representative Steam Generator Feedwater Control Panel Design 1-16 [; ;. , [c ~pij;(p)y y T} kjbd (( b m

f [ Pi,MP 90f C8 CU'8!NT, h[ A uP5 h g =mem=mm ame '5 {- I - NNhh Nh a.- J> JP i Ik~ h h N h b ~ ~ .f".

• - ~ ~ - '

~ ,f i f L'. . s-r- p- ? _.. I' b L. k. I I , l es i ze: l:<: l r: 1::l elet.lnel r ....aum M unM m Q2 d I <=lthl:hlchl:h l ah l O l Ui l *~d l O

• E>

Ei

• l es l es i es l s

' =s t I I l+ AUX FEEDWATER l l l l l l l Q. l pg l ~,. 3 g . e... ai. "w PUMPS F!!DW AT E R ( liO LA T 60P. CIRCUIT Btf Ar.ER h[ MIN 5*I AM TA:P VAU t$ h .Ag IE iE Di 525 <c5 s-a 2 w 2 M @~ v a f-STEAM GENEltATOR NCNRETURN VALVE 5 Ei \\ / E ice A [ \\ MAIN F(fDWATElt PUMP $ AUX FIEDWATER THaOTTLE VAlvis CISCHARGE VALVE $ MAIN $ TEAM ?IUP BVPA55 VALv!S C 'A ~ 8 'C I C A B eC s e m m m i t m.e l o s s' s q.,. g j m. m [ $4 P va.vss g; $G MAIN 31[AM HIP V ALV[ $OV V Aivf 5 ... E E-5 5 m m. e a o s ( ..I MAIN FEEDWATER CONTROL 'E E' SYPASS RFGULAtlNG VALVi$ E*E E'E Ec p p q y v j f CcNTRoL sioNit sounci sructioN g _, ~ .. ~...,. _.m.<,<. MAIN R[GULAflNG VALVi$ g g 3 y Q N i i A B C .ee s..n ..E j.,~.' ! D 12 SY ME ) ~ s ) Figure 1-5. Enhancement of panel shown in Figure 1-4 by means of i func tional demarcation, relabeling, and coding of controls and tae t e r s. No controls or displays have been moved or replaced. 1-17 J a

y F1, 7 g 4 3 g y_, masrx-.m q Gx-L ] f 1 ) T i i 1 g 1 1 m i 1 1 l i L D ~ k L L L.L. A g 6mf b:m::::1 lll llj lll llj j h lli lill o 2::ss:; s., w 6 6-2 ' -~ i ,1 1 ... W - dj.. s., 6-m. a s, sm .v.9 . 4, . ~. 1;11_ li 8 ' I J l l. 1 l I 3 /9 M _M _M_ R _V _MiT M M /' //' ; Tt 6 t, t li r !! t #. i".i F9 R. '-'r=ne=5 - - 9r E-51 C== , t~jj t~ j _Z l3Z35 j T.q T o f T \\ f~-3 C=i o i c;ge Figure 1-6. Existing Feedwater Control Configuration engineered design, the two position indica tors were collocated in the same panel area and presented rod positions in the same form. Similarly, in the precautions analysis presented in Table 1-3 (Item 7), it is requi red that rod movement follow the withdrawal and insertion program. A direct presentation of the program posi-tion would help meet this requi rement. The re f o re, a direct display of actual bank position versus program limits was incorporated in the human-engineered reactor control panel. Control Console Design As a firs t step, a control console con figura tion was required that (1) allowed enough space for necessary panel elements and (2) add re ss ed the anthropometric charac taristics of the operator. Unfortunately, comprehensive data describing the operator popula tion is lacking. The re f ore, reliance on military data was con-l sidered to be a necessary and suitable expedient. It was also necessary to 1-18 klS.) 9*fD y dgmuuh

i i, y i; i e i, i -i - mm --- .---: -- e -, w ~1 ~ ~l.e " x, l.: = - ; d - ; -- d !..n. J =. m lt i: ' O :- : 1 i l l,l . -~_. -.9; " it s-J u -= -o=. m.- s ; !< ' r2 q.,__ - - ~ ~ - ' '-., - l 1I l S,t l j} l:- m} I ~~ r

Tce l(*}jij

, 1 ,. 1 i .,'j. 4 + r, .l1 - r i J I'I! t I- :-,I l- :1 Ii I! i --{ ! El1 *-'**'F"*~ ,g. ,4- _ _ _ _ _ " - ~ ' ' ' i I } h-l l ! t l,!.lI:. ll4 ! i . 3 I : i w ta

p.,

,t: 1,. ;j i s I !IiI ll .;i v;a-I. ! I,I l i i,J 4 tsi! Li I e uu ma mum 2---! "I > d " e. ..s l ', XC t_ ;,XCl 4 .. r. r:L :

XO

'CC !

a 4 ---r - 9 l d b r-20 O'C ;

• ~~

'~ - dl dl 0Cl .C:l "C: ~ ?Cl On -

.'3

-'? .m a.:. _3 V q1 . ao .q q*- -q+ q. 9+ s Y s

J' '

s !XC1

Dic I 00 OC

- 30 '? O j m,-j; . - I i n I I d [ 'd g - - ~

== ==s

== === i c=l ,' C C '*CC, f,- *, 6l 'q' [, g(e g(e g(e. l e, (y i' -l'$':5 d ,.T 1_1.. A]'- _ A_ __ f_f_ g. 1_. _i. 1_ a Figure 1-7. Reorganized Feedwater Control Panel (to be compared with Figure 1-6) I consider that a higher percentage of female operators may enter the control room in the fu ture. Present generation control consoles have been found to viol. ate anthropometric limits for male operators, and would obviously present even greater problems in acconmodating the generally smaller female operators. Figure 1-8 pro-vides the configurations and dimensions for a stand-up console designed to accom-modate the anthropometric range extending from the 5th percentile fem' ale operator to the 95th percentile male. The dimensions given are based on dynamic or ex-tended motion capabilities rather than static operator pos tu re s. Eckup evalua-tions were conducted with sui ~tably sized test subjects to verify these dimensions. 1-19 1 i f

Control and Display Selection Given the console dimensions, it was necessary to select the panel elements that would be us ed to form the th ree s ub sy s tem panel con figu ra tions. Human factors criteria for control-display selec tion were reviewed against currently available panel components. Based on the analysis, determinations were made on the need for qualitative, quantitative, or combinations of these display forms. When quantita-tive data was required, the best format for presenting such data was considered: meters, chart recorders, counters, or variable format displays. Similarly, re-qui red control options were examined in terms of the need for continuous versus dis cre te settings, and in terms of the most appropriate device: pushbutton, toggle switch, rotary selec tor switch, k nob s, etc. Many instances of improper control device selec tion had been uncovered in EPRI RP501-1. Also, the earlier study revealed that the use of excessively large controls unnecessarily increased panel size. There fore, an effort was made to select panel elements that took as little space as possible, but still satisfied other operational requi'rements. Panel Arrangements Five basic principles of control panel arrangement were reviewed for application: sequential ordering of panel elements, mimic or graphic pictorial p re s enta tions, prime locations for important or critical displays, location pre ference based on f requency of use, and functional grouping of related panel elements into distine-tive s ub pane ls. Also, where it was a consideration, location pre ference was given to right-handed operation. These panel layout principles are not mutually exclu-sive and all were used to some extent. However, the predominant layout principle, as will be shown below, was the functional grouping approach. Mimic arrangements, wh ich operators tend to pre fer in comparison with their existing b oard s, were a ttemp t ed but generally use up too much panel space and offer no substantial advantages over a well organized panel grouped by function. Other major concerns in the development of panel arrangement included (1) use of clearcu t labeling practices to aid rapid and accurate identification of panel ele-ments, (2) review of control locations to determine what measures were required to i safeguard critical contrcis from accidental ac tivation, (3) allowance of room for p rocedu res on the bench boards, and (4) determination of the best control-display coding practices. The latter design topic raised questions which were difficult to resolve. The study team concluded that the military " green board" display cod-ing and logic approach has many merits, even though its use of colors is in direct conflict with the tradition of the power i ndu s try which uses red for a normal

open, runn ing, or flow condition and green for a

closed, non-running, i

1-20

.c . _ = = -, , -...+-... - .-...w.._. .. ~ - -..... ~

• f $.

/ 's 15th PERCENTILE FIMALE - 95th itRCENTitE AutE +. 8 / x i i .y j ., 1.; \\ e / 'g I 's u \\ l i 4 - I 'I a \\ l c-,, ~j ' 58 8 'N 3 juw%. 3 9 -. j g N s g g 'b lp' l j 'i

i..

