- Email: [email protected]
An ecological interface for supervisory control of BWR nuclear power plants
ControlEng. Practice,Vol. 3, No. 2, pp. 231-239, 1995
Pergamon
Copyright © 1995 Elsevier Science Lid Printed in Great Brittin. All rights reserved 0967-0661/95 $9.50 + 0.130
0967-0661(94)00081-6
AN ECOLOGICAL INTERFACE FOR SUPERVISORY CONTROL OF BWR NUCLEAR POWER PLANTS J. Itoh, A. Sakuma and K. Monta Nuclear Energy Division, Toshiba Corporation, Kawasaki, Japan
(Received April 1994; in final form November 1994)
Abstrace An ecological interface design was applied to implement support functions for the operator's direct perception and analytical reasoning in the development of an intelligent man-machine system for BWR nuclear power plants. An abstraction-aggregation functional hierarchy representation of the work domain is one basis of the ecological interface design. Another basis is the concept of the level of cognitive control. The former was mapped into the interface to externalize the operator's normative mental model of the plants, which will reduce his/her cognitive work load and support knowledge-based problem solving. Keywords: Man-machine systems; nuclear plants; cognitive systems; artificial intelligence; supervisory control; intelligent machines.
driven, top-down approaches to improve human reliability.
1. INTRODUCTION Improvement in human reliability is of great concern in modem high-technology systems such as those in aviation, nuclear power and chemical industries, since potential risks due to human errors are high in such systems and thus should be constantly reduced (Reason, 1990).
The objective is to optimize the total performance of nuclear power plants as man-machine systems, such that automation and supervisory control by human operators will be designed to reduce human errors, as well as to effectively utilize human ingenuity.
Developmental efforts to improve man-machine systems for nuclear power plants, starting from a modem CRT-based control room, have been carried out since the Three Mile Island-2 (TMI-2) accident in 1979.
2. THE CONCEPT OF AN INTELLIGENT MAN-MACHINE SYSTEM Considering the above, it seems both necessary and promising to develop intelligent man-machine systems which support human operators in their knowledge-based behavior and allow them to cope with unanticipated abnormal events, including recovery from erroneous human actions.
An advanced new control room was developed for the advanced boiling water reactor, ABWR (Iwaki,1991). The first ABWR unit will enter commercial operation in 1996 in Japan and the system is now under commissioning test. Similarly, advanced control rooms have been developed in France (Reynes, 1994) and elsewhere.
Several authors have pointed out, by reviewing previous automation experiences in various industries, that the technology-centered automation which has thus far prevailed has caused new types of human error and new categories of system breakdown, and have suggested that human-centred automation should be realized (Woods, 1988).
In view of the recent advances in information technology and cognitive system engineering, it seems promising to pursue the development of intelligent man-machine systems through principle231
232
J. Itoh et
The main features of the latter are: - A human is the leader of plant control instead of being the counterpart of a machine. - A human is the supervisor of an automated plant. - A human is the error discoverer and recoverer, supported by appropriate tools. This means that knowledge-based behavior should be established, when necessary, by appropriate cognitive tools for the operators. The IAEA advisory group on "Balancing Automation and Human Action in Nuclear Power Plants" recommends that a systematic design approach should be adopted in order to improve task allocation between automation and supervisory control (Bastl et al., 1991). This should also be applied to man-machine system design in order to achieve the above. The characteristics of the human cognitive process should be considered to implement this design approach, especially in the case of abnormality in the plant. The cognitive demands which operators would face in such events are due to the complexity of the situations caused by dynamism in the events, integration and interconnections in the plant functional structure, uncertainty with regard to information accuracy, and risk in the situations (Woods, 1987). Thus, the problems are; (1) To determine the best way to present the complexity. (2) To determine the most effective resource for the operators to use in dealing with the complexity. J.Rasmussen (1986) proposed a top-down design approach for man-machine systems based on cognitive work analysis. First, the identification of control requirements and available resources should be carried out. Decision-making tasks, such as plant state identification and priority setting for operational goals, are identified. Then, the information requirement is analyzed based on the tasks, the operator's preferred mental strategies and the cognitive mechanisms brought to bear by the operator. Finally, task allocation should be determined in order to realize human/computer cooperation and resource profile matching. A typical use of computer support derived by the above approach is to provide supports which correspond to the major cognitive decision-making tasks, such as information processing for the state of affairs, decision support, and support for implementing the intention for action. Therefore, the following three main functions were selected for the intelligent man-machine system, namely: (1) an ecological interface (El): support for the operators' direct perception and analytical reasoning (Rasmussen and Vicente, 1989;
al.
