ML20032B155

From kanterella
Jump to navigation Jump to search
Human Factors Acceptance Criteria for Safety Parameter Display System
ML20032B155
Person / Time
Issue date: 10/31/1981
From:
Office of Nuclear Reactor Regulation
To:
References
NUREG-0835, NUREG-0835-FC, NUREG-835, NUREG-835-FC, NUDOCS 8111040680
Download: ML20032B155 (50)
v • d • e


Text

_

NUREG-0835 Human Factors Acceptance Criteria for the Safety Parameter Display System

'ft

[ 'kt o -}e -).

Draft Report for Comment

.uC

%. th G) :

4

%,% " /

y,,_

r

.m,

U.S. Nuclear Regulatory Commission

(

Office of Nuclear Reactor Regulation

(""*c,,,

o Ps l

O NA2,0ngo822"2 9

0835 R PDR

NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:

1.

The NRC Public Document Room,1717 H Street., N.W.

Washington. DC 20555 2.

The NRC/GPO Sales Program. U.S. Nuclear Regulatory Commission, Washington, DC 20555 3.

The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Document l

Room include NRC correspondence and intemal NRC memoranda; NRC Office of Inspection and Enforce-ment bulletins, circulars, information notices, inspection and investigation notices; Licensee Event l

Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the NRC/GPO Sales Pro-gram; formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regu!afory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commis-sion, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, transactions, and codes and standards. Federaf Register notices, federal and state legislation, and congressional reports can u;ually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference pro-ceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draf t reports are available free upon written request to the Division of Technical infor-mation and Document Control, U.S. Nuclear Regulatory Commiscion, Washington, DC 20555.

l l

i NUREG-0835 i

Human Factors Acceptance Criteria for the Safety Parameter Display l

System l

Draft Report for Comment

- _ _ _ _ - _ _ _ _ - - _ - _ _ _ _ - - - _. _ - - -... __ _l Z Manuscript Completed: September 1981 Date Published: Octobjr 1981 Division of Human Factors Safety Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555 p"%,

5Yf]

s..... e l

ABSTRACT This report contains human f actors engineering design review acceptance criteria developed by the Human Factors Engineering Branch (HFEB) of the Nuclear Regulatory Commission (NRC) to use in evaluating designs of the Safety Parameter Display System (SPDS). These criteria were developed in response to the functional design criteria for the SPDS defined in NUREG-0696, Functional Criteria for Emergency Response Facilities.

The purpose of this report is to identify design review acceptance cr :teria for the SPDS installed in the control room of a nuclear power plant. Use of computer driven cathode ray tube (CRT) displays is anticipated. General acceptance criteria for displays of plant safety status information by the SPDS are developed.

In addition, specific SPDS review criteria corresponding to the SPDS functional criteria specified in NUREG-0696 are established.

These design review acceptance criteria define a basis for the NRC staff's human factors review of a Safety Parameter Display System. These review criteria do not impose any new functional design requirements.

iii i

l 3;

CONTEtirS ~

Page 1.0 Introduction 1

2.0 Scope 3

1 3.0 General Acceptance Criteria for SPDS Displays 3.1 ?etection of Abnormal Conditions 4

3.2 SPDS Data Display Formats 4

3.3 Display Techniques 6

3.3.1 Display Patterns 6

3.3.2 Scaling of Displays 6

3.3.3 Identification of Displayed Parameters 7

3.3.4 Perceptual Aids 7

4.0 Specific SPDS Design Review Acceptance Criteria 9

4.1 Functions 19 4.1.1 Primary function 10 4.1.2 Secondary Functions 10 4.1.3 Future Functions 11 4.2 Data Set 12 4.2.1 Basis of Parameter Selection 12 4.3 Data Validation 12 4.3.1 Real Time Validation 12 4.3.2 Unvalidated Data 13 4.4 Display 14 4.4.1 Design Principles 14 4.4.2 Parameters Displayed 14 4.4.3 Pattern and Coding 17 4.4.4 Additional Data 19 4.4.5 Mode of Operation 21 4.5 Location and Readability 23 4.5.1 Display Location 23 4.5.2 Control Board 23 i

4.5.3 Display Readability r

24 4.5.4 Display Accessibility 25 4.5.5 Control Accessibility 26 4.6 Staff 27 4.6.1 Control Room Staff 27 4.6.2 Operator Interaction 27 4.7 Procedures 28 4.7.1 Failure Recognition 28 4.7.2 Technical Specification 29 4.8 Audible Alarms 30 4.9 Design Criteria 31 4.9.1 Functional Qualification 31 4.9.2 Backup Displays 32 4.9.3 Primary Display, Seismically Qaalified' 33 5.0 Human Factors Engineering Review Process

~ 34 6.0 References 36 A-1 Appendix A Application of General Criteria to Display Patterns V

-+

A,-

---Mp

. PREFACE NUREG-0835 has been submitted to the Office of Management and Budget for 7

review and clearance under the Paperwork Reduction Act of 1980.

This draf t report is issued.to encourage public and industry comment. The staff will evaluate all comments it receives and modify the report as needed in preparing the final report. Comments received by the Commission will be made available for public inspection at the Commission's Public Document Room in Washington, DC. All comments on this draft report must be provided by 45 days after the publication date of the Federal Register Notice. All comments should be forwarded to:

~

Mr. Leo Beltracchi Human Factors Engineering Branch r..

Division of Human Factors Safety U.S. Nuclear Regulatory Commission Washirigton, DC 20555

~.

C

^

.L:

e Jy.

,/

./

m

  • r."

i e

O f

f t

l l

1 f

f

'q r

y y

/

i

,- f vii wy p

=

y,

,ge-

-a9,,

s..-

_.r_~_

mia-

...~.-,-,m

,-+y,

t ACKNOWLEDGEMENT This report was prepared through the joint effort of personnel from the NRC, Division of Human Factors Safety, Human Factors Engineering Branch, and from the Lawrence Livermore National Laboratory, Nuclear Systems Safety Program.

The Human Factors Engineering Branch acknowledges the efforts of Vincent G.

McGevna and L. Rolf Peterson of Lawrence Livermore National Laboratory for their contiibutions to the development of these design review acceptance criteria.

e ix 9

.a

1.0 INTRODUCTION

The accident at Three Mile Island (TMI) and subsequent investigations have demonstrated the need for improving the presentation of plant and process information to reactor operators. This is especially true when a nuclear power plant undergoes a major transient. A major transient, such as the one at TMI, may develop slowly over an extended period of time. During a major transient, a reactor operator is required to monitor and process large amounts of data to ascertain the operating status and safety status of the plant.

NUREG-0696, Functional Criteria for Emergency Response Facilities (Ref. 1),

describes Emergency Response Facilities (ERFs) that are designed to improve emergency response to an accident at a nuclear power plant.

NUREG-0814, Methodology for Evaluation of Emergency Response Facilities, (a draf t report for public comment), defines questions that will be used by the NRC staff to review conceptual designs for the ERFs. The Safety Parameter Display System (SPDS) is described in NUREG-0696. The SPDS will display a minimum set of plant parameters from which the safety status of plant operation may be assessed by reactor operators. The SPDS and the control room operating crew as a unit should be able tc &tect abnormal operating cor.ditions that could adversely affect the safety of the plant.

Section 5 of NUREG-0696 gives the functional criteri

  • which the SPDS should meet.

These design review acceptance criteria define a basis for the NRC staff review of a Safety Parameter Display System. Use of other design review acceptance criteria that may exist is acceptable provided it is shown that the SPDS functional design criteria are satisfied. These review criteria do not impose any new functional design requirements.

Design specifications of SPDS systems and displays are not explicit in either the functional criteria of NUREG-0696 or the NRC regulations. Those examples of displays given in this report are provided to help designers,,

licencees / applicants, and reviewers interpret the design review acceptance l

criteria.

2.0 SCOPE This document presents only SPDS design review acceptance criteria that are within the scope of review related to human factors engineering. Tne human f actors engineering review covers about one-half of the SPDS functional criteria stated in NUREG-0696. The remaining functional criteria will be reviewed in accordance with existing NRC guidance.

