MUJER FRÍGIDA

MMI was an important topic in the Borssele back-fitting programme that was implemented in 1997. It encompassed:

• enlargement and complete retrofit of the main control room,

• addition of a secondary (emergency) control room in a new external events hardened building, • a full-scope replica simulator, including main and secondary control room,

• an emergency response and communication facility in the cellar under the office building. The design of the latest MMI is a plant-specific solution applying modern techniques in a rather old plant. It is based on the following principles:

• The computerised process presentation system (PPS) is used by the operator only for obtaining information from the plant and guidance on accident management. The PPS information is also available outside the control room, in particular in the Emergency Support Centre.

• Safety significant plant information is also presented by panel instrumentation. Manual actuation of components can only be executed from control panels.

• The design of the control room follows a strict and consistent 4-quadrant system: shift supervisor, deputy shift supervisor, reactor operator and balance-of-plant operator.

• Operation of main control room and backup control room is mutually interlocked. To transfer control to the backup control room, the reactor must be scrammed before transfer of control can be performed.

• Control of components by the reactor protection system (RPS) or ESFAS has priority over manual control or control by non-safety classified automation. Where EOPs require an exemption for manual control (to optimise the events sequence), a key code is required.

• An Integrated Plant Status Overview panel (IPSO) is readable from any place in the main control room. Depending on deviations from normal operation, the mimics and set of parameters

presented by the IPSO will automatically be adapted. • Aforementioned PPS provides real time information like:

o process conditions and parameters; o process mimics able to zoom in;

o p, T diagrams presenting safe-unsafe limits and actual working points;

o a critical safety function monitoring system (CSFMS), which indicates the status of the critical safety functions by colour codes with the possibility to instantaneously zoom in on status trees which lead to the use of the appropriate Function Restoration Guide, see below.

The critical safety status monitor presents six so-called Critical Safety Functions (CSF): 1. Sub-criticality 2. Core Cooling 3. Heat Sink 4. Vessel Integrity 5. Containment Integrity 6. RCS Inventory

These Critical Safety Functions (CSFs) are depicted on the IPSO panel in the control room by a small rectangle of six squares arranged in a 2 x 3 matrix. The same matrix is also depicted on all the computer screens in the control room. In addition a hard-wired classified panel depicting the same Critical Safety Functions is located in the control room. Each square representing a CSF can be depicted in four colours:

Green: function is satisfied

Yellow: function is abnormal

Orange: function is endangered

Red: function is violated

By clicking on one of the rectangular blocks in the little matrix on the CRT, the appropriate status tree is opened. The aforementioned measurements form the junctions in the status trees. Each junction answers a question if a certain threshold is passed which leads to the routings through the status trees, applicable to the actual situation. The routings end in the AM procedures prescribed for the current status of the plant. These procedures are executed from paper. The dominance in applying the procedures is indicated by the colours of the rectangular blocks, the routing in the status trees and the sequence in the listing of the six Critical Safety Functions.

Although the availability of the PPS is high, the system is not safety qualified. Therefore the CSMFS can act as a trigger, but the CFSs have to be verified on the hard wired information.

At the Borssele NPP, an integrated Event-Based and Symptom-Based package of Emergency Operating Procedures (EOPs) is used:

• The Optimal Recovery Guidelines (ORGs); ‘Event’-based procedures for LOCA, Secondary Line Break, SGTR and combinations of these.

• The Function Restoration Guidelines (FRGs); ‘Symptom’-based procedures for the overall safety of the plant.

The entry to this package is through the E-0 after Reactor Trip (RT) and/or Safety Injection (SI) procedure, to diagnose the event and to decide on the appropriate event based procedure, based on the event’s symptoms. There are three levels of diagnosis in the set of EOPs: an early diagnosis via E-0, a continuous diagnosis based on symptoms through the CSFs, and re-diagnosis via ES-0.0.

If a CSF is shown in any colour other than green on the computer screens, the addressed signals of the reactor protection system are also depicted on the screen, together with the necessary FRG. The combination of reactor protection signals and CSF uniquely defines the necessary FRG.

The FRGs are selected on the basis of the status of the challenge and the ranking of the challenge as depicted by the CSF status board. 1st rule – colours; red, orange, etc., and 2nd rule – ranking of the CSF; Subcriticality, Core Cooling, etc..

As long as the Critical Safety Functions are satisfied (green) the event is dealt with by the event-based ORGs. The moment a Critical Safety Function is jeopardised, the operator has to use status trees to select the appropriate FRG. The operator remains in that FRG until the CSF is shown in green again or another CSF takes higher priority.