FI108817B - An alarm system of a control complex for a nuclear power plant - Google Patents

Description

108817 o Nuclear Power Plant Control Alarm System

The present invention relates to apparatus and methods for monitoring and controlling the operation of commercial nuclear power plants.

Conventional commercial nuclear power plants have a central control, where the operator has equipment for collecting, detecting, reading, comparing, copying, calculating, modifying, analyzing, confirming, monitoring and / or verifying data from multiple sensors and alarms. Normally, the main operating systems of a control room are installed independently and also function independently. Such systems include 15 controls that control parts and processes of the power plant, and control that deliberately modifies or adjusts parts or processes, and security that identifies and threatens immediate corrective action to the safety of the plant.

20 Such a conventional control room arrangement and operation: sometimes the operator may be exposed to too much information or stimulation. Ts. the amount of information, as well as the large amount and complexity of the operator's available equipment based on such information, can exceed the cognitive limits of the operator and thus cause errors.

The most famous example of the inability of operators, especially in unexpected or unusual power plant phenomena ·: 30 huge amounts of information entering the control room and acting on it v is the accident at the Three Mile Island Nuclear Power Plant in 1978. Since this event, the industry, ··. has paid particular attention to improving the operation of power stations by improving the performance of the control room operator. 35 A key factor in this development process is the design principles that adapt work to people.

2 108817

Advances in computer technology since 1978 have given nuclear engineers and control room designers the ability to display more information in more than 5 different ways, but the effect can be counterproductive because too much information is part of the problem. Adding "user friendliness" while maintaining the amount and type of information available to the operator has created a difficult technical problem.

Therefore, it is an object of the present invention to provide an apparatus and method for nuclear power plant control and monitoring functions, which include compact data processing and presentation, reliable architecture and hardware, and easy maintenance of components while eliminating excessive information to the operator. This is achieved in combination with improved control room reliability, ease of use and lower overall cost.

The present invention solves this problem with a number of features that are new, both independently and together. connected when they form a control room complex.

The complex has six main systems: (1) central control panel! 25 lit, (2) data processing system (DPS), (3) detector detector ·; ·; and Alarm System (DIAS), (4) Component Control Systems • consisting of Protective Component Controllers (ESFC) and Process Component Controllers (PCC), (5) Power Plant Safety System (PPS) and (6) Power Control System (PCS). These six systems collect power plant information, effectively deliver the required information to the operator, • perform all automated operations and allow direct control of power plant components.

•• 35 The control complex of the present invention has a · '· *: top-down, unified presentation and alarm system that supports evaluation of critical aspects of power plant safety and power generation. It guides the operator in locating the information needed for further diagnosis of important assessments. In addition, it significantly reduces the number of display devices required compared to conventional power-5 gains. The complex also reduces the amount of information the operator has to process at one time; it also reduces the impact of malfunctioning display devices. In addition, it eliminates the need for monitors that are only used in abnormal conditions at the power plant.

10

It is known that the steam system of a nuclear power plant can be kept in a safe, stable state by certain safety critical factors. The present invention extends the concept of power plant safety critical factors 15 to include power plant power critical factors so that combining these two sets of factors in the information provided to the operator supports all power and safety critical and critical factors.

The information presentation hierarchy according to the present invention has ·; ··: at the top a “main table”, i.e., a combined process space overview; . * (IPSO), which acts as a stand-alone platform for rapidly evaluating key information relevant to power plant safety and power generation. Normal or Abnormal! 25 sources and directions for changes in paint parameters are obtained; ;;; for more details on DIAS. Both IPSO and DIAS provide direct access to and guidance on system and component status information contained in the hierarchy of DPS-controlled CRT screens.

30 IPSO continually displays location-specific information that indicates the status of critical factors for power plant safety and power generation. This information is presented ;;; a few easy-to-understand symbols that are the result of '--- 35 sophisticated information. Therefore, the operator! '· * Does not need to combine large amounts of individual parameter information, system or component status information and alarms 4 108817 to find out the operational status of the power plant. IPSO presents to the operator the high-level effects of low-level component problems. The format of the IPSO key data is primarily based on the direction of the parameter change, i.e. higher / lower, and the shape and color of the alarm symbol. These are supplemented with the values of the selected parameters.

The IPSO provides aggregated and simplified information to the operator in small amounts and in a form that is easy to perceive and understand.

10

In addition, IPSO eliminates the drawbacks of current industry-wide presentation of all data on CRT displays by giving the operator the ability to get an overall view or "feel" of the plant's status, while the general presentation of the 15 plants on a large, dedicated display brings two other aspects. First, the operator's tasks often require detailed diagnoses in very limited process areas, but it is necessary to keep track of the operation of the entire power plant at the same time, rather than having several operators control similar indicators in the control room with panels: IPSO can be seen anywhere in the control room Provides the operator with continuous information on the overall operation of the power plant, »» *: *. *, which may require most of his attention.

»» · * * T 'In a preferred embodiment, the IPSO supports the evaluation of critical factors in power generation and safety by providing for each factor key space parameters. For each factor, paths * are selected based on the status of the path shown. IPSO clearly links the factors to the physical reality of the power plant. Critical factors apply to power generation, normal reactor trips, and optimum recovery methods.

': ^ 5 • \ The second level of the data presentation hierarchy of the present invention is the presentation of power alerts from the DIAS. A limited number of fixed, discrete tiles with three different alert priority levels are used herein. Dynamic Alarm Handling utilizes power plant status information (eg reactor power, reactor trip, fuel change, shutdown 5, etc.) as well as system and equipment status to eliminate unnecessary and redundant alarms that could contribute to excessive operator exposure. The alarm system provides easy-to-understand guidance on additional information contained in separate detectors, 10 CRT displays and controls. The alarms are based on validated data, so the alarms tell you about the actual process problems at the power plant, not about instrument or control system failures.

15 Alarm features include a detailed message to the operator through the window when an alarm is acknowledged and the ability to combine alarms without losing individual messages. Alarm panels can dynamically display different priorities to the operator. The acknowledgment method 20 ensures that all alarms are acknowledged, but at the same time reduces: · the operator's task load by first emitting a short beep followed by a continuous alarm followed by a reminder, · ': to ensure that the alarm has not been forgotten. The operator may temporarily interrupt the alarm flicker, to prevent visual overload, and reset .J! flicker to ensure that the alarm is eventually reset.

The DIAS detectors constitute the third display level of the hierarchy of the present invention. Plane panel displays 30 compress a plurality of signal sources into a limited set of readings that regularly monitor power plant key information. Verification of signals and automatic selection of the most accurate detectors in the signal range are used to reduce the number of detectors on the control panels. Data readings' .'35 are obtained from the touch screen for improved operator interaction, and include numerical parameter values, a bar-based analog display, and a point graph.

I 6 108817

Multiple range sensors are available on a single screen with automatic sensor and display area selection. The automatic calculation of the parameter value of the correct process representation, together with a plurality of single sensor readings available on the same display, reduces the need for separate additional displays or the need to keep different displays for normal operation and an accident or subsequent situation.

10

A further advantage of the present invention is that the parameter check automatically detects a faulty sensor or a plurality of faulty sensors, while allowing continuous operation and accident mitigation information to arrive to the operator even if a CRT display is not available. Further, normal display information may be attached to an approved sensor, such as may be used, for example, for monitoring purposes following an accident.

At the information display level associated with the control of certain components, there are dynamic "soft" controllers that contain component state information and control signal information that the operator needs to control these components. In the ESFC system, this information includes a status light, on -.:. 25 / off switches, modulation switches, on / off switches and logic controllers. In the PCCS, this information includes load, setpoints, operating range, process values, and output of control signals.

The dynamic CRT monitor pages on the fourth level of the data hierarchy complement all locally specific controllers and information and can be accessed from any CRT monitor in a control room, technical support center, or alert state. These displays are organized into a three-level hierarchy that includes “/ 35 monitoring” (level 1), power plant components and: ”, · system control (level 2) and component / process diagnosis (level 3). The implementation of the displays is controlled by DPS, and it doubles 7108817 to duplicate and ensure all processing of individual alarms and detectors on the DIAS.

In a preferred embodiment of the present invention, the detection, alarm and control functions associated with a particular major area of operation of the power plant 5 are grouped into a single modular panel. Cuts can be made to the panel, with positions that determine the position of the detectors, alarms, controls, and CRT, regardless of the power plant's operating system. This allows 10 panels to be delivered, installed, and pre-tested before power plant-specific logic and algorithms are finalized, which can be programmatically modified at a later stage of the power plant construction schedule. Such a block structure can be achieved because the space required by the panel is essentially independent of the main system of operation of the power plant.

Both alarms and detectors can be easily modified by software. The area available for the panel does not significantly limit the number of alarm and detector panels that can be displayed to the operator, so standardization of panel size and intersection for display windows is possible.

The foregoing and other objects and advantages of the present invention will be described in connection with the preferred embodiment with reference to the accompanying drawings.

Figure 1 is a view of a nuclear power plant control unit according to the present invention.

Figures 2 (a) and 2 (b) together define a schematic representation of the system internal communication related to the invention.

Figures 3 (a) and 3 (b) show a first type and Figures 3 (c) and 3 (d) show a second type of modular panel, according to an aspect of the invention.

FIG. 4 shows a primary system display page directory on a CRT display according to the invention.

8 108817

Figures 5 and 6 show preferred component symbols and shape codes used in accordance with the invention on CRT and IPSO displays.

Figure 7 is a typical detector display with graph 5 according to the invention for pressure and level of the pressurizer.

Figure 8 is an indicator display associated with the detector of Figure 7 for a system pressure and level menu page.

Fig. 9 is a schematic representation of the manner in which alarms are presented in accordance with the present invention.

Fig. 10 is a typical display page according to the present invention showing an alarm in a menu option of a first level display page.

Fig. 11 is a schematic summary of the workstations of the complex 15 shown in Fig. 1, which are classified in a first level display page group.

Fig. 12 illustrates a typical display page directory which displays display pages containing alarm information.

Figure 13 illustrates information supporting an alarm on a CRT after the alarm has been acknowledged.

Figure 14 shows the CRT display used by the operator: · a classified alarm list.

Figure 15 is a typical alarm slab combination with reactor cooling system and sealed alarm slabs associated with individual detector and alarm systems.

* · '·. Fig. 16 shows a reactor coolant pump alarm panel display with one panel activated.

Fig. 17 shows the alarm display of Fig. 16 after acknowledgment of an activated alarm.

Fig. 18 illustrates an alarm display which is displayed by the operator by touching the alarm status information area shown in Fig. 17.

. · Figure 19 shows a CRT display of a primary system.

Figure 20 shows a second level page CRT display based on "'.35 of the first level page shown in Figure 19.

Figure 21 shows a third level display page obtained from the second level page shown in Figure 20.

9 108817

Figure 22 illustrates and explains menu selection ranges for CRT display screens.

Figure 23 illustrates a typical CRT display page corresponding to alarm plaque presentations.

Fig. 24 is a diagram showing a hierarchy of CRT display pages kiasuhteet.

Figure 25 illustrates an Integrated Process State Display (IPSO). Figure 26 is a schematic representation of symbols illustrating directional information for IPSO parameters.

Figure 27 is a schematic representation of the integrated data representation of the present invention.

Fig. 28 is a block diagram associated with Fig. 2 illustrating the relationships between the main control room systems of the present invention.

Fig. 29 is a block diagram showing the inputs and outputs associated with the detector and alarm systems of the present invention.

Fig. 30 is a schematic representation of the use of checked sensor data for monitoring and controlling according to the present invention.

Fig. 31 is a functional diagram of a technical security system and a component control system, preferably having connections according to the present invention.

: * · * · Figure 32 illustrates a typical display page directory associated with: - 25 critical factors control made possible by the data processing system of the present invention. Figure 33 shows a first level critical factor screen associated with the hierarchy shown in Figure 32.

Figure 34 shows a first level critical factor screen after visiting the reactor.

Figure 35 illustrates a typical second level critical factor v display page associated with an inventory control system.

. Figures 36 (a) and 36 (b) are schematic representations of a typical, ···. the prior art instrumentation and • 35 control design process, and accelerated design! . from the process possible using the modular panels of the present invention 108817, respectively.

Figure 37 shows a separate hot and cold primary loop temperature indicator display showing all sensors used in the counting algorithm.

Figure 38 is a summary of the types of sensors used to determine the pressure of the pressurizer and the way they are used to determine the pressure value representative.

10 I. Overview of the Control Complex II. Panel Overview A. Alarm and Messages B. Detector

C. CRT

! 15 D. Controller E. Display Models F. Display Assembly

III. DIAS

A. Discrete Detectors 20 B. Actual Algorithm Adder '· C. Alarm Processing and Display 1. Status and Device Dependency '2. Sub Functionality Group:'. 3. Shape and Color Coding • j 25 4. CRT Alarms • 1 · · 5. Define Alarm Mode 6. Alarm Confirmation

IV. DPS

A. CRT

30 B. IPSO

· 1: V. Supervisory entity v VI. Modularity of the panel. APPENDIX (Decision Algorithm) 135 Figure 1 shows a control panel complex according to a preferred embodiment of the present invention: · '. At the core of the main control room 10 is the main control console 12, which allows one person to operate the steam system of the nuclear power plant from a hot shutdown to a full power production mode. It should be noted that the control room described herein and its apparatus and methods may be used in connection with light water reactors, heavy water reactors, hot gas cooled reactors, liquid metal reactors and advanced passive light water reactors, but for practical reasons this description is based on N

10 The main control console 12 of such an NSSS typically has five panels, one for each of the following system components: a reactor cooling system (RCS) 14, a chemical control system (CVCS) 16, a nuclear reactor core 18, a feedwater and sealing system (FWCS) 20 and a turbine system 22. 15 will be described in more detail later, the monitoring and control of these five power plant systems will be handled by the respective panel of the main control console.

Immediately behind and above the reactor core control and control panel 20 is a large table or display 24 showing a composite process status overview (IPSO). Because of this, the operator can easily see five panels and the IPSO board: * "* while sitting or standing in the center of the main console.

<I «* · • · 25 On the left side of the main control console is a security-related console 26, which typically includes modules related to safety monitoring, technical security, cooling water, and related functions. On the right side of the main control console is an external system console 28, which includes modules related to the secondary circuit, the auxiliary power supply and the diesel generator, the switching field and the heating and ventilation systems.

• I

I ·

I I

It is recommended that the power station computer 30 '' '35 and the mass storage devices 32 associated with the control room be located in separate compartments 31 for improved fire safety and sabotage protection.

12 108817

The control room complex 10 also includes a supervisor office 34 with full view of the control room, a technical support center (TSC) 36 and an out-of-control observation level, and 5 external offices 38, which can handle power station-related paperwork. The furniture of the control room shall be placed as appropriate for the operations of the operators. There is also a remote fire extinguishing room 42 (Figure 2) for post-accident monitoring (PAM).

10

Figure 2 is a schematic representation of the links between power plant components and sensors, which are considered conventional herein, and panels of the main control room. From Figure 2, it is clear that the information flows in both directions through the dashed line 46, which 15 represents the boundary between the steam system of the power plant and the turbine system. The NSSS status information and sensor information 48 used in the power plant security system 50 and PAMS 58 passes directly through the NSSS boundary 46. The control signals 52 from the power control system pass directly through the NSSS boundary. The other control-system 20 signals 60, 62, which originate from the technical safety: 'device control system 56 and the normal process M. component control system 64, are connected to the NSSS boundary: through remote multiplexers 6. Power plant security system, ESF-' · * , the process component control system, the power control system and the PAMs are connected to the master ·. * vom 42, to each other, to the data processing system (DPS) 70 and to the · · detector and alarm system (DIAS) 72.

Figure 2 illustrates a significant feature of the present invention, which is the combination of control, control, and safety information under both normal and accident conditions, so that the operator has the appropriate operating mode. setup is greatly facilitated. The following sections describe in more detail how this was achieved.

II. Panel overview

1 I

•• 35 13 108817

Figures 3 (a) and 3 (b) show diagrams of a standing / sitting panel, such as a reactor cooling system panel 14 located in the main control console 12 according to one embodiment of the present invention. Figures 3 (c) and 3 (d) illustrate an alternative embodiment, whose panel is only used when standing. The substantially flat top or wall 74 of the panel is positioned upright and the substantially flat bottom or table is substantially horizontal. The control and alarm connections are at the top and the control connections are at the bottom 10.

