The function of the alarm system in advanced control rooms: an analysis of operator visual activity during a simulated nuclear power plant disturbance

In 1996, the US Nuclear Regulatory Commission, Brookhaven National Laboratory (US), and the OECD Halden Reactor Project conducted a large experiment, investigating the effects of alarm reduction and display on operator and plant performance (O'Hara et al., 1997), The results from this experiment indicated that the number of alarms presented to the operators, and the type of alarm display, had no impact on human performance during simulated disturbances. One possible interpretation of these surprising results is that operators in advanced control rooms use the alarm system only for limited purposes, i.e., the introduction of process formats, trend curves, overview displays, and computerized support systems have made the alarm system superfluous. Given the massive efforts put into the design and development of sophisticated alarm systems intended to maximize safety, this would be a paradoxical conclusion. To explore the role of the alarm system in more detail, we performed an analysis of eye-movement tracking data collected in the Halden Man-Machine Laboratory (HAMMLAB). The objective of the study was to examine to which extent, and for what purposes, licensed operators use the alarm system in advanced control rooms during complex problem solving. According to Funke (1991), complex problem solving situations are non-transparent, ill-defined, and dynamic, i.e., the underlying state of the system must be inferred from symptoms, the goal state is ambiguous, and the problem is in continuous change. This seems to be an appropriate description of the working conditions when operators are confronted with challenging scenarios in a full scope nuclear simulator. Five experts on nuclear power plant operation from the OECD Halden Reactor Project were convened in order to generate initial hypotheses about the operators' use of the alarm system. The expert panel estimated that operators in advanced control rooms would use the alarm system less than 10 percent of the available scenario time. It was assumed that the primary role of the alarm system would be to alert operators and indicate the location of the fault, while the secondary function of the alarm system would be to give input to the verification of diagnoses and provide retrospective information about process events. The panel supported the idea that the use of alarm information follows a quadratic trend when malfunctions are implemented, i.e., the use of alarm information first increases, and then decreases as a function of time (author) (ml)