FI108815B - Advanced control room complex for a nuclear power plant - Google Patents

Description

108815 j

The present invention relates to apparatus and methods for monitoring and controlling the operation of commercial nuclear power plants.

Conventional commercial nuclear power plants have a central control unit 10, in which the operator has facilities for collecting, detecting, reading, comparing, copying, calculating, modifying, analyzing, confirming, monitoring and / or verifying data from a plurality of sensors and alarms. Normally the main operating systems of the control room are installed independently and also operate independently. Such systems include ί monitoring to control parts and processes of the plant, and control to intentionally modify or adjust parts or processes, as well as safety to identify a threat to the safety of the plant and to take immediate corrective action.

As a result of the organization and operation of such a conventional control room, the operator may sometimes be exposed to too much information or stimulation. Ts. amount of information and such According to 25 information, the large number and complexity of the equipment available to the operator may exceed the cognitive limits of the operator and thus cause errors.

The most famous example of the inability of operators to perceive and act upon the enormous amount of information 30 entering the control room, especially in unexpected or unusual power plant events, is the accident at the Three Mile Island Nuclear Power Plant in 1978. Since then, the industry has paid particular attention to improving the operation of power plants: .3.5 by improving the performance of the control room operator. The key to this development process is the design principles that adapt the work to people.

2 108815 i

Advances in computer technology since 1978 have given nuclear engineers and control room designers the ability to display more information in more than 5 different ways, but the effect can be counterproductive because too much information is part of the problem. Adding "user friendliness" while maintaining the amount and type of information available to the operator has created a difficult technical problem.

Therefore, it is an object of the present invention to provide an apparatus and method for nuclear power plant control and monitoring functions, which include compact data processing and presentation, reliable architecture and hardware, and easy maintenance of components while eliminating excessive information to the operator. This is achieved in combination with improved control room reliability, ease of use and lower overall cost.

The present invention solves this problem with a number of features that are new, both independent and interconnected, when they form a control room complex.

The complex has six main systems: (1) central control panel: 25 liters, (2) data processing system (DPS), (3) detector and alarm system (DIAS), (4) component control system consisting of protection component controllers (ESFC) and process component controllers (PCC) ), (5) power plant safety system (PPS), and (6) power control system (PCS). These six systems collect power plant information, effectively provide the required information to the operator, perform all automated operations and enable power plant components. direct manual control.

:, 3.5 The control complex of the present invention has: · /. a top-down unified data presentation and alarm system that supports the evaluation of critical aspects of power plant safety and power generation 3 108815. It guides the operator in locating the information needed for further diagnosis of important assessments. In addition, it significantly reduces the number of display devices required compared to conventional power station booms. The complex also reduces the amount of information the operator has to process at one time; it also reduces the impact of malfunctioning display devices. In addition, it eliminates the need for monitors that are only used in abnormal conditions at the power plant.

10

It is known that the steam system of a nuclear power plant can be kept in a safe, stable state by certain safety critical factors. The present invention extends the concept of power plant safety critical factors 15 to power plant power critical factors, such that combining these two sets of factors in operator knowledge supports all power and safety critical and critical factors.

At the top of the information presentation hierarchy of the present invention is a "main table", i.e., a Combined Process State Description (IPSO), which serves as a stand-alone location for rapidly evaluating key information related to power plant safety and power generation. Sources and directions for changes in normal or abnormal: 25 paint parameters can be found in ·· .: for more detail, see DIAS. Both IPSO and DIAS provide direct access to and guidance on system and component status information contained in the DPS-controlled CRT screen hierarchy.

30 IPSO continually displays information at specific locations, indicating the state of critical • factors for power plant safety and power generation. This information is represented by a few easy-to-understand symbols, which are obtained by:, 3.5 as a result of highly processed information. Therefore, the operator does not need to combine large amounts of individual parameter information, system or component status information and alarms 4 108815 to find out the operational status of the power plant. IPSO presents to the operator the high-level effects of low-level component problems. The format of the IPSO key data is primarily based on the direction of the parameter change, i.e. higher / lower, and the shape and color of the alarm symbol. These are supplemented with the values of the selected parameters.

The IPSO provides aggregated and simplified information to the operator in small amounts and in a form that is easy to perceive and understand.

10

In addition, the IPSO eliminates the drawbacks of current industry trends in presenting all information in serial form on CRT displays, allowing the operator to obtain an overall view or "feel" of the power plant status. A general presentation of the status of the 15 power plants on the large, dedicated display brings two other aspects. First, the operator's tasks often require detailed diagnoses in very limited process areas. However, it is necessary to keep records of the operation of the entire power plant at the same time. Rather than supervising several operators in the control room with similar detectors or similarly separated panels, the IPSO can be seen throughout the control room and thus provides the operator with continuous information on the overall operation of the power plant, regardless of the detailed nature of its task.

In a preferred embodiment, the IPSO supports the evaluation of critical factors of power generation and safety by providing key status parameters for each of these factors. For each factor, paths are selected based on the status of the route shown. IPSO clearly links the factors to the physical reality of the power plant. Critical factors apply to power generation, normal reactor shutdowns, and optimal recovery methods.

;, Is

The second level of the data presentation hierarchy of the present invention is the presentation of power alarms from DIAS. A limited number of fixed, discrete tiles with three different alert priority levels are used herein. Dynamic Alarm Handling utilizes power plant status information (eg reactor power, reactor trip, fuel change, shutdown 5, etc.) as well as system and equipment status to eliminate unnecessary and redundant alarms that could contribute to excessive operator exposure. The alarm system provides easy-to-understand guidance on additional information contained in separate detectors, 10 CRT displays and controls. The alarms are based on validated data, so the alarms tell you about the actual process problems at the power plant, not about instrument or control system failures.

15 Alarm features include a detailed message to the operator through the window when an alarm is acknowledged and the ability to combine alarms without losing individual messages. Alarm panels can dynamically display different priorities to the operator. The reset method ensures that all alarms are reset, but at the same time reduces the operator's workload by first emitting a short beep! and then a continuous alarm followed by a reminder tone ;;;; to ensure that the alarm has not been forgotten. The operator; ·; the market may temporarily interrupt the alarm flicker: 25 to prevent visual overload, and restore the flicker to ensure that the alarm is eventually reset.

The I * DIAS detectors constitute the third display level of the hierarchy of the present invention. Plane panel displays 30 compress a plurality of signal sources into a limited set of readers that regularly monitor key plant information. Verification of signals and automatic selection of the • most accurate detectors within the signal range are used to reduce the number of detectors on the control panels. Data readings •, 3.5 are obtained from the touch screen for improved operator interaction and include numerical parameter values, bar-format analog display and dot plot.

6 108815

Multiple range sensors are available on a single screen with automatic sensor and display area selection. The automatic calculation of the parameter value of the correct process representation, together with a plurality of single sensor readings available on the same display, reduces the need for separate additional displays or the need to keep different displays for normal operation and an accident or subsequent situation.

10

A further advantage of the present invention is that the parameter check automatically detects a faulty sensor or a plurality of faulty sensors, while allowing continuous operation and accident mitigation information to arrive to the operator even if a CRT display is not available. Further, normal display information may be attached to an approved sensor, such as may be used, for example, for monitoring purposes following an accident.

20 At the level of information display for controlling certain components, there are dynamic "soft" controllers that contain]! component status information and control signal information provided by the; - ;; the rotator needs to control these components. In the ESFC system, this information includes a status light, on / off switches, • modulation switches, on / off switches, and logic controllers. In the PCCS, this information includes load, setpoints, operating range, process values, and output of control signals.

The dynamic CRT monitor pages on the fourth level of the data hierarchy complement all locally specific controllers and information and can be accessed from any CRT monitor in a control room, technical support center, or alarm room. These displays are organized into a three-level hierarchy consisting of: .3.5 general monitoring (level 1), control of power plant components and systems (level 2), and component / process diagnosis (level 3). The implementation of the displays is controlled by DPS, and it is dual I 108815 7! Simplifies and secures all handling of individual DIAS alarms and detectors.

In a preferred embodiment of the present invention, the detection, alarm and control functions associated with a particular major area of operation of the power plant 5 are grouped into a single modular panel. Cuts can be made to the panel, with positions that determine the position of the detectors, alarms, controls, and CRT, regardless of the power plant's operating system. This allows 10 panels to be delivered, installed, and pre-tested before power plant-specific logic and algorithms are finalized, which can be programmatically modified at a later stage of the power plant construction schedule. Such a block structure can be achieved because the space required by the panel is essentially independent of the main system of operation of the power plant.

Both alarms and detectors can be easily modified by software. The available space of the panel does not significantly limit the number of alarm and detector tiles that can be displayed to the operator, so it is possible to standardize the size and intersection of the panel for display windows.

k t * *

The foregoing and other objects and advantages of the present invention will be described in connection with the preferred embodiment with reference to the accompanying drawings.

Figure 1 is a view of a nuclear power plant control unit according to the present invention.

Figures 2 (a) and 2 (b) together define a schematic representation of the system internal communication related to the invention.

Figures 3 (a) and 3 (b) show a first type and Figures 3 (c) and 3 (d) show a second type of modular panel according to an aspect of the invention.

', 3.5 Fig. 4 shows a primary system display page directory on a CRT display according to the invention.

•> * 8 108815

Figures 5 and 6 show preferred component symbols and shape codes used in accordance with the invention on CRT and IPSO displays.

Figure 7 is a typical detector display with graph 5 according to the invention for pressure and level of the pressurizer.

Figure 8 is an indicator display associated with the detector of Figure 7 for a system pressure and level menu page.

Fig. 9 is a schematic representation of the manner in which alarms are presented in accordance with the present invention.

Fig. 10 is a typical display page according to the present invention showing an alarm in a menu option of a first level display page.

Figure 11 is a schematic summary of the workstations of the complex 15 shown in Figure 1, which are classified in the first level display group.

Fig. 12 illustrates a typical display page directory which displays display pages containing alarm information.

Figure 13 illustrates information supporting an alarm on a CRT after the alarm has been acknowledged.

Fig. 14 shows a television classified alert list on the CRT screen used by the operator.

«· !! '. Fig. 15 is a typical alarm slab combination with reactor cooling system and sealed alarm slabs, related to detector and alarm systems.

Figure 16 shows an alarm panel display of the reactor cooling pumps with one panel activated.

Fig. 17 shows the alarm display of Fig. 16 after acknowledgment of an activated alarm.

Figure 18 illustrates an alarm display that is displayed by the operator: by touching the alarm status information area shown in Figure 17.

Fig. 19 shows a CRT display of a primary system.

Fig. 20 shows a CRT display of a second level page based on a first level page shown in Fig. 19.

Figure 21 shows a third level display page obtained from the second level page shown in Figure 20.

9 108815

Figure 22 illustrates and explains menu selection ranges for CRT display screens.

Figure 23 illustrates a typical CRT display page corresponding to alarm plaque presentations.

Fig. 24 is a diagram showing the hierarchical relationships of CRT display pages.

Figure 25 illustrates an Integrated Process State Display (IPSO). Figure 26 is a schematic representation of symbols illustrating directional information for IPSO parameters.

Figure 27 is a schematic representation of the integrated data representation of the present invention.

Fig. 28 is a block diagram associated with Fig. 2 illustrating the relationships between the main control room systems of the present invention.

Fig. 29 is a block diagram illustrating the present invention! Inputs and outputs associated with the detector and alarm systems in accordance with.

Fig. 30 is a schematic representation of the use of checked sensor data for monitoring and controlling according to the present invention.

Fig. 31 is a functional diagram of a technical security system and component control system, preferably having * * 11 * connections according to the present invention.

; 'l FIG. 32 illustrates a typical screen page index associated with • ♦ * · 25 critical factors control that may be displayed. i by means of a data processing system according to the present invention.

Figure 33 shows a first level critical factor screen associated with the hierarchy shown in Figure 32.

Figure 34 shows a first level critical factor screen after visiting the reactor.

! Figure 35 illustrates a typical second level critical factor display screen associated with an inventory control system.

Figures 36 (a) and 36 (b) are schematic representations of a typical prior art instrumentation and control design process, and an accelerated design process that is possible using the present invention.

I I

10 108815 modular panels according to the invention, respectively.

Figure 37 shows a separate hot and cold primary loop temperature indicator display showing all sensors used in the counting algorithm.

Figure 38 is a summary of the types of sensors used to determine the pressure of the pressurizer and the way they are used to determine the pressure value representative.

10 I. Overview of the Control Complex II. Panel Overview A. Alarm and Messages B. Detector

C. CRT

15 D. Controller E. Display Models F. Display Assembly

III. DIAS

A. Discrete Detectors 20 B. Actual Algorithm Adder: C. Alarm Processing and Display 1. Space and Device Dependency: '": 2. Sub Functionality Group 3. Shape and Color Coding 25 4. Alarms in CRT 5. Alarm Definition 6. Alarm Confirmation

IV. DPS

A. CRT

30 B. IPSO ...: V. Volume Component VI. Panel Modularity APPENDIX (Functional Algorithm) 3-5 Figure 1 shows a control panel complex according to a preferred embodiment of the present invention. At the core of the main control room 10 is the main control console 12, which allows one person to operate the nuclear power plant's steam system from a hot shutdown to a full power production mode. It should be noted that the control room described herein and its apparatus and methods may be used in connection with light water reactors, heavy water reactors, hot gas cooled reactors, liquid metal reactors and advanced passive light water reactors, but for practical reasons this description is based on N

10 The main control console 12 of such an NSSS typically has five panels, one for each of the following system components: a reactor cooling system (RCS) 14, a chemical control system (CVCS) 16, a nuclear reactor core 18, a feedwater and sealing system (FWCS) 20 and a turbine system 22. 15 will be described in more detail later, the monitoring and control of these five power plant systems will be handled by the respective panel of the main control console.

Immediately behind and above the reactor core control and control panel 20 is a large table or display 24 where! displaying a combined process state overview (IPSO). As a result, the operator can easily see five panels and an IPSO board: while sitting or standing in the center of the main console.

• 25 To the left of the main control console is a security-related console 26, which typically includes modules related to security monitoring, technical security, cooling water, and related functions. On the right side of the main control console is an external system console 28, which includes modules related to the secondary circuit, auxiliary power supply and diesel generator, switching field and heating and ventilation systems.

I * ·. ·· *. It is recommended that the power station computer 30 3-5 and the mass storage devices 32 associated with the control room be placed in separate equipment rooms 31 to improve fire safety and sabotage. ' ·: Protect.

12 108815

The control room complex 10 also includes a supervisor office 34 with full view of the control room, a technical support center (TSC) 36 and an out-of-control observation level, and 5 external offices 38, which can handle power station-related paperwork. The furniture of the control room shall be placed as appropriate for the operations of the operators. There is also a remote fire extinguishing room 42 (Figure 2) for post-accident monitoring (PAM).

10

Figure 2 is a schematic representation of the links between power plant components and sensors, which are considered conventional herein, and panels of the main control room. From Figure 2, it is clear that the information flows in both directions through the dashed line 46, which 15 represents the boundary between the steam system of the power plant and the turbine system. The NSSS status information and sensor information 48 used in the power plant security system 50 and the PAMS 58 passes directly through the NSSS boundary 46. The control signals 52 from the power control system pass directly through the NSSS boundary. Other control-system system signals 60, 62 from technical safety device control system 56 and normal process: V component control system 64 are connected across NSSS boundary by remote multiplexers 6. Power plant security system, ESF component control system, process component control system, power control system and the PAMrt is connected to a central control room 42, to each other, to a data processing system (DPS) 70 and to a dedicated detector and alarm system (DIAS) 72.

Figure 2 illustrates a significant feature of the present invention, which is the combination of monitoring, control, and safety information under both normal and accident conditions, so as to greatly assist the operator in determining the appropriate mode of operation. The following sections describe in more detail how this was achieved.

, /? 5 * 'II. Panel Overview 13 108815

Figures 3 (a) and 3 (b) show diagrams of a standing / sitting panel, such as a reactor cooling system panel 14 located in the main control console 12 according to one embodiment of the present invention. Figures 3 (c) and 3 (d) illustrate an alternative embodiment, whose panel is only used when standing. The substantially flat top or wall 74 of the panel is positioned upright and the substantially flat bottom or table is substantially horizontal. The control and alarm connections are at the top and the control connections are at the bottom 10.