Vicente and Rasmussen, 1992), (2) a machine problem solver: support for the operators' cognitive resources, and (3) a robust automatic sequence controller. These functions are expected to realize a joint cognitive system for interoperations between the human and the computer as a cognitive tool for operators to use in order to realize a human-centered design. Figure 1 summarizes the concept for developing an intelligent man-machine system.
~
.usr^oro~r~ lat~-DtAt~n,~
ADVANC'aD |
ItB0OVlag¥~l
I .ID~oF I I I-I ___rrt~__-mt~t~. I [~
I~m~
t~,~slur~li~
[
I '
r ~ISI~YUNDI~STANDA~II PRB..~NTATION
- I IqBOOOI~TIONOF
[sr^r~'a~'aRs lI
Fig. 1 Concept for Developing the Intelligent ManMachine system In the following, the development of the ecological interface for the major operational phases of the BWR plant is discussed, since the system overview, the machine problem solver and the robust automatic sequence controller have already been reported (Monta et al., 1992, Takizawa et al., 1994, Sekimizu et al., 1992).
3. CONCEPT OF ECOLOGICAL INTERFACE The objective of the ecological interface design (EID) is to realize a direct perception capability, which is the property of a human's very effective and reliable sensory-motor system in a natural environment, for an artefact such as nuclear power plants, as well as to support analytical reasoning. An artefact has specific goals to achieve. For nuclear power plants, the goal is to produce electricity while maintaining public safety (i.e., prevention of the release of radioactive material into the environment beyond a safe limit). The artefact has a definite functional structure utilizing appropriate natural phenomena in order to fulfil the goal. This structure is hierarchical and involves many-to-many interconnections, since one component serves many functions and one function needs several subfunctions or components to achieve its task. This "means-ends" relation and the first principles for the natural phenomena utilized, such as the mass and energy conservation laws for the thermodynamic process, are invariants for the artefact. Accordingly, if these invariants are provided to the
Control of BWR Nuclear Power Plants
233
operators through the interface, a direct perception capability and an analytical reasoning capability are obtainable for the artefact.
correspond to the nodes in the means-ends relationship of the plant as well as to the causal models in the mass and energy conservation principles within them.
A basis for the ecological interface is an abstractionaggregation functional hierarchical structure, where the purpose and goal, the abstract function, the generalized function and the physical function are the abstraction hierarchy levels, while the plant, the subsystem, and the equipment are the aggregation hierarchy levels. That is, the operator's focus of attention moves around in this space according to his cognitive process during the complexity. Therefore, CRT pictures should be designed to provide appropriate information to the operator for appropriate points in this two-dimensional space. Figure 2 shows a part of the abstraction hierarchy for the electricity production goal for BWR nuclear power plants.
This model, called a multilevel flow model (MFM) by Lind (1992), represents an operator's normative mental model for the plant. Operators can reduce their cognitive work load, such as knowledge, memory, computation, and information retrieval during their cognitive processes by externalizing this mental model through the man-machine interface. Operators can infer failure propagations along the means-ends relationship or causal relations within the flow structures, i.e., which flow function is the most probable cause of failure, etc. They can plan an operational strategy based on due considerations regarding multiple, competitive goals or multiple causes, if any.
