Generelle referanser Desember 2012

Transcription

1 Generelle referanser Desember 2012

2 ~)AEN t_lj NEA Le Directeurgeneral The Director-General Agence de l'ocde pour lenergie nucleaire OECD Nuclear Energy Agency Dr. Kjell BENDIKSEN Managing Director Institute for Energy Technology P.O. Box40 N-2027 Kjeller NORVEGE Issy-les-Moulineaux:, 18 February 2008 Subject: OECD Halden Reactor Project Dear Mr. Bendiksen, I would like to irifonn you that the NEA was recently contacted by the Committee established by the Norwegian Research Council upon the request from your government, for the purpose of evaluating the nuclear reactor based activities of the Institute for Energy Technology (lfe). Their specific interest was to receive input regarding the impqrtance of the Hill den reactor for the nuclear community, and to this end a meeting was held at the NEA Headquarters on 24th January of this year. The answers to the questions that were raised by the Committee are summarised in a document to be issued by the Committee. One of the issues that were addressed during that meeting relates to the Halden Project function of maintaining technical competence arid expertise in the OECD member countries. You might recall that the NEA Steering Committee has recently issued a statement concerning the.. government role in ensuring qualified human resotirces in the nuclear field. This statement considers that governments should encourage large, high profile, international R&D programmes which attract students and young professionals to become the nuclear experts requited for the future. The NEA believes that the Halden Reactor Project,. through the so-called "secondee'' arrangements and its continuous generation and dissemination of R&D findings regarding nuclear safety, especially fuel behaviour and human factors, has a prominent role in maintaining and developing nuclear expertise in OECDINEA member countries. During almost fifty years, this OECD project at the Halden reactor has been a key factor for enhancing nuclear safety and fonning specialists in this field for the 20 participating countries as well as for other countries. We hope that this essential role will be kept in the future. I believe this point is very important and should be brought to the attention of the Norwegian authorities as you deem appropriate. Looking forward to the celebration of the Halden Project 501h anniversary. Yours sincerely;. cc. Delegation of Norway to the OECD Luis E. Echavarri Director-General Le Seine St-Germain, 12.boulevard des lies, lssy-les-mouliruaux, France Tel. -~;33 (0)1 4~ Fax +33 (0) ~

3

4 Institutt for energiteknikk OECD HALDEN REACTOR PROJECT HP-1303 HALDEN REACTOR PROJECT PROGRAMME Proposal for the Three Year Period November 2011

5

6 HP-1303 PROGRAMME PROPOSAL FOR THE HALDEN REACTOR PROJECT FOR THE PERIOD This document contains a proposal for the programme to be carried out in the period aimed at promoting participants interests on safety and reliability of nuclear power plants. It is based on the guidelines given by the Halden Board of Management, discussions in the Halden Programme Group, input and feedback from member organisations, and a priority survey conducted on the draft programme proposal. In formulating the plans, account has been taken of the continuity which is necessary to complete programme elements already started in the period, and long term activities and priorities are balanced with the requirement to develop short-term deliverables. Fuel and Materials Programme The Fuel & Materials experiments rely on facilities able to produce a variety of test conditions and coolant environments, and on reliable in-reactor measurement capabilities. These facilities are continuously being upgraded and expanded. This relates in particular to loop systems in which testing can be performed under a variety of well-defined pressure, temperature, water chemistry and irradiation conditions. The proposed programme comprises: Ch. 1 Fuel Safety and Operational Margins Provide basic data on fuel and cladding performance in a variety of operation conditions, including under normal operation, in demanding environments and in transient/accident conditions. As extended fuel utilisation remains an industry priority, emphasis is on fuel behaviour and properties after prolonged in-core service and at burn-ups in excess of current discharge levels, making extensive use of re-fabricated, instrumented commercial fuels. Ch. 2 Plant Ageing and Degradation Address radiation induced failure, embrittlement, creep/stress relaxation and corrosion processes which are active in in-reactor component materials, aiming at generating validated data on materials properties and stress corrosion cracking behaviour under representative stress conditions and water chemistry environments. Ch. 3 Contribution to International Gen-IV Research Develop instruments able to withstand Gen-IV reactor concept conditions, and study the corrosion behaviour of novel materials or materials with novel surface treatments. Ch. 4 Programme Basis, Fuel and Materials Research Describes the design and fabrication capabilities, in-core instrumentation, irradiation and inspection facilities, and data acquisition and analysis.

7

8 HP-1303 Man-Technology-Organisation (MTO) Programme The MTO research programme proposal is based on work carried out in previous programme periods, experiences- and lessons learned obtained as well as input from member organisations. The competence and infrastructure available for MTO research at the Halden Project is well suited to answer questions related to human factors and digital systems for existing and new reactors both in the short and longer term perspective. The proposed programme comprises: Ch. 5 Human Factors Research for Existing and New Reactors Human Reliability Analysis (HRA) is a significant issue in probabilistic risk/safety assessment (PRA/PSA). The HRP research on HRA aims at advancing and sharing knowledge on control room crews emergency response. Human and organisation factors will further address cultural issues, control room staffing and roles during emergency situations including improvements of training. Human-System Interfaces (HSIs) address design concepts and implementation issues relevant to the development and deployment of current and future HSIs. Control centre design and evaluation aim at establishment of best-practices and the use of knowledge-based technologies to evaluate 3D virtual prototypes of control centre designs. Integrated System Validation (ISV) activity focuses on establishing acceptance criteria regarding human performance in new control rooms. Outage and field work covers activities in the control centre as well as for field operators at the plant or at remote locations. The topics are collaborative HSI technologies to support teamwork in outage management and radiation visualisation including the use of ubiquitous computing to support field operators during maintenance activities. Future operation concepts concerns highly automated plants, e.g. the challenge of establishing a good functioning joint human-automation team. Ch. 6 Digital Systems Research for Existing and New Reactors Contribute to the introduction of digital I&C systems. Software systems dependability aim at providing lessons learned and recommendations on processes, methods, techniques and tools for the different life cycle phases of software important to safety. Condition monitoring and maintenance support will focus on accuracy and usability improvements of current methods and on the development of novel techniques to better support diagnostic activities and condition-based maintenance strategies. Operational support will comprise selected topics of advanced control and computerised assessment of procedures. Ch. 7 Programme Basis, MTO-Research The MTO-lab consists of HAMMLAB, Virtual Reality Centre, IO-lab for remote collaboration studies, and FutureLab to investigate futuristic operational concepts. The overall objective is to maintain and further develop the laboratories of MTO-lab to meet requirements of the programme.

9

10 HP-1303 CONTENTS INTRODUCTION TO THE FUEL & MATERIALS PROGRAMME PROPOSAL...1 OECD HALDEN REACTOR PROJECT PROPOSAL FOR THE THREE YEAR PERIOD NOVEMBER FUEL SAFETY AND OPERATIONAL MARGINS Studies Related to Gas Release under Irradiation Thermo-mechanical Studies Fuel Behaviour under Accident Scenarios Fuel Behaviour under Demanding Operation Conditions Innovative Fuels and Claddings PLANT AGEING AND DEGRADATION Irradiation Assisted Stress Corrosion Cracking Irradiation Enhanced Creep and Stress Relaxation Pressure Vessel Integrity Study CONTRIBUTION TO INTERNATIONAL GEN-IV RESEARCH Instrument Development Material Testing PROGRAMME BASIS, FUEL AND MATERIALS Design and Fabrication Capabilities In-Core Instrumentation Irradiation Facilities Inspection and PIE Facilities Data Acquisition and Analysis Experiment Supervision INTRODUCTION TO THE MTO PROGRAMME PROPOSAL HUMAN FACTORS RESEARCH FOR EXISTING AND NEW REACTORS Human Reliability Human and Organisational Factors Human-System Interfaces Control Centre Design and Evaluation Outage and Field Work Future Operational Concepts Halden Project use only THE INFORMATION CONTAINED IN THIS REPORT IS TO BE COMMUNICATED ONLY TO PERSONS AND UNDERTAKINGS AUTHORISED TO RECEIVE IT BY ONE OF THE ORGANISATIONS PARTICIPATING IN THE OECD HALDEN REACTOR PROJECT IN ACCORDANCE WITH THE PROJECT S RULES FOR COMMUNICATION OF INFORMATION 6 DIGITAL SYSTEMS RESEARCH FOR EXISTING AND NEW REACTORS Software Systems Dependability Condition Monitoring and Maintenance Support Operational Support PROGRAMME BASIS, MTO RESEARCH The MTO laboratories Maintenance and Operation of the MTO Laboratories... 66

11

12 - 1 - HP-1303 INTRODUCTION TO THE FUEL & MATERIALS PROGRAMME PROPOSAL Forecast Nuclear power for electricity generation is well established world-wide. Although its deployment has stagnated in Western Europe and the US since the mid 1980s, nuclear capacity has been expanding in Eastern Europe and Asia. Indeed, globally, the share of nuclear in world electricity has remained constant at around 16% since the mid 1980s, with output from nuclear reactors actually increasing to match the growth in global electricity consumption. Today, nuclear power is regarded as a viable option contributing to curbing carbon emissions. Projections for global new build are similar to or exceeding those of the early years of nuclear power and with 50 reactors being built around the world today, another 130 or more planned to come online during the next 10 years, and over two hundred further back in the pipeline, the global nuclear industry is clearly going forward strongly. A prerequisite for this advance is continued public acceptance of nuclear power which is conditional on high levels of safety throughout the industry. Greater demands for nuclear power plant (NPP) safety can thus be expected, including the ability to demonstrate acceptable fuel behaviour under accident scenarios. Many countries are either considering or have already decided to now make nuclear energy part of their power generation capacity. However, most of the expansion of nuclear power is likely to be in countries that already have installed capacity, seeking either to replace old reactors or increase capacity by investing in lifetime extensions as well as up-rates for existing plants. In fact one of the reasons for the lack of new build in the USA to date has been the successful evolution in maintenance strategies. Over the last 15 years, changes have increased utilisation of US nuclear power plants, with the increased output corresponding to 19 new 1000 MW plants being built. Given the time and investment required to replace existing ageing reactors, there will continue to be much focus on methods of maximising useful plant life by studying long-term performance and structural integrity of NPP components. Materials degradation and ageing issues will need to be addressed through improved understanding of materials properties, corrosion mechanisms, water chemistry interactions, and plant operation and management practices. In addition, plant capacity, reliability and availability can be improved by increasing fuel utilisation. A prerequisite for this is the availability of high performance, reliable fuel able to withstand an aggressive corrosive, high temperature, radiation environment. The determination of fuel safety and operational margin for all types of fuels that will be loaded in reactor cores for the foreseeable future will thus remain a focus, including under demanding operation conditions. Many of the issues connected with nuclear power nuclear safety, increasing energy demand, energy security and climate change - are global in dimension. Consequently, the nuclear industry is moving away from small national programmes towards global cooperative schemes. This is nowhere more evident than in the field of future reactor designs, the so-called Generation IV concepts. It is expected that research in this area will move more from the theoretical towards the practical over the coming 10 years or so.

13 - 2 - HP-1303 Role of the Halden Reactor Project As an OECD-NEA project, built on international collaboration, the HRP is well placed to continue and strengthen its role of addressing nuclear fuels safety related issues and contributing to the understanding of materials degradation and ageing for the global nuclear industry. Overview of the Programme Proposal The HRP fuels programme aims to determine fuel safety and operational margins for use in design and licensing by studying: o o o o gas release behaviour from fuel under irradiation fuel thermo-mechanical behaviour under irradiation fuel behaviour under accident scenarios fuel behaviour under demanding operation conditions The HRP materials programme aims to contribute to the knowledge of plant ageing and degradation for lifetime extension by: o o o o extending the materials database on crack initiation and growth behaviour contributing to the understanding of IASCC behaviour studying irradiation induced changes in component mechanical behaviour determining the effectiveness of ageing and degradation countermeasures By continuing to develop its experimental capabilities, the HRP aims to contribute to international GEN-IV research by: o o developing instruments able to withstand GEN-IV reactor concept conditions studying the corrosion behaviour of novel materials or materials with novel surface treatments Programme Basis The programme is built on existing Halden experience and capabilities to produce a variety of test conditions and coolant environments while making reliable in-reactor measurement in order to study phenomena online and in-situ. Areas for continuing development in order to provide an improved service include: o o o o Strengthening test quality to meet the challenge of more complex experiments Increasing instrumentation robustness for higher expectations Increasing the number of in-reactor water loop systems for testing under a variety of well-defined pressure, temperature, water chemistry and irradiation conditions Enhancing core performance with higher neutron flux

14 - 3 - HP-1303 o Increasing reactor availability Both as-manufactured fuels and materials and those that have accumulated relevant burn-ups and neutron fluences in commercial nuclear power stations will be utilised for the programme. Further, an integrated approach to testing will be used whereby fuel from the same source is studied under different conditions in different types of experiments. This enables a more complete knowledge of fuel performance to be obtained. Overall schedule The accompanying figure shows the overall schedule for the experiments planned for the period. These include those that are carried over from the previous, , period, and those that are planned to be started during the current period. For simplification, each experiment is divided into three main phases: preparation, irradiation and PIE/reporting.

15 - 4 - HP-1303

16 - 5 - HP FUEL SAFETY AND OPERATIONAL MARGINS Competitive electricity generation from nuclear power requires the availability of high performance fuel with high burn-up capabilities and reliability in accord with zero failure. While the operational performance of nuclear power plants has improved considerably in recent years, with the introduction of extended operational cycles, increases in discharge burn-up and power up-rates, operational experience shows that unforeseen deviations from normal fuel performance do occasionally occur in some conditions. Such deviations can limit plant operation or even lead to premature shutdown to discharge the affected fuel. Remedies have involved fuel design modifications, new materials or changes to water chemistry aimed at improving fuel reliability in a variety of demanding service conditions. The success of these approaches is evidenced by the decreasing trend in fuel failure rates across the industry over recent times. However, with an increasing demand for nuclear power to be competitive, it is likely that fuel will be increasingly challenged, and it remains vital that the mechanisms responsible for challenging the fuel, and potentially weakening the cladding during exposure, are well understood. Increased utilisation of fuel provides challenges not only for normal operation, but also in safety transients. It is therefore essential to establish a knowledge base for safety assessments and to demonstrate the capabilities of high exposure fuel in off-normal situations. Since such situations are undesired and extremely rare by definition, the related database must be obtained by dedicated investigations conducted in test reactors in light of envisaged technical solutions and the complementary work planned in hot laboratories. In-reactor experiments should focus on issues that are essential to safety and that cannot otherwise be resolved. Qualified models and codes are required in order to define the condition and properties of the fuel before the safety transient or accident scenario. There is therefore consensus among HRP participants to continue experimental activities with the objective of generating new and improved data on fuel properties and fuel behaviour in the entire burn-up range, under relevant operational conditions and utilising fuel materials representative of the current and near-term expected industry standard. The programme proposal described in the following sections is structured according to the following themes: 1.1 Gas release under irradiation fission gas release behaviour, gas inventory increase, tolerable rod overpressure 1.2 Fuel thermal and mechanical performance - conductivity degradation, densification, swelling, fuel creep, pellet-clad-mechanical-interaction (PCMI) 1.3 Fuel behaviour under accident scenarios - loss of coolant accident (LOCA) 1.4 Demanding operation conditions - power transients, PCMI, cladding transient creep, cladding corrosion and hydriding 1.5 Innovative fuels and claddings studies dependent on supply of materials from participants These investigations relate to fuels in use in light water reactors (PWR, BWR, VVER), i.e. standard UO 2, MOX, Gd and Cr bearing UO 2 fuel pellets and M5, ZIRLO, E110 and M-MDA fuel cladding as well as Zr-4 and Zr-2. It will be the aim and task of proper data evaluation to utilise all these experiments for gaining an understanding of fuel performance which is as complete as possible to understand and predict fuel behaviour under normal and challenging conditions. An overview of all fuel and cladding experiments in the period is given in the accompanying figure.