A. Emergency Messages The alarm functionality (see Figures 9, 15-18) includes an alarm-15 and a message interface (A&M) 78 with a plurality of tiles 80 each bearing a specific letter word, an acronym or equivalent reference 81. The alarm status is indicated by tile illumination and a beep. The operator must acknowledge the alarm either by pressing a plate or by any other method designed for this purpose. The number of tiles in a given panel depends on the number of different alarm conditions that may be generated by the system being monitored, i.e., the cooling system. Typically, each panel has hundreds of S '· * tiles. An alarm is classified into three (3) different • 25 alarm categories (Priority 1, Priority 2, Priority 3, which means immediate action, prompt action and higher alertness). The alarms on this RCS panel depend on the state of the equipment (Normal RCS, Heating / Cooling, Cold Shutting / Refueling and Reactor 30 trip). If a high priority alarm activates a lower priority alarm related to the same parameter, the lower priority alarm automatically disappears. As conditions improve, the higher priority alarm will blink and • I t will sound a reset tone. The operator acknowledges the disappearance of the high priority · 3 · 5 alarms. If the lower priority alarm still exists, its alarm window or detector switches to 14 108815 acknowledged state when the operator acknowledges the exit of the higher priority alarm.

B. Indicator 5

The second monitoring interface consists of process variable indicators, such as reactor coolant temperature, pressure ice level and pressure, and other RCS parameters. Separate detectors 82 (see also Figures 7 and 8) provide a better method for presenting the parameters of the RCS panel 10. Some RCS panel parameters require a constantly updated display and graph for the master control console. Power plant process and class 1 parameters such as pressure level and RCS coolant temperature fall into this class. Other RCS panel parameters are used less frequently. The operational parameters are obtained from the detectors 82 if the data processing system (CRT displays) is not available. These include the Class 1 and 2 parameters of Regulation 1.97 (Regulatory Guide), Priority 1 and 2 alarms, and other 20 operationally necessary parameters that are locally available • * ♦: in the worm and need to be monitored by the operator when information is received. : The V Processing System is inactive for a maximum of twenty four (24) hours. These less frequently monitored parameters are: available in stand-alone detectors, which the operator displays at $ -5 by selecting the appropriate menu. The menu displays the available information in alphabetical order. No separate indicators are required for the parameters displayed in the process controllers.

C. CRT

po

In addition, the CRT display 84 provides a view of the main vessels, pipes, pumps, valves, etc., associated with the reactor cooling system, for example, and displays alarms and values of parameters that may appear as bar, graph, / 35, or otherwise on other displays 78, 82 (see Figures 4-6, 10, 12-14 and 19-23). From this CRT screen, all NSSS information is available to the operator. This information is presented as a 15 108815 three-level hierarchy that is consistent with the operator's perception of the system. Figure 4 shows the primary page of the NSSS page directory 84, which contains all CRT pages of functions associated with the RCS panel.

5 D. Controller

The control portion 76 of panel 14 has a plurality of separate on / off switches on the left side. Each switch pattern 10 is associated with a particular reactor cooling pump, the supply parameters of which are immediately above. It also has analog controls, which can be conventional rotary knobs or the like (not shown), or a touch screen or 88 controlled single control.

I 15 | The RCS has process controls to enable the operator to control the process control loops in the country manually or automatically. Process controllers allow throttling or multi-position control devices (e.g., electro-pneumatic valves) on the control pin-20 from a single control panel. Process controllers are used to control: j: closed loop I of the following RCS process variables: pressure level, pressure ice pressure, RCT seal flow: and RCT seal temperature. Process controllers are designed for each control loop individually, using a uniform 35 display groups and control features.

• I

In a conventional control room, each process control loop has its own control device, commonly referred to as the MANUAL / AUTO station. For example, the RCP sealing area system has 30 five process control loops: one seal flow control loop for each of the four RCPs and a seal temperature control loop for the entire subsystem. Each of these five control loops has its own MANUAL / AUTO drive, which takes up a large amount of control panel space and makes comparisons between loops 3 * 5 clumsy. Although these five process- :. is controlled independently, the process changes of one wizard affect the other four parameters. In conventional MANUAL / AUTO 16 108815 stations, it is difficult for the operator to operate simultaneously with all five MANUAL / AUTO stations.

The process controllers for similar processes (which are related to either the action pins or the system) are used by the RCS panel process controllers from a single control station called a process controller. Such a single controller saves panel space, utilizes appropriate cross-channel checking, and allows for easier interactions between the process loops of several interrelated processes.

Component control capabilities (i.e., activation of switch controllers) are the primary method by which an operator activates devices and systems from an RCS panel. The RCS panel has 15 forty-three components controlled by instantaneous switches. Each switch has a red status indicator for active or open mode and a green status indicator for passive or closed mode. The blue status indicators / switches are used to detect and select an automatic control or a process controller control. In addition to color coding, the red switch is always set above the green switch \: V to enhance color separation. Each switch • «t produces an active control signal when pressed, and each switch is inactive when not pressed. Each switch has a backlight to indicate the status of the device.

• · · f »I I» E. Patterns of Nutters

Process display templates are used to map data for similar processes and devices. Liquid system representations 1 * are always standardized wherever possible: top * · »down, left to right while avoiding junctions. Incoming; and outbound flow paths are set to margins. The data related to one of the »* t. ·· * groups are grouped together for comparative purposes, operating order, / 3 · 5 operations and operating frequency according to: * analysis specification. Process representations / presentations are based on the operator's perception of the process, 17 108815 to maximize the power of his data collection functions. The operator's image of the system is often based on the schematics used in the training material and power plant design documentation related to the system descriptions.

5 Graphical information is represented by display page templates, which facilitates rapid perception of processes. Graphical information consists of the use of columns, flow charts and graphs (eg over time, or pressure versus temperature).

10 Bar charts are primarily used to represent flows, pressures and levels. As the plane is associated with the container, the bar graph is placed at the appropriate position within the container symbol. Plane bar graphs are vertical. If a flow chart is used to represent the flow, it is placed horizontally. Bar charts also facilitate comparison of numerical quantities.

Flowcharts are used when they can enhance the operator's image of the process. Flowcharts facilitate understanding of control systems such as turbine control systems. Operator training material related to process control systems is often in the form of a flowchart and therefore a similar design of the <* »display page is easy to perceive.

# * · * 1h »» ^ 5 Time graphs are used on screen pages when the * * * *; Y analysis indicates that the operator needs to know the parameter changes over time. In addition, the operator can create time plots from any location on the power plant computer database. In some cases, task analysis may indicate ^ 0 that multiple time graphs are needed for process comparisons ;;; control. In some situations, eg 1 heating / cooling curves, two parameters can be set differently; ordinaattiakseleille.

* * * ,, 35 If there are multiple time plots on the same coordinate axis, • * two vertical axes can be used for parameters with different units. The scale markings can be set in 1, 2, 5 or 10 108815 i 18 i t increments. Smaller marks between scale marks can also be set in 1, 2 5 or 10 increments. The time-varying parameter is typically displayed on the screen every 30 minutes. However, the operator door adjusts the scales according to your needs 5. Logarithmic scales can be constructed using ten multiples. If the total range of the parameter is less than 10, place a punctuation mark near the center of the scale.

Time graphs in the same coordinate system use different 10 colors. If multiple curves use the same scale, the scale is gray and the curves are color coded. If different scales are used for coordinate axes, they are coded with the same colors as the corresponding curves. Time graphs do not use alarm colors or normal mode colors to avoid mixing 15 process parameters with the alarm or normal conditions.

The colors help the operator to differentiate between different types of information. Because the benefits of color coding are clearer when used with fewer colors, the color coding of information displays (i.e., IPSO, CRTs, alarm panels) is limited to seven colors. In addition, color-coded data has other properties that. facilitating data segregation and color discrepancy. ·, Observer activity.

25

The following colors are used in information screens to represent the following types of information. The colors have been carefully selected so that red / green colored persons can see a sufficiently large difference between the colors.

30

Black Background Color: · Green Component Off / Inactive, Valve Closed and Working

Red Component on / activated, valve open 35 and working

Yellow Alarm Mode - a color with a high spotlight of 19 108815

Gray Text, markup, dash, menu option, pipe, inaccessible and un-instrumented valve, graph scale, and other non-coding applications.

Light blue Values for process parameters

White System response to operator touch, eg menu option, until system responds as expected.

10

The information system uses shape coding to help the operator identify the component type, functional state and alarm state. The shape coding of the components is based on symbol research, which included questionnaires for nuclear power plant personnel. Figures 5 and 6 show the forms used to represent components in a control room. The shape property, hollow / full, indicates the state of the component. The hollow shape code indicates that the component is active, while the filled shape code represents the passive component. The following is a pre-20 indication of the shape coding of the pump and valve.

Pump A hollow pump indicates that the pump has been activated by an operator or an automatic control signal. A full pump indicates that the pump has been shut down by an operator or an automatic control-25 signal.

Valve A hollow valve indicates that the valve is completely '!' open and full valve indicates the valve is fully closed. The shape of the valve, which is not fully open or closed, is an intermediate form of a solid and a hollow 30, i.e. the left side is full and the right side is hollow.

The following features have been added to the valve coding format: - 35 Valve open and available - Red color code.

Valve Closed and Available - Green color code.

20 108815

To Instrument Valve - Gray Color Code (Operator-Entered Position).

Valve Not Available - Gray color code with 5 alarm codes.

Absence of indicator - Gray color code with alarm code and combined hollow / full shape.

F. Loss of paternity 10

Safety-related information is integrated into control room information to enable the operator to use safety-related information wherever possible during normal operation. For human factors, this is a better method because in stressful situations people tend to use the information that is most familiar to them.

In many situations, the security-related parameters are only a subset of the parameters that control a particular process variable. Existing control room operators typically only use control indicators during process control, and must use separate safety-related indicators to monitor plant safety aspects. In the present invention, the parameters typically used for monitoring and control are compared for safety purposes, if any, to safety parameters. If the parameter deviates from the safety parameter beyond the expected values, the operator will receive an alarm to confirm. In response to such an alarm situation, the operator may view the individual channels associated with the parameter 30 on a diagnostic CRT page or with a separate indicator displaying the parameter. The operator receives a notification when the validation algorithm is able to validate the data. The result of the check algorithms is used in the IPSO, V single detector in the normally displayed model, and on the higher level display pages of the CRT display system with parameter 35. Class 1 information in regulation 1.97 is also shown on 21 108815 with a separate indicator display in one location on the security control panel.

Critical function and action path (availability and action) information is available throughout the data hierarchy (see Figures 10, 24, 25, 26, 27, 32-35). Priority 1 alarms indicate to the operator the inability to maintain a critical function or the inability of the operating path to meet the minimum functional requirements. The lower priority alarms indicate the failure or malfunction of subsystems and components.

15 In the Critical Functions Matrix, IPSO provides general information that is most useful to the operator in evaluating critical functions. Priority 1 alarms related to critical functions or paths are displayed in the IPSO critical function matrix. The support information associated with these alarm conditions is obtained from the alarm panels or the critical functions area of the CRT display hierarchy. The Critical Functions area of the display page hierarchy contains. the following information. Level 1 Screen - "Critical Functions": This page provides more detailed information about IPSON,! '! 25 of the critical functions matrix. In particular, the details of the alarm conditions (ID, priority). This guides the operator to the right of the level two critical functions screen.

Each of the 12 critical functions has its own second level page. Each page contains: ··· - The first level associated with the critical function · Information about the critical function of the screen page.

Information related to path availability and the operation of paths supporting a critical function 35.

High-level information represented in a critical function / path way.

; 108815 i 22 j

Snapshot of most descriptive critical function parameter.

The third level display pages 5 of the Critical Function Hierarchy are copies of the other pages in the hierarchy. For example, the security spray screen under the warehouse control is also in the primary area of the screen hierarchy.

III. SEPARATE LIGHTING AND ALARM SYSTEM 10 A. Separate Detectors

Separate detectors 82 provide a better method for presenting security-related parameters. The most important process-process parameters, such as Class 1 of Instruction 1.97, require 15 continuously updated displays and time graphs on the Master Control Sol. Separate detectors also handle the detection of alarms and alarms when data processing system (DPS) is not available. These parameters include Class 20, Class 1, 2 and 3 of Regulation 1.97, Priority 1 and 2 alarms, and other parameters that are constantly monitored. Although DPS is a very reliable and multiple computer system, you should be prepared for: .i. 24 hours inactivity. The less frequently monitored parameters are obtained from the individual detectors via the operator 25 selectable menu.

• ♦ ·

Each detector is capable of displaying a number of parameters related to a component, system or process. Standalone eyepieces have different display models, which are tailored to the specific information needs of 30 operators.

When monitoring or controlling a process such as the pressure of a pressurizer, for example, it is desirable for the operator to use the highest value of "process» * representative "90 in field 92. 35 for information, the detector 82, as shown in Figures 7 "· and 8, displays a bold digital value and an analog bar graph 94 based on a verified average of the most accurate area sensors I 1> 23 108815. Comparison with PAMI sensors, where available.

5 The detector can also be used for post-accident monitoring if this is compatible with PAMI as stated in field 96. This has the advantage that the operator can continue to use the detector he is most familiar with and used daily. The operator may, if desired, observe any of the 10 independent channels on the digital display of the detector by touching an individualization sensor, e.g., 102. The use of checked parameters is advantageous for operators as it reduces their stimulus and task load resulting from multiple detector channels representing one parameter.

!

If the parameter cannot be checked, the detector detects the reading of the sensor closest to the last value checked. In such a situation, an inspection alert will be given. The separate Sil-20 maize will continue to display the value of this sensor until the operator selects another value for the detector. Separate detector! »· ·: · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · In such circumstances, the value has not been checked and has been selected by the computer. This means that the operator should identify available ·· sensors that can be used as “process agents”. If the operator selects a sensor (which is allowed when a check error occurs or the "VALID" signal does not conform to PAMI), the content of the field containing "FAULT SEL" will be replaced by "OPERATOR SELECT". ". When the check algorithm is able to check the data and all faults have been cleared, ·; ·: The check error alarm is cleared and the algorithm changes field 92

"PROCESS produced by" FAULT SELECT "or" OPERATOR SELECT "

»* To" CALCULATED SIGNAL "of" VALID "of REPRESENTATION.

> · '· 35' / '· Separate detectors also provide the parameters needed to: · monitor overall power plant processes or priority 1 and »<> I · I« 24 108815 2 alarms. Normally, the most descriptive process-parameter is displayed. Menu options allow the operator to view other process related parameters.

5 The RCS panel is equipped with ten detectors. These are:

1. RCP IA

2. RCP IB

3. RCP 2A

10 4. RCP 2B

5. RCP SealBleed (seal leak)

6. RCS

7 * Thot 8 * Tcold 15 9. Pressure of the pressurizer 10. Level of the pressurizer

Figure 7 shows that two interconnected discrete detectors may be represented by a single actuator 82. The left half-mass of the display 82 shows the checked pressure of the pressurizer. The pressure display has the following: digital "process representative" 1 * value with 90 units (2254 psig), display quality 96 (VALID), notification 98 that the display is valid for post-accident monitoring (PAMI), process value as a bar graph 94, 30 minutes \ 25 time graph 104, normal operating range (NORMAL) 106, instrumentation range (1500-2000) and bar graph unit of measure (psig).

In the upper right corner of the PRESS screen, there are two buttons, "CRT" and 30 "MENU", which touch the selected button to light up the selection. mark. When the operator releases his hand from the button, the selection is processed. The CRT button 84 changes the menu options of the CRT display placed in the same panel as the standalone indicator when the button is pressed, e.g., the RCS panel 14 as shown in Figure 3. The CRT button searches the CRT display pages that best match the standalone indicator parameters.

25 108815 Press the MENU button to select the detector menu (Fig. 8). The top of the menu page is usually similar to a normal screen. It includes a digital "process representation" value of 90 units (2254 psig), display quality (VALID), 5 notifications that the display is valid for post-accident monitoring (PAMI), and CRT and MENU buttons.

At the bottom of the menu page are selection buttons, such as 102, for all sensor inputs and "computational 10 signals" of this detector. Selection buttons light up when pressed to indicate selection. When the operator releases his finger, the selection is processed. There are 13 buttons for pressure: four for a pressure of 0-1600 psig: P-103, P-104, P-105 and P-106? six pressurizers for 1500 to 2500 psig: P-15 101A, P-101B, P-101C and P-101D, P-100X and P-100Y; two for RCS pressure of 0-4000 psig: P-1090A and P-109B; and one "calculated signal" for pressure: CALC PRESS. When the "Calc Press" button is selected, the pressure corresponding to the "computed signal" (i.e. output of the algorithm) is displayed. The "calculated signal" of the algorithm can be 20 "valid" signals. If the algorithm failed and selected one sensor as the "calculated signal", the "valid" message would be · · replaced by a "fault select" message. This "fault select" message would appear as inverse in the detector.

I «I

This message would appear in the detector each time "CALC PRESS": 25 is selected until the algorithm provides a "checked signal" to replace the value of the "FAULT SELECT" sensor.

