JPH0584907B2 - - Google Patents

Description

[Detailed Description of the Invention] [Field of Application of the Invention] The present invention relates to a plant operation monitoring control device and a simulator for operation training, and particularly to a method for preventing human error by determining and displaying the details of the human error. The present invention relates to an error determination device that is suitable for driving training.

[Background of the invention]

Conventionally, the method for determining human error is as follows:
“Performance measurement system” installed in a nuclear power plant training simulator for the purpose of collecting human error data
(Performance Measurement System)
(NUREG/CR~3309) is known. This is based on the paper “A Simulator-Based Study of Human Errors in Nuclear Power Plant Control Room Tasks” by the United States Nuclear Regulation Authority (USNRC).
Error in Nuclear Power Plant Control Room
In this system, accident scenarios are determined in advance to identify human errors during accident training, and the correct sequence of operations is determined accordingly. If an operator performs an operation that differs from the uniquely determined operating procedure, it will be determined as a human error.

However, this method has the following problems. That is, since the accident event is predetermined, it cannot be applied in cases where it is impossible to predict what kind of event will occur, such as in an actual plant. ) The same cannot be applied if the event changes significantly due to the occurrence of human error. ) It is extremely difficult to create a scenario that assumes multiple failures. ) Although there are cases where the order of operator operations may be changed or other alternative operations may be used, these operations are also determined to be human errors. ) In order to use the system for education and training, it is necessary to know what type of error occurs when it occurs, but this is unknown. For example, even if an error occurs, whether the cause is due to forgetting a necessary operation, performing an incorrect operation, or bad timing, the cause is unnecessary. be. This system only classifies human errors based on their importance to safety, but does not classify the types of human errors. ) There are so-called arbitrary actions, such as an operator's operation that is not correct but not incorrect, but the system will judge this as human error.

On the other hand, apart from the above-mentioned known examples, there are other methods for preventing human errors, such as
Publication No. 94134 and Japanese Unexamined Patent Application Publication No. 60-3694 can be mentioned, but these are for comparison with predetermined operating procedures, and essentially they do not have the problems pointed out in the previously mentioned known examples. There is.

As a countermeasure to the problem of correct operation, for example, as shown in Japanese Unexamined Patent Publication No. 57-159307, it is known that guidance for correct driving operation is displayed based on symptoms.

In addition, another method is to select the correct operating procedure according to the trend information of the main process quantities and the operating status of the system, that is, depending on the symptoms, and compare it with the actual operation to identify human errors. . In these methods, the correct operating procedure according to the symptoms of the plant is stored in advance, and the correct operating procedure is selected from the stored contents according to the current plant symptom. Although it is effective for some of the problems listed above, it is not effective for other problems. At first glance, problems like ) and ) can be solved by selecting the correct operating procedure according to the symptoms. However, assuming human error and multiple failures, there are a wide variety of events, and it is necessary to create operating procedures for a huge number of combinations in advance, making it virtually impossible to apply in practice. . The first reason for this is that it is difficult to create correct operating procedures for a wide variety of symptoms.
Even if the second correct operating procedure is established, if human error or multiple failures occur, the events will change one after another, so the correct operating procedure will need to be changed one after another. Because it will come out. In the end, it is difficult to prepare in advance correct response procedures according to the symptoms of the plant in response to complex events.

Another example of a method for determining the correct operating procedure is a method using a prediction simulator, as described in Japanese Patent Application Laid-Open No. 140401/1983. In this method, instead of creating and memorizing correct operating procedures in advance, several treatment methods are created and memorized depending on the symptoms of the plant, and which one of them is used is determined based on the plant's performance up to that point. This method uses data to predict the future state of the plant through simulation, and selects the treatment method that maximizes the margin for the critical process volume limit. This method allows for more flexible responses to the above-mentioned problems () and () than the so-called symptom-based treatment methods. However, each time an event changes, it is necessary to use a predictive simulator to calculate several types of treatment methods, which makes it impossible to deal with cases where the event changes in a complex manner.

As mentioned above, the conventional methods for determining various correct operations do not provide an essential solution to the above problems (),), and are also problems when determining human error) ) The reality is that no countermeasures have been proposed yet.

[Purpose of the invention]

The purpose of the present invention is to be able to deal with any event transition by setting correct operating procedures according to changes in plant process volume over time, and to eliminate human error based on a comparison between the correct operating procedures and actual operations. An object of the present invention is to provide an error determination device that can easily determine the type of error.

[Summary of the invention]

For this purpose, the present invention stores in advance various types of knowledge related to operating operations by skilled operators, captures the plant status at a certain point in time, and uses that knowledge to generate operation items to be operated at that point. ,
This was done to determine errors. With this, problems () to () in creating correct operating procedures can be solved.

