DRAFT-Advanced Alarm Systems

137 Pages·2000·0.59 MB·English

ACCESSIONNUMBERML003714955
NUREG/CR-xxxx
BNL-NUREG xxxx
Advanced Alarm Systems
Revision of Guidance and Its Technical Basis
Preparedby
WilliamS.Brown,JohnM.O’Hara,andJamesC.Higgins
Brookhaven National Laboratory
Prepared for
U.S. Nuclear Regulatory Commission
NUREG/CR
BNL-NUREG
Advanced Alarm Systems:
Revision of Guidance and Its Technical Basis
ManuscriptCompleted:
DatePublished:
Preparedby
WilliamS.Brown,JohnM.O’Hara,andJamesC.Higgins
BrookhavenNationalLaboratory
Upton,NY 11973-5000
Prepared for
Officeof NuclearRegulatoryResearch
U.S.NuclearRegulatoryCommission
Washington,DC 20555
NRCJCNW-6290
ABSTRACT
TheobjectiveofthisstudywastoupdateandreviseNuclearRegulatoryCommission’s(NRC)guidancefor
reviewingalarmsystemdesignintheHuman-SystemInterfaceDesignReviewGuideline(NUREG-0700,Revision
1). TherevisionswerebasedonrecentNRCresearchontheeffectsofalarmsystemdesigncharacteristicson
operatorperformanceandonastudyexaminingtheintroductionofnewcomputer-basedhuman-systeminterface
systemsintoconventionalnuclearpowerplants.Inadditionthispresentstudyexaminedresearchonalarmsystems
publishedsincetheNRC’spreviousdevelopmentofguidanceforalarmsystems,publishedinHumanFactors
EngineeringGuidancefortheReviewofAdvancedAlarmSystems(NUREG/CR-6105). Specifically,where
supportedbythetechnicalbases,changesweremadetothealarmsystemcharacterization,HFEguidelines,andthe
previouslyidentifiedhumanperformanceissues. WhilethecharacterizationofalarmsystemsinNUREG/CR-6105
didareasonablejobofrepresentingtheirfunctionalcharacteristics,itdidnotsufficientlyaddressallaspectsof
alarmsystemsthatareimportanttoadesignreview. Thus,thecharacterizationwasexpandedto(1)betterillustrate
therelationshipofthealarmsystemtotheplant’sprocessesandsystems,and(2)moreclearlyindicatethe
relationshipbetweenthehuman-systeminterfaceaspectsofthealarmdesignandtheguidanceinNUREG-0700,
Rev.1. Theresearchcoveredmanyaspectsofalarmsystemdesign.Accordingly,modificationshavebeenmadein
mostoftheelementsofthecharacterization.Ingeneral,theresearchprovidedconfirmatorydatathatwasusedto
clarifytheguidelines.Inaddition,severalnewguidelinesweredevelopedandthecriteriaofsomeexisting
guidelinesweremodifiedorsupplementedbasedonthisrecentresearch. Severalhumanperformanceissueswere
identifiedinrecentliterature. Inmostcases,theyreflectthosepreviouslyidentifiedinearlierphasesofthisproject.
Thisinformationwasusedtoreviseissues,whereappropriate.ThechangestothecharacterizationandHFE
guidelinesdiscussedinthisdocumentwerereviewedandwillbeincorporatedintoNUREG-0700,Revision2.