I t I

To change the display, the operator touches the button that contains the sensor he wants. For example, touching a button labeled "P-30 103" will display the P-103 reading within the range 0-1600 psig on the digital display.

;; The message "VALID" below the digital value changes to "P-103". Additionally, the "PAMI" message is cleared because the P-103 is not a PAMI sensor.

• 35

The "ANAL / ALARM OPER SEL" button selects the signal used by the DIAS

> uses "process agent". It sets I 26 108815 to the current sensor on the digital display. The signal select button allows the operator to select "sensor selection" for any sensor for analog display and alarm processing if, for example, the following 5 faults are present: 1. If the check fails and a "fault selection" sensor is selected as the "process representative".

2. If the "checked" reading does not match the PAMI detector (s).

10

If the fault is present and the operator wishes to select the P-103 as a "process agent", he selects this menu, selects the P-103 for display and then touches the "ANAL / ALARM OPER SEL" button. The message underneath the digital display in field 96 15 becomes inverted "P-103 OP SEL". Whenever the P-103 is selected for display, it has a reverse text message "OP SEL" which indicates that the P-103 reading is used as a "process representative". After setting the sensor as a "process representative" by "operator selection", the operator is expected to press 20 buttons labeled "ANALOG DISPLAY". This will come back ... an operator-selected sensor on the analog display 94 and the time slice display 107 (Fig. 7) with the message "OPER SEL" printed in reverse text.

/ 25 There is usually no "ANAL / -ALARM OPER SEL" button on the detector menu pages; it will be displayed automatically when "carrier selection" is possible after a fault. The "ANAL / ALARM OPER SEL" button exits the menu page when "operator selection" is disabled after all faults have been cleared.

30 "ANALOG DISPLAY" button removes and replaces the menu page ;;; a bar chart (analogue) of any sensor or "process representation" (usually "valid") and "time": "by 35".

27 108815

The other detectors of the process parameters being checked work in the same way.

Menu-guided detectors include all level 5 1 and level 2 displays in the detection function groups.

B. Decrease Decrease Adder

A generic inspection algorithm is used to reduce operator workload and stimulus volume. The algorithm takes the readings of all sensors that measure the same parameter and produces a single output that represents that particular parameter. parameter and is called a "process agent". Generic verification is used because it is well understood by operators. Therefore, the operator does not have to ask where each parameter value checked originates from.

The generic algorithm calculates the average of all sensors [(A, B, C and D) (the number of sensors can be parameter-specific)] and checks the deviation of all sensors from the mean. If ... tolerances are acceptable, the mean is used as a "process representative" and a "checked" signal. If not all sensors pass the mean deviation test, the most abnormal probe will be removed and the remaining ones counted. · Average of 25 sensors. When all the sensors used in the mean calculation pass the mean deviation test, the average is used as "audited process representative". The deviation of the "process representative" from the sensors of the post-accident monitoring system (if any) is then determined. If this second deviation check is passed, this "process agent" will be printed along with the "Valid PAMI" message. This means that the signal can be used for emergency monitoring because it is within the value specified by the PAMI sensors. As long as this uniformity 35 is maintained, this detector can be used for post-accident monitoring instead of a specific PAMI detector. This brings with it the benefit of the human factor, since the operator is able to utilize the detector he normally uses daily, which he is most familiar with.

The validation process described below shortens the time it takes for operators to perform tasks related to key process parameters. To keep the data up to date, all readings to be checked are recalculated at least every second. In addition, the computing equipment has been multiplied and distributed to increase reliability.

10

The following section describes the algorithms and displays processing for DIAS and CRT displays.

1. "Process Agent" is always displayed on the appropriate DIAS screen 15 and / or CRT page (s) when a single "Process Agent" is required instead of multiple sensor values. Each process parameter in the power plant is evaluated individually to determine the type of display required and its location (DIAS and CRT or CRT only).

20 2. "Process Agent" is always a "checked" value unless it is: a. "Fault Selection" value.

b. The value of "carrier selection".

3. "Process Agent" is always used for alarm calculations and '25 time graphs (when a single time graph has a single value). This may be a "checked", "fault selection" or "operator selection" value depending on the results of the calculation algorithm described below.

4. The operator can view any value (A, B, C, D or 30 computed values) via the DIAS or CRT display menu without changing the "process agent".

5. The "Fault Select" value is automatically displayed as "Process representation" if the valid algorithm cannot provide a "valid" value. The value of "Fault select" is the value read by the sensor:: 35 whose value is closest to the last "valid" signal before the validation fails. In DIAS (if the parameter in question is displayed there) such information is indicated by the message "fault 29 108815 select". On the graphic pages of the CRT screen (s), this information is preceded by a multiplication sign (*), which indicates suspicious information.

5 "Fault Select" "process representation" is automatically reset to "valid" "process representation" if the valid algorithm is unable to compute "valid" data.

6. The sensor can be selected by "operator selection" as a "process 10 representative" only when there is a: a. "Inspection error" or b. "PAMI error".

The "process representative" selected by "operator selection" replaces the "process representative 15" produced by "checked" or "fault selection". In DIAS (if the parameter in question is displayed there) such information is marked with the message "operator select". On CRT screens, such information is preceded by a multiplication sign (*) and is designated "operator select" in the database. The "pro-20 process agent" generated by "operator selection" automatically returns to the "checked" "process agent" when both the "control error" and the "PAMI error" are removed.

It should be noted that separate checks are performed using a generic algorithm suitable for different parameter '25s. In this way, the operators understand how each parameter reading checked is determined, thereby enhancing their confidence. This algorithm always gives some result and gives the operator the choice of display if checking is not possible. Although detectors display all the vital information at all times, they also allow the operator easy access to less frequently needed information through an organized menu system. No separate back-up screens are needed at all, as the back-up screens are included in the data retrieval: 35 parallel levels. Such displays significantly reduce the number of detector slots required on the panel, while at the same time displaying all the necessary detectors in a simple form, reducing the stimulus load.

The enclosed Appendix, together with Figures 37 and 38, provides 5 additional details on the recommended implementation of the algorithm.

C. Alarm Handling and Display:

Another feature associated with each panel is the reduction in the number of alarms produced to minimize the operator information load. The interchannel signal check is performed before the alarm is generated, and the alarm logic and set points are consistent with the power plant operating mode.

The alarms are represented by certain visual identifiers according to the priority of the response required of the 15 operators. For example, Priority 1 requires immediate action, Priority 2 requires prompt action, Priority 3 requires alertness, and Priority 4, or operator support, is only status information.

20

Below are the types of alarm conditions for each category.

!!! Priority 1 1. Conditions that may cause reactor shutdown in less than 10 minutes.

2. Conditions that can cause serious damage to equipment.

3. Threat to personnel, radiation hazard.

4. Critical security breach.

30 5. Immediate technical action is required.

6. Reactor / turbine trip.

Priority 2 1. Conditions that may cause reactor shutdown in more than 10 minutes.

, 35 2. Situations requiring technical measures not covered by Priority 1.

3. Possibility of equipment damage.

) 3i 10881 5

Priority 3 1. Sensor offsets.

2. Equipment Deviations.

3. Device / process deviations that are not critical to operation 5.

The alarms are displayed in such a way that the operator can easily determine the effect of the alarm on the safety or operation of the plant. In this technique, alarms are grouped together according to the nature of the problem rather than the symptoms caused by the particular alarm situation. The fixed location of the alarm screens facilitates pattern recognition. The power level overview on the IPSO screen shows possible action paths and critical functions for Priority 1 alarms.

15

To ensure that all alarms are reset without too much workload on the operator, all alarms can be reset one at a time or in small functional groups. All alarms can be reset from any control panel. Instant alarms indicating the status of the alarm will be silenced without operator intervention. Intermittent beeps remind you of unacknowledged situations. The operator can activate the power plant-wide alarm lock, which will automatically exit after a while, to delay the reset of the alarms.

1 «t | ; y In addition to alarms, there is a "carrier support" notification category, which contains useful information but does not indicate abnormal deviations.

30 The "Operator Support" category includes the following situations: channel overflow situations, allowed lock-in approaches, and device status changes.

Some parameters are associated with multiple alarms (e.g.

'35 Gasket feed temperature Hi Hi and Hi). The response required from the operator is lightened so that the lower priority alarm automatically disappears without an exit tone or 32 108815 slow flashing when the higher priority alarm is activated after the lower priority alarm. The operator acknowledges the Hi Hi alarm, so there is no need to acknowledge the deleted lower priority alarm. As situation 5 improves to the point that the higher priority alarm is cleared, the situation generates an exit sound and the alarm plate flashes slowly. The operator acknowledges the exit of the higher priority alarm. If the lower priority alarm condition still exists, its alarm window or indicator goes into 10 acknowledged states when the operator acknowledges the exit of the higher priority alarm. If the situation improves to such an extent that both low and high priority alarms are cleared before the operator resets, as the operator resets, the higher priority alarms will also clear the lower 15 alarms.

1. Subscribe to Device Dependence The key to an alarm system is its dependence on the system and the state of the devices. These features significantly reduce the number of alarms that occur during major events and limit alarms to situations that represent actual process or equipment deviations based on the current status of the power plant. Dependence on the power plant and: · 25 equipment states is implemented through changes in both alarm logic and set points. The space-dependent alarm v can be exemplified, for example, by the lower setpoint of the pressurizer, which is reduced during normal operation to reduce unnecessary alarms. Hardware dependent logic 30 is used to activate the low flow alarm only when the pump should be running.

Four modes have been selected that correspond to significant changes in the power state logic. These modes are: ,, 35 1. Normal operation.

: ·. · 2. Heating / Cooling.

3. Cold Shutdown / Fuel Change i 33 1 0881 5 4. Reactor Shutdown

Except for the reactor trip mode, the operator switches to the various alarm modes manually. During the reactor trip, the alarm logic automatically enters the 5 reactor trip mode without operator intervention. All device-dependent alarms are automatically activated without operator intervention.

2. Sub Functional Modes 10 The RCS panel has more than 200 situations that may cause an alarm. In order to reduce operator stimulus load due to the number of alarms and to improve alarm perception, several alarms are grouped into functional subgroups 108, 110, 112 (Fig. 15). Functional subgroup alarm panels have a number of interrelated functional subgroup alarm messages that appear in the panel alarm message window 114 (adjacent to the alarm panel) or in the CRT. In cases where alarms related to 20 process key parameters are received, each: v one alarm message (e.g., RCS low pressure »·., · La). With such a single alarm message, the operator «t 1 !! can quickly identify certain process-specific problems.

i · · i i · :; As shown in Figure 16, some alarms group together similar components instead of process operations, and add a message to them, such as 116.

As shown in Figure 9, the alarm board may be in one of the following 30 states: ·· 1. Unacknowledged alarm - If the alarm board has a * * *. *: * Unacknowledged alarm, the alarm board will flash rapidly (e.g. 4 times / second, on / off ratio). with * ·: · 50/50 as illustrated in Figure 9 with long rays).

35 This situation overrides all other group alarms: v Alarm slab modes.

34 108815 2. Exit Alarm / Return to Normal (Alarm Reset) - When the alarm condition is reset, the corresponding alarm tile will flash slowly (eg once / second with an on / off ratio of 50/50 as shown in Figure 5 for short beams), until this situation is cleared. This situation overrides the other two remaining states of group alarms.

3. Alarm - If the alarm condition is active and the above alarm states 1 and 2 are not active, the alarm board 10 will light up without blinking (as shown in Fig. 9 with missing rays).

4. No Alarm - If the alarm associated with the alarm board is not valid, the board will not burn (not shown in Figure 9). The operation of the alarm panel lamp can be checked with the 15 lamp test function.

3. Shape Color Coding Alarm information is identified by a unique color of the tile, 20 preferably yellow 118. Parameter / component indicator; *, · or a short message on tube 120 is displayed internally. Gray ', · color coding is used as tile color to return to normal mode il! mark. The priority of the alarm (i.e., 1, 2 or 3) is identified; based on the format code. Alarms use a single; 25 bright colors to maximize the value of this information. The format coding used to indicate the alarm priorities utilizes different levels of code detectability. Alarm-priority format coding also allows priority information to be retained even in the return-to-normal mode.

30

Priority 1 alarm panels, diagrams, symbols, process parameters, and menu option fields are represented by inverted symbols (i.e., blue letters 12 on yellow 118 solid rectangular background 124) using color coding of alarms. The color of the emblem is blue for good contrast for legibility. Additionally, the CRT displays 35 108815 alarm panels and menu options fields use the same presentation.

Priority 2 alarm panels, diagrams, components, menu options, and symbols are in a thin (1-line) box 126 that uses a yellow alarm color code around its blue indicator.

Priority 3 alarm panels, mimic diagnostic ramp parameters, components, menu options, and symbols are surrounded by their detectors 120 with parentheses 128. The English symbols in the message line of each alarm CRT display are represented by the alarm presentation mode, if present.

15 4. Alarms in the CRT

Each CRT page on the data processing system provides the operator with an overview of all valid unacknowledged alarm conditions and their location at the power plant. The standard menu for each display page includes IPSO and all first-level display pages as alternatives (see Figure 10, Menu Section 130). These menu option fields tell about existing unacknowledged alarms in the screen page hierarchy: 25 sectors, their alarm status / priority using the alarm highlighting feature described above. If the alarm tile (i.e., in DIAS) is in alarm mode, the first level display menu option field, such as 132, in menu option 130 indicates the existence of an alarm in that display page hierarchy.

30 area. Alarm panels in menu 130 are grouped into a first-level display page group corresponding to console groupings, or by critical action, as shown in Figure 11.

In addition to the alarm information shown in the menu options on the first level display pages, the following display properties are used to indicate the existence of alarms.

36 108815 Screen Menu Options 134 to access Level 2 and Level 3 screens will light up as described above in the Alert Presentation if the related page information is in Alarm Mode (e.g., if the alarm is unacknowledged, Screen Menu Menu 5 will light up to indicate highest priority unacknowledged).

By selecting option 136, the operator may display a level 2 display page directory, which includes an illustrative diagrammatic representation of the level 3 display pages in a hierarchical format together with the first level display page (see Figures 12 and 15). In this diagram, the represented Level 2 and Level 3 display pages are each marked with an alarm code, if the information in question is the screen has unacknowledged alarm status. This alarm information is most useful for determining the location of alarms in the display page hierarchy. For example, the operator is informed via display menu 130 (Figure 10) that ancillary systems have, without acknowledging the alarm (s), a PRI menu option field with a gray alarm code (return to normal) and 20 slow flashing alarm codes. He can bring up ... directory / hierarchy to see which page (s) the alarm information is on by touching the "DIRECTORY" menu option 136 after the PRI. When the primary display directory appears (Figure 12), the display page (s) 25 the field (s) containing the alarm condition (s) (such as PZR LEVEL 138.) The desired screen containing the alarm information is accessed (as in Figure 15) by touching the flashing field.

The components and power information indicators on the CRT process screen (Figure 13) indicate alarms and their acknowledged status with alarm codes and flashing. The component ID can provide such alarm information if the parameter associated with the component is in the alarm. This is also the case with sil-35, when the screen does not display that particular. the parameter in the alarm; e.g. the low pressure of the pump lubricating oil is represented by *, i. component alarm coding. The operator can view the alarm information on the lower level display page or use the alarm system features described below.

5. Configuring and Confirming Alarms 5

Referring again to Figure 16, each of the Class 1 and Class 2 alarm detector boards in the DIAS may indicate to the operator more than one possible alarm condition. To quickly determine the actual alarm condition, the panel display area 10 78 has a message window 114. When a non-acknowledged alarm indicator tile, such as 134, is pressed, the message window 114 will display a special alarm description 116. The alarm tile 134 will continue flashing until all related alarms have been acknowledged, the additional English descriptions of the additional alarms can be accessed by pressing the alarm tab 134 again.

As the message appears in the message window of the DIAS alarm screen 78, the CRT panel 87 displays an alarm message in the second field 20 132 at the bottom of the screen (see Figure 13). CRT alarm message ... contains the following information: time, priority, magnitude (e.g.

Hi, Hi-Hi), ID, setpoint, and real-time process value (encoded as described to illustrate the alarm priority and alarm status). If. · 25 other unacknowledged alarms, the number of additional unacknowledged alarms is multiplied by the number placed inside the circle to the right of the message area (see Figure 13).

