FI108816B - Console of a control complex for a nuclear power plant - Google Patents

Description

i 108816 O Nuclear Power Plant Control Complex Console

The present invention relates to apparatus and methods for monitoring and controlling the operation of commercial nuclear power plants.

Conventional commercial nuclear power plants have a central control, where the operator has equipment for collecting, detecting, reading, comparing, copying, calculating, modifying, analyzing, confirming, monitoring and / or verifying data from multiple sensors and alarms. Normally, the main operating systems of a control room are installed independently and also function independently. Such systems include 15 controls that control parts and processes of the power plant, and control that deliberately modifies or adjusts parts or processes, and security that identifies and threatens immediate corrective action to the safety of the plant.

:: '3 ° As a result of the organization and operation of such a conventional control room, the operator may sometimes be exposed to too much information or stimulation. Ts. the amount of information and the large amount and complexity of the equipment available to the operator based on such '.'λ' information may exceed the cognitive limits of the operator and thus cause errors.

The most prominent example of the inability of operators, especially in unexpected or unusual power plant phenomena, to: 30 observe the enormous amount of information that comes to the control room and act upon it, is the accident at Three Mile Island Nuclear Power Station in 1978. Since then, the industry has paid particular attention to improving the operation of power plants by improving the performance of the control room operator.

: / .: 35 The key to this development process is the design principles that adapt work to people.

2 108816

Advances in computer technology since 1978 have given nuclear engineers and control room designers the ability to display more information in more than 5 different ways, but the effect can be counterproductive because too much information is part of the problem. Adding "user friendliness" while maintaining the amount and type of information available to the operator has created a difficult technical problem.

Therefore, it is an object of the present invention to provide an apparatus and method for nuclear power plant control and monitoring functions, which include compact data processing and presentation, reliable architecture and hardware, and easy maintenance of components while eliminating excessive information to the operator. This is achieved in combination with improved control room reliability, ease of use and lower overall cost.

: 20 The present invention solves this problem with a number of features that are novel, • both independent and combined, when they form a control room complex.

«,.

X The complex consists of six main systems: (1) central control panel ". ','. 25 liters, (2) data processing system (DPS), (3) detector detector '' and alarm system (DIAS), (4) component control system consisting of protection components controllers (ESFC) and process component controllers (PCC), (5) power plant security system (PPS) and (6) power control system (PCS). These six, i: 30 systems collect power plant information, efficiently present the required information to the operator, perform all automation. X measures and allow direct manual control of power plant components.

The control complex of the present invention has: /.! a top-down unified data presentation and alarm system that supports the evaluation of critical aspects of power plant safety and power generation 3 108816. It guides the operator in locating the information needed for further diagnosis of important assessments. In addition, it significantly reduces the number of display devices required compared to conventional power station booms. The complex also reduces the amount of information the operator has to process at one time; it also reduces the impact of malfunctioning display devices. In addition, it eliminates the need for monitors that are only used in abnormal conditions at the power plant.

10

It is known that the steam system of a nuclear power plant can be kept in a safe, stable state by certain safety critical factors. The present invention extends the concept of power plant safety critical factors 15 to include power plant power critical factors so that combining these two sets of factors in the information provided to the operator supports all power and safety critical and critical factors.

; * * 2: 0 In the data presentation hierarchy of the present invention, there is * * at the top a "main table", i.e. a combined process state descriptor (IPSO), which acts as a standalone location that can quickly provide a «t | assess key information related to critical factors for power plant safety and power generation. Sources and directions for changes in normal or abnormal>> ::: 25 paint parameters can be found in * # · '· * in more detail in DIAS. Both IPSO and DIAS provide direct access to and guidance on system and component status information contained in the hierarchy of DPS-controlled CRT screens.

,, :: 30 IPSO continually displays location-specific information that indicates the state of critical factors for power plant safety and power generation. This information is represented by a few easy-to-understand symbols, which are the result of • ': 35 highly processed information. Therefore, the operator does not need to combine large amounts of individual parameter information, system or component status information and alarms 4 108816 to find out the operational status of the power plant. IPSO presents to the operator the high-level effects of low-level component problems. The format of the IPSO key data is primarily based on the direction of the parameter change, i.e. higher / lower, and the shape and color of the alarm symbol. These are supplemented with the values of the selected parameters. The IPSO provides aggregated and simplified information to the operator in small amounts and in a form that is easy to perceive and understand.

10

In addition, the IPSO eliminates the drawbacks of current industry trends in presenting all information in serial form on CRT displays, allowing the operator to obtain an overall view or "feel" of the power plant status. A general presentation of the status of the 15 power plants on the large, dedicated display brings two other aspects. First, the operator's tasks often require detailed diagnoses in very limited process areas. However, it is necessary to keep a record of the operation of the entire power plant: 20 at a time. Rather than having several operators in the control room monitor similar detectors or the like with separated panels, the IPSO can be seen throughout the control room and thus provides the operator with continuous information on the overall operation of the power plant, regardless of the detailed nature of its task. taking into account their ability.

In a preferred embodiment, the IPSO supports the evaluation of critical factors in power generation and safety by providing, for each factor, key state parameters indicative of a functional state. For each factor, paths are selected: based on the status of the path shown. IPSO combines the factors ·, clearly with the physical reality of the power plant. Critical factors - !!! this applies to power generation, normal reactor boom * ;. rushes and optimal recovery methods.

i'is

The second level of the data presentation hierarchy of the present invention is the presentation of power alerts from the DIAS. A limited number of fixed, discrete tiles with three different alert priority levels are used herein. Dynamic Alarm Handling utilizes power plant status information (eg reactor power, reactor trip, fuel change, shutdown 5, etc.) as well as system and equipment status to eliminate unnecessary and redundant alarms that could contribute to excessive operator exposure. The alarm system provides easy-to-understand guidance on additional information contained in separate detectors, 10 CRT displays and controls. The alarms are based on validated data, so the alarms tell you about the actual process problems at the power plant, not about instrument or control system failures.

15 Alarm features include a detailed message to the operator through the window when an alarm is acknowledged and the ability to combine alarms without losing individual messages. Alarm panels can dynamically display different priorities to the operator. The acknowledgment method ensures: 2 <$ that all alarms are acknowledged, but at the same time it reduces: the operator's workload by first giving a short beep followed by a continuous alarm followed by a reminder tone to ensure that the alarm has not been forgotten. The operator may temporarily interrupt the alarm flicker ”25 to prevent visual overload, and restore the flicker to ensure that the alarm is eventually reset.

The DIAS detectors constitute the third display level of the hierarchy of the present invention. Plane panel displays ..3: 0 compress multiple signal sources into a limited set of readings that regularly monitor key plant information.

. Verification of signals and automatic selection of the most accurate detectors in the signal range are used to reduce the number of detectors on the control panels. Data readings: 3.5 are derived from the touch screen for improved operator interaction and include numerical parameter values, bar-based analog display and dot plot.

108816

Multiple range sensors are available on a single screen with automatic sensor and display area selection. The automatic calculation of the parameter value of the correct process representation, together with a plurality of single sensor readings available on the same display, reduces the need for separate additional displays or the need to keep different displays for normal operation and an accident or subsequent situation.

10

A further advantage of the present invention is that the parameter check automatically detects a faulty sensor or a plurality of faulty sensors, while allowing continuous operation and accident mitigation data to arrive even if a CRT display is not available.

Further, normal display information may be attached to an approved sensor, such as may be used, for example, for monitoring purposes following an accident.

At the information display level j associated with the control of certain components, there are dynamic "soft" controllers that contain component state information and control signal information that the operator needs to control these components. In the ESFC system, this information includes a status light, on / off switches, modulation switches, on / off switches, and logic controllers. In the PCCS, this information includes load, setpoints, operating range, process values, and output of control signals.

., $ 3 The dynamic CRT display pages on the fourth level of the data hierarchy complement all the positions defined. ·. controllers and information, and can be accessed from any CRT screen in a control room, technical support center, or alarm room *. s. These displays are organized into a three-level hierarchy consisting of: 3.5 general monitoring (level 1), power plant components and: ': systems control (level 2) and component / process diagnosis (level 3). The implementation of the displays is controlled by DPS and doubles and ensures the handling of all individual alarms and detectors on the DIAS.

7 108816

In a preferred embodiment of the present invention, the detection, alarm and control functions associated with a particular major area of operation of the power plant 5 are grouped into a single modular panel. Cuts can be made to the panel, with positions that determine the position of the detectors, alarms, controls, and CRT, regardless of the power plant's operating system. This allows 10 panels to be delivered, installed, and pre-tested before power plant-specific logic and algorithms are finalized, which can be programmatically modified at a later stage of the power plant construction schedule. Such a block structure can be achieved because the space required by the panel is essentially independent of the main system of operation of the power plant.

Both alarms and detectors can be easily modified by software. The available space of the panel does not significantly limit the number of alarms and detectors that can be displayed to the operator, so it is possible to standardize the size and intersection of the panel for display windows.

• * »» * «

The foregoing and other objects and advantages of the present invention will be described in connection with the preferred embodiment with reference to the accompanying figures.

Figure 1 is a view of a nuclear power plant control unit according to the present invention.

Figures 2 (a) and 2 (b) together define a schematic representation of .3: 0 system-wide communication related to the invention.

, X Figures 3 (a) and 3 (b) show the first type and the patterns, ·· '. 3 (c) and 3 (d) show another type of modular panel according to one feature of the invention.

Figure 3 shows the primary page display screen directory of the CRT screen according to the invention.

8 108816

Figures 5 and 6 show preferred component symbols and shape codes used in accordance with the invention on CRT and IPSO displays.

Figure 7 is a typical detector display with graph 5 according to the invention for pressure and level of the pressurizer.

Fig. 8 is an indicator display for the system pressure and level menu page associated with the detector of Fig. 7; Fig. 9 is a schematic representation of an alarm display method according to the present invention.

Fig. 10 is a typical display page according to the present invention showing an alarm in a menu option of a first level display page.

Fig. 11 is a schematic summary of the workstations of the complex 15 shown in Fig. 1, which are classified in a first level display page group.

Fig. 12 illustrates a typical display page directory which displays display pages containing alarm information.

Figure 13 illustrates the information supporting the alarm on the CRT after -20 after the alarm has been acknowledged.

: Λ Figure 14 shows a classified alarm list available to the operator on a CRT screen.

• tl: v. Figure 15 is a typical alarm slab combination with reactor cooling system and sealed alarm panels, '125 associated with individual detector and alarm systems.

Fig. 16 shows a reactor coolant pump alarm panel display with one panel activated.

Fig. 17 shows the alarm display of Fig. 16 after acknowledgment of an activated alarm.

, .3: 0 FIG. 18 illustrates an alarm display that is displayed by the operator by touching the alarm status information areas shown in FIG. 17. , · '.

»1

Figure 19 shows a CRT display of a primary system.

Figure 20 shows a second level page CRT display based on; $ .5 to the first level page shown in Figure 19.

= /; Figure 21 shows a third level display page obtained from the second level page shown in Figure 20.

9 108816

Figure 22 illustrates and explains menu selection ranges for CRT display screens.

Figure 23 illustrates a typical CRT display page corresponding to alarm plaque presentations.

Fig. 24 is a diagram showing the hierarchical relationships of CRT display pages.

Figure 25 illustrates an Integrated Process State Display (IPSO). Figure 26 is a schematic representation of symbols illustrating directional information for IPSO parameters.

Figure 27 is a schematic representation of the integrated data representation of the present invention.

Fig. 28 is a block diagram associated with Fig. 2 illustrating the relationships between the main control room systems of the present invention.

! Fig. 29 is a block diagram showing the inputs and outputs associated with the detector and alarm systems of the present invention.

Fig. 30 is a schematic representation of the use of checked sensor data for monitoring and controlling according to the present invention.

:: FIG. 31 is a functional diagram of a technical security system and component control system with recommended connections of: "-" according to the present invention.

.: FIG. 32 illustrates a typical display page directory associated with the control of 25? -Critical factors made possible by the data processing system of the present invention. Figure 33 shows a first level critical factor screen associated with the hierarchy shown in Figure 32.

Figure 34 shows a first level critical factor display-3Q after a reactor visit.

Figure 35 shows a typical second level critical factor · A glacier fill page associated with an inventory control system. Figures 36 (a) and 36 (b) are schematic representations of a typical •• prior art design of instrumentation and 35 control, and an accelerated design process:: · which is possible using the present invention. modular panels according to the invention, respectively.

Figure 37 shows a separate hot and cold primary loop temperature indicator display showing all sensors used in the counting algorithm.

Figure 38 is a summary of the types of sensors used to determine the pressure of the pressurizer and the way they are used to determine the pressure value representative.

10 I. Overview of the Control Complex II. Panel Overview A. Alarm and Messages B. Detector

C. CRT

15 D. Controller E. Display Models F. Display Assembly

III. DIAS

A. Discrete Detectors 2 $ '·· B. Functional Algorithm Adder C. Alarm Processing and Display 1. Space and Device Dependency 2. Sub Functionality Group 3. Shape Color Coding 25: ·, 4. Alarms in CRT 5. Alarm Status Definition 6. Alarm Confirmation

IV. DPS

A. CRT

3o !: 'B. IPSO

V. Control Room. .-. VI. Modularity of the Panel ••• APPENDIX (Decision Algorithm) 35. 'Figure 1 shows a control panel complex according to the preferred embodiment of the present invention. At the core of the main control room 10 is the main control console 12, which allows one person to operate the nuclear power plant steam system from a hot shutdown to a full power production mode. It should be noted that the control room described herein and its apparatus and methods may be used in connection with light water reactors, heavy water reactors, hot gas cooled reactors, liquid metal reactors and advanced passive light water reactors, but for practical reasons this description is based on N

10 The main control console 12 of such an NSSS typically has five panels, one for each of the following system components: a reactor cooling system (RCS) 14, a chemical control system (CVCS) 16, a nuclear reactor core 18, a feedwater and sealing system (FWCS) 20 and a turbine system 22. 15 will be described in more detail later, the monitoring and control of these five power plant systems will be handled by the respective panel of the main control console.

Immediately behind and above the reactor core control and control panel 2¾ '• is a large table or display 24 with •'. ' displaying a combined process state overview (IPSO). This. • '' Because of this, the operator can easily see the five panels and the IPSO board while sitting or standing in the center of the main console.

2.5; -The left side of the main control console is a security-related console 26, which typically includes modules related to security monitoring, technical security, cooling water, and related functions. On the right side of the main control console is an external system console 28, which 3Q. ':' Includes a secondary circuit, auxiliary power supply and a diesel generator, a switching field and a heating and ventilation system. , * .module related modules.

It is recommended that the power station computer 30 associated with the control room and the mass storage devices 32 be housed in separate device rooms 31 to improve fire safety and sabotage protection.

12 1 08 81 6 j Control room complex 10 also has a supervisor office 34, I with full view of the control room, Technical Support Center | (TSC) 36 and an out-of-control observation level, as well as exterior offices 38, which can handle the paperwork associated with the power plant. The furniture of the control room shall be placed as appropriate for the operations of the operators. There is also a remote fire extinguishing room 42 (Figure 2) for post-accident monitoring (PAM).

10

Figure 2 is a schematic representation of the links between power plant components and sensors, which are considered conventional herein, and panels of the main control room. From Figure 2, it is clear that the information flows in both directions through the dashed line 46, which 15 represents the boundary between the steam system of the power plant and the turbine system. The NSSS status information and sensor information 48, used in the power plant security system 50 and the PAMS 58, passes directly through the NSSSs boundary 46. The control signals 52 from the power control system pass directly through the NSSS boundary. Other control signals »2fQ '· system 60, 62, which originate from the technical security device control system 56 and the normal process component control system 64, are connected across the NSSS boundary • · * •' • ': by remote multiplexers 6 Power plant safety system, ESF • · component control system, process component control

MM

35, · the system, the power control system, and the PAMs are connected to the main control room 42, to each other, to a data processing system (DPS) 70, and to a detector and alarm system (DIAS) 72.

