SIST EN 61227:2016

SLOVENSKI STANDARD
SIST EN 61227:2016
01-junij-2016
Jedrske elektrarne - Nadzorne sobe - Krmilni elementi
Nuclear power plants - Control rooms - Operator controls
Kernkraftwerke - Warten - Handbedienungen
Centrales nucléaires de puissance - Salles de commande – Commandes Opérateurs
Ta slovenski standard je istoveten z: EN 61227:2016
ICS:
27.120.20 Jedrske elektrarne. Varnost Nuclear power plants. Safety
SIST EN 61227:2016 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST EN 61227:2016

---------------------- Page: 2 ----------------------

SIST EN 61227:2016


EUROPEAN STANDARD EN 61227

NORME EUROPÉENNE

EUROPÄISCHE NORM
March 2016
ICS 27.120.20

English Version
Nuclear power plants - Control rooms - Operator controls
(IEC 61227:2008)
Centrales nucléaires de puissance - Salles de commande - Kernkraftwerke - Warten - Handbedienungen
Commandes opérateurs (IEC 61227:2008)
(IEC 61227:2008)
This European Standard was approved by CENELEC on 2016-02-29. CENELEC members are bound to comply with the CEN/CENELEC
Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC
Management Centre or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the
same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.


European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2016 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
 Ref. No. EN 61227:2016 E

---------------------- Page: 3 ----------------------

SIST EN 61227:2016
EN 61227:2016
European foreword
This document (EN 61227:2016) consists of the text of IEC 61227:2008 prepared by SC 45A
"Instrumentation, control and electrical systems of nuclear facilities" of IEC/TC 45 "Nuclear
instrumentation".
The following dates are fixed:
(dop) 2017-03-01
• latest date by which the document has to be implemented at
national level by publication of an identical national
standard or by endorsement
(dow) 2019-03-01
• latest date by which the national standards conflicting with
the document have to be withdrawn

Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CENELEC [and/or CEN] shall not be held responsible for identifying any or all such
patent rights.
As stated in the nuclear safety directive 2009/71/EURATOM, Chapter 1, Article 2, item 2, Member
States are not prevented from taking more stringent safety measures in the subject-matter covered by
the Directive, in compliance with Community law. In a similar manner, this European standard does
not prevent Member States from taking more stringent nuclear safety measures in the subject-matter
covered by this standard.
Endorsement notice
The text of the International Standard IEC 61227:2008 was approved by CENELEC as a European
Standard without any modification.
2

---------------------- Page: 4 ----------------------

SIST EN 61227:2016
EN 61227:2016
Annex ZA
(normative)

Normative references to international publications
with their corresponding European publications
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
NOTE 1 When an International Publication has been modified by common modifications, indicated by (mod),
the relevant EN/HD applies.
NOTE 2 Up-to-date information on the latest versions of the European Standards listed in this annex is
available here: www.cenelec.eu.

Publication Year Title EN/HD Year
IEC 60073 -  Basic and safety principles for man- EN 60073 -
machine interface, marking and
identification - Coding principles for
indicators and actuators
IEC 60964 -  Nuclear power plants - Control rooms - EN 60964 -
Design
IEC 61771 -  Nuclear power plants - Main control- - -
room - Verification and validation of
design
IEC 61772 -  Nuclear power plants - Control rooms - EN 61772 -
Application of visual display units
(VDUs)
IAEA Safety Guide 2002 Instrumentation and control systems - -
NS-G-1.3 important to safety in nuclear power
plants

3

---------------------- Page: 5 ----------------------

SIST EN 61227:2016

---------------------- Page: 6 ----------------------

SIST EN 61227:2016
IEC 61227
Edition 2.0 2008-04
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE


Nuclear power plants – Control rooms – Operator controls

Centrales nucléaires de puissance – Salles de commande – Commandes
opérateurs

INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
PRICE CODE
INTERNATIONALE
S
CODE PRIX
ICS 27.120.20 ISBN 2-8318-9732-7