In addition to this alarm message, the display page menu (area 4) has 30 menu options / fields that directly access the display pages that can be used to access diagnostic or support information related to the alarm situation. Figure 22 shows the display areas. Alarm panels that are in alarm mode on a particular panel's DIAS display can be viewed and acknowledged from any CRT panel by a procedure similar to displaying and resetting alarms through control panels. When the Alarm Display 38 Alarm Tiles menu option following the menu option of 108815 worksheet is selected, (i.e., the first level display page set (area 3), the alarm tiles that are in alarm mode and related to the display are displayed in the display area menu area 4. One of the 5 tiles is marked and it is a touch point to access other tiles. The operator acknowledges and inspects these alarm tiles by touching them to receive alarm messages and support screen touch points similar to the one described above. This way 10 react to alarm tiles is most useful responding to alarms at workstations away from the operator's location.

All alarm situations 15 related to the DIAS display indicator board are kept in a buffer. The buffer containing alarms is arranged as follows: 1. First unacknowledged 2.

• · 20 N Last unacknowledged N + l First exit / return N + 2.

,,, · · 25 * * · · n Last exited / normal n + l Acknowledged alarms n + 2 30

ft. | I

Pressing the alarm slab gives access to the upper alarm condition in the bumper.

Acknowledging unacknowledged alarms shifts that alarm. alarm conditions at the bottom of the buffer. Resetting alarms 35 39 108815 drops them from the buffer. Previously acknowledged alarms (n + 1, n + 2, ...) can be viewed if there are no unacknowledged or deleted, unacknowledged alarms. Viewing these alarms moves them to the bottom of the butt-5.

Priority 3 alarm messages and carrier supports are computer generated and appear only on the message line 132 on the CRT screen (Figure 3); The 78 message windows on the DIAS screen do not have 10 English characters. Each notification workstation has one notification plate for Priority 3 alarms. For workstation-related operator support, workstations have one alarm plate.

15 When the priority of an alarm situation changes, the following changes occur in the alarm processing system. When a higher priority alarm is received for the same parameter, the previous alarm is automatically reset (i.e., the operator reset is not necessary as he must reset the higher priority situation 20) without a reset tone or a slow blink rate. When the alarm condition improves to the point where the higher priority alarm goes off, the operator must acknowledge the disappearance of the higher priority alarm; if the lower priority alarm is still active, it is activated; 25 (when the operator acknowledges the exit of the higher priority alarm condition) and automatically enters the acknowledged state (i.e. without operator intervention). The operator detects a new lower priority alarm condition as it reads the 30 incoming alarm messages due to the removal of the highest priority alarm.

The present invention provides methods for cataloging support pages, classifying alarms, and displaying alarms. In this system, alarms are triggered 35 on the alarm list display pages accessed from the DIAS display 78 fields 138 and the CRT display 84 fields 140, 40 108815 shown in Figures 15 and 13, respectively. This listing is classified as follows (see Figure 14): A) level display page set (Power plant main system / main function groups) 142 5 B) Control room workstation 144 C) Alarm panels 146

Workstation alarm panels are listed by priority. Alarms related to the alarm panels are listed according to the contents of the 10 alarm panels buffer.

These alert classes provide the operator with the alert information needed to respond to alert situations. By displaying a classified alert list 78 on page 84 (Figures 4 and 15 12), the operator can easily select the information of the desired category. By first selecting the menu option 14 (Fig. 4) "Alarm List" and then the display page representing the alarm condition (s) (Fig. 12), the operator can view the specific alarm situations he is interested in (Fig. 14).

20

The following are three examples of how to retrieve classified list information from page 84 (Figure 4): 1) The operator first selects the "Alarm List" menu item 140 (Figure 4) and then selects "Alarm List." 148 25 (Figure 4). This exposes a classified alarm list of the type shown in Figure 14, starting with electrical alarms.

2) If the operator wants to view information related to a particular alarm, eg RCP1A, he selects the following 30 menu options on page 84 (Figures 4 and 12: "Alarm Tiles" 150 - "Primary" 152 The display page menu changes to display the alarm quality 35 Currently, the operator can select one of two different types of data presentation for the 41 108815 displayed alarm slabs: A. Classified Alarm List - The operator first selects 5 options, "Alarm List", and then selects a tile, e.g.

"RCP1A" option. The classified alarm list appears with RCPlA alarms at the top.

B. Alarm Messages - The operator can use the alarm panel menu options in the same way as control panel alarm panels. Selecting an alarm panel menu option displays an alarm message and a menu that contains alarm information screens.

Alarm information is also provided for all process flowcharts that include a component or parameter in the alarm state. Alarm situations are marked by color and shape coding as described previously. Alarm parameters related to a component may cause the component ID to light up to indicate an alarm condition if the parameter is not displayed on the display-20 page, eg the second-level display page may not contain ... pump lubricating oil pressure, which allows the pump ID to be alarm coded. If the operator wants to see the exact alarm situation associated with the component .V, he goes to the lower level screen. Alternatively, he can first touch the 25 menu options "Alarm panels" and then the component: · ID, and react to the alarm with alarm panel presentations. This procedure also brings up menu options on the display pages that provide more information about the component.

The present invention provides the following methods for resetting an alarm.

1) Acknowledge Alarm via Indicator Board - Alarms can be acknowledged by pressing the alarm / unacknowledged board or the CRT display board. These 35 steps move the tile from flashing to solid once all tile-related alarms have been acknowledged, and silence all 42 108815 beeps associated with the alarm condition (described later). Alarm messages are displayed in the message window (when using a physical tile) and in the message line on the client CRT screen (see Figure 16).

2) Acknowledge Alarm via Alarm List Page -Alarm-5 alarms can be acknowledged on the Alarm List page by touching the alarm panel touch points associated with the alarm tile categories (see Figure 14). When touching the display of the alarm panel, all of the alarms are displayed. plate-related alarms are reset. This way of responding to alarm panels is most useful when acknowledging multiple alarms far from the operator's location.

Each of these alarm acknowledgment methods removes unacknowledged alarm detectors from the other alarm formats.

15 The operator must be informed when the alarm situation has resolved. The notification is done by flashing the indicator board and associated process screen information at a slow speed. Resetting the deleted alarm detectors is done in the same way as resetting new alarms, i.e., by touching 20 alarm slabs or the CRT display alarm presentation mode.

* t • ». · For the following alarm information, there are special sounds in the control room -. '··, characters; 1. Unacknowledged priority 1 or 2 alarms.

. * 25 2. Priority 1 or 2 alarms unacknowledged or I> ·; exit reminder sound.

»3. Priority 1 alarms cleared or priority 2 alarms cleared.

30 The audible alarm 1 or 3 will only sound for one second and the audible alarm 2 will be repeated periodically once a minute until all new or deleted alarms have been acknowledged.

If several unacknowledged alarms are active at the same time, the operator must focus his attention on new alarms of the highest priority. In such a situation, all other unacknowledged alarms, i.e. the new Priority 2 and 3 43 108815 alarms and any alarms that have disappeared, will cause unnecessary noise that will distract the operator from the most important alarm situations. The MCC, ACC and ASC of the control room have buttons "Flashing Prevention" and "RESET". When the 5 "FLASH-PREVENTION" button is pressed, the alarm system has the following features:

All new / unconfirmed priority 2 and 3 alarms for tile and CRT displays and operator support functions will change from high flashing speed to steady light 10.

All alarms that have gone out, ie slow blinking, are left out of the alarm data.

Any new or deleted alarm that arrives after pressing the "FLASH" button will normally be reported to the operator (i.e.

flashing). However, the operator can suppress these situations by pressing the "ANTI-FLASH" button again.

20 An alarm reminder tone informs the operator of new or deleted alarms that have not been acknowledged. In order to recognize these situations for resetting, · 'the operator will press the "RESET" button, which will reset all unacknowledged and exited situations to normal alarm! 25 formats.

»I» Alarm mute button lights up when pressed to indicate that the alarm mute is active.

30 For quick, direct access to support information by the operator - • which improves operator response to alarm conditions * »· '- a single operator action acknowledges the alarm, displays the alarm parameters, and allows you to select the CRT screen pages related to the alarm situation.

35 (· '· The present invention provides multiplication and spreading for alarm processing and display so that operators have 44 108815 confidence in intelligent alarm handling methods and equipment failure does not affect power plant safety and operation. Priority 1 and 2 alarms are processed and displayed by two independent systems. The multiplicity of the two systems 5 is not visible to the operators due to ongoing cross-checks and unified operator interfaces.

Figures 16-18 show schematic alarm responses when using the tiles of the present invention. The illustrated tile-10 assembly relates to monitoring the reactor coolant pump seal in the reactor cooling system panel shown in Figure 3. The Priority 2 seal / leak system problem alarm lights up to alert the operator who can read a more complete message in the alarm window indicating the high control 15 leakage pressure. Priority 1 and 2 alarms have such messages. The same message appears in a more complete form on the panel's CRT screen. The CRT screen also provides menu options that indicate useful, supportive display pages. Alternatively, the operator can directly select a list of all alarms for a particular group 20.

Thus, an overview of alarm situations is provided on tiles, while details are provided by related messages. A particular alarm is considered more or less important at a particular time, depending on the state of the devices and the state of the NSSS. The processing of alarms is reduced by checking the parameter signals and automatically removing the lower priority alarms when a higher priority alarm related to the same situation is activated.

30 IV. DATA PROCESSING SYSTEM A. CRT certification

The CRT 84 shown in the center of the panel of Figure 3 is part of a data processing system that processes and displays all operational data of the power plant. 35 It is thus connected to all other instruments and control systems in the control room.

45 1,088 1,5

Figures 2, 28 and 30 schematically illustrate a data processing system with respect to a control system, a power plant security system, and a detector and alarm system. The data-5 processing system 70 receives from the control system 64 the same sensor information that the control system uses in its control logic. Similarly, it receives the sensor data verified from the detector and alarm system which is used by the detector and alarm system 72 to generate separate alarms and displays. The power plant security system 50 does not use internally audited data in its trip logic, and the "raw" signal from each channel as such arrives at the data processing system 70 which implements its own signal audit logic 154 to the power plant security system signals 15e and transmits the internally audited signal to signals received from control system 64, power plant security system 50, and detector and alarm system 72 are compared and displayed on CRT 84.

20

It should be noted that both the incoming signal from the reference logic and the incoming from the power plant security system !!! the signal is available on the CRT screen.

: · Ύ5 Thus, each CRT display includes a signal check ···: and all CRT displays are linked to the information available on all other CRT displays in the power plant. In addition, each CRT monitor can produce alarm panel images of any other panel and acknowledge its alarms. Likewise, detailed display indicator windows are displayed. CRT displays have essentially real-time response time, with a delay of up to two seconds.

The CRT screens contain all the power plant information available to the operator in a structured, hierarchical format. CRT pages are very useful for information presentation because they allow the graphical representation of power plant processes to the operator's market in illustrative formats. In addition, CRT monitor models can assist with operations by providing time charts, lists, messages, operational notes, and alerting the operator to abnormal processes.

5 The most important method by which an operator obtains information on a CRT screen is based on a known touch screen interface. Touch screens are based on infrared technology. The horizontal and vertical rays come from a frame placed around the surface 10 of each color monitors. When the user cuts off the rays, the coordinates are compared with the display page database to determine the selected information.

The touch points on the message and support screens are accessed via panel CRT displays by touching other panel features such as detectors and alarm panels. IPSO is available as a single screen and forms the top of the screen hierarchy see. 10, 22 and 24). Below IPSO there are three levels, each of which contains consistent information to meet the specific needs of 20 operators. The structure of the hierarchical format is based on assisting the operator in performing his tasks and on the quick and easy access to all information available through CRT displays. The highest-level display formats provide information for general surveillance tasks, whereas the lowest-level formats contain information that is most useful for performing diagnostic support tasks.

The Level 1 screens contain information that is most useful for monitoring the main power plant processes. These screens provide the operator with information about the operation of the main system and the status of the most important devices and lead to lower level screens that provide support or diagnostic information. The Level 1 display pages are as follows: • 35 1) Primary Systems (example, see Figure 19) 2) Secondary Systems': 3) Power Conversion 4? 1 0881 5 j 4) Electrical Systems 5) Ancillary Systems 6) Critical Functions 5 The Level 2 screens contain information that is most useful in controlling the power plant components and systems. These pages contain all the information necessary to control system processes and functions. The parameters to be monitored during the control task are 10 at a time on the same display, even if they are part of different systems. The suggested operating procedures or instructions for controlling the components are used to determine the parameters to be displayed. Figure 20 shows, by way of example, the control of reactor coolant pumps IA and IB. Normally, operator 15 would monitor the "Primary System" screen when evaluating RCS performance. If the operator wants to use or adjust RCP IA or lB, he will bring up the control screen. All information related to the reactor coolant pumps is on the control screen so that there is no need to switch between different display pages 20.

• · · <* «

The Level 3 screens contain information that is most useful for diagnosing the processes and components shown on the ··· Level 2 screens. Level 3 screen pages provide '| 25 information useful for inter-channel instrumentation * ;; comparisons, detailed diagnostics of equipment or system failures, and time charts that can be used to determine the direction of changes in system performance, that is, whether the situation improves or worsens. Fig. 21 shows a diagnostic display of the RCPlAr 30 seal and cooler block: pump section, ·: · supporting oil system and engine section on a separate display page due to display data frequency limits.

»» • • »· '• 35 Access to the screen is via the menus at the bottom of the screen. Each screen has a standard menu that gives you direct access, ie one touch 108815! 48 by all, according to the data hierarchy. page related pages. The menu contains fields (see Figure 10) that show the titles of the display pages. To access a specific screen, select the appropriate field (a-j). The screen-page menu-5 fields include the following (see Figure 22): 1) The next higher level of the screen page hierarchy (if any), item (c). This feature is more relevant on level 3 screens because the next higher level screen is a level 2 screen, which is not normally in the 10 menu.

2) System display pages that are related to or support the process of the currently displayed display page (h, i).

3) All six first level display pages (b, c, d, e, f, g).

4) IPSO Display Page (a).

15 5) Last page (s) displayed on the monitor.

In order to access the display page described by the menu option, the operator selects the relevant page. menu option (a-k) by touching the desired menu option field on the monitor. The menu option lights up (using black letters on a white background) until the screen appears. Because menu options: directly access only a small number of screen pages in the '· * screen hierarchy, there are alternative methods for quickly displaying other screen pages »» ·. There are three options for the operator: £ 5 (1) Go to screen using alarm panels - * *! '; This screen navigation mechanism is most useful when accessing workstation-related screen pages. When the client alarm panel from display 78, such as 80 (Figure 15), is pressed, menu area 4 on menu 30 of the client CRT screen changes to a new menu with display page options associated with the panel label. For example, '!' The RCPlA Alert Board brings up menu V options related to RCP IA. The desired screen is then a direct connection ;;; enabling menu option.

'•• 35 (2) Retrieve CRT Information Through Detector Detectors - Each: * ·' detector detector 82, as shown in Figure 7, has a CRT access touch point 158. This button provides 49 108815 support information that is related to the process parameter currently displayed in the detector. Touching the CRT touch point on the detector detector changes the menu options 4 on the CRT screen of the workstation to 5 menu options that include process parameter support and diagnostic information display pages.

(3) Navigating to a Screen Using the Screen Index - Any screen in the screen hierarchy can be accessed through the 10 menus currently displayed. If, for example, the operator is viewing the feedwater system screen and wants to access the CVCS screen, he will perform the following steps (see Figures 22 and 4): The operator will select "by touch" menu option "DIRECTORY" he selects the menu option "PRIMARY" (option b in region 3 of Figure 22). In this way, the primary part of the display page hierarchy is reached (see Figure 4). Each screen in the primary part of the screen hierarchy is represented as a touch point, and the operator can select a CVCS screen. This feature lets you navigate to any screen. After the "DIRECTORY" menu option, the desired hierarchy is assigned which is associated with one of the six first level display pages, i.e. one of the menu options b, c, d, e, f or g of Fig. 22.

| '2 5: · In addition to the menu options described above, the menu options include "LAST PAGE", "ALARM LIST", "ALARM TILES", "OTHER" and horizontal paging options ( "Keys" keys). "LAST PAGE" 30 (option j in Figure 22) provides a direct connection to the last page displayed. This is very useful for the operator if he wants to compare data on two screen pages or if he wants to go back to what he has been processing previously.

“35" ALARM LIST "(option n in Figure 22) provides a quick connection to the alarm list screens.

50 108815 "ALARM TILES" (option m in Figure 22) provides a quick connection to the representations of active alarm panels above the workstation CRT display area 4 (see Figure 23). In this way, the operator has access to alarm information related to the tiles 5 of any CRT display. This method of handling alarms is described in more detail in Section 5 of this document.

"OTHER" (option k in Figure 22) provides access to those display pages or information not in the data categories described by the present menu options 10.