3 -'N / J l 'No l / Vj-l ' m* c / / l l ./ E g ,,b 's .i l ,. - l' l ,/ j N/- 1 Ji j y I 9F r T. I /.j/ e g (l l -f j j . r I 8 I I y J., u .-tM.~,. R Standard Hoe of aegM C Norms 1Inne of eagM l I g g 8 5 p rettsial l e i,per v>etas rense i { r

u a e

t F laser ***.smal des l 6 g l ) l seasse - 0 n nya,.. di tance e e i g og 3 i A _m / I .. 3 i i b l a I E i.n 2. e l I 12.' s 9 \\ 8 E s e Figure 1-8 Recommended dimensions for a standup console to accomodate the 5th to 95th percentile operator population. ' f:

no-tlow cond iti on.. The military operator is trained to respond to exceptions to the normally g reen pa t tern of panel displays. Such exceptions would be amber ligh ts for cau tions or the early states of a malfunction trend, and red indica-tions for a more serious ma lfunc tion. Furthermore, p res ent dedicated control boards do not incorporate the circuitry logic to inform the operator when a red-open condition or a g reen-clos ed condition is either a normal or abnormal con-dition which the operatr. should attend to. Some feel that it would be extremely difficult to forsake the traditional color code and that retraining of experienced operators would pre sent too many problems. The study team feels, however, that the. merits of a " green board" approach to display coding strongly ou twe igh the disadvantages of this break with tradition. Human Engineered Panel Lavouts Based on the foregoing analyses and applications of human fac tors design princi-4 ples, layouts were developed for the three subsystems dealt with in this study. Several versions of these layouts were developed as will be described below in the context of a discussion of, design evaluation methods. Figure 1-9 depicts the reactor control panel and reveals the layout of functional groups of control and display elements. Similarly, Figure 1-10 presents the feed-water control panel and provides the underlying framework of subpanel groupings. These panels should be compared with cu rrent operational panel designs shown in Figures 1-3 and 1-11. The most salient difference is the amorphous character of existing designs as compared to the clear-cut, functionally demarcated panels resulting from the human fac tors effort. This difference accounts for the numer-ous a t temp t s made by operators to modiity existing b oard s using taped lines of demarcation to clarify panel relationships and facilitate rapid identification of individual controls and displays. WARNING SYSTEM APPROACHES A primary task of the operator is to maintain cognizance over plant status and processes. He must be alerted to minor and major changes in plant condition as soon as they occur. Once his attention is obtained, he must be given the means to I determine the natu re of anomalies or temporary conditions, diagnose symptoms, assige priorities to correc tive courses of ac tion, and effect remedial control ac ti ons. Beyond this, he mu st con firm the e f f ec tivene ss of his actions and re store the warning system to a state of readiness to re spond to any subsequent problems. 1-22

s ._a ^^ - * - - - ~ - - - - - < ' - - " - - - - - - - - - - ..e..:. l ...<,c.c.,... I i- ..=. = =. - -= c - i &E1 n gggs.s. 335y.] -- ~~- n _.1 m,-.-T-s-.-&---me.- m.,,.m eD.m.,,cN, 3 i 3 m, ' f ~1 - I ,! E,_ :1. _. ,n;. .= ,,... n... i,'.., _ -l.. {-*- l. g, j., .-,.'.--l--l-' x.s =- 1 j __~}=__., t i r si I _. i .n I n i _ m i ~ m g__j ,,, i ' Y ],. W^ ] ' ~; C .h lr ' 1, _..;9..:p. i1 r-i i e i: 4 t.-.I n [ '. ;1. jq I;. q ..j o, .., s.,... ...m ( I C F . --- = - as = __ _______7

====. -.. = - - - -. g ---II. '_1 g i i-C Nis nice.oie toa e.s e - N s !Ej _..._. 1, - ] r.... j r I j n _p . p l., ... _I -.=.q - 4 m, e -- j p, I, l.i 1 l..i,. t,.., r ii. i i i 1'*l ., ':,.i.' ' ; 'I EJ.. -. T - ~1 # ' i ~ I TI l- 'l .. ! l ' ' *d

• }H

,j [*] ! {. I ,g r" "1 " l7 - - WFTTTI n *:! : .-- ~..., _",_ ~_ .. gisiii { h t j l~ OF l~

a.,.,p*-._

. :.&..WZ..;_. _ ~ ' ' ~ h seeU?DO*N #CD Positions t; f cYNfa$.8 l N:s it e ave -'Is ! L" IUI5 nia TOs f a e CONTE 25 j s

s v===

- i-e .- / + 4 . ] f.-* t C RJ = ,!. - 2ap_ es v i 1 .l "",.*~~ l. {*] I' I I" I [-- :: { (C J(

*='=

ar== 14 ~ .] f '"I I "d g. .]h b / l. CCMPV tE IN?f t'a I n f v60ARD ? 1 1L L (" '-- l C= L'I) r gi o p h. y '\\ j_ ECD Detvf CONitOt5 '. j,, y .F. 4 EJ ':, ' 9 r-6 r :- r =.;i [ E t ~in n n 3 l ji

• ,a

- 0 l; 1.:1:1 n l- - o e I*- j F-~" LEU.J r--- -]1 h', 1 l ~ l h ~ a l r'.I.]I...j Lu J !il !( I~~ rI 1

) h l i-o li l

ll ( 1 Figu re 1-9". Candidate Reactor Control Panel Incorporating Human Engineering Design Practices 1-23 D O{

FEEDWATER CONTROL PANEL y (. 2 -). ,...q. y _ ~. - _- l _.j 1 i I I l v, 1_, .i 1 ) t w-m. a m.v y y y.. ~ m l g (_ -. l t l STdAhGENERATbR D 5 ST5dGIUERATOR C ~ $ TEAM GENERATOR A i LSTEAM GENERATOR B l., l,11, '( l l..,.., = I = 1 =r1 i l .,= r T-E-i =.i =,l l ., = rT -I ET T =. i ~ i =.I I 1: u, :ll I.,I,,.,. r~ l l ! [ l.- i +1 1 lI; l), .) ~.'. t...l

d..i j

!, (. i t.., u. l, 1 ,L, i,l: . p. 4 . !oi [ :.. j-1 U_i i i i 'i i i i t to ca ciiiitoi co LTn ! i w - w Asw =i, 3 =i.,=- y,. L,. g.7 { -( g p., g ~ _ _ _.. _y-a. .i.i g l Q. u-a : ; ct -... ~.. -h 7"I ". g;.:.! ;. 4-io w1 : i i M. jr= sammmmum _ _ a, mummmmum _g r-_ _.o m i.,m - gj

- m =

l , s. ,-,r= r. l w-L. r y + + n n p ir g g OO im m E O, g g, $$ gg gg m m. O,E.. mm mm AUXILtARY FEEDWATER PUMPS JAIN FEEDWATER PUMPS m, c.-___-_ =m l -m s s e gj gj ~ gj= ~ @ ~ ~ ..~ ' " ~ - gj =.3. =,

l1 Iz.1,

til 1 Vl >lg. ei =,r' e = t 'J -~ 1. =' n r l ,,t ' E @ _._ _ a.__, r E 0= _ , __ td ___ il 'g] . e -s F [yj = _ _ m...- i' gg. [fj. ;., l-3= _ gj =-- m m =

gj = @

d, di -m=@= di E~- .s .=g(~g1-G G,g -gi:~gj = G -g -3

m

'm- =; m a i_

-~

[] 'm p:,U r g I a < (11 w:, 311 2, at:1: Figure 1-10. Feedwater Control Panel Design Based on Human Engineering Analyses and Design Principles 1-24 h Q w~, g0i0D

[ i' q' e 'r'e i jnl y n n l I h r ,4 o, t, _ -,,. _ _ = _ E CE C C 00 C 8 DG D wm __~ D D _8 D D c as a m en s m es$ s =- = b3 --DDDD c ac c o mm e s es o...- M O O G I U D lj t a es a n.sm a a e mL UU D E 5 5 -6 eOED EC: W EEE D D D .g ab. ~_.. O I G ifs e_. ee. _, e n em..e., a__...en..e er.e h h O W (U O g ~. W EA ^ M~ tE. _ _ Figure 1-11. Undifferentiated Panel Design Which Operators Later Modified by Adding Taped Lines of Demarcation The earlier survey of five p re s ent-gene ra tion control rooms (EPRI RP 501-1) revealed significant problems with existing warning systems. Briefly, anywhere f rom 400 to more than 2000 annunciator ligh ts are typically arrayed in matrices l ) running along the upper periphery of the control boards as shown in Figure 1-12. Some of the major problems with these systems are the following: e Operators are given far more informstion than they can reasonably assimilate when a major anomaly occurs. the annunciator panels have become a catch-all for a wide variety l e of qualitative indications without differentiation as to impor-tance beyond isolation of "first-out" annunciators, i s -

f N g i \\ J / \\, / s'N . ji J ot si/ A g '. y RI

l. '. 4.}

e; e - mm am ax s, smuam n,am]mmamm 1:!r o . 23 u - aa aca anmaJun jiggg73]J2 Tid]3]l M g iii.c:;

:!!a;5nmmo.xs adm&mc4cccci1== A m

wnuanc3c =hswww.im h@'L9%Ca y ~cmu m ~ g

w A :n

~ = w ~4 ~ w A.i.A 8 .g-l* d, _. -.0L ~.28. 4 *. '.4.. wCL'.; % Figure 1-12. A horizontal band of indicator lights above the control boards plua associated auditory cues constitutes the warning system. e Annunciator legends are not sized to be read reliably from the opera tor's normal station. Specific annunciators are not always located above or in clear e proximity to their associated quantitative displays and controls on the control board panels below the annunciator matrices. o Opera tors are plagued by false or nuisance alarms which tend to induce the " cry wolf" phenomenon. [ In view of the special imp ortance of the warning system, it was isolated for se para te considera tion in the pre sent study.

