Development of operator cognitive model in analysis support system for Man-Machine system design information

Symbiosis of Human and Artifact Y. Anzai, K. Ogawa and H. Mori (Editors) © 1995 Elsevier Science B.V. All rights reserved.

933

Development of operator cognitive model in analysis support system for Man-Machine system design information Takashi Nakagawa a, Kazunori Sasaki~, Toru Itoh ~, Hidekazu Yoshikawab, Makoto Takahashi b, Kazuhiro Kiyokawac, Akira Hasegawa c alndustrial Electronics and System Laboratory, Mitsubishi Electric Corporation, Tsukaguchi-Honmachi 8-1-1, Amagasaki-shi, Hyogo-ken, 661 Japan blnstitute of Atomic Energy, Kyoto University, Gokasho, Uji-shi, Kyoto-fu, 611 Japan Clnstitute of Human Factors, Nuclear Power Engineering Corporation, Toranomon-3-17-1, Minato-ku, Tokyo, 105 Japan An integrated soRware system has been under development which aims at analyzing and evaluating the effectiveness of man-machine system design, by computer simulations from various viewpoints of human-factors. In this paper, the configuration of a distributed simulation system is first introduced, followed by an explanation of how the operator simulator model is organized by a Petri net model. Also presented is an example simulation of a plant anomaly diagnoses procedure using the Petri net model in its current state of development in the initial phase of software development. 1. I N T R O D U C T I O N Owing to the recent technological progress in computer control, information processing and human interface devices, the design of instrumentation and control (I&C) systems for various types of plant is rapidly approaching a fully digital I&C system with increased automation. The problems of I&C System design these days have centered on how to evaluate the adequacy of man-machine interface (MMI) design from various human-factors viewpoints, such as (1) the appropriateness of the operators' role in a total man-machine system, (2) the evaluation of effectiveness for the operator's task fulfillment, (3) the evaluation of the impact on human reliability by the introduction of new operation procedures. Accordingly, the authors began the development of SEAMAID (simulation-based evaluation support system, for the predictive analysis of m___aan-machineinterface designing) from the viewpoint of human-factors, especially centering on "cognitive mismatch in human-machine interaction". We are now in the process of developing the SEAMAID system. In this paper, we would like to introduce the configuration of the SEAMAID system, the modeling method of our man-machine system and operator cognitive behavior by utilizing a Petri net model. 2. C O N F I G U R A T I O N OF THE S E A M A I D S Y S T E M The configuration of the SEAMAID system is shown in Fig. 1 The principal functional parts

934 of the whole system are divided into the two sub-systems: (i) distributed simulation system, and (ii) man-machine design information evaluator. The functions of both systems are briefly summarized as follows; (1) Distributed simulation system: This system simulates all three behaviors concerned with total man-machine system, i.e., plant behavior, behavior of man-machine interface equipment, and operator's cognitive behavior. All three simulation systems work independently and interactively, thus distributed simulation system can simulate the situations of the central I&C room when the behavior of the plant is disturbed. (2) Man-machine design information evaluator: This is the analysis support interface for both the qualitative and quantitative evaluations of the causes and consequences of potential human error due to the operator's cognitive mismatch between the information perceived and the presented information actually by the man-machine interface. The analyst inputs the situation data though the Situation Scenario Controller seen in the figure, then the Controller accesses databases such as the Knowledge Database for Cognitive Simulation, the MMI Design Information File and the Database for Plant Disturbance Simulation in order to comply with analyst's request. One of the most important units of SEAMAID is the Interface System Error Analyzer. This analyzer unit receives the information presented by the man-machine interface and the action of the operator, then selects potential human error list which can occur in this situation from the Knowledge Database for Human Error and presents this list to the analyst. 3. M o d e l i n g o f M a n - M a c h i n e Interface When we consider the integrated simulation of man-machine interaction, we need a model of the man-machine interface. This should be an abstract model of real man-machine interface equipment (i.e., operation control board) which can effectively communicate the model parameters among the plant simulators and the operator simulator. ,

. . . . . . . . . . . . . . . . . . . . . . . .

o IPlant Simulator,

i

1.

r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F

~L iiii

Interface

[

i!