B. IPSO

The combined process space overview (IPSO table - see Figure 24) is the second part of the data processing system. Although the number of monitors and alarms that can be loaded at the same time by ope-15 can be significantly reduced by panels using separate alarms, monitors, and CRT monitors as described above, the number of stimuli is still relatively high, and especially in alarm situations develops a slower understanding of the state and direction of critical systems in the NSSS. One display is required, which only displays the highest level of information to the operator and guides the operator to more detailed information as needed. Although in the past .. '25 there have been some attempts to display a large whiteboard or screen; Such current displays have not had significant data integrity as described below.

30 The IPSO table provides a high-level overview of all high-level information, including an overview of plant status, critical safety and power factors, symbols describing key systems and processes, plant key information, and all key alarms. The IPSO data includes time charts, 35 offsets, numerical values for the most critical critical functions, and the presence and location of Priority 1 alarms, as well as availability of systems that support critical functions and 1,0881 5 I * 1 operating status. This, on the other hand, is known as path control. The IPSO can also identify the presence and location of other unacknowledged alarms in the power plant area. In this way, IPSO narrows the gap between an operator's systemic propensity to evaluate critical functions. This balances the reduction in dedicated displays, helping operators maintain the power plant's field conditions. It also helps operators maintain an overall view of the operation of the power plant 10 while performing detailed diagnostic tasks. IPSO provides a common understanding of the power plant process, which enables better communication between the power plant personnel.

The situation shown in Figure 25 is the reactor trip. At the time described, the reactor temperature rise is 27 ° and the average temperature rise is higher than desired and continues to rise as indicated by the arrow and the M + "sign. The pressure of the pressurizer is higher than desired but decreases. Similarly, the water level of 20 steam generators decreases.

Figure 24 illustrates a CRT display hierarchy with an IPSO at its peak and a first level display page set containing • '.25 general control information for a secondary system, electrical system, primary system, auxiliary system, power conversion system and critical function system, and component control and wherein the third level of the display pages 30 provides detailed and diagnostic information. IPSO is constantly seen at all workstations, the supervisor's office and the technical support center. The IPSO is centrally located with respect to the main console. The IPSO also exists as a display page that is displayed in the control room on any CRT-: 35 display of a workstation, as well as at remote operating points, such as an alarm location.

52 108815 The large IPSO panel is approximately 140 cm high and approximately 180 cm wide.

Its location, above and behind the MCC workstation, is approximately 12 meters from the supervisor's office (the farthest point still visible).

5

One of the benefits of IPSO is that IPSO data can be used to support the operator's response to power plant disruptions, especially when disruptions affect many of the power plant's operations. IPSO information supports the operator's ability to respond to power plant power and safety issues.

IPSO supports the operator's ability to quickly evaluate the overall performance of a plant's process by providing the information needed to rapidly evaluate a plant's critical functions. The concept of power plant power control and safety function control enables the power plant power and safety process processes to be classified into a manageable set of data that describes the different processes within the power plant.

20

The critical functions are: Critical:

Function For Power Safety

1. Reactivity Control X X

2. Nuclear Heat X X

'25 3. RCS Heat Removal X X

4. RCS Inventory Control X X

5. RCS Pressure Control X X

6. Steam / feed conversion X

7. Power Generation X

30 8. Heat removal X

9. Control of Shell Conditions X

10.Shield insulation X

ll.Radiolog. emission control X X

12.Additional Ancillary Systems X X

In the upper right corner of the IPSO is a block 160 of the 3x4 alert matrix containing a box 162 for each critical function 53 108815 (see Figure 25 and the IPSOt CRT display in Figure 10). The matrix acts as a single location that provides a continuous view of the state of critical functions. If the Priority 1 alarm associated with the critical function is valid, the corresponding matrix box 5,164 will light up according to the Priority 1 Alarm Presentation method. Critical function alarms describe one of the following priority 1 conditions:

Failure to verify the safety function status (after reactor trip).

10 - Poor operation of the path / system used to support the critical function.

Unwanted priority 1 deviation in power generation (before launch).

Absence of the security system (Minimum Allowance is specified in Regulation 1.47 15).

The 3x4 matrix representation is a general summary of Level 1 critical function screen information (Figure 32). The operator will receive detailed information on critical function and path alarms from the critical functions section of the screen.

Each critical function can be maintained by one or more power plant systems. The information in the IPSO is selected so that; v25 represents the ability of the systems that support the most critical ···. function maintenance. For some critical functions, the general state can be estimated using the most descriptive control parameters. For such critical functions, the IPSO shows the relationship of the process parameter to the setpoint (s) and the direction of change to the right of the parameter identifier.

»* · *

If the integral of the parameter value is greater than the narrowband control value, the arrowhead, as explained in '35 in Figure 26, is used to indicate a change in the parameter towards or away from the setpoint. The arrow head down / up indicates: · the direction of the process parameter change. If these ί 54 108815 parameters deviate from normal control limits, a plus or minus sign will be placed below or above the setpoint representation. The following criteria were used to select the parameters or other indicators presented by IPSO to monitor the total of 5 critical functions: 1. Reactivity Control

Reactor power is the only parameter displayed by IPSOs that controls reactivity. Reactor power allows the operator to easily determine whether the rods are placed in the reactor. He can also use reactor power to determine the rate and direction of change in reactor reactivity after shutdown. Reactor power is shown as a digital representation by IPSO 166, since the numerical value of 15 of this parameter is most relevant to both operators and administrative personnel. The IPSO also displays a reactor vessel alarm if the kernel operational boundary monitoring system has a priority 1 alarm.

20 2. Nuclear Heat Exhaust: The IPSO displays parameters for the Nuclear Heat Exhaust Temperature 168 and the supercooling margin 170 to determine the adequacy of the Nuclear Heat Exhaust. If the kernel outlet temperature is within the range of •, 25, the operator can ensure that fuel integrity is maintained. The undercooling margin is used,: Y. because it gives the operator a temperature margin for total boiling.

30 The kernel removal temperature is represented by IPSO as a dynamic representation (i.e., a time graph) because there is a certain upper limit to the kernel removal temperature and it is easy to determine the Y setpoints for the representation.

<I · ”35 The supercooling margin is also represented by IPSOs as a dynamic representation because there is a lower bound that defines the functional boundary for maintaining supercooling.

55 1 0881 5 3. RCS Heat Exhaust

Tjjf Tc, S / G level 172, and Tave 174 are represented by IPSO to allow the operator 5 to quickly evaluate the efficiency of the RCS heat removal function.

In order to remove heat from the reactor coolant, the S / G level must be maintained at a sufficient level to transfer enough heat from the RCS to the steam power plant. A dynamic representation is used to allow the operator to observe the improvement or deterioration of a changing situation at a glance.

IPSO uses TH and Tc because the operator needs i to determine the amount of heat transferred from the reactor coolant to the secondary system. These parameters are represented as a digital value, since rapid comparison of these parameters is required for delta T monitoring. In addition, their true value is often used and their presentation to IPSO helps those 20 operators whose locations do not easily see separate TH and Tr detectors.

»* * V» · \: V The tave is displayed by IPSO as a dynamic representation, so that the operator can quickly assess whether this control parameter is within acceptable operating limits.

Vili .V 4. RCS Inventory Control The IPSO displays the pressure level 176 using a dynamic-30 representation to allow the operator to quickly determine whether the RCS has the correct amount of refrigerant and to monitor Level I (for better or for worse).

* t I * * • »» *; 5. RCS pressure control. '* 35 • * IPSO uses the pressure of the pressurizer 178 and the supercooling margin to determine the pressure control of the RCS.

f!

»I

i it 1 0881 5 The IPSO uses a dynamic representation to notify the operator of changing pressure conditions that may cause the RCS to become under or over pressurized.

5 IPSO uses the dynamic representation of the saturation margin. The saturation situation of the RCS can negatively affect the ability of the pressurizer to control the pressure. In addition, if the pressure drops, the IPSO's undercooling control suggestion indicates a reduction in the 10 saturation margin.

6. Steam / Input Conversion Steam / Input Conversion Processes can be rapidly evaluated using the following IPSO information: (a) Feedwater and condensation system status information (eg, operating, alarm) (b) Steam generator level, dynamic representation (c) Steam Generator Safety Valve Status 2 0 (d) Atmospheric Exhaust Valve Status (e) Main Steam Isolation Valve Status (f) Turbine Bypass System Status; 7. Power Generation: • ·: Power generation processes can be rapidly evaluated using the following information provided by IPSO: (a) Power Output, Digital Value.

(b) Alarm details of major process offset related to main turbine and turbine generator.

(c) Operation and alarm status of power distribution to power plant routes and grid.

8. Heat removal '. 35 The heat removal processes can be evaluated quickly with the following information provided by IPSO: 57 1 0 8 8 1 5 (a) Circulation system status.

(b) Alarm information on critical deviations in condenser pressure conditions.

5 9. Shell Shell Conditions Control IPSO uses shield pressure and sheath temperature parameters to monitor sheath conditions. These are displayed by IPSO as dynamic representations to evaluate time-10 graphs and relative values. Shield pressure is a variable by which the IPSO warns the operator of an adverse overpressure situation that may result from a failure in the reactor cooling system. The temperature of the jacket also helps to detect a failure in the reactor cooling system; it can also tell 15 about an explosion in a shell building.

10. Shield insulation

The safety function of the sheath insulation is followed by an IPSO; 11a 20 symbol representation of the sheath insulation system.

The symbol is obtained from an algorithm that describes the effectiveness of the following shell insulation factors in their effect on shell insulation:

Activating the Shield Isolation: 25 - Activating the Safety Shutdown Activating the Main Steam - Power Plant Drain Isolation 11. Radiological Emission Control 30 IPSO; 11a displays radiation symbols indicating high radiation values, for example, inside the enclosure, and (2) radiated radioactivity. These symbols are displayed by the IPSO only in the case of high radiation values. These detectors are displayed in alarm colors according to the location of the sensor in the following situations:

High Radiation Exposure I 58 108815

High activity associated with any release route - High activity of coolant.

5 12. Essential Auxiliary Systems The IPSO monitors essential auxiliary systems by providing the following information: (a) Diesel generator status 10 (b) Power distribution area within the power plant (c) Instrument air system status (d) Service water system status (e) Component cooling water system status 15 The systems are the most important heat transfer systems and the systems necessary to support the most important heat transfer processes, whether related to power generation or safety. These systems include those systems that need to be monitored in accordance with regulation 1.47 20, as well as all operating paths that support critical functions of the power plant.

The following systems have dynamic representations at IPSO:, ···, CCW - Component Cooling Water CD - Condensation 2f5 CI - Enclosure Insulation ·; ·· CS - Enclosure Injection 'CW - Circulating EF - Emergency Supply Water FW - Supply Air 30 IA Instrument · S DC - S Ammunition Refrigeration RCS - Reactor Coolant SI - Safety Injection SW - Service Water · 3'5 TB - Turbine Bypass »» 59 The system information presented in IPSO includes changes in the operational status of the systems (ie from active to inactive or passive to active). ) and system-related first-priority alerts.

5 System alarm information helps to inform the operator of critical function alarms.

Priority 1 alarm information is represented by IPSOs by alarm coding the IPSO presentation codes as described previously 10.

V. SUPERVISORY UNITY

Fig. 27 is an overview of a unitary presentation of information available to an operator in accordance with the present invention. From a combined process state overview or table (IPSO), the operator can monitor high priority alarms. If the operator is interested in the parameter time charts, he can look at individual detectors. If he is interested in the status of 20 systems or components, he can view the system driver settings. The IPSO data is shown in the table. la and the panel CRT screen, and all other operator, ···. the panel or any other panel information is provided to the operator on its own CRT screen. The IPSO overview allows the operator to navigate the 'Z5 through the CRT screen or the DIAS screen. In addition, * * · ·; ·; the operator has direct access to these two types of data from any control panel, and when the system control is adjusted or set, the results are also transmitted to the alarm and display controllers on the other panels.

30: · As shown in Figures 2 and 28-31, an overview of the system; '· * means that each panel containing the main console, security, * ski console, and additional console has information ;; the CRT 84 controlled by the processing system 70. The data processing system 13 uses the power plant mainframe computer and, although more efficient, is less reliable than the DIAS 72 computers (which may be distributed microprocessor based or 60 108815 minicomputer based). It is also slower because it is menu driven and performs a lot more calculations. It is mainly used to bring the most important information to the operator and therefore, any CRT monitor 5 can view important alarm panels and can also be acknowledged from any CRT monitor. The information available on one CRT screen is also available on all other CRT displays. The detector and alarm system 72 of a particular panel is associated with controls, but separate (i.e., fast and accurate) features of the alarm and detector screens 78, 82 and panel controls are not available on any other panel.

Information is basically classified in three ways. Class 1 data must be displayed continuously at all times, and this is accomplished by DIAS 72. Class 2 data need not be continuously available but is required from time to time, and DIAS 72 is also responsible for this. Class 3 data is not needed quickly and is of an informative type only and is obtained from DPS. In the event of a DPS 70 failure, the DIAS will take care of some essential information. The DPS and DIAS are connected to the IPSO board via a display generator 180. Under the IPSO, the operator gets a private. Go to the appropriate panel or go to the CRT screen.

»*»: 25 Note that the inputs of DIAS and DPS may not have the same parameters, but if they receive information about the same parameters, the sensors for these parameters are common.

In addition, DPS and DIAS use the same verification algorithms. And further, the algorithms used for the separate alarm panels and detectors 30 calculate a "representative" value · and compare the checked values of the DIAS and DPS.

Fig. 29 is a block diagram showing the signal processing of the control room with respect to the other detector and alarm system to the other * I * * 35 sections. It is a good idea to divide the DIAS system so that

i I.

: v all the detectors required for a particular panel N, the separate alarm information is processed in only one block. However, each panel has a multiple processor. DIAS 1 data and processing is Class 1 and 2 data that is not normally displayed directly by IPSO. IPSO normally receives its information from DPS. If the DPS fails, a portion of the DIAS data is sent to an IPSO display generator for display on the IPSO display.

It should also be noted that both DIAS and DPS use the outputs of all sensors in the power plant to measure a particular parameter, 10 but the number of sensors in the power plant may vary between different parameters. For example, the pressure of the pressurizer is obtained from 12 sensors, while another parameter can be measured by two or three sensors. Some systems, such as the power plant safety system, do not use inspection algorithms 15 because they need to run as fast as possible and use, for example, two of the four activation logic on four independent channels. If the value of the parameter checked by two or more systems is different between systems i, the operator receives an alarm or some other notification via the 20 CRT displays.

• I t * * • ·. . * A significant advantage of the present invention is that the DPS * · 9 '* * does not have to meet nuclear power requirements, although it can be used reliably because it receives its parameter value from the same Z5 sensors as the DIAS that meets the nuclear power requirements. These values are checked in the same way and those checked by DPS

* I

the parameters are compared with the verified parameters of the DIAS before displaying DPS information on CRT displays or IPSO.

30 Nuclear Power Required Alarm Plates and Windows and • DIAS Separate Detector Displays are preferably implemented using a 512x256 electroluminescent panel, power converters, and a graphic drawing with VT text terminal emulation - ;;; controller, such as an M3 electroluminescent display module, supplied by Digital Electronics Corpotarion, Hayward, California. The control function of each panel is preferably implemented using separate, distributed, programmable controllers of 62 108815 of the type available under the trademark "MODICON 984", supplied by AEG Modicon Corporation, North Andover, Massachusetts, USA. Thus, the calculation of the DIAS is based on either distributed, discrete, programmable microprocessors or 5 minicomputers, whereas the calculation of the DPS is based on a task-specific mainframe.

Figure 31 schematically illustrates the ESF control system and process component control system, while the power plant security system is preferably of the type based on "nuclear safety calculation" as disclosed in U.S. Patent No. 4,330,367, "System and Process for Nuclear Power System Control," issued May 18, 1982. , which is incorporated herein by reference.

ϊ

Another aspect of connectivity is the ability to display critical functions and paths with IPSO as described above. Since the major safety and power generation signals and 20 status information are associated with both the DIAS and the DPS, the operator can scroll through the critical functions according to the screen page hierarchy shown in Figures 32-35. In Figure 33, the operator is informed that the emergency supply of the reactor cooling system is not ··; ' not available. In Figure 34, the operator is informed that; 25 emergency supply is unavailable and the power plant is in the shutdown mode. Under these circumstances, the operator must determine an alternative method of heat removal from the reactor core and, by going to the second level of the critical function screen, he will receive the heat removal reference information, even though it is displayed with 30 inventory controls (Figure 35). This level of detailed information and data aggregation is available for all critical functions in virtually all operating conditions, not just during accidents.