Figure 2 illustrates a significant feature of the present invention, which is the combination of monitoring, control, and safety information under both normal and accidental conditions such that it is up to the operator to determine the appropriate operating mode. will be greatly facilitated. In the following sections, V. describes how this was achieved.

35 / • ': II. Panel Overview 13 1,088 6

Figures 3 (a) and 3 (b) show diagrams of a standing / sitting panel, such as a reactor cooling system panel 14 located in the main control console 12 according to one embodiment of the present invention. Figures 3 (c) and 3 (d) illustrate an alternative embodiment, whose panel is only used when standing. The substantially flat top or wall 74 of the panel is positioned upright and the substantially flat bottom or table is substantially horizontal. The control and alarm connections are at the top and the control connections are at the bottom 10.

A. Emergency Messages The alarm functionality (see Figs. 9, 15-18) includes an alarm-15 and a message interface (A&M) 78 with a plurality of tiles 80 each bearing a specific letter word, i.e., an acronym or equivalent reference 81. The alarm condition is indicated by tile lighting. and a beep. The operator must acknowledge the alarm either by pressing a plate or by any other * · 20 method designed for this purpose. Number of tiles in a given panel • 'J.Depends on the number of different alarm conditions that can: ["arise from the system being monitored, or cooling system. Typically, each panel has hundreds of · · / such tiles. The alarm is classified into three (3) different * * ·« 25 , · Alarm class (Priority 1, Priority 2, Priority 3 for immediate action, prompt action and higher alertness) The alarms in this RCS panel depend on the state of the equipment (Normal RCS, Heating / Cooling, Cold Shutdown / Fuel Change ja and Reactor) ·· trigger) If a high priority alarm activates a lower priority alarm associated with the same <* «parameter, the lower priority *»; / priority alarm will be automatically reset when the conditions j · »· ί, ·· improve, the higher priority alarm will blink and •• Operator Acknowledge aa High-Priority 35 · Alarm Exit If a lower-priority alarm exists in the Water, its alarm window or indicator will go into acknowledged state when the operator acknowledges the higher-priority alarm.

14 1 08 81 6 B. Indicator 5

The second monitoring interface consists of process variable indicators, such as reactor coolant temperature, pressure level and pressure, and other RCS parameters. Separate detectors 82 (see also Figures 7 and 8) provide a better method for presenting the parameters of the RCS panel 10. Some RCS panel parameters require a constantly updated display and graph for the master control console. Power plant process and class 1 parameters such as pressure level and RCS coolant temperature fall into this class. Other RCS panel parameters are used less frequently. The operational parameters are obtained from the detectors 82 if the data processing system (CRT displays) is not available. These include the Class 1 and 2 Parameters of Regulation 1.97 (Regulatory Guide), Priority 1 and 2 Alarms and other operationally relevant parameters: '- 2.:05 essential parameters that are locally inaccessible and must be monitored by the operator when information is available. ·. up to twenty processing systems are in use:. four (24) hours. These less frequently monitored parameters are available in standalone detectors, which are displayed by the operator ;; J25 by selecting the appropriate menu. The menu displays the available "· * data items in alphabetical order. No separate indicators are required for the parameters displayed in the process controllers.

C. CRT

..[major

In addition, the CRT display 84 provides a view of the main vessels, JV pipes, pumps, valves, etc., related to e.g.

;;; to the reactor cooling system, and displays alarms and values of parameters that may appear as a bar, graph,? 35 graph, or otherwise displayed on other displays 78, 82 (see Figures 4-6, 10, 12-14, and 19-23). From this CRT screen, all NSSS information is available to the operator. This information is presented in a 1 0 8 81 6 three-level hierarchy that is consistent with the operator's perception of the system. Figure 4 shows the primary page of the NSSS page directory 84, which contains all CRT pages of functions associated with the RCS panel.

5 D. Controller

The control portion 76 of panel 14 has a plurality of separate on / off switches on the left side. Each switch pattern 10 is associated with a particular reactor cooling pump, the supply parameters of which are immediately above. It also has analog controls, which can be conventional rotary knobs or the like (not shown), or a touch screen or 88 controlled single control.

15 The RCS has process controls so that the operator can control the process control loops manually or automatically. Process controllers allow throttle or multi-position controls (e.g., electro-pneumatic valves) to be controlled from a single control panel. Process controls are used as closed loops for the following RCS process variables: ···. for control: pressure level, pressure ice pressure, RCT seal flow and RCT seal temperature. Process controllers are designed for each control loop individually, using a uniform * ;; * 25 display group and control features.

In a conventional control room, each process control loop has its own control device, commonly referred to as the MANUAL / AUTO station. For example, the RCP sealing area system has; 30 five process control loops: one seal flow control loop for each of the four RCPs and a seal temperature control loop for the entire subsystem. Each of these five control loops has its own MANUAL / AUTO drive, which takes up a large amount of control panel space and makes comparisons between the loops: *: 35 clumsy. Although these five process loops are independently controlled, the process changes of one wizard affect the other four parameters. In conventional MANUAL / AUTO stations, it is difficult for the operator to operate simultaneously with all five MANUAL / AUTO stations.

16 1 08 81 6

The process controllers for similar processes (which are related to either the action pins or the system) are used by the RCS panel process controllers from a single control station called a process controller. Such a single controller saves panel space, utilizes appropriate cross-channel checking, and allows for easier interactions between the process loops of several interrelated processes.

Component control capabilities (i.e., activation of switch controllers) are the primary method by which the operator activates devices and systems from the RCS panel. The RCS panel has 15 forty-three components controlled by instantaneous switches. Each switch has a red status indicator for active or open mode and a green status indicator for passive or closed mode. The blue status indicators / switches are used to detect and select an automatic control:: - 20 or control via a process controller. Värikoodauk-. in addition, the red switch is always set above the green switch to enhance color separation. Each switch produces an active control signal when pressed, and each switch is inactive when not pressed. Each switch has a backlight to indicate the status of the device.

E. Dummy Models

Process display models are used to lay out data for similar processes and •: 3 0 devices. Fluid systems representations are always standardized wherever possible: top to bottom, left to right, while avoiding junctions. Inbound and outbound flow paths are set to margins. The related information is grouped according to a task and analysis specification for comparison, operating order, • operation and frequency. Process representations / presentations are based on the operator's perception of the process, 17 1 08 81 6 maximizing the power of his data collection functions. The operator's image of the system is often based on the schematics used in the training material and power plant design documentation related to the system descriptions. Graphic 5 information is represented by display page templates, which facilitates rapid perception of processes. Graphical information consists of the use of columns, flow charts and graphs (eg over time, or pressure versus temperature).

10 Bar charts are primarily used to represent flows, pressures and levels. As the plane is associated with the container, the bar graph is placed at the appropriate position within the container symbol. Plane bar graphs are vertical. If a flow chart is used to represent the flow, it is placed horizontally. Bar charts also facilitate comparison of numerical quantities.

Flowcharts are used when they can enhance the operator's image of the process. Flowcharts facilitate the understanding of control systems such as turbine control systems. where from. Operator's Tutorial Related to Process Applications ···. is often in the form of a flowchart and therefore a similar design of the display page is easy to perceive.

;; 25 Time graphs are used on screen pages when task '·' analysis indicates that the operator needs to know the parameter changes over time. In addition, the operator can create time plots from any location on the power plant computer database. In some cases, task analysis may indicate: 30 that multiple time graphs are needed to monitor process comparisons. In some situations, e.g. 1 heating / cooling curves, two parameters can be set differently ;;; ordinaattiakseleille.

».

»Tl: v35 If there are multiple time plots on the same coordinate axis, t | : '* Two vertical axes can be used for parameters with different units. The scale marks can be set in 1, 2, 5 or 10 is 1 08 81 6 increments. Smaller marks between scale marks can also be set in 1, 25 or 10 increments. The time-varying parameter is typically displayed on the screen every 30 minutes. However, the operator door adjusts the scales according to your needs 5. Logarithmic scales can be constructed using ten multiples. If the total range of the parameter is less than 10, place a punctuation mark near the center of the scale.

Time graphs in the same coordinate system use different 10 colors. If multiple curves use the same scale, the scale is gray and the curves are color coded. If different scales are used for coordinate axes, they are coded with the same colors as the corresponding curves. Time graphs do not use alarm colors or normal mode colors to avoid mixing 15 process parameters with the alarm or normal conditions.

The colors help the operator to differentiate between different types of information. Because the benefits of color coding are more pronounced when used with:: · £: 0 fewer colors, the color codes on information displays (i.e. IPSO, CRTs, Alarm Plates) are limited to seven colors. In addition, color-coded data has other features that make it easier to distinguish between data and to monitor color-poor observers.

·; ·; 25

The following colors are used in information screens to represent the following types of information. The colors have been carefully selected so that red / green colored persons can see a sufficiently large difference between the colors.

• 30

I · M

: '·' Black Background Color

Green Component Off / Inactive, Valve ;;; closed and working · Red Component on / activated, valve open • '•' • 35 and working

Yellow Alarm Mode - a color with a high spotlight 19 1 0881 6

Gray Text, markup, dash, menu option, pipe, inaccessible and un-instrumented valve, graph scale, and other non-coding applications.

Light blue Values for process parameters

White System response to operator touch, eg menu option, until system responds as expected.

10

The information system uses shape coding to help the operator identify the component type, functional state and alarm state. The shape coding of the components is based on symbol research, which included questionnaires for nuclear power plant personnel. Figures 5 and 6 show the forms used to represent components in a control room. The shape property, hollow / full, indicates the state of the component. The hollow shape code indicates that the component is active, while the filled shape code represents the passive component. The following is an example of the shape coding of the pump and the valve.

! · ·.

I *. J, '. ···. Pump A hollow pump indicates that the pump has been activated by an operator or an automatic: v control signal. A full pump means that the pump has been turned off by the operator or by automatic control;

Valve A hollow valve indicates that the valve is fully open and a full valve indicates that the valve is fully closed. The shape of the valve, which is not fully open or closed, is an intermediate shape between the solid and the hollow '130, i.e. the left side is full and the right edge is:' 'hollow.

• * ;;; The following features have been added to the valves' shape coding: ''; · _ t / Presentation:. '' 35 Valve open and available - Red color code.

Valve Closed and Available - Green color code.

20 10881 6

To Instrument Valve - Gray Color Code (Operator-Entered Position).

Valve not available - Gray color code with alarm code.

5 Missing Detector - Gray color code with alarm code and combined hollow / full shape.

F. Safety Information 10 Safety related information is incorporated into control room information to enable the operator to access safety information where possible during normal operation. In the case of human factors, this is a better method because in stressful situations people tend to use the information that is most familiar to them.

In many situations, security-related parameters are only a subset of parameters that control a particular process variable. Current control room operators typically only use control indicators during process control, and,, · they must use separate security related !!! detectors when monitoring the safety aspects of the plant. In the present invention, monitoring and control typically:; for the sake of accuracy, the parameters used are compared with the safety parameters, if any. If the parameter deviates from the safety parameter v beyond the expected values, an alarm will be given to the operator to confirm. In response to such an alarm situation, the operator may view the individual channels associated with the parameter on the diagnostic CRT page | 30 or with a separate indicator representing the parameter. The operator receives a notification when the validation algorithm is able to verify the information. The result of the verification algorithms is used in IPSO, the '·' ·· detector in the normally displayed model and the parameter '· ... ·' in the CRT display system at a higher level of the system! '. * 35 display pages. Class 1 information in regulation 1.97 is also »» t »* 21 1 0881 6 also with a separate indicator display in one location on the security control panel.

Critical function and action path (availability and action) information is available throughout the data hierarchy (see Figures 10, 24, 25, 26, 27, 32-35). Priority 1 alarms indicate to the operator the inability to maintain a critical function or the inability of the operating path to meet the minimum functional requirements. The lower priority alarms indicate the failure or malfunction of subsystems and components.

15 In the Critical Functions Matrix, IPSO provides general information that is most useful to the operator in evaluating critical functions. For critical functions or operational

route-related priority 1 alarms are reported to the IPSO

in the critical action matrix. Support information related to these alarm conditions: '· 2Ό is available from the alarm panels or CRT <·. in the critical functions area of the display hierarchy.

. ···. The Critical Functions area of the display page hierarchy contains • .. “I the following information. Level 1 Screen - "Critical *

* | functions ": this page provides more detailed information about IPSON

i * · *; · 25 of the critical function matrix. In particular, »» details of the alarm conditions (ID, priority). This guides the operator to the right of the level two critical functions screen.

bo Each of the 12 critical functions has its own second level page.

t »t

Each page contains:

Information about the critical function of the first level screen related to the critical function.

Information about path availability and critical path operation * *; * · 35.

»T - High-level information represented in a critical function / path.

22 10881 6

Time graph of the most illustrative critical function parameter.

The third-level screen in the Critical Functions hierarchy are copies of screen pages elsewhere in the hierarchy. 5 For example, the safety spray screen under the warehouse control is also in the primary area of the screen hierarchy.

III. SEPARATE AIR CIRCULATION S IN AND ALARM SYSTEM.

A. Detectors

Separate detectors 82 provide a better method for presenting security-related parameters. The most important process parameters, such as Class 1 of Instruction 1.97, require a continuously updated display and time descriptor on the master control-15 Sol. Separate detectors also handle the detection of alarms and alarms when data processing system (DPS) is not available. These parameters include Parameters 1, 2 and 3 of Class 1.97, Alarms Priority 1 and 2, and other parameters that are monitored continuously, "*? 0. Although DPS is a highly reliable and i t \ multiple computer system, you should be prepared for

<* I

24 hours inactivity. Parameters that are less frequently monitored are obtained from the individual detectors via the operator »I selectable menu.

«I ·: · 25 • ·

Each detector is capable of displaying a number of parameters related to a component, system or process. Stand-alone eyepieces have different display models, which are tailored to the specific information needs of the operator.

'Ϊ30 * * i ·

When monitoring or controlling a V process such as the pressure of a pressurizer, it is desirable for the operator to use the most accurate value of "process representative" 90 in field 92. For this type of * '' 1 *, a separate detector 82 as shown in Figs. , displays a bold digital value and an analog bar chart 94 based on the verified average of the most accurate range sensors. A preferred reinforcement technique 23 1 08 81 6 is described in the appendix and the operational status is indicated in field 96. This verified value is compared to the Post-Accident Monitoring Detector (PAMI) sensors, if available. The detector can also be used for post-accident monitoring 5 if this fits into the PAMI as indicated in field 96. This has the advantage that the operator is able to carry on with the detector he is most familiar with and used daily; use. The operator may, if desired, monitor any independent channel on the digital display of the detector by touching a personalization sensor, e.g.

15

If the parameter cannot be checked, the detector detects the reading of the sensor closest to the last value checked. In such a situation, an inspection alert will be given. The detector continues to display the value of this sensor until the operator selects another value for the detector. Separate detector * · 'fcent 96, which usually says "VALID", shows the inverse of - • "FAULT SEL". Under these circumstances, the value has not ... been checked but selected by the computer. This means that the operator should identify the available sensors that can be used as "process agents". If the '' 'operator selects a sensor (which is allowed when a check error occurs or the "VALID" signal does not conform to PAMI), the content of the field containing the "FAULT SEL" text will be replaced by the inverse "OPERATOR SELECT". When the check-30ccoror is able to check the data and all faults have been cleared, the check error alarm is cleared and the algorithm changes the field 92 '; j'FAULT SELECT "or" PROCESS:: 'REPRESENTATION "produced by OPERATOR SELECT to" CALCULATED SIGNAL ".

The 3L5 \ Separate Detectors also display the parameters needed to monitor the *. 'Power plant's overall processes or priority 1 and' · -2 alarms. Normally the most illustrative process-

S

24 108816 digital parameters. Menu options allow the operator to view other process related parameters.

