Simulator at Surry nuclear plant in Virginia.(Credit: INPO)

technologyinoperatortrainingFull-scope,plant-specific Simulatorsare part of the new reality

by Thomas Perkins

In the late 1960s and early 1970s, the nuclear powerindust ry in the United States made its commitment tosimulator t ra ining for nuclear power plant operators.During this period, all four US nuclear steam supplysystem vendors opened their own training centres, eachincluding its own full-scope nuclear plant simulator.Operators from utilities around the world attendedgeneric courses on nuclear power plant operations atthese centres. Transition training to the specifics ofindiv idua l plants was accomplished once operators hadreturned to their respective plant sites.

By the end of 1978. the use of simulators in thet r a i n i n g of nuclear power plant operators had gainedworldwide acceptance. Training centres existed inCanada, France. Federal Republic of Germany, Japan,Spain. Sweden, the United Kingdom, as well as in Taiwan,China. The American National Standard for NuclearPower Plant Simulators for Use in Operator Training,

Mr Perkins is International Manager, Link Simulation SystemsDivision of the Singer Company, Silver Spring, Maryland.

Copyright 1985 The Singer Company, Link Simulation SystemsDivision, to whom any request to reproduce all or part of thisarticle should he addressed.

first approved in 1977, set minimum requirements forsimulators used to train and to qualify nuclear powerplant operators. Operator training focused mainly onnormal operating procedures and a review of improbable,catastrophic accident scenarios. The nuclear industryassured the public that safety measures bui l t i n t onuclear reactors and control rooms ensured that "aserious accident could not happen".

On 28 March 1979. a major accident occurred atThree Mile Island (TMI) Unit 2 in Middletown, Penn-sylvania. The TMI accident resulted in a critical assess-ment of the preparedness of operations staff to respondto the accident. The post-accident findings of the KemenyCommission and other recommendations concerningsimulators have had a significant impact on the nuclearindustry's approach to operator training.

It is commonly believed that the incident at TMIwould not have occurred had the operators beenproperly trained, but simulator t raining alone wouldnot have averted it. Simply speaking, existing simula-tors were not programmed to handle a reactor transientwhere much of the primary coolant was lost. The TMIaccident has prompted a complete re-evaluation of thenuclear industry's operator training programmes.

18 IAEA BULLETIN, AUTUMN 1985

Nuclear power and electronics

Recognition of the complexity of the processes, thedemands placed on operators, and the importance oftraining are resulting in comprehensive training pro-grammes administered by industry and government agen-cies. Traditional apprentice training can no longer be con-sidered as a viable approach to nuclear plant operatortraining. The old approach of "train the hand, not themind" has given way to an integrated, systematic,performance-based approach to training nuclear plantpersonnel.

The complexity of today's plants requires that asimulator be the principle tool a qualified instructoruses to teach and to assess an operator's ability to performunder normal and abnormal plant conditions. However,acquisition of a full-scope, plant-specific simulator isjust one component in an effective training programme.Today's integrated training programmes include extensiveclassroom .study in the theory and principles of operationscoupled with hands-on simulator training. Normaloperations, the more probable accident events, and theman-machine interface are emphasized.

Post-TMl simulation

A full-scope, plant-specific simulator consists of areplica of the plant control boards, operating consoles,and instructor's station all activated by a large digitalcomputer system. Computer programs are developedthat are mathematical representations of the physicalphenomena of the plant systems and transfer functionsof the control system.

This description is as valid today as it was in early1979. The major-difference between today's simulatorsand those delivered in the late 1970s is the fidelity andaccuracy of simulation — fidelity as applied to theevolution of normal and abnormal plant events, andaccuracy regarding tolerance requirements for steady-state and transient conditions. (Fidelity is the degreeof similarity with the reference plant.)

Some salient features of today's full-scope, plant-specific simulator are described in the following sections.

The control room

A full-scope simulator typically includes a faithfuland complete replica of all of the equipment in the maincontrol room of the plant. The completeness of thereproduction is dependent on the individual customerspecification. Some utilities specify an exact replicaincluding all back panels, lighting (including thedimming effects associated with starting large motors),flooring, and even sound effects (turbine noise, steamdumps, etc.) keyed to the opening of control roomdoors. Others require only the reproduction of thefront panels and, in some cases, not all front panelsare included.

A typical simulator in the late 1970s had an input/output (I/O) count — an indication of the amount ofsimulated control room instrumentation - of between

6000 and 8000. Today it is not unusual to have an I/Ocount of between 16 000 and 20 000. In addition tothe consoles of the main control room, the remoteshutdown panel is also replicated and located in aseparate room.