A. Emergency Messages The alarm functionality (see Figures 9, 15-18) includes an alarm-15 and a message interface (A&M) 78 with a plurality of tiles 80 each bearing a specific letter word, an acronym or equivalent reference 81. The alarm status is indicated by tile illumination and a beep. The operator must acknowledge the alarm either by pressing a plate or by any other method designed for this purpose. The number of tiles in a given panel 'depends on the number of different alarm conditions that may be generated by the system being monitored, i.e. the cooling system. Typically, each panel has hundreds of Γ '| such tiles. The alarm is categorized into three (3) • 25 alarm categories (Priority 1, Priority 2, Priority I 1 1 1. The alarms on this RCS panel depend on the state of the equipment (Normal RCS, Heating / Cooling, Cold Shutdown / Fuel Change and Reactor 30 trip). If a high priority alarm activates a low priority alarm related to the same »t> - ·: parameter, the lower priority alarm automatically disappears. When conditions • »; improve, the higher priority alarm starts flashing and

I I I

.1 '· a beep sounds. The operator acknowledges the exit of the high priority ti '135 alarm. If the lower priority alarm is I 1; · Still exists, its alarm window or indicator goes into f f 1 · 14 108817 acknowledged state when the operator acknowledges the exit of the higher priority alarm.

B. Indicator 5

The second monitoring interface consists of process variable indicators, such as reactor coolant temperature, pressure ice level and pressure, and other RCS parameters. Separate detectors 82 (see also Figures 7 and 8) provide a better method for presenting the parameters of the RCS panel 10. Some RCS panel parameters require a constantly updated display and graph for the master control console. Power plant process and class 1 parameters such as pressure level and RCS coolant temperature fall into this class. Other RCS panel parameters are used less frequently. The operational parameters are obtained from the detectors 82 if the data processing system (CRT displays) is not available. These include the Class 1 and 2 parameters of Regulation 1.97 (Regulatory Guide), Priority 1 and 2 alarms, and other 20 operational critical parameters that are locally unavailable and subject to operator control when the data processing system is disabled for up to twenty-four (24) hours. These less frequently monitored parameters are available in separate detectors, which are displayed by the operator by selecting the appropriate menu. The menu displays the available information in alphabetical order. No separate indicators are required for the parameters displayed in the process controllers.

C. CRT 30

In addition, the CRT display 84 provides a view of the main vessels, pipes, pumps, valves, etc., associated with the reactor cooling system, for example, and displays alarms and values of parameters that may appear as bar, graph,: ... · 35 graphs or otherwise. with other displays 78, 82 (see Figures 4-6, 10, 12-14 and 19-23). From this CRT screen, all NSSS information is available to the operator. This information is presented as a 15 108817 three-level hierarchy that is consistent with the operator's perception of the system. Figure 4 shows the primary page of the NSSS page directory 84, which contains all CRT pages of functions associated with the RCS panel.

5 D. Controller

The control portion 76 of panel 14 has a plurality of separate on / off switches on the left side. Each switch pattern 10 is associated with a particular reactor cooling pump, the supply parameters of which are immediately above. It also has analog controls, which can be conventional rotary knobs or the like (not shown), or a touch screen or 88 controlled single control.

15 The RCS has process controls to enable the operator to control the process control loops manually or automatically. Process controllers allow control of throttle or multi-position controls (eg, electro-pneumatic valves) from a single control panel. Process controls are used to: ·: control the following RCS process variables in a closed loop: pressure level, pressurizer pressure, RCT seal flow, and RCT seal temperature. Process controllers are designed for each control loop individually, using a uniform set of 25 display groups and control features.

In a conventional control room, each process control loop has its own control device, commonly referred to as the MA-NUAL / AUTO station. For example, the RCP sealing area system has 30 five process control loops: one seal flow control - .. j: * loop for each of the four RCPs and the seal temperature: control loop for the entire subsystem. Each of these five control loops has its own MANUAL / AUTO station, which occupy a large space on the control panel and make comparisons between the loops 35 awkward. Although these five process loops are independently controlled, process changes in one wizard affect the other four parameters. In conventional MANUAL / AUTO 16 108817 stations, it is difficult for the operator to operate simultaneously with all five MANUAL / AUTO stations.

The process controllers for similar processes (which are related to either the action pins or the system) are used by the RCS panel process controllers from a single control station called a process controller. Such a single controller saves panel space, utilizes appropriate cross-channel checking, and allows for easier interactions between the process loops of several interrelated processes.

Component control capabilities (i.e., activation of switch controllers) are the primary method by which the operator activates devices and systems from the RCS panel. The RCS panel has 15 forty-three components controlled by instantaneous switches. Each switch has a red status indicator for active or open mode and a green status indicator for passive or closed mode. Blue status indicators / switches are used to detect and select 20 autopilot or process controller control. "" I In addition to color coding, the red switch is always set above the green switch to enhance color separation. Each: "* · switch generates an active control signal when pressed, and each switch is inactive when not pressed. Each.:. Switch has a backlight to indicate device status.

'»♦.

E. Dummy Models

Process display templates are used to map data for similar processes and devices. Fluid systems representations are always standardized wherever possible: top to bottom, left to right, while avoiding junctions. Incoming V and outgoing flow paths are set to margins. Together I! related information is grouped according to a task and analysis specification for comparison, operating order, operation and frequency. Process representations / formats are based on the operator's perception of the process, 1 0881 7 17 f to maximize the power of his data collection functions. The operator's image of the system is often based on the schematics used in the training material and power plant design documentation related to the system descriptions.

5 Graphical information is represented by display page templates, which facilitates rapid perception of processes. Graphical information consists of the use of columns, flow charts and graphs (eg over time, or pressure versus temperature).

10 Bar charts are primarily used to represent flows, pressures and levels. As the plane is associated with the container, the bar graph is placed at the appropriate position within the container symbol. Plane bar graphs are vertical. If a bar-15 ramp is used to represent the flow, it is placed horizontally. Bar charts also facilitate comparison of numerical quantities.

Flowcharts are used when they can enhance the operator's image of the process. Flowcharts facilitate understanding of control systems such as turbine control systems. where from. Operator training material related to process control systems is often in the form of a flowchart and therefore a similar display page design is easy to perceive.

: \: 25 Time graphs are used on screen pages when task analysis indicates that the operator needs to know the parameter changes over time. In addition, the operator can create time plots from any location on the power plant computer database. In some cases, task analysis may indicate that multiple time descriptors are needed to monitor process comparisons. In some situations, e.g., heating / cooling curves, two parameters can be set for different ordinate axes of the graph.

35 If there are multiple time plots on the same coordinate axis, two vertical axes can be used for parameters with different units. The scale markings can be set in 1, 2, 5 or 10 18 108817 increments. Smaller marks between scale marks can also be set in 1, 2 5 or 10 increments. The time-varying parameter is typically displayed on the screen every 30 minutes. However, the operator door adjusts the scales according to your needs 5. Logarithmic scales can be constructed using ten multiples. If the total range of the parameter is less than 10, place a punctuation mark near the center of the scale.

Time graphs in the same coordinate system use different 10 colors. If multiple curves use the same scale, the scale is gray and the curves are color coded. If different scales are used for coordinate axes, they are coded with the same colors as the corresponding curves. Time graphs do not use alarm colors or normal mode colors to avoid mixing 15 process parameters with the alarm or normal conditions.

The colors help the operator to differentiate between different types of information. Because the benefits of color coding are clearer when used with fewer colors, the color coding of information displays (i.e., IPSO, CRTs, alarm panels) is limited to seven colors. In addition, color-coded data has other features that make it easier to distinguish between data and work with low-color observers.

,;. 2 5

The following colors are used in information screens to represent the following types of information. The colors have been carefully selected so that red / green colored persons can see a sufficiently large difference between the colors.

30 .. Black Background Color v Green Component Off / Inactive, Valve. * · * Li closed and works

Red Component On / Activated, 35 Valves Open and Operated • V Yellow Alarm Mode - Color Of Attention: High 19 108817

Gray Text, marking, dividing line, menu option, tube, inaccessible and non-instrumented valve, graph scale, and 5 other non-coding applications.

Light blue Values for process parameters

White System response to operator touch, eg menu option, 10 until system responds as expected.

The shape coding is used in the information system to help the operator identify the component type, the functional state and the 15 alarm state. Component shape coding is based on symbol research, which included queries directed at nuclear power plant personnel. Figures 5 and 6 show the forms used to represent components in a control room. The shape property, hollow / full, indicates the state of the component. The hollow shape code indicates that the 20 components are active while the filled shape code represents the passive component. The following is an example of the shape coding of the pump and the valve.

'. * Pump A hollow pump indicates that the pump has been activated by an operator or an automatic control signal. A full pump indicates that the pump has been shut down by the operator or the automatic control signal.

Valve A hollow valve indicates that the valve is fully open and a full valve indicates valve 30 is fully closed. A valve that is not fully open or closed t has a fixed and *. · Hollow intermediate shape, ie the left side is full and,. * right edge hollow.

· '35 The following features have been added to the shape coding of valves:

Valve open and available - Red color code.

1Q8817 20

Valve Closed and Available - Green color code. To Instrument Valve - Gray Color Code (Operator-Entered Position).

Valve Not Available - Gray color code with 5 alarm codes.

Absence of indicator - Gray color code with alarm code and combined hollow / full shape.

F. Netting package 10

Safety-related information is integrated into control room information to enable the operator to use safety-related information wherever possible during normal operation. For human factors, this is a better method because in stressful situations people tend to use the information that is most familiar to them.

In many situations, the security-related parameters are only a subset of the parameters that control a particular process variable. Existing control room operators typically only use control indicators during process control, and * · «« they must use separate safety-related indicators when monitoring plant safety aspects. In the present invention, typically, the parameters used for monitoring and control: * '25 are compared for safety purposes, if any, with safety parameters. If the parameter deviates from the * * n safety parameter beyond the expected values, the operator will receive an alarm to confirm. In response to such an alarm situation, the operator may view the individual channels associated with the parameter 30 on a diagnostic CRT page, or with a separate indicator displaying the parameter. Operations i · · ;;; a notification is received when the validation algorithm is able to verify the information. The result of the validation algorithms is used in IPSO,; ; * in the detector normally displayed and on the higher level display pages of the CRT display system containing parameter-35. Class 1 information in regulation 1.97 is also shown on 21 108817 with a separate indicator display in one location on the security control panel.

Critical function and action path (availability and action) information is available throughout the data hierarchy (see Figures 10, 24, 25, 26, 27, 32-35). Priority 1 alarms indicate to the operator the inability to maintain a critical function or the inability of the operating path to meet the minimum functional requirements. The lower priority alarms indicate the failure or malfunction of subsystems and components.

15 In the Critical Functions Matrix, IPSO provides general information that is most useful to the operator in evaluating critical functions. Priority 1 alarms related to critical functions or paths are displayed in the IPSO critical function matrix. The support information associated with these alarm conditions is obtained from the alarm panels or the critical functions area of the CRT display hierarchy. The critical functions area of the display page hierarchy contains the following information. Level 1 Screen - "Critical Functions": This page provides more detailed information about the critical function matrix presented by IPSON 25. Specifically, *, · Details of alarm conditions (ID, Priority). This guides the operator to the right of the level two critical functions screen.

Each of the 12 critical functions has its own second level page. Each page contains: • i · v - The first one associated with the critical function

»I

. , * Critical function information for the level screen.

Functional path availability and operation of critical 35 functional paths! related information.

> »22 108817

High-level information presented in a way that describes a critical function / path. Time plot of parameter 5 of the more representative critical function.

The third-level screen in the Critical Functions hierarchy are copies of screen pages elsewhere in the hierarchy. For example, the security spray display page 10 under the warehouse control is also in the primary area of the display page hierarchy.

III. SEPARATE DETECTOR AND ALARM SYSTEM A. Separate Detectors 15 Separate detectors 82 provide a better method for presenting security-related parameters. The most important process-process parameters, such as Class 1 of Instruction Manual 1.97, require a constantly updated display and time descriptor on the Master Control Sol. Separate detectors also handle the detection and alarms required for operation 20 when a data processing system (DPS) is unavailable. These parameters include Class 1, 2 and 3 parameters in Regulation 1.97, Priority 1 and 2 alarms, and other parameters that are constantly monitored. Although DPS is a very reliable and * ·. * 25-fold computer system, you must be prepared for a 24-hour downtime. Parameters that are less frequently monitored are obtained from detectors via the operator selectable menu.

Each detector can display a number of parameters related to a component, system or process. Special eye; (· There are different display models for the corners, based on the operator's specific information needs.

35 When controlled or controlled, for example, by a pressurizer; . process, it is desirable for the operator to use the "process representative" most accurate value 90 in field 92. For this type of 23 108817 information, the detector 82, as shown in Figures 7 and 8, displays a bold digital value and analog bar chart 94 based on the . A preferred gain technique 5 is described in the appendix and the actual state is indicated in field 96. This verified value is compared to the Post-Accident Monitoring Detector (PAMI) sensors, if available. The detector can also be used for post-accident monitoring if this is compatible with PAMI as indicated in field 106. 10 The advantage of this is that the operator can continue to use the detector he is most familiar with and used daily. The operator may, if desired, monitor any independent channel on the digital display of the detector by touching an individualization sensor, e.g., 102. The use of audited parameters-15 is beneficial to operators as it reduces their stimulus and task load resulting from displaying multiple detector channels.

20 If the parameter cannot be checked, the detector will display the reading of the sensor closest to the last value checked. In such a situation, an inspection alert will be given. The detector still displays the value of this sensor until the operator selects another value for the detector. Separate Detector .: 25 field 96, which usually reads "VALID", displays the inverse "FAULT SEL" text, in which case the value is not checked but selected by the computer, which means that the operator should determine the available sensors that can be used " If the operator 30 selects a sensor (which is allowed when a check error occurs or the "VALID" signal does not conform to PAMI), the content of the field containing the "FAULT SEL" text will be replaced by the inverse "OPERATOR SELECT". When the check algorithm is able to check the data and all faults have been cleared,: ': 35 The check error alarm is cleared and the algorithm changes to "CALCULATED SIGNAL" of "PROCESS REPRESENTATION" produced by "FAULT SELECT" or "OPERATOR SELECT" field 92.

24 10881 7

Separate detectors also display the parameters needed to monitor overall power plant processes or priority 1 and 2 alarms. Normally, the most descriptive process parameter 5 is displayed. Menu options allow the operator to view other process related parameters.

The RCS panel is equipped with ten detectors. These are:

10 1. RCP IA

2. RCP IB

3. RCP 2A

4. RCP 2B

5. RCP SealBleed (seal leak)

15 6. RCS

7 * Thot 8 * Tcold 9. Presser Pressure 10. Presser Level 20

Figure 7 shows that two interconnected detectors may be represented by a single display 82. The left half of display 82 shows the checked pressure of the pressurizer. The pressure display has the following: digital "process representative" .25 value with 90 units (2254 psig), display quality 96 (VALID), notification 98 that the display is valid for post-accident monitoring (PAMI), process value as bar graph 94, 30 minute time graph 104, normal operation area (NORMAL) 106, instruction area (1500-2000) and bar graph unit 30 (psig).

In the upper right corner of the PRESS screen, there are two buttons, "CRT" and "MENU," which touch the selected button to indicate the selection. When the operator releases his hand from the button, • '35 the selection is processed. The CRT button 84 changes the menu options of the CRT display placed in the same panel as the separate indicator when the button is pressed, e.g., the RCS panel 14 as shown in s 108817 25 in Figure 3. The CRT button searches the CRT display pages that best match separate indicator parameters.

The MENU button selects the detector menu (Figure 8).

5 The top of the menu page is usually similar to a normal screen. It includes a digital "process representation" value of 90 units (2254 psig), a display quality (VALID) indication that the display is suitable for post-accident monitoring (PAMI), and the CRT and MENU buttons.

10

At the bottom of the menu page are selection buttons, such as 102, for all sensor inputs and "computational signals" of this detector. Selection buttons light up when pressed to indicate selection. When the operator releases his finger 15, the selection is processed. There are 13 buttons for pressure: four for a pressure of 0-1600 psig: P-103, P-104, P-105 and P-106; six pressurizers for 1500 to 2500 psig: P-101A, P-101B, P-101C and P-101D, P-100X and P-100Y; two for RCS pressure of 0-4000 psig: P-1090A and P-109B; and one "calculated 20 signal" for pressure: CALC PRESS. When the "Calc Press" ·: · button is selected, the pressure corresponding to the "calculated signal" (ie.

: algorithm output). The "calculated signal" of the algorithm can be a "valid" signal. If the algorithm failed and selected a single sensor as "calculated signal", the "valid" message '25 would be replaced by a 'fault select' message. This 'fault select' message would appear as inverse text in the detector. This message would appear in the detector whenever " CALC PRESS "is selected until the algorithm provides a" checked signal "to replace the value of the" FAULT SELECT "sensor.