FUNCTIONAL PURPOS[~
Im~rmcrrY] O~[~,ATION
C~GvJ~ I~itOY DISTIUIUT~N
|~1) (m.Berit~rr+o
H "°' I
ABSTRACT FUNCTION
~I~B~,ATION~
Fig. 2 Abstraction Hierarchy Representation for Electricity Generation Special emphasis is paid to the abstract function level, since plant models in this level are most appropriate to represent the invariants of the plant. At the abstract function level, the mass and energy flows in the plant are modeled by appropriate flow functions, such as source, transport and storage, as shown in Fig. 2. These flow functions are organized to represent a flow structure and are supported by different flow structures (not shown) to maintain their performance. This structure constitutes the hierarchical functional structure of the plant. That is, the flow structures
Another basis for the ecological interface is the concept of the level of cognitive control, i.e., skill-, rule-, and knowledge- based behavior of the operators depending on their familiarity with the situations. That is, operators have different mechanisms for dealing with complexity so that their information usage is also different, i.e., signals, signs, and symbols, respectively for skill, rule, and knowledge, which provides a basis for determining the form of information on the interface (Rasmussen, 1986). The ecological interface goal derived from the level of cognitive control mentioned above is to design interfaces that do not force cognitive control to a higher level than the required demands of the task but that also provide the necessary support for all three levels. Three prescriptive design principles are proposed to support the three levels of cognitive control: (1) Skill-based - To support interaction via time-space signals, the operator should be able to act dkectly on the display, and the structure of the displayed information should be isomorphic to the part-whole structure of control actions. (2) Rule-based - Provide a consistent one-to-one mapping between the process constraints and the cues or signs prodded by the interface. (3) Knowledge-based - The relational structures represented in the abstraction hierarchy should be displayed in the interface to serve as an externalized mental model that will support knowledge.based problem solving. According to the EID goal, the information on the display should be used by operators at their favored level of cognitive control or should support all three levels. Thus, the content of information on the display should be rich, and the operators should be easily able to pick up necessary information from among these contents. Therefore, appropriate pictures in the generalized function and the physical function levelin
J. Itoh et al.
234
Fig. 2, for example, are produced as well as in the abstract function level display based on MFMs. Such a multilevel representation provides an informational basis for dealing with unanticipated events. When a fault occurs, its causes will propagate upward in the abstraction hierarchy, thereby resulting in a mismatch between the current state of affairs and the purposes for which the system was designed. To correctly and consistently diagnose a fault, one must have access to higher-order functional information, since this information provides the reference point defining how the system should be operating.
4. DEVELOPMENT OF THE ECOLOGICAL INTERFACE FOR BWR PLANTS First of all, it is appropriate to describe the multilevel flow model (MFM) for BWR plants, since it represents the invariants of the plant. Three MFMs were constructed, corresponding to electricity production, safety, and decay heat removal after a reactor scram. The first two correspond to the two ultimate goals of nuclear power plants, while the third represents an essential goal after reactor scrams by the safety protection system or the normal plant shutdown. The safety goal is relevant at this phase, too. The safety MFM represents many barriers and storages between the fission products in the reactor core and the environment. An example of the abstract function-level display was shown for the topmost flow structure of the safety MFMby Monta et al. (1992). The support relations in this MFM establish the hierarchical means-ends relationship for the plant safety goal. The electricity production MFM represents the energy flow from the nuclear fission energy source to the electric power grid by flow functions. The ecological interface for normal and abnormal operation in the power range has already been explained (Monta et ai., 1992). In the following, the interface for the plant startup phase will be discussed. The decay heat removal MFM represents the built-in alternative decay heat removal paths from the decay heat source in the nuclear reactor core to the environment. The ecological interface based on this MFM will be discussed later.