Other equipment in the plant's main control room,such as the plant process computer's integrated controlsystems and the safety parameter display systems, arealso included in the scope of simulation. With more andmore emphasis being placed on elaborate display systems,it is becoming exceedingly important to familiarize theoperators with the simultaneous display of informationon CRTs and on conventional instrumentation.

Through this extensive use of display systems, theaccuracy and fidelity of models can now be observedto a degree never before available to the trainee. Thesenew demands for accuracy and fidelity are extendingthe delivery time and consequently significantly increas-ing the cost of today's simulators.

Studies currently are under way to determine what isrealistically required to provide effective operatortraining. Are the systems necessary for plant auxiliariesoperation and surveillance on a long-term basis actuallyrequired for simulator training? What are the require-ments for training the plant operator and what otherplant personnel will be trained on the simulator? Thesequestions must be addressed by each organizationplanning to procure a full-scope, plant-specificsimulator.

The question of extent of simulation, and fidelityand accuracy, must be assessed in determining the mostcost-effective solution to providing efficient operatortraining. In making this decision it is important notto forget the primary purpose of a training simulator:that is, to provide sufficient information to the traineeto allow him to verify the normal or abnormal operationof the plant, and to allow the trainee to interact withand to observe the response, of the process to his controlactions or inaction.

Instructor's station

With increased training simulator complexity, therole.of instructor as manager of the training exercise isbecoming more and more demanding. The instructormust be able to easily and rapidly manage malfunctioninsertion, auxiliary operator functions, establish trendingdisplays, and above all, monitor the trainee's perfor-mance. To meet these objectives, the typical instructor'sstation utilizes large-screen, high-resolution, colour-graphic displays coupled with a well-developed "instruc-tor friendly" design approach. This allows the instructorto rapidly accomplish his major task of establishing thetraining scenario.

The use of time-saving, programmable function keys,cursor-controlled function selection, and micro-driveninput techniques allows the instructor to spend moretime accomplishing his primary objective of teaching.

IAEA BULLETIN, AUTUMN 1985 19

Nuclear power and electronics

Typically, an instructor's station includes the followingfeatures:• Initialization to a predetermined status• Freeze all calculations• Malfunction insertion (instantaneous or logical)• Auxiliary operator functions• Backtrack to an earlier point in the training exercise• Monitor trainee performance• Override/fail control room instrumentation• Insert spurious alarms• Fast and slow time• Computer-aided exercise programs• Control environmental conditions and other external

parameters.

In addition to the instructor's station console, a hand-held, remote-control device is provided for use by theinstructor in over-the-shoulder training. This deviceallows the instructor to control the training exercisewhile closely observing the trainee in the control room.

Primary system models

Simulator specifications issued since TMI have clearlystated the requirement to address two-phase-flow andassociated heat-transfer processes. All major simulatormanufacturers have embarked on development pro-grammes to accurately address these requirements, andtoday this new breed of advanced simulators is availableto the nuclear plant operator training industry.

For example, Link's Real Time Advanced Core andThermohydraulic Code (RETACT) is used as the nucleusof Link's advanced power plant simulators. It providesthe predictive capability of a thermohydraulic code,in addition to the entire operational ability of a trainingsimulator. A separate display system, located adjacentto the instructor's station, also provides dynamic infor-mation on all parameters needed for in-depth diagnosticsof the plant's capability to transfer energy from thereactor coolant system to the turbine or other energysinks. The model is developed with physical laws andwith basic constitutive equations that are at the samelevel as the best safety analysis codes. The results can besaid to be best-estimate results. The predictive natureof these advanced models allows operator training to adepth and realism never before available.

Major simulator manufacturers currently aredemonstrating their advanced models to potentialcustomers, and in fact, several simulators using themare already under design in Europe and the UnitedStates.

Design data base and future modifications

The fidelity in design of the plant systems modelsis dependent directly on the quality of the design database. The collection and maintenance of this data baseis a time-consuming task for both the utility and simula-tor manufacturer. This design base must be well defined,

and the simulator owner must maintain an accurate andcurrent data base on the reference plant. As changesare made to the reference plant, each change must beevaluated and appropriate modifications incorporatedinto the simulator. In turn, the simulator design database must be updated to reflect the simulator's currentstatus. Thus, a computerized configuration managementsystem is now a requirement for most simulators beingmanufactured today.

The simulator owner and manufacturer must workclosely during all phases of the project to collect andcorrelate all applicable data available on the referenceplant. When possible, actual plant operations data,including accident and emergency transients, are utilizedin the initial design. If the simulator is being designedahead of or in parallel with the reference plant, thenthe simulator must be fine-tuned after the plant comeson line. This fine-tuning is normally accomplished eitherby the simulator owner's software maintenance per-sonnel or under a separate agreement with the simulatormanufacturer.