---------------------- Page: 7 ----------------------

SIST EN 61227:2016
– 2 – 61227 © IEC:2008
CONTENTS
FOREWORD.0H3
INTRODUCTION.1H5

1 Scope.2H7
2 Normative references .3H7
3 Terms and definitions .4H7
4 Design principles.5H8
4.1 Basic concepts .6H8
4.2 Types of HMI.7H9
4.2.1 Discrete controls .8H9
4.2.2 Soft controls .9H9
4.3 Selection of control system.10H10
5 Design requirements .11H11
5.1 Individual controls and indicators .12H11
5.1.1 Control board layout .13H11
5.1.2 Positioning of groups .14H12
5.1.3 Device layout.15H12
5.1.4 Uniformity of orientation .16H13
5.1.5 Mimic diagrams .17H13
5.1.6 Coding.18H14
5.1.7 Protection against mal-operation of control devices .19H15
5.1.8 Compatibility with VDU formats.20H15
5.2 Soft controls.21H16
5.2.1 Display devices .22H16
5.2.2 Selection displays.23H17
5.2.3 Input Fields .24H17
5.2.4 Input formats .25H17
5.2.5 User-System Interaction .26H17
5.3 Special requirements for touch panels.27H18

28H20
Annex A (informative) Examples for the arrangement of discrete controls .

---------------------- Page: 8 ----------------------

SIST EN 61227:2016
61227 © IEC:2008 – 3 –
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________

NUCLEAR POWER PLANTS –
CONTROL ROOMS –
OPERATOR CONTROLS


FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote
international co-operation on all questions concerning standardization in the electrical and electronic fields. To
this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,
Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC
Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested
in the subject dealt with may participate in this preparatory work. International, governmental and non-
governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely
with the International Organization for Standardization (ISO) in accordance with conditions determined by
agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence
between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in
the latter.
5) IEC provides no marking procedure to indicate its approval and cannot be rendered responsible for any
equipment declared to be in conformity with an IEC Publication.
6) All users should ensure that they have the latest edition of this publication.
7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
members of its technical committees and IEC National Committees for any personal injury, property damage or
other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and
expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC
Publications.
8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is
indispensable for the correct application of this publication.
9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of
patent rights. IEC shall not be held responsible for identifying any or all such patent rights.
International Standard IEC 61227 has been prepared by subcommittee 45A: Instrumentation
and control of nuclear facilities, of IEC technical committee 45: Nuclear instrumentation.
This second edition cancels and replaces the first edition published in 1993 and constitutes a
technical revision. This edition includes the following significant technical changes with
respect to the previous edition:
a) account has been taken of the fact that computer design engineering techniques have
advanced significantly in the intervening years;
b) alignment of the standard with the new revisions of IAEA documents NS-R-1 and NS-G-
1.3, which includes as far as possible an adaptation of the definitions;
c) replacement, as far as possible, of the requirements associated with standards published
since the first edition, especially, IEC 60964 (edition 2) and IEC 61772 (edition 2);
d) review of the existing requirements and updating of the terminology and definitions.

---------------------- Page: 9 ----------------------

SIST EN 61227:2016
– 4 – 61227 © IEC:2008
The text of this standard is based on the following documents:
FDIS Report on voting
45A/694/FDIS 45A/702/RVD

Full information on the voting for the approval of this standard can be found in the report on
voting indicated in the above table.
This publication has been drafted in accordance with the ISO/IEC Directives, Part 2.
The committee has decided that the contents of this publication will remain unchanged until
the maintenance result date indicated on the IEC web site under "http://webstore.iec.ch" in
the data related to the specific publication. At this date, the publication will be
• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.