The design review acceptance criteria emphasize review of SPDS designs that use computer driven cathode ray tube (CRT) displays. This approach reflects the types of SPDS designs proposed by the nuclear inductry in most of the technical briefings presented to the NRC regulatory staff.

It also reflects l

the general trend in the nuclear industry toward increased use of CRT displays.

l Present functional criteria for th2 SPDS do not rule'out-the use of other types of displays in SPDS

  • signs. Th:se cri;.cria gen: rally apply to all typas of SPDS displays with special emphasis on some aspects of CRT displays.

It.was time aad cost effective for the staff to develop acceptance criteria with emphasis on the computer driven CRT displays proposed by industry. More specific design review acceptance criteria for other types of SPDS display designs will be developed and defit ed case by case as designs are submitted for review.

NUREB-0700, Guidelines for Ceratrel Room Design Reviews,.(Ref. 2), are applicable for human factors engineering review of visual displays, process computers, and CRT displays. The HUREG-0700 guidelines alone are not sufficient to review an SPDS ano assure that the SPDS functional requirements developed in NUREG-0696 are met.

Therefore, it was necessary to develop additional design review acceptance criteria that apply to the SPDS functional requirements. These SPDS acceptance criteria provide the basis for a review of SPDS' displays without limiting the types of acceptable SPDS displays to computer driven CRT displays.

General SPDS display criteria are defined and discussed in Section 3.0,teria General Acceptance Criteria for SPDS Displays. Then the functional cri published in NUREG-0696 are organized into specific topic areas and design review ac(.eptance criteria are defined for each functior <1 criterion. These specific criteria are defined in Section 4.0, Specific SPDS Design Review Acceptance Criteria.

s A reviewer should be familiar with the human factors, gaidelines in 3

NUREG-0700. The most important of these guidelines are Section 6.5, Visual Displays, which includes principles of display, meters, light indicators, and graphic recorders; Section 6.6, Labels and Location Aids, which includes -

labeling principles, label location, label content. and location aids; Section 6.7, Process Computers, which includes computer access, CRT displays, and printers; and Section 6.8, Panel Layout, which includes panel contents, i

recognition and identification enhancement, and layout arrangement factors.

Review criteria references to NUREG-0700 are made only where those human engineering guidelines are'directly applicable to the revi:w acceptance criteria.

4 A reviewer of SPDS systems also should be familiar with CRT technology and its application to nuclear power systems. Several references provide general information on the design of CRT-based displa~y systems (Refs. 3-5).

A i

document detailing human engineering design data for CRT based display systems is currently being developed by an NRC contractor (Ref. 6). This forthcoming document will be useful for reviewing many aspects of an SPDS design that uses i

CRT displays. However, a detailed comparison of this ' document with the control room human engineering guidelines guidelines presented in NUREG-0700 has not been conducted. Anotier recent NRC contractor report (Ref. 7) presents numerous ways of displaying multivariate data for use in nuclear process control. Although this report draws some conclusions on the applicability of various displays in reactor control rooms for process control applications, these conclusions do not necessarily apply to specialized functional requirements for SPDS displays

  • All of these referen-es contain extensive bibliographies for reference to more specific information.
  • The use of displa.y patterns such as Chernoff Faces and Fourier Plots would be unacceptable.

1 l

In summary the NUREG-0700 design guidelines are not necessarily the only acceptable guidelines which may be applied to the SPDS design reviews.

Additional guidelines provided in the listed references or elsewhere which are exceptions to the NUREG-0700 guidelines may be equally acceptable provided the SPDS functional criteria are met. The source of these other acceptance criteria should be cited and justification for their use should be provided to the reviewer.

3.0 GENERAL ACCEPTANCE CRITERIA FOR SPDS DISPLAYS The primary function of the SPDS is to help control room operating personnel make quick assessments of the plant safety status. The display should be monitored by the operators during normal operations in the course of performing assigned monitoring functions. During emergencies, the SPDS should serve as an aid to the control room operating crew in executing the symptom oriented emergency procedures.

In this primary function, the SPDS provides the reactor operators plant status information from an integrated display during normal and er.ergency conditions in a manner analogous to the way the basic attitude and flight performance instruments of an aircraf t provide aircraf t status information to the pilot. The SPDS and the control room i

operators as a unit should be able to detect abnormal conditions that could have safety significance.

Operators must be trained in the use of the SPDS. The human operator is the key subsystem in the plant that can synthesize the plant process and assess the important plant functions from the data provided on the display. The displayed data is read and processed by the operator to determine the plant status. The design of the SPDS display should consider the operator's needs i

and should use perceptual aids that assist the operator in the plant synthesis l

and decision making t6sks. A functional qualification program that demonstrates enhanced operator performance in correctly assessing safety l

status of the plant will be a key f actor in the NRC review and acceptance of SPDS designs.

I NUREG-0696 states that the SPDS should display a minimum set of plant parameters from which the safety status of the plant may be assessed. The minimum set of parameters was not defined. The staff recognized that the minimum set of parameters may be plant dependent. However, NUREG-069; did define important plant # unctions to include, but not be limited to:

l

(

Reactivity control Reactor core cooling and heat removal from primary system Reactor coolant system integrity Radioactivity control Containment integrity Other plant functions may also be important. The primary display of the SPDS i

l should consist of the minimum set of parameters from which the operator can I

assess the plant safety status. The status and performance of systems subsystems, and components should be allocated to secondary display for, mats if I

this information is part of the SPDS data. - -

The mechanism for displaying the SPDS safety information is not rigidly specified by the functional requirerents of NUREG-0696. The plant safety status.information must be presented by the SPDS to enhance the functional effectiveness of control room personnel, Good human factors engineering of the SPDS is a functional requirement.

It is anticipated that SPDS designs-generally will use computer driven CRT displays since they allow more flexibility in data display format and data display enhancement than do analog meters and analog chart recorders. This display may consist of one or more CRTs as needed to meet the functions of the design. However, the use of non-CRT types of displays in not precluded. These review criteria are not intended to be so restrictive that they eliminate consideration of other useful displays that are presently available or that may be developed as techniques for data presentation evolve.

i 3.1 Detection of Abnormal Conditions The SPDS is to provide an indication of plant parameters or derived variables i

representative of the safety status of the plant and is to aid the operator in the rapid detection of abnormal operating conditions significant to safety. A minimum set of plant parameters from which the plant safety status can be assessed are to be grouped in the SPDS display. The technical choice of the appropriate minimum set of plant parameters to be used by the SPDS is beyond the scope of these human factors design review acceptance criteria.

The display of abnormal operating conditions significant to safety must be distinctly different in appearance from the display depicting normal operating conditions. This distinction is to assist the control room operating crew in detecting abnormal operating conditions. Displays that present the minimum set of plant safety status parameters in a format that is readily interpretable by the operators and that is visible to the operators are acceptable.

j i

Acceptable SPDS designs will assist operators to rapidly detect an abnormal condition and will assist in initiating diagnosis to localize the source of the abnormality at the function or system level.

Such designs will enable operators to specifically identify what safety status parameters are abnormal.

3.2 SPDS Data Display Formats The functional requirements specify that the SPDS must display the minimum set of plant parameters or derived variables and their trends in a single primary display format for each mode of plant operation. A common display format composed of the same plant parameters may be used lor several modes of plant operation. However, the display must contain that minimum set of parameters needed to' assess the safety status of the plant for each mode of operation.

The SPDS may also have the capability to recall additional data on secondary display formats or displays. Acceptable SPDS display formats may present plant safety status information in combinations of alphanumeric, symbolic, or graphic form and may present plant parameter data in analog or digital form. 1

The primar_y display format may be presented on a single display device or a group of d'isplay devices concentrated in a single compact display at a location specifically designated for the SPDS.

Primary display formats that remain continuously visible to the operators are acceptable.

The information displayed by the SPDS display must be presented in ways that are easy for the operators to read and understand. Display formats designed so that specific elements in the display correspond directly and unambiguously with each parameter are acceptable. A label or other readily understood identifier that appears on each element of the display and specifically identifies that element with the parameter it represents is acceptable.

Changes in value of a display alement should be readily interpreted as a corresponding change in the magnitude of the measured or derived parameter.