The RCS panel is equipped with ten detectors. These 5 are:

1. RCP IA

2. RCP IB

3. RCP 2A

4. RCP 2B

10 5. RCP SealBleed (seal leak)

6. RCS

7 * Thot 8 * Tcold 9. Pressurizer pressure 15 10. Pressurizer level

Figure 7 shows that two interconnected detectors may be represented by a single display 82. The left half of display 82 shows the checked pressure of the pressurizer. The 2Q pressure display has the following: digital "process representative" * · 'value 90 with units of measure (2254 psig), display quality 96 (VALID),' message 98 that display is valid for post-accident light (PAMI), process value as bar graph 94, 30 minutes • time graph 104, normal operating range (NORMAL) 106, instru-25;: mentoring area (1500-2000) and bar chart unit: 'i'. <psig).

In the upper right corner of the PRESS screen, there are two buttons, "CRT" and "MENU", which touch the selected button to light up the selection mark. When the operator releases his hand from the button, * ;;; The CRT button 84 changes the menu options of the CRT display placed in the same panel as the separate indicator '·' when the button is pressed, e.g., the RCS panel 14 such as: "\ is shown in Figure 3. The CRT button searches those CRT display pages , 15 '.' Which best correspond to the parameters of the standalone indicator.

25 1 0881 6 Press the MENU button to select the detector menu (Fig. 8). The top of the menu page is usually similar to a normal screen. It includes a digital "process representation" value of 90 units (2254 psig), display quality (VALID), 5 notifications that the display is valid for post-accident monitoring (PAMI), and CRT and MENU buttons.

At the bottom of the menu page are selection buttons, such as 102, for all sensor inputs and "computational 10 signals" of this detector. Selection buttons light up when pressed to indicate selection. When the operator releases his finger, the selection is processed. There are 13 buttons for pressure: four for a pressure of 0-1600 psig: P-103, P-104, P-105 and P-106; six pressurizers for 1500 to 2500 psig: P-1510IA, P-101B, P-101C and P-101D, P-100X and P-100Y; two for RCS pressure of 0-4000 psig: P-1090A and P-109B; and one "calculated signal" for pressure: CALC PRESS. When the "Calc Press" button is selected, the pressure corresponding to the "computed signal" (i.e. output of the algorithm) is displayed. The "calculated signal" of the algorithm can be a 20. '.valid' signal. If the algorithm fails and selects * · one sensor as a "calculated signal", the "valid" message '- • would be replaced by a' fault select 'message. This "fault select" message would appear as inverse text in the detector.

• 'This message would appear in the detector whenever "CALC PRESS" 25 ;: is selected until the algorithm gives a "checked signal",:' - 'to replace the value of the "FAULT SELECT" sensor.

To change the display, the operator touches the button that contains the sensor he wants. For example, "P-103": Touching a button marked with 0 will display a reading of P-103 within the range of 0 - ;;; 1600 psig on the digital display. Digitized by the message "VALID" becomes "P-103".

:: 'Additionally, the "PAMI" message is cleared because the P-103 is not a PAMI sensor.

35'.The "ANAL / ALARM OPER SEL" button is used to select the signal used by DIAS *. 'As a' process agent '. It sets the current sensor on the digital display to · ·. The selection key for signal 26 108816 allows the operator to select any sensor for analog display and alarm processing with j "operator selection" if, for example, the following error is present: 51. If the check fails and a "fault selection" sensor is selected as "process representative".

2. If the "checked" reading does not match the PAMI detector (s).

10 If the fault is present and the operator wishes to select the P-103 as a "process agent", he selects this menu, selects the P-103 on the screen, and then touches the "ANAL / ALARM OPER SEL" button. The message underneath the digital display in field 96 changes to "P-103 OP SEL". Whenever the P-103 15 is selected for display, it has a reverse text message "OP SEL" which indicates that the P-103 reading is used as a "process representative". After setting the sensor to "process agent" by "operator selection", the operator is expected to press a button labeled "ANALOG DISPLAY". This returns to the analog display 94 of the sensor selected by the 20th gamer and the time scaled display 107 (Fig. 7) together with inverse text with the result "OPER SEL" message.

• The 'ANAL / -25 / ALARM OPER SEL' button usually does not appear on the menu screens of barbecue detectors; it will be displayed automatically when: V '.' operator selection 'is possible after a fault. The "ANAL / ALARM OPER SEL" button exits the menu page when "operator selection" is disabled after all faults have been cleared.

30. The "ANALOG DISPLAY" button removes the menu page and replaces it with a bar graph of any sensor or "calculated signal" (usually a "valid" "calcu-: lated signal") that is currently selected as "process representation" (analog) and timeline: '.

35V

The separate detectors '·' of the process parameters being checked work in the same way.

108816

Menu-guided detectors include all level 1 and level 2 displays in the detection function groups.

5 B. Functional Algorithm Adder

A generic verification algorithm is used to reduce operator workload and stimulus volume. The algorithm takes the readings of all sensors that measure the same parameter, and 10 produces a single output representing the given parameter. parameter and is called a "process agent". Generic verification is used because it is well understood by operators. Therefore, the operator does not need to ask where each parameter value checked originates from.

15

The generic algorithm calculates the average of all sensors [(A, B, C and D) (the number of sensors can be parameter-specific)] and checks the deviation of all sensors from the mean. If the deviations are acceptable, the mean is used as a "process 20" and a "checked" signal. If all sensors' · 'do not pass the mean deviation test, the most abnormal' - • sensor is removed and the average of the remaining sensors is calculated. When all sensors used in averaging • 'pass the mean deviation test, average of 25, referred to as "audited process representative". Thereafter, the 'process inspected' deviation from the sensors in the post-accident monitoring system (if any) is determined. If this second deviation check is passed, this "process agent" will be printed along with the "Valid 30 .PAMI" message. This means that the signal can be used for emergency monitoring because it is in accordance with the value specified by the PAMI sensors. As long as this consistency :: [is maintained, this detector can be used for post-accident monitoring instead of a special PAMI detector. This gives the 3S'.fnukana the benefit of the human factor, as the operator can use the usual device it uses daily, which is most familiar to it.

28 108816

The validation process described below shortens the time it takes for an operator to perform tasks related to key process parameters. In order to keep the data up to date, all readings to be checked are recalculated at least every other second. In addition, the computing equipment has been multiplied and distributed to increase reliability.

The following section describes the processing of the DIAS and CRT monitors algorithms and 10 monitors.

1. "Process Agent" is always displayed on the appropriate DIAS screen and / or CRT page (s) when a single "Process Agent" is required instead of multiple sensor values. Each process parameter of power plant 15 is evaluated individually to determine the type of display required and its location (DIAS and CRT or CRT only).

2. A "process agent" is always a "checked" value unless it is: 20 a. A "fault selection" value.

b. The value of "carrier selection".

:,:, 3. The "process agent" is always used for alarm calculations and time descriptors (when a single time descriptor has a single value). This can be "checked", "fault selection" or • · 25.:. value of "operator selection" depending on the results of the calculation algorithm described below.

4. The operator can view any value (A, B, C, D or calculated value) via the DIAS or CRT display menu without changing the "process agent".

30 5. The "Fault ·· .: Select" value is automatically displayed as "process representation" if the valid algorithm cannot provide a "valid" value. The "Fault select" value is the reading of the sensor that is closest to the last "valid" signal before the validation fails. In DIAS (if the parameter in question is displayed with 35 · ·) such information is marked with a "fault select" message. On the graphical pages of the CRT screen (s), this information is preceded by a multiplier (*), which indicates suspicious information.

"Fault Select" "process representation" is automatically reset to "valid" "process representation" if the valid algorithm is unable to compute "valid" data.

6. The sensor can only be selected as a "process agent" by "operator selection" if there is a valid: 10 a. "Inspection error" or b. "PAMI error".

The "process agent" selected by "operator selection" replaces the "process agent" produced by "checked" or "fault selection". In DIAS (if the parameter in question is displayed therein) 15 such information is denoted by the message "operator select". On CRT screens, this information is preceded by a multiplication sign (*) and is designated as "operator select" in the database. The "process agent" generated by the "operator selection" is automatically reset to the "verified" process-20th agent when both the "control error" and the "PAMI- * · * 'error" are cleared.

• * • ·: ... 0n note that separate checks are performed by a generic algorithm for different parameters. In this way, the operators of 25 'understand how each parameter checked: The overrun is determined and their confidence is strengthened. This algorithm always gives some result and gives the operator the option to select the display if checking is not possible. Although the detectors show all the essential information for 30 days, they also allow; ^ easy access to less frequently needed information for the operator via an organized menu system. Separate backup screens :: 'are not needed at all, since the backup screens are included in the' parallel layers' for information retrieval. Such displays greatly reduce the number of detector slots required in the panel, and

t I

'But at the same time they bring out all the necessary * »·' · metrics in an easy format, reducing the stimulus load.

108816

The enclosed Appendix, together with Figures 37 and 38, provides further details on the recommended implementation of the algorithm.

5 c. Alarm processing and display:

Another feature associated with each panel is the reduction in the number of alarms produced to minimize the operator information load. Interchannel signal checking is performed before the alarm is generated, and the alarm logic 10 and set points are within the power plant operating mode.

Alarms are displayed with certain visual symbols according to the priority of the response required from the operator. For example, Priority 1 requires immediate action, Priority 2 requires prompt action, Priority 3 requires alertness, and Priority 4, or operator support, is only status information.

Below are the types of alarm situations 20 belonging to each category.

Priority 1 4 * '·' · 1. Circumstances which may cause the reactor to shut down in less than 10 minutes.

I I * • 2. Conditions that can cause serious damage to equipment 2 5 'i.

: Y 3. Threat to personnel, radiation hazard.

4. Critical security breach.

5. Immediate technical action is required.

6. Reactor / turbine trip.

30th Priority 2 1. Circumstances which may cause the reactor to be shut down within '10 minutes.

: 2. Situations requiring technical measures not covered by Priority 1.

35 '.' 3. Possibility of Equipment Damage.

I 1 1 · Priority 3 »t · '1. Sensor offsets.

108816 2. Deviations of equipment space.

3. Device / process deviations that are not critical to operation.

5 The alarms are displayed in such a way that the operator can easily determine the effect of the alarm on the safety or operation of the power plant. In this technique, alarms are grouped according to the nature of the problem rather than the symptoms caused by the particular alarm situation. The fixed location 10 of the alarm screens facilitates pattern recognition. The power level overview on the IPSO screen shows possible action paths and critical functions for Priority 1 alarms.

In order to ensure that all alarms are reset without too much workload on the 15 operators, all alarms can be reset individually or in small functional groups. All alarms can be reset from any control panel. Instant alarms indicating the status of the alarm will be silenced without operator intervention. 20 Intermittent beeps remind you of unacknowledged conditions. The operator can activate a power station-wide alarm that will • disappear automatically after a while to delay the reset of the alarms.

In addition to the alarms, a notification information class "Operator:: Support" has been developed which contains useful information but does not indicate abnormal deviations. The "operator support" category includes the following situations: channel overflow situations, allowed lock-in approaches, and 30. device status changes.

'·' .Some parameters have multiple alarms (e.g.

:: Gasket feed temperature Hi Hi and Hi). The response required from the operator is lightened so that the lower priority alarm 35 is automatically reset without an exit tone or '. Slow blinking' when the higher priority alarm is triggered after the lower priority alarm. The operator will reset the Hi Hi alarm, so there is no need to acknowledge the deleted lower priority alarm. As the situation improves to the point where the higher priority alarm is cleared, the situation will produce an exit sound and the alarm plate will blink slowly 5. The operator acknowledges the exit of the higher priority alarm. If the lower priority alarm condition still exists, its alarm window or indicator goes into acknowledged state when the operator acknowledges the exit of the higher priority alarm. If the situation improves to such an extent that both low-priority and high-priority alarms are cleared before the operator resets, as the operator acknowledges, the higher-priority alarm also removes the lower-priority situation.

15 1. Subscribe to Device Dependence The key to an alarm system is its dependence on the state of the system and its devices. These features significantly reduce the number of alarms that occur during major events, and limit alarms to situations that. .-. represent the actual deviations of the process or equipment based on the current status of the 'power plant'. Dependence on the status of the plant and equipment is realized by changes in both the alarm logic and: set points. The space-dependent alarm 25 * can be exemplified by, e.g., the lower set point of the pressurizer, which is reduced during normal operation to reduce unnecessary alarms. Hardware-dependent logic is used to activate a low-flow alarm only when the pump should be running.

3 0 * *;:. Four modes have been selected that correspond to significant changes in the • state of power plant logic. These modes are: '•: ·· 1. Normal operation.

'...: 2. Heating / Cooling.

$ 5 ': 3. Cold Shutdown / Fuel Change 4. Reactor Shutdown 33 1 0881 6

Except for the reactor trip mode, the operator switches to the various alarm modes manually. During reactor trip, the alarm logic automatically enters reactor trip mode without operator intervention. Everybody! 5 device-dependent alarms are automatically activated without operator intervention.

2. Sub Functional Modes 10 The RCS panel has more than 200 situations that may cause an alarm. In order to reduce operator stimulus load due to the number of alarms and to improve alarm perception, several alarms are grouped into functional subgroups 108, 110, 112 (Figure 15). Functional subgroup alarm panels have a number of interrelated functional subgroup alarm messages that appear in the panel alarm message window 114 (adjacent to the alarm panel) or in the CRT. In cases where alerts related to key process parameters are received, there is one alarm message in each of the 20 alert plates (e.g., RCS pressure down...... La). With such a single alarm message, operator '.' Can quickly identify certain process-specific problems.

As shown in Fig. 16, some alarms are grouped by 25; similar components instead of process operation, and a '' '' is added to them, such as 116.

As shown in Figure 9, the alarm board may be in one of the following states: 3 0:> 1. Un acknowledge alarm - If the alarm board has an unacknowledged alarm, the alarm board will flash rapidly (e.g. 4 times / second with 50/50 on / off ratio) 9 in long rays). This situation bypasses all other group alerts for $ 5 '; alarm tile spaces.

2. Alarm Removed / Return to Normal (Alarm Reset) - When the alarm situation is resolved, the corresponding alarm plate will flash slowly (eg once / second, with 50/50 on / off ratio as shown in Figure 9 for short beams). until this situation is cleared. This situation overrides the other 5 remaining states of group alarms.

3. Alarm - If the alarm situation is active and the above alarm states 1 and 2 are not active, the alarm panel will light up without blinking (as shown in Fig. 9 with missing rays).

10 4. No Alarm - If the alarm associated with the alarm board is not valid, the board will not burn (not shown in Figure 9). The operation of the alarm panel lamp can be checked with the lamp test function.

3. Shape Color Coding Alarm information is identified by a unique color of the tile, preferably yellow 118. The parameter / component indicator or short message on the tube 120 is displayed internally. Gray 2.0. color coding is used as the tile color to return to normal. The priority of the alarm (i.e., 1, 2 or 3) is identified by the !!! format code. Alarms use a single bright color to maximize the value of this information. The format code-25 encoding used to denote alarm priorities utilizes different levels of code discoverability. Alarm priority format coding also allows the priority information to be retained even in the return to normal mode.

Priority 1 alarm panels, diagrams, symbols, 30; process parameters and menu option fields are represented by • · · ·. The color of the emblem is blue to give '... good contrast for readability. In addition, the 35 'CRT displays: alarm panels and menu option fields use the same presentation.

35 1 0881 6

Priority 2 alarm panels, diagrams, components, menu options, and symbols are in a thin (1-line) box 126 that uses a yellow alarm color code around their blue indicator.

5

Priority 3 alarm panels, mimic diagram parameters, components, menu options, and symbols are surrounded by brackets 128 around their detectors 120. The English-10 language codes in the message line of all alarms on the CRT display are represented by the alarm display mode, if present.