---------------------- Page: 10 ----------------------

SIST EN 61227:2016
61227 © IEC:2008 – 5 –
INTRODUCTION
a) Technical background, main issues and organisation of this standard
This IEC standard specifically focuses on operator controls.
It is intended that this standard be used by operators of NPPs (utilities), systems evaluators
and by licensors.
b) Situation of the current standard in the structure of IEC SC 45A standard series
IEC 61227 is the third level IEC SC 45A document tackling the generic issue of operator
controls.
IEC 61227 is to be read in association with IEC 60964 and IEC 61772. IEC 60964 is the
appropriate IEC SC 45A chapeau document for control rooms which provides guidance on
control room design and which references IEC 61227. IEC 61772 establishes requirements for
the application of VDU (Visual Display Units).
For more details on the structure of IEC SC 45A standard series, see item d) of this
introduction.
c) Recommendations and limitations regarding the application of this standard
It is important to note that this standard establishes no additional functional requirements for
safety systems.
To ensure that this standard will continue to be relevant in future years, the emphasis has
been placed on issues of principle, rather than specific technologies.
d) Description of the structure of the IEC SC 45A standard series and relationships
with other IEC documents and other bodies documents (IAEA, ISO)
The top-level document of the IEC SC 45A standard series is IEC 61513. It provides general
requirements for I&C systems and equipment that are used to perform functions important to
safety in NPPs. IEC 61513 structures the IEC SC 45A standard series.
IEC 61513 refers directly to other IEC SC 45A standards for general topics related to
categorization of functions and classification of systems, qualification, separation of systems,
defence against common cause failure, software aspects of computer-based systems,
hardware aspects of computer-based systems, and control room design. The standards
referenced directly at this second level should be considered together with IEC 61513 as a
consistent document set.
At a third level, IEC SC 45A standards not directly referenced by IEC 61513 are standards
related to specific equipment, technical methods, or specific activities. Usually these
documents, which make reference to second-level documents for general topics, can be used
on their own.
A fourth level extending the IEC SC 45A standard series, corresponds to the Technical
Reports which are not normative.
IEC 61513 has adopted a presentation format similar to the basic safety publication
IEC 61508 with an overall safety life-cycle framework and a system life-cycle framework and
provides an interpretation of the general requirements of IEC 61508-1, IEC 61508-2 and
IEC 61508-4, for the nuclear application sector. Compliance with IEC 61513 will facilitate
consistency with the requirements of IEC 61508 as they have been interpreted for the nuclear

---------------------- Page: 11 ----------------------

SIST EN 61227:2016
– 6 – 61227 © IEC:2008
industry. In this framework IEC 60880 and IEC 62138 correspond to IEC 61508-3 for the
nuclear application sector.
IEC 61513 refers to ISO as well as to IAEA 50-C-QA (now replaced by IAEA 50-C/SG-Q) for
topics related to quality assurance (QA).
The IEC SC 45A standards series consistently implements and details the principles and
basic safety aspects provided in the IAEA code on the safety of NPPs and in the IAEA safety
series, in particular the Requirements NS-R-1, establishing safety requirements related to the
design of Nuclear Power Plants, and the Safety Guide NS-G-1.3 dealing with instrumentation
and control systems important to safety in Nuclear Power Plants. The terminology and
definitions used by SC 45A standards are consistent with those used by the IAEA.