30

To change the display, the operator touches the button that contains the sensor he wants. For example, "P-103": Touching a button labeled 1-Va will display the P-103 within the range 0-1600 psig on the digital display. Digitize -:. 35 value below the message "VALID" becomes "P-103".

• Additionally, the "PAMI" message is cleared because the P-103 is not a PAMI sensor.

26 108817

The "ANAL / ALARM OPER SEL" button selects the signal that the DIAS uses as "process agent". It sets the current sensor on the digital display to be selected. The signal select button 5 allows the operator to "select operator" any sensor for analog display and alarm processing if, for example, the following error is present: 1. If the check fails and a "fault select" sensor is selected as "process representative" 10.

2. If the "checked" reading does not match the PAMI detector (s).

If the fault is present and the operator wants to select the P-103 as a "process agent", he selects this menu, selects the P-103 on the display and then touches the "ANAL / ALARM OPER SEL" button. The message underneath the digital display in field 96 changes to "P-103 OP SEL". Whenever the P-103 is selected for display, it has the reverse message "OP SEL", which indicates that the P-103 reading is used as a "process representative". After setting the sensor as "process agent" by "operator selection", the operator is expected to press a button labeled "ANALOG DISPLAY". This returns to the analog display 94 of the transducer selected by the operator and to the scaled display 107 (Fig. 7) of the timeout .25 together with the "OPER SEL" message printed in inverse text.

There is usually no "ANAL / -ALARM OPER SEL" button on the detector menu pages; it will be displayed automatically when 30 "carrier selection" is possible after a fault. The "ANAL / ALARM. OPER SEL" button exits the menu page when the "Operator Variable" is disabled after all faults have been cleared.

The "ANALOG DISPLAY" button removes the menu page and replaces it with: 1 "; 35 of any sensor or" calculated signal "(usually" valid "" calcu "108817 lated signal): n) a bar chart (analog) and a time plot.

The other detectors 5 of the process parameters to be checked operate in the same way.

Menu-guided detectors include all level 1 and level 2 displays in the detection function groups.

.. 10 B. Active Weightlifting Adder

A generic verification algorithm is used to reduce operator workload and stimulus volume. The algorithm takes the readings of all sensors that measure the same parameter and produces a single output that represents that particular parameter. parameter and is called a "process agent". Generic verification is used because it is well understood by operators. Therefore, the operator does not need to ask where each parameter value checked originates from.

20

The generic algorithm calculates the average of all sensors [(A, B, C, and D): \ · (number of sensors can be parameter-specific)] and checks the deviation of all sensors from the mean. If:.,. Deviations are acceptable, the mean is used as a "process. If all sensors T! do not pass the mean deviation test, the most abnormal sensor is removed and the average of the remaining sensors is calculated. When all the sensors used in the mean calculation pass the mean deviation test, an average of 30 is used as "audited process representative". The deviation of the "verified process agent" from the sensors of the post-accident monitoring system (if any) is then determined. If this second deviation check is passed, this "process agent" will be printed along with the message "Valid ·; · .35 PAMI". This means that the signal can be • '. used for emergency monitoring because it is within the value specified by the PAMI sensors. As long as this consistency i 28 108817 is maintained, this detector can be used for post-accident monitoring instead of the special PAMI detector. This brings with it the benefit of the human factor, as the operator can utilize the il-5 device that he is familiar with on a daily basis.

The validation process described below shortens the time it takes for an operator to perform tasks related to key process parameters. In order to keep the data up to date, all readings to be checked are recalculated at least every second. In addition, the computing equipment has been multiplied and distributed to increase reliability.

The following section describes the algorithm and process processing of the DIAS and CRT displays.

1. "Process Agent" is always displayed on the appropriate DIAS screen and / or CRT page (s) when a single "Process Agent" is required instead of multiple sensor values 20. Each process parameter in the power plant is evaluated individually to determine the required display type and its location (DIAS and CRT or CRT only).

2. A "process agent" is always a "checked" value unless it is: .25 a. A "fault selection" value.

b. The value of "carrier selection".

: 3. "Process Agent" is always used for alarm calculations and time graphs (when a normal time graph has a single value). This may be the value of "checked", "fault-30 selection" or "operator selection" depending on the results of the calculation algorithm described below.

4. The operator can view any value (A, B, C, D or calculated value) via the DIAS or CRT display menu without changing the "process agent".

-35 5. The "Fault Select" value is automatically displayed as "Process representation" if the valid algorithm cannot provide a "valid" value. The "Fault select" value is the value of the sensor I 10881 7 29 that is closest to the last "valid" signal before the validation fails. With DIAS (if the parameter in question is displayed there) such information is marked with a "fault select" message. On the graphical 5 pages of the CRT screen (s), such information is preceded by a multiplication sign (*) indicating suspicious information.

"Fault Select" "process representation" is automatically reset to "valid" "process representation" if 10 valid algorithms cannot compute "valid" data.

6. The sensor can only be selected as a "process agent" by "operator selection" only when: a. "Inspection error" or 15b. "PAMI error" exists.

The "process agent" selected by "operator selection" replaces the "process agent" produced by "checked" or "fault selection". In DIAS (if the parameter in question is displayed there) such information is marked with the message "operator 20 select". This is the case on the graphic pages of CRT displays. ; the information is preceded by a multiplication sign (*) and in the database it is marked with "operator select" The "process agent" generated by the "operator selection" is automatically reset to the "checked" "process agent" when i .25 both the "check error" and the "PAMI error" are cleared.

;: · Note that separate checks are performed by a generic algorithm suitable for different parameters. In this way, the operators understand how each of the parameter-30 values checked is determined, thereby enhancing their confidence. This algorithm always gives some result and it gives the operas - '!!! in the market, the ability to select the display if the inspection fails. not possible. Although detectors display all the vital information at all times, they also allow: '' .35 operator easy access to less frequently needed information through an organized menu system. Separate backup screens »* are not needed at all, since backup screens are included in the parallel data retrieval <» · 30 108817 levels. Such displays significantly reduce the number of detector slots required on the panel, while at the same time displaying all the necessary detectors in a simple form, reducing the stimulus load.

5

The enclosed Appendix, together with Figures 37 and 38, provides further details on the recommended implementation of the algorithm.

C. Alarm Processing and Display: 10 Another feature associated with each panel is the reduction in the number of alarms produced to minimize the operator information load. The interchannel signal check is performed before the alarm is generated, and the alarm logic and set points are consistent with the power plant operating mode.

Alarms are displayed with certain visual symbols j according to the priority of the response required from the operator. For example, priority 1 requires immediate action, priority 2 | requires fast action, priority 3 requires 20 vigilantes, and priority 4, or operator support, is only status information.

* 1 i *

The following are the types of alarm conditions for each category:.

• 25 Priority 1 1. Conditions that may cause reactor shutdown in less than 10 minutes.

2. Conditions that can cause serious damage to equipment.

30 3. Threat to personnel, radiation hazard.

, · 4. Critical security breach.

5. Immediate technical action is required.

6. Reactor / turbine trip.

Priority 2; \ 35 1. Conditions that may cause reactor shutdown in more than 10 minutes.

! 31 108817 2. Situations requiring technical measures not covered by Priority 1.

3. Possibility of equipment damage.

Priority 3 5 1. Sensor offsets.

2. Equipment Deviations.

3. Device / process deviations that are not critical to operation.

10 Alarms are displayed in such a way that the operator can easily determine the effect of the alarm on the safety or operation of the plant. In this technique, alarms are grouped according to the nature of the problem rather than the symptoms caused by the particular alarm situation. The fixed location of the alarm screens 15 facilitates pattern recognition. The power level overview on the IPSO screen shows possible action paths and critical functions for Priority 1 alarms.

In order to ensure that all alarms are reset without too much workload on the 20 operators, all alarms can be reset one at a time or in small functional groups. All alarms can be reset from: .i. from any control panel. Instant tones indicating the alarm status • · «• \ <t 'will be silenced without operator intervention.

25 Intermittent beeps remind you of unacknowledged • conditions. The operator can activate a power station-wide alarm », which will automatically exit after a while in order to delay the reset of the alarms.

30 In addition to alarms, a "carrier support" notification category has been developed that contains useful information

1 I

··; information, but which does not indicate abnormal deviations.

The "operator support" category includes the following situations: * ·; channel overflow situations, allowed lock-in approaches, and · · 35 device status changes.

»I

II t • t 32 108817

Some parameters have multiple alarms (eg Gasket feed temperature Hi Hi and Hi). The response required from the operator is lightened so that the lower priority alarm automatically disappears without an exit tone or 5 slow blinks when the higher priority alarm activates after the lower priority alarm. The operator acknowledges the Hi Hi alarm, so there is no need to acknowledge the deleted lower priority alarm. As the situation improves to the point that the higher priority alarm 10 is cleared, the situation will produce an exit sound and the alarm plate will blink slowly. The operator acknowledges the exit of the higher priority alarm. If the lower priority alarm condition still exists, its alarm window or indicator will go into acknowledged state when the operator acknowledges the exit of the higher priority alarm. If the situation improves to such an extent that both low and high priority alarms are cleared before the operator resets, as the operator resets, the higher priority alarms will also clear the lower priority alarms.

20: \ l. Subscribe to Device Dependency • <· The key to an alarm system is its dependence on the state of the system and devices. These features significantly reduce the number of alarms T. 'occurring during major events and limit alarms to situations that represent real process or equipment deviations based on the current status of the power plant. Dependence on power plant and equipment status is accomplished by changes in both alarm logic and setpoint 30. The state-dependent alarm ,,! · Can be given as an example of the lower ice set point, which is reduced during unnecessary operation during normal operation! ' to reduce alarms. Hardware-dependent logic is used to activate a low-flow alarm only, '35 when the pump should be running.

I I »! 33 108817! Four modes have been selected which correspond to significant changes in the power plant state logic. These modes are: 1. Normal operation.

2. Heating / Cooling.

5 3. Cold Shutdown / Fuel Change 4. Reactor Shutdown

Except for the reactor trip mode, the operator switches to the various alarm modes manually. During reactor trip, the alarm logic automatically enters the 10 reactor trip mode without operator intervention. All device-dependent alarms are automatically activated without operator intervention.

2. Sub Functional Modes 15 The RCS panel has more than 200 situations that can cause an alarm. In order to reduce operator stimulus load due to the number of alarms and to improve alarm perception, several alarms are grouped into functional subgroups 108, 110, 112 (Fig. 15). Functional subgroup alarm panels have a number of interrelated functional subgroup alarm messages that appear in the panel alarm message window 114 (adjacent to the alarm panel) or in the CRT. In cases where: '' 5 alarms related to key process parameters are obtained, there is one alarm message on each alarm board (e.g., RCS pressure down-la). With such a single alarm message, the operator can quickly identify certain process-specific problems.

As shown in Figure 16, some alarms group similar components instead of process operations, and * ·: adds a message, such as 116.

As shown in Figure 9, the alarm board may be in one of the following states: ••• .35 of the following states: 1. Un acknowledge alarm - If the alarm board has an unacknowledged alarm, the alarm board i I 34 108817 will flash rapidly (eg 4 times / second, on / off at 50/50 as illustrated in Figure 9 at long rays). This situation bypasses all other 5 alarm slab modes for group alarms.

2. Alarm Removed / Return to Normal (Alarm Reset) - When the alarm condition is resolved, the corresponding alarm slab flashes slowly (eg once / second, on / off ratio 50/50 10 as shown in Figure 9 for short beams) until this situation will be cleared. This situation overrides the other two remaining states of group alarms.

3. Alarm - If the alarm condition is active and the above alarm states 1 and 2 are not active, the alarm board will light up without flashing (as shown in Fig. 9 with missing beams).

4. No Alarm - If the alarm 20 associated with the alarm board is not valid, the board will not burn (not shown in Figure 9). Alarm slab lamp: Function can be checked with lamp test function.

,; 25 3. Shape Color Coding The alarm information is identified by the unambiguous color of the tile, preferably yellow 118. The parameter / component indicator or short message on the tube 120 is displayed internally. The gray 30 color coding is used as a tile color to indicate a return to normal mode. The priority of the alarm (i.e. 1, 2 or 3) is identified by: the format code. Alarms use a single bright color to maximize the value of this information. The format code used to indicate alarm priorities -. '.35 daus utilizes different levels of code discoverability. Alarm-priority format coding also allows priority information to be retained even in the return to normal mode.

ί 35 108817

Priority 1 alarm panels, diagrams, symbols, process parameters, and menu option fields are represented by inverse symbols (i.e., blue letters 12 on yellow 5 118 solid rectangular background 124) using color coding of alarms. The color of the emblem is blue to provide good contrast for I readability. In addition, the alarm panels and menu options fields on CRT displays use the same presentation.

10

Priority 2 alarm panels, diagrams, components, menu options, and symbols are in a thin (1-line) box 126 that uses a yellow alarm color code around their blue indicator.

15

Priority 3 alarm panels, mimic diagram parameters, components, menu options, and symbols are surrounded by brackets 128 around their detectors 120. The English-20 language codes in the message line of all alarms on the CRT display, if present, are represented in the alarm mode.

4. CRT alarms: '' Each CRT page in a data processing system gives the operator an overview of all valid unacknowledged .y. alarm conditions and an overview of their location in the power plant. The standard menu for each display page includes options for IPSO and all first-level display pages (see Figure 10, Menu-30, Section 130). These menu option fields indicate existing unacknowledged alarms in the sectors of the display page hierarchy using their alarm status / priority using the alarm highlighting feature described above. If the alarm tile (i.e., in DIAS) is in alarm mode, the first level * • .35 display menu option field, such as 132, in menu option 130 indicates the existence of an alarm in the current page hierarchy. within the precincts of. Alarm panels in menu 130 are grouped into a first 36 108817 level display page group corresponding to console groupings, or by critical action, as shown in Figure 11.

In addition to the alarm information shown in the menu options on the first level screen pages, the following screen features are used to indicate the existence of alarms.

Screen Menu Options 134 for accessing Level 2 and Level 3 screens are illuminated as described in Alert Presentation 10 above, if the information associated with the corresponding page is in Alarm Mode (e.g.

By selecting option 136, the operator can display a Level 2 display page directory, which contains an illustrative diagram of the Level 3 display pages in a hierarchical format together with the first level display page (see Figures 12 and 15). In this diagram, the represented Level 2 and Level 3 display pages are marked with 20 each with an alarm code, if the information in question is the screen has ··: 'unacknowledged in alarm mode. This alarm information is most useful in determining the location of alarms in the display page hierarchy. For example, the operator is informed by means of menu 130 (Fig. 10) on the display page that additional systems,; 25 have unconfirmed alarm (s) in the PRI menu option field with a gray alarm code (return to normal) and

• t I

with a slow flashing alarm code. He can bring up the directory / hierarchy to see which page (s) the alarm information is on by touching the "DIRECTO-30 RY" menu option 136, which is after the PRI. When the primary display directory appears (Fig. 12), the field (s) representing the display page (s) containing the alarm condition (s) (such as. · PZR LEVEL 138) lights up. The desired screen with the alarm information is accessed (as in Figure 15) by touching '. ". 35 flashing fields.

37 108817 Components and Power Indicators on the CRT Process Screen Pages (Figure 13) report alarms and their acknowledged status with alarm codes and flashing. The component ID can provide such alarm information if the parameter associated with component 5 is in the alarm. This also happens when the display page does not display the relevant code. the parameter in the alarm; e.g., the low pressure of the pump lubricating oil is represented by the type of pump lubricating oil. component alarm coding. The operator can view the exact alarm information on the lower level display page or use the 10 alarm system features described below.

5. Defining and confirming the alarm mode

Referring again to FIG. 16, each of the Class 1 and Class 2 Alarm Indicator Plates 15 in the DIAS may notify the operator of more than one possible alarm condition. Due to the rapid determination of the actual alarm condition, a message window 114 is provided in the display area 78 of the panel.

Alarm tile 134 will continue flashing until all alarms associated with the alarm tile have been acknowledged, For further alarms: English descriptions, press Alarm. ···, tile 134 again.

: v25 I As the message appears in the message window of the DIAS alarm screen 78, the CRT panel 87 will display an alarm message in the second field '132 at the bottom of the screen (see Figure 13). The CRT alert message contains the following information: time, priority, magnitude (e.g.

30 Hi, Hi-Hi), ID, setpoint, and real-time process value (which is encoded as described to illustrate the alarm priority and alarm status). If. the number of additional unacknowledged alarms is multiplied by the number placed inside the 35 circles to the right of the message area (see Figure 13).