iii NUREG/CR
NUREG/CR iv
TABLEOFCONTENTS
Page
ABSTRACT................................................................................ iii
LISTOFFIGURES ......................................................................... vii
EXECUTIVESUMMARY .................................................................... ix
PREFACE ................................................................................ xiii
ACRONYMS .............................................................................. xv
1 INTRODUCTION ................................................................... 1-1
2 OBJECTIVE ....................................................................... 2-1
3 METHODOLOGY .................................................................. 3-1
3.1 Overview ................................................................... 3-1
3.2 CharacterizationoftheAlarmSystem............................................. 3-2
3.3 DevelopmentoftheTechnicalBasis .............................................. 3-2
3.4 DevelopmentofGuidelinesandDocumentation..................................... 3-4
3.5 IdentificationofIssues ........................................................ 3-5
3.6 PeerReview ................................................................. 3-5
4 RESULTS ......................................................................... 4-1
4.1 BasisfortheModificationstotheAlarmSystemCharacterization ...................... 4-1
4.1.1 EvaluationofRecentResearch:DescriptionsofAlarmSystemDesigns ........... 4-1
4.1.2 ModificationstotheAlarmSystemCharacterization .......................... 4-8
4.2 GuidelinesforHFEDesignReview .............................................. 4-9
4.2.1 GeneralGuidelines .................................................... 4-9
4.2.1.1 EvaluationofRecentResearch .................................... 4-9
4.2.1.2 ModificationstoGeneralGuidelinesforAlarmSystems ............... 4-11
4.2.2 AlarmDefinition ..................................................... 4-12
4.2.2.1 EvaluationofRecentResearch ................................... 4-12
4.2.2.2 ModificationstoAlarmDefinitionGuidelines ....................... 4-14
4.2.3 AlarmProcessingandReduction ........................................ 4-14
4.2.3.1 EvaluationofRecentResearch ................................... 4-14
4.2.3.2 ModificationstoGuidelinesforAlarmProcessingandReduction ....... 4-16
v NUREG/CR
4.2.4 PrioritizationandAvailabilityofAlarms .................................. 4-17
4.2.4.1 EvaluationofRecentResearch ................................... 4-17
4.2.4.2 ModificationstoGuidelinesonAlarmPrioritizationandAvailability ..... 4-19
4.2.5 Display ............................................................ 4-19
4.2.5.1 VisualDisplays ............................................... 4-20
4.2.5.1.1EvaluationofRecentResearch ........................... 4-20
4.2.5.1.2ModificationstoVisualDisplayGuidelines ................. 4-22
4.2.5.2 AuditorySignals .............................................. 4-22
4.2.5.2.1EvaluationofRecentResearch ........................... 4-23
4.2.5.2.2ModificationstoGuidelinesforAuditorySignals ............. 4-26
4.2.6 Control ............................................................ 4-27
4.2.6.1 EvaluationofRecentResearch ................................... 4-27
4.2.6.2 ModificationstoGuidelinesforAlarmControl ...................... 4-27
4.2.7 Automated,Dynamic,andModifiableFeatures ............................. 4-28
4.2.8 Reliability,Test,Maintenance,andFailureIndications ....................... 4-28
4.2.9 AlarmResponseProcedures ............................................ 4-29
4.2.9.1 EvaluationofRecentResearch ................................... 4-29
4.2.9.2 ModificationstoGuidelinesforAlarmResponseProcedures ........... 4-29
4.2.10 Control-DisplayIntegrationandLayout ................................... 4-29
4.2.10.1 EvaluationofRecentResearch ................................... 4-29
4.2.10.2 ModificationstoGuidelinesforControl-DisplayIntegrationandLayout .. 4-30
4.3 HumanPerformanceIssues .................................................... 4-30
5 DISCUSSION ...................................................................... 5-1
6 REFERENCES ..................................................................... 6-1
APPENDIXA AlarmSystemCharacterization ................................................. A-1
APPENDIXB AlarmSystemGuidelines ..................................................... B-1
APPENDIXC AlarmSystemHumanPerformanceIssues ........................................ C-1
NUREG/CR vi
LIST OF FIGURES
3.1 MajorstepsindevelopingNUREG-0700 ................................................. 3-2
3.2 Technicalbasisandprocessfordevelopingguidance ........................................ 3-3
3.3 Exampleofanalarmsystemdesignreviewguideline ........................................ 3-6
vii NUREG/CR
NUREG/CR viii
EXECUTIVE SUMMARY
The alarm system is one of the primary means by which process abnormalities and failures are brought to plant
personnel’s attention. The need to improve the human factors engineering (HFE) of alarm systems has led to the
development of advanced, computer-based alarm systems. The goal of such systems is to assist the operator by
processingalarmdata,andtoimprovethepresentationofthisinformation. Thistechnologypromisestoprovideameans
ofcorrectingmanyknowndeficienciesinalarmsystems. Advanced,computer-basedalarmsystemsareavailableas
upgradestoexistinghuman-systeminterfaces(HSIs),andareincludedinnewcontrolroomdesigns.
TheU.S.NuclearRegulatoryCommission(NRC)reviewstheHFEaspectsofcontrolroomstoensurethattheirdesign
meetsgoodhumanfactorsengineeringprinciplesandthattheoperator’sperformanceandreliabilityareappropriately
supportedtoprotectpublichealthandsafety. TheHuman-SystemInterfaceDesignReviewGuideline,NUREG-0700,
Rev.1,wasdevelopedtoprovideguidanceonHFEfortheNRC. TheNRCstaffusesNUREG-0700for(1)reviewing
submittals of HSI designs prepared bylicensees or applicants for a license or design certification of a commercial
nuclearpowerplant(NPP),and(2)undertakingHSIreviewsthatcouldbeincludedinaninspectionorothertypesof
regulatoryreviewofHSIdesigns,orincidentsinvolvinghumanperformance. ItdescribesthoseaspectsoftheHSI
design review process that are important to identifying and resolving human engineering discrepancies that could
adverselyaffectplantsafety. NUREG-0700alsohasdetailedHFEguidelinesforassessingtheimplementationofHSI
designs.