---------------------- Page: 12 ----------------------

SIST EN 61227:2016
61227 © IEC:2008 – 7 –
NUCLEAR POWER PLANTS –
CONTROL ROOMS –
OPERATOR CONTROLS



1 Scope
This International Standard supplements IEC 60964 which applies to the design for control
rooms of nuclear power plants. It identifies the Human-Machine Interface (HMI) requirements
for discrete controls, multiplexed conventional systems, and soft control systems. For the
main control room of a nuclear power plant, IEC 60964 includes general requirements for
layout, user needs and verification and validation methods, and these aspects are not
repeated in this standard. However, IEC 61772 on Visual Displays Unit (VDU) also provides
some guidance on displays and indications where necessary for the correct application of the
control requirements.
This standard is intended for application to the design of new main control rooms in nuclear
power plants designed to IEC 60964 where this is initiated after the publication of this
standard. If it is desired to apply it to supplementary control points or local control positions,
or to existing control rooms or designs, special caution shall be exercised as it makes
assumptions such as the automation level that may not apply.
2 Normative references
The following referenced documents are indispensable for the application of this document.
For dated references, only the edition cited applies. For undated references, the latest edition
of the referenced document (including any amendments) applies.
IEC 60073, Basic and safety principles for man-machine interface, marking and identification
– Coding principles for indicators and actuators
IEC 60964, Nuclear power plants – Control rooms – Design of main control room
IEC 61771, Nuclear power plants – Control rooms – Verification and validation of design
IEC 61772, Nuclear power plants – Control rooms – Application of visual display units (VDU)
IAEA Safety guide NS-G-1.3:2002, Instrumentation and Control Systems Important to Safety
in Nuclear Power Plants
3 Terms and definitions
For the purposes of this document, the terms and definitions given in IEC 60964 and the
following definitions apply:
3.1
discrepancy control and indication
binary control with state and discrepancy indication using a single control switch
3.2
discrete (individual) controls
devices to support operator control of plant components, such as pumps, valves, controllers,
with one control being assigned to a single plant component or function

---------------------- Page: 13 ----------------------

SIST EN 61227:2016
– 8 – 61227 © IEC:2008
3.3
multiplexed
used for several purposes at different times. For example, a start-stop switch may be selected
by another device associated to a number of plant items and used to start or stop the item to
which it is connected at the time
3.4
operator controls
devices which the operator uses to send demand signals to control systems and plant items
3.5
semaphore
electrically driven mechanical device which displays the plant condition (e.g. open or closed
switch position) by the angular position of the visible surface
3.6
soft control
control device for input of operator commands, that has connections with the control system
that are mediated by software rather then direct physical connections. As a result, the
functions of a soft control may be variable and context dependent rather than statically
defined.
NOTE Typically, soft control devices use VDUs for displaying the input options, and pointing devices such as
track ball, mouse, touch capability, or light pen for the selection of the choice.
3.7
touch panel
soft control which uses a position detector to detect the operator's finger pointing at the label
on the VDU (Visual Display Unit). Alternatively, a light pen may be used or a cursor may be
moved over the VDU format to identify a label. The label may describe an item of plant or a
control action.
4 Design principles
4.1 Basic concepts
An overall systems design approach is required for the design of the HMI. IEC 60964 states
the requirements for overall design of the control room system and the establishment of the
principles required for safety, availability and user considerations, and the functional design of
the system as a whole. The designer shall consider his goals, and the relative importance of
the various design factors for his particular application.
Operator controls shall be designed so that operators can perform their tasks easily and
correctly. Consideration shall be given to control-display integration and the type of operating
procedure and its presentation shall be taken into account in the choice of controls to be
used. Particular attention shall be given to the needs of the operator for simple error-proof
systems that will optimize the operator's performance under all conditions. Their design shall
be based on ergonomic principles to ensure ease of operation and to minimize operators'
errors, both of omission and execution. Where conventional systems are used, mechanical
characteristics of control elements, such as size, operating pressure or force, tactile
feedback, etc., shall meet human capabilities and characteristics specified in the
anthropometric data base.
The design of the control panels and controls shall be consistent with the overall system
design and shall comply with the requirements specified in IEC 60964 and, in particular, with
the following subclauses of that standard:
a) Panel layout
b) Location aids