17 # of rods in experiment # of rods in series temperature pressure clad elongation fuel elongation gas flow clad diameter EIS thermal fission conductivity gas release densification, fuel swelling creep PCMI clad creep Clad corrosion loss of coolant HP-1303 FUEL SAFETY AND OPERATIONAL MARGINS OVERVIEW OF FUEL AND CLADDING EXPERIMENTS MEASUREMENTS APPLICATIONS fuel types or cladding materials Target burnup MWd/kg oxide comments progr. section UO 2, UO 2 +Gd, UO 2 +additives x x x Integral fuel performance MOX (disk fuel) x x MOX helium release UO 2, MOX (disk fuel) x x Rim fuel properties UO 2 (disk fuel) Rim fuel burnup extension UO 2 + MDA / Zirlo () 1 x x x x x Tolerable rod pressure UO 2, UO 2 +BeO, UO 2 +additives x x x Fission gas release mechanisms UO x Conductivity degradation/recovery UO 2, UO 2 +add., UO2+Gd, MOX x x Fuel creep % Gd / 8% Gd / UO x x x x Gd fuel performance % Gd / UO 2 (VVER) x x x x VVER fuel performance UO x x LOCA test series, iodine release M5, M-MDA, Opt. Zirlo, E110- M x x Cladding creep Opt. Zirlo, M5, MDA, others x Cladding corrosion Zry-2, Zry x On-line clad corr. measurement UO 2, UO 2 +additives x x x x Power cycling, load follow

18 - 7 - HP Studies Related to Gas Release under Irradiation Motivation and background Fission gas release (FGR) and rod pressure increase contribute to limitations of fuel utilisation in LWRs imposed by safety criteria. FGR is linked to and influences fuel temperatures and therefore has a feedback on a number of phenomena. Data starting at zero burn-up are required for new types of fuels, e.g. fuels with additives and modified morphology, and also for Gd-fuel where high concentrations of Gd (>8%) are desirable for application in extended cycle core loading strategies. At the same time, more FGR data for high burn-up fuels are needed for fuel behaviour code qualification and to improve their capability to predict steady state operation and transient release. In addition to general release from the matrix, the contribution of release from fuel with high burnup structure is of special interest. The implications of end-of-life gas inventory on cladding strain and integrity are also issues that need to be investigated. A number of participating countries are burning MOX fuel in their reactors as part of their fuel cycle strategy. MOX fuel has to obey the same safety standards as UO 2 fuels and has to be compatible with the overall operational requirements. Fission gas release is a particular issue for MOX fuel due to the higher power at end-of-life compared to UO 2 fuel. The resulting rod pressure concern is amplified by the production and release of helium. In addition to fission gas release, helium release can contribute to as much as 30% of the pressure increase and is therefore an important consideration in safety analyses. Workscope These issues have been, and will continue to be, studied in a number of experiments carried out in the Halden reactor within the Joint Programme. Many of the tests related to fission gas release will be designed and instrumented in a manner that will provide concurrent data on fission gas release as well as thermo-mechanical properties, and the Project has the capabilities for conducting tests designed both for transient release studies as well as thermal release. Participating organisations contribute to these tests with delivery of fresh, production line and laboratory fuels as well as fuels with high burn-up retrieved from commercial nuclear power stations. The designs of the irradiation rigs are based on successful long-term fuel irradiation experiments with a variety of instrumentation, such as fuel thermocouples, fuel stack or cladding elongation detectors and rod pressure transducers. The instruments provide essential data for the phenomena to be addressed. The ability to re-fabricate and instrument fuel from commercial reactors has been an essential part of the Project s activities for years, and the tests proposed for the next 3-year programme will rely on the continued utilisation of such fuels. The experiments related to gas release under irradiation considered for the next programme period are indicated in the following paragraphs. Integral fuel performance studies have the objective to produce experimental data for understanding and modelling of high burn-up fuel behaviour by the concurrent measurement of temperature, fission gas release and PCMI in controlled power transients and steady state conditions. Such studies have in previous programme periods been carried out using IFA-629 and IFA- 700, and now IFA-720, where both MOX and UO 2 fuels were utilised.

19 - 8 - HP-1303 These investigations relate to fuels in use in light water reactors i.e. standard UO 2, MOX, Gd-bearing UO 2, and possibly innovative fuels if available. In this context, it is important to note that the associated experimental rigs are designed for several loadings, and this feature will be used to address the same issues for different types of fuel either irradiated in commercial NPPs or from other irradiation tests in the Halden reactor where medium to high levels of burn-up have been accumulated. A MOX He release test has the objective to understand the helium release and retention capability of MOX fuel under irradiation conditions in terms of influential variables such as temperature, microstructure, rating and burn-up. The experiment, already described in White Paper HWhP-015, employs disk fuel which has the advantage that larger quantities of fuel are exposed to the same conditions. Fuel temperature, stack elongation, rod pressure and gas composition are parameters to be controlled and/or monitored. The latter will be measured with a specially designed Helium detector (gas conductivity monitor). Given the availability of MOX fuel for this irradiation, the test is planned to start irradiation in 2013 with the aim to continue through the programme. An ultra-high burn-up irradiation experiment, utilising rods of fuel disks previously irradiated in IFA- 655, has the objective to study fission gas release of high burn-up structured (HBS) fuel subjected to a relatively fast power up-rating. Two UO 2 rods and two MOX fuel rods, irradiated to burn-ups of ~120 and 110 MWd/kg respectively, are available for the first set of these tests, which are due to start already in the current program period. Two other rods of the same design are currently being further irradiated to a target burn-up of ~200 MWd/kg. These rods will be available for re-fabrication and testing in the same manner as the other four rods. Hot lab PIE (micro structure, density, conductivity) is another option for utilising the segments after irradiation. The cladding lift-off experiments at Halden have been carried out for many years and provide direct and convincing data on maximum tolerable rod overpressure. The objectives are to determine the maximum P above system pressure to which fuel rods of different designs (PWR, BWR, VVER) and types of fuel (UO 2, MOX) can be operated without causing lasting/continuous fuel temperature increase and thus a potential threat to rod integrity. Cladding elongation is also monitored allowing the state of PCMI during the test to be determined. In addition to lift-off data, the tests are designed to produce data on axial gas communication within high burn-up fuels. The influence of filler gas (Ar/He) and gas pressure on steady state and dynamic fuel thermal response can also be studied. Fuels envisaged to be tested in the programme will focus on different cladding types with different creep resistance/strength and possibly a long-term test where the fuel is subjected to overpressure until cladding failure. Fission gas release from standard, large grain, gadolinia and chromia fuels as well as BeO bearing fuels will be studied through a range of burn-up in several experiments started from fresh fuel. Deliverables Data on fission gas release will be obtained by:

20 - 9 - HP-1303 In-pile rod pressure measurements Measurement of radioactive fission gas release from sweep gas experiment(s) Post irradiation examination - gas volume and analysis, ceramography Specialised PIE performed as appropriate at participants laboratories The proposed programme aims at: Extending the data base of on-set and kinetics of FGR in LWR fuels Studying the effects on FGR of fuel rod variables additives, burnable poison, innovative fuel types, fill gas pressure Studying the effects on FGR of operational conditions temperature, power, power cycling/load follow and burn-up Exploring the production and release of helium in MOX fuel rods Expanding the data base on the consequences of long and short term operation with rod overpressure as well as the influence of cladding type, burn-up level (extent of fuel-clad bonding) and operational parameters (e.g. load or temperature changes) Studying gas release behaviour of fuel or fuel samples with well developed high burn-up structure 1.2 Thermo-mechanical Studies Motivation and background The development and utilisation of new fuels, whether derived from standard fuels or of completely different pedigree, requires a thorough knowledge of in-core properties and performance. Well qualified data obtained from carefully controlled experiments are needed for modelling and safety assessment purposes. Excluding gas release behaviour (covered in Section 1.1), the aspects that need to be known about are: Fuel thermal conductivity Pellet cladding mechanical interaction Fuel swelling / rod growth Fuel creep Fuel with gadolinia as a burnable poison is being used or considered in all types of light water reactors and has thus featured in many experiments performed at Halden and will continue to do so here considering its quite different densification and swelling behaviour at beginning of life compared to that of UO 2 fuel. Workscope The interactions between the different phenomena which develop in a fuel rod during irradiation are complex. In order to obtain a better understanding of the overall fuel performance, the proposed programme contains separate effects tests, experiments dedicated to certain fuel types, and integral performance tests on re-fabricated segments. Many of the experiments are also linked to fission gas

21 HP-1303 release described separately in Section 1.1, and all make extensive use of in-core instrumentation such as fuel thermocouples, rod pressure transducers and fuel stack elongation sensors. These instruments typically give reliable data throughout irradiation histories of five years or more. Some experiments initiated in previous programme periods will continue on into and be completed within that timeframe, giving room for new experiments of this type. The experiments related to fuel thermal and mechanical performance considered for the next programme period are indicated in the following paragraphs. Fuel thermal conductivity degradation and recovery mechanisms are proposed to be studied in a separate effects test including innovative fuel types as available. Fuel thermal conductivity is an essential materials property required for modelling of fuel behaviour. The change of this property due to burn-up has been the subject of extensive research, but open questions remain. One of them regards the mechanisms active in out-of-pile fuel thermal conductivity recovery in irradiated fuel samples observed in conjunction with laser flash measurements, and whether they could affect inpile behaviour during normal operation and transients. The concept of the proposed experiment is described in White Paper HWhP-033. Fission induced fuel creep will continue to be studied in a separate effects test, initiated in the current 3-year programme (White Paper HWhP-010) and planned to continue into the period. The creep of UO 2 and MOX fuels under irradiation has been shown to be a function of the applied stress and fission rate per unit volume, but independent of temperature below about 1000 C i.e. fuel periphery temperatures. This is of particular interest in relation to PCMI, and the creep behaviour of MOX fuel and gadolinia fuel will be investigated as a function of applied stress. Gd-fuel behaviour will continue to be investigated in experiments dedicated to this fuel type. A comparative irradiation test (IFA-681) already started in a previous programme period will continue into the next in order to reach the target burn-up of about 50 MWd/kg (UO 2 rods) with PIE and higher power operation (in a dedicated test rig) planned in order to study PCMI (and fission gas release as indicated in Section 1.1). Densification and swelling at beginning of life, which differs from UO 2 fuel behaviour, will be studied in a new test specifically designed to study the phenomenon. The proposed test set-up is a fuel disk type of irradiation, with a test matrix to study fuels of varying Gd content at varying irradiation temperature and power / fission rate. Available Gd-bearing fresh fuel pellets at HRP are 2 wt%gd, 5 wt% Gd and 8 wt%gd. Fuel disks enable testing with well controlled and well-defined fuel power and temperature while monitoring fuel stack length change. VVER fuel behaviour will continue to be studied in an experiment dedicated to this fuel type. A comparative irradiation test already started in a previous programme period (IFA-676), containing standard VVER fuel and fuel with additives, will continue into the next period in order to reach the target burn-up of about 60 MWd/kg (UO 2 rods) with emphasis on thermal performance excluding FGR. After the target burn-up is reached, PIE and higher power operation (in a dedicated test rig) are proposed to study PCMI (and fission gas release as indicated in Section 1.1). The thermal behaviour of modified fuels is investigated in an experiment that commenced in 2010 (IFA-716) that will continue throughout the next programme period. Of special interest is the thermal performance of beryllium oxide in a UO 2 matrix resulting in improved (higher) thermal conductivity

22 HP-1303 and thus lower fuel temperatures. The experiment is also mentioned in Section 1.1 on fission gas release which is the main issue to be studied with the other rods in this irradiation test. Integral fuel performance studies described in Section 1.1 will also yield data on fuel temperatures and PCMI. Candidate fuel for testing in this series is Gd-fuel with a burn-up of about 50 MWd/kg. The cladding lift-off experiments described in Section 1.1 are also designed to produce data on fuel temperature, fuel swelling and axial gas communication within high burn-up UO 2 and MOX fuels. Deliverables Thermo-mechanical data will be obtained by using the following in-core instrumentation in selected combinations: Fuel thermocouples Cladding extensometers Fuel extensometers Bellows pressure transducers In most tests, the fuel segments will be equipped with multiple instruments to study the interrelation between the various performance parameters. The in-pile measurements and results will be complemented with post irradiation examinations at the Kjeller hot cell laboratories, and also by specialised PIE at participants laboratories as needed. The planned investigations and analyses will: Expand the database of fuel thermal conductivity and its degradation with burn-up Expand the database of PCMI behaviour at different exposures Provide new performance data on modified and innovative fuel Generate more data on the behaviour of production line gadolinia fuel Generate more data on the behaviour of VVER fuels Provide long term measurements on PCMI behaviour and rod growth rate due to fuel swelling and fuel-clad bonding Produce direct measurements of in-pile creep of UO 2, MOX and Gd-fuel This will be achieved by using fresh fuels as well as irradiated and re-fabricated fuel segments from PWR, BWR and VVERs, 1.3 Fuel Behaviour under Accident Scenarios Motivation and background The introduction of new cladding materials and, in particular, the move to higher burn-up has generated a need to re-examine the safety criteria for loss-of-coolant accidents and to verify their continued validity. As part of international efforts to this end, the Halden Project has implemented a LOCA test series to study the integral in-reactor fuel behaviour under expected and bounding conditions.

23 HP-1303 The Halden reactor is suited for integral in-pile testing of fuel behaviour under LOCA conditions using single fuel rods. The decay heat is simulated by a low level of nuclear heating which produces a temperature distribution in the fuel rod similar to the real case. Thus a more correct differential fuel-cladding thermal expansion is obtained compared to out-of-reactor tests where the cladding is heated from outside and more than the fuel. Ø 34 Flask Heater cable Heater T/C The objectives of the HRP LOCA test series and the test execution conditions were defined in close cooperation with the HPG and individual member organisations as: Ø 26.5 / Ø 9.5 rod Ø 20 heater Schematic cross section of fuel pin, heater and pressure tube used in HRP LOCA studies 1. Measure the extent of fuel (fragment) relocation into the ballooned region and evaluate its possible effect on cladding temperature and oxidation. 2. Investigate the extent (if any) of secondary transient hydriding on the inner side of the cladding above and below the burst region. Nine tests with irradiated fuel segments (burn-up MWd/kg) from commercial NPPs have now been carried out. The fourth test of the series caused particular attention since the fuel used in the experiment (92 MWd/kgU) experienced substantial fragmentation and dispersal at temperatures far lower than entailed by the current 1200C / 17% ECR limit. This feature of strong fragmentation and dispersal potentially present in high burn-up fuel was corroborated by another test with sibling fuel. Different degrees of contamination of the loop system employed in the series were observed from test to test. A procedure has been implemented to quantify the amount of iodine released after ballooning and burst since the source term is important for evaluating the consequences of a LOCA. A continuation of the HRP LOCA test series will aim to provide answers to the original objectives as well as new questions arisen from the tests carried out so far: When do fuel relocation and fuel dispersal occur and when can they be excluded? Effects of burn-up, rod pressure, and corrosion (hydrogen) on integral fuel behaviour during LOCA Quantification of the source term (iodine release) Workscope It is mandatory to utilise fuel rods irradiated in commercial reactors to relevant burn-ups with a thorough characterisation regarding the state of the cladding and the bonding with the fuel. Participating organisations have made available both PWR, BWR and VVER fuel with the desired characteristics of which all four segments with burn-up >80 MWd/kg have been used. Out of two further segments committed to LOCA testing (72-73 Mwd/kg burn-up from Leibstadt BWR (KKL)), one remains for testing in the programme period. In addition, at least two rods with MWd/kg burn-up currently stored at Studsvik can be made available. Participants have also

24 HP-1303 expressed an interest in testing MOX fuel in the HRP LOCA series, but suitable fuel has yet to be identified and made available. Experience shows that about three LOCA experiments can be executed in a three years period, including the necessary refabrication work before and PIE after the in-reactor part. The Halden LOCA series is expected to include both bounding conditions and industry representative conditions. The latter category includes the break of a recirculation pump as the limiting design base accident for a BWR 6 (e.g. KKL). Calculations according to Appendix K of 10CFR50 show low values for cladding temperatures and low oxide thickness on the assumption of no fuel relocation. However, it is an open question whether fuel fragmentation and relocation can also occur without burst, just as a consequence of heating up the fuel and loss of constraint by the cladding. It is proposed to continue to address the issue with the second of two high burn-up rods from KKL. In the first run, the rod was brought to ballooning, with the aim of avoiding failure, but the segment failed shortly after the test was terminated (by reactor scram). In the second run, the rod will be exposed to the same conditions and allowed to balloon with the aim to avoid burst. After LOCA, the rods are transported to the IFE Kjeller hot lab to continue the investigation of hydrogen distribution in the balloon area in conjunction with fuel relocation a question which has not been answered satisfactorily by the high PCT tests conducted so far. Due to their implication for safety regulation, the Halden LOCA tests have also been discussed extensively in the NEA-CSNI context by the Working Group on Fuel Safety (WGFS). Among others, their recommendations include: Determine the impact of axial gas transport on ballooning, e.g. by including a spacer grid between the upper plenum and the balloon area that would act as a prototypical distension restriction and cooling improvement similar to what can be expected in the real situation. Investigate fuel relocation as influenced by the driving force provided by the amount of gas available in the experiments. The exact conditions for the tests indicated above or other possible variants, e.g. the WGFS recommendations, will be developed in HPG workshops accompanying the test series. Deliverables The aim for the programme is to: Refabricate and instrument segments for about three LOCA experiments with high burn-up fuel. Execute about three LOCA tests in the Halden reactor as indicated in the workscope (the exact test programme will not only depend on the outcome of the in-core phase, but also on the results of accompanying PIE). Measure and quantify the iodine released from the test fuel. Carry out non-destructive and destructive PIE on the test segments after test execution. Describe the results in individual work reports and provide a summary report on related tests and issues.