First, general human f ac tors l

l 1

c. n 0))

hk 1-26 1

requirements for warning sy s t ems were reviewed, and the following conclusions drawn: (1) alerting signals mu st a t trac t the operator'c attention regardle ss of i his position in ;he control room, including backrack areas, (2) while comanding the operator's attention, alerting signals should not be so startling or disrup-tive that on-going ac tivities are compromised, and (3) it is advisable to give the operator some indication of the severity of an annunciated problem so that he can assign proper re sponse priorities. Once general operational guideline s were developed, candidate visual and auditory warning approaches were explored. Visual Warning Approaches Seven candidate visual warning approaches were examined and are briefly described as follows: e Integration of Warning Signals Into Primary Control Panels. "ather than isolating all qualitative warning displays in to a separate annunciator panel, it is possible to integrate such qualitative displays with associated qualitative read-outs and controls. This requires that such warning displays be highly d istinc t ive, such as flashing red watning lights incorpora ted in a well-designed " green board" panel layout. e Master Warning Displays. To reduce the visual scan time associ-ated with the firs t approach, a master or sumary alarm indica-tion could be a ssigned ra each major system or corresponding board segment. Each sumary indication, which would flash on and off when ac tiva ted, could be placed above the panel segment of direc t re levance (see Figure 1-13), or the sumary annunciators could be integrated into one centrally located annunciator panel shaped to provide geographic correspondence with the control board layout as shown in Figure 1-14. e Redundant Warning Information. One method for providing an over-view of plant status via an annunciator band of qualitative indi-cators and also satisfying the requirement of func tionally group-ing qualitative and quantitative information is to provide redundancy of information on the upper and lower areas of control b oard s. his approach is already being followed to some extent in some plants. e Prioritized Annunciator Displays. Rather than assigning all qualitative indica tions to the traditional annunciator panel loca tion, a review of such indications reveals that a fraction M those usually placed within annunciator matrices can be left there as sumary indications while the majority can be integrated di rectly into the Control Board panels below. his prioritiza-tion re flec ts the need to be able to oversee, at a glance, plant and process status while relegating lesser or more detailed indi-cations to the subpane ls where system diagnosis and control can be e f f ec ted. The feedwater annunciator panel shown in Figure 1-10 represents this approach. 1-27

n== nm i mm em i 6 :rmm a p,a j g m., cu::.c:.l

m:ames en :s cs i

xN \\ /N- 'A \\ / / i \\ \\ N //. / l l l \\ \\ \\ \\' // / l l \\ \\ \\ \\ // / llI \\\\\\ l l / / y / N \\ Figure 1-13. Master Lfarning Displays That Double as Major Panel Labels e Correlated Annunciator Panel and Control Board Arrangements. Present day annunciator panels give no clue as to the relation-ship of a given annunciator light to the location if its rela ted quantita tive displays below. The operator learns such associ-ations through experience. However, by configuring the annunci-ator panel so that its arrangement is corre lated with the arrangement of the subpanels below, using the same logic as was illustrated in Figure 1-14, the transition from annunciator to the cont'.o1 boards is le ss likely to produce errors of misassoci-ations s nd will produce a reduction in visual scan time. As in the..eceding parag ra ph, only summary indications would be included. e Mimic Annunciator Panel Arrangements. Operators have indicated a strong preference for mimic panel arrangements. Generally, such arrangements require more panel space than desirable and do not offer clear advantages over a well-designed panel based on prin-ciples of - clearly demarcated func tiona l grouping of panel ele- ' ments. However, there may be an application for mimic arrange-ments of annunciator panels (see Figure 1-15). Such panels would provide some insight into the relationship of a given malfunction indication to the system or subsystem in which the problem occurs and should, thereby, aid diagnosis and control of the problem. 1-28 h -~

fN /s ~- N N,N ,Q \\[,; en p'l ' i >R / i--W.1 t__u ,/' .':=2_._. ._gg ~ t-- " ._.._____..__s s i. Figure 1-14 Suenary master waming display located in a central board area and arranged to mimic the location of panels on the control boards by major system. E [

- d --- - ~~';~

_i k

• 'A

. h I" ll b k- .$Li. kl b $$ i"""r5 i d- .k4 1gu;

t c Jy. -c..._.

J-- ., C .~ ___I L - _. :p, r-+.-., Q i w y 7 .c c.c': ; 6 O %Q L,,L. R IL 3 L,-c g m ---- ma .2 ....-Y-l l Y . _ _ - - ~ ~ ^. .-: y5.,. st:$ ,l X;k$Ut 'i'[ ' '.','TP,t-Wf,' 11b@.i$N2?P '5';a #~ D--I(( 77. h s a m=== m======== = mesa aino emi mm:a m

q=:m=c=m== ext xmm.,,,c,,o..,m, g --- Q.

j

'; ;,p

' hr t--: - gr- = g. Figu re 1-15. Mimic Annuncia tor Panel Arrangements n.]lT)Q 1-29 k,,,, q? u, A -,{ M D 0,

e Hierarchical Annunciators Panels. Another variation of the pri-oritized annunciator concept de scribed above is to arrange the annuncia tors in a hierarchical or py ramidal order from the most general to the most specific. At the apex of the py ramid we might have FEEDWATER SYSTEM. The next level might include indi-vidual sumary STEAM CENERATOR ligh ts, followed by a third tier of STEAM CENERATOR FLOW, LEVEL, and STEAM alarms f or each steam generator, etc. A hierarchical arrangement based en importance is also possible. Such an arrangement might be use M in allow-ing the operator to address the more impor tant problem when con-f ronted with aimultaneous alarms. Auditory Warning Signals Visual warning systems may suffice when an operator is confined to a fixed station and his control panels are always in view. Such is certainly not the case in a nuclear power plant control room where the board s are relatively large and the opera tor must constantly move around, sometimes outside the primary control sphere. Consequently, visual alerts, which are highly directional, must be sup-i plemented with auditory cues which are omni-directional, that is, capable of ac-quiring the operator's attention regardless of his location within the control While all the control rooms visited by the study team use auditory cues in room. association with visual annunciator systems, the information pre sent ly conveyed via the auditory channel is generally limited to a distinctive sound, directing the operator's attention to the boards. This study examined a variety of possible auditory signals that can be used in c onjunc tion with the visual warning candidates outlined above. The aim was to expand the information content of the audit?ry warning system so that board scan time could be reduced, correspondingly reducing the time required to identify the nature of the alarm. The auditory candidates considered were as follows: General Auditory Alert. Generally, one distinctive sound can be e used simply to direc t the operator's visual attention to the b oard s. A variation o' this approach, observed at one plant, is to have the warning a,;nal emanate from only one of a number of speakers, the one located in association with the affected annun-ciator matrix, Two-Level Auditory Alert. A two-tone auditory alert system could e be devised to differentiate between urgent warnings and less significant cautions or advisory information. This two-level sound code would allow the opera tor to determine whether he should - stop what he is doing at the moment of the alert, or I continue what may be a more critical task until possible to l 1 eave. This syst.3 could also be correlated with color coded annuncia tor displaj;, e.g., red for major warnings, and amber for cau tions. 1-30

• Coded Non-Verbal Signa ls.

Six to ten distinctive sounds could be employed for c oding purposes. For example, warnings associated with the various major plant systems could be coded auditorily so that the ope ra tor would immediately direct h is eyes to the a pp ro-priate sec tion of the board s. Alternatively, distinctive sounds could be associated with major emergencies, such as MAIN STEAM TUBE RUPIt,R E, assuming that the warning system logic (a disturbance analysis sy stem) was capable of signalling a major disturbance direc tly. Since such emergencies would be so infrequent, period ic rehearsals of code meanings would be necessary. e Verbal Warning Systems. Considering that pre sent day control rooms can have from 400 to 2000 visual annunciations, coded auditory signals may not be the best supplement to a visual warning system. Verbal warning approaches, initially developed for airc raf t appli-1 cations, may hold grea ter promise. Such warning systems could p res ent taped or synthetic speech messages over a control room speaker. Such messages would be prioritized so that in the case of simultaneous warnings the most important would be delivered first. Preferred Audio-Visual Candidates It is apparent from the foregoing that numerous alternative combinations of audio and visual warning approaches are possible. Research is insufficient to allow the selec tion of the one best audio-visual warning system. The most promising audio-visual candidates were selected by applying the following criteria: e The operator should be alerted to the onset of a cautionary trend, sy stem ma l func tion, unsafe condition, or proce ss distur-bance in the shortest possible time, e The operator should be provided the means to c orrela te qualita-tive alerting information with associated quantitative displays, in order to allow an accurate determination, in the shortest pos-sible time, of the na ture and cause of changes in system or proce ss status e The operator should be able to identify and associate available control options with specific disturbances quickly and accurately so that app ropriate control actions can be effected manually or the initiation of au tomatic sy stem re sponse can be easily veri fi ed. e The operator should be able to identify the gravity of any alert-ing signal f rom any position in the control room so that he.an determine whether to interrupt or continue on going tasks. e The operator, watch f oreman, and other intere sted parties who frequent the control room should be able to make summary judg-ments regarding plant status by means of the annuncia tor-varning system, without having to make a detailed scrutiny of al'. or most discrete control panel elements. Using these evaluation criteria, the following audio-visual combinations appear most promising: e Correlated -annunciator panel and control board arrangements coupled with a verbal warning system 1-31