4. Alarms in CRT 15 Each CRT page in the data processing system gives the operator an overview of all valid unacknowledged alarms and their location in the power plant. The standard menu for each display page includes IPSO and all first-level display pages as alternatives (see Figure 10, Menu-20, Section 130). These menu option fields tell about the existing unacknowledged alarms in the screen hierarchy ;; [sectors] their alarm status / priority using the '••• alarm highlighting feature described above. If the alarm: tile (i.e., in DIAS) is in alarm mode, the first level 25!: Display menu option field, such as 132, in menu option ·,: 130 indicates the existence of an alarm in the display page hierarchy. within the precincts of. Alarm panels in menu 130 are grouped into a first-level display page group corresponding to console groupings, or by critical action, as shown in Figure 11.

30.:.

-In addition to the alarm information shown in the menu options on the first-level display pages, the following '.-. Features of the display pages are used to indicate the existence of alarms.

3: 5.-Display Menu Options 134 to access level 2 'and 3 display pages will light up in accordance with the above alarm presentation' if the information related to the corresponding page is in the alarm mode. lights up to indicate the highest priority for unacknowledged status).

5 By selecting option 136, the operator may display a level 2 display page directory, which contains an illustrative diagram of the level 3 display pages in a hierarchical format together with the first level display page (see Figures 12 and 15). In this diagram, the represented Level 2 and Level 3 display pages are each marked with 10 alarm codes, if the information in question is the screen has unacknowledged alarm status. This alarm information is most useful in determining the location of alarms in the display page hierarchy. For example, the operator is informed through the display page menu 130 (Fig. 10) that auxiliary systems 15 have, without acknowledging the alarm (s), a PRI menu option field with a gray alarm code (return to normal) and a slow flashing alarm code. He can bring up the directory / hierarchy to see which page (s) the alarm information is on by touching the "DIRECTO-2Q RY" menu option 136, which is after the PRI. When the primary display directory information (Fig. 12) appears, the field (s) representing the display page (s) containing the alert state (s) (such as' ••• PZR LEVEL 138 ) lights up. To access the desired display screen i 'containing the alarm information (as in Figure 15), touch the 2 ^.-Flashing field.

»*» The components and power information indicators on the CRT process display pages (Figure 13) indicate alarms and their acknowledged status with alarm codes and blinking. The component-30; identifier can provide such alarm information if the parameter associated with the component. 'Is in the alarm. This also happens when the display page does not display that particular code. Alarm:, · .parameter; e.g., the low pressure of the pump lubricating oil is represented by the type of pump lubricating oil. component alarm coding. The operator can view the exact details of the alarm 3 ^ 'on the lower level display page or use the *.' Alarm system features described below.

37 1 0881 6 5. Defining and confirming alarms

Referring again to FIG. 16, each of the Class 1 and Class 2 alarm detector boards on the DIAS may notify the operator of more than one of the five possible alarm states. Due to the rapid determination of the actual alarm condition, the panel display area 78 has a message window 114. When an unacknowledged alarm detector tile, such as 134, is pressed, the message window 114 will display a specific alarm condition 116. 10 The alarm tile 134 will continue flashing until all related alarms have been acknowledged, the English descriptions of the additional alarms can be accessed by pressing the alarm tab 134 again.

15 While a message appears in the message window of the DIAS alarm screen 78, the CRT panel 87 displays an alarm message in the second field 132 at the bottom of the screen (see Figure 13). The CRT alarm message contains the following information: time, priority, magnitude (e.g., Hi, Hi-Hi), ID, setpoint, and real-time process value 2p (which is encoded as described to illustrate the alarm priority and... Alarm situation). If. • "other unacknowledged alarms, additional unacknowledged alarms - .." are multiplied by the number inside the circle at the right of the message area (see Figure 13).

In addition to this alarm message, the display page menu (area 4) has menu options / fields that directly access the display pages that can be used to access diagnostic or support information related to the alarm situation. Figure 22 shows the display areas. Alarm panels that • appear in alarm mode on the DIAS display of a particular panel can be seen and acknowledged from any CRT panel by a procedure similar to the display of alarms and acknowledgment via control panels. When selecting the "Alarm Tiles" menu option next to the Alarm Display-3 | 5th Page menu option, (i.e., the first level display page set (area 3), the alarm tiles that are in Alarm Mode and related to the 381,0881 6 Display Pages are displayed on the Display Page. In menu area 4. One tile is labeled and is a touch point to access other tiles.The operator acknowledges and inspects these alarm tiles by touching them to receive alarm messages and touch screen touch points similar to those described above. This way of responding to alarm panels is most useful when responding to alarms at workstations remote from the operator's location.

10

All alarm situations related to the DIAS display indicator board are kept in a buffer. The buffer containing alarms is arranged as follows: 1. First unacknowledged 15 2.

• · • · N Last unacknowledged N + l First exited / returned to normal 20. · N + 2.

· · Isin I (((((isin (isin isin poist Viime isin poist poist poist isin isin isin isin poist poist

• I

25 ·: n + l Acknowledged alarms> · v 'n + 2 • · • · 30. | Pressing the alarm tile reaches the top of the buffer

MM

, ·; 'Alarm situation.

• · M.Resetting of unacknowledged alarms shifts that alarm. alarm- * I »situations at the bottom of the buffer. Reset alarms acknowledge-

• I

35.'m drops them from the buffer. Previously acknowledged alarms, ·, (n + 1, n + 2, ...) can be viewed if there are no unacknowledged or deleted, unacknowledged alarms. Viewing these alarms moves them to the bottom of the buffer.

Priority 3 alarm messages and carrier supports are generated by the computer 5 and appear only on the message line 132 on the CRT screen (Figure 3); The 78 message window on the DIAS screen does not display an English ID. Each notification workstation has one notification plate for Priority 3 alarms. For workstation-related operator support, workstations 10 have one alarm plate.

As the priority of the alarm situation changes, the following changes occur in the alarm processing system. When a higher priority alarm is received for the same parameter, the previous 15 alarm is automatically reset (i.e., an operator reset is not necessary as he must reset a higher priority situation) without a reset tone or a slow blink rate. When the alarm condition improves to the point where the higher priority alarm goes off, the operator must acknowledge the disappearance of the 2p higher priority alarm; if the lower priority f · 'is still active, it is activated by «» ^ (when the operator acknowledges the higher priority alarm state -]; - | exit) and automatically enters the acknowledged state: * (i.e. without operator action). The operator detects the 25th new lower priority alarm condition when reading the higher priority alarm due to the clearing of the alarm.

The present invention provides methods for listing supporting 3 0 · t display pages, classifying alarms, and I ♦ | > «To get it. In this system, alarms are triggered on the alarm list screen accessed by: DIAS display 78 fields 138 and CRT display 84 fields 140 shown in Figures 15 and 13, respectively. This list of 35 \ * its alarm classes is as follows (see Figure) 14): A) First Level Display Page Set (Power Plant Main System / Main Function Groups) 142 40 1,0881 6 B) Control Station Workstation 144 C) Alarm Boards 146

Workstation alarm panels are listed according to priority 5. Alarms related to the alarm slabs are listed according to the contents of the alarm slab buffer.

These alert classes provide the operator with the alert information needed to respond to alert situations. By displaying 10 classified alert lists 78 on page 84 (Figures 4 and 12), the operator can easily select the information of the desired category.

i

By first selecting the menu option 14 (Fig. 4) "Alarm List" and then the display page representing the alert state (s) (Fig. 12), the operator can view the specific alert situations he is interested in (Fig. 14).

The following are three examples of how to display the classified list information on page 84 (Figure 4): 1) The operator first selects the "Alarm List" menu option 20 140 (Figure 4) and then selects "Alarm." 148 · ’. ·· (Figure 4). This brings forth the type of alarm list shown in Figure 14: starting with electrical alarms.

2) If the operator wants to view information related to a particular alarm, 25. for example RCP1A, he chooses the following: ··. menu options on page 84 (Figures 4 and 12: "Alarm Tiles" 150 "Primary" 152 30 The menu on the display changes to a display of the alarm tiles that are associated with the primary system (see Figure 14). · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · ·

4i 1 08 81 6 "RCP1A", alternative. The classified alarm list appears with RCPlA alarms at the top.

B. Alarm Messages - The operator can use the alarm panel menu options in the same way as control panel 5 panel alarm panels. Selecting an alarm panel menu option displays an alarm message and a menu that contains alarm information screens.

Alarm information is also provided for all process flowcharts that include a component or parameter in alarm condition. Alarm situations are marked by color and shape coding as described previously. Alarm parameters associated with a component may cause the component ID to light up to indicate an alarm condition if the parameter is not displayed on the display-15 page, e.g., the second-level display may not include pump lubricating oil pressure; If the operator wants to see the exact alarm condition associated with the component, he goes to the lower level screen. Alternatively, he can touch the 20 menu options "Alarm panels" and then the component. · .. ID, and respond to the alarm with alarm panel presentations. This procedure also brings up menu options on the display pages that provide more information about the component.

• 25 * The present invention provides the following methods for resetting an alarm.

·. * ': 1) Acknowledge Alarm via Indicator Board - Alarms can be acknowledged by pressing the alarm / unacknowledged board or the CRT display board. These 30 steps move the tile from flashing to solid • j. when all panel - related alarms have been acknowledged,. and silence any alarm sounds (described later). Alarm messages are displayed in the message window (when using a physical tile) and in the message bar of the CRT • .33 workstation (see Figure 16).

2) Acknowledge the alarm via the alarm list page - Alarm ·. Alarms can be acknowledged on the Alarm List page by touching 42 1,0881 6 Alarm Board Touch Points associated with Alarm Board Classes (see Figure 14). When touching the display of the alarm panel, all of the alarms are displayed. plate-related alarms are reset. This way of responding to alarm panels is most useful when acknowledging multiple alarms far from the operator's location.

Each of these alarm acknowledgment methods removes unacknowledged alarm detectors from the other alarm formats.

10 The operator must be informed when the alarm situation has resolved. The notification is done by flashing the indicator board and associated process screen information at a slow speed. Resetting the deleted alarm detectors is done in the same way as resetting new alarms, i.e., by touching the 15 alarm panels or the CRT display alarm presentation mode.

The control panel has special acoustic signals for the following alarm information: 1. Unconfirmed priority 1 or 2 alarms.

20 2. Alarm for unconfirmed or cleared status of priority 1 or 2 alarms.

::: 3. Priority 1 alarms cleared or priority 2 alarms cleared.

25. The audible alarm 1 or 3 will only sound for one second and the audible alarm 2 will be repeated periodically once per minute until all new or deleted alarms are reset.

If several unacknowledged alarms are active at the same time, the operator must focus his attention on new alarms of the highest priority. In this situation, all other unacknowledged alarms, i.e. new priority 2 and 3. alarms, and any alarms that have disappeared, will cause. unnecessary noise that draws the operator's attention away from the most important alarm situations. The control room MCC, ACC, and ASC: "." Have "FLASH PREVENT" and "RESET" buttons. By pressing the 43 10881 6 button "Flashing Prevention", the alarm system has the following features:

All new / unacknowledged priority 2 and 3 alarms for tile and CRT displays and operator support functions 5 change from a high blinking speed to a steady lighted state.

All alarms that have gone out, ie slow blinking, are left out of the alarm data.

All new alarm situations or exited alarm-10 states that arrive after the "FLASH-PREVENTION" button is pressed are normally displayed to the operator (i.e., by blinking). However, the operator can suppress these situations by pressing the "ANTI-FLASH" button again.

15 The alarm reminder tone informs the operator of any new or deleted alarms that have not been acknowledged. In order to identify these situations for resetting, the operator will press the "RESET" button which will reset all 20 unacknowledged and exited situations to normal alarm · '. '·· presentation formats.

The Alarm Mute button lights up when pressed to indicate • '.' • Alarm Mute validity.

* 25.

: V. For quick, direct access to support information by the operator - improving operator response to alarms - a single operator action acknowledges the alarm, displays the alarm parameters, and allows you to select 30 CRT display pages related to the alarm situation.

The present invention provides for the processing and display of alarms. multiplication and decentralization so that operators have confidence in ··· intelligent alarm handling methods, '15 and equipment failure does not affect power plant safety and operation. Priority 1 and 2 alarms are processed and displayed by two independent systems. The multiplication of the two systems 44 1 0881 6 is not visible to operators due to ongoing cross-checks and unified operator interfaces.

Figures 16-18 show schematic alarm responses when using the tiles of the present invention. The tile assembly illustrated relates to monitoring the reactor coolant pump seal in the reactor cooling system panel shown in Figure 3. Priority 2 seal / leak system problem alarm lights up to alert the operator who can read a more complete message in the alarm window indicating high control leakage pressure. Priority 1 and 2 alarms have such messages. The same message appears in a more complete form on the panel's CRT screen. The CRT screen also provides menu options that indicate useful, supportive display pages. Alternatively, the operator 15 may directly select a list of all alarms for a particular group.

Thus, an overview of alarm situations is provided on tiles, while details are provided by related messages. 20 A particular alarm is considered more or less important at a particular time based on the state of the devices and the operating state of the NSSS. Alarm processing is reduced by checking para - ;;; meter signals, and automatically disabling the lower priority -'... · task alarms when a higher-priority Ώ5 'alarm related to the same situation is activated.

0 '· IV. DATA PROCESSING SYSTEM A. CRT certification

The 84 CRT shown in the center of the panel of Figure 3 is part of a 30 data processing system that processes and displays all operational data of the power plant. Therefore, it is connected, 'j. control room for all other instruments and control systems. systems.

• I I

Figures 2, 28 and 30 schematically illustrate a data processing system with respect to a control system, a power plant security system, and a detector and alarm system. The data processing system 70 receives from the control system 64 the same sensor information that the control system uses in its control logic. Similarly, it receives the sensor information verified from the detector and alarm system which is used by the detector and alarm system 72 to generate separate alarms and displays. The power plant security system 50 does not use internally audited data in its trip logic, and the "raw" signal from each channel as such arrives at the data processing system 70 which implements its own signaling logic 154 to power station security system signals and transmits the internally audited signal to audited signal control , signals received from power plant security system 50 and detector and alarm system 72 are compared and displayed on CRT 84.

It should be noted that both the checked signal from the reference logic and the checked signal from the power plant security system are available on the CRT display.

20: '\: Thus, each CRT monitor includes a signal check: and each CRT monitor is connected to the information available on all other CRT screens in the power plant. In addition, each CRT monitor can produce alarm slab images of any other panel 2i and acknowledge its alarms. Detailed display indicators windows are also displayed. CRT displays have essentially real-time response time, with a delay of up to two seconds.

30 CRT screen pages contain all the operator-available ('i' power plant information in a structured, hierarchical format. CRT pages are very useful for data presentation because they V allow for graphical representation of power plant processes in operative, ;;; market-based CRT display models. if necessary, assist with actions by presenting: 'time charts, lists, messages, operational notes, and alerting the operator of abnormal processes.

46 108816 The most important method by which an operator obtains information on a CRT screen is based on a known touch screen interface. Touch screens are based on infrared technology. The horizontal 5 and vertical rays come from a frame placed around the surface of each color monitors. When the user cuts off the rays, the coordinates are compared with the display page database to determine the selected information.

10 Touch points on message and support screens are accessed through panel CRT displays by touching other panel features such as detectors and alarm panels. IPSO is available as a single screen and forms the top of the screen hierarchy see. 10, 22 and 24). Below IPSO 15 there are three levels, each of which contains consistent information to meet the specific needs of the operator. The structure of the hierarchical format is based on assisting the operator in performing his tasks and on the quick and easy access to all information available through CRT displays. Up to 20 man-level display formats provide information about common monitoring tasks while the lower-level forms contain information that: is most useful for performing diagnostic support tasks.