25 HP Fuel Behaviour under Demanding Operation Conditions Motivation and background More flexible or commercial operating modes, such as load following, can result in high and variable stresses being imposed on the fuel cladding with resulting high strains accumulating in the cladding. After the fuel cladding has crept down onto the fuel pellet, which is concurrently swelling, and the initial fuel-clad gap is closed, a stress reversal occurs as fuel swelling starts to drive general clad creep-out. Subsequent fuel swelling, fission gas release and power variations affect the applied stress on the cladding in terms of both magnitude and direction. The in-pile creep behaviour of LWR fuel cladding under variable loading conditions is thus important and needs to be addressed in fuel performance codes. General discussion indicates that there are specific areas where modellers continue to require creep data on well characterised material tested under carefully defined in-pile testing conditions, such as primary creep following repeated stress increments and reversals and for material with a high accumulated fast fluence. With the trend toward increased fuel cycle length and reactor core ratings, fuel can be challenged by the resulting high discharge burn-up and more aggressive thermal-hydraulic conditions (e.g. coolant temperature and void fraction) and water chemistry conditions. Longer fuel cycles together with power up-rates require higher boron concentrations for reactivity control, which, in turn, leads to the increased need of lithium to maintain the optimal water chemistry conditions. Such operation requires beginning of cycle LiOH concentrations above the current industry limit of 3.5 ppm. PWR primary water chemistry is also being optimised to minimise corrosion product release from the surfaces of steam generators and thus out-of-core radiation fields and crud formation on fuel cladding surfaces. Elevated and constant coolant ph is one potential optimisation method. Operation with constant ph 7.3 or 7.4 (maximum lithium concentration 5-6 ppm) has been demonstrated in a commercial PWR; however before more demanding operation conditions can be implemented in PWRs, it is necessary to confirm that they do not have adverse effects on fuel cladding corrosion and hydriding. One concern is to determine whether a so-called cliff edge exists, beyond which operation will be unacceptable. Corrosion performance of fuel cladding materials may be limiting under these more demanding conditions, especially in PWRs where an absolute limit of 100 µm oxide is applied, and it has been found that Zircaloy-4 does not always offer sufficient margin. For high duty and extended burn-up applications, several new alloys have been developed and these require comprehensive testing before they can be used in commercial reactors. Both utilities and licensing organisations require the vendor to provide evidence of the corrosion resistance of the materials. The fuel vendor performs the majority of the development work for a new cladding material, varying the chemical composition of the alloy and the manufacturing route, resulting in selection of a small number of candidate materials. It is at this point that in-core testing is required, since in-core corrosion rates are enhanced relative to those measured out-of-reactor. For burn-ups exceeding 50 MWd/kg, the fuel rim structure is formed and fuel-clad bonding is established. Load follow operation can have strong effects on PCMI and fission gas release. Released fission products can have an effect on fatigue life of the cladding during operations involving a large number of power changes. Further, axial ratcheting as observed in some experiments involving high

26 HP-1303 burn-up fuel may lead to an accumulation of strain increments with a possible impact on cladding integrity. Excessive fuel-clad bonding may also lower the PCMI failure threshold. Regarding PCMI, a mismatch between release and onset of interaction has been observed for shutdown/start-up sequences. Fuel must continue to satisfy reliability and performance requirements while being exposed to these more demanding operation conditions, and vendors, utilities and regulators all require experimental data to show that safety criteria are met. Such data can be used directly or indirectly (in models and codes), to determine the operating margins during reactor operation and to understand the mechanisms responsible for challenging and weakening the fuel and cladding during irradiation. Workscope All experiments involving the study of cladding behaviour make use of test loops that allow experiments to be performed under representative thermal-hydraulic and water chemistry conditions, i.e. coolant water pressure, temperature and make-up. Since the fuel is also operated under representative linear powers, other parameters such as cladding mid-wall and surface temperatures are also representative. Fast flux levels are maximised where required by surrounding the test fuel with booster fuel rods. All tests are instrumented for measurement of neutron flux and coolant temperature, pressure and flowrate. Test rods are fitted with instrumentation appropriate to the objectives of the experiment. The experiments related to fuel behaviour under demanding operation conditions considered for the next programme period are indicated in the following paragraphs. Steady state and transient creep of cladding will be investigated using the dual principle of stress application by internal gas pressurisation of closed-end cladding tubes and diameter change measurement via a surface traversing 3-point contact diameter gauge. A wide range of compressive and tensile hoop stresses can be applied to the specimens, and on-line changes in stress level can be effected both rapidly and repeatedly. On-line monitoring of the changing segment outer diameter can be carried out frequently and to an accuracy of ± 2 µm. The proposed creep experiment is a continuation of that which commenced in the programme, and which contains four test claddings (M5, M-MDA, E110 and ZIRLO) supplied by member organisations. The test will be conducted under representative PWR conditions. Corrosion and hydriding of fuel cladding are studied by measurements of oxide thickness using an eddy current proximity probe during reactor outages, with post irradiation determinations of oxide thickness and morphology and hydrogen pick-up. The proposed experiment is a continuation of that which commenced in the programme, and which contains six test rods, with claddings supplied by member organisations: M5, M-MDA-SR and ZIRLO, together with alloys used in previous experiments and development alloys. Irradiation conditions (coolant mass evaporation rate and lithium concentration) have been chosen to be more severe than those currently allowed in commercial PWRs. It is also proposed to develop in-core, on-line measurement techniques on fuelled clad segments. Use of fuelled segments will automatically generate a range of coolant temperatures, while a range of neutron/gamma fluxes can be obtained by axial positioning of the test rods. The on-line

27 HP-1303 measurement techniques envisaged are Electrochemical Impedance Spectroscopy, Potential Drop technique on fuel cladding, and Eddy current technique for a direct measurement of the oxide layer thickness. These techniques require in-pile ECP-electrodes (such as the iron/iron oxide membrane reference electrode), Pt-electrodes and other leak-tight electrical feedthroughs. Some of these electrodes already exist but need further miniaturization in order to allow the instrumentation of several units in one rig. So, part of the program is related to the fabrication of miniaturised, brazed electrodes. The eddy-current technique still needs extensive out-pile testing before it can be considered for in-pile measurements. The test will be conducted in a PWR loop. There are several reasons for this, including (i) the higher coolant conductivity (advantageous for the measurement), and (ii) the majority of any future work would be on PWR materials. Power cycling / load follow behaviour of high burn-up fuel will be investigated by integral fuel performance studies conducted in such a manner that FGR and PCMI can be studied together. The test fuel rods are equipped with instrumentation allowing measurements of fuel temperature, fuel rod internal pressure and cladding elongation. A typical start-up of a test in this series consists of a stepwise power increase to study the onset of release. Power dips are inserted to facilitate axial gas communication. After the start-up ramp, power is kept at a constant, high level to obtain data on the long-term evolution of fission gas release. Other aspects studied are onset and extent of PCMI, clad relaxation following power changes, and long term clad elongation due to fuel swelling and irradiation growth. The test fuel rods are manufactured from high burn-up rods from commercial reactors, which are refabricated at IFE, Kjeller with suitable instrumentation. Deliverables The aim for the programme is to: Characterise creep behaviour of modern LWR cladding materials under a range of representative compressive and tensile hoop stress levels Determine oxide thickness and hydrogen pick-up rates for modern PWR cladding materials under elevated Li water chemistry conditions (10 ppm Li, ph ) Develop miniaturized ECP, Pt electrodes Develop an on-line oxide thickness probe (based on eddy current) Make online corrosion measurements on Zr-2 and Zr-4 clad fuel under PWR conditions Study the onset of FGR and PCMI for high burn-up fuel rods from commercial LWRs Other experiments that are relevant to the theme of fuel behaviour under demanding operation conditions are described in other sections, including: Tolerable rod internal pressure / lift-off criterion (Section 1.1) Integral fuel performance studies (Section 1.1 and Section 1.2)

28 HP Innovative Fuels and Claddings Motivation and background In addition to the improved fuels and claddings being developed to withstand the challenges to fuel integrity described in the previous sections, innovative materials are also being looked into as an option for fuels and claddings, especially for Generation 3+ or Generation IV reactor types. For fuels, it is desirable to be able to operate at a lower temperature for a given power output in order to reduce fission gas release and other deleterious effects of high temperature operation. Higher fuel thermal conductivity is a prerequisite for this, and candidate materials include uranium nitride, fuel containing beryllium oxide (possibly in a whisker form), and fuel rods with a liquid metal in the fuel-clad gap. In addition, improved fuel performance may be achieved through careful control of fuel microstructure by producing pellets with a microstructure that varies radially through the pellet such as grain size, Gd-content or enrichment. For cladding materials, it is desirable to avoid the deleterious effects induced by high residence time in a corrosive and radiation environment such as accelerated creep and growth or hydride embrittlement. Sustained dimensional stability is a prerequisite for this, and SiC could be a suitable cladding material in this respect for ultrahigh utilisation of uranium fuel. An obvious added advantage of this material is that it is also relatively chemically inert. Workscope Integral fuel performance studies of innovative fuels will use concurrent measurement of fuel temperature and rod pressure during steady state conditions to generate data on thermal performance as well as fuel densification, swelling and possible fission gas release. Characterisation of the in-pile behaviour of innovative claddings will take place under LWR water chemistry conditions, with unfuelled but sealed segments of the cladding. Non-destructive interim inspections and a final destructive post irradiation examination will map the behaviour of the material. Deliverables The aim for the programme is to: Provide performance data on innovative fuels (e.g. U-BeO whiskers, uranium nitride, liquid metal bonded, variable microstructure pellets) Characterise the in-pile behaviour of innovative claddings (dimensional stability, corrosion resistance, retention of mechanical properties)

29 HP PLANT AGEING AND DEGRADATION The plant ageing and degradation programme is aimed at studying the effects of irradiation on reactor vessel internals as the age of operating nuclear power plants increases. The studies address the following issues: Irradiation assisted stress corrosion cracking (IASCC) of core component structural materials Irradiation enhanced creep and stress relaxation Reactor pressure vessel (RPV) embrittlement The experimental programme on IASCC is aimed at generating data that provide a fundamental mechanistic understanding of the phenomenon, predicting behaviour, in particular the cracking response of irradiated materials, assessing the benefits of countermeasures and determining the limits of operation for existing materials. An understanding of the processes is considered the key to effective ageing management (i.e. mitigation and / or repair). The majority of the IASCC investigations are performed in loops simulating light water reactor operating and water chemistry conditions. Irradiation enhanced creep and stress relaxation are potential degradation mechanisms that may affect core-internals long-term performance, and an in-pile study aimed at assessing the effects of irradiation and applied load on creep / stress relaxation in materials commonly employed in LWRs is being conducted under dry irradiation conditions. For the RPV programme, the Halden Project is participating, in collaboration with VUJE, Slovakia, in a study aimed at evaluating the use of the small punch test as an alternative method for determining the basic mechanical properties of RPV materials. The creep and stress relaxation and the vessel embrittlement studies are performed in inert environments. An overview of all materials experiments in the period is given in the accompanying figure. 2.1 Irradiation Assisted Stress Corrosion Cracking Motivation and background Irradiation assisted stress corrosion cracking (IASCC) occurs under the combined effects of irradiation, stress and a corrosive environment. IASCC is a degradation mechanism that is of concern for core components as reactors age, and components from both BWRs and PWRs have experienced intergranular cracking attributed to IASCC. The austenitic stainless steels and nickel based alloys that are used as structural materials for LWR internals are exposed to radiation environments over extended periods of time. The resultant increases in yield strength, radiation induced segregation, changes in the material microstructure, loss of ductility and fracture resistance are all important factors when addressing plant ageing and licence renewal issues. A better understanding of their manifestation can enable better planning of aging management strategies for power plants.

30 # of samples in experiment Initial dose or target dose (dpa) Crack growth Specimen failure Sample elongation Crack growth rate data Crack initiation / integrated time to failure Creep and stress relaxation data Mechanical properties of RPV and core internals HP-1303 PLANT AGEING AND DEGRADATION OVERVIEW OF MATERIALS EXPERIMENTS MEASUREMENTS APPLICATIONS materials comments progr. section 304L SS 6 1, 5.9, 7.7 (intial) 304L SS, CW 316 SS, CW 316Ti SS 6 5.9, 7.7; 6-9; 4 (initial) 304L SS (initial) CW 316, CW 316LN, Alloy 718, 304(L) RPV base & weld metal; austenitic cladding (RPV); austenitic steels 1&2 (core internals) 24 2 (target) & 1.4 (target) 6 x Matrix still to be finalised x Matrix still to be finalised x x Elongation of the 12 non-instrumented specimens will be measured when irradiation is complete x Mechanical properties will be determined by SPT and tensile tests after irradiation is complete

31 HP-1303 The IASCC programme focuses on four inter-related areas crack growth rate studies crack initiation (integrated time to failure) studies effectiveness of ageing and degradation countermeasures irradiated materials characterisation Workscope Crack growth rate studies. Long-term crack growth rate (CGR) data from Compact Tension (CT) specimens prepared from irradiated core component materials will be generated in BWR and PWR environments. The specimens are instrumented with the reversing dc potential drop method for crack propagation monitoring and are equipped with bellows for variable load application. The crack rate studies are aimed at practical data generation as a function of temperature, corrosion potential, fast neutron flux and stress intensity (K) levels. Representative materials harvested from commercial power plant components are employed, concentrating on crack growth rate (CGR) testing over a range of dose levels. Flux effects may be addressed by comparing the cracking response of the CTs located in high and low flux positions in the test assemblies. The test materials and doses for the experiments have not yet been identified. It is expected that one PWR and one BWR crack growth test, each employing 6 CTs, may be conducted in the programme period. Crack initiation (integrated time-to-failure) studies. In high dose materials, the benefits of hydrogen additions in slowing down rates of crack growth in CT specimens has been found to be limited, and the main objective of one test series is to determine if HWC is more effective in reducing susceptibility to the initiation of cracks in high dose materials. By comparing the number of specimen failures occurring during exposure in oxidising conditions (high ECP) with the number of failures in reducing conditions (low ECP), it is anticipated that some conclusions on the effectiveness of low ECP in mitigating crack initiation will be obtained. In addition, the study will provide information on time-to-failure as a function of applied load. In a continuation of the crack initiation / time-to-failure tests, materials with different doses may also be introduced, such that the effect of dose on time-to-failure also can be addressed. As many as possible of the factors considered necessary to obtain useful data from such an investigation have been taken into consideration in design of the experiment. These include maximising the number of specimens (miniature tensile specimens), the use of active loading with bellows and the use of LVDTs for on-line monitoring of specimen performance. Effectiveness of ageing and degradation countermeasures. The effects of mitigation measures, such as low ECP and post irradiation annealing treatments, will be addressed in both the crack growth and the crack initiation (time-to-failure) studies. For the ECP studies, the coolant chemistry may be changed from oxidizing conditions (high ECP) to reducing conditions (low ECP) in the case of the BWR studies. In the case of PWR tests, the concentration of hydrogen in the coolant may be varied from very low to very high levels to study the effects on cracking response. Investigating the effect of Zn at low ECP is also a possibility that will be considered.

32 HP-1303 For the post irradiation annealing (PIA) treatments, these will be applied to selected specimens only. The PIA treatments may also provide improved understanding of IASCC phenomena since the PIA treatment can be used to separate micro-compositional and micro-structural changes which may then be studied as part of the materials characterisation programme on completion of the in-pile testing. Irradiated materials characterisation. Post irradiation characterisation of the materials that are used in the crack growth rate and crack initiation tests is an important supplement to the in-pile data. At the Kjeller hot cell facilities, post irradiation examination of specimen fracture surfaces, using both replicas and direct examination are performed. In addition, some mechanical testing, such as hardness measurements and tensile tests are possible. More detailed material characterisation, including TEM /FEG-STEM examination of the materials microstructures and microchemistries is performed at participant laboratories. In addition, the history of the core component materials that are being used in the various investigations is also of importance, and efforts are made to obtain as much information as possible on the conditions (flux, fluence and temperature) to which the materials were exposed in the commercial nuclear power plants from which they were retrieved. Deliverables Crack growth rate data measured on CT specimens prepared from core component materials with a range of dose levels The crack growth rates will be measured as a function of several key variables affecting growth rate: namely temperature, stress and corrosion potential (water chemistry) Assessing the effects of water chemistry changes on crack initiation and growth behaviour Determining the effects of water chemistry, load and dose on time-to-failure in crack initiation studies Assessment of post irradiation heat treatments in ameliorating IASCC susceptibility Thorough characterization of the irradiated material s microstructure and quantification of the extent of any radiation-induced segregation at the grain boundaries of the materials. 2.2 Irradiation Enhanced Creep and Stress Relaxation Motivation and background Irradiation induced creep and stress relaxation is a potential degradation mechanism that may influence the service life of, for example, the bolting used in reactor vessel internals where design requires that a minimum load be maintained throughout service. Since the initial stresses in structural components will vary during reactor operation, information on the effects of irradiation on the creep and stress relaxation of stainless steels and Ni-alloys used in structural components is an important design and analysis requirement, for example in determining the amount of pre-load required for components and for predicting when, for-example, bolt tightening may be necessary. Most irradiation creep and irradiation stress relaxation 316 SS and 304 SS tests have been performed in fast neutron spectrum reactors. The purpose of this programme is to measure the irradiation creep and irradiation

33 HP-1303 stress relaxation of common reactor structural materials (such as 316 SS, 304 SS and Alloy 718) in a thermal neutron reactor spectrum prototypic of PWRs and BWRs. Workscope Twelve (12) tensile samples with diameter ~2.6 mm and gauge length 50 mm) are installed in instrumented units and provide on-line creep and stress relaxation data. Stress is applied to the specimens by means of bellows which are compressed by gas pressure that is introduced into the chamber housing the bellows. In the case of specimens that are used for providing stress relaxation data, constant displacement is maintained by monitoring sample elongation with the LVDTs and reducing the applied load on-line by decreasing the pressure in the bellows housing units. For the creep samples, the applied stress is constant and elongation is measured as function of exposure time (dose accumulation). In addition to the bellows gas lines for load application, the test units are equipped with gas lines that enable the specimen temperatures to be controlled at the 290, 330 and 370C targets by altering the composition of helium-argon gas mixture surrounding the specimens. The instrumented sample matrix is summarised in the table below. Instrumented Specimen Matrix for Stress Relaxation / Creep Investigation Level Unit.No. Material Sample Type Initial Stress (MPa) Target Temp (C) 1 CW 316 Rod (bottom) 2 CW 316 Rod CW 316 LN Tube Alloy 718 Rod Alloy 718 Rod CW 316 Qualification sample SA 304L Tube SA 304L Tube CW 316N lot Tube CW 316 rod (top) 11 CW 316 Rod-creep CW 316 Rod-creep Deliverables Provide baseline creep and stress relaxation data on austenitic stainless steels and Ni based alloys commonly employed in LWRs. Identify candidate replacement materials that exhibit superior creep / stress relaxation properties. Measure irradiation enhanced creep and stress relaxation of replacement materials under different load / temperature /dose levels. 2.3 Pressure Vessel Integrity Study Motivation and background The effect of neutron embrittlement on pressure vessel materials remains a safety issue which traditionally is assessed on the basis of testing Charpy-type specimens irradiated as part of surveillance

34 HP-1303 programmes. The limited amounts of available material for such tests are being resolved through reconstitution techniques and miniaturisation of test specimens. In order to establish proper correlations between the data from subsize specimens with those of standard size, experimental verification is required. In an investigation that was performed in collaboration with VÚJE, Slovakia, in the programme period, the use of the small punch test (SPT) method, which reduces the amount of material required to determine the basic mechanical properties of a material, was evaluated. The SPT method was used to obtain data on the basic mechanical properties (yield stress, ultimate tensile strength, ductile-to-brittle transition temperature and fracture toughness) of three materials: The base and weld metal of the RPV steel 15Ch2MFA, a reference material produced by Izhora plant, Russia, and also used in an international round robin co-ordinated by the IAEA on the evaluation of the irradiation embrittlement of the welds of WWER-440/230-type RPVs; The reference steel JRQ (ASTM A533 grade B class 1), used as a radiation/mechanical property correlation monitor in a number of studies on irradiation embrittlement of RPV steels. Workscope On the basis of the actual results from the study as well as results obtained from surveillance specimen programmes implemented in Slovak power reactors, a new project conducted in collaboration with VUJE will be aimed at preparing new sets of SPT and miniature tensile specimens prepared from RPV materials (RPV wall materials and RPV internals in the reactor). Material / Type of specimens SPT Mini tensile Weld metal RPV 30 3 Base material RPV 15 3 Austenitic cladding RPV 15 3 Austenitic steel 1 (internal part of RC) 15 3 Austenitic steel 2 (internal part of RC) 15 3 Total The specimens would be irradiated at 280 C to two different levels, equivalent to 2 and 4 campaigns in power reactor Deliverables Results from the mini tensile specimens will increase reliability and precision of the results from SPT specimens. The proposed materials as well as the SPT specimens are applied in the Advanced Surveillance Specimen Programs in Slovakia. The results from the Halden - VUJE proposed project will thus provide the possibility for assessment of the dose rate effect on real RPV materials. The results obtained from the irradiation of austenitic steel will provide knowledge about material degradation in the reactor core under higher fluence than is possible to reach in the power reactor surveillance canals.

