Control room design and human factors

Marcel takes Hana to the plant-referenced simulator at a TVA training center, an exact replica of a unit control room. Long benchboards of switches, meters, recorders and annunciator windows surround the operators, with newer digital displays added over the years. “When this room was designed, nobody had heard of human factors engineering,” he says. “Then came Three Mile Island. The question since then has been the same: can a tired crew at three in the morning understand what the plant is doing and act correctly? Everything in this room should be designed around that question.”

This lesson covers the functions of a control room, the lessons from Three Mile Island that created human factors engineering for nuclear plants, the human factors engineering program and design review guidance, alarm system design and alarm floods, displays and procedures, and the estimation of human error probability for safety analysis.

What a control room is for

The main control room is where licensed operators monitor and control the plant in all states, from start-up and normal power operation through upsets and accidents. It must give the crew the information needed to understand the state of the plant, the controls needed to act, and communication with the rest of the site and with off-site organizations. It must remain habitable during accidents, with protected ventilation and shielding. And because it could become unavailable, for example after a fire, plants have a secondary control area or remote shutdown panels from which the reactor can be shut down, cooled and monitored.

In a US plant, each unit, or pair of units, has a main control room with benchboards for the reactor, primary and secondary systems, electrical systems and safety systems, laid out by system. Remote shutdown panels elsewhere in the plant meet the requirements of General Design Criterion 19 and the fire protection rules, so that the plant can be brought to and held at safe shutdown without the control room. Modernized plants, and new designs such as the AP1000 and the BWRX-300, use compact workstations with large overview displays.

Lessons from Three Mile Island

In March 1979, at Three Mile Island Unit 2 in Pennsylvania, a loss of feedwater led to a reactor trip, and a pilot-operated relief valve on the pressurizer opened and then stuck open. The control room indication showed only that the valve had been commanded to close. Over the following hours, coolant escaped through the open valve. Pressurizer level, which the operators had been trained to protect, rose because of steam formation in the primary system, and the crew reduced emergency cooling flow to avoid filling the pressurizer, while the core was uncovered and severely damaged. Within minutes of the start, more than a hundred alarms were sounding, and a printer reporting alarms ran hours behind.

The investigations found that the operators had acted reasonably on the information and training they had, and that the design of the control room, the procedures and the training had set them up to fail. In response, the NRC required detailed control room design reviews at every plant, a safety parameter display system summarizing critical safety functions, symptom-based emergency operating procedures, better training on simulators and shift technical advisors, and new requirements for post-accident monitoring instrumentation. Regulatory Guide 1.97 sets the post-accident monitoring variables; in Canada, CSA N290.6 sets requirements for monitoring and display of safety functions in the event of an accident. Human factors engineering became a formal part of nuclear design.

The human factors engineering program

In the United States, NUREG-0711, the Human Factors Engineering Program Review Model, now in revision 3, describes twelve elements that the NRC reviews for new plants and for significant control room modifications: program management, operating experience review, functional requirements analysis and function allocation, task analysis, staffing and qualifications, treatment of important human actions, human-system interface design, procedure development, training program development, human factors verification and validation, design implementation, and human performance monitoring. NUREG-0700, the Human-System Interface Design Review Guidelines, gives detailed criteria for displays, controls, alarms and workstations. Internationally, IEC 60964 and IEC 61772 cover control room design and displays.

Alarm systems

Alarms are the main way a plant tells operators that something needs attention. A good alarm is relevant, unique, timely, prioritized, understandable and requires a response. Poorly designed alarm systems fail in predictable ways: nuisance alarms that sound often without needing action teach operators to ignore them, standing alarms clutter the display, and during a major upset an alarm flood buries the few important messages under hundreds of consequential ones. The industrial alarm management standard ANSI/ISA-18.2 and the EEMUA 191 guide recommend rates that operators can handle: in steady operation, on the order of one alarm every ten minutes or less, and during upsets no more than about ten in any ten-minute period.

# Alarm load during an upset, and a simple performance-shaping-factor human error estimate.
alarms_per_min = [0.1] * 10 + [45, 30, 18, 12, 8, 6, 5, 4, 3, 2] + [1] * 10
def windows(rate, w=10):
    return [sum(rate[i:i + w]) for i in range(0, len(rate), w)]
for i, n in enumerate(windows(alarms_per_min)):
    label = "manageable" if n <= 10 else "flood"
    print(f"minutes {i * 10:2d}-{i * 10 + 9:2d}: {n:6.1f} alarms  {label}")
print("with suppression of consequential alarms (keep 1 in 6 during the upset):")
sup = alarms_per_min[:10] + [r / 6 for r in alarms_per_min[10:20]] + alarms_per_min[20:]
print("  first 10 minutes of the upset:", round(windows(sup)[1], 1), "alarms")
nominal = 1.0e-3                    # nominal error probability for a well-practiced action
psf = {"available time": 10, "stress": 2, "complexity": 2, "procedures": 1, "training": 0.5,
       "ergonomics and interface": 1}
composite = 1.0
for v in psf.values(): composite *= v
hep = nominal * composite / (nominal * (composite - 1) + 1)   # adjustment keeps it below 1
print(f"composite multiplier {composite:g}; human error probability {hep:.3f}")

minutes  0- 9:    1.0 alarms  manageable
minutes 10-19:  133.0 alarms  flood
minutes 20-29:   10.0 alarms  manageable
with suppression of consequential alarms (keep 1 in 6 during the upset):
  first 10 minutes of the upset: 22.2 alarms
composite multiplier 20; human error probability 0.020