Generator I ¢ ~, l Operator Cognitive Simulator

~

t'

i

Disturbance Simulation Data Generator

~ Database for ~

.........!:

I

| /

I-Knowledge~ Situation InterfaceSystem , , IDatabase for S;en~io Err°r Analyzer ~/~ Contr.oller I Cognitive , I ~ , • _~r_Mode I~lMI Desk, n-]I IDatabase fore-] Action I . . . . ~ I Plant -- I • lnlormallon Analysis table I File I Disturban Distributed ~....anq I .... I [ SimulatioCnee J[ Simulator System rotenual riuma~ ~ Error List ~ . :,~........................ u ~ , , l t ~ t d ., , , ~~222.-i2;.~'..'"! : ~" Data Flow [Static Analysm Resu Is, :1 R e s u l t s ~I; ~IA n a l y z e r !i : . . ii System Control i.... -t Management Interface for MMS Design I-' ....... Database Access | Information Analysis & Evaluation I il~ ~' t. .. r i | [i

r

. . . . . . . . . . . . . . .

Fig.1 Configuration of SEAMAID system

935 i

ontrol Board[ of Control Board Equipment < isplay Equipment <

I

I

Alarm Equipment ] Name of C_x~trolBoard to be equilzped I Alarm Sound Kind of alarm sotmd / Status of currentalarm sound(~l/off)* Alarm Window-Name of window t Usage Color Positon I Input parametor-Name , Present Value* CRT display Equipment Alarm set point-Set value ]Name of Control board to be ec uipped Setting ground IConfiguration Tree of CRT Panels Alarm trigger logiclogic Diagram [ (with distinction of constant display and on-demand display) Des~ground IName of CRT display currently displayed* ~ t alarm loght status* IRequest P a n e l - ~ Panel NO. Current inputstatus of alarm stop button(en/offFo I Name of Panel CSm'entinput status of alarm reset button(on/off~o I Name of Request Button -Color ] Position ] Request input status% IAutomatic Display Function----design ground ] Condition of automatic display Current status of automatic display(on/off)*

IIndicato°~

Fig.2 Online Knowledge Frame Model for Man-Machine Interface Information Generator For the above purpose, we have been developing a Man-Machine Interface (MMI) information generator, a kind of online knowledge database model. In this MMI information generator, conditions of man-machine interface equipment with respect to structural configuration, topological relationships, functional characteristics, etc., are represented as knowledge databases with a hierarchical frame model, and the dynamic information elements coming from and going to see above can be included in appropriate slots of the frame model and can be updated from time to time during dynamic simulation. The configuration of the online database model is illustrated as shown in Fig. 2, where the data elements marked with an asterisk(*) come from the plant simulator, while those marked with a percent sign (%) come from the operator simulator.

4. D e v e l o p m e n t of Operator Cognitive Simulator 4.1 Configure of Human M o d e l Reason, who viewed human as "fallible machine" proposed a general framework of human modeling which can predict not only correct human performance but also possible human errors [ 1]. This is the product of conceptual aggregation from existing knowledge in the field of cognitive psychology, and from his line of thought, a general idea of how to model human cognition at a man-machine interface can be summarized as shown in Fig .2. [3] To develop the operator cognitive simulator for the SEAMMD system, the authors apply Reason's concept to the operator cognitive model. But there remain problems if we apply the concept to the operator cognitive simulator as computer software. The most important point is not clear the distinction between the "processing mechanism" and "data structure". Therefore, we have to make clear the general idea in Fig.2 into a more workable formulation for constructing human model. At the moment, the authors translated the ideas in Fig. 3 to the system architecture as shown in Fig.4. On the other hand, the authors apply the Petri net model[2] for presenting operator's knowledge as Knowledge Base Database because of the following considerations: (1) Need to model hierarchical cognitive behavior of the operator,