35 HP CONTRIBUTION TO INTERNATIONAL GEN-IV RESEARCH Generation IV reactors (Gen IV) are a set of theoretical nuclear reactor designs currently being researched. Most of these designs are generally not expected to be available for commercial construction before Demonstration of concepts are however foreseen around Current reactors in operation around the world are generally considered second- or third-generation systems, with the first-generation systems having been retired some time ago. Relative to current nuclear power plant technology, the claimed benefits for 4th generation reactors include 1) sustainability, 2) increased safety, 3) better use of the nuclear fuel, 4) high efficiency and better economics, 5) minimal waste production, 6) the ability to consume existing nuclear waste in the production of electricity, 7) increased proliferation resistance. Many reactor types were considered initially; however, the list was downsized to focus on the most promising technologies and those that could most likely meet the goals of the Gen IV initiative. The present focus is on six reactor types: 1) very-high-temperature reactor (VHTR), 2) supercritical-watercooled reactor (SCWR), 3) molten salt reactor (MSR), 4) gas-cooled fast reactor (GFR), 5) sodium cooled fast reactor (SFR), 6) lead cooled fast reactor (LFR). 3.1 Instrument Development Motivation and background Common to these reactor concepts is that they operate at high temperature (higher than present Pressurized Water Reactors). Many material and fuels issues have to be studied in-pile, and specialized instruments are needed to allow such investigations. These instruments need to tolerate high temperature, radiation and sometimes aggressive corrosion environments (such as high temperature liquid lead). An instrument development program is therefore urgently needed. Workscope The Linear Variable Displacement Transducer (LVDT) is an essential instrument for the study of material (creep, stress relaxation) and fuel (fission gas release, fuel swelling, cladding extension, fuel centre temperature) properties. One element of the study therefore concerns the development of LVDTs which can withstand higher temperatures. For supercritical water conditions and for operation in liquid sodium, a maximum temperature of 600 C would be sufficient, while for the VHTR environment an LVDT which can operate up to 1000 C is required. The main challenge in designing such LVDTs is to find or fabricate insulated wires which can tolerate these high temperatures. One of the most important parameters that affects stress corrosion cracking (SCC) in reactor constructional materials is the electrochemical corrosion potential (ECP) of the material. The ECP should be measured at the same location in which the SCC samples are positioned; hence in-core measurements are required for Halden tests, as well as for in-plant studies. These in-core measurements require ECP reference electrodes that can withstand the aggressive in-core conditions, including exposure to gamma and neutron fluxes. For materials studies under supercritical water conditions, electrochemical potential sensors (ECP) are needed to measure the electrochemical potential at high pressure (250 bar) and high temperature (up to 600 C). Such electrodes have already been developed at the Halden Project but they still need to be tested in-core.

36 HP-1303 For materials studies under liquid sodium, there is a requirement to measure the crack-growth on CTspecimens. Since the standard potential drop technique cannot be used under these circumstances (electrically conducting environment), it is proposed to use crack mouth opening displacement instead. It will be investigated whether a newly developed diameter gauge can be used for this purpose. Deliverables The following deliverables are expected to result out of the development program: High temperature LVDT (500 C, possibly up to 900 C) ECP electrode for use in supercritical water Crack Mouth Opening Displacement on CT specimen for use in liquid sodium These instruments will be tested in and out-of-pile. 3.2 Material Testing Motivation and background Because the different types of Generation IV reactors operate at higher temperature and often in more corrosive environments, new materials have to be developed and tested. The main tasks are to investigate the corrosion behaviour and creep of relevant Generation IV materials (for reactor internals and for fuel cladding). Also corrosion resistant coatings (to protect materials under the most corrosive environments such as liquid lead or supercritical water) should be developed and tested. Further, it should be mentioned that some of the materials considered for Generation IV reactors could also be interesting for use in Generation III reactors. Workscope The following materials are under consideration for in-pile corrosion testing: Oxide dispersed strengthened steel (9 % Cr or 14 % Cr) Inconel 690 Inconel Cr 15Ni Ti-stabilized steel TiAlN, CrN and ZrO 2 coating Main material considered in Gen IV European materials programs: Low swelling and high creep resistance at high temperature. Interesting material for the supercritical CANDU reactor concept. Low general corrosion. Also considered as cladding material. High strength material with good swelling resistance. Optimal material for an in-pile supercritical water loop. Interesting material for the supercritical water reactor (and it is already accepted as a nuclear grade material). Corrosion barrier. Deliverables It is proposed to corrosion test some of these materials and surface treatments in both in-pile and outof-pile conditions. The general corrosion behaviour will be assessed based on weight gain/loss measurements and examination by SEM analysis.

37 HP PROGRAMME BASIS, FUEL AND MATERIALS The execution of the fuel and materials testing programme is based on expertise and facilities established at the Halden Reactor on the background of more than fifty years of operation and experience. This comprises all steps from design and fabrication of test rigs to irradiation, data acquisition and evaluation, ensuring an expedient and flexible execution of plans with in-house control of quality and timing. The major factors and requirements in this process are highlighted in the following sections. Additional details can be found in Annex I and Annex II. 4.1 Design and Fabrication Capabilities The design of an irradiation rig is a crucial stage of an experiment since it almost irrevocably determines the capabilities of a test and most of the conditions under which it will be executed. The Project has therefore emphasised the utilisation of modern tools for design and fabrication. Computer aided design (AutoCad) is employed for fast and versatile production of drawings and parts lists. This allows re-use and easy modification of existing layouts as well as the application of basic constructs. Computer programmes are also applied for the evaluation of hydraulic and cooling conditions, and for structural analysis. The fabrication workshop contains all necessary tools and machinery for precision machining and welding. Numerically controlled turning lathes and wire erosion techniques ensure the exact and repeatable manufacturing of parts with small tolerances. Refabrication and re-instrumentation techniques have been proven and applied on high burn-up fuel rods suitable for assessing the performance of LWR fuels. Re-instrumentation can be performed for fuel centre thermocouples, pressure transducers and cladding elongation detectors. Thermocouples can be attached to (irradiated) cladding surfaces for application in LOCA and dryout tests. Design and fabrication are carried out under strict quality control routines, which involve function tests and calibration of individual components/instruments as well as testing of the complete test rigs in a loop, operated at full temperature and pressure conditions, prior to loading in the reactor. A formal documentation system for quality control purposes is implemented according to ISO In-Core Instrumentation The in-core instrumentation in use at the Halden Reactor is subject to a continuous upgrading in response to the changing and ever more exacting needs for the experimental programmes. New types of sensors have therefore been developed in recent years, and commercially available sensors have been evaluated and applied to meet requirements, especially in the areas of materials testing and high burn-up investigations. The conversion of HBWR instrumentation and re-fabrication technology for use in other reactor systems is pursued through co-operative arrangements with participating organisations.

38 HP Fuel Testing Instrumentation Rod power is an essential parameter in relation to many aspects of fuel performance. A considerable part of the instrumentation is therefore directed towards maintaining an adequate power monitoring. High quality turbine flow meters and coolant thermocouples, together with advanced experimental techniques, make it possible to determine the channel power with an accuracy of 3% both in the HBWR core and in the LWR simulation loops. Careful selection and proper placement of self-powered neutron detectors, together with the channel power calibration and physics calculations, allow the continuous evaluation of power and burn-up for a test assembly as a whole, for each individual rod, and at different axial nodes. Advanced core physics codes are applied to further improve the quality of Halden experimental data, especially at high burn-up and after long in-reactor residence times. Fuel parameters are measured with a variety of proven instruments including high temperature thermocouples and expansion thermometers for fuel temperature measurements, fuel stack elongation detectors to evaluate densification and swelling behaviour, and bellows pressure transducers for continuous monitoring of fission gas release. Cladding parameters and overall rod behaviour can be monitored with the help of cladding elongation detectors for PCMI assessment, cladding I.D. thermocouples, a gap meter to determine the fuel-tocladding gap, and diameter gauge systems to measure cladding dimensional changes during in-pile operation with an accuracy of about 2 m. The latter is successfully applied in cladding creep and crud build-up studies. - Materials Testing Instrumentation Water chemistry parameters are measured out-of-vessel and in cold conditions by means of sampling lines connecting the primary circuit to the measuring equipment. This, however, does not give a correct picture of the electro-chemical conditions prevailing in the core. For corrosion studies of incore materials, it has become increasingly important to understand how the corrosion potential varies in-core as function of varied feedwater chemistry parameters. The Project has addressed this item primarily in terms of developing electro-chemical potential sensors as well as validating and applying sensors produced by participants. On-line crack measurements based on the potential drop method have been used with good results. Compact Tension specimen designs with active bellows force loading are available for IASCC studies aiming at investigating crack growth as a function of stress intensity. Another specimen type is the pressurised tube variant for constant stress IASCC tests. Pressures of several hundred bars can be obtained in sealed tubes made of the materials to be investigated. Cladding elongation detectors can be used for an assessment of zirconium oxide conductivity under reactor operating conditions. The sensor will detect the additional thermal expansion of the cladding due to the increased temperature which is caused by the resistance of the oxide layer to the heat flux. The comparison with reference material will allow the deduction of the conductivity.

39 HP Irradiation Facilities The Project can make available a wide range of versatile test rig designs to be irradiated either under HBWR conditions or in light water loop systems with prototypic LWR temperature and pressure conditions. The HBWR core provides the thermal flux levels required for obtaining adequate power ratings with prototypic LWR enrichment fuel. The experimental activities are supported by a highly experienced reactor operation and maintenance staff, as well as by experimentalists and data handling personnel. A chemical engineering group supervises the monitoring and control of the water chemistry related testing activities in the reactor and in the light water loops. - The Halden Reactor Several features make the Halden Boiling Heavy Water Reactor (HBWR) suited for studies of reactor fuels and materials. Being a heavy water moderated and cooled reactor, it has a considerably wider core than a light water reactor of the same power. This gives better room for instruments and experimental equipment. The top lid of the reactor is designed with a penetration for each test rig, thus making handling and loading relatively simple. Above all, it allows making the instrument cable seals an integral part of an irradiation rig. The reactor is operated with a core of about 100 fuel assemblies of which up to 30 are instrumented test rigs. In addition, loop systems are utilised for tests requiring water chemistry and thermal/hydraulic conditions representative of modern light water power reactors. The neutron and gamma flux conditions in the various test positions in the core can be varied according to experimental needs. - Test Rigs Instrumented test carriers are designed both for fuel rods which shall not be replaced as well as for replaceable fuel rods. In the former case, the design is more flexible and instrumentation of high complexity and density can be accommodated, such that a large variety of experimental objectives are met. An example of this design is the Project s gas flow and fission product release assembly, where highly instrumented fuel rods are connected to an out-of-reactor gas supply. The gas composition in each rod can be individually controlled by using in-core valves for either gas flow/gas exchange experiments or fission gas release experiments. A number of test rigs are designed such that fuel rods can be removed and replaced. The advantage of this concept is that fuel rods can successively be exposed to different operating and measuring sequences in any one of a number of specialised rigs. Base irradiation rigs allow efficient accumulation of burn-up with varying degree of instrumentation, whereas ramp rigs allow up to four rods to be ramped through use of a helium-3 system. TheHe-3 system is also applied for load follow and frequency control type tests. Rigs with movable absorber shields are suitable for a variety of power cycling experiments, and diameter rigs allow diameter measurements on up to three fuel rods simultaneously. If experimental requirements demand it, the special features described above can be combined.

40 HP-1303 The complex mechanisms of the rigs are operated by external control systems. The reactor s heavy water is used as hydraulic fluid for the fuel rod drive system, the absorber shield system and diameter gauge drive systems. The helium-3 system controls the pressure in the absorber coils, and the fuel rod gas flow system permits flushing of helium and other gases through fuel rods, exchange of different gases, analysis of fission products, and operation of in-core valves. - High Pressure Light Water Loops Fuel testing under pressure and temperature conditions typical of pressurised and boiling water reactors has been performed in the HBWR for more than thirty years. Each loop system can serve one or more test sections and have external systems for controlling the coolant thermal hydraulic and chemistry conditions. For example, waterside corrosion investigations can be performed under typical PWR and BWR water chemistry conditions, utilising segments preirradiated in power plants. The loop systems are also used for material testing (IASCC investigations). Within the space of the pressure flask, the test rigs in use for loop testing can incorporate all the essential rod and rig instruments in use under HBWR conditions as described above. 4.4 Inspection and PIE Facilities The irradiation programmes are complemented by pool-side inspection facilities and a wide variety of PIE possibilities at the associated hot cell of Institutt for energiteknikk at Kjeller. - Inspection Compartment A number of measurements complementary to in-core results can be performed in the inspection compartment inside the HBWR reactor hall. These include diameter profilometry and length change determination based on the precise measurement of the distance between v-grooves machined into a rod. Eddy current measurements are being used to detect cladding cracks, and EC proximity probes are applied for oxide thickness determination. Further, it is possible to pick up the positional change (relative to a pre-irradiation calibration) of a core inside the rod using an external LVDT. With this technique, fission gas release and fuel stack length changes can be determined non-destructively even for rods which could not be irradiated in a test rig with an LVDT. Burn-up and power profiles can be determined with a -scanning facility. Photo and video equipment is available for close-up inspection of rod surfaces, documentation of changes such as crud build-up, corrosion and nodule formation. The information can be stored in analogue and digital form for further evaluation and processing. - Post Irradiation Examination Comprehensive PIE capabilities are provided by the hot cells of Institutt for energiteknikk (IFE). They comprise non-destructive (profilometry, eddy current testing, gamma scanning, neutron radiography) and a variety of destructive examinations (puncturing and fission gas analysis, metallography/ceramography, auto-radiography, burn-up analysis, transversal -scanning). Emphasis is put on micro analyses in conjunction with the determination of parameters associated with extended

41 HP-1303 and high burn-up such as retained fission gas, burn-up analysis (both from micro samples) and SEM examination. 4.5 Data Acquisition and Analysis In parallel with the Project s experimental efforts, work is conducted in the areas of data qualification, data analysis, model development and verification, and knowledge transfer to Project participants. The knowledge transfer between the Project and its participants is in particular dependent upon a proper understanding of the data and upon having available effective means of transferring that knowledge. The data acquisition and reactor supervision system is running on a G2/RTP process control computer. More than two thousand signals from the instrumented test rigs and from the plant are logged at 0.5 sec intervals. As a routine, raw data are saved permanently every minute for future use, and converted data are entered into the Test-Fuel-Data-Bank (TFDB) at least every 15 minutes. Logging faster than 0.5 sec is covered by a special programme for sampling intervals from 10 milliseconds and upwards. Typical applications are diameter trace recording and sampling for noise analysis. Fast data logging and storage is automatically switched on when a reactor scram occurs since especially the transient temperature data contain valuable information on the fuel. Computerised data dating back as far as 1972 are available and can be read and processed with the same software as data obtained today. Efficient data treatment and reduction are indispensable requirements to cope with the ever-growing data base of the Halden Project. Long-ranging experiments, comprising several million measurement records, are not uncommon and increase in number when e.g., high burn-up tests are performed. The TFDB, in particular with its graphics display module VISION, provides versatile functions for data screening and manipulation during various stages of data retrieval and display. Widely accepted standards have emerged which facilitate data treatment and information exchange. The Project intends to keep track of such developments and to introduce hardware and software in order to follow generally accepted trends, e.g. password protected down-loading of data. 4.6 Experiment Supervision Upgrading of the environment used by experimentalists and reactor operators is a continuous effort. Software systems developed at the Halden Project for plant monitoring and control can advantageously be applied to many tasks in conjunction with the supervision of experiments and the reactor. Status and alarm displays of the reactor as a whole, the experimental loop systems and the individual experiments are shown using the Halden-developed ProcSee real time display system together with a real time data conversion system of the TFDB. The daily usage by experimentalists and reactor operators provides valuable feedback and spawns the implementation of new features and improvements.