· 3β

: · Χ VI. MODULARITY OF PANELS

63 108815

It should be noted that, as noted above, the use of discrete tiles and communication ladders significantly reduces the amount of panel space required to perform a particular control task. Similarly, the monitors monitor-5 task section, which includes hierarchical display pages, is more robust than conventional nuclear control room systems. The control actions of a particular panel can be combined in a similar way.

Therefore, a feature of the present invention is the physical modularity of each panel containing the master control console, and more generally the physical modularity of each panel of the control room. The space required in each panel to provide an efficient connection with the operator is substantially independent of the number of alarms, displays, or controllers available to the operator. For example, as shown in Figure 3, the six locations on each side of the CRT can be reserved for alarm and detection purposes. Preferably, the two top positions on each side are reserved for alarms 78 and the other four 20 positions on each side are reserved for indicator display 82. Each panel of the control room has a similar appearance.

This provides significant flexibility and significant cost savings during the construction phase of the power plant, as the equipment can be: 2-5 installed and terminals can be connected early in the construction schedule, even before all system functional requirements have been fulfilled. Software-based systems are delivered early and representative software is installed to pre-test the control room functions. The final installation and functional testing of the software will be implemented at a more practical stage of the construction schedule. This method can significantly speed up the power plant construction schedule for • instrumentation and control systems. Because power plant instrumentation and control requirements are often only completed: 3.5 at a late stage in the power plant design schedule, the present invention reduces the costly delays in the construction phase in almost all cases. In addition, obvious cost savings are achieved due to the manufacture of integral panels, as it is normally necessary to design the locations and presentation of alarms, and because the manufacture of compact panels reduces material costs. In addition, such modularity utilizes 5 operator training, and if operators are under stress in an alarm situation, it will reduce operator errors, as each panel is consistent in its positioning.

Thus, each modular control panel has location-specific detectors and alarms, and preferably at least one position-specific separate controller label 88, CRT 84, and interfaces to at least one modular control panel or computer for communication therewith. For example, communication via DPS includes e.g. the ability to acknowledge one panel alarm when an operator is on another panel, and the automatic availability of system-related information controlled by one panel to all other panels.

20

Fig. 36 (a) illustrates conventional procedures for: ': providing instrumentation and control for a nuclear power plant, and Fig. 36 (b) illustrates operations in accordance with the present invention. Usually, inputs and outputs are defined, then the necessary algorithms are defined which define the human-machine interface. After that, the production of all materials begins and all equipment is installed in the power plant at substantially the same time before system testing can begin. By contrast, the modularity of the present invention allows the manufacture of the apparatus to commence at the same time as defining outputs and inputs. Similarly, devices can be installed and tested generally at the same time during human-machine interface design and power plant-specific algorithm design. The hardware and 3.'5 software will be combined prior to final testing. In a conventional nuclear power plant installation, the equipment is installed during the fourth year of the entire instrumentation and control phase, while the 65 108815 operating according to the present invention can be installed as early as the second or third year.

Referring further to Figure 3, the process component control system 5 and the protection component control system 56 use programmable logic controllers similar to the Modicon devices mentioned above. These include input and output multiplexers and associated wires and cables that can be delivered to the power plant prior to the development of power plant-specific logic and algorithms. The device is fault tolerant.

The data processing system 70 operates multiple power plant mainframes via modular software and hardware and associated data links 15. Such hardware can be delivered and modular software specific to the power plant may be installed just prior to system integration and testing.

20 DIAS 72 uses input / output multiplexers and fault tolerant implementation. It incorporates programmable logic processors or minicomputers which achieve the same benefits as those described for process control and security device control systems; ·; in connection with.

66 1,0881 5

ANNEX

DETAILED EXAMPLES OF AUDIT ALGORITHM

5 This appendix describes in detail the generic validation and display algorithm used in DPS and DIAS.

Definitions of Terms Used 10 PAMI Post-accident monitoring briefing.

Instrumentation Sensor and Transmitter Operational Uncertainty Operational accuracy (eg, ± 15 1% accuracy, instrument uncertainty 2%).

Expected Process Temperature (or other unit of measurement) deviation between sensors measuring the same process parameter due to the expected process temperature (or other unit of measurement) deviation due to the different locations of the sensors.

I <.

; ·; Computational Single algorithm calculated: 2-5 signal signal representing all sensors measuring the same parameter.

Process AgentA single output signal used in displays and alarms when a single signal value is required instead of multiple sensor values. A "process agent" is always a "laser chemical signal" unless an error has occurred. After the fault has occurred, it may be selected by the operator or algorithm:, 2.5 individual sensor output.

67 108815} i

Checked "Computational Signal" for which all inputs have passed a deviation check for the average of all inputs.

5 Verified PAMI "Verified" "Process Agent" who passes a deviation check with "PAMI" sensors.

Inspection Error Inspection and Display Algorithm Failure-1 10 in calculation of "checked" "computed signal".

PAMI Error "Computational Signal" Deviation Check with "PAMI" Sensors 15.

Fault selection "Computational signal", which is the output of the sensor that was closest to the last "checked" signal before the check 20 failed.

Operator selection "Process representative", which is the output of the sensor selected by the operator after the "PAMI error" or "check error".

• 2J5

Good An entry for a sensor that passes an offset check with "operator selection" or "checked" "process agent".

30

Bad An entry assigned to a sensor that fails the deviation check with the "operator" or the "process" inspector.

; '3'5 ,, y Suspicious An entry given to a "good" sensor that deviates most from the average (68 108815 "computed signal") when any deviation check fails.

"Permit to Operator Selection by Inspection Error" 5 Permit that allows an operator to select a single sensor as a "process representative" when the algorithm is unable to compute the "inspected" signal.

10 "Authorization for carrier selection based on PAMI error"

A permit that allows an operator to select a single sensor as a "process representative" when the "checked" "computed signal" fails the deviation test with 15 PAMI sensors.

Inspection and sampling algorithm

All sensor transmissions (A, B, C, D) are read and stored at the start of the algorithms. The algorithm uses the Show Stored Values display: · to execute all steps (1-10) that make up [* one pass. When the algorithm is repeated (after step 10), the sensor transmissions are read and re-stored for a new scan.

* «: 2? ·· 'Determining Errors in' Computational Signal '(Steps' · '' 1.2,3.4.5)

Test Attempt (Steps 1.2.3) 30 1. The algorithm checks if there are at least 2 "good" sensors.

- yes, go to step 2 • »» ». : · - no, go to step 5 · Note The sensor is "good" unless it has been marked as "poor" or "suspicious" sensor the last time it was \ 3J5.

69 108815 2. The algorithm calculates the average of all "good" sensors (A, B, C, D). Let's go to step 3.

3. Check the deviation of all good sensors for the mean value (which should be within the sum of the instrument uncertainty half and the sum of the expected process deviation).

If all the deviation checks are successful, the following is done: 10 a.

b. Disable the permit that allows the operator to select a sensor after an inspection error (i.e. "permit operator selection due to an inspection error 15" if one has been previously given).

c. All "suspicious" sensors are declared "bad" and a deviation alarm is issued for such sensors.

20th Give the average as "checked" as "calculated signal".

: V e. Go to Step 4.

- If any deviation check fails, '25 will happen as follows: a. The most abnormal sensor will be labeled 'suspicious', after which the algorithm will check whether it is the first or second round of this pass.

30 * For the first round, the algo rhythm is repeated from step 1.

··: Note:

If the offset check fails first

I I

. . * at that turn, the algorithm has used .3 * 5 at least one bad sensor to calculate the mean. Second Round Implementation * * (t I * 70 108815 removes a bad sensor or detects malfunction of multiple sensors.

* If the second round fails, go to step 5.

Note 5:

Failure to pass the offset check in the second round will indicate the simultaneous existence of two or more sensor errors. The algorithm cannot reliably remove only bad sensors 10, and therefore fails. This ensures that the algorithm does not compute the wrong "checked" signal in this case. Normally, when there are no multiple simultaneous errors, the algorithm i 15 detects a plurality of misalignments, removes them one by one from the algorithm one by one, and determines a "checked" signal.

20 Checked - PAMI Inspection (Step 4) ... 4. (This step is used if the process * has a PAMI class 1 sensor. If this process does not have PAMI sensors, this step is not performed but goes directly to to step 6).

: $ 5 Does the "checked" signal pass the deviation check: V with PAMI sensors? a. Yes. Issuing a "PAMI" message, removing any "Authorized carrier selection due to PAMI error", removing a possible "PAMI error" alarm, going to step 6.

Note: "Permit carrier selection due to PAMI error" allows the operator to select any of the 35 sensors as a "process representative" when the "count signal" (i.e., the "verified" output of the algorithm) does not conform to the PAMI sensor.

! 71 108815 b Hey. The following steps are taken.

Deleting "PAMI" Message Generating "PAMI Error" Alert 5 - Granting "Permit Operator Selection Due to PAMI Error"

Let's go to step 6.

Failed Check (Step 5) 10 5. The algorithm checks if the "calculated signal" of the previous pass was an "error selection" sensor.

If the previous screening had no "error selection", a "verification error" occurred right now. Do the following: I 15 a. Generate a "check error" signal.

b. Declare all "suspicious" sensors "good".

Note: This step ensures that the algorithm attempts to scan the next 20 times using all sensors not previously configured *! "bad».

> f ;;; c. Allows the operator to select one f * ;; assigning the sensor as a "process agent" ("permission for • 25 operator selection due to a control error").

>!: d. All sensors are checked for deviations «* V with respect to the last" checked "signal. The "fault selection" sensor is the sensor that deviates least from the last "checked" 30 signal.

e. The "fault selection" sensor signal is output as a "calculated signal".

f. Let's go to step 6.

If the previous scan had a "fault selection", the l «:, 3,5 check failed earlier and already selected the" fault, silence "sensor. The value of the "fault selection" sensor is still given as j 72 108815 as a "count signal", going to step 6.

NB:

It is important that the 5 sensors originally selected by "fault selection" are maintained, as other failed sensors may subsequently erroneously appear more accurate.

Selecting the "Process Agent" (Steps 6.7) 6. The algorithm checks whether the "Authorized carrier selection due to an inspection error" or "Authorized carrier selection due to a PAMI error" is valid.

NB:

The check error allows one permission for operator selection, and if the deviation of the "checked" value of the algorithm does not pass 15 "PAMI" checks, this will provide another permission for operator selection.

If no operator selection permission is in effect, a "computational signal" is given as a "process agent" and proceed to step 9.

20 - If you have a carrier selection permission, go to step 7.

7. Check if the sensor has been selected by the operator as a "process agent".

: 25: - Yes, give the signal of the selected sensor as "process representative", go to step 9.

... - No, give a "computational signal" as "process representative", go to step 9.

Note: 30 This step gives a "computational signal" as a "process agent" when the operator has the choice

• · I

sensor, but he does not use this option.

PAMI Inspection of "Qperator Selection" Sensor (Step 8), 3'5. 8. Does the "operator selection" pass the sensor deviation test for the PAMI sensor (within the sum of the PAMI instrument uncertainty and the expected process deviation)? ! 73 108815

Yes, a "PAMI" message is displayed on the "process agent" screen.

No, the "ΡΑΜΙ '' message is removed from the" process agent "screen.

5

Bad Sensor Evaluation (Step 9 ^ 9) Is "Process Agent" "Checked" or "Operator Choice"?

No, let's go to step 10 (no "bad" sensor evaluations will be done if the "process agent" comes from the "fault selection" sensor.)

Yes, an offset check is performed on all "bad" sensors (A, B, C, D) for the "checked" or "operator-selected" signal by the following methods: 15 0 All future "bad" sensors run an offset test (instrument uncertainty and expected process within the tolerance).

a. Unmark all transducers that pass the deviation check and mark them as "good", and remove the deviation alarm associated with the transducer.

b. Retain the "bad" markings of all sensors that fail the deviation test.

.! '! c. Let's go to step 10.

'25' · ;;; Area Check (Step 10) * 10.The algorithm checks whether the "process agent" is at or above the maximum numeric value of the sensors, or at or below the lowest numeric value.

30 - Yes, the message is given "out of range" together with the "process representative" signal. The CRT screen displays a multiplication sign (*) above the "process agent". Let's go to step 1 and repeat the algorithm.

- No, let's go to step 1 and repeat the algorithm.

'35' Note: | ·. ·; The "out of range" message tells the operator that: the actual process value may be below the sensor measuring range or 74 108815. If process measurements can be made with sensors in more than one area, this check causes a new set of sensors to be selected.

Note: 5 The RCS panel uses this generic verification algorithm directly for the parameters RCP Differential Pressure, SG Differential Pressure, and Compressor Level Reference Branch Temperature. Tcold's 'Thot' The Compressor Level and Compressor Pressure algorithms use this generic algorithm, to which are added 10 steps and small changes to include: 1. Different number of sensors.

2. Multiple sensor areas.

3. Loss of information in related process measurements.

15

Tcold; Inspection Algorithm (Fig. 37) The RCS uses 12 sensors to measure cold branch temperatures. During most operating cycles, the operator will search for a single "process agent" for each of the RCS cold branch temperatures. This value is obtained from DIAS with the designation "RCS Tcold". For the sake of consistency, this is defined by the DIAS. value is also used in the combined process state overview !!! ella (IPSO). For the sake of reliability, DPS compares the DIAS "process representative" Tcold with its own RCS TCQld and the alarm reports any deviation (DPS / DIAS RCS Tc calculation deviation). ; ·; To determine this value, a three-step algorithm is used: '1. Determine the "process-representative" temperature for each of the four cold branches (IA, IB, 2A, 2B) using a combination of deviation check and average calculation (detailed 30 below).

·· 2. From the results of Step 1, determine the "process representative" Tco ^ d for each RCS loop (loop 1 and loop 2) by averaging the corresponding values of A, B.

3. Determine the "process-representative" RCS * 35 'Tcold for normal displays and alarms from the results of Step 2 by averaging the values of Loops 1 and 2.

75 108815 This three-step process determines the "controlled" "process-representative" temperatures for cold branches IA, IB, 2A and 2B, cold loops 1 and 2, and RCS for Tc. In situations where it is not possible to calculate the "process" temperature 5 for the cold branch, the algorithm selects the sensor with the value closest to the last "checked" signal as the "fault-selected" process-representative temperature. This automatic fault selection ensures the RCS Tcoia's "Process Agent" is continuously available for displays and alarms. After the fault, the operator 10 may select a single sensor in question. cold branch (IA, IB, 2A, 2B) as a "process agent". This selection allows the "process representative" of the loop 1, the loop 2 and the RCS Tcold to be calculated with the "operator selection" information.

15 The following section describes the algorithm and display processing with DIAS and CRT displays.

1. The "process representative" of rods IA, IB, 2A, 2B, Loops 1, 2 and RCS Tco ^ d is always displayed on the relevant DIAS-display and / or CRT screens when a single "process representative" is required for multiple instead of sensor values.

s 2. The Τ002 ^ ίη algorithm and display processing are identical to the generic inspection algorithm with the following notes: '2? a. Generic algorithm steps 1-5 ("computational ·; ·; signal" and fault determination) are modified taking into account the following points: 1. There are only 3 cold branch sensors.

2. The same cold branch has wide and narrow area 30 sensors.

* ·· b. The determination of the "computational signal" and the faults and other steps of the generic algorithm (steps 6-10) are performed independently for each cold branch (IA, IB, 2A, 2B).

'35' c. Two algorithms are added: j · *; 1. An algorithm that calculates the average of two "process representative" of the cold branch, which is the I 108815 76 of the loop.

Tcold "Process Agent" (IA and IB for loop 1, 2A and 2B for loop 2).

2. An algorithm that computes the average of the two "cold process loops" in the process, which is the RCS 5 Tcold "Process Agent" (loop 1 and loop 2).

3. The operator can view any of the 12 sensor values or 7 "computational signals" using the menu on the DIAS or CRT display (as described in the generic inspection algorithm 10).

These options include:

T-112CA / 122CA 465-615 ”F TCold Silk 1A / 2A

15 T-112CB / 122CB 465-615 ° F TCold Silaukka 1B / 2B

1 T-112CC / 122CC 465-615 ° F TCold Gull 1A / 2A

T-112CD / 122CD 465-615 ° F TCold loop 1B / 2B

T-111CA / 111CB / 50-750 ° F TCold silmu ^ a

123CA / 123CB 1A / 2A / 2A / 2B, PAMI

20: *. * IA IA Tc Computational signal. Loop IB T_ Computational signal

t »· V

Loop 2A Tc Computational signal

Loop 2B T_ Computational Signal • «w * 25 Loop 1 Tc Computational Signal ·; ·; Loop 2 Tc Computational signal 'RCS Tc Computational signal

Inspection Algorithms 30 Note: · * · The following letters are used to mark the sensors of the cold branch to facilitate the marking of the sensors.