936 (2) Need to visualize state transition in cognitive process, (3) Ease of handling knowledge base structure (update and upgrade) to meet the analysis objectives flexibly. The desirability of applying the Petri net model lies in its merit of describing state transition by the use of "place" and "transition", where we can mix both the serial and parallel process and visualize the structure and the dynamic process of state transition comprehensively on a graphic display. The function of each unit in Fig.3 are summarized as follows. (1) Share Memory l: share memory l is used as the communication area from the Interface Information Generator to the Operator Cognitive Simulator. There are two types information in this communication area as follows; (i) alarm information which communicates to the operator as an interrupt signal, and (ii) the information about the equipment which the operator is watching. (2) Share Memory2: share memory2 is used as the communication area from the Operator Cognitive Simulator to the Interface Information Generation. There are two types information in this communication area as follows; (i)the information about the equipment operated by the operator, and (ii) position information of the conceptual operator's view point. (3) Perception Process; the perception process gets information surrounding the operator through Share Memory l and transforms the information to information elements which can be treated by other processes. The information element is shown as Table 1. Next, the Perception Process sends this information element to PWM. (Peripheral Working Memory) (4) PWM; the PWM area is a temporary area holding information elements coming from the perception process or the KB Database process. The processing the information in this area is unconscious of the operator. (5) FWM process; important functions of the FWM process include (I) transporting information elements from PWM to FWM (Focal Working Memory), (ii) prioritizing

eripheral Working Memory unconscious world ]

I

InterfaceInformation Generator

0

i FocalWorking Memory :. consciousworld Sensory ~ "

buffer store~ _ ~ ,-, Output tol Knowledge t~ase Effector [----~

Share Memory1 Alamainf. • Equipmentinf. .....

,Share Memory2 ) 1. Operatoractioninf. ]• Equipmentinf.

!~FWM ; r o c e s s )

Wi~RetriT~~Kl3 Pr°cess1

. . . . . . . . .Cognitive . . . . . . . . . . .Simulator . . . . . . . . . . . . . . . . .L~..e..~.n.et.m~el~... i.Operator

Fig. 3 Principal structmal components of the Fig.4 System aichilec~e of Operator CognitiveSimulato, f~lible machine and their inter~nnections

937 information elements in the FWM area, by assigning an "Importance Index" which calculates from "Saliency" or index of similarity with focal information which is being processed consciously in FWM, (iii) chunking function of the information elements in FWM, (iv) Inference function at FWM with interaction to KB database keeping the

context. (6) FWM; the FWM area has a limited space and the information in this area is processed with the consciousness of the operator. (7) Retrieval KB process; the functions of the Retrieval KB process are retrieval of information elements from the KB database using keywords which coincide with the focusing information element which has the highest "Importance Index" in the FWM. (8) KB Database; this corresponds to long term memory. The authors apply a Petri net model for modeling the KB database. We will discuss this in detail in next section. If the cognitive process bypasses FWM and action is made only through PWM, then this process will be a "skill-based process" If the process is processing in FWM but it follows just the procedural knowledge base in KB database with no further inference mechanism being triggered, then it will be a "Rule-based process" otherwise it will be a "Knowledge-base process". 4.2 Petri N e t M o d e l for K B D a t a b a s e The authors apply a Petri net model to present the operator's knowledge as a Knowledge Base database. But since the current system development is in its initial phase, the modeling assumptions are rather simpler than those for the final targets mentioned above; being only rule-based procedural process. The example of converting the operation procedure of a Loss of Coolant Accident into a Petri Net model is displayed in Fig. 5. There are two types of place, simple places indicated by single circles, and hierarchical places shown by double circles. Note that the statement label attached to each place states the specific action to be made. The contents of a hierarchical place are further expanded like the sequence of places and transitions shown in the bottom part of Fig. 5. The transitions are indicated by the perpendicular bars shown in the same figure. In our model, there are four types of the tokens for place, as explained in Table 1. If all the places connected to a transition in the upstream direction reach a "finished" state, then the transition fires and all the places downwards becomes "candidate" states, and all the statement labels attached to the place are transported to PWM by the KB retrieval process. If the contents of the attended information element (highest Importance Index in FWM) agree with the statement label of the place in a "candidate" state, then the "~__J