In most cases a linear relationship between the magnitude of the measured or derived value of the parameter and the display element used to depict the parameter is acceptable.

In some cases a nonlinear relationship between the parameter and the display element may be acceptable if it can be demonstrated that such a relationship is more meaningful to the operators or that it will actually f acilitate interpreting information. For example, a logarithmic relationship between reactor power level and the magnitude of the corrc:ponding display element may be appropriate to display power during reactor startup if accurate readings of reactor power are needed over many decades of power level.

Quantitative information about the magnitude and trend behavior of the parameters used for the SPDS must be presented to help the operators assess the severity of abnormal plant conditions. Displays that provide quantitative data of the magnitude of each parameter on the primary display as part of the primary display format are acceptable.

Properly designed numeric, analog, or graphic displays of parameter magnitude are acceptable.

In addition to magnitude, the operators should also be able to determine whether each parameter is increasing or decreasing and observe the trend or rate of change of a parameter from changes in the display. Operator monitoring of parameter trends is a key task in evaluating the safety status of the plant. This trend information is needed to assist the operators in determining the severity of a abnormality when a transient condition develops.

Primary SPDS displays that show quantitative rate of change information are I

acceptable provided the quantitative rate of change display will not be misleading to the operators during transient or oscillatory variations of the parameter that may occur.

Primary SPDS displays that provide qualitative trend and rate of change information by observation of the variation in magnitude of the parameters are acceptable if quantititative rate of change and time history data for each parameter are available on a secondary SPDS display.

Time history displays of parameters over a recent time interval are a preferred means of displaying trend and rate of change data. A time history of each safety status paramecer for the 30 minutes imediately preceeding current real time is acceptable. This time period is consistent with the Availability of time history data displays on either the primary SPDS d).

startup time required for activating the Technical Support Center (TSC isplay format or on a secondary SPDS display format is acceptable.

l j

a 3.3 Display Techniques Since the primary function of the SPDS is to assist control room operating be personnel in evaluating the safety status of the plant, the display should-j-

er.hanced to improve the. operator's perception, comprehension, and detection of abnormal operating status significant.to safety. Some display design-i techniques to enhance-the detection function are discussed in the-following sections. Review guidance is provided for.each technique to assure that use of that technique will provide acceptable enhancement features for the SPDS -

display.

The display enhancement techniques discussed are:

I 1.

Display Patterns 2.

Scaling of Displays-3.

Identification of Displayed Parameters 4.

Perceptual Aids 1.

Color-2.

Symbols-and mimics 3.

Overlays 4.

Setpoints-1 5.

Blinking and Flashing Display techniques other than those listed may also be acceptable.

3.3.1 Display Patterns Patterns can be an effective way to present data to an operator. When a pattern is used to enhance tne operators' assessment of the safety status of the plant there chould be a direct association between the display pattern and the status of the plant.

I-The 5.attern for normal operating conditions should have distinctive j

j-characteristics that distinguish it from the patterns produced by aP,ormal conditions. The change from normal to abnormal pattern configuration should i

be readily detectable. One change in pattern that is acceptable when properly designed and implemented is a change from a symmetric or regular geometric.

pattern during normal operating conditions to an asymetric or irregular geometric pattern when an abnormal condition occurs. - Another change in pattern that may be acceptable = is a change from a pattern displaying uniform magnitude or. length of all pattern elements during normal conditions to al-l pattern displ_aying unequal magnitudes or lengths of pattern elements representing narameters that are in an abnormal state..The use of Chernoff j

Faces and Fourier Plots are unacceptable display patterns.

3.3.2 Scaling of Displays The displays of parameter magnitude should be scaled to optimize the operator-recognition of plant changes from nomal conditions. The choice of a parameter scale to produce an undistorted display pattern under normal

- conditions is an acceptable scaling technique provided adequate data readout accuracy for operator use is maintained. However, it may not be possible to

. normalize 'all parameters.

r-r-,ww-----e----r

-e--

=.ee--

yw--

-e-wr------s--

-s-<

<e,

+ w5r-

+-+w

+-----+-----+me

+-+---,----+--rw--

-r- - - - - - - +

Parameter magnitude should be scaled to allow tracking over a wide range of abnormal conditions. Patterns-for abnormal conditions that do not fill the entire display area are acceptable. Pattern' displays that have means of reading parameter data if the display pattern should go offscale during abnormal conditions are also acceptable.

An operator is not likely to notice small changes in a pattern which normally appears distorted. During normal operation, a parameter being displayed may deviate from its nominal value.

However, it is important that the display pattern remain undistorted to avoid giving false indication of abnormality to the operator. Displays should use appropriate parameters that have small deviations about a steady state value during normal operating conditions and that have distinctive large variations from the steady state value during abnormal conditions.

It may be acceptable to change the scaling f actors used in a display if changes in relative magnitudes of the parameters occur during plant operations. For example, normal operation at reduced power may result in a display which appears distorted relative to the display exhibited during operation at 100% power. Since reduced power operation does not represent an abnormal condition, a change in display scale may be acceptable to provide a display that remains undistorted.

It is preferable that this type of display scaling change only be made by operator command rather than by automatic action of the display signal or data processing system to assure that an abnormal condition is not misrepresented by the SPDS display system.

3.3.3 Identification of Displayed Parameters The operator must be able to readily interpret the information conveyed by the SPDS display. When a display changes, the operator must know what pirameters i

are changing and how they are changing in order to assess the nature of an abnormality. This will also help identify the system involved during an abnormal condition. An acceptable display format or display pattern must include labels to identify each parameter. Reliance upon the operator's j

memorization of the relationship between the display format or the display pattern and the specific variables being displayed is not acceptable.

I l

3.3.4 Perceptual Aids Perceptual aids can be used with all types of display mechanisms. Among the perceptual aids suitable for use in SPDS displays are color, symbols, overlays, and setpoints.

1 3.3.4.1 Color Color may be used in SPDS displays to help identify and differentiate between elements of the display and to indicate a change in functional or operating status of a plant parameter. To be effective, the colors used in the SPDS display should confonn to a color code.

Conformance with the guidelines provided by NUREG-0700, Section 6.5.1.6, Color Codin and Section 6.7.2.7, GraphicCodingandHighlightingisacceptableforSPb5 displays.

When color changes are used to indicate a change in functional or operating status, they should be limited to no more than two levels in severity of the change in status. Acceptable displays may employ one color change when a part aieter is outsida its normal range but does not represent a serious problem. A second more noticeable color change when a parameter is in a range that indicates a serious abnormality is also acceptable. (Tse of the preferred color codes in NUREG-0700 to depict alerting and alarming conditions of parameters being displayed is acceptable.

Acceptable displays will avoid conflicts between the 'ne of color to enhance identification of display elements and the use of color to enhance changes in status of displays or display elements.

3 3.4.2 Symbols and Mimics 1

Graphic symbols and mimics may be used as distinctive means of presenting information in a pictorial format. Conformance with the guidelines of NUREG-0700, Section 6.6.3.4, Symbols, and Section 6.6.6.4, Use of Mimics, is acceptable for SPDS displays.

3.3.4.3 Overlays Overlays can be an effective means of enhancing displays. An overlay which provides a reference to normal conditions, or provides an indication of normal limits for individual parameters, or provides an indication of abnormal operating ranges is acceptable. An overlay of a normal pattern can enhance some graphic displays by providing a reference to normal operating conditions to f acilitate pattern recognition or to detect deviation from normal conditions. Electronic overlays for CRT displays are acceptable when they improve the operator's interpretation of the operating conditions.

Transparent overlays that interfere with observation or interpretation of plant operating conditions are not acceptable.

3.3.4.4 Setpoints Setpoints for a parameter that are used to initiate changes in display presentation and to alert operators to changes in operating status are

{

acceptable. Setpoints used for display changes and overlays must be established using appropriate technical considerations. Arbitrarily establishing setpoints as some nominal percentage of normal value or maximum range will not necessarily provide any display enhancement.

Poorly chosen setpoints can have negative effects if they result in frequent false alarms.

Setpoints used for display enhancement that are chosen y,'ecifically for their j

appropriateness to perform that function are acceptable.