4.1
Ecological Interface for Plant Startup
The maneuvering of process plants, such as startup, power level change, and shut down, is a process to attain an appropriate plant operational goal from a current operational state. As such, designers can carry through all the decision steps and store the resulting
design in a decision table in a computer, achieving automation. However, during an automatic execution of such long sequences, operators are requested to supervise all the functions, and if some anomalies should appear, they are requested to diagnose the situation and override automation, if necessary. In order to enable such supervisory control, the operators must be supplied with information about the system states and about the designers' intention in order to be able to verify the decisions taken by the computer through use of their own preferred decision strategy. Figure 3 shows an example of E1 for the plant startup phase. The topmost flow structure, i.e., the functional purpose, is shown in the middle part. The support shown in each flow function (FF) represents appropriate functions to establish FF performance and is implemented by other lower-level flow structures. This process is repeated iteratively to represent the plant functional structure hierarchically and in sufficient detail. In the lower part, the causal structure in the energy conversion process is shown, using the energy balance and the Rankine cycle display. The main energy storage in BWR plants is the reactor pressure vessel. The energy balance there determines the pressure in the reactor coolant system. Hence, the energy inventory is indicated along with its time derivative, i.e., the energy balance, by a tilted line. The Rankine cycle display proposed by Beltracchi (1990) is appropriate to show BWR plant performance, since it consists of the Rankine cycle. The rightmost figure shows the turbine heat cycle. It is a regenerative heat cycle, and the cycle efficiency is shown in the figure by the ratio of the area surrounded by the cycle to the area below the line segments a-b-c in the figure. The lower part also represents the mass balance in the plant, which supports the above energy balance. The main mass storages in the plant involve the reactor pressure vessel and the hot well in the condenser. Their inventories, as well as their time derivatives, are shown by appropriate icons with appropriate reference values in the same manner as the energy balance. The above configuration is almost the same as the normal/ abnormal power operation, since the goal of the startup is to attain the power operation. The top part of the figure shows the major steps in the startup processes that correspond to establishing the functions or their supports. "Vacuum up" is the process of establishing the support of the exhaust heat removal, the condenser vacuum, thus establishing the plant heat sink. The reactor criticality is the process of establishing the
Control of BWR Nuclear Power Plants
[
I[
!i "'"'!ii'
I
235
iiiiii"""iiiiiil"iiiiiiii iiii
, r--
I
_
0
i
-
~l l~g'U
OUT XX'
t
Fig. 3 Example of EI for the Plant Startup Phase support of the nuclear energy generation. The reactivity of the reactor core is increased from a negative value in the shutdown condition to nearly zero in order to adjust the fission power for the later steps. The leftmost figure in the lower part represents the process, as explained later. The reactor pressure increase step establishes the support of the energy transport. The reactor fission power is slightly increased to maintain the rate of increase of the reactor pressure and the reactor water temperature. This process is also monitored by the leftmost figure. The D/W inspection step examines whether any abnormality exists in the primary containment (D/W). The reactivity is decreased to protect an operator who enters the D/W. The reactor power increase step restores the reactivity, the fission power and the reactor pressure after the D/ W inspection. The grid in is the process to establish support for the energy conversion and the electricity generation by increasing the turbine rotational speed and synchronizing the generator to the power grid.
Finally, the generator power control increases the generator load by increasing the fission power, the energy transport via steam flow to the turbine and the energy conversion, since all the supports of these FFs have been established. During these steps, the status of the supports and the functions are monitored and the results are displayed by the colors of the corresponding icons in Fig. 3 to show the establishing process of the means-end structure of the plant. The leftmost figure shows the reactivity, the reactor water temperature and the reactor pressure against the ft~sion power, since these variables are the key variables for the most steps. This figure is switched to the corresponding one for the power range EI at the generator power control step (Monta et al., 1992). In this way, the most important internal functional relationship for establishing energy production and conversion in the plant is displayed using a standard format for engineering analysis of the heat engine cycles and easy-to-undersland icons. This display is expected to support operators in plant status perception and in thought experiments for hypothesis and testing, with regard to their knowledge-based behavior.