~ _ _. k e- . Correlated ' annu nc is to r. panel and control. board arrangements coupled with coded.non-verbal auditory signals Mimic annu'nciator. panels coupled with a verbal warning system e Mimic annunciator panels coupled wi th eoded non-verbal auditory signals These pre ferred cand ida te s were chosen because of operational efficiency, with insufficient consideration of design complexity factors. These judgmental evalu-ations should be substantiated by empirically derived mea su re s of the re lative e f fec t ivene m-of alternative audio-visual warning approaches. For example, there is some concern that operators might "bject to the chattering of a verbal warning system if the alarm rate were excessive. .1 CONTROL BOARD DESIGN EVALUATIONS { An essential step in the human fac tors approach to control board design is design evaluation or verification. Analytic approaches. no matter how systematic or thorough, can overlook or fail to anticipate operational realities or deep-seated opera tor p re f e rence s. There is always the concern that long established ope ra- ' tional response. patterns may lead to a negative transfer of training when the opera tor is confronted with new board configurations that depart from traditional j. designs. It is, therefore, important to interface with operatione personnel, not only when e stab lishing p re liminary design requi remen t s, 'out also at periodic intervals during the. design process. The use of three-dimensional mockups of candidate j design concepts are an indispensible aid in verifying the adequacy of man-machine in te r face s. Such mockups permit static simulations or walk-throughs of + operational sequences, both normal and o ff-normal. These so-called static simulations allow evaluations of anthropometric fac tors, panel layout efficiency, ( sufficiency of. displayed information, and adequacy of control options, among a l host of other v riables. In fac t, a human f ac tor design checklist (see Figure 1-16) is advisable to ensu re that no significant f ac tors are overl ook ed. Such ' checklists ? should be used, not only by human fac tors specialists on the design team, but more importantly by the customer to ensure compliance with human factors L standards. I.- L 1-32 i -3 =

HlHAN FACTORS ENGINEERING DESIGN CHECKLIST FACILITY CONSOLE (S)/ PANEL (S) I DEVICE (S) e a z 42 5.2.2.1.16 Lame Removal, Method. Where possible, have provisions been made for lamp removal f rom the f ront of the display panel without the use of tools, or by some other equally rapid and convenient means? NOTES: 43 5.2.2.1.17 Lamp Removal, Safety. Have display circuits been designed so that bulbs may he removed and replaced while power is applied without causing failure of indicator circuit components or imposing personnel safety hazards? NOTES: 44 5.2.2.1.18 Indicatig covers. Are leFend screen or indicator covers designed to prevent ina dver t ent interchange? NOTES: 45 5.2.2.1.19 Color Coding. With the exception of aircrew station signals which shall conform to MIL-STD-411, and Air Force training equipme! which shall conform to MIL-T-27474, do transilluminated incandescent disptays conform with the following color coding scheme, in accordance with Type I - Aviation colors of MIL-C-25050?: (a) Is RED used to alert an operator that the system or any portion of the system is inoperative? (b) Is FLASHING RED used only to denote emergency conditions which require operator action to be taken without undue delay, to avert impeding personnel injury, equipment damage, or both? (c) Is YELLOW or AMBER used to advise an operator that a condition exists which is marginal, or to alert the operator to situations where caution, recheck, or unexpected delay is necessary? (d) Is CREEN used to indicate that the monitored equipment is in tolerance or a condition is satisfactory and that it is all right to proceed ? (e) Is WHITE used to indicate system conditions that do not have "right" or " wrong" implications, such as alternative functions or transitory conditions provided such indication does not imply success or failure of operations? i (f) Is BLUE used for an advisory light, and avoided wherever possible? NOTES: l Figure 1-16. Sample page from a military human fac tors design evaluation checklist. 1-33

The pre sent s'tudy provided for two forms of design reviews or evaluations: the first with a group of operationally oriented trainers at the Westinghouse Opera tor Training Center, Zion. Illinois, and the second with a sample of 25 control board de signers d is tribu ted ac ross the major Nuclear Steam Supply System (NSSS) and Architec t-Engineering ( A-E) fi rms. The operational review took place when the con-trol panel designs presented in the preceding sections were at a preliminary stage of development. The reviews by board designers were scheduled subsequent to refinements made to the panels as a result of the operational critique. Operational Review The "first-cu t" at the three major panel layouts developed was based on an analysis of control-display requirements associated with start-up, load change, and shut-down operations. Analyses of these three modes served as a good beginning for study purposes but fell far short of the analytic foundation required for an actual design and development program. To more fully explore the range of operator activities, a week was spent with four trainers having extensive operational b ackground on Westinghouse systems. The trainers first reviewed the panel layouts in terms of the opera tional modes on which the analyses we re p redica ted. Subsequently, the panels we re reviewed in terms of a series of standard major emergency sequences used in the training pro-g rams at the Zion training center: main steam line b reak, loss of a feedwa ter pump, a dropped rod, and condenser vacuum problems. The number of emergency opera-tional scenarios reviewed had to be constrained by the time and budget limitations of'the study. The study team felt that a fairly comprehensive evaluation of design c oncep ts was obtained from these walk-th rough s. Had this been an actual board development e ff ort, however, an attempt would have been made to walk-through all or most normal and off-normal operational sequences. The setting for these operational reviews proved very favorable. The mockups to be evaluated were placed in a special training room that included a half-scale mockup of the Zion plant control room. When some questions arose as to current opera-tional or design practices, a ready comparison to the Zion control room design was ava ilable. Also, when the dynamic training simulator was not in use for training purposes, the study team was invited to witness the pattern of indications and con-trol manipulations associated with the selected emergency operations in a realistic real-time mode. i l 1-34 l l-l

e e r. N6MN hwmm mum.SWWW 6 N "*NW i g t i. LL 6'. t i i s . l.. k' i. L. J LJ Lk' ; _ L. I i. L,J 7 a

c 2.I : '4

~~ 1 4 [Co 4 -- 2 4 m it b j e -,2 .wi = D9 1 -, 2 1 a n-i j si

sl l

4 13i2 : u 2 4 n h=9 li 4 e a n =' = d C 2 E 2 s w .w w, w i {g

• g

j v 2

8 j it 1 o ? 1 l. f 7 I ". a 13 l. j. 1-l - g g. 1. e y L-e n 3 L Lm. L LLL a n k t-e, I ? Q [, . [ .t e 0.- j i f h( N D i i .e l gaJ y ln l' l ' "' M ." I - 1 _ : : =.,. _( lf u _ i _ _._ ~ __L. _ J. L _ gd

d.

q g eaa r-a u g: O T, - I: J. f' C l ....:~' b ec es y { _'b

---

a nsJ 9

M o u _ 'L E v ) o e t s u a c

'=

w e.t 4 e {i IL p, c L. J I = -l b l q. i - rr-cs 2 ,t ;., l7 e a e . L = j .1

---

I n

,i, ,.j J.v.r ( g 6 (" L' - s g;, [Zn r f u e d C 6 'z , " k1 _ __._ - _...._ d i = 1 sa.* 3 ,o s e 2 ( p1 <w I , Og ( S N f [i T - ~ 1 " ~"~ "'.j I'f i 1 ~ fl l' 6 i[. ' L' l ~ g r .s g i I! t.,,,,,.i i L { L' '.- e,, n ll (m.. .n 56 e J 7 i. [L u n M ~- ^ ~ 7E I E O ' y ~ ' -- j "'" q e .L j

• ,. ~

2Ch, p h g 3 L1 _ _.. d,!! i i 2

t

} 3 _ il h r_ _:n O , < n' t-w a s i j i [ - w _ _~; ! L +- n ! -- 9 ) M=E;. - - ~, _ _,,

_ L__

ik th '~ L / I \\ k s; 39 g ' Y k 1-36 r l l

Based on these reviews, a number of changes to the initial panel designs were indi-cated. A comparison of Figures 1-17 and 1-18 provides an indication of the modifi-cations made to accormodate operator judgment and experience. The initial arrange-ment of Nuclear Instrumentation Sy s tem (NIS) and control rod position information on the veritical panel is shown in Figure 1-17. This arrangment was based on the opera tional anayises that p receded the panel design effort. During the walk-through of start-up operations, the test operators found this arrangement to be awkward. When moving control rods, the opera tors initially check the rod position in formation to verify movement, and subsequently check the NIS displays. To lro-mote a more natural le f t-to-right p rog re ssion, it became apparent that the rod positional information should be placed to the left and the NIS information to the right as shown in Figure 1-18. The operationally oriented trainers who reviewed the proposed designs appeared totally sympathetic to the aims of the study team in introducing human f actors con-siderations in panel design. It was their general consensus that improved func-tional groupings of panel elements, enhanced labe ling, and the simplified warning system proposed would ease the task of the trainer and tend to reduce operational errors. Design Engineering Review Human factors specialists typically make their contributions to equipment design in a design team setting. Day-to-day interactions with other designers, each with a special f ocu s, allows re solution of numerous trade-off decisions typical of most design and development e ff ort s. The p re s ent study lacked such constant inter-actions with other design specialists, periodic reviews with management personnel, or expressions of client p re fe rence s. To partially compensate for the absence of these crucial tests of design approaches, visits were made to the major control room design organizations for critiques. The 25 designers who participated in these reviews were invited to coment on such design f actors as (1) compliance with seismic and separation criteria, (2) produc-ibility of the panel designs, (3) operational charac teris tics of the panels, and (4) the value and feasibility of incorporating human f actors engineering principles into panel designs. The designers were helpful in raising concerns over instances whe re separation of components was inadequate or where seismic criteria were only marginally satisfied. While recomended design features such as " green board" logic coding of indicato-ligh ts we re perceived as introducing added design com-plexity and costs, all of the human fac tors recomendations were felt to be both 1-35

• .q l

J. o3 l-l.C = 2 i!. ,,t._ ~ ' !.nigl r, E= 7. r. 1

",E F.