%rbitrarily setting l

a setpoint at some fixed fraction of the normal operating "P; w'thout supporting justification is not acceptable.

I -

3.3.4.5 Blinking and Flashing Blinking of symbols or data on a CRT, blinking of illuminated graphic displays, ar.d flashing' ale means of calling opertor attention to an abnormal of indicator lights and annunciator displays are effective and accepta condition. Conformance with the guidelines of NUREG-0700, Section 6.3.3.2, Visual Alarm Recognition and Identification and with Section 6.7.2.7, Graphic Coding and Highlighting 1s also acceptable for use in SPDS displays.

4.0 SPECIFIC SPDS DESIGN REVIEW CRITERIA The specific design review acceptance criteria address all SPDS display systems with emphasis on review criteria applicable to CRT display systems.

The SPDS functional criteria, as c'efined in Section 5 of NUREG-0696, have been grouped into nine broad categories.

These categories are:

1) Functions,
2) Data Set,
3) Data Validation,
4) Display,
5) location and Size,
6) Staff,
7) Procedures,
8) Alarms,
9) Design Criteria.

The functional design criteria for each category are stated and referenced to NUREG-0696. Specific design review acceptance criteria are presented for each l

functional criterion and are referenced to NUREG-0700, Section 6., Control l

Room Human Engineering Guidelines, where applicable.

_g_

' FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700-REF NO.

REF. NO.

4.1 FUNCTIONS 4.1.1 Primary Function The primary _ function of the 5.1 This criterion is satisfied when:

SPDS is to serve as an 1.3.4 a) the primary SPDS display format 6.5 operator aid in the rapid contains functional information to 6.6 detection of abnormal assist the operator in rapidly conditions by providing a evaluating the safety status of the '

display of plant parsneters plant.

from which the safety ar;d status of operation may be b) abnormal conditions which impact safety assessed in the control of the plant are easily identified and room.

recognized from the primary SPDS display format.

1 and j

y, c) the SPDS supplements the control room annunciator system when severe plant-c) transients occur.

4.1.2 Secondary Functions The display system may 5.5 The secondary functions are acceptable include other functions provided:

that aid operating a) they do not impair the operator's'use personnel in evaluating of the.SPDS in executing the primary plant status, function.

and Secondary functions, such as b).the control room operating crew has the performance monitoring of been trained in the use of the plant systems or safety secondary functions.

systems and the presentation of data.to assist the operator to diagnose abnormal operating conditions may be used. No acceptance criteria for the

'j secondary functions are specified in this report.-

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700

l REF. N0.

.REF. N0..

4.1.3 Future Functions The design of the display system 5.5 The criterion may be' satisfied in designs should be flexible to allow for using a computer based system when either:

future incorporation of advanced a) the design is expandable to accept.new diagnostic concepts.and evaluation functions.

techniques and systems, or b) the design allows' for the addition of processors, memories or. additional computers, such as in a distributed network..

This criterion may be satisfied by.a hardwired system when:

a).

the design allows for the addition of new displays to the.SPDS panel /

J.

workspace; T'

and b) the design allows for the installation of equipment to support the-displays.

The addition of diagnostic techniques must not compromise the primary.SPDS function and is subject to review prior to implementation.

l l

I l

'e

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.2 DATA SET 4.2.1 Basis of Parameter Selection The basis for selection of 5.5 This criterion is satisfied when:

the minimum set of it can be demonstrated that the.

parameters in the primary primary display format,'using the display shall be documented parameters selected meets the as part of the design.

guidelines or criteria of Section 3.

4.3 DATA VALIDATION 4.3.1 Real Time Validation Display data shall be 5.1 This criterion is satisfied by:

validated on a real time a) comparing redundant sensor readings 6.7.2.7 4

basis where practicable.

prior to the display of the parameter.

na or b) using analytical redundancy among different parameters and using models and equations that have been documented and validated. Operating regimes where the equations used are not valid should be identified and.

documented.

i 6

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

lEF. h0.

4.3.2 Unvalidated Data Display data which is 5.1 This criterion is satisfied when:

unvalidated shall be so a) validated parameters, unvalidated 6.7.2.7 indicated to operators.

parameters, and invalid data are identified, where practical and b) validated parameters are coded in a manner whereby they are easily Jistinguished from unvalidated parameters.

and c) coding of invalid data is distinct from the coding of data for which data validation is unsuccessful.

and J.

d) operating procedures for use of the i'

SPDS provides guidance for treatment of invalid data and resolution of unsuccessful data validation.

and e) operator training in the use of the SPDS includes practice in dealing with unvalidated data and application of procedures to resolve unsuccessful data validation.

Operator knowledge of the validity of data is important in correctly assessing the safety status of the plant.

FUNCTIONAL CRITERIA

.NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. N0.

REF. NO.

4.4 DISPLAY 4.4.1 Design Principles The display format shall be 5.5 This criterion.is satisfied when:

designed to accepted human a) the design conforms to the displa7

-6.7

  • f actors principles.

guidelines presented in NUREG 0700, and

'\\

b)

.the primary display format conforms to the general criteria in Section 3.

4.4.2 Parameters Displayed 4.4.2.1 Individual Parameters The primary display may 5.1 This criterion is satisfied when:

be a continuous 5.5 a) a dedicated display, such as a'CRT, indication of individual with a single primary display format plant parameters or may continuously displays the minimum J.

be, composed of a number parameter set necessary to essess the

?

of measured variables or safety status of the plant.

derived variables, or b) reduction-in size of'the primary display format is provided when it is necessary to display secondary information, or c).

audio or visual cues are provided on the display to alert a'well trained operator to return to the primary

' display f ormat while viewing secondary information.

or d) the seismically qualified, concentrated backup display of primary format infromation is visible to the operator while viewing-secondary information on the CRT.

___________x____

)

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA iiUREG-0700 REF. NO.

REF. N0.

4.4.2.2 Timeliness and Accuracy of Data Displayed data shall 5.1 This criterion is satisfied when:

present current and a) the sampling rate for each parameter accurate statcs of the is chosen such that there is no plant.

meaningful loss of information in the data presented to the operator.

and b) the time delay from when the sensor signal is sampled to when it is displayed is no greater than 2 seconds.

and c) maintaining the control room SPDS displ.ay is given processor priority over display and processing requests M

from the TSC, E0F, or other sources.

and d) each parameter is displayed with an accuracy sufficient for the operator to discriminate between abnormal con-ditions which impact safety and normal operating conditions, l

I

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.4.2.3 Scope of Data The display should be 5.5 This criterion is satisfied when:

responsive to transient a) operator comprehension of a change in and accident sequences.

the safety status of the plant from the primary SPDS display could be achieved in a matter of seconds.

If

}

closure of this task takes several minutes, the design is unacceptable, and b) the display system correctly portrays l

the plant process status for all design basis events and e unts specified by NUREG-0737,Section I.C.1, Guidance For The Evaluation and Development of Procedures For Transients and Accidente 4

T l

l 1

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.4.3 Pattern and Cccing 4.4.3.1 Parameter Grouping Parameters must be 5.1 This criterion is satisfied when:

grouped to enhance a) the minimum set of parameters are operators assestment of presented on the single primary the plant and to assist display format. The minimum set of in making functional parameters must be the ones by which comparisons.

the operator evaluates the safety status of the plant.

and b) the parameters displayed are grouped so that all are visible to the operator within one field of view.

and c) the parameters are sequenced in a logical manner to facilitate operator Y

comparison of parameters in evaluating the safety status of the plant, and d) the primary display format utilizes patterns and display enhancements as discussed in Section 3.

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

-REF. NO.

4.4.3.2 Pattern and Coding Techniques Pattern and coding 5.1 This criterion can'be satisfied by:

techniques shall be used a) the use of color coding to indicate.

6.7.2.7 to assist operator the approach to unsafe operation and detection and to indicate unsafe operation.

recognition of unsafe or operating conditions, b) the use of. limit marks for each parameter displayed. The. limit marks should be rerresentative of operational limits established by technical specifications, process

limits, 5 - fety system actuation setpoints.

." applicable.

or c) the'use of patterns which noticeably

?

distort when an unsafe condition is approached.

Also see Section 3.3, Display Techniques.