38 108817 In addition to this alarm message, the display page menu (area 4) has menu options / fields that directly access the display pages that can be used to access diagnostic or support information related to the alarm situation. Figure 22 shows the display areas. Alarm panels that are in alarm mode on a particular panel's DIAS display can be viewed and acknowledged from any CRT panel by a procedure similar to displaying and resetting alarms through control panels. When selecting the "Alarm Tiles" menu option following the Alarm Display-10 worksheet menu option, (i.e., the first-level display page set (area 3), the alarm tiles that are in alarm mode and related to the display page appear in the area of the menu screen 4.) it is a touch point that gives access to other tiles, and the operator acknowledges and inspects these alarm panels by touching them to receive alarm messages and support screen touch points similar to the one described above. This is the way to respond to alarm panels most useful for answering alarms at workstations remote from the operator's location.

: All alarm situations related to the DIAS display indicator plate are kept in the buffer. The buffer containing alarms shall be arranged as follows:, · 1. First unacknowledged 2.

»• · • · 30 N Last unacknowledged N + l First exited / normal N + 2 • · · f * · f 35 n Last exited / normal n + l Acknowledged alarms I 39 n + 2 1 08 81 7 • · • · 5 Press the alarm plate to access the upper alarm level in the bumper.

Acknowledging unacknowledged alarms shifts that alarm. alarm conditions at the bottom of the buffer. Resetting alarms will drop them from the buffer. Previously acknowledged alarms (n + 1, n + 2, ...) can be viewed if there are no unacknowledged or deleted, unacknowledged alarms. Viewing these alarms moves them to the bottom of the buffer.

15

Priority 3 alarm messages and carrier supports are computer generated and only appear in the message line 132 on the CRT screen (Figure 3)? The 78 message window on the DIAS screen does not display an English ID. Each reporting workstation 20 has one notification plate for Priority 3 alarms.

'·' · For workstation-related operator support, workstations have: * one alarm slab.

As the priority of the alarm situation changes, the following changes occur in the alarm system. When a higher priority alarm is received for the same parameter, the previous * · alarm is automatically cleared (ie no operator reset is required as he must reset the higher priority situation) without a reset tone or a slow blink rate. When the alarm condition 30 improves to the point where the higher priority alarm goes off, the operator must acknowledge v the exit of the higher priority alarm; if lower. . · * Priority alarm is still active, it is activated. '!! (when the operator acknowledges the exit of the higher-priority alarm state-3 5) and automatically enters the acknowledged state (i.e. without operator intervention). The operator detects a new lower priority alarm condition when reading an incoming alarm message due to the • removal of the highest priority alarm.

The present invention provides methods for cataloging support pages, classifying alarms, and displaying alarms. In this system, alarms are triggered on the alarm list display pages accessed from the DIAS display 78 fields 138 and the CRT display 84 fields 140 shown in Figures 15 and 13, respectively. This list of 10 alert categories is as follows (see Figure 14): A) level display page set (Power plant main system / main function groups) 142 B) Control room workstation 144 C) Alarm panels 146 15

Workstation alarm panels are listed by priority. Alarms related to the alarm slabs are listed according to the contents of the alarm slab buffer.

j 20 These alert classes provide the operator with the alert information needed to respond to an alarm situation. By highlighting -... · through the Classified Alarm List 78 on page 84 (Figures 4 and,. · 12), the operator can easily select the information of the desired category.

• «, · '·' By first selecting the menu option 14 (Fig. 4)" Alarm List ".i ',' 25 and then selecting the display page representing the alarm state (s) (Fig. 12), '; the operator can view specific alarm situations, of which * · ·; ·; he is interested (Figure 14).

* I

The following are three examples of how to retrieve information from the classified list 30 on page 84 (Figure 4): 1) The operator first selects the menu option "Alarm • | List" 140 (Figure 4) and then the menu option "Alarm." i M »148 (Fig. 4). This exposes the classified alert list of type · ·, · shown in Figure 14 so that it

* I

'··> 35 starts with electrical alarms.

»· * · 41 108817 2) If the operator wants to view information related to a particular alarm, eg RCP1A, he selects the following menu options on page 84 (Figures 4 and 12: -" Alarm Tiles "150 5 -" Primary "152 The display screen menu changes to presentation of the alarm panels that are in the alarm and are related to the primary system (see Figure 14) Currently, the operator can select one of two different types of data presentation for the 10 displayed alarm panels: A. Classified Alarm List - The operator first selects "Alarm List"

15 "RCP1A" option. The classified alarm list appears with RCPlA alarms at the top.

B. Alarm Messages - The operator can use the alarm panel menu options in the same way as control panel alarm panels. Selecting an alarm panel menu option 20 displays an alarm message and a menu containing information related to the alarm situation; display pages.

* i · * »# Alarm information is also provided for all process visualization diagrams

* I

, * 25 la, containing the component in alarm condition or, v parameter. Alarm situations are marked as described above! t with color and shape coding. Alarm parameters associated with a component may cause the component ID to light up to indicate an alarm condition if the parameter is not displayed on the display-30 page, eg a second-level display page may not contain »., !! pump lubricating oil pressure, which allows the pump ID to be alarm coded. If the operator wants to see the exact alarm condition associated with the component, he goes to the lower level screen. Alternatively, he can first touch; \ 35 the menu item "Alarms" and then the component ID, and respond to the alarm with Alarm Board presentations i 108817 42 (e). This procedure also displays menu options on the display pages that provide additional information about the component.

The present invention provides the following methods for resetting alarm 5.

1) Acknowledge Alarm via Indicator Board - Alarms can be acknowledged by pressing the alarm / unacknowledged board or the CRT display board. This action will move the slab from flashing mode 10 to solid mode after all slab-related alarms have been acknowledged, and silence all alarm-related beeps (described below). Alarm messages are displayed in the message window (when using a physical tile) and message line 15 on the workstation CRT screen (see Figure 16).

2) Acknowledging an Alarm via the Alarm List Page - Alarms can be acknowledged on the Alarm List page by touching the Alarm Board touch points associated with the Alarm List categories (see Figure 14). When the 20 presentations of the alarm panel are touched, all of the presentations of the alarm panel are touched. tile-related alarms are cleared. This way of responding to alarming alarm panels is most useful when acknowledging multiple alarms far from the operator's location.

: '25 Each of these alarm reset methods removes unacknowledged alarm detectors from the other alarm formats.

The operator must be informed when the alarm situation has resolved. The notification is made by flashing the detector plate and the associated process screen information at low speed.

. Resetting the deleted alarm detectors is done in the same way as resetting new alarms, i.e., by touching the alarm slab or the CRT display alarm presentation mode.

; "'? 5 There are special beeps in the control room for the following alarm information: • ·» 43 108817 1. Unacknowledged priority 1 or 2 alarms.

2. A reminder tone for unconfirmed or exited states for Priority 1 or 2 alarms.

5 3. Priority 1 alarms cleared or priority 2 alarms cleared.

The audible alarm 1 or 3 sounds only for one second and the audible alarm 2 is repeated periodically once per minute until 10 new or deleted alarms have been acknowledged.

If several unacknowledged alarms are active at the same time, the operator must focus his attention on new alarms of the highest priority. In such a situation, all other 15 unacknowledged alarms, i.e., new priority 2 and 3 alarms and any alarms that have disappeared, will cause unnecessary noise that will distract the operator from the most important alarm situations. The MCC, ACC and ASC of the control room have buttons "FLASH-PREVENTING" and "RESET". When pressed., 20 "FLASH PROTECTION" buttons, the alarm system has the following features:

All new / unconfirmed priority 2 and 3 alarms for tile and CRT displays and operator support functions change from high flashing speed to steady ... 25 lit conditions.

All alarms that have gone out, ie slow blinking, are left out of the alarm data.

Any new alarm conditions or extinguished alarm conditions that arrive after you press .30 on the "FLASH PREVENTION" button will normally be displayed to the operator (ie flashing). However, the operator can suppress these situations by pressing the "ANTI-FLASH" button again.

: -.- 35 Alarm reminder tone informs the operator of new or deleted alarms that have not been acknowledged. To identify these situations for acknowledgment, the operator of 44 108817 presses the "RESET" button / which restores all unacknowledged and exited situations to normal alarm display formats.

j 5 Alarm mute button lights up when pressed to indicate that the alarm mute is active.

In order to provide the operator with quick, direct access to support information - thereby improving operator response to alarm conditions 10 - a single operator action acknowledges the alarm, displays the alarm parameters, and enables the selection of CRT display pages related to the alarm situation.

The present invention provides multiplication and spreading for alarm processing and display 15 such that operators have confidence in intelligent alarm handling methods and equipment failure does not affect power plant safety and operation. Priority 1 and 2 alarms are processed and displayed by two independent systems. The duplication of the two systems 2.0 is not visible to operators due to ongoing cross-checks and unified operator interfaces.

Figures 16-18 show schematic alarm responses when used in the tiles of the present invention. The illustrated tile - ..: group 25 relates to the control of the reactor coolant pump seal: in the reactor cooling system panel shown in Figure 3. Priority 2 Gasket / Leak System Problem Alarm lights up to alert the operator who can read a more complete message in the alarm window that indicates high control: 30 leakage pressure. Priority 1 and 2 alarms have these i ;. ' messages. The same message appears in a more complete form in the panel. CRT display. The CRT screen also provides menu options that indicate useful, supportive display pages. Operator: Alternatively, you can directly select a list of all specific groups; · '· 35 alarms.

45 108817 Thus, an overview of alarm situations is given on tiles, while details are provided by related messages. A particular alarm is considered more or less important at a given time based on the status of the devices and the NSSS operating mode. The processing of alarms is reduced by checking the parameter signals and automatically removing the lower priority alarms when a higher priority alarm related to the same situation is activated.

10 IV. DATA PROCESSING SYSTEM.

A. CRT strain

The 84 CRT shown in the center of the panel of Figure 3 is part of a data processing system that processes and displays all operational data of the power plant. It is therefore linked to all other instruments and control systems of the 15 control stations.

Figures 2, 28 and 30 schematically illustrate a data processing system with respect to a control system, a power plant security system, and a separate detector and alarm system. The data processing system 70 receives from the control system 64 the same sensor information that the control system uses in its control logic. Similarly, it receives sensed information from the detector and alarm system, which is used by the detector and alarm system 72 to generate separate alarms and displays. The power plant security system 50 does not use the internally audited data in its trip logic, and the "raw" signal from each channel as such arrives at the data processing system 70 which implements its own signal; signal comparison logic 156. Within this operating range, signals received from control system 64, power plant security system 50, and detector and alarm system 72 are: - 35, and are compared and displayed on CRT 84.

46 108817

It should be noted that both the checked signal from the reference logic and the checked signal from the power plant security system are available on the CRT display.

5 Therefore, each CRT display includes a signal check and all CRT displays are linked to the information available on all other CRT displays in the power plant. In addition, each CRT monitor can produce alarm panel images of any other panel and acknowledge its alarms. Similarly, detailed display indicators windows are displayed. CRT displays have essentially real-time response time, with a delay of up to two seconds.

The CRT screens contain all the power plant information available to the operator in a structured, hierarchical format. CRT pages are very useful for data presentation because they allow the operator to graphically represent the power plant processes in illustrative formats. In addition, CRT monitor models can assist with operations by providing time diagrams, lists, messages, operational notes, and alerting the operator to abnormal processes.

The most important method by which an operator obtains information on a CRT screen is based on a known touch screen interface.

: 25 Touch screens are based on infrared technology. The horizontal * · · and vertical rays come from a frame placed around the surface of each color motor. When the user cuts off the rays, the coordinates are compared with the display page database to determine the selected information.

30 ··· The touch points on the message and support screens can be accessed ·: * via panel CRT displays by touching other panel ·, · features such as detectors and alarm panels. IPSO is available as a single screen and forms the top of the screen • * • 35 hierarchy. 10, 22 and 24). Below IPS0; "· * There are three levels, each containing consistent information: to meet the specific needs of the operator. The structure of the hierarchical 108817 I 47 form is based on assisting the operator in the performance of his duties and the quick and easy access to all information available through CRT displays. The highest-level display formats provide information for general surveillance tasks 5, while the lowest-level formats contain information most useful for performing diagnostic support tasks.

The Level 1 screens contain information that is most useful for monitoring the main power plant processes. These screens provide the operator with information about the operation of the main system and the status of the most important devices and lead to lower level screens that provide support or diagnostic information. The Level 1 display pages are as follows: 15 1) Primary systems (example, see Figure 19) 2) Secondary systems 3) Power conversion 4) Electrical systems 5) Auxiliary systems t 6) Critical functions • »

The Level 2 screens contain information that is most useful in controlling the power plant components and systems. These pages:. contains all the information necessary to control the process and functions of the system. Such: the parameters to be monitored during the control task are simultaneously on the same display, even if they are part of different systems. The proposed operating procedures or instructions for controlling the components are utilized in determining the parameters to be displayed; Figure 20 shows, by way of example, the control of reactor coolant pumps IA and IB. Normally, the operator would monitor the "Primary System" screen when evaluating the operation of RCS: .j. If the operator wants to use or adjust RCP IA or lB, he will bring up the control screen. All the information related to the 35 reactor coolant pumps is on the control screen so that you do not have to scroll through different screen pages unnecessarily.

l 48 108817

The Level 3 screens contain information that is most useful for diagnosing the processes and components shown on the Level 2 screens. The Level 3 screens provide information useful for inter-channel instrument comparisons, detailed diagnostics of equipment or system failures, and time charts that can be used to determine the direction of changes in system performance, i.e., whether the situation is improving or worsening. Figure 21 shows a diagnostic display of the RCPlA 10 seal and cooler block: the pump section, the supporting oil system, and the engine section are shown on a separate display page due to the data display frequency limits of the display pages.

15 Access the screens via the menus at the bottom of the screens. Each screen has a standard menu that provides direct, ie one-touch access to all data in the data hierarchy. page related pages. The menu contains fields (see Figure 10) in which 20 are the titles of the display pages. To access a specific screen, select the appropriate field (a-j). The display menu * * 'fields include the following (see Figure 22): 1) The next higher level of the display page hierarchy (if any), item (c). This feature is more relevant on Level 3 screens because the next Upper Level V screen is a Level 2 screen, which is not normally on the menu.

2) System screen pages that are related to or support the process of the currently displayed screen .30 (h, i).

t ;;; 3) All six first level display pages (b, c, d, e, f, g).

4) IPSO Display Page (a).

5) Last page (s) displayed on the monitor.

In order to access the display page described by the menu option, the operator selects the relevant page. 35 49 108817 the desired menu option field on the monitor. The menu option lights up (using black letters on a white background) until the screen appears. Because menu options directly access only a small number of screen pages in the screen hierarchy 5, there are alternative methods for quickly displaying other screen pages. There are three options for the operator: (1) Navigate to the screen using alarm panels - This screen navigator mechanism is most useful for accessing workflow-related screens. When the workstation alarm tile from the display 78, such as 80 (Fig. 15), is pressed, menu area 4 of the workstation CRT display page changes to a new menu with display page swap conditions associated with the alarm tile ID. For example, the RCPlA Alarm Board brings up menu options related to RCP 15 IA. In this case, the desired screen is a direct access menu option.

(2) Retrieval of CRT Information through Detectors - Each detector 82, as shown in Figure 7, has a 2.0 CRT access point 158. This button provides a "t" · «to access support information related to • 1 process currently displayed in the detector. parameter. By touching the CRT touch detector:. The point 4 of the CRT display menu options on the workstation changes to menu options that include: V process parameter support and diagnostic information display pages.

(3) Navigating to a Screen Using the Screen Index - Any screen 30 in the screen hierarchy can be accessed through the menu currently displayed. For example, if the * operator is viewing a feedwater system screen and wants to access the CVCS screen, he will perform the following steps (see Figures 22 and 4): The Operator will select the "by touch" menu option, 35 "DIRECTORY" ), after which he selects the menu option "PRIMARY" (option b in area 3 of Figure 22). In this way, 50 108817 are obtained

to the primary section of the display page hierarchy (see Figure 4). Each screen in the primary part of the screen hierarchy is represented as a touch point, and the operator can select the CVCS screen. This feature lets you navigate 5 to any screen. The menu option "DIREC

After TORY, the desired hierarchy associated with one of the six first-level display pages is provided, i.e. one of the menu options b, c, d, e, f or g of Figure 22.