42 HP-1303 MAN-TECHNOLOGY, ORGANISATION (MTO) PROGRAMME

43

44 HP-1303 CONTENTS INTRODUCTION TO THE MTO PROGRAMME PROPOSAL OECD HALDEN REACTOR PROJECT 5 HUMAN FACTORS RESEARCH FOR EXISTING AND NEW REACTORS Human Reliability Human and Organisational Factors Human-System Interfaces Control Centre Design and Evaluation Outage and Field Work Future Operational Concepts DIGITAL SYSTEMS RESEARCH FOR EXISTING AND NEW REACTORS Software Systems Dependability Condition Monitoring and Maintenance Support Operational Support PROPOSAL FOR THE THREE YEAR PERIOD NOVEMBER PROGRAMME BASIS, MTO RESEARCH The MTO laboratories Maintenance and Operation of the MTO Laboratories Halden Project use only THE INFORMATION CONTAINED IN THIS REPORT IS TO BE COMMUNICATED ONLY TO PERSONS AND UNDERTAKINGS AUTHORISED TO RECEIVE IT BY ONE OF THE ORGANISATIONS PARTICIPATING IN THE OECD HALDEN REACTOR PROJECT IN ACCORDANCE WITH THE PROJECT S RULES FOR COMMUNICATION OF INFORMATION

45

46 HP-1303 INTRODUCTION TO THE MTO PROGRAMME PROPOSAL The HRP MTO research programme proposal is based on work carried out by the Project s MTO sector in previous programme periods, experiences- and lessons learned obtained as well as input from various member organisations. Advice has been obtained from the HPG during the autumn 2009 meeting. Further, the summary of the Halden Board of Management s teambuilding session in Lueven, Belgium in June 2009 has been an important guidance: Future MTO research should be based on HRP s excellence in this area such as experimental methods & measures for human performance, and its two unique facilities of Hammlab and the VR centre. Focus should remain on developing skills and providing results in human reliability, human factors, software reliability, control room design and modernisation (Human Factors and Human-System Interfaces) and Operational support system. For the longer term, relevant new research topics could include interpretation of process signals, passive systems and the impact of high level of automation. In this introduction we provide, on request from Project member organisations, some forecasts covering MTO themes that we expect will be important both in a short- and long-term perspective. The second part of the introduction contains executive summaries of the main themes in the two proposed chapters. This is summed up by a cross-reference table that links the thematic parts to the forecasts. Forecast #1: Modernisation of Gen II and Gen III control rooms In a short-term perspective the license renewal programmes of existing Gen II and Gen III reactors will, in the MTO area, focus on modernisation of control rooms and a step-wise introduction of digital I&C systems. In Sweden, the utilities commenced control room modernisation programmes already in the Fig.1. Oskarshamn 1 control room in Sweden (after the modernisation project completed in 2002) mid-nineties, and Fig. 1 shows the Oskarshamn 1 control room in Sweden after the MOD modernisation programme was completed in In this picture, we see what is called a hybrid control room, which means that, to a large extent, the old backpanels are kept, but a large screen display and CRTs for seated operators have been carefully introduced mainly for use in normal operating modes. The main issues in such modernisation projects are: control room design, human factors verification and validation, integrated system validation, integration of PSA and HRA in the upgrade process, large screen display design, computerised alarm- and computerised procedures systems, lifecycle issues regarding safety-critical software, including design, verification and validation.

47 HP-1303 Forecast #2: Many Gen III+ NPPs with a new generation of control rooms- will be built In a longer time perspective, such as the period , the revival of nuclear power we are currently seeing, paves the way for building many more Gen III+ NPPs. In 2012 it is expected that the first Gen III+ EPR will be put into operation at Olkiluoto in Finland, closely followed by the Flamanville 3 EPR in France. A 2008 sketch of Fig.2. Sketch from 2008 showing the planned Olkiluoto 3 EPR the EPR control room is shown in Figure 2. There are significant differences from Gen II to Gen III+ control rooms because Gen III+ have computerised seated work-stations for use during most operating modes and they are connected to powerful and complex I&C systems. There are minor differences between the Gen III and Gen III+ control rooms, mainly in the control room layout and level of automation. Issues mentioned under Forecast #1 are still relevant, but in addition there is an immediate need for methods to perform integrated system validation (ISV) of completely new control room designs. Another challenge is how to do a safety analysis, e.g., PSA including HRA, on an unfinished or almost finished design. The impact of a higher level of automation, including the role of automation and the staffing level in highly automated plants, should be further investigated. Operator training related to new, highly automated plants entail other important issues for example understanding the behaviour of automation systems. It is also a clear trend that advanced, and probably fleet-wide, condition monitoring systems are emerging, aiming both to improve safety and productivity, and such systems will probably have an impact on roles and responsibilities. Furthermore, work processes, teamwork, and communication issues will change from what we see today. Regulators, utilities, and suppliers would, from the outset, need to focus on knowledge management with respect to the expected lifetime of the new plants being eighty years. Forecast #3: Outage control centres will be further developed The accelerating advances in digital technology will certainly penetrate into other work domains in both existing and future reactors, including the area of outage planning and execution. Fig.3. Concept for an Outage Control Centre Our main forecast is that outage control centres (OCC) will be further developed in the not too distant future, a development actually already being pushed by the larger utilities. In these OCCs we expect that advanced technologies, such as multitouch interaction technologies, will be implemented and tested out in the context of large screen displays (see Fig. 3). Furthermore, we anticipate that condition-based maintenance strategies will emerge as new drivers in maintenance planning. Halden proposes to work

48 HP-1303 on on-line equipment health assessment and prognostic; aiming to verify how enhanced instrumentation in terms of continuous measurements of degradation quantities can improve estimates of equipment lifetime. In OCCs, the concept of plant-wide monitoring will probably be introduced first. It is likely that the larger utilities will subsequently continue to implement the concept of fleet-wide condition monitoring in their operation concept. The reason being that they will then be even better equipped to make higher-level strategic operation decisions (see Fig. 5). Forecast #4: Enabling the Field operators A general observation is that mobile smart communication devices are already penetrating the private, business, and some other industry sectors. It is expected that they will soon emerge in an industrial form, quality, and format, at a reasonable price, making them fit for use also in nuclear plants. Our forecast is that such devices will enable field operators to be connected to an outage control Fig. 4. Communication devices forecasted to be applied by field operators in the future centre and/or to the control room. The expectation would be that the communication between field operators and control centres will be safer and more efficient by the introduction of such devices. The field operators would be much more updated on the state of the plant and accordingly be more aware of what should be checked, carried out, and reported from the field (see Fig. 4). The main issue will be how to obtain and guarantee the safe and practical use of advanced communication devices in a nuclear setting. From this issue follows that all the human factors and technical issues that the industry has been struggling with since the introduction of computerised systems in the nuclear setting may have to be readdressed for the new devices. Practical solutions will be needed to establish easy to use and effective user interfaces for field workers. Forecast #5: New Operation Concepts to be expected in Gen IV plants In a longer time perspective, the nuclear industry is looking ahead to new reactor designs to meet the energy needs beyond 2030, in the so-called Generation IV plants initiative. In these new reactors, it is likely that the operation concept will change considerably in comparison with that of today, and the designs will clearly take advantage of advanced digital I&C technologies that are expected to continue to develop rapidly in the coming years. It is our forecast that a new operation concept will emerge. In

49 HP-1303 particular, if the experiences with OCCs mentioned earlier are good, the design of the Gen IV control rooms will probably be heavily influenced by the design of the OCCs as well as the development of the central control rooms. Fig.5. Possible future operation concept for modernised or new reactors Consequently, the introduction of new technologies will inevitably lead to a new set of human factors issues and new issues related to safety and reliability in the area of division of functions, roles, and work processes. Additionally, new issues related to teamwork, including collaboration and communication skills must be solved, and the training of operators must come at an early stage to prepare them for such an operating environment. In other words, a new operation concept will probably emerge for the Gen IV reactors (see Fig. 5), and many of the previously addressed safety issues related to humans, technologies, and organisation needs, will need to be re-examined for the new concept. Forecast #6: Knowledge management is introduced for the Gen III+ Gen IV reactors One of the key issues in the life of a nuclear plant is the management of information and knowledge related to human activities in and around the facility, from the earliest design phase to the end of the decommissioning phase. Our forecast is that regulators, utilities, and suppliers will see advantages and needs for knowledge and information to be captured and processed in order to improve activities at the plants throughout the long lifetime of the new plants. Furthermore, knowledge acquired during this process should be provided as input to the design of future plants. Through past research and experience, we see a great potential for extending the use of virtual nuclear power plant models, and surrounding environments, as knowledge repositories that can be updated throughout the plant lifecycle. For example, ubiquitous computing and spatially-oriented visualisation technologies such as virtual and augmented reality can be used to capture experience and knowledge related to field work practices in existing plants in order to improve the design of new ones and support organisational learning.

50 HP-1303 Forecast #7: Successful development, assurance and deployment of high integrity software within the nuclear sector will be a major challenge in the years to come. The use of software for control and protection purposes is expected to still increase both for existing and new nuclear power plants. In order to facilitate the successful development, assurance and deployment of high integrity software, the sector will need to continuously improve the knowledge on the effectiveness and proper use of processes, methods, techniques and tools for the different lifecycle phases of the software. Basically, the software engineering process must be capable of providing software at the required safety integrity and dependability. Equally important however is the documented demonstration that the software is safe to put into use and fit for its intended application. Finally, appropriate means must be devised to ensure that the computer based system maintains its level of safety integrity and dependability throughout its lifetime. The development of high integrity software for power plants will increasingly benefit from international standardisation, both with respect to development and safety approval. Furthermore, organised knowledge transfer from the use of high integrity software in other sectors will be necessary in order to extend the knowledge base on the effectiveness of novel approaches, methods and technologies. This will also have an impact on future software systems dependability research, which needs to address the scientific basis, application and further development of requirements and recommendations in standards and guidelines, and to effectively utilize results from similar research in other sectors. Executive Summary of the HRP MTO Programme Proposal The draft HRP MTO programme for the period proposes a new outline compared to previous programmes. We propose two chapters instead of the earlier five, one being Human Factors Research for Existing and New Reactors and the second Digital Systems Research for Existing and New Reactors. The reason for the proposed change is to group the themes more consistently in two chapters. Chapter 1 on Human Factors Research for Existing and New Reactors address 5 thematic areas: Human Reliability (1.1) Human reliability analysis (HRA) is a significant issue in probabilistic risk/safety assessment (PRA/PSA) for nuclear power plants. Given the high degree of redundancy, diversity and reliability of safety systems, fault sequences involving human actions often contribute significantly to the frequency of core damage. Thus, an important research area since 2006 is empirical studies to support the understanding and modelling of human performance. The activities proposed build on the results from the International HRA Empirical Study, where it was shown that the qualitative scenario analysis was instrumental for doing a good HRA, and that complexity and teamwork and procedure use were heavily interdependent, causing variability in crew performance. We therefore propose case studies to improve the qualitative analysis of HRA. Also, we propose Hammlab studies to look into procedures, crew expertise and teamwork features in emergency response. One output of this work is cognitive models that will support the modelling of these issues in HRA, the other is more direct advice to resilient procedure use in complex situations.

51 HP-1303 Human and Organisation Factors (1.2) In this area some of the proposed topics are continuing from the current programme period, but also some new topics are proposed. We propose to study how control room staffing solutions and roles in the control room affect important crew functions during emergency situations. Studies on training in virtual and augmented environments will be continued. In addition we propose, to work on training issues, in particular to utilise knowledge and experiences from scenarios used in human performance studies in Hammlab emphasizing assessment of training effectiveness and improvements of the training itself. Human-System Interfaces (1.3) In the area of human-system interfaces, the three topics proposed address design concepts and implementation issues relevant to the development and deployment of current and future HSIs. This includes the design and evaluation of an integrated HSI concept applicable for all NPP operational modes, the design and evaluation of HSIs to support communication and collaborative decision-making in stressful situations, and work on techniques to support the implementation and testing of HSIs with the goal of improving the HSI implementation and verification and validation process. Control Centre Design and Evaluation (1.4) A large number of nuclear facilities are either in the process of being modernised or will be modernised in the near future, and a significant number of new builds are planned. The overall objective of the work proposed in this area is to improve the design process and ensure a good end result. The topics proposed cover the establishment of design patterns representing best-practices for control centre designs, the further development of 3D virtual mock-ups for control centre designs, including an evaluation of the validity of the results of the use of virtual prototypes for control room V&V, considering whether these technologies can reliably support a more agile design process without sacrificing the necessary rigor required to justify the final control centre design solution. The final topic, as well as the final activity of a design process, is integrated system validation. Especially for new designs, a challenge is to establish the proper acceptance criteria regarding human performance in the new control room. In combination, we believe that the results of these topics could greatly influence future control room centre design processes. Outage and Field Work (1.5) Outage control centres can play an important role in prioritising outage activities, directing resources, and supporting decision-making to ensure that activities are carried out efficiently and safely. The work proposed in this area covers activities in a physical control centre but also in the extended team of field operators and other stakeholders at the plant or at remote locations. The topics proposed focus on collaborative human-system interface technologies, information visualisation techniques, and teamwork in the context of outage management. We propose to continue work on the use of ubiquitous computing technologies to support field operators during maintenance activities. Future Operation Concepts (1.6) Conceptual work on future advanced reactor designs is well underway worldwide. For such future reactor designs, there exist several common design characteristics with possible human performance

52 HP-1303 implications. One of the topics we propose to address concerns highly automated plants, and particularly the challenge of establishing a joint human-automation team in a future control environment. We also propose to investigate how relatively new technologies such as multi-touch and high-resolution large display surfaces can influence work practices in future control centre environments. Chapter 2 on Digital Systems Research for Existing and New Reactors address three thematic areas: Software Systems Dependability (2.1) The activities on software systems dependability aim at providing lessons learned and recommendations on processes, methods, techniques and tools for the different life cycle phases of software important to safety. This includes questions addressing the criteria behind successful approval process; the responsibilities, tasks and competence needs of the different personnel involved in the software development; means supporting the requirements elicitation process; methods and processes for generating appropriate design solutions; failure analysis, in particular with respect to common cause failures; the development and assessment of a safety case; the appropriate use of software qualification tests; and operational monitoring of systems performance. Complementary to these specific activities, the Project will provide a regularly updated report providing lessons learned and recommendations covering the full breadth of the area. Condition Monitoring and Maintenance Support (2.2) The research programme on condition monitoring and maintenance support will focus on accuracy and usability improvements of current methods and on the development of novel techniques to better support diagnostic activities and condition-based maintenance strategies. Operational Support (2.3) While the target user group of the condition monitoring and maintenance support activities are engineering and technical support teams, the target user group of the research programme on operational support are the actual control room operators. Within this research programme area the Project will address advanced control systems and their interactions with human operators, and issues related to the implementation and use of computerised operational procedures.

53 CR modernisation New CRs Outage CCs Enabling Field Op s New Operation concepts Knowledge management High integrity SW HP-1303 Summary of Forecasts versus Programme Items Table 1 provides a brief overview of the relevance for the various programme items with respect to the 7 forecasts. Table 1: Cross-reference between Forecast #1 7 and the themes in Chapters 1 and 2 Forecasts Legend: X - highly relevant (x) - partly relevant Themes #1 #2 #3 #4 #5 #6 #7 Ch. 1 Human Factors Research for Existing and New Reactors 1.1 Human Reliability X X (x) X 1.2 Human and Organisation Factors X X (x) (x) X (x) 1.3 Human-System Interfaces X X (x) X X (x) 1.4 Control Centre Design Process X X X (x) X X 1.5 Outage and Field Work X X X (x) 1.6 Future Operation Concepts (x) (x) X X Ch. 2 Digital Systems Research for Existing and New Reactors 2.1 Software Dependability X X X (x) X 2.2 Condition Monitoring and Maintenance Support (x) (x) X X (x) 2.3 Operational Support X X (x) (x) X (x) Programme Basis A new laboratory building called the MTO-lab was taken into use in The building consists of 7 different laboratories and facilities, as well as offices for laboratory staff. Fig. 6 shows a picture of the Hammlab part of the MTO laboratory as it is by spring Fig.6. Hammlab part of the MTO laboratory as of 2010, for more details, see Chapter 3. For a more comprehensive description of the MTO laboratory, see chapter 3 Programme Basis, MTO research.