^

^

d

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. N0.

4.4.4 Additional Data 4.4.4.1 Magnitude, Trend The display shall be 5.1 This criterion is satisfied when:

capable of presenting a) the primary display format contains magnitudes and trends of the magnitude for all variables being parameters or derived displayed.

variables. The display and of time derivatives in b) the primary display format has the 6.7.2.1 lieu of trends may be capability of indicating trends, or 6.7.2.8 I

acceptable.

trends of operator selected parameters are available in a secondary display format.

and c) trend data is displayed with sufficient resolution in time ard t;

magnitude to ensure that rapidly changing parameters are accurately a

displayed. The frequency bandwidth of the signal measurement' system, consisting of sensor, signal processing devices and trend.disolay device should.be broad enough to transmit all meaningful information of the measured parameterlor derived variable.

The display of time' derivatives of variables is acceptable only when the l

derivatives unambiguously reflect the l

trends in the variables. The. algorithm used for time derivatives must be-adequate to track oscillating plant variables that-l may exist during the design basis events for the plant.

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA

-NUREG-0700 REF. NO.

REF. NO.

J 4.4.4.2 Recall Capabilities The recall of additional 5.5 This criterion is met when:

data on secondary a) formats or displays is operator requests to the' display

'6.7.2.8 system will result'in displays, of desirable, additional data, on secondary formats, such as. trend data-of the safety status parameters.

and b) data is available for retrieval and is not lost as a result of an electrical power failure.

and c) data stored for retrieval is stored on a secure medium and is available'upon demand.

i E$

and d) response times to operator requests 6.7.1.7 for information on secondary displays conforms with NUREG-0700. guidelines for computer response time to operator queries.

m FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. N0.

4.4.5 Mode of Operation 4.4.5.1 Mode of Plant _0peration The design of the 5.5 This criterion is satisfied when:

display shall contain a a) the design contains a primary display single primary display format for each mode of. plant format for each mode of operation defined by the technical plant operation.

specifications of operation.

A common display format composed of the

'same parameters may be used for several modes of plant operation. However, for any one mode, the displaymust contain that minimum set of parameters needed to assess the safety status of the plant.

A:

Typical modes of plant operation are:

T'

l. Power Operation
2. Startup
3. Hot Standby
4. Hot Shutdown
5. Cold Shutdown
6. Refueling

FUNCTIONAL' CRITERIA NUREG-0696 ACCEPTANCE. CRITERIA NUREG-0700' REF.-NO.

REF. NO.

4.4.5.2 Display Format Selection For each plant operating 5.5 This criterion is satisfied when:

mode, display formats a) a manually operated switch or input may either be.

from an alpha-numeric keyboard, touch automatically; displayed panel,. light pen, cursor, or or manually selected.

equivalent interface is provided by-the design to allow the operator to adjust the display format for the mode

-of plant operations, or b) an automatic display t'ormat change' 6.7.1.1'

' occurs with a change in the mode of plant operation.

Automatic' change must be designed so'that-A3 gradual change due'to an.. abnormal condition 1

ga is not interpreted as a change in mode of-4 operation. There must also be provisions to indicate to operators that a change in

.the. mode of plant operation has occurred.-

Provisions must bel included for the-operator.to override.-automatic. change when-necessary.

.a

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.5 LOCATION AND READABILITY 4.5.1 Display Location The SPDS shall be located 5.2 This criterion is satisfied when:

in the control room with provisions are made for. locating the additional displays SPDS' display and associated controls provided in the TSC and E0F.

in the control room, TSC, and EOF.

4.5.2 Control Board A,

If the SPDS is part of the 5.2 This criterion is satisfied when:

43 control board, it must be a) the SPDS is readily distinguished from 6.1 easily recognizable and other displays on the control-board.-

6.8 readable and b) the display conforms to the

.6.7.2 appropriate display readability guidelines stated in NUREG 0700.

m, m

o et

.4

-s.w

_3 jpm.,_,

L 4

4 m

m 4

_g m

a FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

- REF. NO.

1 4.5.3 Display Readability The display.shall be 5.3 This criterion is satisfied when:

readable from the emergency a) the displays design conforms to the 6.7.2.1 station of the Senior appropriate display readability-Reactor Operator, guidelines stated in NUREG-0700, such as viewing distance, viewing angle, and screen location for standing and seated operators at tne Senior Reactor Operator's Station.

and b) the data displayed on the CRT's has 6.7.2.1 acceptably low flicker and noise.

and c)

Alpha-numeric characters generated 6.7.2.2 with a 7 x 9 dot matrix or larger are A,

pref.erable;. characters with 5 x 7 dot f=

matrix are acceptable, if necessary.

and d) density of display is-less than 25%

when complex symbology (e.g.n imics -

are displayed, and e) for ease of detection, acceptable symbol to background contrast ratio should fall in a range of 3:1 to 4:1. for all important data.

and f) motion of data displayed on a CRT to prevent screen burnout is at a rate slow enough to avoid distractirg the operator.

T l

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.5.4 Display Accessibility The display shall be readily 5.2 This criterion is satisfied when:

accessible and visible to the:

a) phsyical obstructions do not block a 6.1.1 Shift Supervisor person's field of view when the person Control Room Senior Reactor is at the normal work station.

and Operator Shift Technical Advisor b) if the SPDS is not in the operator's One Reactor Gperator.

direct field of view at the workstation, a reorientation of his/her field of view allows viewing the SPDS from the workstation.

and c) members of the control room operating crew have physical access to the SPDS from their normal workstation. For g,

example, a short direct walk to the y

SPDS is acceptable.

and d) glare from normal or emergency 6.1.5.3 lighting does not restrict viewing of the SPDS from within the control room.

The use of antiglare techniques and devices are acceptable when they are in accord with other criteria stated in this report.

and e) luminance levels and luminance 6.7.2.1 contrast do not limit viewing from locations throughout control room.

_. _.. _,._.. ~. _

' FUNCTIONAL' CRITERIA NUREG-0696

' ACCEPTANCE CRITERIA NUREG-0700:

i

~ EF.'NO.

REF. NO.

R I

4.5.5 Control. Accessibility The display system shall 5.3 This. criterion is satisfied when:

not interfere with the a) the display system does not obstruct-6.1.1.

normal movement of-the the normal movement of.the control 6.1.2 control room operation room operating crew.-

j crew. The display system and

-shall not interfere with b) the display system does not~ interfere l

full visual access.to other with the full visual access ~ to other.

'l control room operating control room operating systems and j

systems and displays.-

displays.

o l

1

-l 1

0

-l

^

, -i I

6

~

n

. h,] f 4

i z4

. ~ - -,

..~

..a

...t

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. N0.

4.6 STAFF 4.6.1 Control Room Siaff' No additional operating 5.4

.This criterion is satisfied when:

staff other than the normal a) no additional operating staff other control room operdting than the normal control room operating staff should be needed for staff need be added for operation of

_ operation of the display.

~the SPOS.

and b) the operator training program contains instructions on the use of the SPDS.

and c) an SPDS user's manual is available for operator reference in the control room, and d) interaction with an SPDS computer is i

N designed such that training in computer programming is not required.

4.6.2 Operator Interaction This criterion is satisfied when:

Flexibility to allow for 5.5 a) the system contains operator 6.7.1.4 interaction by the operator interactive devicas, is desirable in the design b) the display system positively 6.7.1.7 of the display designs.

acknowledges each request that the design allows the operator to make.

c) system response times to operator 6.7.1./

request conform to the guidelines of NUREG 0700. Undue time delays in response to a request are unacceptable.

Function keys for the recall of data are the preferred type of interactive devices.

Keyboards are accer.able for use in the recalling of da'.a provided the necessary syntax is simple and straightforward to use.

Alpha-numeric keyboards added to SPDS should have the same keyboard layout as other keyboards in control room. Other interactive devices such as touch panels or light pens may also be acceptable.

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.7 PROCEDURES 4.7.1 Failure Recognition The control room operations 5.6 This criterion may be satisfied by:

staff shall be provided a) designing a monitoring system in the 6.7.2.6 with sufficient information display which may be automatic or 6.7.?.7 and criteria for opera *cr activated.

performance of an er operability evaluation of b) a display of calendar date and time of 6.5.1.1 the SPDS.

day, with some ineans of indicating the passage of seconds. The display should be updated only when the systera is operating properly so that a static time would indicate a system failure.