236
J. Itoh et al.
Fig. 4 Alternative Decay Heat Removal Paths Based on the Corresponding MFM
4.2
EcologicalInterfacefor Decay Heat Removal
Figure 4 shows the alternative decay heat removal paths based on the corresponding MFM. The energy stored in the coolant in the reactor pressure vessel (RPV) is removed to the condenser through a main steam line in the case where an ordinary system is usable. On the other hand, in the case where the primary containment vessel (PCV) is isolated to prevent the release of radioactive material, the energy is transferred into the PCV through the safety/relief valves. Thereafter, the energy is transferred to the heat exhaust through the PCV cooling mode of the residual heat removal (RHR) system. In the above two paths, the energy in the RPV is transferred by means of the steam flow, but in the case where the cooling of the decay heat is sufficiently achieved and the pressure in the RPV is then lowered, the energy is transferred to the heat exhaust by a direct cooling of the RPV by the RHR. Each flow function in the figure has its support, and every functional status of the pair of elements is shown, thus enabling the operators to supervise overall plant status in this operational phase. Figure 5 shows the energy and the mass balance in this phase along with some thermodynamic properties of the working fluid. In the upper part, the causal structure in the decay heat removal paths is shown for the three major energy storages, i.e., the reactor pressure vessel, the primary containment vessel and the condenser. For the reactor pressure vessel, the energy balance is shown using an icon similar to that in Fig. 3, that is, the energy inlet flow due to the core fission decay heat along with the energy carried into the vessel by
coolant injection is shown in the upper bar, while the energy outlet flow due to the steam flow to the PCV or the condenser plus the heat removed by the residual heat removal (RHR) system is shown by the lower bar. The energy balance between the two is indicated by the tilted line and the energy inventory is indicated by a vertical line. The reactor coolant temperature is indicated in the temperature-entropy diagram (the same framework for the Rankine cycle display) along with the temperatures of the coolant in RHR to show the heat transfer in this path when it functions. The same display scheme is applied to the PCV and the condenser where the steam or steam/water mixture flow from the RPV is roughly shown as an isoenthalpy line. In the lower part, the mass balance in the plant, which supports the above energy balance is shown for the condensate storage tank, the RPV, the PCV and the condenser. The leftmost figure in the upper part shows the relation between the energy and the mass inventory pair and the reactor pressure and the water level in the RPV, assuming equilibrium, saturated steam/water condition. This figure is intended to approximately estimate the depressurization effect of steam/water discharge which is necessary when events such as loss of all the feedwater transient without the high pressure emergency core cooling system (ECCS) may occur. In such cases, when operators should activate the safety/ relief valves to lower the reactor pressure to utilize the low-pressure ECCS, their cognitive performance becomes quite important and should, therefore, be supported (Masuda and Kawano, 1991). The line segments in the lower right part of the figure show the direction of the depressurization and water level
Control of BWR Nuclear Power Plants
x~
237
ks/an2
zlO
RPV INLETPLOW
PCV INLRTPLOW
CONDI~SBR lN1,gl"l:~OW
O~I~BT In..OW
O~'I.RT FLOW
:i
:tN¢ olrl'i.~ 1t.1~ i
|
,
I
°
•
°
.
~S
.4b
Fig. 5 Energy and Mass Balance in the Plant Startup Phase decrease. Applying these segments to the current status point, the decrease of the water level resulting from the needed depressurization can be estimated. According to the above figures, the energy/mass flow and the energy/mass balance condition in the whole plant at the decay heat removal phase can be easily grasped. At the same time, since the main process variables representing the heat transfer characteristics of the respective paths can also be easily grasped as patterns, the recognition of the abnormalities and the countermeasures for these can be improved. 5. ANALYTICAL EVALUATION OF THE PROTOTYPE EID Evaluation of the man-machine interface, especially for new designs such as EID, is one of the most important issues, since it should guarantee that the design objectives have been completely achieved before interface usage. Its importance as well as its difficulty increases for the present case because the main objective is to support the operator's knowledgebased behavior to cope with unanticipated events. There will be numerous scenarios corresponding to these events, and the evaluation will not be possible solely by empirical methods. Rasmussen (1985) has argued that analytical evaluations based on the use of quantitative or qualitative models of man-machine interaction should be considered rather than data collection in empirical evaluations. Analytical evaluations are useful for evaluating the effectiveness of a man-machine interface, i.e., the degree to which an interface supports the achievement
of the design objectives of the system. This is because they should reveal the functionality of the system achieving the objectives based on the engineering analysis of the work domain, and then, based on that, should identify the necessary information content and structure of the man-machine interface (Vicente, 1990). The abstraction hierarchy that the EID is based on is such a useful framework for the engineering analysis of the work domain that it can be used as a useful criterion for the analytical evaluations of the EID. That is, the third prescriptive principle of EID, i.e., the one for knowledge-based support, should lead to the following criterion: all levels in the abstraction hierarchy need to be presented in an interface. Regarding the above, a flow structure in the MFM should be considered as a nucleus to assemble the needed information from other abstraction levels based on the analytical evaluation. As described before, individual abstraction levels should have corresponding CRT picture elements. This process should be performed in a top-down fashion following the abstraction-aggregation relation. An analytical evaluation of the production goal display was done using Fig. 2 (Itoh et al., 1993). From this study, the abstraction hierarchy showed its feasibility to clearly evaluate the necessary information content and structure for the manmachine interface supporting the operator's knowledge-based behavior. Starting from the top-level flow structures, the CRT picture hierarchies can be evaluated systematically. The information identified
238
J. Itoh et aL
as necessary outside the current picture should be treated in the same way as the current picture. That is, based on the corresponding nucleus flow structure, the information content should be evaluated according to the abstraction hierarchy including the nucleus flow structure.