10 In addition to the menu options described above, the menu options include "LAST PAGE", "ALARM LIST", "ALARM TILES", "OTHER", and horizontal paging options ("Keys", keypad). "LAST PAGE" (option j in Figure 22) provides a direct connection to the last page on screen. This is very useful for the operator if he wants to compare data on two screen pages or if he wants to go back to what he has been processing previously.

The "ALARM LIST" (option n in Figure 22) provides a quick connection to the alarm page display pages.

'·. "ALARM TILES" (option m in Fig. 22) provides a quick connection to the representations of active: \ alarm panels above zone 4 of the workstation CRT display (see Fig. 23). This way (the i25 operator has access to the alert information associated with the tiles; Y of any CRT display. This method of handling alarms is described in more detail in Section 5 of this document.

"OTHER" (option k in Figure 22) provides access to those screen pages or information that are not in the data categories described by the current menu options.

B. IPSO

The combined process state overview (IPSO table - see Figure 35 24) is another part of the data processing system. Although the number of monitors and alarms that can simultaneously load the operator can be significantly reduced by panels using 51 108817 individual alarms, monitors, and CRT monitors as described above, the number of stimuli is still relatively high, and this can cause the operator to slow down an insight into the state and direction of critical systems in the NSSS.

One display is required, which only displays the highest level of information to the operator and guides the operator to more detailed information as needed. Although some attempts have been made in the past to present a large table or display to an operator, such current displays have not had significant data combining capabilities as described below.

The IPSO table provides a high-level overview of all high-level 15 information, including an overview of the plant status, critical safety and power factors, symbols representing key systems and processes, plant key information, and all key alarms. IPSO data includes time charts, deviations, numerical values of the most critical critical functions, and the presence and location of Priority 1 alarms, and the availability of systems that support critical functions, and. mode. This, on the other hand, is known as path control. The IPSO can also identify the presence and location of other unacknowledged ••• 'alarms in the power plant area. In this 25th round, IPSO narrows the gap between the operator's systemic, systemic propensity, and more desirable critical functions ·,: Evaluation. This balances the reduction in dedicated displays, helping operators maintain the power plant's field conditions. It also helps operators maintain an overall view of power plant operation while performing detailed diagnostic tasks. whereas ipso provides a common understanding of the power plant process; whereby communication is better between power plant personnel, i.

35 '·';. ·. The situation shown in Fig. 25 is a reactor trip. As described '•'; at the moment, the reactor temperature rise is 27 "and the average temperature rise • I * 52 108817 is higher than desired and continues to rise as indicated by the arrow and the" + "sign. The pressure in the presser is higher than desired, but it drops. Correspondingly, the water level of the steam generator is higher than desired but decreases.

Figure 24 illustrates a CRT display hierarchy with an IPSO at its peak and wherein the first level display page set includes general monitoring information for the secondary system, electrical system, primary system, auxiliary system, power conversion system and critical function system, and and where the third level of the screen provides detailed and diagnostic information. IPSO is seen 15 continuously on all workstations, the supervisor's office and the technical support center. The IPSO is centrally located with respect to the main console. IPSO also exists as a display page that is displayed on the CRT screen of any workstation in the control room as well as at remote operating points such as 20. alarm site of operation.

•: 'The large IPSO panel is about 140 cm high and about 180 cm wide. : ...: Its location, above and behind the MCC workstation, is approx.

: '.Ί2 meters from the watchdog's office (25 more distant; visible point).

One of the benefits of IPSO is that IPSO data can be used to support the operator's response to power plant shocks, especially when the shocks 30. affect many of the plant's operations. The IPSO data supports the operator's ability to react to power plant power and safety factors.

'".IPSO supports the operator's ability to quickly evaluate the overall operation of plant 35 by providing the information needed to quickly evaluate plant critical functions." · "· Power and Safety Function Management Concept 53 108817 Enables Power Management and Safety Management Processes , which describes the various processes at the power plant.

5 Critical Functions are: Critical:

Function For Power Safe for kissing

1. Reactivity Control X X

2. Nuclear Heat X X

10 3. RCS Heat Removal X X

4. RCS Inventory Control X X

5. RCS Pressure Control X X

6. Steam / feed conversion X

7. Power Generation X

15 8. Heat removal X

9. Control of Shell Conditions X

10. Shield insulation X

11. Radiolog. emission control X X

12. Essential ancillary systems X X

20 <> <; IPS0 has a block 160, * »in the upper right corner of the 3x4 alarm matrix. containing a box 162 for each critical function ;;; (see Figure 25 and IPSO CRT display in Figure 10). The matrix '•••' functions as a single location that continuously displays the state of the critical-25 functions. If the Priority 1 Alarm associated with the critical function is valid, the corresponding matrix box -164 will light up according to the Priority 1 Alarm Presentation method. Critical function alarms represent one of the following conditions for Priority 1: 30 - Failure to verify the safety function status (after reactor trip).

- Poor operation of the path / system used to support the critical function.

Unwanted priority 1 deviation in power generation 35., · '(before launch).

- Absence of a safety system (Regulation 1.47 specifies the minimum level of availability).

54 108817 The 3x4 matrix representation is a general summary of Level 1 critical function screen information (Figure 32). The operator receives detailed information about critical function and path alarms from the critical functions section of the screen.

Each critical function can be maintained by one or more power plant systems. The information on the IPSO is selected to represent the ability of the most supportive systems to maintain critical functions. For some critical functions, the general state can be estimated using the most descriptive control parameters. For such critical functions, the IPSO shows the relationship of the process parameter to the set-point 15 (s) and the direction of change to the right of the parameter identifier.

If the integral of the parameter value is greater than the narrowband control value, an arrowhead, as explained in Figure 26, is used to indicate a change in the parameter toward or away from the setpoint. Arrowhead direction, down / up, indicates ·: the direction of the process parameter change. If these parameters "deviate beyond normal control limits, a" + "or" - "sign will be placed below or above the setpoint representation. 25.: The following criteria were used to select IPSO parameters. • [• parameters or other indicators to monitor the overall state of critical functions: 1. Reactivity control 30 'Reactor power is the only parameter displayed by IPSO to monitor reactivity. Reactor power allows the operator, · to easily determine whether the rods are placed in the reactor. power is also used to determine reactor reactivity change-35! 'after the shutdown Reactor power is represented by IPSO as a digital representation of 166 because ·, the numerical value of this parameter is most meaningful for both 55 108817 operators and administrative personnel. also reactor vessel alarm if I monitor the kernel operating limits the system has a priority 1 alarm.

5 2. Nuclear Heat Exhaust With IPSO, the parameters are the Core Erosion Temperature 168 and the undercooling margin 170, which can be used to determine the adequacy of the Nuclear Heat Exhaust. If the kernel outlet temperature is within the set range of 10, the operator can assure that fuel integrity is maintained. The undercooling margin is used because it gives the operator a temperature margin for total boiling.

15 The kernel removal temperature is represented by IPSO as a dynamic representation (i.e., a time graph) because there is a certain upper limit to the kernel removal temperature and the setpoint is easy to determine.

20 The undercooling margin is also represented by IPSO as a dynamic representation because there is a lower limit that defines an operational limit for maintaining cooling.

'' 3. PCS Dehumidification 25;: · TH 'TC' S / G Level 172 and Tave 174 are represented by IPSOs to allow the operator to quickly evaluate the efficiency of the RCS Dehumidification function.

30, In order to remove heat from the reactor coolant, • ;; The S / G level is maintained to a sufficient degree to transfer sufficient heat from the RCS to the steam plant. A dynamic representation is used to allow the operator to observe the improvement or deterioration of the changing situation at a glance.

ψ / • IPSO uses TH and Tc because the operator needs to: determine the amount of heat transferred from the reactor coolant to the secondary system. These parameters are represented as a digital value, since rapid comparison of these parameters is required for delta T monitoring. In addition, their true value is often used and their presentation by IPSO helps those operators whose location does not easily see separate TH and Tc detectors.

The tave is displayed by IPSO as a dynamic representation, so that the operator can quickly evaluate whether this control parameter has been accepted within operational limits.

4. RCS Inventory Guidance IPSO displays pressurizer level 176 using a dynamic-15 representation to allow the operator to quickly determine whether the RCS has the correct amount of refrigerant and to observe changes in the level for better or worse.

| 5. RCS Pressure Control 20 "" "käytetäänεο is used as the pressure of the pressurizer 178 and the supercooling margin to determine the pressure control of the RCS.

: \\ IPS0 uses a dynamic representation to report to the operat- 25,;. Tor the changing pressure conditions that may cause the • •.... RCS to underpress or overpressure.

IPSO uses the dynamic representation of the saturation margin. The saturation situation of the RCS can negatively affect the ability of the 30 pressers to control the pressure. In addition, if the pressure drops, the control message on the undercooling margin on IPS0 indicates a decrease in the saturation margin.

«» I t, * · '6. Steam / feed conversion 3ö: \; -Steam / feed conversion processes can be evaluated quickly using the following IPSO data: 57 108817 (a) Supply water and condensation system status information (e.g., operating, alarm) (b) Steam generator level, dynamic representation (c) Steam generator 5 (d) Atmospheric discharge valve status (e) Main vapor isolation valve status (f) Turbine bypass system status 7. Power generation 10 Power generation processes can be rapidly evaluated using the following IPSO data:

(b) Alarm details of major process 15 incident process related to the main turbine and turbine generator.

(c) Operation and alarm status of power distribution to power plant routes and grid.

8. Heat removal 20, ...: The heat removal processes can be evaluated quickly. with the following information provided by IPSOs: ;;; (a) Circulation system status.

*; ·; (b) Alarm data for critical deviations of condenser pressure conditions 2 * 5 · '.

»» -9. Control of the Sheath Conditions The IPSO uses parameter 30 shield pressure and sheath temperature to monitor the sheath conditions. These are displayed as dynamic representations by.:. IPSO to evaluate time, ·· graphs and relative values. The casing pressure is a variable and is used by the • IPSO to alert the operator of a harmful overpressure that may result from a reactor cooling system of 3: 5. of a defect in the thigh. Also, the temperature of the jacket helps to detect a fault in the reactor cooling system; it can, too, tell of the explosion in the shell building.

58 108817 10. Insulating the Sheath

The safety function of the sheath insulation is monitored by IPSO 5 through a symbol representation of the sheath insulation system.

The symbol is obtained from an algorithm that describes the effectiveness of the following shell insulation factors in their effect on shell insulation:

Activating the Shield Isolation 10 - Activating the Safety Shutdown Activating the Main Steam Power Station Drain Isolation 11. Radiological Emission Control 15 IPSOs display radiation symbols indicating high radiation values, eg inside the shield, and (2) passages of radioactivity released into the environment. These symbols are only displayed by IPSOs when high radiation values are combined. These detectors are displayed in alarm colors, depending on the location of the sensor, in the following situations: - High radiation from the protective cover> 4 «

High activity associated with any release route 25, · - High activity of coolant.

* t • · '12. Essential Auxiliary Systems The IPSO monitors essential auxiliary systems with the following 30 information: (a) Diesel generator status j (b) Power distribution status in power plant area * * (c) Instrument air system status'' (d) Service water system status 35 "(e) Component Cooling Water System Status I 59 108817 These systems, presented in IPSO, are the most important heat transfer systems and the systems necessary to support the most important heat transfer processes, either related to power generation or safety. These systems include the 5 systems that need to be monitored in accordance with Regulation 1.47 and all operating paths that support the critical functions of the power plant.

The following systems have dynamic representations at IPSO: CCW - Component Cooling Water 10 CD - Condensation CI - Sheath Insulation CS - Sheath Spray CW - Circulating EF - Emergency Supply Water 15 FW - Supply Water IA - Instrument Coolant Reactor Cooling RC Safety Spray 2 0 SW - Service Water • · · «TB - Turbine Bypass * ·» tsp ·

»T I

:. ,, 'The system information presented in IPSO includes the operational status of the systems * t · • \, changes in the functional state (i.e.

25 ·: Active-passive or passive-active) and; v priority-related alarms.

System alarm information helps to inform the operator of the critical function alarm paths.

30th Priority 1 alarm information is represented by the IPSO alarm code - ;;; club IPS0 presentation codes in the past

»F

• 'as shown.

F F

I »*

V. SUPERVISORY UNITY

'*> Fig. 27 is an overview of the unified data presentation,. "which is available to the operator according to the present invention. From the Combined Process State Description or Table (IPSO), the operator can monitor the high priority alarms. If the operator is interested in parameter time charts, he can view individual detectors. component status, he can view the system controller settings, the IPSO information is displayed on the board and the panel CRT screen, and any other operator panel or any other panel information is provided to the operator on his own CRT screen. screen or DIASt screen pages, and the operator has direct access to both types of information from any control panel, and when the system control is adjusted or set, the results are transmitted to the other panel alarm and display controllers.

15

As depicted in Figures 2 and 28-31 as an overview, system integrity means that each panel containing the master console, the security console, and the auxiliary console has a CRT 84 controlled by a data processing system 70. The data processing system uses a power plant master computer; it is not as reliable as DIAS 72 computers 'which may be distributed microprocessor based or »* t: ,,,' minicomputer based). It is also slower because it is menu controlled and performs much more computation. It is mainly used to import the most important information to the • 14 * /. Operator, and therefore, from any CRT screen *, important alarm panels can be viewed and acknowledged from any CRT screen. The information available on one CRT display is also available on all other CRT-3 0 displays. Specific Panel Detection and Alarm System 72 · ;;; is associated with controls, but the separate (i.e. fast and accurate) '' alarm and detector display 78, 82 and panel control features are not available on any other panel.

•. «35 '/ Information is basically classified in three ways. Class 1 data must be displayed continuously at all times, and this will happen. Class 2 data does not have to be continuously available 61 108817, but is required from time to time, and DIAS 72 is also responsible for this. Class 3 data is not needed quickly and is of an informative type only and is obtained from DPS. If the DPS 70 becomes damaged, some essential information is provided by the DIAS. The DPS and DIAS are connected to the IPSO board via a display generator 180. Based on IPSO, the operator can obtain detailed information by going to the appropriate panel or navigating the CRT screen.

10 Note that the inputs of DIAS and DPS may not have the same parameters, but if they receive information on the same parameters, the sensors for these parameters are common.

In addition, DPS and DIAS use the same verification algorithms. And further, the algorithms used in connection with the individual alarm panels and detectors 15 calculate a "representative" value and compare the checked values of the DIAS and DPS.

Fig. 29 is a block diagram showing the signal processing of the control room with respect to the separate detector and alarm system for the other 20 parts. It is a good idea to divide the DIAS into blocks so that •; ··: all the detector and alarm alarms required for a given panel N are processed in only one block. However, each panel has a multiple processor. DIAS 1 data and processing is Class 1 and 2 data that is not standard-.25 list displayed directly by IPSO. IPSO normally receives its information · ;;; DPS: the East. If the DPS is corrupted, a portion of the DIAS data is sent to the IPSO display generator for display on the IPSO display.

30 It should also be noted that both DIAS and DPS use the power plant's ·; · outputs of all sensors to measure a given parameter, but the number of sensors in the power plant may vary between different parameters. For example, the pressure of the pressurizer is obtained from 12 sensors, while another parameter can be measured by '••• '35 with two or three sensors. Some systems, such as · '·'; power plant security system, do not use inspection algorithms because they need to operate as fast as possible, and • · 62 108817 use eg two of four activation logic on four independent channels. If the value of the parameter checked by two or more systems is different between the systems, the operator will receive an alarm or other notification via the 5 CRT displays.

An important advantage of the present invention is that the DPS does not have to meet the nuclear power requirements, although it can be used reliably as it obtains its parameter value from the same sensors as the DIAS which meets the nuclear power requirements. These values are checked in the same way, and the DPS checked parameters are compared with the DIAS verified parameters before displaying the DPS information on CRT displays or IPSO.

15 Nuclear Power Required Alarm Plates and Windows and DIAS Separate Detector Displays are preferably implemented using a 512x256 electroluminescent panel, power conversion circuits, and a Graphic Drawing Controller with VT Text Terminal Emulation Corp., such as the M3, . The control function for each panel is preferably implemented using separate, distributed, programmable controllers of the type available under the trademark "MODICON 984", supplied by AEG Modicon Corporation, North Andover, Massachu - ;: 25 setsts, USA. support, stand-alone, programmable microprocessors or minicomputers, while DPS calculation is based on a task-specific mainframe.