The simulated upset produces 133 alarms in its first ten minutes, a flood far beyond what any crew can read. Suppressing consequential alarms, for example alarms that follow automatically from a pump trip already announced, cuts the count to about 22. That is still above the guideline, which is why designers also prioritize alarms, group them by system, and present first-out indications showing which alarm came first. Modern alarm systems use logic that knows the plant's mode, so that alarms expected after a trip, such as low flux, are not announced as abnormal.

Displays and procedures

Displays must present information at the level the crew needs. Overview displays show the overall state of the plant at a glance, typically the critical safety functions: subcriticality, core cooling, heat sink, primary system integrity, containment and inventory. Detailed displays show individual systems. Trend displays show how variables are changing, which is often more useful than their current values. Good displays show actual equipment states, not commands, use consistent colors and symbols, avoid clutter, and are designed with operators.

Procedures turn knowledge into action. Normal operating procedures cover routine evolutions. Abnormal procedures cover equipment failures and upsets. Emergency operating procedures, after Three Mile Island, are symptom-based: rather than asking the crew to diagnose the event first, they direct actions based on the state of the critical safety functions, so that the crew protects the core even when it does not yet know exactly what happened. Severe accident management guidelines go further, for conditions beyond the design basis.

Human reliability

Safety analyzes and probabilistic safety assessments must estimate the probability that operators fail to perform important actions. Methods such as THERP and SPAR-H start from a nominal human error probability for the type of task, then multiply it by performance shaping factors for the conditions: available time, stress, complexity, experience and training, procedures, ergonomics and the human-system interface, fitness for duty and work processes. The code applies such factors and a standard adjustment that keeps the probability below one. With little available time, high stress and a complex task, a nominal probability of one in a thousand becomes about one in fifty. Design improvements, such as better displays or more time through automation, reduce the factors and thus the estimate.

Staffing, workload and automation

The control room design must match the number of operators who will use it. Staffing requirements set a minimum shift complement in the control room and on site, and the human factors program checks, on the simulator, that this complement can handle the most demanding scenarios. Workload depends on how much the automation does. Automating routine tasks frees operators to monitor and think, but too much automation can leave them out of the loop, unaware of what the plant is doing until something goes wrong. The function allocation step of the human factors program decides which tasks are automated, which are manual and which are shared, and designs displays so that operators always know what the automation is doing and why.

Small modular reactor designs raise new questions here. Some propose one operator crew for several reactors, or smaller crews with more automation and passive safety features that need no prompt operator action. Regulators in both countries are reviewing such proposals through the human factors program elements, with the applicant expected to show by analysis and simulator validation that the proposed staffing can manage all credible situations, including several units in upset at once.

Modernizing a control room

Replacing analog panels with digital displays changes how operators work. Information that was spread across a wall of meters is now on screens, which can show more but must be navigated. Operators who scanned panels by habit must learn new routines. Experience from modernization projects shows the value of involving operators from the start, of keeping important controls and indications in fixed, dedicated locations rather than behind menus, of hybrid designs that introduce digital displays in stages, and of thorough simulator training before the plant changes. The human factors verification and validation for the modification confirms that crews can operate the new interface at least as well as the old.

Marcel's view, after decades in control rooms, is simple. “A good control room makes the right action obvious and the wrong action hard,” he says. “Every alarm, display and switch either helps the crew understand the plant or gets in the way. There is no neutral.”

Communication and teamwork

Interfaces include the people in the room. Crews use structured communication: a clear direction, a repeat-back, and a confirmation, known as three-way communication, and they use a phonetic alphabet for equipment labels. The shift supervisor keeps an overview while operators carry out actions, and a peer checks critical manipulations before they are made. Training in crew resource management, adapted from aviation, teaches crews to share their understanding of the plant aloud, to challenge one another when something does not make sense and to avoid fixating on a single indication. These habits matter most in the first minutes of an event, when the alarms are loudest and the pressure to act is greatest.

Finally, human factors does not end when the plant starts up. The last element of a human factors program is human performance monitoring: tracking operator errors, near misses, workarounds, operator complaints about displays and alarms, and simulator results, then feeding them back into design changes, procedure revisions and training. A plant that listens to its operators finds weaknesses in its control room long before they contribute to an event, and many of the most valuable modifications in operating plants have come from operators who pointed out an indication that was confusing or a control that was too easy to operate by mistake.