7 . 3 ~. 7 I =- J. ,l j J 1w -S IFpj' 5 la ~ . f l N j nl l I S icT 1* 0 l: I 43 N ~ { E R E N W

f_

b O sr P o R n-- - '. ~_. l O. W l t E ,, 7 W a ( z- ..I c .f .Il:!; ls 1 r l.,;- i O ~_. . l P n'~,.", l d ,t [._ d .._ r. r h n T ;. fl l i j . a ~>. _r. l R .l l ,1-b-n r . f f o r p a i f x;1tlil. I z t .n: I l l 7 ~ i l s .i s( op 5 >y J do p, - r j ;- - I-il, l l d n n I l a 1 5 I I S S = I N R E l 1 T R l E E e l m l. D l l M h .l R b a O t 1 1 A I C l 1 ~ f o E P R 7,1.A I n L l 1 S' t O a N I - N l l R e. m w I l mw T l l ee O gi C l 1 - nv ~ l 1 ae r r l l r a o - l.,- I [ al a g d n .[ v eo I f t f [ ii t( .w_ i a d r .~ oe Mp o .e 8h S l }I l I l l j l .l l jjg j 1 t c c c c 0-c u cT" u " s e c N. m m o n. ~ m 4, m 1 n e c 0 a o t i m 0 c m m O - ~ s o i, O l W'Fl4 s s e 3 e I + w v + T I 4 + w s i l l l l l rd ue S 1 l l l gs .j. .j. i a P a+ 1 g Fb E l e a l l . r l, u i D 0 0 m n T-n _ O ,0 n m u O 0, -_.,u O- ~ R r., l ,j' R l0 r. ,u, c. r. a 1+ W- ,{L + l ,f L l O u~ l

o. l.0 l, o l

j-g ,o U O 7 ~ ;0 a-u + R n i0 v T .u 1 me m 1 r. l r. !0 7 - N

0

!O s s O l r.

t r

l C I

j-

!{' f( . {- } ],b l1sl j j.jj { ]._] ] u _0 s l .n n, d d _c c c e e c 0 c o a n o 0 e 0 m 0 m m w.,. p o s i m, 1 m m m ~ t m m m, 3,. + v S w 4 4 q_ g l i j 1 l j l j l l l I l 5 e d ; @g. p,- a a ) qy:GO.2C )R. 0 3,u

1. c

@cCs

g.-

i r 5a -iw" - c c l I (

well within the state of the art and successfully applied in other industries. On the whole, the response of designers, as was the case with the trainers, was essen-tially and uniformly positive. One designer noted with some envy in his voice that the study team was allowed to create human engineered designs due to the l ack of changes introduced by the client and the absence of last-minute additions made by functional system designers af ter the layout was supposedly " frozen." ADVANCED COMPUTER-BASED CRT APPROACHES There is a marked trend towards advanced computer-based CRT control rooms. As one advanced system designer observed, "This is the last m jor indus try to cove in the direc tion of advanced control-display techniques!" Each of the major NSSS vendor organizations is developing advanced control rooms, with some on the drawing boards, others in mockup.or prototype form, and still others being assembled and prepared for operation within a year or two. To obtain an overview of developments and trends in future control room design, a ' tour was made of the primary advanced control room design organizations. Discus-sions with design engineers and design reviews permitted the study team to delin-este the key issues involving human f actors concerns discussed in this section. General Characteristics of Advanced CRT Approaches Advanced control room concepts are defined as those designs that incorporate CRTs as the primary display interface instead of conventional hardwired indicators and recorders, thus allowing for much more flexibility in the presentation of informa-tion to the opera tor. This increased flexibility provides the grea te s t inherent potential f or improved operations. At the same time, if the man-maci..L interface is not human engineered, this flexibility can create, and in some cases has created the setting for a degraded operator-control console interf ace. In addition to this increased flexibility of the man-machine interfaces in an advanced con trol r oom, the mode of presentation is different from that o f a c on-ventional control room where information is presented in parallel. With dedicated i in s trumenta tion, all inf ormation is continuously available to the operators, and based upon their training and experience, they extract specific information and data depending on the situation. In a CRT-based display system, the information is pre sented primarily in a sequential manner. The designer prede te rmine s what spe-cific group of data to present on a given display page, and the operators take spe-cific ac tions to retrieve the display page of intere st. The ease with which the op e ra t or can re trieve pertinent data in the advanced control room depends to a 1-38

large extent on the deg ree to which the designer (1) considered the operational interface and accessing s t ra te gy when structuring the information, and (2) organ-ized it in terms of display pages. The information structure and accessing scheme should be developed primarily to aid ope rational use, rather than to minimize design or so f tware requirements. The human fac tors engineering effort required to ensure an operationally efficient interf ace is more extensive f or the advanced control room. It is easier to compen-sate for a poorly human-engineered conventional control room through extra training and s ta f fing e ff orts than it will be for an advanced system with a cumbersome acces'ing strategy or excessively high-density displays. Analytic Requirements The analytic foundation for the advanced control room is necessarily more extensive than that f or a conventional control room. Whe reas the designer of a conventional control room has to decide only once what information to include on the panel, in what form, and where, the advanced control room designer addresses these, issues over and over for a multitude of display pages. There fore, the analyses must be conduc ted at a much more detailed task level for the advanced control room. Information Accessing Schemes j One of the greate st challenges confronting designers of advanced control rooms is the development of schemes to enable the ope ra tor to access required information e ff ec tively. Advanced CRT displays provide a narrow window into the system, pre-senting at any given time no more than 5 to 10 percent of the total available in formation. Ideally, it should be as easy and natural for operators to extract information from the computer as it is for them to scan the conventional control room to obtain pertinent information. During a major transient, it is extremely imp ortant to provide the operator with means to focus on diagnosis of the problem and identification of appropriate correc tive action. At such times, the operator should not be p reoccupied with the intricacies of the display system logic to retrieve desired information. Two accessing schemes were examined, both of which are being developed by NSSS sup-pliers. The fi rst organizes the inf ormation by system and then by the level of detail within a system. The second technique also is organized by system, but the subgrouping is based upon the plant operating s ta te and the information set required by the operator for each particular mode. 1-39

~_ .= -Althcuch an organization b1 sed - upon the information re q uiremen t s of a particular state of fers the opportunity for a very smooth and e f ficient interface, it is only as goad as the operational analyses that determined the information requirements j f or each state. If t ime a nd e f f ort are not invested in operational analyses early in display development, the potential for a degraded Interface is high. 2 k Organizing by information detail leaves the operator with the task of searching out 1 required information from the indexing structure. However, as the operator becomes ~ inc rea si ngly familiar with - this structure, he will probably be able to find the desired information quickly in the same way that he can find a particular control or indicator on a massive conventional control board. In all likelihood, some com-hination of the two information-accessing approaches will be most effective. Response time is an important considera tion in developing an information accessing system. If an operator requests a particular display, it should be on the screen within 2 to 3 seconds. - If the system does not respond within one second, an "in-progress" message should be provided to the operator. I 'Interfacine Hardware Having developed an in fore.at ion structure and accessing scheme. the actual inter-f acing hardware requirements can be addressed. Once an operator has determined the display page desired, this selection information must be input to the system. A a communication s tra tegy and operational plan encompassing the entire control room I with its multi-CRTs should be developed. Some of the items to consider include the following: (1) Should there be a dedicated interface device assigned to each CRT or - is one device for every two or three CRTs sufficient? (2) Should there be a i master interface device from which all CRTs can be controlled? An swers to such questiona regarding the overall operational interfaces will influence the selection of the actual interf ace devices. Several alternative hardwa re options reviewed . include the following: alpha-numeric keyboards, light pens, cursor controls, joy-l sticks, acous6ic pens, and trackballs. Information coding .With 'a -system as comple:: a nuclear power plant and its associated instrumenta-as tion, the coding of information to aid operator processing and interpreting is .essentialJ The best format should be developed for presenting the information to the operator prior _-to including the coding fea tu res ; coding should not be expected l to " crutch a poorly formatted display, but should enhance an otherwise acceptable display format. The designer should optimize use of all c oding techniques (e.g., 7 1-40 m n. ~~

intensity, reverse video, symbology, line te xtu re s, size) and not rely exclusively on color, which is the most f requently used coding dimension with the CRT display s ys t e ms. In f ac t, because most color CRT systems furnish eight colors, it is fre-quently overu=ed and may well result in degraded, rather than improved, ope ra ti on. Color should only be used where a func tional need exists to differentiate two i tems. Frequently a designer will group similar things (examples a re labels, units, system titles, and components) and assign a different color to each one, even though in actual operations the re is no functional requirement for an operator j to discriminate among these various items. The use of color in this way may result in a more aesthetically pleasing display with all things c1carly categorized, but the color is irrevelant to actual operations, complicates the operator's task, and may in f act degrade operations. Figure 1-19 illustrates a preliminary display for-mat where color has not been used to its best advantage. Figure 1-20 shows how the CRT format might be enhanced through more effective use of color coding. Color is a very strong coding dimension and is best re served for items of greatest fune-tional importance, such as dynamic information and alarm conditions. Other coding dimensions should be incorporated for the more routine differentiations in the display. Interactive Techniques Coding techniques are not the only means available to aid operator processing and interpretation of complex CRT displays. Inte rac tive capabilities can be incorpo-rated into the system design, enabling operators to modify and amplify displays to reduce clutter. Experienced opera tors will only infrequently need to refer to parameter labels and engineering units; the re fore, this information could be sup-p re ss ed on the display page unle ss reque s ted. Limits could be provided inter-ac tively at the operator's request, but would be suppressed at other times to reduce clutter in the display. Crid-lines and scales on graphical displays could be provided on reque st only. On trend or graphic displays, an operator could interactively request a digital display on the coordinate of some specific point on a cu rve. Interactive trend graph s could be provided when an operator suspects a developing problem. The operator could input the desired time period for the trend and specify other variables for simultaneous trending if he suspects there is a relationship between them and wishes to compare them. Although interactive fea-tures require extra efforts for developing the supporting data structures and soft-wa re, they will provide a smoother, less frustrating interf ace for the life of the system. f. 1-41

l

i.GidQDiQ

Jvay nF E

nqqg@+pftf '}t'M!O%k&-{f).,,.M,f Eg~ p l N '! Q,?.QM W.6fi',';,. , P: 'mh h FSg5d ?' SN;p? Ai jg.t:'. f '.?ir?: H 'esi@h Nikhs 4 %A; w:. gj;W.% 'lh b(th$d M0AN,A'M 4 4 y.. Q7NY.b' gy. - p. MN4 d w e i a % &.s nM9meown s;[7- [g '[.s;.S.k.! :k. $hhk,, b+ d. ..~ n. f,j;f (& ~< .2' .?C,