A - Narrow Area 1 Sensor (Security) (465-615 * F)

»I

B - 2nd Narrow Area Sensor (Security) (465-615 ° F): 3; 5'C - Wide Area Sensor (PAMI) (50-750 ° F) » sensor in the opposite cold branch (i.e., when talking about loop IA, this is a wide area sensor IB, PAMI) (50-750 ° F) 5 The following algorithms are calculated and displayed independently in both DPS and DIAS.

Method IA. 2B. 2A or 2B for Specifying a Process Agent11 for TCQld 10 Determining the "process agent" for a cold branch is done in four steps: 1. Determining the "computational signal" and faults as described below (steps 1-8): I 15 · Cold branch IA, IB, 2A, and The "calculated signal" for temperature 2B is calculated using sensors A, B, C. An inspection is attempted using narrow-area sensors. If this fails, the "computational signal" of the cold branch is checked against a wide range of sensors. If the check fails both narrow: * · *; With wide area sensors, the algorithm chooses. as the "fault-selected" "computational signal" of the sensor closest to the last "checked".! '! signal.

: 25 2. Selecting a "process representative" (Steps 9, 10) (similar to Steps 6 and 7 of the generic inspection algorithm).

3. PAMI check of "operator selection" sensor (step 11) 30 (similar to step 8 of the generic check algorithm).

4. Poor Sensor Evaluation and Area Inspection (Steps 12, 13) Y (Similar to Generic Inspection Algorithm Steps 9 and 10).

W

Cold branch IA, IB. Checking and Display Algorithm 2A or 2B 78 108815 Determining "Computational Signal" and Faults (Steps 1-81)

Narrow Range Attempt (Steps 1-5) 51. The algorithm checks if there are two "good" Narrow Area Sensors (A and B).

is, let's go to step 2 no, let's go to step 5

Note: The sensor is "good" unless it is marked "bad" in the previous 10 passes.

2. The algorithm calculates the mean of A and B, going to step 3.

3. The difference between the mean values of both "good" narrowband sensors (A and b) (up to a sum of half the uncertainty of the narrowband sensor 15 and the expected process offset).

If both deviation checks are passed, go to step 4 to check if the average is in the measuring range.

20 - If any deviation check fails, go to "· *> step 5.

% • · # t, · * ·. Range Selection (Step 41 4. The algorithm checks whether the average or the narrow: 2 ^ range sensor in the measurement range is selected.

• I

- The average or selected sensor is within the measuring range if »I '^ is not more than 96% or at least 4% of the narrow measuring range.

The average or selected sensor is outside the measuring range 30 Lila if its value is at least 98% or at most 2% of the narrow measuring range.

Note: Hysteresis prevents continuous transitions outside the area. Crossing the range occurs at '98% and 2% to ensure that: values outside the range 35 are not used to calculate the "checked" signal (e.g.

t I

79 In the 108815 mass situation, the sensor readings could be 100% or 0%).

If the value is within the measuring range, remove any "control error M alarm", remove the "permission for 5-line selection due to control error", and provide the average or selected narrowband sensor as a "checked" "computed signal".

If the value is out of range, go to step 10 7.

5. The algorithm checks the deviation of the narrow range sensors (A and B) from the sensor C (up to the sum of half of the wide area sensor uncertainty and the expected process deviation 15).

If either sensor A or sensor B passes the bias, the algorithm will select the sensor closest to C (A or B). This sensor is selected for further inspection. A sensor that deviates most from sensor C is designated as 20 "bad" sensors, unless it has previously been labeled "bad," and the probe is produced. sensor offset alarm, if it has not already been done before. Let's go to step 4.

If both A and B fail in the misalignment test with C, £ 5, then go to step 7 and attempt a wide area test.

PAMI Check (Step 6) 6. The algorithm checks whether the "checked" average or the 30 selected sensors pass the deviation test with the PAMI sensor (C) (within the sum of half the uncertainty and the expected process deviation).

If successful, proceed as follows: a. Delete "carrier selection permission due to PAMI error 35".

b. Providing a "ΡΑΜΙ" message together with a "checked" "computed signal".

108815 c. Eliminate any "PAMI Error" alarm.

d. Let's go to step 9.

- If unsuccessful, proceed as follows: a. Delete the "PAMI" message.

5b. Allow "carrier selection due to PAMI error".

Note: This feature allows the operator to select a second sensor cold branch as a "process 10" when the "checked" output of the algorithm does not match the post-accident monitoring indicator (sensor c).

Large Area Inspection Attempt (Step 7) 15 7. Check for C deviation from D (within the sum of half the uncertainty and the expected process deviation).

Note: When checking a single wide area sensor in the cold branch, the algorithm checks its deviation from another wide area sensor in the same cold loop (ie if in loop 1, the wide area sensor IA is checked against the wide area sensor IB).

- If the deviation test is passed, sensor C is selected

to "checked" "computed signal" and '25 do the following: a. Remove any "check error" alarm.

b. The deletion of "authorization to select a carrier due to a control error" is deleted.

c. Let's go to step 9.

.30 - Failure to Pass Failure Test Failure; ;;; lookup in. Let's go to step 8.

Failed check fstep 8) 8. The algorithm checks whether the "pass-through", "35-pin" signal from the previous pass was a "fault selection" sensor.

· [- If there was no "fault selection" last time, a validation error has occurred. The following is done: 81 1 0881 5 a. A "check error" alarm is generated b. Granted "operator selection due to a check error".

c. The deviations of all sensors (A, B, C) are checked for the last "checked" signal.

The "fault selection" sensor is the sensor that deviates least from the last "checked" signal.

d. The "fault selection" sensor signal is output as a "calculated signal" of the branch 10 Tc.

e. Let's go to step 9.

If there was a "fault selection" last time, the check has already failed and the algorithm has selected a "fault selection" sensor. The signal of this "fault selection" sensor 15 is still output as a "calculated signal". Let's go to step 9.

Selecting a "process representative" for branch (A or B) Tc (steps 9. 101 to 20. 9. Step 9 is the same as the generic validation algorithm step "6.

10. Step 10 is the same as Generic Verification Algorithm Step 7 with the following exception. The operator can select "pro-> t; | 25 process representative" of any of the above. a cold branch sensor A, B or C, or the opposite cold branch (A or B) of any sensor A, B or C.

PAMI Verification of "Q Selector" Sensor (Step 11) .30 11. Step 11 is the same as Step 8 of the Generic Verification Algorithm.

, Poor Sensor Estimation (Step 12) 12.This step is the same as the Generic Inspection Algorithm .. '35 Step 9 except that all offset checks use wide area instrument uncertainty except for offset checks that compare narrowband sensor offsets to narrowband signal. , using narrow-band instrument uncertainties.

5 Area inspection (step 13) 13.This step is the same as step 10 of the generic inspection algorithm.

A method for determining the process representative * '10 of Tco ^ d for loops 1 and 2

The "process representative" of loops 1 and Tc is determined by averaging the "process representatives" of the A and B cold branch (IA and IB in loop 1) (2A and 2B in loop 2).

Note: To simplify the processing of inputs of the "process agent" of the cold branch (1A, 1B, 2A or 2B), the algorithms in loop 1 or loop 2 agree that A represents input from branch IA or 2A and B represents output from branch IB or 2B.

..20 1. The algorithm calculates the entries from the A and B cold branches: average and gives average of the loop (1 or 2) Te »·" process representative ".

• I <2. The algorithm checks if A and B are "checked".

Yes, the average is given as the "checked" signal, going to step 5.

No, let's go to step 3.

3. The algorithm checks whether A or B is "carrier selection".

Yes, let's go to step 4.

No, give the average as a "fault selection" signal, .30 goes to step 5.

4. The algorithm checks whether A or B is a "fault selection".

Yes, the average is given as a "fault selection" signal ", going to step 5.

No, the average "operator selection" signal is given, 35 na, go to step 5.

; as 1 0881 5 5. Check the deviation of A and B from the mean, (within the sum of half of the wide area uncertainty and the expected process deviation).

- If the deviation checks are passed, remove 5 possible "Tc Cold Branch (1A / 1B or 2A / 2B) temperatures.

deviation "alarm, go to step 6.

- If either deviation test fails, a "Tc Cold Branch (1A / 1B or 2A / 2B) Temperature Deviation" alarm is generated, go to Step 6.

10 6. The algorithm checks whether A and B are in a narrow range.

Yes, give the average in a narrow range, go to step 7.

- No, give the average over a wide area, let's go to step 7.

15 7. The algorithm checks whether one or both of the outputs are out of range.

- if one or both are out of range, providing a "process representative" signal of the loop Tc, together with an "out of range" message, go to ... 20 step 8.

If both are within range, no "out of range" message will be issued with the "process * * * '- · process agent" of the loop Tc.

8. The algorithm checks whether A and B inputs are PAMI inputs.

: 25 - Yes, a "PAMI" message is issued together with a "process representative" of the TQ of the loop (1 or 2), the Tc algorithm of the loop is repeated, go to step 1.

No, no "PAMI" message is given together with the "process representative" of the Tc of the loop (1 or 2), the algorithm of the Tc-.30 of the loop is repeated, going to step 1.

<I I t •. . Method for Determining RCS TCQ ^^ - The "process representative" of Loops 1 and Tcol (j) is determined by averaging the Tcold "process representatives of Loops 1 and 2 -", '35 en ", (missing ??) \ - No, giving step 2 "process agent" as "fault selection", go to step 6.

84 108815 5. The algorithm checks whether signal 1 or 2 is a "fault selection".

Yes, we give step 2 "process agent" as "fault option", go to step 6.

No, the step 2 "process representative" is given as "operator-5 market selection", let's go to step 6.

Area Check 6. This step is the same as the generic check algorithm step 10. Let's go to step 1 and repeat the algorithm.

10

Under Pressure! An Pressure Check Algorithm (Figure 38)

The pressure of the pressurizer and RCS is measured with 12 sensors. During multiple duty cycles, the operator needs a single "process representative" for all pressure readers of the pressurizer / RCS. This value is indicated by DIAS as "PRESS". For the sake of consistency, the IPSO table also uses this value defined by the DIAS. To ensure reliability, DPS compares DIAS pressure "process agent" with its own pressure "process agent" and alerts for any deviations ,,, 20 (DPS / DIAS Pressure Calculation Deviation).

'"· The algorithm assigns a" checked "" process representative "to the pressure of the press / RCS. In situations where it is not possible to lower the" checked "" process representative "to pressure, the algorithm: 25 selects the" fault selection "" process representative "of its sensor, : Y, which is closest to the last "checked" signal, this automatic fault selection ensures that the "process representative" of the pressurizer / RCS pressure is continuously available for displays and alarms, and the operator may select a single .30 sensor pressure as a "process representative".

»14» • I *

The following section describes the algorithm and display handling: with DIAS and CRT displays.

, .Y35 1. "Process Representative" pressure is always displayed on the relevant 'DIAS screen and / or CRT screen when 85 1 0881 5 individual' process agents' are required instead of multiple sensor values.

2. The pressure algorithm and display processing are identical to the generic inspection algorithm with the following modifications: a. The generic algorithm steps 1-5 (determination of "computational signal" and faults) are modified as follows: 1. Three ranges of sensors are used ( 0-1600 10 psig), (1500-2500 psig), and (0-4000 psig).

b. The other steps of the generic algorithm (steps 6-10) are numbered according to the additional items in the block ("computational signal" and fault finding). They remain almost the same except for the small changes described in each of the 15 steps, 3. The operator can use the menu to view the values of any sensor or a single "computational sine" (as described in the generic inspection algorithm). - These options include the following: .20 P-103, 104, 105, 106 0-1600 psig For pressures ice pressure:; P-101A, 101B, 101C, 1500-2500 psig Pressurizer pressure

: .I. 101D, 100X, 100Y

P-190A, 190B 0-4000 psigRCS pressure, PAMI

* »· • CALC PRESS Computational signal: 25

Mil: V Inspection algorithm

In order to facilitate the handling of sensor identification numbers, the following letters shall be used to mark pressure transducers:

P - 10IA = A .30 P - 101B = B P - 101C = C P - 101D = D: Γ P - 101X »E

P - 101Y = F ,, V35 P - 103 = G P - 104 = H P - 105 = I

86 10881 5

P - 106 = J P - 190A 1 K P - 190B = L

5 The following algorithms are computed and displayed independently in both DPS and DIAS.

The "computational signal" of the pressurizer pressure is calculated using the antimeters A, B, C, D, E, F, G, H, I, J, K, and L. First, 10 attempts are made to use narrow range, 1500-2500 psig B, C, D, E and F). For pressures outside the 1500 to 2500 psig range, sensors in the 0-1600 psig range (G, H, I, and J) are used. If the pressure cannot be reduced with these sensors, sensors in the range 0-4000 psig (K and L) are used. If the check 15 fails in all three areas, the algorithm selects the sensor closest to the last "checked" signal as the "process representative" of the "fault selection".

This "fault signal" "computed signal" is used .. £ 0 "process representative" until the operator changes the sensor> ·; "operator selection" or algorithm passes the check.

(«♦ · j · 1 I I ·

Pressure Vessel Pressure Check and Display Algorithm • Determination of Computational Signal and Faults fvalheet 1-;: 25 131 i Test Attempt at 1500-2500 psiqrn 1. The algorithm checks if there are at least two "good" sensors at 1500-2500 psig.

Yes, let's go to Step 2.

, 30 - No, let's go to step 5 to try 0-1600 psig ';;; area inspection.

Note: The sensor is "good" unless it is labeled "bad": or suspicious at the previous passage.

* I 1 2. The algorithm calculates the average of all "good" sensors (A, B, C, D, E and F) in the 1500-2500 psig range. Let's go to step 3.

t 87 1 0881 5 i j 3. Check the mean deviation of all good 1500-2500 psig sensors (which should be in the range of half the sum of the uncertainty and the expected process deviation).

5 - If all the deviation checks are passed, go to step 4 to check if the mean is in the correct range.

If any deviation check fails, the following occurs: 10 The most abnormal sensor is marked "suspicious", after which the algorithm checks whether this is the first or second cycle of this pass.

* For the first round, algorithm 15 is repeated from step 1.

NB:

If the offset check fails in the first round, the algorithm has used at least one bad sensor to calculate the mean.

20 Implementing a second turn removes a bad sensor or detects a number of sensor malfunctions.

* For the second round, the check fails in the 1500-2500 psig range and go to: step 5 to try the 0-1600 psig range: '$ 2.

• j. NB:

Failure to pass the offset check in the second round will indicate the simultaneous existence of two or more sensors in the 1500-2500 psig range. The algorithm cannot reliably remove only bad sensors, which ··: causes a scan failure in the 1500 to 2500 psig range. 0-1600 psig inspection is attempted. This ensures that the algorithm does not calculate incorrect •• 35 signals in this case. Normally, when there are no "" simultaneous errors, the algorithm: detects multiple misalignments, removes 88 108815 sequentially one by one from the algorithm, and determines the "checked" signal.

Range Selection (Step 4) 4. The algorithm checks if the average is in the measuring range.

5 - The average or selected sensor is within the measuring range if its value does not exceed 96% or at least 4% of the narrow measuring range.

The average or selected sensor is out of range if its value is at least 98% or at most 2%! 10 narrow measuring ranges.

NBs Hysteresis prevents continuous transitions outside the area. The range is exceeded at 98% and 2% to ensure that values outside the range are not used to calculate the "audited" signal (e.g., in worst case, sensor readings could be 100% or 0%).

- If the value is within the measuring range, proceed as follows: a. Remove any "check error" alarm. 20b. Delete "Authorization of operator selection due to audit error" c. Give the average as a "checked" "calculated signal".

d. Let's go to step 12.

: 2¾ - If the value is out of range, try checking in the range 0-1600 psig and go to step 5.

Attempt to scan in the 0-1600 partition range (steps 5-8) 5. The algorithm checks if there are at least two "good" 0-1600 30 psig sensors (G, H, I, and J).

Yes, let's go to step 6.

No, let's go to step 9 to try the 0-4000 psig check.

6. The algorithm calculates the range of all "good" 0-1600 psig. * 35 average of the sensors (G, H, I and J). Let's go to step 7.

7. Deviation of all "good" 0-1600 psig sensors: Check for mean (which should be within the range of 0-1600 1 108815 for half of the uncertainty of the 89 psig range and the sum of the expected process offset).

- If all the deviation checks are passed, go to step 8 to check if the average is in the right 5 range.

If any deviation check fails, the following will occur:

The most abnormal sensor is labeled "suspicious", after which the algorithm checks whether 10 is the first or second cycle of this pass.

* For the first round, the 0-1600 psig range algorithm is repeated from step 5 onwards.

15 Note:

If the offset check fails in the first round, the algorithm has used at least one bad sensor to calculate the mean.