The data and time should be located in

)

a corner of the display so as not to i

5 distract the operator.

Or c) the operable status of the display system is available upon operator demand.

or d)

An equivalent means of evaluating display system operability is available.

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.7.2 Technical Specification A technical specification 5.6 This criterion is satisfied when:

of operations is required a) the technicz' specificatien defines to defiia compensatory acceptable compensatory measure for measures for the operator each function perfarmed by the SPDS.

when the SPDS is inoperable.

The use of the seismic qualified back-up display, monitored on a frequent basis, may be an acceptable compensatory measure. The same minimum set or comparable set of safety status parameters on the SPDS primary display format should be present on the backup. Also, the backup display must be readily interpretable by the operator.

b.$

i

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.8 AUDIBLE ALARMS Where feasible, the SPDS should 5.5 This criterion is met when:

include some audible notification a) the display system emits a distinct 6.2.2 to alert personnel of an unsafe audible sound, such as the beeper 6.3.2 operating condition.

available on computer terminals, upon detecting an abnormal operating condition.

and b) the SPDS alarm system has provisions 6.3.4 to silence, acknowledge, reset and test these functions, as appropriate.

An audible alarm from the SPDS need not meet the intensity requirements given in NUREG-0700.

O?

SPDS alarms should be independent of the annunciator system and should not result in the generation of the same audible alarms as the annunciator system.

L

FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.9 DESIGN CRITERIA 4.9.1 Functional Qualification A functional qualification 5.1 This criterion is satisfied when:

program should M established a) a test plan is available for the to demonstrate SPDS display system. The test plan shall operational coaformance with define a minimum of one test case for the functional design each major functional criterion of the criteria.

display system. The object of the test case is to illustrate the correct performance of the implemented design.

and b) a test report containing the results of the test cases is compiled. All major functional criteria raust be tested successfully.

i and y

c) all display formats in the design are tested, including mode' dependent f ormats, and d) a. human factors review of the SPDS in 6.0 accordance with appropriate portions of NUREG-0700 is performed with results evaluated in accordance with' the guidelines presented in h0 REG 0801. The results of this effort are to be documented Fy the licensee / applicant as part of the control room design' review.

and e) a trained control room operating crew can effectively use the SPDS to. detect abnormal plant operating conditions which impact safety.

m FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. N0.

REF. NO.

4.9.2 Backup Displays Displays designated as a 5.6 This criterion is satisfied when:

seismically qualified a) the back-up displays contain the same backup to the SPDS must be minimum set of safety status designed to accepted human parameters as presented in the primary engineering principles.

display format of the SPDS or an

^

equivalent comparable set of safety status parameters.

and b) the back-up display is capable of -

operating during and following earthquakes, to the same degree as control room displays needed to comply with Regulatory Guide 1.97.

.and c) the needed seismicially qualified i

M displays are concentrated into one segment of the control board.

Dependence on poorly human-engineered Class IE seismically qualified instruments that are scattered throughout the control room is not acceptable.

and d) the backup displays, when reviewed as a group, conform with the guidelines i

of NUREG-0700.

and e) meters on the control board which are part of the SPCS backup display are

, i readily identified and are not likely to be confused with similar meters in the vicinity.

y

~

~

1 FUNCTIONAL CRITERIA NUREG-0696 ACCEPTANCE CRITERIA NUREG-0700 REF. NO.

REF. NO.

4.9.3 Primary Display, Seismically Qualified It is preferred that only one 5.6 When the option for a seismically qualified display system be used for primary display is selected, this option is evaluating the safety status satisfied when:

of the plant. However, an a) the design of the primary display alternative is to design the conforms to Regulatory Guide 1.97, overall SPDS function with a Revision 2, December 1980, primary and a backup display.

"In;trumentation For Light-Water Cooled Nuclear Power Plants to Assess Plant' and Environs Conditions During znd Following An Accident" and b)

'the design conforms -to the acceptance g;

criteria defined in this report, with the exception of the concext of i

Section 4.9.2, Backup Displays.

i r

5.0 HUMAN FACTORS ENGINEERING REVIEW PROCESS The major steps in reviewing the design are:

(1) Evaluate the process used by the licensee / applicant to verify and validate the design.

(2) Audit the functional conformance of the design agt. inst functional criteria stated in Section 4, Specific SPDS Design lieview Acceptance Criteria.

(3) Audit the design's conformance to the acceptance criteria stated in Section 3, General Acceptance Criteria for SPDS CRT Displays, and Section 4, Specific SPDS Design Review Accept-ance Criteria.

(4) Audit the as-built system for conformance with the validated

design, i

(5) Audit the functional qualification test plan and test results.

In evaluating the process used by the licensee / applicant to verify and validate the design, the staff will as'sess the adequacy and thoroughness of the design verification and validation processes. This effort involves an assessment of the type of activities performed by verifiers and validators, the design discrepancies found, and how these discrepancies were resolved.

This allows the staff to determine how well versed the verifiers and validators are with the functional criteria for NUREG-0696 and to determine the quality of the original design effort.

The type of design discrepancies established by the verification and validating processes will also be assessed to determine if a generic pattern exists among them. The purpose of this effort is to determine if the-discrepancies are random or are inherent to the design process. The discrepancies which are inherent to the design process have a much greater significance with respect to the actions needed to achieve an acceptable design. Should a generic pattern among the discrepancies be detected, the i

staff may determine that the design is unacceptable.

Subsequent to the evaluation of the verification and validation processes,=

+

the staff will conduct audits of the design and tests. The' depth and scope of the audits will be dependent upon the verification and validation evaluation results, the functional criteria of NUREG-0696, and the acceptance criterla defined in Section 3, General Acceptance Criteria, and Section 4, Specific Acceptance Criteria of this report. The test plan and test results for qualifying the as-built system should also be audited.

l In conducting the audit, the NRC reviewer should first select a sub-set of the functional guidelines of the design. As an audit is planned, the sub-set of functions chosen should as a minimum be no less than 10-15% of the total set. A different set of functional guidelines should be selected for each design reviewed. The second step is to audit the design to ensure that these functions have been incorporated into the design. Then the following steps t

l

-1 y

are to audit the design to ensure that it meets the acceptance criteria for the functions selected. The final step is to audit the test plan and test results to ensure that all of the selected functions are being fully tested and that the test results demonstrate functional conformance to the design.

Shnuld the audit process define design or test discrepancies, then the Safety Evaluation Report should define the nature of the discrepancies ari why the design / test feature is unacceptable. Conversely, for acceptable designs / test results, the Safety Evaluation Report should clearly define the basis for acceptance along with the scope and depth of the review.

To conduct these reviews, the staff will need:

(1) A description of the verification and validation program for the SPDS.

(2) The results of the verification and validation program.

(3) Access to or submittal of the SPDS design, test plan, and test results.

The staff will evaluate the program for the results of the design verification and validation. The staff will also audit the design, audit the test plan, and audit the test results. These audits could take the form of:

(1) Assessing submitted material.

(2) Assessing material at the plant / vendor site.

(3) Assessing material obtained electronically from the utility or vendor.

The first two forms have been traditional methods used by the staff. The third form is currently technically feasible and holds the potential for cost savings to the regulated as well as regulators. However electronic transmission of material would require significant changes in the regulatory process.

The staff plans to conduct all of the above defined reviews in a single effort. All of the material needed to conduct the review is to be available prior to starting the review. Upon completeion of the review, the NRC staff plans to publish their findings in a Safety Evaluation Report.

This review plan mimimizes staff resource requirements as only one review effort is made i

instead of the usual two.

Industry comments on this review plan are welcome.

l f

f l -

6.0 REFERENCES

1)

U.S. Nuclear Regulatory Comission, " Functional Criteria for Emergency Response Facilities", NUREG-0696, Febru;ry 1981.

2)

U.S. Nuclear Regulatory Comission " Guidelines for Control Room Design Reviews", NUREG-0700, September 1951.