.30 Figure 31 is a schematic representation of the ESF control system and ;;; a process component control system, while the power plant security system is preferably of the type based on: \ · "Nuclear Safety Calculation" as disclosed in US-4330367, "System and Process for Nuclear Power System .." • 35, published May 18, 1982 by Combustion Engineering * t · 'Inc., and incorporated herein by reference' · '·'.

f 63 1,0881 7

Another aspect of connectivity is the ability to display critical functions and paths with IPSO as described above. Because key safety and power generation signals and state information are associated with both DIAS and DPS, the operator can browse critical functions according to the screen page hierarchy shown in Figures 32-35. In Figure 33, the operator is informed that emergency feed of the reactor cooling system is not available. In Figure 34, the operator is informed that the emergency supply 10 is unavailable and the power plant is in the launch state. Under these circumstances, the operator must determine an alternative method of heat removal from the reactor core, and by moving to the second level of the critical function screen, he will receive reference heat removal information, even though it is displayed with 15 inventory controls (Figure 35). This level of detailed information and data aggregation is available for all critical functions in virtually all operating conditions, not just during accidents.

20

VI. MODULARITY OF PANELS

A: It should be noted that, as noted above, the use of separate tiles and messaging methods significantly reduces: 25 the amount of panel space required to perform a particular control task. Similarly, the monitors monitor task section, which includes hierarchical display pages, is more robust than conventional nuclear control room systems. The control actions of a particular panel can be combined in a similar manner.

* Thus, a feature of the present invention is the physical modularity of each panel containing the master control console, and more generally, the physical modularity of each panel of the control panel. In each panel, the space required to provide an effective interface with the operator is substantially independent of any alarms, displays, or displays available to the operator; 64 of 108817 controllers. For example, as shown in Figure 3, the six locations on each side of the CRT can be reserved for alarm and detection purposes. Preferably, the two top positions on each side are reserved for alarms 78 and the other four 5 positions on each side are reserved for the indicator display 82. Each panel of the control room has a similar appearance.

This provides significant flexibility and significant cost savings during the construction phase of the power plant, as the equipment can be installed and terminals can be connected at an early stage of the construction schedule, even before all operational requirements of the system have been fulfilled. Software-based systems are delivered early and representative software is installed to pre-test the control room functions. The final installation and functional testing of the software will take place in a more practical phase of the construction schedule. This method can significantly speed up the power plant construction schedule for instrumentation and control systems. Because power plant instrumentation and control requirements are often completed only late in the 20 power plant design schedule, the present invention reduces the costly construction phase delays in almost all cases. In addition, obvious cost savings are achieved due to the manufacture of solid panels, as it is normally necessary to design alarm locations and ..: - 25 presentation methods, and because the manufacture of compact panels reduces material costs. In addition, such modularity takes advantage of operator training, and if operators are under stress in an alarm situation, it will reduce operator errors as each panel operates in a uniform manner.

Thus, each modular control panel has location-specific detectors and alarms and ·· preferably at least one position-specific separate controller: -: 35 entries 88, CRT 84, and interfaces to at least one modular control panel or computer for communication therewith. For example, communication via DPS 65 108817 includes e.g. the ability to acknowledge one panel alarm when an operator is on another panel, and the automatic availability of system-related information controlled by one panel to all other panels.

5

Figure 36 (a) illustrates conventional procedures for implementing instrumentation and control of a nuclear power plant, and Figure 36 (b) illustrates operations according to the present invention. Usually, inputs and outputs are first defined, then the necessary algorithms are defined which define the human-machine interface. After that, the production of all materials begins and all equipment is installed in the power plant at substantially the same time before system testing can begin. By contrast, the modularity of the present invention allows the manufacture of the apparatus to begin at the same time as defining outputs and inputs. Similarly, devices can be installed and tested generally at the same time during human-machine interface design and power plant-specific algorithm design. The hardware and software are combined prior to final testing. In a conventional nuclear power plant installation, the equipment is installed throughout the fourth year of the instruction and control phase, while the equipment according to the present invention can be installed as early as the second or third year.

.. :: 25: Referring further to Figure 3, the process component control system and the protection component control system 56 use programmable logic controllers similar to the Modicon devices mentioned above. These include input and output multiplexers and associated wires and cables, which can be delivered to the power plant prior to the development of power plant-specific logic and algorithms. The device is fault tolerant -:.: Y i s.

• The V35 Data Processing System 70 uses multiple power plants. large computers through modular software and hardware and • related data links. Such hardware j 108817 i 66 can be shipped and power plant-specific modular software installed just prior to system integration and testing.

5 The DIAS 72 uses input / output multiplexers and fault tolerant implementation. It has programmable logic processors or minicomputers that provide the same benefits as described for process control and security device control systems.

I 67 1 0 8 8 1 7 i

LUTE

DETAILED EXAMPLES OF AUDIT ALGORITHM

5 This appendix describes in detail the generic validation and display algorithm used in DPS and DIAS.

Definitions of Terms Used 10 PAMI Post-accident Instrumentation.

Instrumentation Sensor and Transmitter Operational Uncertainty Operational accuracy (eg, if the accuracy is 15 ± 1%, the instrument uncertainty is 2%).

Expected Process Temperature (or other unit of measurement) deviation between sensors measuring the same process parameter due to the expected process temperature (or other unit of measurement) deviation due to the different locations of the sensors;

Computational A single signal calculated by algorithms that represents all sensors measured by the same parameter.

Process Agent A single output signal used in monitors and alarms when a single signal value is required instead of multiple 35 sensor values. A "process agent" is always a "computational signal" unless there is an error in the air and the 108817! 68 feel. After the fault has occurred, it may be the output of a single sensor selected by the operator or algorithm.

5 Checked "Computational Signal" for which all inputs have passed an offset check for the average of all inputs.

10 Verified PAMI "Verified" "Process Agent" that passes a deviation check with "PAMI" sensors.

Check Error Failure of the check and display algorithm to compute a "checked" "computational signal thereof".

PAMI Error "Computational Signal" Deviation Check Failure with "PAMI" -20 Sensors.

Fault selection "Computational signal", which is the output of the sensor closest to the last "checked" signal,: - 25 before the check failed.

Operator selection "Process representative", which is the output of the sensor selected by the operator after the "PAMI error" or "check error".

Good An entry for a sensor that passes a deviation check with "ope-'35 rider selection" or "inspected" "process representative".

69 108817

Poor Marking for a sensor that fails the deviation check with "operator selection" 5 or "checked" "process representative".

! Suspicious An entry given to a "good" sensor that deviates most from the 10 average "computed signals" when any abnormal inspection fails.

"Permit to Operator Selection by Inspection Error" 15 Permit that allows an operator to select a single sensor as a "process representative" when the algorithm cannot calculate a "checked" signal.

* ;;; "Authorization for carrier selection based on PAMI error"

Authorization granting the operation:. the ability to select ...: 25 individual sensors as a "process:: representative" when the "computed signal" checked does not pass the deviation test with the PAMI sensor.

30 '' j! Inspection and sampling algorithm I »:, i. All sensor transmissions (A, B, C, D) are read and stored in the algorithm. when we start. The algorithm uses the display Stored Values; ·. ** 35 to implement all steps (1-10) that make up one pass. When the algorithm is repeated (step 10 remained at 70 108817), the sensor passes are read and re-stored for a new pass.

Determining “Computational Signal” and Errors (Steps 5, 1,2,3,4.5)

Testing Company ^ Steps 1.2.3) 1. The algorithm checks if there are at least 2 "good" sensors.

i yes, let's go to step 2 10 - no, let's go to step 5

Note. A sensor is "good" unless it has been labeled "bad" or "suspicious" a previous time.

15 2. The algorithm calculates the average of all "good" sensors (A, B, C, D). Let's go to step 3.

3. Checking the mean deviation of all good sensors (which must be within the sum of the instrument uncertainty half and the sum of the expected process deviation t <>.).

* - If all the deviation checks are successful, then: .25 a. The previously set ..il "verification error" will be cleared.

: Y b. Delete the permission that allows the operator to select a sensor after an inspection error (i.e. "permit 30 operator selection due to an inspection error" if such has been given previously 'Y min.

c. All "suspicious" sensors are declared "bad" and given the following: "'35 deviation alarm for sensors.

. · '· * D Give the average "checked"

I I

as a "calculated signal".

71 108817 e. Go to Step 4.

- If any deviation check fails, the following occurs: 5a. The most abnormal sensor is marked as "suspicious", after which the algorithm checks whether it is the first or second round of this pass.

10 * For the first round, the algorithm is repeated from step 1.

NB:

If the offset check fails in the first round, the algorithm has used at least one bad sensor to calculate the mean. Implementing the second turn 20 removes the bad sensor, or detects the malfunction of multiple sensors.

;;; * If the second round does not complete, go to • · 25 step 5.

NB:

Failure to pass the misalignment in the second round indicates the simultaneous existence of two 30 or more sensor errors. The algorithm cannot create. presumably removes only: bad sensors, which 35 fails. This ensures that the algorithm does not calculate the wrong "inspected 108817 I 72" signal in this case. Normally, when there are no multiple simultaneous errors, the algorithm detects a plurality of 5 misalignments, removes them sequentially one by one from the algorithm, and determines a "checked" signal.

10

Verified - PAMI Inspection (Step 4) 4. (This step is used if the process has a PAMI class 1 sensor. If there are no PAMI sensors in this process, this step will not be performed but will go directly to step 6).

Does the "checked" signal pass the deviation check with the PAMI sensors? a. Yes. Issuing a "PAMI" message, deleting ..., 20 any "Authorized carrier selection due to a PAMI error", removing a possible "PAMI - ;;; error" alarm, going to step 6.

Note: • * · • · "Enable operator selection due to PAMI error" ..1: 25 allows the operator to select any sensor as a "process agent" when the "count signal" (i.e. "verified" output of the algorithm) is not PAMI- according to the sensor.

30 b. Hey. The following steps are taken.

'' .Il - Deleting "PAMI" message »·

Generating "PAMI Error" Alert - Allowing "Operator Selection Due to i # PAMI Error" -, - 35 - Go to Step 6.

»I

t · 'Failed check (step 5) 73 108817 5. The algorithm checks if the "computed signal" of the previous pass was an "error selection" sensor.

If there was no "error selection" in the previous screening, "audit error 5" just now appeared. Do the following: a. Generate a "check error" signal.

b. Declare all "suspicious" sensors "good".

Note: 10 This step ensures that the next time the algorithm attempts to validate using all sensors not previously configured, 15c. The operator is given the opportunity to select the output of one sensor as a "process agent" ("permission for operator selection due to a control error").

d. The deviations of all sensors are checked for the last "checked" signal. As the "fault selection" sensor M «t, the sensor which deviates ;;; least of the last "checked" signal.

· '.25 e. The signal of the "fault selection" sensor is given as a "calculated signal".

• »- *, i f. Let's go to step 6.

If the previous scan had a "fault selection", the inspection failed earlier and already 30 "fault selection" sensors were selected. The value of the "fault selection" sensor is still given as a "counting signal", as in step 6.

t »

Note: »

It is important that the initially "fault selection": 35 selected sensors are maintained, as other failed sensors may subsequently erroneously appear more accurate.

j 74 1 0881 7 "Process Agent" Selection (Steps 6.7Ϊ6) The algorithm checks for "Authorized Operator Selection due to an audit error" or "Authorized Operator Selection due to a PAMI error".

NB:

The check error allows one permission for operator selection and if the deviation of the "checked" value of the algorithm fails the "PAMI" check, this will provide another permission for operator selection 10.

If no operator selection permission is in effect, a "computational signal" is given as a "process agent" and proceed to step 9.

If you have a carrier selection permission, 15 will go to step 7.

7. Check whether the sensor has been selected by the operator as a "process agent".

Yes, the signal of the selected sensor is given "as a representative of the process", 20, go to step 9.

No, giving the "computational signal" as "process advantage", go to step 9.

* t

Note: f * · »» • · This step gives a "computational signal" "process ..: - 25 representatives" when the operator has the option to select the I · sensor but does not use this option.

PAMI Verification of "Qoperator Selection" Sensor (Step 8) 8. Does the "Operator Selection" sensor pass the ^,; 30 with respect to the PAMI sensor (within the sum of the PAMI instrument uncertainty and the expected process deviation)? »». - Yes, a "PAMI" message will be displayed on the "Process Agent" screen.

- No, the "PAMI" message is removed from the "process agent", "/ 35 display.

I t s * 'Bad Sensor Evaluation (Step 9) 75 108817 9. Is "Process Agent" "Checked" or "Operator Selection"?

No, let's go to step 10 ("Bad" sensor evaluations will not be performed if the "Process Agent" comes from the "Fault Select-5" sensor.)

Yes, a deviation check is performed on all "bad" sensors (A, B, C, D) for the "checked" or "operator-selected" signal by the following methods: e All future "bad" sensors pass the deviation test (instrument uncertainty and expectation). within process deviation).

a. Unmark all transducers that pass the deviation check and mark them as "good" and remove the deviation alarm associated with the transducer.

b. Retain the "bad" markings of all sensors that fail the deviation test.

20 c. Let's go to step 10.

: .j: Area Check (Step 10) 10. The algorithm checks whether the "process agent" is at or above the maximum numeric value of the sensors: 25, or at or below the lowest numeric value.

Yes, the message is "out of range" along with the "process agent" signal. The CRT screen displays a multiplication sign (*) above the "process agent".

Let's go to step 1 and repeat the algorithm.

...: - No, let's go to step 1 and repeat the algorithm.

: Note:

The "out of area" message tells the operator that: ···. the actual process value may be below or above the sensor measurement range. If process measurements can be made with sensors in more than one area, this check causes a new set of sensors to be selected.

76 108817

Note: The RCS panel uses this generic verification algorithm directly for the RCP differential pressure, SG differential pressure, and pressurizer level reference branch temperature.

5 Tcold, Thot, Compressor Level and Compressor Pressure algorithms use this generic algorithm to add steps and minor changes to include: 1. Different number of sensors.

2. Multiple sensor areas.

10 3. Loss of information in related process measurements.

Tcold Inspection Algorithm (Fig. 37) The RCS uses 12 sensors to measure cold branch temperatures. During most operating cycles, the operator will search for a single "process agent" for each of the RCS cold branch temperatures. This value is obtained from DIAS labeled "RCS Tco ^ d". For the sake of consistency, this value determined by the DIASt is also used in the Combined Process State Description (IPSO). To ensure reliability, DPS compares DIAStn '; ··: "process representative" Tcold to its own RCS Tcold value and alarms any deviation (DPS / DIAS RCS T "calculation offset).

. ·. To determine this value, a three-step algorithm is used: ·. · 1. Determine the "process" temperature for each .'25 of the four cold arms (IA, IB, 2A, 2B) using a combination of abnormal inspection and averaging (details will be described later).

2. From the results of Step 1, determine the "process" Tcold ^ cumPaa ^ in for the RCS loop (loop 1 and 30 loop 2) by averaging the corresponding values of A, B.

: 3. The "process representative" RCS TCQ ^ d for normal displays and alarms is determined from the results of Step 2 by averaging the values of Loops 1 and 2.

35: This three-step process determines the "checked" "process-representative" temperatures for cold branches IA, IB, 2A, and 2B, cold 77 108817 for mesh loops 1 and 2, and RCS for Tc. In situations where it is not possible to calculate the "process" temperature for the "cold" branch, the algorithm selects the sensor with the value closest to the last 5 "checked" signals as the "fault selected" "process" temperature. This automatic fault selection ensures that the RCS Τσθ2 ^ ίη "Process Agent" is continuously available for displays and alarms. After the fault, the operator can select the individual sensor in question. cold branch (IA, IB, 2A, 2B) as a "process agent". This selection allows the "process representative" of the loop 1, the 10 loop 2 and the RCS Tcold to be calculated with the "operator selection" information.

The following section describes the algorithm and display handling with DIAS and CRT displays.

15 1. The "process representative" of the bars IA, IB, 2A, 2B, Loops 1, 2 and RCS Tcoia is always displayed on the relevant DIAS display and / or CRT screens when a single "process representative" is required for multiple sensor values ... .20 instead.

2. The Tcold! Algorithm and display processing are identical to the generic validation algorithm with the following notes: ... '' 25a. Generic algorithm steps 1-5 ("computational signal" and fault determination) are modified taking into account the following points: 1. There are only 3 cold branch sensors.

2. Within the same cold branch there are wide and narrow gauge sensors.

. ··· 'b. The determination of the "computational signal" and the faults and other steps of the generic algorithm (steps 6 to 10) are performed independently for each cold branch (IA, IB, 2A, 2B).

35 c. Two algorithms are added: 1. An algorithm that computes the average of 78 process points of the "cold chain" "process representative", which is the "process representative" of the loop (IA and IB for loop 1, 2A and 2B for loop 2).

2. An algorithm that calculates the average of two cold loop "process representative" which is RCS "process representative" (loop 1 and loop 2).

