August 26, 2008

HSI Technology Evolution

and

Effects on Operators 
Overview

3⁄4 HSI technology evolution in new con

rooms will change some operator tas

3⁄4 This presentation highlights a few ke

areas for the US-APWR
Information & Controls Accessibili

3⁄4 All information and controls are easily acce

to each operator

9 Video Display Units with hundreds of display pa

• Menu selectable

9 Multi-division VDUs

• Control all safety divisions and non-safety fr

same VDU

3⁄4 Very different than the geographic distribut

instrumentation and controls on conventiopanels

9 One RO can monitor and control all plant functi9 With two ROs, the division of responsibility betw

ROs can be function based rather than system 

• For example, one RO can be responsible fo

systems (safety and non-safety) for controllisame function (eg. RCS inventory). 
Operational VDU – Screen Menu
Operational VDU - Monitoring
Operational VDU - Control
Operational VDU - Multi-Division
Automated Cross Channel Checks

3⁄4 Computers continuously perform cross cha

checks

9 Operators don’t need to do this anymore

3⁄4 Monitoring and control displays show one 

parameter, not four

9 Four are available on diagnostic level displays

3⁄4 Control systems use all channels

9 No effect from single channel failures

3⁄4 Operators respond to channel deviation ala

9 Check system level effect (usually none, Partia9 Confirm deviation9 Check Tech Spec LCOs9 Longer term action

• Maintenance work order
Automated Actuation Checks

3⁄4 Computers check correct actuation of all E

system components

• Pump start, valve line-up

9 Operators don’t need to do this anymore

3⁄4 Operators respond to “Not OK” alarms 

9 Confirm alternate train is “OK”, including perfor9 Longer term action 

• Confirm “Not OK” status• Restore to “OK” status • Maintenance work order
Large Display Panel

OK Monitor

Partial Trip Mo
Automated BISI

Bypassed or Inoperable Status Indication 

3⁄4 Computers monitor components for inoper

misalignment conditions

9 While in standby mode

3⁄4 Computers determine and display effects a

level

9 Operators don’t need to do this anymore

3⁄4 Operators respond to “Not Ok” alarms

9 Confirm “Not Ok”9 Check Tech Spec LCOs9 Longer term action 

• Restore to “OK” status • Maintenance order
Alarm Management

3⁄4 Alarm avalanche conditions are common in 

alarm systems

9 EOPs and training do not credit the alarm syste

3⁄4 Alarm avalanche conditions are significant

reduced by

9 Signal validation 

– based on automated cross channel checks

• One process alarm, not one for each divisio

9 Cause-consequence dependency logic

• Plant mode• Equipment mode

9 Prioritization logic

• Highlights degrading conditions

3⁄4 Allows the alarm system to be credited
Dynamic Alarm Priority Rules (1/3)

Higher prioritization rule

LOW

LOW-LOW

Charging Pump not used After Safety injection

Low alarm is displayed as Priority 1 (alarm tank level reduces to the Low-Low alarm se

LOW

LOW-LOW

When the level reaches the Low-Low alarm salarm is displayed as Priority 1 and the Low Priority 3 (status information). 
Dynamic Alarm Priority Rules (2/3)

TRIPPED

PressureLow

Charging Pump not used After Safety injection

Cause-consequence equipment rule

TRIPPED

PressureLow

A low discharge pressure alarm is displayed there is no cause for the alarm.

However, the low pressure alarm (“result” alaPriority 3 when the pump is stopped by the inalarm) which is displayed as Priority 1.
Dynamic Alarm Priority Rules (3/3)

Cause-consequence mode rule

A-CHP

OPEN

B-CHP

OPEN

ECCS

A-CHP

OPEN

B-CHP

OPEN

TRIPPED

TRIPPED

A charging pump trip is displayed at pris no cause for the alarm.

Charging pump trip alarms are regarded as Pinformation) when an ECCS signal is actuate

ECCS

ECCS

ECCS

TRIPPED
Degraded HSI Conditions

3⁄4 Current control rooms

9 HSI is an integral part of the plant systems and com

(eg. pumps, valves, instruments)

9 Operators train to cope with plant component failure

HSI failures

3⁄4 New control room

9 HSI redundancy to minimize the potential for failures9 If an unusual failure occurs, the effect can be much 

global (eg. complete VDU freeze)

• In addition to training operators for plant 

component/system failures, we must also train thHSI failures

• This is further complicated by NRC criteria for 

consideration of common cause failure

– Adds even more training for beyond design basis 

9 Degraded HSI may be the most significant operator 

challenge
Degraded HSI Conditions

Diver

HSI Pa

S
Summary

3⁄4 HSI technology evolution in new con

rooms will reduce routine operator taburden

3⁄4 Digital technology has proven highly 

reliable

3⁄4 Regardless, operators must be well t

for degraded HSI conditions