[Embodiments of the invention]

The present invention will be explained below with reference to FIGS. 1 to 11, but before that, the theoretical background thereof will be explained as follows.

In other words, as mentioned above, the most important feature of the present invention is that the knowledge of skilled maintenance personnel regarding operation is stored in fragments, and the knowledge to be used is selected in accordance with the plant condition to ensure correct operation. The purpose is to have the procedures created sequentially. For example, knowledge about the course of a phenomenon can be expressed as follows.

If (scram occurrence) - Then (neutron flux suddenly decreases) Knowledge regarding operations can also be expressed in the same way.

If (scrum occurrence) - Then (reactor mode switch switching) If you memorize various types of knowledge expressed in this way, you can trace various pieces of knowledge one after another and learn how to This makes it possible to create correct response operations for events.

By the way, the above-mentioned problem (), which exists in the operator's operation, can be dealt with in the following way. That is, in order to deal with the arbitrariness of the order of operations, a rule is set that groups together operations whose order may be changed.
Also, rules are written in parallel for alternative operations.
For example, this can be done by writing the following in parallel: If (reactor water level low) - Then (feed water flow rate increased) If (reactor water level low) - Then (cooling system activated during isolation).
At this time, if the priority is included in the Then part, the knowledge will be more in line with the actual situation of the plant. Of course, if there is a rule that changes the priority order according to the plant status, it can be made more consistent with the operation of the actual plant.

According to Dr. Swain of the Sandia National Laboratory in the United States, human errors can be divided into the following types:

(a) Commitment error: Performing an operation that is different from what should have been done (b) Omission error: Forgetting an operation that should have been done (c) Timeout error: Performing an operation correctly but at the wrong timing (d) Sequence Error Mistaking the order of operations Even though these human errors are the same, they have different causes, so it is desirable for education and training systems to determine and display these differences. This can be dealt with by having the knowledge to judge based on the degree of mismatch by pattern matching the rule group and the actual operation. For example, a rule such as if (operation rule does not match, but matches if the if part and then part of the operation rule are replaced)-Then (sequence error) is kept as knowledge.

Finally, operations that are neither correct nor incorrect are judged based on whether or not they have an adverse effect on the plant. In other words, allowable values are determined in advance for major process quantities that have a large impact on the plant, and if an operation exceeds the allowable process quantity, it is considered a human error, but if it is less than the allowable process quantity, it may or may not be done. It is judged as an operation.

Now, to explain in more detail by taking an example where the present invention is applied to the accident response operation of a nuclear power plant, FIG. 1 shows the overall configuration of an example of the apparatus according to the present invention. In FIG. 1, 1 is a plant or a control panel in a training simulator, 2 is an arithmetic processing unit, 3 is a storage device, and 4 is a plant or training simulator (hereinafter referred to as the plant). As shown in the figure, the arithmetic processing unit 2 in this example is a plant status grasping unit 2.
a, normal operation procedure creation section 2b, error identification section 2c
and from the error extraction unit 2d, and also from the storage device 3.
It is composed of a state understanding knowledge storage section 3a, a normal operation procedure storage section 3b, an error discrimination method storage section 3c, and an allowable process amount storage section 3d.

Next, the error determination processing procedure in this apparatus will be explained in order along the processing flow shown in FIG. 2 as follows.

(1) In the process 5a, process data, operating status of equipment, alarm data, etc. are imported from the plant 4 into the plant status grasping unit 2a as judgment data, and the status of the plant is determined based on the knowledge in the status grasping knowledge storage unit 3a. In the subsequent process 5b, the amount of change in parameters important for safe operation of the plant 4 or ensuring safe operation,
Alternatively, trends in change can now be determined from process data. Important parameters include reactor water level, reactor pressure, and water supply flow rate.

(2) Next, the normal operation procedure creation unit 2b processes 5c.
As such, operations necessary for stable operation and safety of the plant are created based on the normal procedure from the normal operation procedure storage unit 3b, and in process 5d, the effect when each created operation is executed, Knowledge storage unit 3 for understanding the status of the presence or absence of adverse effects
Judgments are now made using knowledge from a.

(3) Furthermore, the normal operation procedure creation unit 2b performs processing 5e.
Other alternative operations that produce similar effects are considered, and the list of operation items at that point is determined.

(4) In error identification 2c, as processing 5f,
The normal operation created in the normal operation procedure creation unit 2b is compared and verified with the actual operation by the operator input from the operation panel 1, and if they are verified, the operation by the operator is considered to be a normal operation 5g and must be verified. If so, it is determined to be an operation error candidate 5h. Furthermore, the error identification unit 2c identifies the operation error candidate 5h as a commitment error, an omission error, a sequence error, or a timeout error based on the difference between the two operations using the knowledge from the error discrimination method storage unit 3c. It has become a classification.

