Operating procedures and man-machine interface

he accident at Three Miles Island (TMI) in the USA in 1979 demonstrated the fundamental role played by man in the operation of a nuclear facility. Since then, numerous studies have been carried out to find the best possible organization of documents, teams and operating resources.

We recall that at Three Miles Island, all the means necessary to avoid the accident were available, but due to ambiguous, erroneous or contradictory information, the operators didn't know what to do.

The approach adopted is to ensure defense in depth using all available resources. In the event of an accident, this defense in depth enables the following to intervene in succession:

• control systems associated with operating specifications and alarms to detect any departure from the normal operating range and take corrective measures (automatic or manual) to ensure rapid return to this range;

• the reactor protection system, which detects any departure from the protection range of successive barriers (fuel sheath, primary circuit envelope, containment) and automatically initiates corrective action for at least thirty minutes;

• operator diagnosis of barrier status during this period of automatic protection system intervention;

• the manual actions required by the operators at the end of these thirty minutes to return the installation to a so-called safe state, i.e. one in which the barriers are maintained in a state that guarantees their integrity; at the same time, an attempt is made to diagnose the cause of the accident and, if possible, to reverse it;

• control by an engineer present in the control room (ISR) to confirm the operators' diagnosis and monitor the main barrier parameters during the accident driving period in order to detect any deterioration requiring a change in driving strategy;

• These teams are made up of experts from different backgrounds, who meet in the crisis rooms at the power plants, as well as in the Paris offices of EDF, IPSN, DSIN and FRAMATOME.

EDF has opted to use automated systems for short-term actions, requiring a response time of less than thirty minutes, and for medium- and long-term operator actions.

This position enables a good compromise to be found between the untimely commands that can result from automation and the risks of operator error, which are all the more frequent when the time left to the operator to carry out manual actions is short.

As part of this strategy, the organization of driving is fundamental. This organization is based on :

...