• · · • »25, Level 1 screens contain information that is most useful for monitoring the main power plant processes. These screens provide the operator with information on the operation of the main system and the status of the most important devices and direct them to the lower level screens for support or diagnostic information. Level 1 display pages are as follows: 1) Primary systems (example, see Figure 19): 2) Secondary systems. . · 3) Power conversion, · '·' 4) Electrical systems '35 5) Auxiliary systems i t * V 6) Critical functions • »47 1 0 8 8 1 6 f

The Level 2 screens contain information that is most useful in controlling the power plant components and systems. These pages contain all the information necessary to control system processes and functions. The 5 parameters that need to be monitored during the control task are simultaneously on the same display, even if they are part of different systems. The suggested operating procedures or instructions for controlling the components are used to determine the parameters to be displayed. Fig. 20 shows by way of example the control of the refrigerant pumps IA and IB of the reactor 10. Normally, the operator would monitor the "Primary System" screen when evaluating RCS performance. If the operator wishes to use or adjust RCP IA or IB, he will display the control screen. All information related to the reactor coolant pumps is on the control-15 display so that there is no need to switch between different display pages.

The Level 3 screens contain information that is most useful for the diagnostic tasks of the processes and components 20 shown on the Level 2 screens. Level 3 screen pages are available. .information that is useful in instrumental cross-channel * · · '. comparisons, details of equipment or system failures ;;;; full time diagnoses, and time charts that can be used to determine the direction of changes in system performance, that is, '• 25 whether the situation improves or worsens. Figure 21 shows the RCPlA ,,, '! diagnostic display for seal and cooler block: pump section, V support oil system, and engine section are displayed on a separate display page due to the display data frequency limits.

30 You can access the screens through the menus at the bottom of the screens. Each screen has a standard format. · A menu that provides direct access, ie one-touch> all, according to the data hierarchy. page related * »· '35 screen pages. The menu contains fields (see Figure 10) where; 48 10881 6 can be accessed by selecting the appropriate field (a-j). The menu fields on the display page include the following (see Figure 22): 1) The next higher level of the display page hierarchy (if any), item (c). This feature is more relevant 3.

5 level screens because the next higher level screen is a level 2 screen that is not normally in the menu.

2) System display pages that are related to or support the process of the currently displayed display page (h, i).

3) All six first level display pages (b, c, d, e, f, g).

4) IPSO Display Page (a).

5) Last page (s) displayed on the monitor.

In order to access the display page described by the menu option 15, the operator selects the relevant page. menu option (a-k) by touching the desired menu option field on the monitor. The menu item lights up (using black letters on a white background) until the screen appears. Because the menu options directly access only a small number of the 20 screen pages in the screen hierarchy, there are alternative methods for quickly displaying other screen pages. There are three options for the operator: (1) Go to screen using alarm panels - This screen switching mechanism is most useful for accessing * i · 1 '1 screen pages related to the workstation process. When the workstation alarm panel from the display 78, such as 80 *, ·. · (Fig. 15) is pressed, the workstation CRT screen menu * ·.

area 4 changes to a new menu with display page options related to the alarm panel ID. For example, the RCPlA Alert Board will display menu options associated with RCP LAtha. The desired screen is then a direct connection> .. !! enabling menu option.

»1 1 (2) Retrieve CRT Data through Detector Detectors - Each *»,, · detector 82 as shown in Figure 7 has a i », ··· CRT access touch point 158. This button provides a connection to it for 3h support information related to the process parameter displayed at that instant in the detector.

By touching the CRT touch point on the detector, the work area 49 1 0881 6 menu CRT display menu options area 4 changes to menu options that include process parameter support and diagnostic information display pages.

5 (3) Navigating to a Screen Using the Screen Index - Any screen in the screen hierarchy can be accessed through the menu currently displayed. If, for example, the operator is viewing a feedwater system screen and wants to access the CVCS screen, he will perform the following 10 steps (see Figures 22 and 4): The operator selects "by touch" menu option "DIRECTORY" (Figure 22 he selects the "PRIMARY" menu option (option b in Figure 22 region 3). This accesses the primary part of the display page hierarchy (see Figure 4). 15 Each screen in the primary part of the screen hierarchy is represented as a touch point, and the operator can select the CVCS screen. This feature lets you navigate to any screen. After the "DIRECTORY" menu option, the desired hierarchy is given which is related to:, '- 20 of the six first level display pages, i.e. one of the menu options b, c, d, e, f or g of FIG. 22.

In addition to the menu options described above, the menu options include "LAST PAGE", "ALARM LIST", "ALARM TILES", "OTHER", and horizontal paging options ("Keys", keys). ). "LAST PAGE" (option j in Figure 22) provides a direct connection to the last page displayed. This is very useful for the operator if he wants to compare the data on two screen pages with each other or ,,!: 30 if he wants to go back to the information he has previously processed.

. /. "ALARM LIST" (option n in Figure 22) provides a quick connection to the alarm list screens. 1 ', S5 "ALARM TILES" (option m of FIG. 22) provides a quick connection to the representations of active alarm panels above the workstation CRT display area 4 (see FIG. 23). In this way, 50 10881 6 operators have access to alarm information related to the tiles of any CRT display. This method of handling alarms is described in more detail in Section 5 of this document.

5 "OTHER" (option k in FIG. 22) provides access to display pages or information not in the data categories described by the present menu options.

B. IPSO

j 10 The combined process state overview (IPSO table - see Figure 24) is the second part of the computing system. Although the number of monitors and alarms that can simultaneously load an operator can be significantly reduced by panels using separate alarms, monitors, and CRT monitors as described above, the number of stimuli is still relatively high, and this may cause the operator to develop slower perception Status and direction of critical systems in the NSSS. One display is required which only displays the highest level: .20 information to the operator and which guides the operator to the need: for more detailed information if required. Although some attempts have been made in the past to display a large screen or screen: v. Such current displays have not had a significant compound data retention time of the kind described below.

The IPSO table provides a high-level overview of all high-level information, including the plant status overview, critical safety and power generation factors, symbols representing key systems and processes, power plant key information, and all key alarms. The IPSO data includes time charts,, X deviations, numerical values of the most critical critical functions! '.! values, and the presence and location of Priority 1 alarms, and the availability of systems that support critical functions, and: '.S5 mode. This, on the other hand, is known as the path control::. The IPSO can also identify the presence and location of other unacknowledged alarms in the power plant area. In this way, IPSO narrows the gap between an operator's systemic propensity to evaluate critical functions. This balances the reduction in dedicated screens, helping operators 5 maintain the power plant field conditions. It also helps operators maintain an overall view of the operation of the power plant while performing detailed diagnostic tasks. The IPSO provides a common understanding of the power plant process, which results in better communication between power plant personnel 10.

The situation shown in Fig. 25 is a reactor trip. At the time described, the reactor temperature rise is 27 "and the average temperature rise is higher than desired and is still rising as indicated by the arrow and" + "sign. The pressure in the presser is higher than desired but decreases. Similarly, the steam generator water level is higher than desired it counts.

»I

: '.J20 Figure 24 shows a CRT display hierarchy with the IPSO at its peak and the first level display page set containing;' *? general monitoring information on the secondary system, electrical system, primary system, auxiliary system, power conversion system and critical function system,, · 25 and where the second level of the screen is related to system and / or component control and the third level of the screen provides detailed and diagnostic information. IPSO is constantly seen at all workstations, the supervisor's office and the technical support center. IPSO is centrally positioned ...: 30 with respect to the main control console. IPSO also exists as a display page that is displayed in the control room on any workstation's CRT, display, and at remote operating points such as · ', e.g.

.35 The large IPSO panel is approximately 140 cm high and approximately 180 cm wide.

♦ '·; Its location, above and behind the MCC workstation, is approx.

52 1 0881 6 12 meters from the watcher's office (the farthest point still visible).

One of the benefits of IPSO is that the IPSO 5 data can be used to support the operator's response to power plant malfunctions, especially when the malfunctions affect multiple power plant operations. IPSO data supports the operator's ability to respond to power plant power and safety issues.

10 IPSO supports the operator's ability to quickly evaluate the overall performance of a plant's process by providing the information needed to rapidly evaluate a critical plant's critical functions. The concept of control of power plant power generation and safety functions 15 allows the classification of power plant power generation and safety processes into a manageable set of data that describes the various processes within the power plant.

The critical functions are: Critical: 2Q. Function For Power Safety

"· / 1. Reactivity Control X X

'•' • '2. Nuclear Heat X X

RCS Heat Removal X X

•, ¾. RCS Inventory Control X X

25, | 5. RCS Pressure Control X X

:: J5. Steam / feed conversion X

| 7. Power Generation X

8. Heat removal X

9. Control of Shell Conditions X

30 .10.Shield insulation X

: ;; il. Radiologists. emission control X X

, 12.Additional ancillary systems X X

"In the upper right corner of the IPSO is a block 3x4 alarm matrix 160, 35. Which includes a box 162 for each critical function" (see Figure 25 and the IPSO CRT display in Figure 10). The matrix serves as a single location 53 1 0881 6 If the Priority 1 Alarm associated with the critical function is active, the corresponding matrix box j 164 lights up according to the Alarm Presentation Method for Priority 1. Critical Function Alarms represent one of the following 5 Priority 1 conditions:

Failure to verify the safety function status (after reactor trip).

Poor operation of the path / system used to support the critical function.

10 - Unwanted priority 1 deviation in power generation (before launch).

- Absence of the safety system (Order 1.47 specifies the minimum allowable availability).

15 The 3x4 matrix representation is a general summary of Level 1 critical function screen information (Figure 32). The operator receives detailed information on critical function and path alarms from the critical functions section of the screen.

3Q: '.' Each critical function can be maintained by one or more ;;; power plant system. The information in IPSO is selected to represent the ability of the most supportive systems to perform critical functions. For certain critical functions 25: the general state can be estimated by the most descriptive 'control parameters. For such critical functions, the IPSO shows the relationship of the process parameter to the setpoint (s) and the direction of change to the right of the parameter identifier.

30.:.

, ·; · If the integral of the value of the parameter is greater than the narrow • guide value, use the arrowhead as explained in '- • Figure 26 to indicate the change in the parameter towards or away from the setpoint. Arrowhead direction, down / up, says 3: 5. the direction of the process parameter change. If these parameters, ·, deviate from the normal control limits, a plus or minus sign will be placed below or above the setpoint representation.

54 1 0 8 8 1 6

The following criteria were used to select the parameters or other indicators presented in the IPSO to monitor the overall state of the critical functions: 5 1. Reactivity Control

Reactor power is the only parameter displayed by IPSO to monitor reactivity. Reactor power allows the operator to easily determine whether the rods are placed in the reactor. He may also use reactor power to determine the rate and direction of change in reactor reactivity after shutdown. Reactor power is represented by IPS0 as a digital representation 166, since the numerical value of this parameter is most relevant to both operators and administrative personnel. The IPSO 15 also displays a reactor vessel alarm if the kernel operational boundary monitoring system has a priority 1 alarm.

2. Core Heat Exhaustion 20. jIPSO shows the parameters of the Core Heat Exhaust Temperature 168 and ', · the undercooling margin 170, which can be used to determine the adequacy of the nuclear heat removal. If the kernel outlet temperature is within the set limits, the operator can assure that: · the integrity of the fuel is maintained. The undercooling margin is used because it gives the operator a total temperature margin for boiling.

The kernel removal temperature is represented by IPSO as a dynamic representation (i.e., a time graph) because there is a certain upper limit to the kernel removal temperature and it is easy to determine the representation. ·; · Set points.

Also, the supercooling margin is represented by IPSO as a dynamic representation, since there is a lower limit that defines an operational limit 33 for maintaining cooling.

3. RCS Dehumidification 55 10881 6 ΤΗ, Tq, S / G Level 172 and Tave 174 are presented in IPSO to allow the operator to quickly evaluate the efficiency of the RCS dehumidification function.

5

In order to remove heat from the reactor coolant, the S / G level must be maintained at a level sufficient to transfer sufficient heat from the RCSt to the steam power plant. A dynamic representation is used so that the operator can observe the improvement or deterioration of the changing situation at a glance.

IPSO uses TH and Tc because the operator needs them to determine the amount of heat transferred from the reactor coolant to the secondary system. These parameters are represented as 15 digital values because rapid delta T monitoring requires a quick comparison of these parameters. In addition, their true value is often used and their presentation to IPSO helps operators whose location does not easily see separate TH and Tc detectors.

2.Θ. :% *> '.Tave is displayed by IPSO as a dynamic representation so that the operator: :;; can quickly evaluate whether this control parameter is within acceptable operating limits.

• «* 25,: 4. RCS Inventory Control ♦ * * The IPSO displays the pressure level 176 using a dynamic representation so that the operator can quickly assess whether the RCS has the correct amount of refrigerant and monitor changes in level 30, 'for better or worse.

• * ·> 5. RCS Pressure Control »: ,,, IPSO uses a pressure ice pressure 178 and a supercooling margin of 35 to determine the RCS pressure control.

56 10881 6 The IPSO uses a dynamic representation to notify the operator of changing pressure conditions that may cause the RCS to underpress or overpressure.

5 IPSO uses the dynamic representation of the saturation margin. The saturation situation of the RCS can negatively affect the ability of the pressurizer to control the pressure. In addition, if the pressure drops, the IPSO's undercooling control suggestion indicates a decrease in the saturation margin.

10 6. Steam / Input Conversion Steam / Input conversion processes can be rapidly evaluated using the following information provided by IPSO: 15 (a) Supply water and condensation system status information (e.g., operating, alarm) (b) Steam generator level, dynamic representation (c) ) Steam Generator Safety Valve Status (d) Atmospheric Exhaust Valve Status 2.0. ; (e) State of Main Steam Valve Valve \ «.-. (f) State of Turbine Bypass System *» ♦,; *; 7. Power Generation * • »..

2 * 5> '· Power generation processes can be rapidly evaluated using the following IPSO data: (a) Power Output, Digital Value.

(b) Alarm details of major process offsets associated with the main turbine and turbine generator.

30: (c) Operation and alarm status of power distribution to power plant buses and grid.

«» • 8. Dehumidification 35 · 'The dehumidification processes can be rapidly assessed using the following information provided by IPSO: (a) Circulation system status.

57 1 0881 6 (b) Alarm information on critical deviations in condenser pressure conditions.

9. Control of Sheath Conditions 5 IPSO uses the shield pressure and shell temperature parameters to control the shell conditions. These are displayed on IPSO as dynamic representations to evaluate time charts and relative values. The casing pressure is variable | 10 and whereby the IPSO warns the operator of a harmful overpressure situation that may result from a failure in the reactor cooling system. The temperature of the jacket also helps to detect a failure in the reactor cooling system; it can also tell about an explosion in a shell building.

15 10. Shield insulation

The safety function of the sheath insulation is followed by IPSO through a symbol representation of the sheath insulation system.

20 The symbol is derived from an algorithm that describes the effectiveness of the following shell insulation factors in their effect on shell insulation: ... _ activating shell insulation .. '' i - Activation of safety spray; 25 - Main Steam Activation · ;;; - Power plant drainage isolation 11. Radiological emission control 30 IPSO displays radiation symbols indicating high ··· radiation values, eg inside the enclosure, and (2) around: ·. pathways for radioactivity entering the work. These symbols are only sampled by IPSO at high radiation values. These detectors are displayed in alarm colors according to the • • '35 sensor location in the following situations:

High Radiation Cover Air Exposure 58 1 0 8 8 1 6

High activity associated with any release pathway High activity of coolant.

5 12.Applicable Auxiliary Systems The IPSO controls the auxiliary auxiliary systems with the following information: (a) Diesel Generator Status 10 (b) Power Distribution Area Power Station (c) Instrument Air System Status (d) Service Water System Status (e) Component Cooling Water System Status 15 These IPSO The systems are the most important heat transfer systems and the systems necessary to support the most important heat transfer processes, whether related to power generation or safety. These systems include those systems that need to be monitored in accordance with regulation 1.47 20, as well as all operating paths that support critical functions of the power plant.

The following systems have dynamic presentations at IPSO: CCW - Component Cooling Water CD - Condensation: 25 CI - Enclosure Insulation; CS - Shield Injection CW Circulating EF - Emergency Feed Water FW - Feed Water 30 IA Instrument Air S DC - Shutdown Cooling RCS - Reactor Coolant. SI - Safety Spray, · '··. SW - Service Water 1.35 TB - Turbine Bypass 59 1 0881 6 The system information presented in IPSO includes system operational status, operational status changes (ie, j active / passive or passive active) and system I first priority alarms.