criteria for information content and structure of the interface. The empirical evaluation of the advantages of EID is an important issue.
Such an analytical evaluation can confirm the information content and structure, i.e., the effectiveness of the interface. However, the form of information also contributes to a fit between the representation in the interface and the operator's mental model of the domain that supports the knowledge-based behavior. Empirical evaluation should be considered for the above to complement analytical evaluation. Some preliminary results have been reported by Takizawa et al. (1994).
Basil, W., et al. (1991). Balance between automation and human actions in NPP operation - Results of international co-operation. In Balancing Automation and Human Action in Nuclear Power Plants. IAEA, Vienna. pp. 11-32.
A typical comment of the test subjects was as follows: EID display would suit the novice operator training to build up his/her plant mental model. However, it is too crowded with information to easily understand the situation. This comment can be interpreted as indicating that the EID display is at least full of information, but that it takes a long time to pick up necessary information as "affordance" (Rasmussen et al., 1989). This means that it takes time for operators to become accustomed to the EID display, since humankind has required a long time to acquire affordance from the natural environment. Besides the formal training, operators have ample time to get accustomed to the EID during on-the-job training during the normal operation.
6. CONCLUSION Systematic design approaches are needed for developing intelligent man-machine systems for nuclear power plants and an approach based on plant functional knowledge, knowledge of the cognitive processes of the operators, and advanced information technology has been studied. The ecological interface design is a seemingly unique existing methodology to systematically design intelligent man-machine interfaces supporting the operator's knowledge-based behavior. In order to cope with unanticipated events, its abstraction hierarchy can identify, a priori, the necessary information, based on a set of goal-relevant constraints governing the operation of the controlled system. A prototype application of EID to the major operational phases of BWR nuclear plants has shown that an improvement in the total plant overview and hierarchical plant monitoring is realized. EID also seems to be a valuable tool for the analytical evaluation of intelligent man-machine interfaces, because the abstraction hierarchy defines very useful
REFERENCES
Beltracchi, L. (1990). A direct manipulation systemprocess interface. In ANS Topical Mtg. on Advances in Human Factors Research on Man Computer Interactions. American Nuclear Society, Chicago. pp. 286-292. Itoh, J., et al. (1993). An ecological interface design for intelligent man-machine systems for BWR plants, In Topical Mtg. on Nuclear Plant Instrumentation, Control, and Man-Machine Interface Technologies, American Nuclear Society, Oak Ridge, pp. 97-103. Iwaki, K. (1991). Control room design and automation in the advanced BWR (ABWR). In Balancing Automation and Human Action in Nuclear Power Plants, IAEA, Vienna, pp. 399-412. Lind, M., et al., (1992). Applications of multilevel flow modeling. In ANP'92 -Infl ConL on Design and Safety of Advanced Nuclear Power Plants, Atomic Energy Society of Japan, Tokyo, pp. 42.3-1 - 42.3-10. Masuda, F., and R. Kawano (1991). The effect of human factors on plant safety. In ANS Intl Topical Mtg. on Thermal Reactor Safety. American Nuclear Society, Portland, pp. 631638. Monta, K. et al. (1992). Human reliability in process control during malfunctioning - A survey of the nuclear industry with a case study of man machine system development. In Analysis, Design and Evaluation of Man-Machine Systems, 1992 IFAC, The Hague, pp. 31-42. Rasmussen, J. (1985). Conceptual Models in ManMachine Design Verification, RISO-M-2520. Rasmussen, J. (1986) Information Processing and Human-Machine Interaction - An Approach to Cognitive Engineering. Elsevier Publishing, New York. Rasmussen, J., and K.J. Vicente (1989). Coping with human error through system design:
Control of BWR Nuclear Power Plants Implications for ecological interface design. Int'l. J. Man-Machine Studies, 31, pp. 517-534.