Implementing the second turn removes the bad sensor 20 or detects the badness of multiple sensors.

* In the case of the second round, the check will fail • V in the 0-1600 psig range and go to step 9 to try the 0-4000 psig range check: ''.

\ '2b, Note:

Failure to pass the offset check in the second round indicates the simultaneous existence of two or more sensor errors in the 0-1600 psig range. The algorithm cannot reliably remove only bad sensors, which causes the scan to fail in the range of 0-1600 psig. 0-4000 psig inspection is attempted. This ensures that the algorithm does not compute the wrong signal in this case. Normally, when not, -3½ are multiple concurrent errors, the algorithm detects multiple misalignments, removes 90 108815 consecutively one by one from the algorithm, and determines a "checked" signal.

Range Selection (Step 8) 5 8. The algorithm checks if the average is in the measuring range.

- The average or the selected sensor is within the measuring range if its value is up to 96% or at least 4% of the 0-1600 psig measuring range.

- The average or selected sensor is outside the measuring range if its value is at least 98% or at most 2% of the measuring range 0-1600 psig.

Hysteresis prevents continuous transitions outside the area. The range is exceeded at 98% and 2% to ensure that values outside the range are not used to calculate the "checked" signal (e.g., in worst case, sensor readings could be 100% or 0%).

If the value is within the measuring range, proceed as follows: a. Remove any "check error" alarm. 20b. Delete "Authorization of operator selection due to a control error". · C. Give the average as "checked" as "computed signal".

d. Let's go to step 12.

• 2-5, - If the value is out of range, try checking in the range 0-4000 psig and go to step 9.

MM

Attempt at 0-4000 psig (Steps 9-11) 9. The algorithm checks whether both sensors (K and L) in the 0-4000 psig 30 range are "good".

Yes, let's go to step 10.

- No, it is not possible to check the 0-4000 psig range, ·, · go to step 13.

. 10.The algorithm calculates K and L (0-4000 psig sensors), 05. average. Let's go to point 11.

91 108815 The deviation of II.K and L is checked against the mean (which should be in the range of 0-4000 psig for the sum of half the uncertainty and the sum of the expected process deviation).

If both deviation checks are passed, the following 5 steps are performed: a. Remove any "check error" alarm.

b. Delete any "carrier selection permission due to a control error" c. Let's go to step 12.

10 - If either of the non-conformance checks fails, go to step 13.

PAMI Check (Step 12Ϊ | 12.Is the "Checked" "Computational Signal" passes through! 15 Peak Check with PAMI Sensors. Method a is used if the "Checked" "Computational Signal" is 1500-2500 psig or 0 -1600 psig, and method b if 0-4000 psig.

Method (a) The deviation shall be within the range of half the instrument uncertainty, the process deviation and the sum of the instrument position constants within the range of 0 to 4000 psig.

: .i.r Method (bl The deviation must be within the half of the uncertainty of the instrument within the range 0-4000 psig and the sum of the process deviation: '25.

»· • j · - Yes, do the following: .. * a. A" PAMI "message will be issued, unless already done.

b. Remove any "carrier selection permission due to PAMI error".

30 c. Let's go to step 14.

No, do the following: ··>: a. Delete any "PAMI" message.

·. · B. Generate "PAMI Error" alarm, if not already * •:; ' made.

, * 35 c. Allowing "operator selection due to PAMI error · ·".

t t:. d. Let's go to step 14.

i 92 10881 5

Failed Check (Step 13) 13. The algorithm checks if the "calculated" signal from the previous pass was a "fault selection" sensor.

5 - If there was no "fault selection" last time, an error has occurred right now. Do the following: a. Generate a "check error" alarm.

b. The offsets of all sensors (A, B, C, D, E, F, G, H, I, J, K, and L) are checked for the last "checked" 10 signals. The sensor with the least deviation from the last "checked" signal is selected as the "fault selection" sensor.

c. The "fault selection" sensor signal is output as a "computed signal" of the pressure in the pressurizer.

15th Granting 'permission to select operator due to a control error'.

e. Let's go to step 14.

For pressure, the selection of a "process representative" of pressure (steps 14. 20 151 14. Step 14 is the same as that of the generic inspection algorithm: V 6.

15. Step 15 is the same as the generic verification algorithm step

Ci * 7.

: 25 * · PAMI Verification of "Qperator Selection" Sensor (Step 16Ϊ16) Step 16 is the same as Generic Inspection Algorithm step t 8 except that the criteria for the deviation check are as described in step 12 of this pressure tester and display sub-30 algorithm.

»'Bad Sensor Estimation (Step 12) 17. This step is the same as Step 9 of the Generic Inspection Algorithm • * except that the criteria for the deviation check / 35 are the same as described in step 12 for this pressure tester and _ ·· display algorithm.

I »<I - 93 1 08 81 5!

Area check (step 18ϊ18) The algorithm checks whether the "process agent" is at or above the maximum numeric value (1600 psig for 0-1600 psig sensors, 2500 psig for 1500-2500 psig 5 sensors, 4000 psig for 0- 4000 psigs for sensors) or at or below the lowest numeric value (0 psig for 0-1600 psig and 0-4000 psig, 1500 psig for 1500-2500 psig sensors).

Yes, the message is "out of range" along with the "pro-10 process representative" signal. The CRT screen displays a multiplication sign (*) above the "process agent". Let's go to step 1 and repeat the algorithm.

No, let's go to step 1 and repeat the algorithm.

Note: 15 The "out of area" message tells the operator that the actual process value may be below or above the sensor measurement range.

Claims (25)

108815 94 1. Nuclear power station control complex, the power plant comprising a plurality of off-site control components and sensors, characterized in that the complex comprises: 5 main control rooms having at least one console including parameter detectors for displaying power plant operating values, alarms for abnormal status a display of fluid operating currents for generating associated component operating parameter values and component status visual images, and means for manually stopping the reactor, a first type digital processor means associated with 15 parameter sensors, alarms, and controllers; a second type of digital processor means associated with a display; a power plant protection system and an associated third type digital processor device responsive to at least which-. also for power plant sensors, to automatically shut down the reactor from 1 to 20 in the event of a dangerous event; : a rescue system to adjust at least some power plant components in the event of a dangerous phenomenon; a component control system for adjusting power plant components for normal operation; • a power control system for controlling the reactor power level; means for transmitting data from a protection system, a rescue system, a component control system and a power control system to each of the first and second digital processor means; 95 10881 5 means for separately computing representative values of power parameters in the first and second digital processor means; Means for associated with said second type of digital processor means for providing said display screen with operating parameter display values based on comparing representative values of said first and second type of processor means. A control complex according to claim 1, characterized in that the first type of processor means is distributed to each console and that the second type of data processing means is centralized separately from each console. 3. Improvement in a nuclear power plant having a nuclear steam / steam generation system that includes a plurality of components that work together to perform power plant operations that include critical shielding functions; be maintained to keep the power plant safely in a stable condition ^: 20 to maintain the health and safety of the population; means for measuring power plant operating variables and generating operating parameter signals from said measured variables; a control room comprising data processing means responsive to operating parameter signals for displaying control information including parameter values and para meter alerts to the operator; characterized in that the enhancement of the means for displaying control information on critical security functions includes: means for displaying anywhere from the control room through a visual display · 30 display screens · ··, an indicator for each critical security function associated with each critical function an operating path indicator wherein each of the operating path detectors 96 1 0 8 81 5 represents at least a preferred power component assembly capable of performing a corresponding critical operation, a key parameter value representing each critical operation, a status indicator of a preferred operating path for each critical operation (on / off or active / inactive) and adjustability (whereby the state can be changed), parameter alarm along with the key parameter value when an alarm signal related to the key parameter is generated, an indication that an operating path is unavailable when the operating path cannot be activated to achieve minimal acceptable performance. Improvement according to Claim 3, characterized in that the power plant functions include critical mission functions 15 which must be performed by the continuous power generation of the power plant! and means for displaying screens from each of said alerts, status indicators, key-parameter-! and both mission critical and mission critical. . ·. from unavailable alarms. I · '••• 20 Improvement according to Claim 3, characterized in that: * that the power plant can be run in any of a number of conditions and that critical functions and paths are dependent on: the mode of operation. Improvement according to claim 5, characterized in that the modes include normal operation, ramp-down, cold-start / refueling and after-run. Improvement according to claim 3, characterized in that the means for displaying on the large screen also displays an alarm on the operating path if the operating path is: ,,, 30 going but the performance quality is below an acceptable minimum criterion. 97 1,0881 5 8. Improvement in a nuclear power plant having a nuclear steam-steam generating system comprising a plurality of components operating together to perform power plant operations; means for measuring power plant operating variables and generating operating parameter signals from said measured variables; a control room comprising data processing means responsive to operating parameter signals for displaying control information including parameter values and parameter alerts to the operator; means responsive to operating parameter signals for automatically triggering component protection activity in the event of certain abnormal situations, means for the operator to adjust the components related to the protection, and means for adjusting the power generation components of the power plant, characterized in that the improved data processing method to display control information for critical operations includes: storing a hierarchy of display pages including an I vertex page containing a plurality of detector matrices that respectively indicate • several power plant critical functions ;. . ·. including critical security features,. which must be carried out in order to maintain the plant in a safe and stable state while maintaining the health and safety of the population; , and mission critical functions to be performed ';;; 25 power plants to ensure uninterrupted power development, a first-level screen containing a hierarchical search, ··, a memo for each critical activity indicator, and a number of critical activity path notifications associated with: * 30 for each critical function, each operational path indicator representing a power component assembly capable of performing a corresponding critical function, '··' a plurality of second level display pages corresponding to each critical function and containing information about the k-35 operating state, and a plurality of operations of the component configuration of each of the operating paths, and a plurality of third level display pages containing detailed diagnostic information of the operating path component 5; that the state of critical operations is continuously determined by comparing parametric signals with the acceptance criteria for critical operations of the power plant; illuminating a single critical activity indicator on the tip page when the acceptance criterion for a single critical activity is not satisfactory; and that the operator has means for accessing the first, second and third level display pages, whereby the operator can diagnose the operating paths associated with the illuminated critical action detector. Improvement according to Claim 8, characterized in that the vertex page displays * at least one key parameter representing each critical I ·: · * function, and an alarm detector with the key parameter display when a parameter alarm related to '... 20 key parameters occurs, and at least one operating path state for each critical operation ;. f operation, including associated component configuration status and adjustability, and with status with alarm detector when | , the route is not available or running. • '' '25 Improvement according to claim 9, characterized in that the display of the status of each path on the vertex includes a geometric pattern together with shape, text and color code. · '· _ Enhancement according to claim 9, characterized in that '' 30 the shape code is hollow / full to indicate an active / inactive state, and the 99 10881 5 color code is green / red (closed or off / open or on) and yellow for a parameter alarm to express. Improvement according to claim 8, characterized in that each path detector in the directory is so touch sensitive that by touching one such detector the operator can retrieve a second level display page associated with said touch path detector. Improvement according to Claim 8, characterized in that the plant is operable in any one of several states, and that the acceptance criterion for critical operation is dependent on the state of operation of the power plant, including power generation and after-use. 14. The enhancement of claim 8, characterized in that the second level display page includes a trend in the key parameter associated with it. The enhancement of claim 8, characterized in that each of the second level display pages includes a high level trace, 1.20 television diagram of the associated critical action paths. The improvement according to claim 9, characterized in that! that • · · MM • ft. said top page is continuously displayed on a large, centrally located screen that is visible throughout *; · «25 control rooms, and that *» * • y 'for said first, second and third level pages: · .. from one operator panel with another display screen. 17. The improvement of claim 16, characterized in that: · · · status, availability, and progress information is displayed on the tip display, and that on the 10010881 5 displays, the operator panel displays a tip display. The improvement of claim 8, characterized in that states of the critical path paths are continuously determined, including the availability of the critical path paths, the current path state and the current path, and that the results are provided for storage in said memory means; 10 generating an operating path unavailability alert if the operating path cannot be triggered to reach an acceptable minimum performance criterion; and generating an action path unavailability alert if the action path is activated but the performance quality is less than the hy-15 acceptable minimum criterion. 19. Improvement in a Nuclear Power Plant with a Nuclear Steam Generation System comprising a plurality of components that work together to perform power plant operations in multiple power plant operating modes; means for measuring power plant operating parameters and for generating parametric signals from said measured variables; control room,! including data processing means responsive to the parameter signals to display control information including 'parameter values and parameter alarms in response to non-standard parameter signals, to the operator at least * "· on one display screen; in the event of abnormal situations, the means by which the operator can "SO adjust the components associated with the protection, and the means by which the operator can" adjust. 1a can adjust power plant related components, characterized in that the method by which an operator may use computing methods to diagnose power failures that compromise the power plant's ability to perform critical operations includes: 101 1 0881 5 showing a vertex a detector array that identifies a number of critical power plant operations, including critical security operations that must be performed to maintain the plant in a safe, stable state while maintaining health and safety of the population, and mission critical operations that must be performed at the power plant multiple detectors that indicate a plurality of critical action paths associated with each critical action, wherein each the aisin represents a butter-15 malacomponent assembly that can perform the critical operation associated therewith; automatically monitoring the parameter signals of the key parameters representing each critical operating process; ': And continually checking the monitored key parameters for status:: '20 and comparing with the context-dependent acceptance criteria; That if a certain critical action fails the acceptance criterion because an abnormal parameter signal is associated with a component in a system expected to perform a critical action, a critical action alert signal is generated that is specific to said critical action, and denotes ·: * ·: an alarm condition in said first matrix of the information *; the critical activity indicator; • · · · · · · · · · · · · · · that the critical activity activity "" is automatically monitored for the availability, activity status and progress of the route: 30 and the context-dependent acceptance criterion; IM that if a certain critical activity activity route fails the acceptance criterion from an abnormal parametric signal of a particular component of the operating path configuration, generating a 102 1 08 81 5 operating path alarm signal specific to said particular operating path and indicating an alert state on the top page of said particular operating path indicator; contains a hierarchical directory of each critical activity indicator and a plurality of critical activity route indicators associated with each critical activity, each activity 10 path indicator representing a power plant a system component configuration capable of performing a corresponding critical function, second level display pages corresponding to each critical function and containing, for each path associated with the critical functions 15, a system component configuration for that activity status, availability, and current activity, detailed diagnostic information related to the second level display page; that the corresponding alarm detector is recorded when the critical: 'operation alarm or path path alert has been generated and detected on said vertex page, »· * for the first level screen critical path indicator iitt25 and the path path indicator the second level screen system path component: ·. for the configuration of the system from which the alarm signal, ···, originated, ·· on the third level display page containing information. "30 of the components from which said abnormal signal is due to a malfunction; 103 1 0881 5 that while viewing the alert indicator on the tip display page, a first level display page is selected to appear in one of said screens so that the operator can examine hierarchical that, while looking at the first level display page, selecting a second level display page containing a system with an abnormal parameter alarm to appear in one of the 10 mentioned screens; that after the step in which it was selected; a second level display page, selecting a third level display page containing diagnostic information associated with the component from which the abnormal parameter alarm signal originates. A method according to claim 19, characterized in that the tip screen is a large screen that is visible throughout the control room, and that »♦ '! said second screen is in the control room on the operator panel. • · ♦ :, .. 20 A method according to claim 20, characterized in that: • · · the operator can optionally display a tip screen on said second screen, and that ·: * ·: while the tip screen is on said second screen, * ”25 operator selects and displays the first level display page in said first pane. t The method according to claim 19, characterized in that the method further comprises the steps of storing, for selection and display, the first 30 displays, for each main system (primary circuit, secondary circuit, power control, electrical system and auxiliary systems). ), an alternative first level display page containing a hierarchical indicator directory for each main system and a plurality of 5 subsystem indicators for each system, each subsystem indicator representing a subsystem of power components of said main system, alternate display pages corresponding to each major system and and an alternative third level display page containing detailed diagnostic information to the second level display page l components of the system; that each of the alternate first, second, and third level display pages displays an alarm indicator indicating the origin of the alarm parameter; that the top page displays a menu containing touch sensitive images for said operator on said second screen. ': Any of the first or alternate first:;' 20 to display and display; ,; ·; that the said generated and displayed page will display a · · "operator-sensitive image for displaying and displaying a second-level or alternative second-level display page. i ,,., 25 The method of claim 19, characterized in that said vertex display page displays symbols indicating the preferred operating state of each critical action. A method according to claim 23, characterized in that the operating path state is displayed by separate symbols indicating the operating state (on / off or active / inactive) and adjustability (the ability of the operator or protection means to change the operating state). 105 10881 5 A method according to claim 24, characterized in that the symbols are displayed as a shape code.