• f h

(y- ~ y >QfL j~ n: z l IS -.. *, _p.. a' x @t gy-O.: j i i c. u:k _ =

4 l

2 -grirc, s, h7 ) !<fi l ~ rp! 8 y j hl' l x ) i w I l' i,, s, fng LL;,;,M Q ~ Figure 1-19. System components are assigned the most conspicuous color. Yellow should have been used to highlight note important infermation. I ^ p, -. ~ for 5 ,..,,;q

y...

"p .t 1 ,r-4 4. @.,i s-n= 3 eg 4

• 1PU. -

J ',e w. s. ' ;5 3.,._ j' ..f 'wg'4 .. Q C.,, g a ~ ..: w .llE y 'Y t .,.TDr e m w .~ 3, l l =n,as a n.a. i y,. k:S t. . ~. r, scr-tat ; a.14 Mos 3 ) ,, ),. - f , ? et rvsttw ,./ -

?

eCP-W - . G L s.,'+ *, ,, s. .t. 3 5 <; D3M /T I , gg p**sse.g-- .e

p y-1 Figu re 1-20.

Sy stem components shown in Figu re 1-14 have been coded dark blue. Yellr.;w is reserved for more important inf-rm tien. m j 1-42 .u .n_ut_ 1 i e -

Alarms 0% of the ma jor unsolved isu es - 'n f ron t i n ~, the design?r of an adv r -d control r&m is *he p re s ent a t i cn of air : i n f orma t i o's ta s!crt the ope ra * *r a s y n e-anomaly er pend ing p roblen. Int = e ra tinc ala rm information into rerular CRT display pages by changing the color of the d ispl ay parameter a nd blinking the value to attrac t the operator's attention to the change is fairly straight-forward. While this can e f f ec t ive ly handle the situations whe re a handful of alarm c ond itions occur, such a s t ra te gy will soon become overburdened when con fronted with the mass of alarms generated almost simultaneously during a major casualty. Although CRT-based alarm displays can present a lot of information in a small space, care must be taken to develop the appropria te mix of dedicated and CRT-based alarm indica-tions. The use of CRT-based alarming may not eliminate the need for dedicated annunciators in the advanced control room. Integration of Controls and Displays As with conventional control rooms, the desi gne r is confronted with the problem of func t ional integration of controls and displays. With CRTs as the prima ry source of display in format ion, it is impos s ible to locate all associated controls adjacent to the a f f ec ted parameter d isplays. Other schemes for achieving readily apparent control and display re la t ion s h ip s, without the bene fit of actual geographic group-ing, must be devised. Two control arrangements we re examined: mimic or flow lay-outs and func tional grouping arrangements, both helping the opera tor to quickly and accurately locate a specific control of interest and associate it with the related CRT display A computer-based display system can further assist the operator in associating a control action with the a f fec ted parametric display by highlighting that display on the CRT screen when an operator inputs a change in valve position or switch status. Thus, by systematically arranging the controls and by highlight-ing the affected parameter, the impact of the physical separation of controls and displays can be min imiz ed. Also, some approaches allow inte rac tive control direc tly on the screen, as with light pens. Procedural Integration In the advanced multi-CRT control room, it is possible to display procedural infor-mation on a CRT, allowing operators in different locations to access the same pro-cedu re. During an emergency, the procedure could be displayed automatically, or a functional keyboard could be p rovided so that the emergency ope ra ti ng p rocedu re s are one keystroke away. A sec tion of each display page could also be usej co M'M @b5)f'[9Mj P Iii NMb I o

pre sent relevant procedu ra l information direc tly to the operator; however, one designer indica ted that there were legal liability reasons p reventing the implementation of this approach by the vendor. i Environmental Considerations There are many factors to consider when designing an integrated, advanced control room. Two of these that can significantly impact operability are viewing distance and viewing angle for CRTs. The distance from which an operator can read a CRT is a function of the CRT size, ambient illumination, c on t ra s t, and specified character size and configuration. A control room should be designed with maximum and minimum viewing distances and line of sight engles to the display surf ace. Glare is another problem to, consider when designing both the console configuration and ambient illumination system for an advanced control room. Although the re are some surface measures that can reduce glare from the CRT surface, there is no sub-stitute for an integrated approach to control room illumi. nation design. Clare min-i'ization should be a design goal when determining the control room illumination m source and the positions of the CRT display units within the control board. Display System Parameters In developing the specification for an advanced CRT control room, there are many display system parameters affecting the interf ace with the operator. From a human f ac tors standpoint, it is important that these parameters be defined with consider-l ation for the operational use of the system and the limitations and capabilities of the human operator. Character attributes that affect operability include character height, re so lu tion, viewing angles, strokewidth, aspect ra t i o, case, spacing, and charac ter matrix con figura tion. Hardware fea ture s that impact operability include ref resh rate, misregistration, response time, and contrast ratio. The parameters in Tabis 5 re pre sent the recomended values based on available research data for a human engineered CRT based display system. Shown are the most t desirable values for each parameter in terms of the man-machine inte r face. In the t i process of actual display design, trade-offs will be required which may force com-promis e s. The value of these guidelines is that compromises become visible and the relative degradations introduced by alternative compromises can be evaluated. E l l l 1-44

Table 1-5 RECOMMENDED VALUES FOR SELECTED DISPLAY SYSTEM PARAMETERS Parameter Rec ouraenda tion Character Height 21 min of visual are for color (1/6 in, at 28 in. viewing distance) min.: 50 minutes maximum 30 min, for off-axis viewing (1/4 in. at 28 in. viewing distance) Resolution Alphanumeries 9 to 10 lines minimum 14 lines for off-axis viewing Symbolic 17 lines minimum 25 lines for off-axis viewing Strokewidth 1:10 maximum Narrower lines okay because of irradiation on CRT Aspect Ratio 5:7 to 2:3 minimum 1:1 for off-axis viewing Character Case Capital Letters Spacing 75% Intercharacter and Interline Chara:ter Matrix System Dependent (picture element dimensions determine desirable matrix configuration) Refresh Rate 60 Hertz minimum Hisregistration 50% maximum Response Time 2 to 3 seconds maximum (operator request / 1 second desirable action) Contrast Ratio 10:1 minimum (variable operator control) Display Formatting Little hard research exists regarding the most effective way to format information on a CRT sc reen. We know in general what informati an an operator needs to be able to access, bu t we have little empirical or operational data to determine whether the information is best displayed on mimic diagrams, in digital form, on analog bar charts, on trend diagrams, or in other formats. There are, however, some general principles and guidelines for display f orma tting that should be observed when arranging information for an operator to interpret: e The density of a display page should be managed so that informa-tion is not too tightly packed on the page. Empirical evidence shows that an operator will scan the upper right quadrant of a CRT display signific&ntly more often than the other quadrants. The upper le f t quadrant is the next most frequently scanned 1-45

q uad ra n t, followed by the lower lef t and lower right. There fore, the ' designer should attempt to place important information, like alarm status information, in the upper righ t hand quadrant to dec rease opera tor response time, e The app roximate effective visual field for detail is 50 cone about the focal line of sigh t. At a 28-inch viewing distance, the resulting field is a circle of 2.4 inches in diameter on the CRT face. Field size impacts label and numeric length in the format and placement of re la ted or unrelated groups of information on the screen. e Where it is impossible to provide sufficient open space between groups of information, it is recommended that boxes and lines be used to group the data into clearly defined areas on the display page. Although less e ffec tive than open space, a box around a set of data tend s to focus the operator's attention and remove some of the distractions from adjacent data and information. Every display page should have a header; every header should con-e tain the same set of information about the display, a nd the in formation should be positioned in-the same general location on the display page. The header format should be e stablished early in system development, and it should be consistently used for all display pages on both the primary and the secondary sides of the plant. e Nomenclature should be standardized early in system development and should be consistently a pplied on all display pages. A standardized list of abb reviation s should be developed and rigorously applied. e Consistent coding techniques should be used for every display page. A symbol set should be selected and used throughout. One color coding scheme should be used for every display page on both the primary and the secondary sides of the plant, and color should not be overused or riisused just because it is an available coding technique. Lack of Standardization In reviewing the advanced design direc tions being pursued by the various NSSS vendors, it is apparent that future control rooms will not be any more standardized than present generation control boards. For example, console designs incorporating CRTs run the gamut f rom sit-down to si t-s ta nd to stand-up ope ra tion. Similarly, color coding prac tice s vary from vendor to vendor. Some vendors are using the ' traditional industry red-green color coding scheme for active passive designations i of the status of valves and b reakers, as well as the status of flow in intercon-necting piping. One vendor is using symbology, rather than color, to designate j active versus passive devices and is reserving red for presenting alarm information t to the operator. One vendor uses cyan to designate dynamic, real-time data; another uses amber for this func tion. As discussed earlier, the in formation 1-46