This fine-tuning effort and future modification of thesimulation mathematical models must be easily facili-tated, in terms of understanding the models and modi-fying them without affecting the rest of the software.To accomplish this, the math models for all the varioussystems must be organized in a modular form, with aminimum of interfacing between models. A "top-down"design approach to systems modelling — where onecontrol module calls one or more code segments that inturn call various components and sub-routines -provides for this ease of future modification.

Due to the modular nature of today's design and theelaborate software maintenance tools delivered with thesimulator, most simulator owners are able to implementmost changes without the assistance of the originalmanufacturer.

Computer system

"Computer system" refers to all necessary hardwareand software for the implementation and proper opera-tion of the simulator. This includes the I/O interfaceswith the control room instrumentation.

Many simulator manufacturers are currentlyproposing Gould Computer Systems Division 32 Seriescomputers. A computer complex must have sufficientcomputing speed, memory capacity, and programmingflexibility to achieve the performance levels demanded ofthe simulator.

Typically, the system must be capable of performingthe following:• Control the simulation process• Realistically reflect real-time responses of controlmanipulations by the operator-trainee• Maintain control of all computer peripheral devicesand their intended functions• Provide sufficient digital word lengths to reflect speci-fied accuracies

20 IAEA BULLETIN, AUTUMN ,1985

Plant-specific simulators are replicas of a particular control room. Shown are the systems for the Susquehanna nuclear plant in the USA(top) and for the Ontario Hydro Bruce "B" CANDU power plant in Canada. (Credit top photo: Link SSD; bottom: CAE Electronics Ltd.)

IAEA BULLETIN, AUTUMN 1985 21

Nuclear power and electronics

From airplanes to power plants and beyond

Standing behind the development of today's sophisti-cated simulators for training nuclear-plant operators is theexperience gained in more than 50 years of simulationtechnology in the aerospace industry.

Within the past half century, flight simulation techno-logy has moved from mechanical pilot trainers to complexcomputerized systems imitating outer space missions.Before the US Space Shuttle Columbia conducted itsfirst operational mission in late 1982, for example, boththe crew and support personnel had used simulationtechnology to rehearse their respective roles from launch tolanding.

Just as their own development over the past 25 yearsevolved from past experience, modern nuclear-plant simu-lators now are leading the way for many other types ofoperator training devices in the electric power and otherindustries.

Fossil-fuelled power plants have been using sophisticatedfull-scope simulators for operator training since 1977.

Today these are located in various countries, includingAustralia, China, the Federal Republic of Germany, India,Indonesia, Republic of Korea, Saudi Arabia, South Africa,and the United States. Other types of simulators arelocated in many other countries.

Process industries are the most recent ones to utilizesimulation for operator training. The use of simulationtechnology in this industry, in fact, has gone beyond therealm of plant operator training. Today, real-time simula-tion technology is proving to be a cost-effective tool inthe design of highly complex process plants. For example,the fidelity of simulation is providing a better understand-ing, allowing the plant owner to make plant design modifications and process-control changes before or in parallelwith the actual plant construction and start-up phase.In several cases, the savings in equipment cost andstart-up time have more than recovered the cost of thesimulator.

Experience gained in nuclear-plant simulation has helped develop simulation systems for other industries, such as the oneshown here for a gas processing plant. (Credit: Link Simulation Systems Division)

22 IAEA BULLETIN, AUTUMN 1985

Nuclear power and electronics

• Provide sufficient input/output transfer rates and mathmodel iteration rates so the simulated plant responsesobservable in the control room are not readily discerniblefrom those in the real plant• Support software system maintenance and programmodifications activity through appropriate language ;processors and support programme• Support background processing functions concurrentwith simulator operations, subject only to resource andtime availability• Provide sufficient spare time and memory (or expan-sion capability) to accommodate future modification.

A typical Gould computer complex would include,as a minimum, a dual 32/97 Series computer; a line :printer; CRT display terminals; 300-MB disc drives;75-IPS magnetic tape units; and a 1000-CPM card reader.

Developments in the computer field are occurring sorapidly that, quite often, by the time the simulator is ;delivered, its computer is at least one generation behind

the current state-of-the-art. Therefore, the portabilityof the software has become an extremely importantpart of the simulator's design. Several areas now receiv-ing additional attention in the design of a portablesystem are the utilization of the computer vendor'soperating software without modification, programmingtotally in a high-level language, and the use of structureddesign and programming.