54 HP HUMAN FACTORS RESEARCH FOR EXISTING AND NEW REACTORS People constitute a main element of the safety of nuclear power plants. The human factors research at the Halden Project supports both design and safety assessments of new solutions for existing plants, upgrades and new builds. Modernisation of NPP control rooms is ongoing in many countries, moving from panel-based control rooms into hybrid, combining computerised and traditional technologies, or even to fully computerised solutions. Similarly, control rooms of current new builds consist mainly of digital solutions. The NEA/CSNI identifies human factors research topics for new nuclear plant technology in a new Technical Opinion Paper, 1 and the proposed Halden Project programme addresses these topics in the current chapter. The Halden Project proposes to continue its research on control centres, innovative HSIs, design methods, training, outage and future operational concepts to meet demands of the nuclear industry, by serving modernisation projects and new builds with technical basis for guidelines, and ideas for new and innovative solutions, as well as regulators need for knowledge on evaluation of modern digital control centres. Human reliability analysis (HRA) is a significant issue in probabilistic risk/safety assessment (PRA/PSA) for nuclear power plants. NEA and CSNI have recently emphasized work on international studies to investigate human performance in a variety of hypothetical scenarios. 5.1 Human Reliability The HRP research on Human Reliability Analysis aims at advancing and sharing knowledge on control room crews emergency response. Central to this research are Hammlab simulator studies. There are three classes of HRA relevant information that Hammlab simulator studies can provide: (1) general human factors knowledge (evidence to be integrated in models and theories of human performance in complex systems); (2) empirical evidence of crew operation in emergency situations (e.g. narratives of simulated events); and (3) quantitative data (e.g. response times). HRP research aims at covering the full range of HRA relevant information. In the programme period, the International HRA Empirical Study was a central part of the activities in this field. If a new benchmark study comparing the performance of various HRA methods is proposed by member organisations, we could perform such a study again combining it with the other research topics proposed. Improving Scenario Analysis for HRA: Case Studies of HRA Practice Over the last two program periods, the International HRA Empirical Study has provided many insights into the strengths and weaknesses of HRA methods. We can now move on from evaluating HRA methods, and work towards solving some of the practical problems HRA analysts face in their daily work. The topic of the proposed project is scenario analysis, i.e. the stage in the HRA process where analysts develop a detailed qualitative understanding of the scenario evolution, of task requirements, 1 NEA/CSNI/R(2009)7: CSNI Technical Opinion Papers, No. 12: Research on Human Factors in New Nuclear Plant Technology, ISBN

55 HP-1303 of the impact of performance shaping factors (PSFs), and of failure mechanisms. In the HRA Empirical Study, scenario analysis emerged as one of the main sources of variability in HRA predictions. Good qualitative analysis helped some HRA teams predict the performance of operator crews in Hammlab, while other HRA teams struggled. It is therefore important to understand why scenario analysis is difficult and how it can be improved. A number of factors need to be considered, including the task analysis method used, the data available to the analyst, the analyst's expertise, and the influence of the HRA method itself (e.g. underlying failure model, set of PSFs). Advances in task analysis techniques and new data sources (e.g. operational narratives, HRA databases) promise significant improvements - but are they effective, and how can they be integrated into a real-world HRA process? Two issues need to be addressed: What are the main difficulties in scenario analysis, and how can the process be improved? Both issues require a more thorough understanding of HRA practice than is currently available. We will therefore work closely with HRA practitioners and method developers (both first and second generation methods), and organize the research around case studies of HRA practice. Only case studies provide the deep contextual understanding necessary to identify weaknesses in the current scenario analysis process, and to test the feasibility of proposed solutions. Expected results: Identification of success factors and challenges in scenario analysis. Improved HRA process through use of cognitive task analysis and HRA data sources (including feedback to data providers on the requirements for data used in HRA scenario analysis). Results will contribute to the technical basis for updating and refining guidance on HRA good practices (e.g. NUREG-1792). Modelling Cognitive Systems in Emergency Response Previous Hammlab studies have found that the effects of task complexity on crew performance are mediated by situational aspects, features of emergency procedures, crew expertise and teamwork, and the interactions between these factors. This conclusion is in line with the tenets of several research trends in contemporary cognitive science, such as situated cognition and activity theory, where cognitive performance in complex systems is seen as environmentally, culturally and dynamically situated. For HRA this has the consequence of making it difficult to apply the findings of laboratory research on basic cognitive properties of humans to the real-world area of control room emergency operation: in this type of research, problems, however complicated, are well specified by the fact that the situational context is removed, there are typically no cognitive tools like the procedures, and there are isolated individuals rather than specialized teams. The consequence for Hammlab research, where there are teams using procedures in realistic contexts, is that results obtained by manipulating some levels of one or two task-dependent variables (e.g. complexity), cannot be generalized to different contexts, unless valid and reliable profiling systems for assessing the levels of the variables in new contexts are available. Models of crew performance in emergency operation are needed for meeting the challenges of realism and situatedness of control room work: the models systematize and organize all relevant knowledge (be it from the psychology laboratory or from operational experience) by clearly specifying the important concepts, their relationships, and the way of assessing them.

56 HP-1303 The goal of this activity is to develop and empirically assess, in Hammlab and at external training simulators, models of crew operation where procedures, crew expertise and teamwork features are the most important independent variables. This research activity will include the following elements: Identification of the structural features of task and crew (e.g. aspects of the procedures that impact cognitive activity, expertise level). Definition of candidate models of cognitive activity and performance outcomes (e.g. effect of structural features on crew cognitive control modes and subsequent actions). Comparison of the models capability to explain and predict observed performance (across different scenarios and tasks). Expected Results: Tools and knowledge for improved qualitative task analysis, e.g., by guiding the scenario analysis at identifying the structural aspects of procedures that impact cognitive performance; support the HRA treatment of Errors of Commission, as decision making is a critical aspect of situated crew performance modelling; an evaluation of the impact of the empirically tested models on procedures development and crew training; support improvements of HRA methods and methods guidance; inputs for cognitive modelling of crew work. Resilient Procedure Use Procedure use is one of the most significant and under-researched issues in successful emergency response. Operators are expected to follow procedures closely. At the same time they are expected to take appropriate knowledge-based measures when the procedure does not match the system state. Such situations have recently been studied in Hammlab and were found to be challenging for operators. Clearly, a balance must be struck between procedural prescriptiveness and the operator s ability to recognize and adapt to unforeseen situations (so called rule-based or knowledge-based procedure following). Resilience research addresses such problems by emphasising the active role of the operator in responding to unforeseen events, and analysing the conditions necessary for a system to adapt to surprises. It builds on many recent developments in human and organisational factors research. The project will re-examine observations on procedure use in recent Hammlab experiments from the point of view of resilience engineering. This analysis will reveal the factors that promote or hinder resilience (including procedure features, situational characteristics, training, response strategies and crew factors). Based on these findings, we will work with practitioners to develop proposals for resilient procedure use, procedure writing and procedure presentation. These proposals will be tested in Hammlab experiments and possibly at training simulators. Expected Results: A model of resilient procedure use; A pilot test of resilient procedure use, potentially involving modified procedure structure, support system and training; Guidance on the usefulness of the resilience engineering approach. The results will build upon an analysis of current procedure use, including a synthesis of current knowledge about procedure issues (strengths and weaknesses). Exchange of HRA Empirical Evidence and Data The goal of this activity is to make available to the HRA community empirical evidence of crew emergency operation produced in Hammlab. This will be done in two ways:

57 HP-1303 By documenting observed performance in operational terms, i.e. by writing contextually rich narratives of observed performance in a format and language easy accessible to HRA practitioners. By collaborating at international efforts to develop frameworks for empirical information and data exchange. A notable example here is the Emergency Operating Systems (EOS) plant profiling, a framework for describing in a systematic way different plant emergency organisations (e.g. procedure characteristics, crew staffing and organisation) in order to adapt and reuse HRA analyses and operational experiences across plants. Expected Results: The main expected result of this activity is to improve the empirical knowledge base of HRA, particularly in regard to the analysts that do not normally have the possibility of performing their own simulator observations; providing guidance to member organisations for collecting and analysing HRA observations at training simulators. 5.2 Human and Organisational Factors Control Room Staffing in Emergency Situations In the proposed activity we will investigate how differences in staffing and roles in the control room affect important crew functions during emergency operation. A first step in the proposed work is to identify such crew functions. They could for example relate to how fast the crews work through procedures, how they make decisions, and if there is an independent second check of the status of the reactor safety or not. A second step includes describing two or three existing staffing solutions, and how their features correspond to the crew functions. Examples of how the staffing may vary are the number of crew members, the level of training in each position, if the operators have the same or different technical training, and if there is an independent evaluator on shift. We will investigate how the staffing solutions assure the important crew functions identified in the first phase, and will identify possible problem areas and existing good practices. Expected Results: Findings from this activity can support guidance on staffing and also improve the possibilities to exchange information between different nuclear organisations, and generalize results from the Halden Reactor Project simulator studies. Another motivation for the study is to have a basis for creating new solutions for staffing, making sure to consider the features of existing control rooms organisations that guarantee well-performing crews during emergency operation. Training of Control Room Operators: assessment and improvement Training is one of the cornerstones of safe operations. The benefits of training extend far beyond the acquisition of system knowledge and the practicing of emergency procedures. Training organisations face increasing challenges, and need to adapt their practices to maintain and improve the effectiveness of training. By working on training, the Project can use the knowledge from human performance studies in Hammlab to find solutions to the problems identified in these studies. We have chosen three areas where our competence can make a significant contribution to improving training and thereby safety.

58 HP-1303 Assessment of training effectiveness. The Project has extensive experience developing and testing measures of crew performance. We will investigate how these measures can be adapted to assess the short- and long-term effectiveness of training. Skills training. There is increasing recognition of the importance of leadership, teamwork skills, decision-making styles, and crew communication. These issues have been studied extensively in Hammlab. We will develop guidance on how to identify relevant skills, how crews can acquire these skills more effectively during training, and how trainers can select the right training approach to produce the desired outcomes. This activity will also investigate how individual and crew differences can be taken into account. Transfer of training and informal training. Learning has to continue outside the brief periods of simulator training. This activity will test tools and methods for on-the-job training, and investigate how to create a learning environment in daily work. We will survey training approaches at several organisations to identify existing practices relating to the topics listed above. We will then review Hammlab reports and relevant literature to develop guidance for each area. We will work closely with training organisations to develop and test training approaches based on this guidance, with validations taking place both in Hammlab and at training simulators. Expected Results: Guidance documents addressing assessment of training effectiveness, skills training and transfer of training and informal training; An analysis of current practices and approaches to training in several organisations, providing insights to practitioners who require a deeper understanding of current trends in training, e.g. managers, regulators and safety analysts. Training in Virtual and Augmented Reality Environments The nuclear industry needs to educate existing staff, to teach new work practices and to improve efficiency and safety. The industry also needs to educate new staff and contractors, to understand how underlying processes work, to embrace procedures, and learn how to work safely and effectively. With an aging workforce, it is increasingly necessary to capture and transfer competence and practices from experienced staff, and to manage feedback from issues identified during training, to improve actual work practices and procedures. We propose to focus on how 2D and 3D visualisation can be used to better support learning by highlighting significant information for the trainee in a pedagogically appropriate manner. We will investigate how effective instructional approaches and methods can be applied to AR and VR training by using realistic simulations to enable innovative teaching methods. This would include studying the instructor's role in VR-based training, and the effects of immersion and interaction. We also propose to develop interaction techniques that are specifically designed, and well-suited, for training needs. We will continue to develop and test solutions tailored for training of nuclear outage and maintenance, and related activities. Expected Results: Deeper understanding of how visualisation technology can support increased comprehension of learning material, increased retention, and better transfer of training, by matching proven instructional design with innovative visualisation techniques and intuitive user interaction.

59 HP Human-System Interfaces Innovative Human-System Interfaces for Near-Term Applications The member organisations of the Halden Project has over the past few years taken an active interest in research related to innovative Human-System Interfaces (HSIs), in particular to designs going beyond traditional P&ID-based presentation. In this process, the information presentation is improved in many ways, utilising the full capabilities of computerised solutions, but at the same time a high priority issue is to maintain good human factors principles. The Halden Project will in such processes act as a demonstration bed for innovative solutions, assisting utilities, authorities and vendors in their design and evaluation processes related to human-system interface designs 2. The aspect of HSI integration is emphasised from many NPP actors, and the Project started in the previous programme period the work of integrating many of the different HSI concepts being developed and evaluated in the past decade. The computerisation of procedures is a topic that will be emphasised, and particularly the further deployment of the Task-Based display concept for an augmented set of procedures and its integration with other types of computerised procedure technologies. The overall purpose of this activity is to design, and later make a full Human Factors evaluation, of an integrated HSI, which includes multi-layered design elements, such as large overview displays, partplant overview displays, computerised procedures alarm system and other task-oriented support, based on a unified design philosophy. The integrated HSI will cover all operational modes from outage and shutdown states, during phases of start-up, to normal operation and including incident and accident situations. The integrated HSI will, at the same time, support a joint operating crew of control room operators and field operators, by applying the HSIs at different presentation media such as large overview panels, operator stations and mobile devices. The integrated HSI concept should be acceptable by today s operators, support existing or improved work practices, and comply with relevant standards and guidelines. The design approach will largely be a user-centred one where domain experts assisted by Human Factors experts and HSI designers will create a complete HSI concept and provide a solution for demonstrations and tests. During previous programme periods, the Task-based Display concept has been used to implement computerised support for most of the event based procedures (e.g. reactor scram, containment isolation, turbine trip). The goal is now to expand this concept with a new set of computerised procedures covering all types of procedures used in normal, abnormal and emergency situations both for the main control room and local operation. Technical solutions supporting execution of procedures where close collaboration are needed with field operations, e.g. where particular procedure steps are executed from remote control points, will be a particular issue. The format of procedures may vary and probably both traditional and task-based concepts will be used. The relevant evaluation approach for the integrated HSI will be like the traditional type of studies conducted in Hammlab. Various types of user tests, human performance experiments and high-realism validation studies will be performed in dedicated HSI studies in Hammlab. But also in non-hsi oriented experiments, new interface features will be used and thereby be a source for collecting user feedback and other data for the HSI work. 2 HWR-866 Human-System Interface Research Strategy for the Halden Project (Ø.Veland), Halden Project, 2007.

60 HP-1303 Expected Results: An integrated HSI concept designed and evaluated, applicable for all NPP operational modes. Throughout the development process individual HSI solutions will be documented and presented as display prototypes. Human-System Interfaces to Facilitate Work Practices in Digital Control rooms The main goal will be to focus on how HSIs can be used to facilitate work practices, more specifically, communication and teamwork, in incidents and accidents situations. The main activities will be to develop and test a computer-based HSI that support communication and collaborative decision making in such situations. The HSI will be designed to support the team s common ground and shared awareness, as well as their cognitive models. The HSI will further include presentation of real-time visual and auditory information to field operators and other personnel located outside the control room and experts located outside the plant. This project will gather experiences from existing plants with various computer-based design solutions, and also look at how other industries have solved their HSI challenges. Surveys, detailed interviews and observations of operators will be performed, as well as field studies and workshops with operators. Design solutions will be developed based on this input, and tested in Hammlab. The development and testing will build on the experiences gained from the earlier phases of the Work practice project. Expected Results: Development and test of HSIs supporting communication and collaborative decision making in incidents/ accidents situations; Investigation of cognitive models to better understand what creates a cognitive burden in NPP, and how HSI solutions can be designed to overcome such burdens; Input for communication /communication protocols in computer-based control rooms. Human-System Interface Implementation Techniques Service-oriented architectures and more centralised information and knowledge repositories are leading to a greater integration of operations and information, where the boundaries between traditional software applications are being replaced by dynamic integration of information and functionality defined by context. Furthermore, after a long period of relatively standardised display resolutions and screen dimensions, computers of all sizes are now increasingly capable of supporting advanced interaction and visualisation techniques. Viable input and display technologies currently range from mobile devices to large overview panels, with wearable, desktop and multi-touch surface displays in between. More adaptive user interfaces are therefore necessary to support new work practices and emerging interaction and information technologies. Tools for designing and deploying HSIs for process control should support designers in organising potentially large numbers of displays and user interface elements in a manner that complements the HSI design approach used. Similarly, software for deploying process displays should provide greater flexibility in the management and display of context-relevant information, in order to significantly ease the burden on the HSI developer when implementing interaction and navigation strategies for multiple display contexts. This would reduce the risk of errors in the design and development of HSIs, and thus contribute to improving plant safety by providing an effective means to implement and test innovative display concepts to provide better information to operators.

61 HP-1303 This work would comprise of two main tasks: Studying and prototyping software technologies that could be used to support and improve HSI implementation and validation processes Reviewing existing and emerging software and hardware technologies that could be used in future control rooms, in order to enable these technologies to be tested in Hammlab. Specifically, we propose to continue to study how open semantic technologies could be used to verify that a HSI implementation contains the required user interface elements specified in a HSI design model. We will also explore how a design model could be used to automatically generate and manage HSI display layouts, and thereby reduce the risk of implementation errors. Furthermore, we propose to look into techniques for implementing context-dependent adaptive user interfaces. The viability and usability of these techniques will be evaluated by developing prototypes using ProcSee. Expected Results: Techniques to support the design, implementation, and testing of user interfaces for current and next generation HSIs. 5.4 Control Centre Design and Evaluation The Control Centre Design Process The Project s member organisations clearly recognise the need for practical and efficient methods supporting the control centre design process. Examples of basic design process models can be found in many standards and guidelines 3. However, there is need for further research on the design process, because current methods supporting the analysis and evaluation phases are in some cases not precise and reliable enough. In many cases they are also insufficient, and practitioners claim that results coming out of the methods do not justify costs. In HWR two major paradigms in design research is discussed, the "technical-rational" view and what one can refer to as the "design thinking" view. The design thinking view has largely replaced the technical-rational view in traditional design professions like product design and architectural design. A "technical-rational" view considers design as simply a case of analytical problem solving. It assumes and advocates a logical sequence starting with analysis to understand the problem, then synthesis of a solution, and eventually evaluation of this solution. According to this view, design can be improved by defining better methods and more precise use of these methods. Design decisions should as far as possible be based on scientifically established facts, and involves rational weighing of measurable qualities against well-defined criteria. We have seen how design thinking emphasizes how real-world design problems must be tackled using a "conversation-like", exploratory approach. Any design process will be shaped by the particular problem it tackles and will thus follow a trajectory that is essentially non-predictable. The term "interaction design" refers to the application of this kind of contemporary design thinking to Human-System Interface problems. 3 The multipart ISO standard 11064, NUREG 0711, ISO 6385, ISO 13407, EN 894, IEC 60964, IEC and IEC Øystein Veland: Design patterns in the nuclear domain: Theoretical background and further research opportunities, HWR-932, 2010.