3) Ramsey, H. R. and M. E Atwood, " Human Factors Computer Systems: A Review of the Literature", SAI-79-111-DEN, September 1979.
4) Seminara, J. L. and S. K. Eckert, " Human Factors Considerations for Advanced Control Board Design", EPRI NP-1118, Vol. 4, March 1980.
5) Banks, W. W. and M. T. Clark, "Some Human Engineering Color Considerations Using CRT Disp?ays: A Review of the Literature", EG&G Report SD-B-81-001.
6) Banks, W. W., et al., " Human Engineering Design Considerations for CRT Generated Displays", EG&G DRAFT REPORT
7) Danchak, M. M., " Techniques for Displaying Multivariate Data on Cathode Ray Tubes with Applications to Nuclear Process Control", NUREG/CR-1994, EG&G-2086, April 1981.
9) Bruckner, L. A., "On Chernoff Faces", in P.C.C. Wang, draphical Representation of Multivariate Data, New York, Academic Prest, 1978, p. 93.
10) U. S. Nuclear Regulatory Comission$G-0814, August 1981. - (Draf t Report)

" Methodology for Evaluation of Emergency Response Facilities", NUR

11) U.S. Nuclear Regulatory Comission, " Evaluation Criteria for the Detailed Control Room Review", NUREG-0801, October 1981. (DraftReport) 4,

4

+

Y F

APPENDIX A APPLICATION OF GENERAL ~ CRITERIA TO DISPLAY PATTERNS HQIf: The material in this appendix supplements Section 3. General Acceptance Criteria for SPDS Displays, but has not yet been integrated. We invite Industry comments on the usefulness of this material.

CONTENTS.

Page A.1 Bar Chart A-2 A.? Deviation Btr Chart A-3 A.3 Linear Profile A-3 A.4 Circular Prcfile A-4 A.5 Time History Plot A-4

. A.6 Chernoff Face A-4 A.7 Fourier Represer.tations A-5 i.

FIGURES Page l

1.

Bar Chart A-6 l-2.

Scaled Bar Chart A-7 l

3.

Deviation Bar Chart A-8 4

Linear Profile A-9 5.

Circular Profile A-10 6.

Time History Plot A-11 7.

Chernoff Face A-12 l

8.

Linear Fourier Plot A-13

' A-1

APPENDIX-A APPLICATION OF GENERAL CRITERIA TO DISPLAY PATTERNS The purp ;e of this Appendix is to provide guidance in.the application of the General Acceptance Criteria. This Appendix is not intended as an endorsement of the display techniques presented.

A recent report (Ref. 7) presents numerous ways of displaying multivariate data for use in nuclear process control. Although this report draws some conclusions on the applicability of various displays for process control, these conclusions do not necessarily apply to the SPDS functional requirements. Many of the display techniques presented would be acceptable for the SPDS primary display format provided they are designed to satisfy the functional requirements of NUREG-0696.

The following are a selection of display techniques, primarily taken from j.

Reference 7, which are presented and reviewed in accordance with the criteria set forth in the previous sections.

A.1 Bar Chart The bar chart, Figure 1, synthesizes an array of analog meters. Each bar represents a specific parameter. Tne length oi each bar is generCly proportional to the magnitude of the measured parameter it represents. The reactor operator can easily associate with this type of display because of the multitude of analog meters in the control room used to display the magnitude of operating parameters.

Each bar on the display has a unique identification label. The label provides a positive identification of the parameter each bar represents. While an operator might learn the positions of each parameter bar, the labels provides a refereace identification of the parameter that is always avai.aole for the operator's use.

It would not be acceptable for an operator to have to memorize the position of each parameter on the display.

The bar chart, as presented in Figure 1, would not, by itself, allow a quick assessrrent of the plant safety status.

Each bar has a different length.

There is no display enhancement to distinguish normal parameter values from abnormal ones. A small change in any one bar indi9ating the onset of an ai, normal condition might not be detected by the reactor operator.

An acceptable enhancement to the bar chart would be to provida a reference to the normal operating condition. With references showi g normal parameter operating values, the operators are more likely to notice deviations from normal conditions. This enhancemer.t might in::1ude an indication of the normal value of each parameter together with pointers-for the normal operating range of each parameter. Such indications would facilitate interpreting the importance of a parameter change.

A-2

The scaling of the magnitude of each parameter displayed may be changed so that under normal cond.tions each bar is of the same length. When each bar is the same length during normal opera'ing conditions, as shown in Figure 2, a change in any one bar becomes more noticable. A bar chart such as Figure 2 would be acceptable to satisfy the requirement for a quick assessment of plant safety status provided abnormal values of each parameter produce noticeable changes from the norma? value.

Other enhancements which improve the ability of the operator to identify an abnormal condition would also be acceptable. The labels or bars may change colors tc signify an abnormal condition. Blinking of a label is also acceptable to call attention to an out of range parameter. These types of enhancements can be added to most display patterns to assure detection of abnormal operating conditions.

A.2 Deviation Bar Chart The deviation bar chart, Figure 3, is similar to the bar chart discussed above. However, each displayed bar consid s of the difference between the measured value of the parareter and the termi value of the parameter. Note that while the magnitude of the parameters %asured are always positive, the deviations from the normal ralue can be either positive or negative. A parameter which deviates s s tificantly from its normal value is easily detected by the operator.

Like the bar chart, each parameter is uniquely identified. Thus a c.hange in one deviation is readily associated with the corresponding parameter. There is a direct association with the status of the plant since under normal conditions the deviations are small.

In the cient of an abnormality, the magnitude and direction of a paramrier change is readily determined.

Thc choice of scaling for the deviations is important in assuring that there is a distinct difference between normal and abnormal conditions. Deviation bars that can vary over the entire display range under normal conditions would be unacceptable. The range of normal condition deviations should represent no more than 10% of the total range provided to display deviations. An indication of the normal range for each deviation is acceptable.

Some means of indicating the magnitude of each parameter is needed with the display for use a primary SPDS display since this information is not included in the deviation bar chart.

A.3 Linear Profile In a linear profile, the wide bars in the bar chart are replaced by thin lines. As presented in Ref. 7, percent range is displayed vertically and the individual parameters are defined and spaced horizontally. The vertical height of the parameter line represents the magnitude of the parameter. The end points of each parameter line are connected to establish a profile line, Figure 4.

Abnormal operating conditions are generally represented by an irregular profile line. Labels are provided along the bottom to identify each pasameter.

A-3 I

Scaling considerations for the linear profile are the same as for the bar chart. A horizontal line, representing normal operating conditions superimposed on the display is an acceptable enhancer.n t.

Shading below the profile line is also acceptable to provide a more distinguishable profile.

A.4 Circular Profile In a circular profile, the parameter lines of a linear profile join in a comon origin. Parameter lines radiate from the origin with equal angular spacing relative to each other, Figure 5.

The length of each line represents the magnitude of the parameter. Under normal operating conditions the profile should be circular. An irregular profile is indicative of an abnormal operating conditions. Labels are provided to identify each radial line.

Shading within the profile is acceptable to enhance the operator's perception of plant status.

A.6 Tirne History Plot A time history plot, Figure 6, provides a continuous graph of past values of a parameter vs. time. This display technique incorporates trend information into the display. When a parameter becomes abnormal a history of the abnormality is readily apparent. The trend should be a straight line, with possible minor fluctuations, during normal conditions.

It is acceptable to display the minimum parameter set using several plots, each plot containing ae or more variables.

When more than one parameter is presented in a plot there should be means of identifying each inividual parameter. Color coding of traces is acceptable. Color codes used, however, must not conflict with other uses of color in the display.

A display of two variables where the vertical axis and/or the horizontal axis for each variable do not intersect, should be considered as distinct plots.

In accordance with NUREG-0700, the number of parameters in one plot should not exceed five (5).

When more than one parameter is presented on each plot, then the grouping of parameters should enhance the operators assessment of the safety status of the plant.

A.6 Chernoff Face The Chernoff face is a graphic technique which maps multivariate data into facial features. Changes in data are translated into a change in the facial expression. Figure 7, shows an example of a Chernoff face. The assignment of f acial features to parameters is also shown in Figure 7.