(5 System alarm information helps to inform operators of the critical function alarms operating paths.

Priority 1 alarm information is represented by IPSO by alarm coding the IPSO presentation codes as described previously 10.

V. SUPERVISORY UNITY

Fig. 27 is an overview of a unitary presentation of information available to an operator in accordance with the present invention. From a combined process space overview or table! (IPSO) operator can monitor high priority alarms.

If the operator is interested in the parameter time charts, he can look at individual detectors. If he is interested in the status of 20 systems or components, he can view the system driver settings. IPSO data is shown on the table! , la, and the panel's CRT screen, and any other operator ···, panel, or any other panel information the operator receives .y; to their CRT screen. With the help of the IPSO overview, the operator can; 25 navigate through the CRT screen or the DIAS screen. In addition, ·; ·; the operator has a direct connection to these two types '·' Data from any control panel, and when the system control is adjusted or set, the results are also transmitted to the alarm and display controllers of the other panels.

30

As depicted in Figures 2 and 28-31 as an overview, the system: · Unity means that each panel containing the master console, security console, and sub console has a CRT 84 controlled by a data processing system 70. The data processing system uses the main computer of the power plant, and more powerful, it is not as reliable as DIAS 72 computers (which may be distributed microprocessor-based or I 60 1 0881 6j minicomputer-based). It is also slower because it is menu driven and performs a lot more calculations. It is mainly used to bring the most important information to the operator and therefore, any CRT monitor 5 can view important alarm panels and can also be acknowledged from any CRT monitor. The information available on one CRT screen is also available on all other CRT displays. The detector and alarm system 72 of a particular panel is associated with controls, but separate (i.e., fast and accurate) features of the alarm and detector screens 78, 82 and panel controls are not available on any other panel.

Information is basically classified in three ways. Class 1 data must be displayed continuously at all times, and this is accomplished by DIAS 72. Class 2 data need not be continuously available but is required from time to time, and DIAS 72 is also responsible for this. Class 3 data is not needed quickly and is of an informative type only and is obtained from DPS. In the event of a DPS 70 failure, the DIAS will take care of some essential information. The DPS and DIAS are connected to the IPSO board via a display generator 180. Under the IPSO, the operator obtains private: · specific information by going to the appropriate panel or visiting the CRT screen.

It should be noted that DIAS and DPS inputs may not be | ·, · Same parameters, but if they receive information about the same I ', * parameters, the sensors for these parameters are common. In addition, DPS and DIAS use the same verification algorithms. And further, the algorithms used with the individual alarm panels and detectors 30 calculate a "representative" value and compare the verified values of the DIAS and DPS.

Fig. 29 is a block diagram showing separate detectors, ···. to the alarm system for the other parts of the control panel's signal processing • '• 35. It is a good idea to divide the DIAS into blocks so that i »·: V all the required detector and 'Λ: detector alarms required for a given panel are processed in only one block. However, each panel has a multiple processor. DIAS 1 data and processing is Class 1 and 2 data that is not normally displayed directly by IPSO. IPSO normally receives its information from DPS. If the DPS fails, a portion of the DIAS data is sent to an IPSO display generator for display on the IPSO display.

It should also be noted that both DIAS and DPS use the outputs of all of the power plant sensors to measure a given parameter, 10 but the number of power plant sensors may vary between different I parameters. For example, the pressure of the pressurizer is obtained from 12 sensors, while another parameter can be measured by two or three sensors. Some systems, such as the power plant safety system, do not use inspection algorithms 15 because they need to run as fast as possible and use, for example, two of the four activation logic on four independent channels. If the value of the parameter checked by two or more systems differs between the systems, the operator will receive an alarm or other notification via the 20 CRT displays.

An important advantage of the present invention is that no DPS, ·· '·. whereas it is necessary to meet the nuclear power plant requirements, although it can be used reliably because it receives the same parameter values; 25 sensors like a DIAS that meets the requirements for nuclear power plants. These

t I

·; ·· Values are checked in the same way and the DPS checked «t parameters are compared with the DIAS verified parameters before displaying DPS data on CRT displays or IPSO.

30 Nuclear Power Required Alarm Plates and Windows, and · DIAS Separate Detector Displays are preferably implemented using a 512x256 electroluminescent panel, power converters, V and VT Text Terminal emulation, Graphic Drawing Controller such as M3 electroluminescence, California. The control function for each panel is preferably implemented using separate, distributed, programmable controllers of the type available under the trademark "MODICON 984", supplied by AEG Modicon Corporation, North Andover, Massachusetts, USA. Thus, the calculation of the DIAS is based on either distributed, discrete, programmable microprocessors or 5 minicomputers, whereas the calculation of the DPS is based on a task-specific mainframe.

Figure 31 schematically illustrates the ESF control system and process component control system, while the power plant security system is preferably of the type based on "nuclear safety calculation" as disclosed in U.S. Patent No. 4,330,367, "System and Process for Nuclear Power System Control," issued May 18, 1982. , which is incorporated herein by reference.

Another aspect of connectivity is the ability to display critical functions and paths with IPSO as described above. Since the major safety and power generation signals and 20 status information are associated with both the DIAS and the DPS, the operator: can browse the critical functions shown in Figures 32-35; ; according to the screen page hierarchy. In Figure 33, the operator is informed that emergency feed of the reactor cooling system is not available. In Figure 34, the operator is informed that emergency supply 25 is unavailable and the power plant is in the launch state.

· '* Under these conditions, the operator must define an alternative method of heat removal from the reactor core and, by going to the second level of the critical function screen, he will receive the heat removal reference information, even though it is displayed with 30 inventory controls (Figure 35). This level of detailed information and data aggregation is available for all critical functions in virtually all operating conditions, not just during accidents.

VI. MODULARITY OF PANELS

.35 63 1,0881 6

It should be noted that, as noted above, the use of separate tiles and messaging methods significantly reduces the amount of panel space required to perform a particular control task. Similarly, the monitors monitor-5 task section, which includes hierarchical display pages, is more robust than conventional nuclear control room systems. The control actions of a particular panel can be combined in a similar way.

Therefore, a feature of the present invention is the physical modularity of each panel containing the master control console, and more generally the physical modularity of each panel of the control room. The space required in each panel to provide an efficient connection with the operator is substantially independent of the number of alarms, displays, or controllers available to the operator. For example, as shown in Figure 3, the six locations on each side of the CRT can be reserved for alarm and detection purposes. Preferably, the two top positions on each side are reserved for alarms 78 and the other four 20 positions on each side are reserved for indicator display 82. Each panel of the control room has a similar appearance.

«* · This provides significant flexibility and significant cost savings • during the construction phase of the power plant, as the hardware can be installed and terminals can be connected at an early stage of the • construction schedule, even before all system operational requirements are met. implemented. Software-based systems are delivered early and representative software is installed to pre-test the control room functions. The final installation and functional testing of the software is carried out in a more »practical phase of the construction, on schedule. This method can l (· significantly accelerate the construction time of the power plant for instrumentation *, · operation and control systems. Because power plant instrumentation and control requirements are often only reached at a late stage of the .35 power plant design schedule, the present invention reduces costly delays in the construction phase in almost all cases, and the obvious cost savings of 64 1 08 8 1 6 due to the production of integrated panels, the normal design of alarm locations and presentation and the reduction of material costs for compact panels. operators work under stress in the event of an alarm, it reduces operator errors because each panel has a consistent investment position.

Thus, each modular control panel has location-specific detectors and alarms, and preferably at least one position-specific separate controller label 88, CRT 84, and interfaces to at least one modular control panel or computer for communication therewith. For example, communication via DPS includes e.g. the ability to acknowledge one panel alarm when an operator is on another panel, and the automatic availability of system-related information controlled by one panel to all other panels.

2 °

Figure 36 (a) illustrates conventional procedures by which; performing instrumentation and control of a nuclear power plant, and Figure: 36 (b) illustrates operations according to the present invention.

Conventionally, inputs and outputs are defined, then the required algorithms are defined which define the interface between the human and: *: \ machine. After that, the production of all materials begins and all equipment is installed in the power plant at substantially the same time before system testing can begin. By contrast, the modularity of the present invention allows the manufacture of the apparatus to commence at the same time as the determination of outputs and inputs. In the same way. ”The devices can be installed and tested generally at the same time: during the human-machine interface design and at the site-specific algorithm design. The hardware and software · will be combined before final testing. In a conventional nuclear power plant installation, the equipment will be installed throughout the fourth year of the instrumentation and control phase, while the equipment according to the present invention may be installed as early as the second or third year.

Referring further to Figure 3, the process component control system 5 and the protection component control system 56 use programmable logic controllers similar to the Modicon devices mentioned above. These include input and output multiplexers and associated wires and cables that can be delivered to the power plant prior to the development of power plant-specific logic and algorithms. The device is fault tolerant.

The data processing system 70 operates multiple power plant mainframes via modular software and hardware and associated data links 15. Such hardware can be delivered and modular software specific to the power plant may be installed just prior to system integration and testing.

20 DIAS 72 uses input / output multiplexers and fault tolerant implementation. It has programmable logic processors or :: minicomputers that achieve the same benefits as described in process control and security device control systems: *. ·.

I. * \ i. .

| »(* • · · I 108810 66

ANNEX

DETAILED EXAMPLES OF AUDIT ALGORITHM

5 This appendix describes in detail the generic validation and display algorithm used in DPS and DIAS.

Definitions of Terms Used 10 PAMI Post-accident monitoring briefing.

Instrumentation Sensor and Transmitter Operational Uncertainty Operational accuracy (eg, accuracy is ± 1%, 15 instrument uncertainty is 2%).

Expected Process Temperature (or other unit of measurement) deviation between sensors measuring the same process parameter due to the expected process temperature (or other "·" · unit of measurement) deviation due to the different locations of the sensors.

25 ·· Computational Single algorithmic computation: Y: Signal A signal representing all sensors measuring the same parameter.

Process Representative 30. single output signal used for displays and alarms when required * ;;; a single signal value instead of multiple I * · * _ sensor values. "Process representation-.: 'And" is always a "computational signal" unless an error has occurred. After the 35 V error has occurred, it may be the output of a single sensor selected by the training i * \ · 's rator or algorithm.

108816

Checked "Computational Signal" for which all inputs have passed a deviation check for the average of all inputs. 5

Verified PAMI "Verified" "Process Agent" that passes a deviation check with "PAMI" sensors.

10

Inspection Error The inspection and display algorithm failed to compute the "checked" "computed signal".

15 PAMI Error "Computational Signal" misalignment with "PAMI" sensors.

Fault selection "Computational signal", which is the output of the 20 sensors closest to the • last "checked" signal before the check failed.

: Operator Selection "Process Agent", which is the output of the 25 ·· sensor selected by the operator after the “PAMI Error” or “Inspection Error”.

Good Mark, 30 for a sensor that passes a deviation check · ;;; "operator selection" or "verified" "process agent".

, Poor The label assigned to a sensor, 3.5y, which fails in the deviation check with the "operator selection" or the "process agent" checked.

68 108816

Suspicious An entry given to a "good" sensor that deviates most from the average "computed signal" 5 when any deviation check fails.

"Permit carrier selection based on audit error"

A permission that allows an operator to select a single sensor as a "process representative" when the algorithm is unable to compute a "checked" signal.

15 "Authorization for carrier selection based on PAMI error"

A permit that allows an operator to select a single sensor as a "process representative" when the "checked" "computed signal" fails the 20 deviation tests with the PAMI sensor.

* «::: Inspection and sampling algorithm i '': All sensor transmissions (A, B, C, D) are read and stored at the start of the algorithms. The algorithm uses the Show Stored Values, i.e., to execute all steps (1-10) that make up a single pass. When the algorithm is repeated (after step 10), the sensor transmissions are read and re-stored for a new scan.

30th

^ Configuring "Computational Signal" and Errors (Steps 1.2.3.4.5¾; "Test Attempt (Steps 1.2.3¾ 35, 1) The algorithm checks if there are at least 2" good "sensors, yes, go to step 2 no, go to step 5 i 69 10881 6

Note. The sensor is "good" unless it has been marked as "bad" or "suspicious" sensor the last time.

j 5 2. The algorithm calculates the average of all "good" sensors (A, B, C, D). Let's go to step 3.

3. Check the mean deviation of all good sensors (which should be within the sum of the instrument half of the uncertainty of the instrument and the sum of the expected process deviation).

If all the deviation checks are successful, proceed as follows: a. Any previously set "inspection errors" will be removed.

b. Delete the permit that allows the operator to select a sensor after an inspection error (ie, "permit operator selection due to an inspection error" if one has been previously issued).

20 φ c. All "suspicious" sensors are declared "defective" and a deviation alarm is issued for such sensors.

»1 · ί ,,. 'D. Give the average as a "checked" "calculated signal".

25: e. Go to Step 4.

• · 4 ·

If any deviation check fails, the following occurs: a. The most abnormal sensor is marked 30, "suspicious", after which the algorithm checks · *; whether this is the first or second round of this passage.

* I

; * For the first round, the algorithm · ·. ”* Mi is repeated from step 1.

♦ I I »3 {5, V Note:> * If the deviation check fails in the first round, the algorithm has used I 70 1 0881 6 j at least one bad sensor to calculate the mean. Applying a second turn removes a bad sensor or detects malfunction of multiple sensors.

5 * If the second round fails, go to step 5.

NB:

If the second round does not pass the deviation test, it will indicate two or | 10 simultaneous presence of more than one sensor error. The algorithm cannot reliably remove only bad sensors, which will cause it to fail. This ensures that the algorithm does not calculate a false "checked" signal in this case. Normally, when there are no multiple simultaneous errors, the algorithm detects multiple misalignments, removes them one by one from the algorithm one by one, and determines a "checked" signal.

20 t * '· * · Checked - PAMI Inspection (Step 4) m. 4. (This step is used if the process »has a Class 1 PAMI sensor. If this process does not have PAMI | \ sensors, this step is not performed but goes straight to step 29; step 6).

• · · ·> ·

* I

* Does the "checked" signal pass the deviation check with PAMI sensors? a. Yes. Giving "PAMI" message, removing possible 30, "Permit carrier selection due to PAMI error", removing possible "PAMI error" alert, going | ** 'to step 6.

| ; Note; "Authorization for carrier selection due to PAMI error" allows the $ 3 operator to select any sensor as a "process agent" when the "count signal" 10881 6 (i.e., the "verified" output of the algorithm) does not match the PAMI sensor.

b. The following steps are taken.

5 - Delete the "PAMI" message

A "PAMI Error" alarm is generated

Allowing "carrier selection due to PAMI error" - Let's go to step 6.

10

Failed Check (Step 5) The algorithm checks if the "calculated signal" of the previous pass was an "error selection" sensor.

- If there was no "error selection" in the previous screening, a "verification error" just occurred. Do the following: a. Generate a "check error" signal.

b. Declare all "suspicious" sensors "good".

: 2t): Note: This step ensures that the next time the algorithm attempts to scan using all sensors that have not previously been designated as "bad".

c. Allows the operator to select the output of a single sensor as a "process agent" ("permission to select operator due to a control error").

d. The deviations of all sensors are checked for the last "checked" signal. The "fault selection" sensor is the sensor that deviates least from the last "checked" signal.

e. The "fault selection" sensor signal is output as a "computed signal".

; 3 '$ · f. Let's go to step 6.

- If the previous scan had a "fault selection", the inspection failed earlier and already selected the "fault 72 1 0881 6 silence" sensor. The value of the "fault selection" sensor is still given as a "calculation signal", going to step 6. Note:

It is important that the 5 sensors originally selected by "fault selection" are maintained, as other failed sensors may subsequently erroneously appear more accurate.

Selection of "Process Agent" (Steps 6,7) 6. The algorithm checks for "Authorized carrier selection due to audit error" or "Authorized carrier selection due to PAMI error".