-= a I. i i accessing schemes vary from vendor to vendor. The inte rac ti ve strategies and i devices employed f or accessina inf ormation al so vary widely. d f An obvious case can be made for standardization in terms of reduced training needs a nd the transfer of skills as ope ra t ors move from one advanced control room to another. However, perhaps an even more important concern is the lack of an empir-4 ical data base to favor one app roach versus another among the widely divergent courses being pursued. l HYBRID SYSTEMS While there is an unmistakable trcnd toward computer-based control and display i de s ign s, the re are also indications that many plants will take a middle ground between the conventional and advanced c'on t rol rooms. We have chosen the term i " hybrid sy s tems" to re f er to combinations of conventional and advanced designs. l This sec tion will explore various possible hybrid systems and some of the human f ac tors implications associated with these control room configurations. J As noted

earlier, conventional hard-wired instrumentation (meters, charts rec orde rs, counters, a nd indica tors) provides a parallel p re sentation of informa-tion in a fixed display mode.

The inforciation is continuously available to opera-tors and all those who f requent the control room. An electronic display devie2, on the other hand, pre sent s information serially to the operator in a variety of pres-entation modes or formats. The information is available on reque st and can be incorporated on more than one display page providing a dynamic set of relationships among. variable s. Hybrid control room arrangements can build on the characteristics e and strengths of both conventional and advanced electronic displays and hence have potential for providing the most effective control-room alternative in the near f u ture. Advanced Computer Capabilities That May Be Added to Conventional Control Rooms Mo st existing conventional control rooms already encompass a process computer and associated readouts: either a CRT display or a printout device or both. The com-pu ters generally supplement the hard-wired boards by, for example, assisting with complex calculations or automati-3ing of events. These capabilities could be extended in the following ways: e Dist urbance Diagnosis. 1here is a serious problem with present board designs: when a major transient of disturbance occurs, the operator is overwhelmed by a large number of visual indications l accompanied by successive auditory alerting signals, all of which 1-47 l

must be acknowledged and slienced. The re is simply too much information displayed to be readily absorbed and integrated. The additi on of advanced compu ter capability to existing control rooms may take the form of improved diagnostic techniques. Two levels of alarm handling are currently being developed for use in advanced CRT-based control rooms, and these capabilities, when available, could t e integrated into existing control rooms. e Improved Plant Monitoring. Advanced computer capabilities can be us ed to s truc tu re the presentation of information in a way that assists an operator in monitoring the plant and anticipating anomalous conditions. Plant status information can be p resented alphanumerically in digital form or in analog form as bar graphs for ope ra tor surveillance. Key parame te rs can be p resented together on one display page rather than being physically dispersed about the control room. For periodic, procedural reviews, information can be pre sented in a form that permits inrnedia te reading without requiring the operator to wander about the control room.- Thus, the flexibility of formatting and pres-entation modes with elec tronic display devices may enable an operator to perform routine monitoring ta sks more effectively. Mimic arrangements, which operators favor, can be readily incor-porated in CRT formats. e Improved Plant Control. Present control board designs sometimes separate controls and associated displays, requiring the operator to be in two places at the same time. If the control board allows for the incorporation of CRT displays at disc re te spatial intervals, required display information could be called up in the vicinity of the control being actuated. This redundancy of information would " shrink" the control room size and also aid multi-operator tasks such as startup. Human Factors Concerns and Issues The development of hyb rid arrangements, both those involving modifications to existing plants and those involving future plants, introduces some basic questions regarding the best integration of conventional and advanced control display capa-bility within one control room. How should opera tors divide their attention between advanced CRT displays and conventional boards? Should the advanced dis-plays and controls be integrated into the same console with conventional instrumen-ta tion, or should an auxiliary console be provided with the advanced capability? The re is always the possibility of conflicting information from the conventional and advanced displays, presenting the operator with the dilenna of deciding which displays to believe. i The development of a thorough operational concept is the firs t task to undertake either when adding advanced computer capability to existing control rooms or when developing a hybrid control room from the outset. During normal operations, will an opera tor be primarily interf acing with the conventional display, the advanced 1-48

displays, or both forms of display? Similarly, operational requirements essociated with start up, s hu t down, and plant disturbances need to be de fineJ. Some control rooms are de signed for one-man operation. With the addition of' advanced capa-bility, manning requirements may correspondingly increase depending on the manner in which the advanced control and display features are integrated into an existing control room. One app roach taken in the oil re fining indu stry has considerable appeal from a human fac tors standpoint: to incorpc-ite the advanced capability in a separate console and assign a more senior control room operator or supervisor to it while the control room operator continues to monitor the conventional displays as per normal p rac tice s. In multi-unit plants, the center de sk operator might assume responsibility for the advanced console. If the operational analysis indica tes that one ope ra tor can simultaneously handle the workload imposed by both the conventional and advanced components of the con-trol roc n, then it might be best to integrate both capabilities into one major con-trol. board. Integra tion would allow a functional grouping of conventional and advanced displays with a ssocia ted controls. Otherwise, the operator vould be required to alternate his attention between two consoles: one conventional and the other advanced. While the potential bene fits for hyb rid systems are clear, there are many unre-solved human f ac tors issues in attempting to design the most effective hybrid capa-bility. Control room simulator-based research is required to resolve some of the pressing design and operational issues raised. DESIGN PRACTICES SURVEY To help implementation of human factors approaches in the power industry, some u nderstanding is needed of the existing control board design process and con-straints. Accordingly, a survey was conduc ted, based on interviews with a sample of board designers. A 30-item structured interview form, requiring about two hours to adminis ter, was developed with questions spanning a variety of design issues ranging from control room dimensions and control board configuration, to the design review p roce ss. The questions were designed to address $g rajor human fac tors de ficiencies noted in the earlier review of control r' ns (EPFT RP 501-1). The interview sample consisted of 20 designers, with hit / { $ em in a supervisory or lead engineer role. These de signers we re selecto trs, rix firms, with eight employed by A-E companies and the remaining 12 associated with NSSS firms. The i major findings and conclusions that emerged from this survey are presetged below. l 1-49 l l

\\ l l l Lack of Systematic C ~1cern for Human Factors Human fac tors considera tions are not applied to the determination of control room l size, location, or con figu ra tion. No systematic functions and task analyses are conduc ted as prerequisite s to establishing the manning concept, control display req ui rements, tra f fic pa t te rns, or an overall initial control room concept. Rather, the designer is f aced with a set of " givens" he must accomodate, and which a re, with the exception of advanced computer-based concepts, standard re ference control boards or the most recent projec t worked on. These precedents, likewise, a re not based on human f ac tors concerns, so the same set of problems persist from generation to generation. In the course of the detailed design process, no individual or group is dedicated to concern for the operational aspects of the b oard s. Responsibility is dif fu se and assumed to be a comon concern of all parties involved. The designers, whose e ff orts are of ten directed by " client preference" either directly, or through A-E projec t management acting as the client's agent, may lose any sense of responsi-bility for operational aspects of the design. After all, the client has to operate the boa rd s, so why not leave all such decisions to the client? One designer expressed these sentiments as follows: "I have no pride of authorship in the lay-out of the b oard s. The client has to live with them. Nobody here cares that much. The NRC is only interested in knowing whether or not a certain function is covered on the boards - either in front or back, and is it sepM ated. Besides, we won't be here when the boards become operational." In short, the operator does not have a stead fast and dedicated representative at the design table or in the design review. Lack of an Integrated Human Factors Approach to Control Room Design Various systems designers are each responsible for a segment of the overall plant design and each one impac ts the control room and control board design wnere the systems all come together for monitoring and control functions. However, the re is little cross-talk between the individuals. The fac ility design people establish the size and configuration of the control room and do not consult with the control board designers. The designers of the reactor systems do not cross-check with the turbine designers; there may be inadequate comunication between the client's engi-neering organization and the operations group; and the NSSS control board designer may never talk to the client directly but only through the A-E firm rep res enting the clients. The board de signe r is given lists of disparate instrumentation requi rements f rom a host of participants in the design process. The re is no inter-mediate systemr -inte g ra tion func tion setting comon groundrules for all subsystem 1-50 l