62 HP-1303 In a bilateral project for the Norwegian petroleum industry gathering experience and identifying best practice for design of large screen overview displays was made in the form of design patterns. A design pattern states a proven solution strategy to a commonly occurring problem in a certain context. Each pattern has a name to remember it by and combines text and visual explanation. It aims to be detailed enough to be useful, yet flexible enough to allow each design project room for necessary local adaptation. Design patterns should be empirically and theoretically grounded and always state an insight that is necessary and non-trivial. In this activity we propose to gather experience and best practices from control room modernization projects carried out at many of the Project s member organisations, and present this experience in the form of design patterns. Further on these design patterns can be transferred into new methods and techniques supporting the control centre design process in an improved way, as opposed to today s stringent sequential technical-rational way of design thinking. Expected Results: Experience and best practice from control centre modification projects and compile these into control centre design patterns. Improving the Control Room Design Process using Virtual Mock-ups The nuclear industry is increasingly using virtual mock-ups to support control room design activities, and the software available to perform design evaluation tasks is more powerful and accessible than before. Specifically, 3D visualisation techniques enable designers, human factors specialists, and project stakeholders to communicate and evaluate ideas early in the design process. As 3D tools enable mock-ups to be created rapidly, resulting in more design iterations, the process of reviewing each iteration takes a relatively long time, as fixing an issue can lead to others that are not caught until submitted to review again. This process could be significantly improved by transforming review guidelines into rule-based tests that can be evaluated automatically by the design software, requiring the designer to either justify why a guideline will not be met or make appropriate changes to resolve the violation. The same techniques could also be used to achieve greater, more consistent, accuracy in design activities, potentially leading to more optimal solutions and improved management of design complexity. We propose to extend the testbed implemented in the programme period to support the inclusion of knowledge derived from sources such as fire and emergency regulations, operator interviews, general system requirements, and knowledge elicited from earlier stages in the design process, in addition to guidelines, such as ISO and NUREG This could potentially reduce the risk of developing suboptimal design solutions by identifying a wider range of issues early in the control room engineering process, while the cost of change is still low. By combining these techniques with 3D scene analysis, it should be possible to enable control room designers and evaluators to perform more reliable testing and reviewing of layout proposals by supporting continuous verification of layout designs as they evolve. It is necessary to demonstrate that the results of using virtual prototyping techniques for control room verification can be trusted. Therefore, we propose to carry out studies into the accuracy and effectiveness of virtual prototyping techniques, as a basis on which to make more qualified recommendations on the extent in which such tools can be used to manage and transform the

63 HP-1303 conventional control room design process used today into a more efficient agile process, without sacrificing the necessary rigour that needs to be demonstrated to justify the result. Expected Results: A method to improve the efficiency and accuracy of the control room design process. Guidance on how to apply knowledge-based software methods and techniques to support the design and evaluation of control rooms. Recommendations on the use of interactive 3D software tools designed to support a more agile design process for control room engineering. Fig. 7. Virtual prototype illustrating a possible workstation layout solution for evaluation Integrated System Validation New plants and major upgrades to existing plants make topical the question of how to assess that human performance of these systems supports safe and efficient operation. The purpose of Integrated System Validation (ISV) is to investigate whether the new or modernized control room or control centre perform within acceptable limits, and thereby support safe operation of the plant. New technology for instrumentation and control, human machine interfaces, operating procedure concepts, and work organisation have the potential for improving safety and efficiency, but can also produce new and unforeseen human performance problems. The testing of safe and efficient performance of the whole operational human-machine system, the so called human factors Integrated System Validation, is crucial for determining the acceptability of the modernized or the new plant's human performance capabilities. A major challenge in ISV is to define and select the human performance dimensions that should be assessed, and to establish trustworthy criteria for evaluating the acceptability of design solutions. Several industry projects have used the benchmark approach, utilising the performance of an existing accepted system as the reference for acceptable performance of a new or modernised control room. This approach has the advantage of providing criteria for human performance issue that traditionally have been difficult to define. For example, what is the sufficient level of situation awareness? One main drawback of the benchmark approach is the assumption that the human

64 HP-1303 performance of the existing control room represents acceptable performance for the new or modernised control room. For example, if a modernisation includes new safety systems and new automation the human performance of the old control room can be less relevant as a benchmark. Further, the comparison of the performance of the new design to the baseline does not always support the identification of causes for the observed performance in the new control room. An alternative to the benchmark approach is a criterion-referenced approach. In the criterionreferenced approach the acceptability criteria for human performance of the new control room need to be analytically derived or derived from the observations of the performance of the new design. A criterion-based approach is expected to improve the accuracy and validity of ISV and is expected to provide specific diagnostic information on the causes of observed human performance of the control room evaluated. While criterion-based approaches have been developed and discussed in other settings, the development and evaluation of criterion-based approaches for control room assessment are lacking. In the previous programme initial studies for the development of a criterion-referenced approach were performed. The initial studies looked at techniques that could be incorporated into such a measurement technology, e.g., task and scenario analysis, expert judgment, operator self evaluation, and identification of human performance requirements from technical specifications and safety analysis. The proposal for this three-year period is to continue this line of research and to concentrate on developing the basis for a criterion-referenced approach to ISV. Expected Results: Technical basis, tools and techniques supporting a criterion-referenced approach to human factors integrated system validation of new or modernized control room designs. 5.5 Outage and Field Work Human-System Interfaces in Outage Control Centres The Electric Power Research Institute (EPRI) issued in 2007 a guideline document on outage organisation and real-time management. This guideline mentions Outage Control Centres (OCC) as a means to support the recommended practices in organisation and outage management principles. The OCC role and infrastructure is in the guideline described as follows: The OCC assigns priorities, redirects resources, resolves problems, and makes decisions to keep the outage on track. It provides direction through line management in the respective work groups. Typically, the OCC is made up of representatives from each of the major departments on site. It is the focal point for outage execution. It is imperative that information flow from the OCC to the respective departments and the site in a timely and accurate manner. It is the responsibility of the department representatives to ensure that this happens. Research in this area is necessary because many characteristics and design aspects of OCCs, as well as collaboration and teamwork issues in outage are different from well-researched contexts such as the main control room. It has been shown that a key issue in outage is to share the current status of outage activities between people, either within the outage control centre or remotely. Any unscheduled or unforeseen event, any delay on a task beginning or closure must be shared, transmitted and pushed towards the people that are currently involved. It is especially important to share this information between the key actors,

65 HP-1303 no matter physical location in the plant; the main control room, the outage control room, and the field. We will investigate how emerging interactive tools can be utilized to support the OCC crew, exploring concepts in two main areas: Group-view displays to facilitate situation awareness among whole or groups within the OCC crew, and emerging collaborative technology, such as multi-touch surfaces, for more explicitly supporting teamwork. Information visualisation for the main control room has been a central part of HSI research at the Project for many years, and we will draw on this experience to design interactive tools for increasing efficiency and safety in outage. Expected Results: Development and test of innovative technical and organisational solutions for outages, in particular design patterns for outage control centres; Results on how advanced interactive tools, visualisation solutions and team collaboration can assist utilities in performing more efficient and safe outages. Teamwork in Outage Outages have changed significantly over the last 20 years, and more changes are on the horizon in the form of new technologies and new operational concepts. Supporting these developments is predicated on a detailed understanding of the current outage organisation, its main challenges and the drivers for change; an understanding of the relevant human and organisational factors (e.g. distributed and nonestablished teams, situation awareness in teams, trust); and an understanding of the proposed technologies and operational concepts (e.g. planning and scheduling tools, groupware technologies, location-sensing technologies and location-aware applications, video and data links, large-screen overview displays, integrated operation concepts, outage control centres). Many of these issues have not yet been studied in detail in Hammlab or in other research. In particular, collaboration in nonestablished, distributed teams (e.g. working with contractor staff) is significantly different from the well-researched area of teamwork in the main control room. The studies will be performed in collaboration between human factors analysts and design experts in Halden, and in close cooperation with industry. Case studies of outages in several member countries will be conducted to understand the drivers for change, the current outage organisation, best practices and challenges. These case studies will generate scenarios for developing and testing new technical and organisational solutions. Lessons learned on distributed teamwork and integrated operations in other industries (e.g. petroleum) will also be taken into account. The proposed solutions will be tested in Hammlab experiments and in design workshops with industry experts. Expected Results: An analysis of best practices and problems in outages in different organisations, with a focus on outage control centres; an analysis of the drivers for change and of relevant human and organisational factors (focus on distributed teamwork and maintenance error); guidance and reference data for measurement of outage performance. Ubiquitous Computing and Monitoring of Maintenance Activities Emerging technologies can be used to enable new work practices. Hand-held technologies enable mobile access to information and advanced computer-mediated support systems. Collaborative technologies support distributed decision-making and support. User interfaces integrate data from

66 HP-1303 multiple sources, and will probably do so more dynamically in future. New interaction technologies and methods will potentially offer more robust interfaces in industrial environments. By providing pertinent information to field operators, a better foundation for informed decision-making would be possible, reducing the risk of safety-related incidents during maintenance and outage operations. HRP will continue to identify, test and evaluate emerging technologies relevant to ubiquitous computing and to provide member organisations with competence and experience on the use of such technologies. By combining member organisations experience and knowledge on stakeholder s issues with the HRP s experience and knowledge on visualisation techniques and techniques for ubiquitous computing, we will seek to identify pilot applications relevant for maintenance and outage activities, focusing on the needs of operators in the field and of control centres responsible for planning, supervision, and control. Using combinations of desktop, large-screen, handheld, wearable, tracking, and collaboration technologies, we will implement and demonstrate pilot applications, and evaluate their usability. The usability of pilot applications and emerging technologies will be evaluated with respect to applicability within a harsh working environment compliance with nuclear safety standards usability for people in relevant working scenarios Evaluations are to be carried out in cooperation with member organisations to ensure the most relevant feedback. Expected Results: An understanding of how emerging technologies can be applied in real working environments to support field workers and support centres during maintenance and outage activities. Visualisation Applications to Support Decommissioning Activities Interactive 3D visualisation tools can be used to prepare and relate procedures for decommissioning activities to the environment in which they will take place, even if the target environment is not physically accessible to all staff involved in planning activities. 3D models of an environment can incorporate location-based information on the planning and coordination of individual work tasks and teamwork, on procedures related to tasks or work areas, on contamination and materials, and information about existing, past, or foreseen conditions that need to be evaluated to support decisionmaking. Past research and experience indicates great potential for using virtual power plant models, together with data on the surrounding environment, as knowledge repositories that can be updated and used throughout the life of a nuclear plant. In addition to optimising existing work practices, 3D technologies can be used to support the acquisition of experience and knowledge during the decommissioning process that can be applied to improve the design of new plants to make subsequent decommissioning easier. Virtual plants also make it possible to take more parameters into consideration at an early planning stage, such as the location of people and equipment, floor space availability, and estimated dose budgets, leading to improved planning and, consequently, improved

67 HP-1303 safety. Simulations of planned decommissioning activities can be used for education, briefing and communication with the public and other stakeholders. This project will focus on: Use of VR to prepare and validate procedures, calculate doses, and optimise shielding Supporting teamwork in planning and monitoring of decommissioning activities Preserving experience and lessons learned in decommissioning work Supporting the development of procedures focussing on the safety of workers Supporting evaluation of the consequences of potential accident scenarios on public safety Use of VR for public acceptance, briefing, and educational purposes The project work will primarily comprise of: Identifying specific requirements for software applications to meet decommissioning planning needs Software prototyping and development, building on the Halden Planner software (designed for maintenance and outage planning) Usability studies and user experience evaluations Expected Results: Concepts, methods, and technologies to support well-informed decision-making for planning decommissioning activities, supporting planning, training, improvement of work practices, and knowledge management. 5.6 Future Operational Concepts Highly Automated Plants Future plants will probably be highly automated. The driving force behind this development is that computers can perform well-defined tasks more reliably and effectively than humans. This has given us the power to control industrial systems of increasing complexity. Another projection is that automatic systems will become more intelligent and autonomous, and might even be able to control the whole plant under normal and upset conditions like the autopilot in an aircraft. Intelligent control concepts are investigated under activity Advanced Control and Automation Support in Chapter 2.3. Automation is basically a computer program that executes pre-specified rules with superior speed and precision. This strength is also a potential weakness, as the rigidity of computers can be limiting in situations that demand an element of creative thinking. Humans, on the other hand, possess flexible problem solving abilities that are essential in the handling of unexpected and ill-defined events. Thus, automatic systems and human operators complement each other on a fundamental level, and are likely to coexist also in future control environments. Increased levels of automation has traditionally been associated with loss of operator situation awareness, de-skilling, miscalibrated trust, destructive workload transitions and other Human Factors challenges. In order to compensate such problems, there is a need for new operational concepts and technologies that can help humans to control highly automated future plants.

68 HP-1303 An initial research activity will be an analysis of the industry trend towards higher levels of automation: What are the drivers and needs for more automation? Which problems are intelligent and autonomous automatic systems supposed to solve? Which control functions should, and should not be automated, and why? Can we utilise successful elements from current concepts of operation in highly automated environments? This analysis work will establish a basis for further research. The main research activity during the three-year period will be to develop solutions that can enhance the collaboration between human operators and automatic systems in highly automated plants. More specifically, we will focus on the following topics: Automation design. We will develop automation algorithms for the HAMBO simulator that can handle known transients, such as scram, turbine trip and containment isolation. Existing computer scripts are already able to perform basic monitoring and detection of process deviations in normal plant states, and can execute automatic start-up or shutdown of the plant. Our aim is to demonstrate how future automatic systems might work, and use the resulting plant autopilot to develop new humanautomation interaction styles and transparent automation interfaces (see below). Interaction with automation. We will establish new human-automation interaction styles, where control tasks are dynamically shared among operators and automated agents. For example, automation can maintain a current process state while human operators mitigate a problem, or operators can manage the set-points for automation to optimize the process development. This research activity will be performed in the Future Plant Lab (refer Programme Basis) and is a joint venture with the Future control environments research activity (see below). Observability of automation. Emerging interface design solutions will be used to support the communication of the automatic systems capabilities, responsibilities, goals, activities, and the consequences of automatic actions. This research activity will be performed in the Future Plant Lab and is an integrated part of the Future control environments research activity. Expected Results: The research on highly automated plants will provide new operational concepts and technological solutions for future control environments where humans and automation work closely together as a team. Future Control Environments Addressing plants to be built in the future, this work builds on two basic premises: 1) That environments and tools shape human performance, and 2) that the environments and tools utilized for nuclear process control will undergo significant changes in the not too distant future. Computers are becoming increasingly pervasive, and the ways we interact with technology is evolving rapidly. We feel confident that this trend will drastically influence the nuclear domain in years to come, as both operational concepts and the technology evolves. We also believe that present computerized interfaces for process control are far from mature: Their form is most often a simple translation of traditional P&ID based hard-panelled interfaces made to fit computer screens, and there are quite a

69 HP-1303 few known challenges associated with them. Thus, there is both great room and opportunity for radical innovation. To our minds, meaningful research into future control environments has two main components. The first is analytical: We need to identify which factors will be dominant in shaping tomorrows` control environments, and in which areas safety is potentially most affected. The second component is creative: We need to explore the directions that these changes might take, increasing our understanding of possible gains and potential challenges that might be associated with them. This involves exploring and developing innovative solutions and gain some experience in their use. When building next generation interfaces for nuclear process control we will seek to merge the best qualities of traditional and computerized interfaces while simultaneously avoid known challenges. We envision this future control environment as an open environment where the current plant state and the activity of others are transparent (both human and machine agents, locally and remote), where we provide powerful information visualisation displays and facilitate a directness of control. Our approach will include utilising emerging interaction technology, such as haptics, multi-touch interfaces and large high-resolution displays to enhance operators ability to meet new operational challenges. We believe that the successful operation of future plants will need to build on an increased understanding of several key topics, such as well functioning human-automation teams, information visualisation, alarming techniques, acoustic interfaces, computerized procedures and fluent remote collaboration. A central tool in this research will be a Future Plant Lab a physical space in the MTO-lab building used for investigating futuristic operational concepts and tools (refer Programme Basis). The Project will have close ties to the activities Highly automated plants (see above) and Innovative HSIs for nearterm applications (refer 1.3) research activities. Expected Results: The project will provide visions of future control environments based on concept work in the Future Plant Lab. It will address the topics outlined above, proposing solutions for enhancing the efficiency and safety of future plant operations. Delivered both as concept illustrations, working prototypes and work reports, the Project will raise key issues, challenge conventional HSI practices and facilitate broad industry discussion regarding valuable directions for further research and development.