NB:

The check error allows one permission for operator selection, and if the deviation of the "checked" value of the algorithm does not pass 15 "PAMI" checks, this will provide another permission for operator selection.

- If no operator selection permission is in effect, a "computational signal" is given as "process agent" and proceed to step 9.

: 2O: - If you have a carrier selection permission, go to step 7.

7. Check whether the sensor has been selected by the operator as a "process | representative".

'25 - Yes, giving the signal of the selected sensor as "process representative", go to step 9.

No, the "computational signal" is given as "process representative", go to step 9.

Note: This step gives a "computational signal" "process:: · as a representative" when the operator has the option to select the V sensor but does not use this option.

* I * *: \ PAMI Verification of "Qoperator Selection" Sensor (Step 8) • 3'5: 8. Does the "Operator Selection" sensor pass the PAMI sensor (within the sum of the PAMI instrument uncertainty and expected process deviation)? 73 1 08 81 6

Yes, a "PAMI" message is displayed on the "process agent" screen.

No, the "PAMI" message is removed from the "Process Agent" screen. 5

Bad Sensor Evaluation (Step 9) 9. Is "Process Agent" "Checked" or "Operator Selection"?

No, let's go to step 10 (no "bad" sensor evaluations will be done if the "process agent" comes from the "fault selection" sensor.)

Yes, an offset check is performed on all "bad" sensors (A, B, C, D) for the "checked" or "operator selection" signal by the following methods: 15e All future "bad" sensors pass the offset test (instrument uncertainty and expected process offset). within).

a. Remove the "bad" and; 2 <31 markings of all sensors that have passed the deviation check, and remove them from the sensor. associated deviation alarm.

b. Retain the "bad" markings of all sensors that fail in the deviation test.

c. Let's go to step 10.

25

'·' 'Area inspection (step 1CH

10. The algorithm checks whether the "process agent" is at or above the maximum numeric value of the sensors, or at or below the lowest numeric value.

3tr - Yes, the message is "out of range" along with the "process front and" signal. The CRT screen displays a multiplication sign (*) above the "process agent". Let's go to step 1 and repeat the algorithm.

No, let's go to step 1 and repeat the algorithm.

: 35 Note:

The "out of range" message tells the operator that the actual process value may be below the sensor's measuring range or 74 1 08 81 6. If process measurements can be made with sensors in more than one area, this check causes a new set of sensors to be selected.

Note: 5 The RCS panel uses this generic verification algorithm directly for the RCP differential pressure, SG differential pressure, and pressurizer level reference branch temperature. Tcold's 'Thot' Compressor Level and Compressor Pressure Algorithms use this generic algorithm, which adds 10 steps and small changes to include: 1. Different number of sensors.

2. Multiple sensor areas.

3. Loss of information in related process measurements.

! 15 Tcold Inspection Algorithm (Fig. 37) The RCS uses 12 sensors to measure cold branch temperatures. During most operating cycles, the operator will search for a single "process agent" for each of the RCS cold branch temperatures. This value is obtained from DIAS as "RCS Tco ^ d" '2'Q; with. For consistency, this value defined by the DIAS::: value is also used in the Combined Process State Description (IPSO). For the sake of reliability, DPS compares the DIC "process representative" Tcold with its own RCS Tcold value and alerts for any deviations (DPS / DIAS RCS T_ calculation deviation). [25 A three-step algorithm is used to determine this value: 1. Determine the "process" temperature for each of the four cold branches (IA, IB, 2A, 2B) using a combination of deviation check and mean calculation (details will be described later).

, ib '2. From the results of step 1, determine the "process" Tcolcd • i »v for each RCS loop (loop 1 and loop 2),, · by averaging the corresponding values of A, B.

3. Determine the "process representative" RCS Tcold from the results of Step 2 for normal displays and alarms by calculating: 3'5 the average of the values of Loops 1 and 2.

75 1 0881 6 This three-step process determines the "controlled" "process" temperatures for the cold branches IA, IB, 2A and 2B, the cold loops 1 and 2, and the RCS for Tc. In situations where it is not possible to calculate the "process" temperature 5 for the cold branch, the algorithm selects the sensor with the value closest to the last "checked" signal as the "fault-selected" process-representative temperature. This automatic fault selection ensures the RCS Tcold "Process Agent" is continuously available for displays and alarms. After the fault, the operator 10 may select a single sensor in question. cold branch (IA, IB, 2A, 2B) as a "process agent". This selection allows the "process representative" of the loop 1, the loop 2 and the RCS Tcold to be calculated with the "operator selection" information.

15 The following section describes the algorithm and display handling with DIAS and CRT displays.

1. The "process representative" of the rods IA, IB, 2A, 2B, Loops 1, 2, and RCS Tcold is always displayed with the appropriate DIAS * t '' 2'q; display and / or CRT screens when a single "process representative" is required instead of multiple sensor values.

* * s 2. »Tcold's algorithm and display processing is identical to the generic verification algorithm with the following notes:» * 2Ϊ5, a. Generic algorithm steps 1-5 ("computational I * · · signal") "and troubleshooting) are modified taking into account the following points: 1. There are only 3 cold branch sensors.

2. The same cold branch has wide and narrow area sensors.

b. Determination of "computational signal" and faults; and. Other steps of the X generic algorithm (steps 6-10) is executed independently for each cold branch (IA, IB, 2A, 2B).

• 3 * 5 c. Two algorithms are added:. 1. An algorithm that computes the average of the "process representative" of the two cold branches, which is the 76 1 0881 6 of the loop.

Tcold "Process Agent" (IA and IB for loop 1, 2A and 2B for loop 2).

2. An algorithm that computes the average of the "process representative" of the two cold loops, which is the "process representative" of RCS 5 Tcold! (Loop 1 and loop 2).

3. The operator can view any of the 12 sensor values or 7 "computational signals" using the menu on the DIAS or CRT display (as described in the generic inspection algorithm 10).

These options include:

T-112CA / 122CA 465-615eF TCold loop IA / 2A

15 T-112CB / 122CB 465-615 ”F TCold Loop 1B / 2B

T-112CC / 122CC 465-615 "F TCold loop 1A / 2A

T-112CD / 122CD 465-615 ”F TCold loop 1B / 2B

T-111CA / 111CB / 50-750 ”F TCold loop

123CA / 123CB 1A / 2A / 2A / 2B, PAMI

20

Loop IA Tc Computational signal

Loop IB Tc Computational signal

Loop 2A Tc Computational signal

Loop 2B Tc Computational signal 2: 5 Loop 1 T_ Computational signal • v

Loop 2 T_ Computational signal * * l v RCS Tc Computational signal

Inspection Algorithms 30 Note:

The following letters are used to mark the sensors of the cold branch to facilitate the marking of the sensors.

A - Narrow Sensor 1 (Security) (465-615 ° F) B - Narrow Sensor 2 (Security) (465-615 "F) '35 C - Wide Sensor (PAMI) (50-750T) 77 1 0881 6 D - wide area sensor in opposite cold branch (ie when talking about loop IA, this is wide area sensor IB, PAMI) (50-750 ° F) 5 The following algorithms are computed and displayed in both DPS and DIAS independently.

Method for Determining the "Process Representative" of TCLlds for IA, 2B, 2A, or 2B Flow Branches 10 The determination of a "process representative" for a cold branch is done in four steps: For IA, IB, 2A and 2B, the "calculated signal" for temperature is calculated using sensors A, B, C. An inspection is attempted using narrow-area sensors. If this fails, the cold branch "computed signal" is checked by a wide range of .20 path sensors. If the scan fails with both narrow and • wide-area sensors, the algorithm selects the "fault-selected" "computed signal" as the sensor closest to the last "checked" signal.

2: 5: Y; 2. Selecting a "process representative" (steps 9, 10) (similar to generic verification algorithm steps 6 and 7).

3. PAMI check of "operator selection" sensor (step 11) 3j0 (similar to step 8 of the generic check algorithm).

t 4. Poor Sensor Evaluation and Area Inspection (Steps 12, 13): (Similar to Generic Inspection Algorithm Steps 9 and 10).

· 'Cold Branch IA. IB. 2A or 2B Checking and Calibrating Algorithm .35 78 1 08 81 6 Determining "Computational Signal" and Faults (Steps 1 to 2)

Narrow Zone Attempt (Steps 1-5) 5 1. The algorithm checks if there are two "good" Narrow Area Sensors (A and B).

- yes, let's go to step 2 no, let's go to step 5

Note: The sensor is "good" unless it is marked "bad" in the previous 10 passes.

2. The algorithm calculates the mean of A and B, going to step 3.

3. The mean deviation of both "good" narrowband sensors (A and b) is checked (up to half the sum of the uncertainty of the 15 narrowband sensors and the sum of the expected process deviation).

If both deviation checks are passed, go to step 4 to check if the average is in the measuring range.

, 20 - If any deviation check fails, go to "·" '· step 5.

Range Selection f Step 4 ') •. · 4. The algorithm checks whether the average or selected narrow range sensor is within the measuring range.

- The average or selected sensor is within the measuring range if its value does not exceed 96% or at least 4% of the narrow measuring range.

The average or selected sensor is out of range of 3.0 if its value is at least 98% or at most 2% ';;; narrow measuring range.

Note: Hysteresis prevents continuous transitions outside the area. The range is exceeded at 98% and 2% to ensure that values outside the range 25 are not used to calculate the "checked" signal (e.g., in the worst case 791 0881 6, sensor readings could be 100% or 0). %).

If the value is within the measuring range, remove any "control error" alarm, deactivate "permit operator-5 selection due to control error", and provide the average or selected narrowband sensor as a "checked" "computed signal". Let's go to step 6.

I - If the value is out of range, go to step 7.

10 5. The algorithm checks the deviation of the narrow range sensors (A and B) from the sensor C (up to half the sum of the wide area sensor uncertainty and the expected process deviation).

15 - If either sensor A or sensor B passes the bias test, the algorithm will select the sensor closest to C (A or B). This sensor is selected for further inspection. A sensor that deviates most from sensor C is labeled "bad" unless it has already been labeled as "2.0", i.e. "bad", and produced. sensor related deviation alarm, if it has not already been done before.

Go to Step 4.

- If both A and B fail the deflection test with C, go to step 7 and try a wide area • 25 check.

• »PAMI check (step 6) 6. The algorithm checks whether the" checked "average or selected sensor passes the deviation test with PAMI sensor (C) 30 (within the limits of half the uncertainty and the expected process deviation);

'[- If passed, do the following:; a. Delete "carrier selection permission due to PAMI error".

, .3.5 b. Issuing a "PAMI" message together with a "checked" · "" computed signal ".

'· C. Eliminate any "PAMI Error" alarm.

i 80 1 0881 6 ί d. Let's go to step 9.

If not, proceed as follows: a. Delete the "PAMI" message.

b. Granting "Operator Selection Due to PAMI Error 5".

Note: This feature allows the operator to select a second sensor cold branch as a "process representative" when the "checked" output of the algorithm 10 does not match the post-accident monitoring indicator (sensor c).

Wide Area Inspection Attempt (Step 7) 7. Check for C deviation from D (within the sum of half the uncertainty plus 15 expected process deviations).

Note: When checking a single wide area sensor in the cold branch, the algorithm checks its deviation from another wide area sensor of the same cold loop (i.e. if in loop 1, the wide area .20 sensor IA deviation is checked for wide area I '· *' · sensor IB).

1 * *

! '·: · - If the deviation test is passed, sensor C is selected

as a "checked" "calculated signal" and • V, do the following: 25 a. Remove any "check error" alarm.

: Y: b. Delete "permission to select operator due to an error!"

c. Let's go to step 9.

- Failure to pass anomaly testing will result in failure of inspection. Let's go to step 8.

* I I

, Failed check (step 8): 8. The algorithm checks if the "calculated" signal from the previous pass was a "fault selection" sensor.

..3.5 - If there was no "fault selection" last time, there is a »t · \ check error just now. Do the following: a. Generate a "check error" alert 81 1 0881 6 b. Grant "operator selection due to a check error".

c. The deviations of all sensors (A, B, C) are checked for the last "checked" signal.

5 The "fault selection" sensor is the sensor that deviates least from the last "checked" signal.

d. The "fault selection" sensor signal is output as a "calculated signal" of the branch Tc.

10 e. Let's go to step 9.

If there was a "fault selection" last time, the check has already failed and the algorithm has selected a "fault selection" sensor. The signal of this "fault selection" sensor is still output as a "computed signal". Let's go to step 9.

Selection of the branch (A or B1 Tc "process representative" (steps 9 to 9) Step 9 is the same as generic verification algorithm step 6.

.20 • 10. Step 10 is the same as Generic Verification Algorithm Step 7 with the following exception. The operator can choose to be a "process agent" for any of the applications. A, B or: V C of the cold branch sensor, or any of the opposite cold branch (A or B).

PAMI Verification of "Qperator Selection" Sensor (Step 11) 11. Step 11 is the same as Step 8 of the Generic Verification Algorithm.

SO

'• J' Poor sensor evaluation (Step 121. 12.This step is the same as Generic Verification Algorithm Step 9, except that all offset checks use: 'except for wide-area instrument uncertainties;' 3 · έ those offset checks where narrow-area sensor offsets is compared to a narrowband signal, whereby the uncertainties of the narrowband instrument are used.

82 108816

Area inspection (step 13) 13.This step is the same as step 10 of the generic inspection algorithm.

5

A method for determining the "process representative" of loops 1 and 2 Tcoia;

- The "process representative" of Loops 1 and Tc is determined by calculating the A and B cold branches (IA and IB in Loop 1) (2A

10 and 2B in loop 2) average of "process representatives".

NB:

To simplify the processing of inputs of the "process agent" of the cold branch (1A, 1B, 2A or 2B), the algorithms in loop 1 or loop 2 agree that A represents input from branch IA or 15 2A and B represents output from branch IB or 2B.

1. The algorithm calculates the average of the entries from the cold branches A and B and gives as the "process representative" of the mean loop (1 or 2) Te.

.20 2. The algorithm checks whether A and B are "checked".

• · «'· * · Yes, giving the average as a" checked "signal, go to step 5.

t · · - No, let's go to step 3.

• · · i 3. The algorithm checks whether A or B is "operator selection".

, 25 - Yes, let's go to step 4.

: Y - No, give the average as a "fault selection" signal, go to step 5.

4. The algorithm checks whether A or B is a "fault selection".

Yes, the average is given as a "fault selection" signal, "10 going to step 5.

- No, the average is given as the "operator selection" signal,, go to step 5.

:: 5. Check the deviation of A and B from the mean (half of the wide area uncertainty and expected process deviation).

• »I

..35 within the range).

* I

»> ·

♦ I

83 1,0881 6

If the deviation checks are passed, the "Tc Cold Branch (1A / 1B or 2A / 2B) Temperature Deviation" alarm is cleared, then go to step 6.

- If either of the deviation checks is not passed, 5 "Tc Cold Branch (1A / 1B or 2A / 2B) temperature will be generated.

deviation "alarm, go to step 6.

6. The algorithm checks whether A and B are in a narrow range.

- Yes, give the average in a narrow range, go to step 7.

10 - No, give an average over a wide range, go to step 7.

7. The algorithm checks whether one or both of the outputs are out of range.

If one or both are out of range, a "process representative" signal of the loop Tc is provided together with an "out of range" message, proceeding to step 8.

- If both are within range, no "out of range .20 la" message will be issued with the "process agent" of the loop Tc.

'· / 8. The algorithm checks whether A and B inputs are PAMI inputs.

• * '·: · - Yes, the "PAMI" message is given together with the "process representative" of the T_ of the loop (1 or f * 2), the algorithm of the loop T - I · t ^ ^; is repeated, go to step 1.

> (^ 25 - No, no "PAMI" message is given together with the loop (1 or 2); Y T_ "process representative", loop T algorithm is repeated, go to step 1).

Method for Configuring RCS TCQld 3.0 - "Process Representative" for Loops 1 and Tcold * ;;; calculating the average of Tcold "process representatives" for loops 1 and 2, (missing ??): - No, providing a "process representative" of step 2 as "fault selection", going to step 6.