Alarmsystemsarekeyelementsofcontrolroomsbecauseofthecomplexityoftheprocesscontroltask. Accordingly,
NRCconductedaprogramofresearchaimedatdevelopingatechnicalbasisforreviewingadvancedalarmsystems.
Inanearlier NRCproject,thekeydesignfeatures of advanced alarmsystems werecharacterized,andHFEreview
guidance was developed and documented in Human Factors Engineering Guidance for Advanced Alarm Systems,
NUREG/CR-6105. Theguidancewasbasedonavarietyofsources,includingHFEguidelinesandstandards,industry
experience,andliteratureonfeaturesofalarmsystemdesignandtheireffectsonoperatorperformance. Theguidance
wassubsequentlyintegratedintoSection4ofNUREG-0700,Rev.1.
Sincethepublicationofthisguidance,therehasbeenaconsiderableamountofresearchonalarmsystemsthatmayhave
implicationsfordevelopingnewguidanceorforrevisingtheexistingguidance. Thepurposeofthestudyreportedhere
wastoexaminerecentresearchandexpandandrevisetheguidancetomaintainitasstate-of-the-artalarmsystemdesign
reviewguidance.
Thus,theobjectiveof this studywas toreviewrecentliteratureand,wheresupportedbythetechnicalbasesinthat
literature,toaddressthefollowing:
1. ReviseandexpandthealarmcharacterizationinNUREG/CR-6105.
2. ReviseandexpandtheHFEdesignreviewguidance:
• Developnewreviewguidancetoaddressalarmsystemdesigncharacteristics,orhumanperformanceissues
notfullycoveredinNUREG-0700,Rev.1
• RevisetheexistingreviewguidanceforalarmdesignsinNUREG-0700,Rev.1
• Augmentthetechnicalbasisofexistingguidancewithconfirmatoryinformation
3. Identifyhumanperformanceissues.
The methodology used to accomplish these objectives was the general NUREG-0700 methodology for guidance
development.TherevisionstothecharacterizationandguidancewerebasedonrecentNRCresearchontheeffectsof
alarm system design characteristics on operator performance and on a study examining the introduction of new
computer-based human-systeminterface systems into conventional nuclear power plants. In addition we examined
ix NUREG/CR
researchonalarmsystemspublishedsincetheNRC’spreviousdevelopmentofguidanceforalarmsystems,published
inNUREG/CR-6105.
Theresultsforeachobjectivewillbebrieflysummarizedbelow.
AlarmSystemCharacterization
A system characterization is important because it provided a structure within which the reviewer could request
information about a system and with which to structure the guidance. Existing alarm systems were reviewed and
compared with the alarm characterization previously developed in NUREG/CR-6105. While the characterization
reasonablyrepresentedthefunctionalcharacteristicsofalarmsystems,itdidnotadequatelyaddressallaspectsthatare
importanttoanHFEdesignreview. Thus,thecharacterizationwasexpandedto(1)betterillustratetherelationshipof
thealarmsystemtotheprocessesandsystemsoftheplant,and(2)moreclearlyindicatetherelationshipsbetweenthe
HSIaspectsofthealarmsystemandtheguidance.
HFEDesignReviewGuidelines
Recentresearchhasaddressedmanyaspectsofalarmsystemdesign,andasaresult,modificationsweremadetomost
oftheelementsofthealarmsystemcharacterization.Ingeneral,theresearchyieldedconfirmatorydatawhichcouldbe
usedtofurtherclarifytheguidelines. Inaddition,wheresupportedbytheliterature,newguidelinesweredeveloped.
Theguidelineswereorganizedandspecifiedinastandardformatandwereorganizedasfollows:
• GeneralGuidelines
• AlarmDefinition
• AlarmProcessing
• AlarmPrioritizationandMessageAvailability
• Display
- GeneralAlarmDisplayGuidelines
- DisplayofHigh-PriorityAlarms
- DisplayofAlarmStatus
- DisplayofSharedAlarms
- AlarmMessages
- CodingMethods
- DisplayLayoutandOrganization
• User-SystemInteraction
- GeneralGuidelines
- SilenceFunctions
- AcknowledgeFunctions
- ResetFunctions
- AlarmManagement
- AutomaticFeatures
• ControlDevices
• Backup,Test,Maintenance,andFailureIndicationFeatures
- Reliability
- Test
- Maintenance
- FailureIndication
• AlarmResponseProcedures
• Control-DisplayIntegrationandLayout
Theguidancewasthenpeerreviewedandrevised. ThisnewguidancewillbeintegratedintoNUREG-0700.
NUREG/CR x