3. The operator can view any of the 12 sensor values or 7 "computational signals" using a menu of DIAS or 10 CRT displays (as described in the generic inspection algorithm).

These options include: 15 T-112CA / 122CA 465-615eF Tcold

loop 1A / 2A

T-112CB / 122CB 465-615 ”F Tcold

loop 1B / 2B

T-112CC / 122CC 465-615 # F Tcold

20 loops 1A / 2A

....: T-112CD / 122CD 465-615 ° F Tcold

loop 1B / 2B

::: T-111CA / 111CB / 50-750eF Tcold loop

· ’· 25 123CA / 123CB

1A / 2A / 2A / 2B, PAMI

Loop IA T_ Computational signal

Loop IB T_ Computational signal 30 Loop 2A Tc Computational signal

Loop 2B T_ Computational signal • c

Loop 1 Tc Computational signal

Loop 2 T_ Computational signal • v RCS Tc Computational signal

Tarkastusalqoritmit

Note: 35 I · 79 108817

The following letters are used to mark the sensors of the cold branch to facilitate the marking of the sensors.

A - Narrow Sensor 1 (Security) (465-615 * F) 5 B - Narrow Sensor 2 (Security) (465-615'F) C - Wide Sensor (PAMI) (50-750 * F) D - wide area sensor in opposite cold branch (ie when talking about loop IA, this is wide area sensor IB, PAMI) (50-750T) 10

The algorithms described below are computed and displayed in DPS and DIAS independently.

The method of the interleaves IA, 2B. 2A or 2B for determining 15 representatives11 of the TCQld process

Determining the "process representative" of the cold branch is done in four steps: 1. Determining the "computational signal" and faults as described below ....? 0 (steps 1-8):

The "calculated signal" of the temperature of the cold branch IA, IB, 2A and 2B is calculated using sensors A, B, C. An inspection is attempted using narrow-area sensors. If this ...: 25 fails, the cold branch "computational signal" is checked based on the wide area sensors j. If the check fails with both narrow and wide range sensors, the algorithm will select the sensor closest to '' as the "defective 30" signal. the last "checked" signal.

2. Selecting a "process representative" (steps 9, 10) (similar to generic verification algorithm steps 6 • X 35 and 7).

80 108817 3. PAMI Verification of "Operator Selection" Sensor (Step 11) (similar to Generic Verification Algorithm Step 8).

5 4. Poor Sensor Evaluation and Area Inspection (Steps 12, 13) (similar to Generic Inspection Algorithm Steps 9 and 10).

|

Kvlmähara branch IA. IB. 2A or 2B Check and Error Algorithm 10 "Determining Computational Signal11 and Faults (Steps 1-81

Narrow Area Attempt Attempt (Steps 1-5Ϊ 1. The algorithm checks if there are two "good" Narrow Area 15 sensors (A and B).

is, let's go to step 2 no, let's go to step 5

Note: The sensor is "good" unless it is marked "bad" in the previous pass.

2. The algorithm calculates the mean of A and B, going to step 3.

3. The mean deviation of both "good" narrowband sensors (A and b) is checked (up to the sum of half of the narrowband sensor uncertainty and the expected; 25 process offset).

···: - If both deviation checks are passed, go to step 4 to check if the average is in the measuring range.

If any deviation check is not passed, 30 goes to step 5.

. *: · Range selection (step 41 4. The algorithm checks if the average or the narrow range sensor in the measuring range is selected.

, .. 35 - The average or the selected sensor is in the measuring range la if its value does not exceed 96% or at least ·, 4% of the narrow measuring range.

! 108817 I 81 j

The average or selected sensor is out of range if its value is at least 98% or at most 2% of the narrow range.

Note: Hysteresis prevents continuous transitions outside the region. Crossing the range occurs at 98% and 2% to ensure that values outside the range are not used to calculate the "checked" signal (e.g., in worst case, sensor readings 10 could be 100% or 0%).

- If the value is within the measuring range, remove any "control error" alarm, deactivate "permit operator selection due to control error", and provide an average or selected 15 narrow range sensors as "checked" as a "computed signal". Let's go to step 6.

- If the value is out of range, go to step 7.

20 5. The algorithm checks the deviation of the narrow range sensors (A and B) from the sensor C (up to half the sum of the wide area sensor uncertainty and the expected process deviation '').

\ - If either sensor A or sensor B passes the '25 span test, the algorithm will select the sensor (A or B) closest to C: *: '. This sensor is selected for further inspection. The sensor that deviates most from sensor C is labeled "bad", if not previously labeled, as "bad", and the probe is produced. sensor offset alarm, if it has not already been done before. Let's go to step 4.

If both A and B fail in an abnormality test with C, then step 7 and 35 attempt a wide area check.

PAMI Check (Step 6) 82 108817 6. The algorithm checks whether the "checked" average or selected sensor passes the deviation test with the PAMI sensor (C) (within the sum of half uncertainty and the expected process deviation).

5 - If successful, do the following: a. Delete "carrier selection permission due to PAMI error".

b. Providing a "PAMI" message together with a "checked" "computed signal" 10.

c. Eliminate any "PAMI Error" alarm.

d. Let's go to step 9.

If not, proceed as follows: 15 a. Delete the "PAMI" message.

b. Granting "carrier selection due to PAMI error".

Note: This feature gives the operator., .. 2 0 the ability to select a second sensor cold branch as a "process representative" when the "checked" output of the algorithm * * does not match the post-accident monitoring * · indicator (sensor c).

25 * * v Wide Area Inspection Attempt Step 7) 7. Check for C deviation from D (within the sum of half the uncertainty and the expected process deviation). Note: When checking a single wide area sensor in a cold branch, the algorithm checks its deviation from another wide area sensor in the same cold loop (i.e. if in loop 1, the wide area sensor IA is checked for wide area sensor IB), v 35 - If the deviation test is passed, select sensor C as a "checked" "computed signal" and do the following: 83 108817 a. Remove any "check error" alarm.

b. The deletion of the "carrier selection permission due to a control error".

5 c. Let's go to step 9.

- If the deviation test fails, the check will fail. Let's go to step 8.

Failed Check (Step 8) 10 8. The algorithm checks if the "calculated" signal from the previous pass was a "fault selection" sensor.

- If there was no "fault selection" last time, a control error has occurred right now. Do the following: 15 a. Generate a "check error" alarm b. Allow "operator selection due to a check error".

c. The deviations of all sensors (A, B, C) are checked for the last "inspected" signal. "Fault selection", ... · The sensor which,, · · deviates the least from the last "checked" signal is selected as the sensor.

d. "Faulty cue" sensor signal given::; 25 a branch of Tc as a "computed t · ·· * · 'signal".

! · E. Let's go to step 9.

- If there was a "fault selection" last time, the check has failed in the past and the "fault selection" sensor has been selected by the algorithm.

The signal of this "fault selection" sensor is>> still given as a "calculated signal".

• * Go to step 9.

<* I

35 Selecting a "process representative" of branch (A or B) T_ (steps 9,

i * C

10) 84 108817 9. Step 9 is the same as Generic Verification Algorithm Step 6.

10. Step 10 is the same as Generation 5 Algorithm 5 with the following exception. The operator can choose to be a "process agent" for any of the applications. a cold branch sensor A, B or C, or the opposite cold branch (A or B) any sensor A, B or C.

10 PAMI Verification of "Qperator Selection" Sensor (Step 11Ϊ11. Step 11 is the same as Step 8 of the Generic Verification Algorithm).

Bad Sensor Evaluation Step 12) 15 12. This step is the same as Generic Inspection Algorithm Step 9 except that all offset checks use wide-area instrument uncertainties, except for offset checks that compare narrow-band sensor offsets to a narrow, 20-band signal, where region instrument uncertainties.

• · 'I * I ♦ *

Area Inspection f Step 13): · 13. This step is the same as step 10 of the generic inspection algorithm <”i25.

I »t

A method for determining the "process representative" of the TCs of loops 1 and 2 i

The "process representative" of Loops 1 and T_ is defined by v 30 by calculating the average of the "process representatives" of A and B cold branches (IA and IB in Loop 1); (2A and 2B in Loop 2).

NB:

To simplify the processing of the "process representative" inputs i t v 35 of the cold branch (1A, 1B, 2A or 2B), the algorithms in loop 1 or loop 2 agree that A represents uptake from branch IA or 2A and B represents Tc uptake from branch IB or 2B.

85 1 0881 7 1. The algorithm calculates the average of the entries from the cold branches A and B and gives average loop (1 or 2)

Te "process representative".

5 2. The algorithm checks if A and B are "checked".

- Yes, give the average as a "checked" signal, go to step 5.

No, let's go to step 3.

3. The algorithm checks whether A or B is "carrier selection".

10 - Yes, let's go to step 4.

No, give the average as a "fault selection" signal, go to step 5.

4. The algorithm checks whether A or B is a "fault selection".

Yes, the average "fault selection" signal-15 Iina is given, go to step 5.

No, give the average as the "operator selection" signal, go to step 5.

5. Check the deviation of A and B from the mean, (within the sum of half of the wide range uncertainty and the expected process deviation).

If the deviation checks are passed, any "Tc Cold Branch (IA / IB or 2A / 2B) Temperature Deviation" alarm is cleared, then go to step 6.

: · .25 - If either deviation test fails, a "T_ Cold Branch (1A / 1B or, v 2A / 2B) Temperature Deviation" alarm is generated, go to Step 6.

6. The algorithm checks whether A and B are in a narrow range.

30 - Yes, give an average in a narrow range, go to step 7.

- No, give the average over a wide area, let's go to step 7.

7. The algorithm checks whether one or both of the outputs are out of range.

If one or both are outside the region, the "process representative" signal of the loop Tc is issued together with the "out of area" message, proceeding to step 8.

- If both are within range, no "out of range 5" message will be issued with the "process agent" of the loop Tc.

8. The algorithm checks whether A and B inputs are PAMI inputs.

Yes, the "PAMI" message is issued together with the "process representative" of the T_ of the loop (1 or 2), the T algorithm of the loop is repeated, and go to step 1 of step 10.

- No, no "PAMI" message is issued together with the "process representative" of the Tc of the loop (1 or 2), the Tc algorithm of the loop is repeated, go to step 1.

15

Method for determining RCS Tcol <^

The "process representative" of Zones 1 and T ^^ is determined by averaging the Tcoi (j "process representatives" of Zones 1 and 2. (Missing ??) 20 - No, providing the "process representative" of step 2 as a "fault selection", let's go to step 6.

5. The algorithm checks whether signal 1 or 2 is "fault selected".

Yes, given step 2 "process representative" • '25 "fault selection", go to step 6.

··· - No, enter step 2 "process agent" as "operator selection", go to step 6.

6. This step is the same as step 10 of the generic check algorithm. Let's go to step 1 and repeat the algorithm.

Pressure Verification Algorithm for Pressure Pressure (Figure 38)

The pressure of the pressurizer and RCS is measured with 12 sensors. During several • • 35 duty cycles, the operator needs a single “process representative” for all pressure readings in the pressurizer / RCS. This value is indicated by DIAS as "PRESS".

87 108817

For the sake of consistency, the IPSO table also uses this value defined by the DIAS. To ensure reliability, DPS compares DIAS pressure "process representative" with its own pressure "process representative" and alarms any deviation 5 (DPS / DIAS Pressure Calculation Deviation).

The algorithm determines the "checked" "process representative" from the pressures to the jan / RCS pressure. In situations where the "checked" "process representative" cannot be pressurized, the sensor closest to the last "checked" signal is selected by the algorithm 10 as the "process representative" of the "fault selection". This automatic fault selection ensures that the "process representative" of the pressurizer / RCS is continuously available for displays and alarms. After a failure, the operator may select the pressure of the individual 15 sensors as a "process representative" of "fault selection".

The following section describes the algorithm and display processing with DIAS and CRT displays.

20 1. "Process representative" pressure is always displayed on the relevant DIAS screen and / or CRT screen when a single "process representative" is required for multiple sensor values !!! in exchange for.

: 25 2. The pressure algorithm and display processing are identical to the generic inspection algorithm with the following modifications: a. Generic algorithm steps 1-5 (Determination of "Computational Signal" and Faults) 30 are modified as follows: 1. Three sensing ranges are used (0). -1600 psig), (1500-2500 psig), and (0-4000 psig).

b. The other steps of the generic algorithm (steps 6- • .., 35-10) are numbered according to the additional items in the block ("computational signal" and fault determination). They remain almost the same 88 108817 with the exception of the small changes described in each step.

3. The operator can use the menu to view the values of any sensor or a single "computational sine" 5 (as described in the generic inspection algorithm).

These options include the following: P-103, 104, 105, 106 0-1600 psig Presser pressure P-101A, 101B, 101C, 1500-2500 psig Presser pressure

10 101D, 100X, 100Y

P-190A, 190B 0-4000 psigRCS pressure, PAMI

CALC PRESS Computational signal

Inspection Algorithm 15 The following letters are used to label pressure transducers to facilitate the handling of transducer identification numbers:

P - 101A = A P - 101B - B P - 101C - C 20 P - 101D - D

P - 101X - E P - 101Y - F P - 103 = G P - 104 = H: '25 P - 105 - I

P - 106 = J

: Y: P - 190A = K

P - 190B = L

30 The following algorithms are computed and displayed independently in both DPS and DIAS.

«» ·

The "computational signal" of the pressurizer pressure is calculated using the antimeters A, B, C, D, E, F, G, H, I, J, K, and L. First: 35 attempts are made to use narrow range, 1500-2500 psigr sensors (A,: V b, C, D, E and F). For pressures outside the 1500 to 2500 psig range, sensors in the 0-1600 psig range (G, H, I, and J) are used.

89 108817

If the pressure cannot be reduced with these sensors, sensors in the range 0-4000 psig (K and L) are used. If the check fails in all three areas, the algorithm will select the "process representative" of the "fault selection" sensor 5 closest to the last "checked" signal.

This "computational signal" of "fault selection" is used as a "process agent" until the operator switches the sensor to "operator selection" or the algorithm passes the check.

10

Of course, the Pressure Check and Improvement Algorithm Determining the Computational Signal and Faults (Steps 1-131

Attempt to test in the 1500-2500 partition range 15 1. The algorithm checks if there are at least two "good" sensors in the 1500- 2500 psig narrow range.

Yes, let's go to Step 2.

No, let's go to step 5 to try the 0-1600 psig check.

20 Note: The sensor is "good" unless it is labeled "bad" or suspicious at the previous passage.

2. The algorithm calculates the average of all "good" sensors in the 1500-2500 psig range (A, B, C, D, E, and F). Let's go: 25 to point 3.

3. Check the mean deviation of all good 1500 to 2500 psig sensors (which should be within the sum of half of the uncertainty and the expected process deviation of 30).

: - If all the deviation checks are passed, go to step 4 to check if the mean is in the right range.

If any deviation check fails, the following occurs: v 'The most abnormal sensor is marked as "suspicious", after which algorithm 90 108817 checks whether it is the first or second round of this pass.

* For the first round, the algorithm is repeated from step 1 onwards.

NB:

If the offset check fails in the first round, the algorithm has used at least one bad 10 sensor to calculate the mean. Applying a second turn removes a bad sensor or detects malfunction of multiple sensors.

* For the second round, the check fails in the 1500-2500 psig range and go to step 5 to try the 0-1600 psig range.

Note: 20 Failure in the second round to pass the offset check will indicate the simultaneous existence of two or more 1500-2500 psig ::: sensor errors. The algorithm cannot: 25 reliably remove only bad sensors, which results in non-v checks in the range of 1500-2500 psig. An inspection of the 0-1600 psig range is attempted. This ensures that the algorithm-30 mi does not calculate the wrong signal in this case. Normally, when there are no multiple concurrent errors, the algorithm detects multiple discrepancies in time, removes them one by one from the algorithm, and determines the "exact * dipped" signal.

; Range Selection (Step 4) 91 108817 4. The algorithm checks if the average is in the measuring range.

The average or selected sensor is within the measuring range if its value does not exceed 96% or at least 4% of the narrow measuring range.

5 - The average or selected sensor is out of range if its value is at least 98% or at most 2% of the narrow range.

NBs Hysteresis prevents continuous transitions outside the area. Crossing the range 10 occurs at 98% and 2% to ensure that values outside the range are not used to calculate the "checked" signal (e.g., in worst case, sensor readings could be 100% or 0%).

15 - If the value is within the measuring range, proceed as follows: a. Remove any "check error" alarm.

b. Delete "Authorized carrier selection due to an audit error" 20c. Give the average "checked" as "computed signal", d. Let's go to step 12.