---------------------- Page: 14 ----------------------

SIST EN 61227:2016
61227 © IEC:2008 – 9 –
c) Information and control systems
d) Control-display integration
e) Communication system
f) Other requirements
Any system shall give immediate feedback to the operator that it has received a control
command, for example, by lighting a device or a mark on a VDU. Appropriate plant feedback
shall indicate when the command has been implemented, for example the valve has closed.
4.2 Types of HMI
The types of operator interface available for control may be classified into two groups,
a) discrete controls comprising dedicated systems / multiplexed conventional systems;
b) soft controls.
The groups have the following characteristics, and the task analysis described in 4.3 is used
to determine the most appropriate type to use.
4.2.1 Discrete controls
Dedicated controls have the disadvantage of being present even when not wanted, thus
increasing the size of the whole control desk and providing "clutter" when other controls are in
use.
Dedicated controls are particularly suitable for controls in constant use, for example electrical
output, or those whose immediate accessibility and reliability are of prime importance, for
example an emergency trip button. Requirements for their layout are described in 5.1.1.
Multiplexed controls, a sub-set of discrete controls, use a single control for the same function
on several equipments, thus reducing the number of controls on the desk or panel so that
they can be made smaller and the controls can be brought closer to the operator. However,
the operator has to make a selection, so the number of operations is increased and the
chances of error and the operator response time may be increased.
Multiplexed controls shall be designed with good feedback to the operator for the function
selected, to permit error recovery. They are particularly suitable for the control of seldom-
used systems that are not required in a hurry, for example, tank filling, and for systems where
the consequences of error are not serious and where time is available for correction in the
event of error.
4.2.2 Soft controls
These controls are a type of multiplexed system where they can have different functions at
different times. Typically, soft controls are implemented using one (or two) VDUs together
with a pointing device (such as mouse, track ball light pen or touch capability), or a
combination of a VDU with a set of dedicated controls. Control actions are performed in the
following way:
– selection of the object to be controlled using the pointing device;
– presentation of the command options on the VDU as menu items or icons, e.g. in a pop-
up-window or on a separate VDU;
– selection and activation of the command option to be executed, again using the pointing
device.
These systems have many of the characteristics of conventional multiplexed systems, but
make it possible to assemble controls related to specific tasks and not offer the operator
controls that are invalid or inappropriate to that task, so guiding the operator to correct

---------------------- Page: 15 ----------------------

SIST EN 61227:2016
– 10 – 61227 © IEC:2008
actions. All information required by the operator to perform the correct control action shall be
presented to him when required, either on the touch screen or on a related adjacent format.
Selection error rates could be high if the system is not well-designed and, as a hierarchical
selection of several formats may be required to recall the control set required, the process of
selection of a control not already on display may be relatively lengthy. However, it may be
possible to use a single format with changed windows for several control actions.
It is often difficult to optimise the position of the VDU for both monitoring and touching and
two screens may be required. Off-screen pointing devices (e.g. track ball and light pen) are an
alternative solution.
Soft controls can be particularly useful where the task is under the control of the operator.
For using soft controls, suitable consideration shall be needed to satisfy HMI requirements.
For example: software switch selection time, human error rate in selecting the switches, or
system response time. The VDU can display the mimic diagram of the system with the
information required by the operator, who will identify the concerned item in the computer,
and use a touch panel, soft control switch, or pointing device to achieve the desired effect.
For more information on the requirements for soft controls interfaces, see 5.2.
4.3 Selection of control system
The process to select and specify a control system should start from the consideration of the
available technologies on the market and of the available feed-back from the plants.
This process shall clearly distinguish between the selection of the “main control system” and
the selection of the proper control type for every plant component / plant function.
It is also to be considered that, for common cause failure reasons, two different control
systems could be selected to perform the same function.
A task analysis is required as a fundamental part of the control room design and this shall be
documented in a manner that indicates the requirements for the controls in terms of:
a) frequency of use;
b) grouping, and relationship with other controls;
c) speed of access required (when not already in use);
d) reliability;
e) acceptability of common cause faults;
f) importance of consequences of erroneous selection;
g) complexity of system controlled;
h) type of information display proposed (VDU or dedicated instruments);
i) type o
...