Malfunctions

Malfunctions are defined as a failure or degradation inperformance of plant components and may be groupedinto two types: generic malfunctions, and system-specific malfunctions. Generic malfunctions covermost plant components such as pumps, valves, heatexchangers, regulators, etc., while system-specificmalfunctions include fuel leakage, condenser tube leak,pipe breaks, etc.

Trends in nuclear simulation

In the nuclear industry, the first two nuclear plantsimulators were built in 1957 almost in parallel with eachother. The first to be completed was in the UnitedKingdom for training operators for the Calder Hallmagnox station. The second was for the nuclear merchantship Savannah. Both of these simulators could be referredto as a replica simulator, since each faithfully duplicatedthe control room of the actual plant. In fact, the Savannahsimulator was capable of being used to perform engineer-ing studies of the ship's propulsion system.

Today's types range from basic-principles trainers tofull-scope, plant-specific simulators, providing a full rangeof training devices for students with no practical experi-ence, as well as those with many years of actual operationsexperience.

Basic-principles trainers are intended to provide afundamental understanding of the cause and effectrelationship between systems of a nuclear power plant.It is becoming a well-accepted fact that initial training ofoperators and support staff can best be accomplished onthis type of conceptual simulator. Learning the conceptsbehind the operation of a nuclear plant is easier for theinexperienced trainee when he is not overwhelmed by 'the details of a replica control room. Once the basicprinciples have been learned and fundamental operating'skills have been acquired, the operator can confidentlymove up to training on a replica simulator.

The full-scope, plant-specific simulator provides areplica of the reference plant control room. The fidelityof simulation of plant systems is such that an experiencedoperator should not be able to detect any difference inoperation of the simulator or the actual plant. Theaccuracy of the simulation is well defined, with criticalparameters and associated tolerances clearly specified. .

Between these two types of simulators lies an entirespectrum of training devices for nuclear plant operatorsand support staff.

Simulators in use

According to IAEA reports, conceptual simulationbased on small mini-computers that do not representevery system detail are becoming a new training tool.About one dozen of these simulators are now in use.

More clearly, there is an increasing trend toward plant-specific simulators. About 100 full-scope nuclear powerplant simulators for training are now in use or underconstruction worldwide, the IAEA estimates.

In Czechoslovakia, the training centre of the NuclearPower Research Institute uses a domestically producedVVER-440 simulator. It is the most advanced simulatorin Member States of the Council for Mutual EconomicAssistance (CMEA) and allows simulation of normaloperations, anticipated occurrences, and accidentconditions.

One of the world's most complex nuclear-plant simu-lators has been put into operation at the training centrefor the Hunterston-B advanced gas-cooled reactors in theUnited Kingdom. It uses 52 microcomputers in a parallelprocessing mode, with a combined directly accessiblememory of over 10 megabytes.

Work also has been completed on a French multi-purposefunctional analysis simulator that can simulate normaloperations and complex accident scenarios in real time.It can be used for system design and development ofoperating procedures, but its strongest point is accidentsimulation. The effects of an accident on the whole plantare shown along with several possible courses of action.

Although simulators have traditionally been used fortraining personnel and developing operating procedures,they also can be a valuable research tool. This has beendemonstrated in the validation of an advanced safetyparameter display system for the Loviisa nuclear plant inFinland.

IAEA BULLETIN, AUTUMN 1985 23

Nuclear power and electronics

The American National Standard for Nuclear PowerPlant Simulators for Use in Operator Training requiresa minimum of 75 malfunctions to demonstrate inherentplant responses and the functioning of automatic plantcontrols. In addition, the standard also requires thatthe fidelity of simulation must allow the operator totake action to recover the plant or mitigate incidentconsequences and return the plant to a reasonableoperating condition.

Today's simulators far exceed these minimum require-ments, having the capability to simulate the failure ofalmost every component in the plant, resulting in manyhundreds of malfunctions. These generic and system-specific malfunctions, coupled with the instructor'scapability to fail each item of control room equipment,leads to a virtual cornucopia of malfunction scenarios.

A joint venture

To summarize, the typical full-scope, plant-specificsimulator being manufactured today is truly a jointventure between owners and suppliers. From initialdata collection efforts through final verification testing,a close working relationship is established and strongteam spirit is developed. The ever increasing complexityof the simulator demands this close relationship, andthe quality of the final product benefits heavily fromthis co-operation.

We must not lose sight of what the real purpose of atraining simulator is and how the various trainingdevices — from part-task trainers to full-scope, plant-specific simulators — can best be utilized in an integratedtraining programme.

.'4 IAEA BULLETIN, AUTUMN 1985