(5) In the error extraction unit 2d, as a process 5i, if the variation in the process amount in the plant 4 due to the error candidate 5h from the error identification unit 2c does not exceed the allowable process amount from the allowable process amount storage unit 3d, the plant On the other hand, if the allowable process amount is exceeded, it will have a negative impact on the plant, so it will be judged as an operation error 5k. ing.

When all the processing steps are completed as described above, the final evaluation results are displayed on the operation panel 1. Display contents include a table of normal operations, actual operations, locations of human errors, types of human errors, and details of adverse effects on the plant. In addition, in the case of a training simulator,
The inserted Marufanxion is also displayed.

Note that HPCS and RCIC in Figure 2 represent the high-pressure core spray system and reactor isolation cooling system, respectively.

The outline of the present invention is as described above, but to explain in more detail, FIG. This summarizes the transition of phenomena when the main steam isolation valve is closed.

When a scram occurs, all control rods are sent in, the scram discharge vessel (SDV) vent valve and drain valve are fully closed, and the reactor water level set point is set down. Next, when all control rods are inserted, it is inferred from rules 4 and 5 that there is a sudden decrease in heat flux and voids. And as a result of the sudden decrease in voids, rules 8 and 9
This indicates a sudden drop in the reactor water level and a sudden decrease in the main steam flow rate. By having this kind of knowledge, it is possible to understand the initial phenomena and changes in major parameters such as reactor water level and main steam flow rate when a scram occurs. Moreover, this knowledge is common no matter what the reason for Scrum. In addition, the third
PCIS, SGTS, and CUW in the figure represent the containment vessel isolation control system, emergency gas treatment system, and reactor water purification system, respectively.

Next, an example of the knowledge for creating a normal operating procedure in process 5c will be described. FIG. 4 also shows the standard operation of the reactor side operator when a scram occurs (MSIV open).

This is the most basic corresponding operation described in the operating procedure manual, and is stored in the normal operating procedure storage section 3b. FIG. 5 shows rules for corresponding operations created based on this standard operation. According to these rules, the reactor mode switch must be switched to the "stop" position if it is determined that all control rods have been inserted.
In addition, ANN in Fig. 4 indicates an annunciator (alarm device), and T/D-RFP, M/D in Fig. 5.
-RFP indicates a turbine-driven water pump and a motor-driven water pump, respectively, and IRM and PLR indicate an intermediate range neutron monitor and a recirculation system, respectively.

Further, as process 5e, a list of possible driving operations for a certain phenomenon is created based on the knowledge of alternative operations shown in FIG. For example, during scram (MSIV closure), the reactor water level is low, and in response to this low reactor water level phenomenon, as shown in Rules 1 to 5, the water supply flow rate should be increased, the reactor isolation cooling system (RCIC), and high-pressure core spray should be used. This can be handled by water injection using the low pressure core spray system (HPCS), low pressure core spray system (LPCS), or low pressure core injection system (LPCI). 6th
Rule 6 and subsequent rules in the figure show the conditions and operations necessary to perform the driving operation. In order to recover the water level by increasing the water supply flow rate, it is necessary that the conditions shown in Rules 6 to 9 are satisfied, and if these conditions are satisfied, the priority is considered to be the highest. If this is not met, water injection by RCIC will be given priority 1 after confirming that the conditions of Rules 10 to 12 are met, and the correct operation will be to use this. Note that the prediction of the phenomenon occurring in the plant in process 5d is performed by reusing the knowledge of the phenomenon shown in FIG.

Now, human error is determined and classified by comparison with the actual operation in process 5f, and the knowledge for this is shown in FIGS. 7 and 8. 7th of these
The diagram shows commitment error, commitment error,
This shows rules for extracting sequence errors. An omission error is determined by the absence of an actual operation corresponding to the Then portion of rule group A, which is a set of normal operations including alternative operations.

Rule group A: If A Then A ₁ If A Then A ₂ : In addition, the commit error occurs in rule group A.
Since there is an actual operation that is different from the Then part, a sequence error is determined based on the fact that there is an actual operation that is in a different order from the series of operations in the Then part of Rule B.

Rule B: If B Then B ₁ B ₂ B ₃ ... Judgment and classification for omission errors, commitment errors, and sequence errors are as described above, but Figure 8 shows the rules for extracting timeout errors. It is something that A timeout error occurs when the operation procedure is correct, but the operation timing is simply too early (F) or too late (L) compared to normal times.
It cannot be detected in the same way as other errors. In such a case, a timeout error is determined based on the phenomenon that appears as a result of the operation. In other words, the rules are not general, but the changes that occur when the operation is too early or too late for each phenomenon are standardized, and judgments are made based on this and the actual process amount changes.