A-4

Many linear and non-linear mappings relate the data being displayed to the different, facial features. Thus it is difficult to relate a change in the f ace to a specific change in the safety status of the power plant. There is not a direct association that an operator can make between the facial features and the magnitude of parameters or the safety status of the plant. Also, the Chernoff face does not allow simple identification of individual parameters.

The frowning mouth shown in Figure 7 is a composite of three parameters.

Extensive training and memorization of patterns are required to interpret these displays. Studies using Chernoff faces have shown that certain combinations of changes in the facial characteristics can result in a face that does not. ;, ear distorted (Ref. 8).

Thus, there may not be a noticable distinction between normal and abnormal conditions.

These cha acteristics make the Chernoff f ace unacceptable for use as the primary r,isplay of an SP95.

A.7 Fourier Representations Two other techniques presensed in Ref. 7 are the linear and polar Fourier representations.

A Fourier series is used to generate the function:

Y=A1+A2 cosX + As sinX + A4 cos2X +...

where A,... are the parameters to be displayed A,

1 2

X is an angle between 0 and 2pi.

TFe linear Fourier plot representation is a plot of Y = F(X) vs. X using rectangular coordinates. The polar Fourier plot representation is a polar plot of Y = F(X) vs. X.

The linear Fourier plot representation is shown in Figure 8.

The Fourier representationc ?c complex nonlinear transformations where individual parameters are no longer presented in readi!y identifiable form.

Thus it is not possible to associate the status of the plant with the display. These qualities make Fourier representations unacceptable for a primary SPDS display.

A-5

POWER E

PRIMARY FLOW M

CORE AT l

PRIMARY PRESS I

l PRESS LEVEL M

STEAM GEN. LEVEL MMMM M MM 0

20 40 60 80 100 PEP, CENT RANGE FIGURE 1.

Bar Chart Display l

l A-6 l

l POWER MMMg PRIMARY FLOW E

CORE AT MEE M

(

PRIMARY PRESS EE E

PRESS LEVEL E

E STEAM GEN. LEVEL E

E O

20 40 60 80 100 PERCENT RANGE FIGURE 2.

Scaled Bar Chart Display of Normal Conditions A-7

l POWER 1

PRIMARY FLOW ll CORE AT l

II PRIMARY PRESS II PRESS LEVEL STEAM GEN.

gg LEVEL 100 80 60 40 20 20 40 60 80 100 0

LOW HIGH i

l FIGURE 3.

Deviation Bar Chart RepresentJtion of Normal l

Operating Conditions l

l-A-8 i

i f

PERCENT RANGE 100 75 50 25 s

POWER FLOW AT PRI.

PRESS STEAM PRESS LEVEL GEN.

LEVEL FIGURE 4.

Linear Profile of Normal Operating Conditions A-9

STEAM GEN.

LEVE POWER

,/ m m

flESS LEVEL

, FLOW

\\

/ /

/

/

/

I Pnl 4T PRESS FIGURE 5.

Circular Profile of Normal Operatiag Conditions l

l A-10

=

Temperature 100u

--1000 (op) 750-

.750 Core Outlet Temperature Core Inlet Temperature 250.

._250 0

-30

-2b

-20

-ld

-l'0 b

o l

Tirie (minutes)

FIGURE 6.

Time History Plet A-11

O O

1

\\

\\

nV 1

\\'

f 1

1

\\

l NOTE: THIS DISPLAY PATTERN UNACCEPTABLE FOR AN SPDS l

f Assignment of variab'es to facial features for Chernoff faces Variable Facial Feature Power Size (half length) of eyes

)

Primary Flow Stant of eyes Cold Leg Temperature Eccentricity of eyes I

Delta Temperature Position of pupils Primary Pressure Separation of eyes Pressurizer Level IIcight of center of eyes Secondary Pressure Length of nose Secondary Feed Flow Ncse width Steam Control Valve Position Curvature of mouth Steam Generator Level Length of mouth Condr aser Pressure Position of center of mouth '

FIGURE 7 Chernoff Face Representation of an Abnormal Operating Condition A-12

l 1

4 Y

i X

t cosX + A sinX + A cos2X +...

A) + A2 3

4 Y

=

Where A, A,... are parameters j

2 NOTE: THIS DISPLAY PATTERN UNACCEPTABLE FOR AN SPDS FIGURE 8.

Linear Fourier Plot of Normal Operating Conditions A-13

-___.. ~_.

m__

_m 0

e oRM 335 U.S. NUCLE AR REGULATOR.Y COMMISSION (7 77)

BIBLIOGRAPHIC GATA SHEET NUREG-0835 j

4. TITLE AND SUBilTLE (Add Votume No., af eprepnaart
2. (Leave bim4/

Human Factors Acceptance Criteria for the Safety Parameter Display System

3. RECIPIENT *S ACCESSION NO.
7. AUTHOR (S)
5. DATE REPORT COMPLETED MONTH l YEAR

$eD tomhe r-1M1

9. PERFORMING ORGANIZATION NAME AND MAILING ADDRESS (/nclude I,p CodeJ DATE REPORT ISSUED Division of Human Factors Safet" Octo'ber l1981

"^"

Office of Nuclear Reactor Regulation 8 *"' **"*#

U. S. Nuclear Regulatory Commission Washington, D.C.

20555

8. (Leave Nank)
12. SPONSORING ORGANIZATION NAME AND MAILING ADDRESS (lactude 2,0 Codel
10. PROJECT / TASK / WORK UNIT NO.

j Division of Human cactors Safety Office of Nuclear Peactor Regulation

11. CONTRACT NO U. S. Nuclear Regult. tory Commission Washington, D. C.

205E5

13. TYPE OF REPORT PE RIOD COVE RED //nclusive daarsJ Draft Report for Comment
15. SUPPLEMENTARY NOTES
14. (Leave umk/
16. ABSTR ACT 200 words or less) l This report contains human f actors engineering design review acceptance criteria developed by the Human Factors Engineering Branch (HFEB) of the Nuclsar Regulatory Commission (NRC) to use in evaluating designs of the Safety 3

Parameter Display System (SPDS). These criteria were developed in response to the functional design criteria for the SPDS defined in NUREG-0696, Functional i

Criteria for Emergency Response Facilities.

The purpose of this report is to identify design review acceptance criteria for the SPDS installed in the control room of a nuclear power plant. Use of computer driven cathode ray tube (CRT) displays is anticipated. General acceptance criteria for displays of plant safety status information by the SPDS are developed.

In addition, specific SPDS review criteria corresponding to the SPDS functional criteria specified in NUREG-0696 are established.

These design review acceptance criteria define a basis for the NRC staff's l

human factors review of a Safety Parameter Display System. These review l

crite:ia do not impose any new functional design requirements.

17. KEY WORDS AND DOCUMENT ANALYSl$

17a. DESCRIPTORS i

17b. IDENTIFIERSIOPEN ENDED TERMS

18. AVAILABILITY STATEMENT
19. SE CURITY CLASS (TMs report)
21. NO. OF PAGES Unclassified
22. P RICE 2ogggT'iif4Sg (ms,,,,i Unlimited s

NRC FORM 335 (7 77) t

.,---r----

r s-

-.--.s r

,.-.-we--

, - - - - - - +

---+-..,.. -,

.---w e--

-e-

..-.--,-,.=-m..--

UNITED STATES F

]

NUCLE AR REGULATO2Y CCMMI?AION W ASHINGTON, D. C. 20SSS posvaes aseo Fans caen m

u.s. MuCLaan maoutavony OFFICI AL SUSINESS g

Conomessa ow FENALTY FOM PMlvATE USE,$300 L

J m

I CE>Z m>

120555064215 2 A:4 n

LS NRC O

ACM DOCU MEN T C ONT ROL DESK m

g'd PCR 016 W A SH INGTON DC 20555 nm "U

H>

ZOm O5 Hm m

O

D

- -4 Im t/)>

ri m

-44 m>

m>

Mm

-4 m

"D 9

50 r-><

(n<

cn

-4 mE OoHQ tDm "D

1

-

Retrieved from "https://kanterella.com/w/index.php?title=ML20032B155&oldid=4594597"