I t I

..3.5 5. The algorithm checks whether signal 1 or 2 is "fault selection".

'- Yes, given the "process representative" of step 2 as a "bugfix", go to step 6.

84 1,0881 6

No, the "process representative" of step 2 is given as the "operator-choice", let's go to step 6.

6. This step is the same as step 10 of the generic check algorithm. Let's go to step 1 and repeat the algorithm.

After pressure, the pressure check algorithm (Figure 38)

The pressure of the pressurizer and RCS is measured with 12 sensors. During more than 10 duty cycles, the operator needs a single "process representative" for all pressure readings of the pressurizer / RCS. This value is indicated by DIAS as "PRESS". For the sake of consistency, the IPSO table also uses this value defined by the DIAS. To ensure reliability, the DPS 15 compares the DIAS pressure "process agent" with its own pressure "process agent" and alerts you to any deviations (DPS / DIAS Pressure Calculation Deviation).

The algorithm determines the "checked" "process representative" for pressure, 20 strainer / RCS pressure. In situations where it is not possible to calculate *, for pressure "checked" "process representative", the algorithm • * selects the "fault selection" "process representative" of the sensor closest to the last "checked" signal. This * · ·: Automatic Fault Selection ensures continuous availability of pressurizer / RCS pressure "35" process representative "for displays and alarms. After a fault, the operator may select the pressure of a single sensor as a "process representative" of "fault selection".

The following section describes the algorithm and display processing with 30 DIAS and CRT displays.

• I »

* * I

(t \. 1. "Process representative" pressure is always displayed on the relevant DIAS screen and / or CRT screens when a single "process representative" is required instead of multiple sensor values ..! j6.

»· I» »» 85 1 08 81 6 2. The pressure algorithm and display processing are identical to the generic inspection algorithm with the following modifications: a. The generic algorithm steps 1-5 ("computational signal" and fault determination) are modified as follows: 1. The sensors use three measuring ranges (0-1600 psig), (1500-2500 psig) and (0-4000 psig).

b. The other steps of the generic algorithm (steps 6-10) are numbered according to the additional items in the block ("defining the signal" and defining 10 faults). They remain almost the same except for the minor changes described in each step, as 3. The operator can use the menu to view the values of any of the 1 sensors or a single "computational sine" 15 (as described in the generic inspection algorithm). These options include the following: P-103, 104, 105, 106 0-1600 psig Presser pressure P-101A, 101B, 101C, 1500-2500 psig Presser pressure

101D, 100X, 100Y

I: '· .20 P-190A, 190B 0-4000 psigRCS pressure, PAMI

CALC PRESS Computational signal

Tarkastusalooritmi

In order to facilitate the handling of the sensor identification numbers, the following letters are used to indicate pressure sensors:

: ·: P - 10IA = A

P - 10 IB = B P - 101C = C P - 101D = D • 30 P - 101X = E

; ··. P - 101Y - F

P - 103 = G P - 104 = H: · ·; P - 105 = I

: '-' 35 P - 106 - J

P - 190A = K P - 190B = L

86 1 0881 6

The algorithms described below are computed and displayed independently in both DPS and DIAS.

5 The "computational signal" of the pressurizer pressure is calculated using the antimeters A, B, C, D, E, F, G, H, I, J, K, and L. First, narrow range sensors (A, B, C, D, E and F). For pressures outside the 1500 to 2500 psig range, sensors in the 0-1600 psig range (G, H, I, and J) are used. 10 If the pressure cannot be reduced with these sensors, sensors in the range 0-4000 psig (K and L) are used. If the check fails in all three areas, the algorithm selects the "closest" signal to the "process representative" of the "fault selection" process.

15 This "fault selection" "computational signal" is used as a "process agent" until the operator switches the sensor to "operator selection" or the algorithm passes the check.

: * -. 2 0 Pressure Vessel Pressure Check and Increase Algorithm · Determination of Computational Signal and Faults (Steps 1-Ill: 'Test Attempt in the 1500-2500 Partition Range 1. The algorithm checks if there are at least two "good" 1500-2500 ", ;; 25 psig sensor.

- Yes, let's go to step 2.

No, let's go to step 5 to try a 0-1600 psigr range check.

Note: The sensor is "good" unless it is marked "bad"; 30 or suspicious at the previous passage.

2. The algorithm calculates the average of all "good" sensors in the 1500-2500 psig range (A, B, C, D, E, and F). Let's go to step 3.

'·; · [3. Checking the mean of all good 1500-2500 psig sensor offsets; v35 (which should be in the range of half the sum of the uncertainty and the expected process offset).

87 Jl Λ Λ Λ it 108816

If all the deviation checks are passed, go to step 4 to check if the mean is in the right range.

- If any abnormal check fails, 5 will occur:

The most abnormal sensor is marked as "suspicious", after which the algorithm checks whether this is the first or second cycle of this pass.

10 * For the first round, the algorithm is repeated from step 1.

NB:

If the offset check fails in the first round, the algorithm has used at least 15 equally bad sensors to calculate the mean. Another | performing a round removes a bad sensor or detects a number of sensor malfunctions.

* For the second round, the check fails in the 1500-2500 psig range and go to \ & 0 step 5 to try the 0-1600 psig range: check.

. · · ·. NB:

Failure in the second round to pass the offset check indicates the presence of two or more •: ·: 25 1500-2500 psig sensors in the same band. The algorithm cannot reliably remove only bad sensors, which causes the scan to fail in the 1500 to 2500 psig range. 0-1600 psig inspection is attempted. ;: 30 This ensures that the algorithm does not calculate the wrong signal in this case. Normally, when there are no multiple simultaneous errors, the algorithm detects multiple misalignments, removes them one by one from the algorithm, and determines the "checked" signal.

: '·, · Range selection (step 4) 4. The algorithm checks if the average is in the measurement range.

88 1 0881 6

The average or selected sensor is within the measuring range if its value does not exceed 96% or at least 4% of the narrow measuring range.

The average or selected sensor is outside the measuring range if its value is at least 98% or at most 2% of the narrow measuring range.

Note: Hysteresis prevents continuous transitions outside the area. The range is exceeded at 98% and 2% to ensure that values outside the range 10 are not used to calculate the "checked" signal (eg in worst case, sensor readings could be 100% or 0%).

If the value is within the measuring range, proceed as follows: 15 a. Remove any "check error" alarm.

b. Delete "Authorized carrier selection due to a control error" c. Give the average as a "checked" "calculated signal".

: '-. Dec 20 Let's go to step 12.

: - If the value is out of range, try to check ··· in the range 0-1600 psig and go to step 5.

! Attempt to scan in the 0-1600 partition range (steps 5-8) *; ': 25 5. The algorithm checks if there are at least two "good" sensors in the 0-1600 psig range (G, H, I, and J).

Yes, let's go to step 6.

- No, let's go to step 9 to try the 0-4000 psig check.

..; | 30 6. The algorithm calculates the average of all "good" 0-1600 psig:: sensors (G, H, I, and J). Let's go to step 7.

, 7. Checking the mean deviation of all "good" 0-1600 psig sensors (which should be within half of the uncertainty of the 0-1600 psig range and the sum of the expected process: 35 deviation).

j 89 1,0881 6

If all the deviation checks are passed, go to step 8 to check if the mean is in the right range.

If any deviation check fails, the following 5 will occur:! The most abnormal sensor is marked "suspicious", after which the algorithm checks whether this is the first or second cycle of this pass.

10 * For the first round, the 0-1600 psig range algorithm is repeated from step 5 onwards. NB:

If the offset check fails in the first round, the algorithm has used at least 15 equally bad sensors to calculate the mean. Applying a second turn removes a bad sensor or detects malfunction of multiple sensors.

* For the second round, the scan fails in the 0-1600 psig range and goes to step: 9 to try to scan the 0-4000 psig range.

Note: • · ·: *. · If the second round does not pass the deviation-! check, it indicates the simultaneous existence of two or more 0- ".". 25 1600 psig sensor errors. The algorithm cannot reliably remove only bad sensors, which causes the scan to fail in the range of 0-1600 psig. 0-4000 psig inspection is attempted. This ^ 130 ensures that the algorithm does not compute the wrong signal in this case. Normally when ι V is not multiple errors, the algorithm ;;; detects multiple misalignments, removes them one by one from the algorithm one after the other, and defines a "checked" signal.

»» *

Range Selection (Step 8) 90 1 08 81 6 8. The algorithm checks if the average is in the measuring range.

The average or selected sensor is within the measuring range if its value is up to 96% or at least 4% of the 0-1600 psig measuring range.

5 - The average or selected sensor is out of range if its value is at least 98% or at most 2% of the 0-1600 psig range.

Hysteresis prevents continuous transitions outside the area. Exceeding the range occurs at 98% and 2% 10 to ensure that values outside the range are not used to calculate the "checked" signal (e.g., worst case sensor readings could be 100% or 0%).

If the value is within the measuring range, proceed as follows: 15 a. Remove any "check error" alarm.

i b. Delete "Authorized carrier selection due to an error in inspection" c. Give the average as a "checked" "calculated signal".

: '\ £ 0 d. Let's go to step 12.

: - If the value is out of range, a check is attempted ·· 1. in the range 0-4000 psig and go to step 9.

[· »·! Attempt to 0-4000 psigr range (steps 9-11) "." 25 9. The algorithm checks if both the 0-4000 psigr range sensors (K and L) are "good".

Yes, let's go to step 10.

No, it is not possible to check the 0-4000 psig range, go to step 13.

y: 30 10. The algorithm calculates the mean of K and L (sensors in the range 0-4000 psig). Let's go to point 11.

• The deviation of V11.K and L is checked for the mean value (which should be in the range of 0-4000 psig for half the sum of the uncertainty plus the expected process deviation).

: '· 35 - If both deviation checks are passed, then:' ·.! the following: a. Remove any "check error" alarm.

9i 1 0 8 81 6 b. Deletion of any "carrier selection permit due to a control error" c. Let's go to step 12.

- If either failure check fails, go to step 13.

PAMI Check (Step 12) 12. Whether the "checked" "computed signal" passes a deviation check with the PAMI sensors. Method 10 is used if the "checked" "computed signal" is in the range 1500-2500 psig or 0-1600 psig, and method b if it is in the range 0-4000 psig.

Method f (a) The deviation shall be within the limits of half the sum of the uncertainties of the 15 instruments in the range of 0 to 4000 psig, the sum of the process deviation and the position constant of the instrument.

Method (b) The deviation shall be within the range of half the sum of the uncertainty of the instrument within the range of 0-4000 psig and the sum of the process deviation.

: \ fc0 - Yes, do the following i ·: A "PAMI" message will be issued, unless already done.

«· ·, ···. b. Delete any "carrier selection permission; · '· due to PAMI error".

! c. Let's go to step 14.

* * *; ': 25 - No, do the following. Delete any "PAMI" message.

b. A "PAMI Error" alarm is generated, if not already done.

c. Allowing "carrier selection due to PAMI error: 30".

: T d. Let's go to step 14.

• · • ;;; Failed Check (Step 13); ·, 13. The algorithm checks if the "countdown" signal from the previous pass was a "fault selection" sensor.

- If there was no "fault selection" last time, an error has occurred right now. 92 1 0881 6 a. A "check error" alarm will be generated.

b. The offsets of all sensors (A, B, C, D, E, F, G, H, I, J, K, and L) are checked for the last "checked" signal. The sensor that deviates least from the last "checked" signal is selected as the "fault selection" sensor.

c. The "fault selection" sensor signal is given as a "computed signal" of the pressure and pressure.

d. Granting "permission to select operator due to a control error".

e. Let's go to step 14.

Selection of a "process representative" for pressurized pressure (Steps 14).

151 15 14. Step 14 is the same as Generic Verification Algorithm Step 6.

15. Step 15 is the same as step 7 of the generic check algorithm; '· .έθ PAMI check of the "Qperator selection" sensor (step 16) 16. Step 16 is the same as step * * k 8 of the generic check algorithm except that the offset check criterion The pressure at this pressures is as described in step 12 of this ice pressure check and display algorithm.

•; '| 25 * »

Poor Sensor Evaluation (Step 12) 17. This step is the same as Generic Inspection Algorithm Step 9 except that the criteria for the deviation inspection are as described in step 12 for the pressure checking and display sub-pressure of this pressurizer.

* »> V Area Inspection (Step 18) ;;; 18. The algorithm checks whether the "process agent" is at or above the maximum numeric value (1600 psig for 0 - {'' '35 for 1600 psig sensors, 2500 psig for 1500-2500 psig, sensors, 4000 psig for 0-4000 psigtn sensors) or at or below the lowest numeric value (0 93 1 Q 8 81 6 psig for 0-1600 psig and 0-4000 psig sensors, 1500 psig for 1500-2500 psig sensors).

Yes, the message is "out of range" along with the "process agent" signal. The CRT screen displays 5 multiplication characters (*) above the "process agent". Let's go to step 1 and repeat the algorithm.

No, let's go to step 1 and repeat the algorithm.

NB:

The "out of range" message tells the operator that the 10 actual process breaks may be below or above the sensor measurement range.

Claims (6)

1. Console in a control complex for a nuclear power plant, characterized in that the console consists of several panels and each panel. . includes: a substantially vertical vertical upper portion for mounting monitor and display apparatus, and a transverse, substantially lower vertical portion of the "· j". 20 portion for mounting control terminals; • · ··· a relatively large first screen connection device, placed • · · v * substantially centrally in the upper part for displaying integrated images and text information regarding monitoring and control of the power plant; A plurality of mutually equal Large, relatively smaller screen connection devices of a different type, located on either side of the first Large Screen Connector, whereby the eating device. one of screen type devices of another type is configured to, ···, display images of alarm panels and at least another of 30 screen type devices of another type is set up to display images of process variable indicators; an alarm processor, comprising means for producing images of the alarm panels of a different type of connection apparatus and programmable alarm logic means for activating alarms when a predetermined relationship between alarm signals arises; An indication processor, comprising means for producing images of process indicator instrumentation to a different type of connection apparatus and programmable indicator logic means is calculated to calculate process parameter values in response to inputs from the process sensors. 10 A method of mounting a multi-panel computer controlled console, in which several main functions of the power plant are performed, in the control room of a nuclear power plant, where at least two of the panels are power plant algorithms for processing the power plant's operating parameters and a separate indicator, alarm and control system. , characterized in that, in user interfaces connected to respective two main functions of the power plant, steps include: \: (a) mounting in the control room two general panels, in which,. each includes a general appliance unit and a general program unit, which has general parameter process algorithms, which together determine the user interface for each of the aforementioned two main functions of the power plant; (b) testing the general panels with test parameters to confirm the interaction between the general system unit and the general program unit; (C) outside the control room, parallel to at least one of the steps (a) and (b), a program-specific program unit with power plant-related parameter process algorithms is generated; (d) following steps (b) and (c), the power plant-related: integrates the program whole into the general control room panels to determine the final panels; and 98108816 (e) the final panels are tested to determine the interaction between the general plant unit and the power plant-specific program unit, which together produce a power-to-individual user interface. 5 Method according to claim 2, characterized in that in the general installation unit substantially vertical wall members with openings are included, and in step (a), the mounting of the display apparatus in each opening and the combination of the computer system with the display processing apparatus and vision apparatus are included. of digital data in display devices. The method according to claim 3, characterized in that in step (b), image generation interacts with said screen image means in response to changes in the test parameters. 5. A method according to claim 3, characterized in that step 15 (a) is preceded by a step in which an equal number of equal said openings is made in each panel. . . Method according to claim 5, characterized in that in the alarm system interfaces the display of several alarm panels and in the indicator system interfaces include the display of several function parameters and in the integration stage ( d) includes the use of panes intended for displaying alarm panels in the power plant-related alarm system ♦ * · in wall openings equal to the openings, in which there are boxes intended for displaying the function parameter values in the '25 power plant-related indicator system. I »·