In the process 5i in which an operation error is finally determined based on the presence or absence of an adverse effect on the plant, an allowable process amount is determined in advance, and this value is stored in the allowable process amount storage section 3d. Examples based on this allowable process amount are:
An example of this is the annunciator installed in the control panel for controlling reactor water level, reactor pressure, etc. There are approximately 1,500 annunciators in one plant, which is sufficient as a standard for determining errors. Taking the reactor water level as an example, the annunciator water level is set lower than the water level level that protects the safety of the turbine, and the annunciator water level is set slightly above the water level level to prevent the fuel rods from being exposed. It is now set to high. These are appropriate standards for determining the impact on the plant.

FIG. 9 shows an example of standard operation and operation by operators X and Y. This is the same as before when a scrum occurs. 1 in standard operation
The operations are to be performed in order from 9 to 9. Now, in this case, operator X performed the operation 9 quite early, but based on his knowledge of scram compatible operations, it was determined that it was not an error. On the other hand, operator Y is found to have committed an omission error in which he forgot to operate number 4, and a sequence error in which he made a mistake in the order of numbers 7 and 8. In addition, in Figure 9
SRM and CP indicate the neutron source region monitor and condensate pump, respectively.

FIG. 10 shows an example of a display for a sequence error committed by operator Y. This example shows the case of a driving training simulator, which displays the type and time of the input malfunction, as well as normal operation and actual operation by operator Y, error type and judgment reason. ing.

FIG. 11 shows a display example of related process quantities and related system configurations as an example of reference information that helps the operator's understanding. From the displays shown in FIGS. 10 and 11, the operator can know the nature of the error he or she has committed.

Although the present invention is a device used for determining human error, the function of creating a correct operating procedure is also effective as a function of determining a method of handling an accident in an instruction system. Also,
In addition to correct operating procedures, this device also stores operating procedures for systems and equipment that are to be automatically started, and by comparing these with the actual system and equipment status,
This makes it possible to identify not only human errors but also system and equipment failures.

〔Effect of the invention〕

As explained above, according to the present invention, by setting the correct operating procedure according to the change in the process amount of the plant over time, it is possible to deal with any transition of events, and the correct operating procedure and the actual operation can be By comparison, human error and its type can be determined. Therefore, in an operator training simulator, human errors are automatically identified and displayed, which is effective for training operators.In addition, in an actual plant, not only can correct operating procedures be displayed, but also correct operating procedures can be displayed. Human error can be reduced by taking measures such as applying protection to illegal driving operations.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing the overall configuration of an example of a device according to the present invention, FIG. 2 is a diagram showing a flow of error determination processing by the device, FIGS. 3, 4, and 5.
6, 7, and 8 are diagrams for explaining the details of the processing, and FIG. Figure 10 is a diagram showing an example of display for human error;
FIG. 11 is a diagram showing a display example of auxiliary reference information for actual operation. 1...Operation panel, 2...Arithmetic processing unit, 2a...
Plant status understanding unit, 2b... Normal operating procedure creation unit, 2c... Error identification unit, 2d... Error extraction unit, 3... Storage device, 3a... Status understanding knowledge storage unit, 3b... Normal operating procedure storage Section 3c... Error determination method storage section, 3d... Allowable process amount storage section, 4... Plant or training simulator.

Claims (1)

[Scope of Claims] 1. The state grasping unit in the arithmetic processing means determines the current plant state based on at least one of the state quantities from the plant or the plant simulator, the operating status of each device, and the state grasping knowledge from the storage means. is determined, and in order to keep the current plant state on the safer side, the normal operating procedure creation unit creates the necessary steps based on the normal operating procedure corresponding to the plant state from the storage means, allowing for alternative operations. The above operation procedure is created as a candidate, and the created operation procedure is compared and verified with the actual operation content from the operation/display means in the error identification section based on the error determination procedure from the storage means. While the human error candidates and the types of the errors are determined by A specific Schumann error is determined as an operation error from among the error candidates, and the determination results from the extraction section and the error identification section are displayed on the operation/display means. Error determination device. 2. The error determination device according to claim 1, wherein the error identification unit compares the created operating procedure with trend information of the actual operation content, and determines the type of human error according to the difference. 3. The error determination device according to claim 1, wherein the error extraction section determines that a specific human error exists when the process amount from the plant is outside the range of the allowable process amount. 4. The error determination device according to claim 1, wherein each of the one or more operation procedure candidates is given a priority depending on the current state of the plant.