q

"~,...2

® --I emergency repo to recogmze occurrenceof ofWL.&P.ofpzr.-.... .load down supervisor LOCA........ "................. heater-lON~j ~emeter [ ~ ofw

~VL. :water level[ te. :prem~. I I

:ch i.g II

/Ik~"_~~Oh ~ - 3 0 ~

//

o n h -40N "

,of

o

q

procedure

'] " ~ - - - ~ ~ ' - ~ ~ s t a r t ~ ] ]

I

(eck~~~~__~~

l

11

7:

Fig.5 Example of Petri net model for LOCA procedure

~~)

938 Table 1 Types of Token and their Meaning Type of Token

©

0

~[¢IiI

Status of Place "Candidate" of Action

Meanin~ If the place content which is already a "candidate'' state agrees with the request from FWM, then the token of this place will become a "Finish" state, after the action succeeds. But if the action failed, the token becomes "Failed" state. As soon as the upstream transition is fired, the place becomes a "Candidate" state and the information content of the place is sent to PWM. (If the place is the initial one of the Petri net sequence, it is assumed to be "candidate" status in initial condition.) Action "Finished" When the place reaches this state, then the direct downstream transition of this place is checked as to whether or not it satisfies the firing condition, and if it fires, then the output places of this transition reaches "Candidate" state. As soon as the place is found to shift from "Candidate" to "Finished" status by a request from FWM, the status flag of the information element in FWM is requested to change from "needed" to "ended". Action When the place reaches this state, the status flag of the information element in "Failed" FWM is requests to change from "need" to "fail". No firing of the downstream transition occurs ordinarily, but the downstream transition can fire only if this place connected by a arc attached crossing mark. No activatingstate The place with this token state is outside of the FWM search.

status of place changes from "candidate" to "finish", and the information concerning actions for MMI, included in the place, is transported to Share Memory2 by the KB retrieval process.

4.3 Example Simulation In the example simulation of a distributed simulator system described above, we assume that Loss Of Coolant Accident (LOCA) occurred in a PWR type nuclear power plant. We programmed LOCA situation on a plant simulator, made an MMI design information file for the standard central control panel of the plant, and translated the operational manual for LOCA situations into a Petri net model as a KB database. Then, we executed the Distributed Simulator System. By analyzing the output log of Share Memory2 ( Operator Action for MMI), we obtained results which agreed approximately with those expected.

5. Conclusion In this paper, the authors presented a method of modeling and development of the distributed simulation system for man-machine interaction, especially highlighting the use of the Petri net model for organizing the cognitive system in the operator simulator. Although the software system development is in its initial phase, the example simulation showed that the proposed method is fundamentally an effective alternative to AI methodology in modeling various aspects and characteristics of human cognitive behavior at man-machine interfaces. In the future, the authors will carry out further development such as an elaboration of the modeling capabilities of the cognitive system and development of the remaining sub-system elements to integrate a total system.

REFERENCES 1. 2. 3.

J. Reason, Human Error, Cambridge University Press (1990). J.L. Peterson, Petri Net Theory and the Modeling of System, Prentice-Hall (1981) K. Yoshikawa and K. Furuta, Human Modeling in Nuclear Engineering, J. At. Energy Soc. Japan, Vol.36, No.4, pp.268-278 (1994) (in Japanese)