de si gne rs. Furthermore, in at least half of the cases, there is no full-scale mockup to serve as a design integration tool. In many military and space system developments, a human factors and industrial design team assumes the responsibility for the integration of control and display requi rement s, panel design p rac t i ce s, and operational evaluations of candidate approaches. Lack of Human Factors Design Guidel Qes The designe=rs interviewed are severely limited both in possession of human factors information and in access to human f ac tors specialists. While scattered articles on such subjec ts as anthropometrics are accumula ted, none of the contnon human engi-neering re f e rences or standards us ed in the aerospace indu s try we re in evidence. Human f ac tors guidelines tailored to the needs of the power industry are urgently required. However, for the present, designers should rely on existing guides: e MIL-STD-1472 B, Human Engineering Design Criteria for Military Systems, Equipment and Facilities, 1974. e Van Cott and Kinkad e, Human Engineering Guide to Equipment Design, 1972. McCormick, Human Factors Engineering, 1976. e e Wood son and Conove r, Human Engineering Guide for Equipment Designers, 1973. More importantly, utilities generally have no formal procedures for ensuring the adoption and implementation of human factors principles and methods in control room design. Such attention to human factors is a matter of contractual requirements in the development of military systems. The most repetitive phrase heard during the interviews was " client preference." If the client indicates a preference for human-engineered control rooms, and has the means to evaluate proposed designs, design organizations v.o follow suit as did all of the major aerospace firms when the military insisteu on human-engineered weapon systems. Overreliance on the Operator The utilities, in varying degrees, attempt to human-engineer control rooms by rely-ing on the operations department to either design the boards or revamp proposed re ference board s submitted by the contractors. While it is essential to consult the operators in the design and evaluation process, opera tors are not equipped by training or experience to design control rooms. The de signe r need s to tap the operator's experience and preference as an important input to design rather than turning over this responsibility to the operator. The design organization should acquaint the operators with the operational featu res of candidate control room ) 1 l-51 l

designs and use them in performance evaluation studies of the cand ida te s. In the p res ent survey, it was learned that the designer is generally far too remote from the operational environment; many have never set foot in an operational control room. Mockups, Sir teors. and Demonstrations More extensive use should be made of mockups and simulators because, as noted - above, they serve as important design integration aids. In addition, mockups pro-i vide an essential evaluation tool through which the utilities can review a partic-ular design for human factors concerns before any metal is bent. However, mockups were used in only 40 to 50 percent of the projects covered by our sample. Simula-tion is even rarer and only used in some instances of advanced sy s tems develop-ment. On many aerospace developments the contractor is required to demonstrate the operability of the boards against contractual obligations set by the client. Mock-ups can later serve as valuable training aids, so the cost can be justified beyond design costs. Similarly, where new and untested advanced control room concepts are being procured, dynanic simulation is often required to provide the assurance that the man-machine interface will be effective and reliable. Lack of Feedback The designers get no formal feedback from the plants regarding the adequacy of their control board designs. They may hear informally of problems that surfaced during plant start-up. However, there are no formal procedure s for accumulating user reaction to guide future design effets. For one reason, th ree or more years may elapse between the times that the design work is completed and the boards b ecome operational. Typically, a separate field service group, and not the de signe r, oversees the console through assembly, test, and start-up. By the time feedback might be available, the designer has long since moved to another project, is employed by another company, or has retired. CONCLUSIONS AND FUTURE STUDY NEEDS This study has examined the applicability of human fac tors engineering methods in resolving problems noted in an earlier study of nuclear power plant control room designs. In developing control board concepts based on huran factor principles and in exposing these candida tes to the scrutiny of operational and design personnel, it became evident that the human fac tors principles and methods developed in the f military-aerospace context are applicable and relevant to the needs and concerns of the power indu st ry. While board de signers might question the development cost or l schedule impact of some recomenda tions, overall the re was good acceptance of l 1-52 e ,-r- - - w---, o%.-- w-

3 J underlying human f ac tors principles. Opera tional personnel were even quicker to perce ive a nd endorse the p ropos ed design features aimed at improved ope ra tor-control board interfaces. In comparing human factors approaches with current board design practices, certain salient differences emerge. First, human factors specialists place greater empha-sis on systematic analyses of che man-machine inter face s to determine control and display requi rements and groupings as p rerequisi tes to design. Also, these spe-cialists have evolved a set of rules or guidelines based on labora tory experimenta-tion and field evaluations that are consistently applied in the layout of control panels. Additionally, a great deal of emphasis is placed on verification of design concepts by means of mockups and simulators using representative te st subjects. The general acceptance for human factors impact on control board design observed in this study, coupled with a Sighly re sponsive reaction to the findings of the ante-cedent study (EPRI RP501-1), impels a consideration of steps that should be taken to ensu re a more systematic c once rn for human factors in fu tu re design e f f ort s. First, and foremos t, there is an urgent need for a human fac tors design guide tailored to the needs of the power industry. A corollary need exists fora human f ac tors standard to be invoked for control room procurement purposes. The survey of current control board design practices revealed that design organizations asso-ciated with A-E and NSSS firms are extremely responsive to " client pre ference" in the development of new control room designs. However, the utilities presently pro-vide little or no formal guidance in ensuring that human factors considerations are

co account by the designer.

With the ' emergence of human f ac tors design taken # guides and standards, it can be anticipated that more of the attention of the 3,000 or so human f ac tors specialists in this country would be focussed on human factors problems in the power indu stry. At pre sent, less than a handful of such special-ists, with bona fide credentials, are participating directly in solving power industry problems. Beyond the high priority measures described above, the following research avenues have been identified as leading to a significant expinsion of the human factors data base to aid control room designers and utility decision-makers: e The p resent study has identified a variety of measures for up-grad ing existing operational control rooms both to improve the ope ra tor-c e ntrol b oard interface and to minimize the potential for human error. The feasibility and value of such mea sure s 1-53

O? should be examined in greater depth in the operational eviron-ment. Several nuclear power plant control rooms, where a corre-spond ing training simulator exists, should be reviewed in detail with the ' objective of modifying the boards systematically without interruption of power production. Human fac tors recomendations for up-grading each control room should be formulated and dis-cussed with plant operations, engineering, and management. person-nel. These modifications should first be attempted and evaluated in the control room simulators. Subsequently, specific backfit recommendations should be offered to each plant, and general reconmenda tions should be offered to plants not participating in this study. e. A review of existing control rooms has revealed a number of major de ficiencies with present annunciator warning sys tems. This study has de fined a number of possible alternatives to existing designs. The candida te. audio-visual annunciator warning approaches developed should be evaluated experimentally to ensure that they offer, substantial operational bene fits over existing operational approaches. The candidates that prove most effective from the human f ac tors standpoint should be examined in terms of design complexity and cost fac tors. e. Advanced CRT formatting and color usage approaches being devel-oped vary widely from vendor to vendor. Research is needed to determine the rela tive e f fec tivene ss of competing advanced con-trol and display concepts -and to provide human factors guidelines for future developments. Much might also be learned from a human f ac tors review of foreign approaches to advanced control room design. Significant advances are being made in Japan, Sweder, Germany, the USSR, Great Britain, Denmark, and Norway. The util-ity industry might avoid needless duplication of effort and learn from the experiences of other countries. For example, the British ran into serious problems in the advanced control room area; the operators experienced severe information re trieval problems. e Each of the major NSSS vendors is focussing on advanced computer-based control room designs as an option to the present generation hard-wired control rooms. A trend towards advanced systems exists, even though the operational benefits of the advanced sys-tems have not been demonstrated with hard evidence within the utility industry. When the first advanced control room simulator becomes available in 1980, the opportunity will be at hand for a detailed human f ac tors review of initial operational experiences 4 with advanced systems. Considera tion should also be given to extending EPRI RP 769 (Performance Measu rement System For Train-ing Simulators) to an advanced control-room simulator. The per-formance measuremmt methods being developed by EPRI RP 769 could provide comparative human performance data on conventional versus advanced systems. e The ana ly tic e ff orts conduc ted in the pre sent study revealed instances in which a particular display might profitably be added to the current repertoire of information provided to operators, or in which an interlock might have been inc luded in the design to prec lude the possibility of operator error in conducting a specific task. These and other control board design enh an cement 1-54

~. 'is-t = soo a possibilities should be pursued fu rther in a design team setting so that appropriate engineering trade-of f s. 'can be conducted to establish cost-bene fit f ac tors in evaluating individual human f ac tors pro pos al s. e The-conventiona l~ - hard-wired ' pane ls developed in the pre sent study, and based on human f ac tors methods and principles, - should j be compared experimentally with their current operational counterparts within existing control room simula tors a nd by recruiting re pre sentative operators as test subjects. Dynamic simulation would have to be supplied to the existing mockups of f eedwa te r, reac tor, and turbine generator control panels. Opera-tor perf ormance_ measures associated with existing - and proposed designs should be obtained under both normal and degraded opera-tional c onditions, such as excessive ope ra tor fatigue or the first graveyard shif t after four days off work. A review of control-display coding p rac tices in p re s ent day nuclear power plants indicates that available coding dimensions are applied inconsistently or are underused. Color c oding prac-tices, such as the green board concept, should be compared exper-imentally with c onventional:- d is play codes in terms of operator per formance mea sure s. Uniquely shape-coded controls should be developed to minimize the potential for ipsdvertent ' control activation. The complexity and feasibility of adapting coding techniques developed in space and military contexts should be assessed in design engineering terms. 4 e It was indica ted in this study that many utilities will opt for hybrid control rooms or some middle ground between advanced con-trol rooms and the dedicated control-display conventional control rooms. Hyb rid concepts raise significant human fac tors issues regarding the division of operational attention between advanced and conventional-components of the hybrid control room. Research is needed to evalua te alternative ways of integrating advanced and conventiona l component s of hybrid control rooms, such as a separate console for advanced displays versus the physical inte-gration of CRTs within conventional control boards. As prototype advanced sy stem elements are developed, alternative methods for ' integrating their capabilities in a conventional control. room can be assessed using existing control-room simulators. i I t l 1-55 4 r a n ,, -}}