70 HP DIGITAL SYSTEMS RESEARCH FOR EXISTING AND NEW REACTORS Existing and new reactors are expected to rely in increasing degree on digital systems in general and on software systems in particular. The activities proposed in this chapter focus on three central aspects of digital systems research, namely the dependability of software systems, the development and application of software systems for condition monitoring and maintenance support, and the development and application of software systems for operational support. The overall objective of the Project s research programme on software systems dependability is to contribute to successful development, assurance and deployment of high integrity software within the nuclear sector. The Project s activities within this area concentrate on processes, methods, techniques and tools for the different life cycle phases of software important to safety. The research programme on condition monitoring and maintenance support will focus on accuracy and usability improvements of current methods and on the development of novel techniques to better support diagnostic activities and condition-based maintenance strategies. While the target user group of the condition monitoring and maintenance support activities are engineering and technical support teams, the target user group of the research programme on operational support are the actual plant operators. Within this research programme the Project will address advanced control systems and their interactions with human operators, and issues related to the implementation and use of operational procedures. 6.1 Software Systems Dependability The activities on software systems dependability aim at providing lessons learned and recommendations on processes, methods, techniques and tools for the different life cycle phases of software important to safety. Through consideration of requirements and recommendations in relevant international standards and guidelines, as well as needs identified by stakeholders, the research programme aims at improving the knowledge on how to best implement these in real projects. This involves the use of principles such as top-down design methods, modularity, verification, validation, assessment, configuration management and change control, and the appropriate consideration of organisational and personnel competency issues. The programme involves both indepth and in-breadth research related to these principles, with the aim or providing lessons learned and recommendations that help the different parties develop, operate and maintain software that is safe to put into use and that preserves its level of safety integrity and dependability throughout its lifetime. In order to extend the basis for recommendations and lessons learned within this area, the programme will benefit from organised knowledge transfer from the use of software in control and protection systems in other application areas like petroleum, air traffic control and railway signalling. The programme is addressed to all parties involved in the development, assessment, approval, operation, and maintenance including software vendors, safety authorities, and utilities. Software Development Based on the specification of system and safety requirements, the development of software starts by establishing the software requirements and culminates with the final acceptance of the software.

71 HP-1303 Important issues related to software development include how to describe a complete set of requirements for the software meeting all system and safety requirements, and how to develop a software architecture that achieves these requirements, to identify and evaluate the significance of hardware/software interactions for safety, to achieve software which is analysable, testable, verifiable and maintainable, and to demonstrate that the software and the hardware interact correctly to perform their intended functions. The activities on software development cover aspects related to requirements, architecture, design, implementation, integration, and final acceptance: Requirements elicitation. An important activity in the early phases of the software development is to elicit the software requirements from the different inputs to the requirements management process. The Project will investigate means to support the requirements elicitation process, in particular with respect to the possibility to automate parts of the requirements elicitation and the establishment of traceability from requirements to their sources. Development processes. Standards and guidelines provide requirements to the software development, but do not necessarily provide recommendations on which methods and development processes are the most effective for generating design solutions appropriate for the required safety and dependability. In particular, there is a need for guidance on the safe use of advanced technologies like multi-core processors and adaptive control. The Project will address these needs by providing recommendations on development processes and methods for generating design solutions appropriate for the required safety and dependability. Expected Results: Means supporting the requirements elicitation process. Furthermore, recommendations on development processes and methods for generating design solutions appropriate for the required safety and dependability. Software Assurance For software important to safety, important concerns are how to assure that the software fulfils the requirements, is safe to put into use, and otherwise is fit for its purpose. Important issues related to software assurance include how to ascertain the behaviour or performance of software, to ensure that output items of a specific development phase fulfil the requirements and plans with respect to completeness, correctness and consistency, to demonstrate that the processes and their outputs are such that the software fulfils its requirements and is fit for its intended application, to ensure that the software performs as required, preserving the software safety integrity and dependability when modifying the software, and to ensure that potential failures of tools do not undetected adversely affect their output in a safety related manner. The activities on software assurance cover aspects related to software analysis, testing, verification, validation, assessment, quality assurance, configuration management, modification control, and support tools: Failure analysis. The objective of software analysis is to ascertain the behaviour or performance of the software through detailed examination of its components or structure. Failure analysis concerns the

72 HP-1303 ability of the software to meet its specified safety requirements in the event of random hardware faults and, as far as reasonably practicable, systematic faults. This analysis addresses effects of single faults, independence of items, detection of single faults, actions following fault detection, effects of multiple faults, and defence against systematic faults. The research activities on failure analysis will investigate how to effectively address both product and process aspects in the analysis, covering faults introduced in the technical design as well as errors made in the life cycle activities. Of particular concern are faults that have a potential for common cause failures. The research will provide recommendations on how the failure analysis can be improved through optimal combinations of description and analysis techniques reflecting all relevant viewpoints. Development and assessment of the safety case. Basic to the approval processes in many countries and industries is the provision of a safety case, i.e. the documented demonstration that the product complies with the specified safety requirements. The safety case forms part of the overall documentary evidence to be submitted to the relevant safety authority in order to obtain safety approval of a product. The Project will research this topic by developing a method and tool for developing and assessing a safety case and its supporting documentation for software-based systems, including the assessment of tool automated processes, making optimal use of probabilistic and analytical assessment methods. The method and tool will be designed to support the developer and the assessor in respectively documenting and assessing the necessary evidence, providing assistance for checking that relevant questions have been covered, for checking that the argumentation is complete, correct and consistent, and for following up identified deviations and defects in the safety argumentation and documentation. Expected Results: Recommendations on how failure analysis can be improved through optimal combinations of description and analysis techniques; furthermore, a method and tool for developing and assessing a safety case and its supporting documentation for software-based systems. Software Approval and Deployment In order for a safety critical system to be put into use, the safety demonstration needs to be accepted by the relevant safety authority through a formal approval process. A successful deployment of the software furthermore requires that the final software behaves as expected when executed in the target system, and that it continues to perform at the same level throughout its life time. Important issues related to software approval and deployment include how to ensure an effective approval process and that the software preserves its safety integrity and dependability when it is deployed in the final environment of application and when making corrections, enhancements or adaptations to the software: Effective approval processes. Successful introduction of software important to safety requires effective processes providing the necessary documented evidence that the software is safe to put into use. This puts great demands on all life cycle phases, and needs to be reflected in the processes employed for the development and approval of the software.

73 HP-1303 The programme addresses this topic by surveying approval processes in different countries and industrial sectors, with the aim of identifying the most important criteria behind successful safety approvals. The activity will focus both on the authorities approval activities and how the suppliers can support these activities. Safety qualification tests. In many cases, the safety case prescribes a number of safety qualification tests to be carried out under operational conditions before the concerned system is given full responsibility for safety. These tests do not replace the safety argumentation in the safety case, but are designed to provide increased confidence in the system. The Project will address this topic by surveying the role of safety qualification tests in concrete projects, and provide recommendations on how these tests can be designed and carried out to support the acceptance and deployment of software important to safety. This includes recommendations on how to provide the necessary documented demonstration of the sufficiency of the tests. Expected Results: Identification of the most important criteria behind successful safety approvals. Recommendations on how safety qualification tests can be designed and carried out to support the acceptance and deployment of software important to safety. Lessons Learned and Recommendations on Software Dependability In order to support the different research activities and provide adequate lessons learned and recommendations, the Project will produce a regularly updated report reflecting an in-breadth perspective on the competence area, providing lessons learned, recommendations, and references to relevant work, and identifying gaps that require further research. The report will provide recommendations on processes, methods, techniques and tools for the different life cycle phases of software important to safety, with indication of constraints of application based on experiences. Since the scope of the report will be the full breadth of software systems dependability, it will also serve as a guide to the competence area, and make it easier to see how the Project s research activities fit issues and challenges within this area. The report complements the more in-depth research activities performed by the Project by putting these activities into context, thereby reducing the risk of performing individual research activities isolated from a broader consideration of their significance. The report is expected to serve both the users of the Project s research and the Project itself, in the utilization and further planning of software dependability research carried out by the Project. Expected Results: Regularly updated report providing lessons learned, recommendations, and references to relevant work, and identifying gaps that require further research. 6.2 Condition Monitoring and Maintenance Support Advanced digital systems and technologies for decision support in plant supervision and diagnostics are expected to lead to improved availability and safety of the plant systems and improved effectiveness of the human interaction with automation. These factors are equally important to existing as well as to future plants.

74 HP-1303 This sub-chapter focuses on new developments of condition monitoring and condition-based maintenance methods, building on the accumulated experience from previous research programmes and the feedback from the practical use of the developed methods and tools. Particular attention will be given to the pursuit of significant improvements in the accuracy and usability of well proven methods developed at the Project, such as physical modelling and data reconciliation, and at the same time to the investigation of new possibilities for additional functionality that can be obtained from the combination and integration of complementary techniques. New methods that facilitate the automation of the interpretation of the results coming from currently deployable condition monitoring systems will lead to greatly enhanced diagnostic capabilities. New methods for equipment health assessment will also form the basis for the implementation of condition-based maintenance strategies where the estimation of equipment remaining useful life is a key concept. The Mímir modular platform for advanced condition monitoring and condition-based maintenance applications developed during the programme period will be used for the implementation and benchmarking of prototypes deriving from the developed methods. Performance Monitoring with Verified and Validated Physical Models The primary purpose of physical models using data-reconciliation, such as implemented in TEMPO, is to monitor the performance of instruments, equipment, and the balance of plant. Current techniques using analysis from a snapshot of measurements provide methods for detecting instrument faults and some equipment faults. However these methods have high detection thresholds and are limited in the kinds of fault they can detect. Previous research by HRP has shown that time series analysis of many such snapshots can be used to reduce detection thresholds and increase the types of faults which can be detected. Research in this area will be centered on determining which analysis methods of this data give the best results for fault detection and aid in the optimization of equipment and plant performance. At a nuclear power plant (NPP) no physical model for a large system can be constructed in a completely theoretical manner. Assumptions are normally made for parameters such as turbine constants and other component efficiencies in a rather qualitative manner, but these parameters have a large uncertainty associated with them. Some form of empirical modeling becomes then essential to the improvement of the accuracy of the physical model and to the verification of physical models against the available history of plant data. In this context verification refers to whether a specific parameter is being modeled correctly, while validation refers to whether the correct parameter is being modeled. The long term aim of this activity is to be able to complement systems based on physical models such as TEMPO with methods and procedures for adjusting and tuning its physical model parameters in an automatic fashion, i.e. to learn on its own. Before this can occur more work must be performed to qualify the validity of the empirical parameters based on various plant states. While one would like the system to be applicable to many different nuclear power systems it is likely that empirical models will be specific to the plant that is modeled. However, by practicing empirical modeling on multiple plants

75 HP-1303 one can obtain a procedure to determine how, when, and which parameters should be adjusted. It is this procedure that will be critical to future development. Expected Results: Methods and procedures for the analysis of the data-reconciliation results to reduce the amount of expert knowledge required to utilize these techniques, and making them more attractive for implementation. Verification and validation processes for physical model improvement that will help satisfying NPP s needs from business, technical, and regulatory perspectives. Higher accuracies and decreased uncertainties that will lead to improved plant simulation capabilities, better plant economics and safety, and increased confidence from plant engineers in relying on TEMPO and similar systems for online monitoring. Diagnostic Decision Support Reliable methods and systems are currently available for fault and anomaly detection, and among these we can mention HRP s TEMPO (used to detect abnormal conditions based on data reconciliation techniques) and PEANO (used to monitor sensor performance based on empirical auto-associative techniques). While the monitoring functions performed by these systems are reasonably automated, the actual interpretation of the results obtained is still a manual process. A typical diagnostic task could be for example the determination of whether some observed anomalous residuals are due to a component or instrumentation fault. The proposed activity will investigate techniques and methods for the (partial) automation of the diagnostic processes, also in light of the higher automation requirements of more complex condition monitoring settings such as those envisioned for fleet-wide monitoring centres. In this respect, qualitative and functional modelling techniques such as, for example, Multilevel Flow Modelling (MFM), could be used to automate the diagnostic process. These modelling techniques provide an abstract description of the plant process and of the causal relationships between the functions associated to each component which can then constitute the basis for advanced diagnostic decision support. Expected Results: Methods and techniques such as goal- and function-oriented modelling and qualitative reasoning to automate the diagnosis process, and their integration with existing COSSes for sensor monitoring and fault detection (e.g. PEANO and TEMPO). Health Assessment and Prognostics The industry is moving from an age-based maintenance towards a condition-based maintenance (CBM) regime where maintenance decisions are based on the information collected through condition monitoring, maintenance events, inspections, design quality and reliability, environmental conditions and expert knowledge. The health assessment of an item or judgment of the state of the item at a specified time based on this information is a challenge. This activity aims at the definition of a general methodology for assessing the equipment health state based on its technical condition, its operational history, design quality, and reliability. The investigation of the following key aspects is being proposed:

76 HP-1303 Verify how enhanced instrumentation in terms of continuous measurements of degradation quantities can improve prognostics and estimates of equipment lifetime. Investigate how empirical models can be used to improve existing technical condition indicators or define new ones. Propose guidelines for a standard approach to the recording of operational failures, maintenance data, and experiences, so as to facilitate the establishment of a common understanding among all technicians and maintenance related workforces in the plant of how to assess the technical condition in practice. Application-specific implementations of the general methodology will be performed in case studies in cooperation with member utilities. Expected Results: A general methodology for equipment health assessment. Application-specific implementations of the general methodology and prognostics in case studies offered by the utilities, including guidelines for instrumentation, documentation, and formulation of qualitative rules needed for prognostics. 6.3 Operational Support While sub-chapter 2.2 focuses on digital systems research in support of condition monitoring, diagnostics, and prognostics, where the primary users of the technology are engineering and technical support teams and experts, this sub-chapter directs it focus to the sharper end of spectrum of activities related to plant monitoring and supervision, namely the actual operation of the plant. Two main aspects of operational support are proposed investigated in the programme period, the first related to advanced control systems and their interactions with human operators, i.e. how advanced techniques can improve the reliability and robustness of automated control, and the second related to operation procedures, i.e. how advanced techniques can improve the reliability of procedural human control. Advanced Control and Automation Support Growing complexity of process automation and automation support systems involving operation, condition monitoring, diagnosis, control, optimization and safety & performance assessment, calls for more systematic and efficient solutions for design, assessment and integration of new technologies for especially enhanced supervisory and fault-tolerant control. Such solutions need also to take into account interactions between manual and automated operation and control, which also calls for solutions towards optimal decision support systems. This proposed activity focuses therefore on problem areas related to supervisory, fault-tolerant control, and decision support functionalities in advanced control and automation systems. As far as human-automation interactions are concerned, it is also important to analyze the usability aspects of these methods and techniques for, e.g., improved operator situation awareness and alertness. These issues will be addressed in the proposed activities Future Operational Concepts (ref Chapter 1.6).

77 HP-1303 The technical focus of this proposed activity will be on the application of methods supporting a multipurpose view of systems, as well goal- and function-oriented methods supporting a single-purpose view of systems. Furthermore, qualitative and quantitative information gained from on-line monitoring, early fault detection and diagnosis activities will be taken into account in evaluation, application and development of particularly methods and techniques for design and integration of supervisory and fault-tolerant control functionalities. Expected Results: Evaluation and integration of methods, techniques and tools for enhanced information extraction, processing, and presentation for advanced control and automation with various degrees of human-automation interactions. Utilization of qualitative and quantitative information gained from on-line monitoring, early fault detection and diagnosis activities in evaluation, application and development of methods and techniques for design and integration of supervisory and fault-tolerant control functionalities. Computerized Assessment of Procedures The iterative development of procedures and their reliable maintenance is a challenging activity. At regular intervals change proposals are submitted due to some recently found defect of a procedure. After a presumed correction has been proposed and implemented, it is needed to assess the procedure so that the new version does not destroy any of the goals to be established by the procedure or violate any rule established for the presentation and structuring of the procedure. This work intends to explore how and to what extend computerization may facilitate this process. One of the opportunities that are conceivable is the automated execution of fully detailed procedures such as the Emergency Operating Procedures. Still the full coverage automatic verification of a procedure is very hard due to the many cases and different contextual conditions where the procedure needs to be tested. One solution to this problem is to defer the assessment of the procedure to its immediate execution because at that time many of contextual conditions have been fixed. In this situation a computerized procedure system may be run in combination with a faster-than-real-time simulator to uncover if the application of the procedure fails to achieve the desired process state and the reason for this. In this way procedure defects may be detected and modified and fed back to the procedure maintenance organization. Procedures may also be assessed with respect to presentation guidelines, in particular those guidelines that have been used previously thus asserting consistency of procedure presentation and structure. Guidelines on paper based procedures are abundant (e.g. IAEA TECDOC-341 and 1058, DOE-STD ), and some of these guidelines would also apply to computerized procedures. Computerized testing of presentation can be done upfront of the procedure deployment and also during procedure execution as a procedure usage feedback framework of the operator. Expected Results: Methods, tools, and prototypes for the computerized assessment of procedures. In particular prototyped automated procedure execution in the HAMMLAB environment will be endeavoured. As a side effect of this undertaking tentative guidelines for the deployment of computerized procedures on portable devices are expected.

78 HP PROGRAMME BASIS, MTO RESEARCH 7.1 The MTO laboratories A new laboratory building, IFE MTO-lab, was taken into use in The new building consists of spacious laboratory facilities, as well as offices for laboratory staff. Fig. 9 shows a screenshot of a VR model of the 2010 version of the MTO laboratory facilities. Fig. 9 The MTO-lab Hammlab (1) has since its establishment in 1983 been the major basis for the Halden Project programmes on human factors research and human-computer systems development. Hammlab has two advanced and modern nuclear simulators, the HAMBO simulator (BWR, simulates the Forsmark-3 plant in Sweden), and the RIPS simulator (PWR, simulates the Ringhals-3 plant in Sweden). The simulators have capabilities also supporting the proposed programme activities on outages and future plants. All simulators are connected to an advanced, fully digital control room environment. The hardware/software platform for the simulators, the control room systems and the experimenters systems for executing and analysing data from experiments in Hammlab have also been continually upgraded, making Hammlab a flexible and efficient facility for the proposed MTO-research programme. In the Experimenters Gallery (3), researchers monitor and manipulate the simulators during experiments with licensed operators in Hammlab. They have equipment available for data, video, and audio recordings.