If the value is out of range, a check is attempted in the range 0-1600 psig and go to step j '.25.

: Y Testing for 0-1600 parts range (Steps 5-8) 5. The algorithm checks if there are at least two "good" sensors in the 0-1600 psig range (G, H, I, and J).

30 - Yes, let's go to step 6.

. - No, let's go to step 9 to try to check the 0-4000 Ύ psig range.

6. The algorithm calculates the average of all "good" 0-1600 psig range: f sensors (G, H, I and J). Let's go to step 7.

: "35 7. Checking for the mean value of any" good "0-1600 psig sensor offset (which should be in the range of 0-1 I 108817 i! 92 i 1600 psig for the sum of the uncertainty plus the expected process offset).

If all the deviation checks are passed, go to step 8 to verify that the mean-5 value is in the correct range.

- If any deviation check fails, the following will occur:

The most abnormal sensor is labeled "suspicious", after which algorithm 10 checks whether it is the first or second cycle of this passage.

* For the first round, the 0-1600 psig range algorithm is repeated from step 5 onwards.

15 Note:

If the offset check fails in the first round, the algorithm has used at least one bad sensor to calculate the mean. Implementing the second 20 rounds removes the bad ·; ·· 'sensor or detects multiple sensor; den badness.

* For the second round, the check fails in the 0-1600 psig p5 range, and proceed to step 9 to attempt the 0-4000 psig range check.

NB:

Failure to pass 20 deviation checks in the second round will indicate the simultaneous presence of two or more 0-1600 psig sensor errors in the 0 V mass. The algorithm cannot reliably remove only bad sensors, • which results in scans failures in the 0-1600 psig range. 0-4000 psig inspection is attempted. This 108817 93 ensures that the algorithm does not calculate the wrong signal in this case. Normally, when there are no multiple simultaneous errors, the algorithm detects several misalignments, removes them sequentially one by one from the algorithm, and determines a "checked" signal.

10 Range Selection (Step 8) 8. The algorithm checks if the average is in the measuring range.

The average or selected sensor is within the measuring range if its value is up to 96% or at least 4% of the 0-1600 psig measuring range.

15 - The average or selected sensor is out of range if its value is at least 98% or at most 2% of the 0-1600 psig range. Hysteresis prevents continuous transitions outside the area. The range is exceeded at 98% and 20% at 2% to ensure that values outside the range .... are not used to calculate the "checked" signal. , (For example, in the worst case, the sensor readings s * • i 'could be 100% or 0%).

,! '! - If the value is within the measuring range, proceed as follows: '25 a. Remove any "check error» •; ·; he "alarm.

t * b. Delete the "carrier selection permission due to a control error" c. Give the average "checked" 30 as a "calculated signal".

; d. Let's go to step 12.

.; * - If the value is out of range, try a check in the range 0-4000 psig and go to: · Step 9.

, .35 * i '.' Attempt to test in the 0-4000 psicr range (steps 9-11) l 94 108817 9. The algorithm checks whether both sensors (K and L) in the 0-4000 psig range are "good".

Yes, let's go to step 10.

- No, 0-4000 psig range check is not possible, go to step 13.

10. The algorithm calculates the mean of K and L (sensors in the range 0-4000 psigr). Let's go to point 11.

11. The K and L deviation is checked for the mean value (which should be in the range 0-4000 psigra for the sum of 10 half of the uncertainty plus the expected process deviation).

- If both deviation checks are successfully completed, proceed as follows: a. Remove any "check error" alarm.

b. Delete any "permission to choose operator due to an audit error" c. Let's go to step 12.

20 - If either failure check fails, go to step 13.

, ···, PAMI check (step 12) 12. Does the "checked" "computed signal" pass an error check with PAMI sensors. Used · ;;; method a if the "checked" "calculated signal" is in the range 1500-2500 psig or 0-1600 psig, and method b if it is in the range 0-4000 psig.

30 Method fa) The deviation shall be within the limits of the instrument uncertainty half, the sum of the process deviation and the position constant of the instrument within the range 0-4000 psigr.

Method (b) The deviation shall be within the limits of one-half of the uncertainty of the instrument within the range 0-4000 psig and the sum of the process deviation '3.5 '.

Yes, let's do the following 95 958888 a. A "PAMI" message will be given, if not already done.

b. Remove any "carrier selection permission due to PAMI error".

5 c. Let's go to step 14.

- No, do the following: a. Delete any "PAMI" message.

b. A "PAMI Error" alarm is generated, if not already done.

10 c. Allowing "carrier selection due to PAMI error".

d. Let's go to step 14.

Failed Check (Step 13) 15 13. The algorithm checks if the "calculated" signal from the previous pass was a "fault selection" sensor.

- If there was no "fault selection" last time, an error has occurred right now. Do the following: 20 a. Provide a "check error" alarm.

·; ··: b. The deviations of all sensors (A, B, C, D, E, F, G, H, I, J, K, and L) are checked for the last "checked" signal. The "fault selection" sensor is selected with 2¾ of the sensor that deviates least from the last "checked" signal.

'C. The "fault selection" sensor signal is output as a "computed signal" of the pressure in the pressurizer.

30th Allowing "operator selection due to 'audit error'.

e. Let's go to step 14.

! Selection of a "process representative" of pressure vessel pressure (steps 14. '3: 5; 151 14. Step 14 is the same as the generic inspection algorithm', step 6.

96 108817 15. Step 15 is the same as step 7 of the generic validation algorithm.

16. The step 16 is the same as step 8 of the generic check algorithm, except that the criteria for the offset check are as described in step 12 of this pressure check and display algorithm for this pressurizer.

10 Poor Sensor Evaluation (Step 12) 17. This step is the same as Step 9 of the Generic Inspection Algorithm, except that the criteria for the deviation inspection are as described in Step 12 of this Pressure Check and Display Algorithm for this pressurizer.

15

Area Inspection (Step 18 ^ 18) The algorithm checks whether the "process agent" is at or above the maximum numeric value (1600 psig for 0-1600 psig sensors, 2500 psig 1500-2500 for 20 psig sensors, 4000 psig 0-4000 for psig sensors ·; ···) or at or below the lowest numeric value (0 psig for 0-1600 psig and 0-4000 psig for · · · reels, 1500 psig 1500-2500 psigsn sensors).

Yes, the message is "out of range" along with the * 25 "process representative" signal. CRT screen *! *! the multiplication sign (*) is displayed above the "process agent".

Let's go to step 1 and repeat the algorithm.

No, let's go to step 1 and repeat the algorithm.

Note: 30 The "out of range" message informs the operator that the actual process value may be below or above the sensor measurement range.

Claims (21)

1. I 22. A method for checking the presentation of alarms, t regarding abnormal condition in an alarm system to be used. M of the operator of a nuclear power plant,! · 1; characterized in that it comprises:. "1. activating at least two of a plurality of alarm panels in an alarm panel set such that each activated panel shows a n, *., j. activated descriptor of the origin of the abnormal state of the nuclear power plant; activated panels to display a shape-coded indication that the affected origin requires high priority attention; for the second of said activated panels, to show a shape-coded indication that the affected origin requires low priority attention; the operator can respond to each activated alarm panel so that each panel is in one of four states comprising a new alarm for an abnormal condition and an acknowledged panel, an existing alarm for an abnormal condition and a acknowledged panel, a clarified alarm for normal condition and an acknowledged panel and • a re-issued alarm condition regarding a normal condition of a kv iterated alarm;:; ΐ; ί »'1' to generate a first instantaneous audible tone when activating a new alarm; . · M 1 * 1 \ X,> »..less to generate a second instantaneous audible tone in the event of an m - 20 cleared alarm; and to generate a third periodically repeated audible tone during a • In new alarm and a clarified alarm. Method according to claim 22, characterized in that it is', ··· ;. the first and second tones have a duration of about one second .-> every two seconds and the third tone is repeated with a duration of about one second each minute. Method according to claim 22, characterized in that it further comprises steps for flashing the descriptor of a new alarm and a clarified alarm with | a first speed, flashing the descriptor of a cleared alarm at a second rate lower than the first speed, illuminating the descriptor of an existing alarm without blinking, and displaying the descriptor of an returned alarm without illumination and blinking. 25. A method according to claim 24, characterized in that it comprises steps for alternatively extinguishing the flashing of previously activated new and clarified alarms without obstructing the generation of said third periodically repeated audible tone for the alarms which have been removed. Method according to claim 22, characterized in that at least some panels can be activated by more than one abnormal origin and the method comprises steps for activating a particular panel for indicating a low priority alarm with a low priority form code. , in the event of an abnormal origin condition having high priority for said given panel to automatically remove the mold code by; * * 0 team priority without reverberating tone or slow flash speed, automatically replacing the high priority form code for said * alarm panel, when improving alarm condition from high priority to team • t25 priority to automatically remove only the high priority alarm. rity, • J · I * ·. to manually acknowledge the removal of high priority alarms; * and to automatically display the lower priority of the alarm form code in the acknowledged state. ; 121 1 0881 7 27. Improvement of a nuclear power plant, characterized in that a nuclear power-operated meadow supply system comprises a plurality of components that can be operated in a coordinated manner to control the power plant's operating parameters for each of a plurality of predetermined modes of operation; means for measuring a predetermined plurality of said function variables and generating a first plurality of parameter signals corresponding to at least a portion of said variables; means for storing a set point value for each said parameter signal; an alarm display comprising a plurality of alarm panels for | said plurality of parameter signals; alarm logic means for generating an alarm signal when a given parameter signal exceeds a given set point; and means for activating a given panel in response to said alarm signal; the enhancement comprising: means for generating a variation of set points for each parameter, each value for such a variable set point corresponding to one of said operation modes of the power plant; • t: the alarm logic means compares said given parameter signal with the given value for said variable set point corresponding to the, '20 given way in which the power plant operates; 'where activation of an alarm panel depends on the value of its: corresponding parameter signal and a varying set point value depends on the operation of the power plant. * · · · I> I 28. An improvement according to claim 27, characterized in that said logic means generates a priority code for indicating at the alarm screen if said alarm signal has a relatively high or relatively low priority, and the priority code depends on the mode of operation of the power plant and, 3 * 0 the state of operation of the at least part of said components. 29. An improvement according to claim 27, characterized in that the site comprises normal nuclear energy development at nuclear power plants and reactor operation. An improvement according to claim 28, characterized in that the kits include normal nuclear energy development at nuclear power plants and reactor operation. An improvement according to claim 30, characterized in that said means for storing switching points comprises switching points for maintaining critical safety functions and switching points for maintaining critical energy production functions, where the power plant is in a normal energy development state, generating a high priority code for the alarm logic means. - · tone single alarm signals from parameters concerning only energy production and only critical safety functions, and where the power plant is in post-operation condition, the ·,: alarm logic means generates a code with high priority for alarm signals from parameters concerning only the critical safety functions-. na. • * · «K. :: 32. Improvement of a nuclear power plant, characterized by; The £ 0 nuclear power plant's nuclear powered meadow delivery system includes a plurality of components which functionally cooperate to control a plurality of system function parameters; to nuclear. the power plant includes means for measuring the function variables and generating corresponding parameter signals; means for comparing the parameter signals with predetermined setpoint values and generating an alarm signal where the parameter signal exceeds the setpoint; a control room comprising alarm monitors.!. comprising a plurality of alarm panels, each ··; '. parameter signal relates to a panel; means for activating the related panel to display an active state where an alarm signal is generated for a given parameter signal; and means responding to the control room operator's action to convert the activated state of said active panel into a acknowledged state; wherein the improvement comprises: at least some panels can each be activated by a different plurality of alarm signals so that the monitor for active state on one of said at least plurality of panels may indicate the simultaneous occurrence of a plurality of alarm signals for a corresponding plurality of parameter signals; and said means for converting each alarm signal for said one panel as well as said panel to the acknowledged state where said operator touches said monitor on said one activated panel. 33. An improvement according to claim 32, characterized by means responsive to said means for converting, and showing the operator a description of each parameter signal concerning the alarm signal 15 for each acknowledged panel. 34. An improvement according to claim 33, characterized in that / ·: said means showing a descriptor also shows an image of the acknowledged panel. t, * 35. An improvement of a nuclear power plant, characterized in that the *:; \ 2f0 nuclear power plant's nuclear-powered meadow supply system comprises 'a plurality of components which functionally cooperate to Mi': master a plurality of system function parameters; that the nuclear power plant includes means for measuring the function variables; ··: and generating corresponding parameter signals; means for comparing the parameter signals with predetermined setpoint values., 1 and generating an alarm signal where the parameter signal exceeds ·, ** the setpoint; a control room comprising alarm displays 9 '* -;' 'comprising a plurality of alarm panels, each parameter signal relating to a panel; means for activating the related panel to display an active state where an alarm signal is generated for a given parameter signal; and means responsive to the control room operator's action to convert said active panel's activated state into a acknowledged state; the improvement comprising: at least one first-class display device spatially and functionally arranged in the control room to display alarm information which includes alarm panels and responds to the operator's touch to acknowledge an activated alarm panel; a plurality of other types of display apparatus distributed over the control room to selectively display monitor information regarding the operation of the power plant, including information on the alarm signal related to an activated panel; and means responsive to the operator's touching any of the second display apparatus to convert the active state of an operator-activated panel on the assigned alarm panel display into the first display apparatus into acknowledged condition. An improvement according to claim 35, characterized in that • t; the display devices of the first and second types are distributed over t · c a plurality of control room panels, each having indicator, i '·. : ·· 2'θ alarm and control functions related to one of a plurality:. 'Main component system of the power plant; M? , *. \ l · each of the other display devices generates continuous •. nowadays, a menu having a plurality of different sectors corresponding to a plurality of main component systems and showing side controls; 25 means are provided in each other display device to display a code on the portion of the menu corresponding to the system panel where the alarm panel has been activated by an alarm signal; *. means responsive to the operator's touch of the menu are provided to display said information regarding the alarm signal concerning the activated panel as a touch sensitive image for the operator of said second display apparatus, said touch sensitive image constituting means for the operator to convert the active state of one panel to a acknowledged state of the second display device. 37. An improvement according to claim 36, characterized in that access to said information regarding the alarm signal is phased via a first screen which is phased by touching the coded part and displaying a directory hierarchy comprising the main system, a plurality of subsystem of the main system, and subsystem in each subsystem, the affected subsystem being connected to the one that best coded the alarm signal and responding to the operator's touch, and means responding to the touch of the coded subsystem, in order to generate a second display containing detailed information on the selected subsystem, including parameter values for the system function and said touch sensitive image. 38. An improvement according to claim 35, characterized in that. . I ': f a first computer system generates a first alarm signal for a given parameter and activates the related panel on a;.: I' first type display; ; 'J | /. ·; ·. a second computer system generates a second alarm signal for the same _. given parameter and generates the code in that part of the menu on the 1 (> second display devices; and) receipts are affixed to both data systems by the operator a bunch of j '·. · touching either the first display device or the other display device. 39. A method for mastering the display and acknowledgment of abnormal condition alarms in an alarm system to be used by an operator at a nuclear power plant, characterized in that the method comprises: 126 at least two activation of a plurality of alarm panels in a set of alarm panels, that each activated panel shows an activated descriptor of the origin of an abnormal state of the power plant; Wherein the operator can respond to each activated alarm panel such that each panel is in one of four states comprising: a new alarm for an abnormal condition and an acknowledged panel, an existing alarm for an abnormal condition and a acknowledged panel, a clarified alarm for normal condition and an unqualified panel, and a return alarm condition for normal condition for an acknowledged alarm; Generating a first instantaneous audible tone when activating a new alarm; »* T * *> *; · '. generating a second instantaneous audible tone in the event of> · '·, a clarified alarm; and> generating a third periodically repeated audible tone below; 130 a new alarm and a clarified alarm. e »* i * a. 40. A method according to claim 39, characterized in that it suffers. the first and second tones have a duration of about one second, every two seconds and the third tone is repeated with a duration of about one second each minute. The method according to claim 39, characterized in that it further comprises steps for flashing the descriptor of a new alarm and a clarified one. first rate alarm, flashing the descriptor of a completed alarm at a second rate lower than said first rate, and illuminating the descriptor of an existing alarm without blinking, and displaying the descriptor of an returned alarm without illumination and flashing. accession. 42. The method of claim 41, characterized in that it comprises a step of selectively removing the flashing of previously activated new and cleared alarms, without removing the generation of said third periodically repeated audible tone for the alarms removed. • · «· • · • · 1 t · · Ml» · I · • »· I · I • · · * · • I *» · ♦ I · »tl II 1% I · · • • »· •» II · • · · * M »I · Ml M