239
Reason, J. (1990). Haman Error. Cambridge University Press, Cambridge.
Vicente, K.J. (1990). Ecological interface design as an analytical evaluation tool. In ANS Topical Mtg. on Advances in Human Factors Research on Man/Computer Interactions. American Nuclear Society, Chicago. pp. 259-265.
Reynes, L. (1994). France's approach to I & C. Nuclear Engineering International, July, pp. 32-35.
Vicente, KJ., and J.Rasmussen (1992). Ecological Interface Design: Theoretical Foundation. IEEE Trans. SMC, 22, pp. 589-606.
Sekimizu, K. et al. (1992). Knowledge representation for automated boiling water reactor plant startup. Nuclear Technology, 100, pp. 295-309.
Woods, D.D. (1987). Commentary: Cognitive engineering in a complex and dynamic world. Int'l. J. Man-Machine Studies, 27, pp. 571-585.
Takizawa, Y. et al. (1994). An intelligent man machine system for future nuclear power plants. Nuclear Technology, 107, pp. 72-82.
Woods, D.D. (1988). Invited lecture. In Flight Deck Automations: Promises and Realities. NASA Conf. Report No. 10036.
Pergamon
Copyright © 1995 Elsevier Science Lid Printed in Great Brittin. All rights reserved 0967-0661/95 $9.50 + 0.130
0967-0661(94)00081-6
AN ECOLOGICAL INTERFACE FOR SUPERVISORY CONTROL OF BWR NUCLEAR POWER PLANTS J. Itoh, A. Sakuma and K. Monta Nuclear Energy Division, Toshiba Corporation, Kawasaki, Japan
(Received April 1994; in final form November 1994)
Abstrace An ecological interface design was applied to implement support functions for the operator's direct perception and analytical reasoning in the development of an intelligent man-machine system for BWR nuclear power plants. An abstraction-aggregation functional hierarchy representation of the work domain is one basis of the ecological interface design. Another basis is the concept of the level of cognitive control. The former was mapped into the interface to externalize the operator's normative mental model of the plants, which will reduce his/her cognitive work load and support knowledge-based problem solving. Keywords: Man-machine systems; nuclear plants; cognitive systems; artificial intelligence; supervisory control; intelligent machines.
driven, top-down approaches to improve human reliability.
1. INTRODUCTION Improvement in human reliability is of great concern in modem high-technology systems such as those in aviation, nuclear power and chemical industries, since potential risks due to human errors are high in such systems and thus should be constantly reduced (Reason, 1990).
The objective is to optimize the total performance of nuclear power plants as man-machine systems, such that automation and supervisory control by human operators will be designed to reduce human errors, as well as to effectively utilize human ingenuity.
Developmental efforts to improve man-machine systems for nuclear power plants, starting from a modem CRT-based control room, have been carried out since the Three Mile Island-2 (TMI-2) accident in 1979.
2. THE CONCEPT OF AN INTELLIGENT MAN-MACHINE SYSTEM Considering the above, it seems both necessary and promising to develop intelligent man-machine systems which support human operators in their knowledge-based behavior and allow them to cope with unanticipated abnormal events, including recovery from erroneous human actions.
An advanced new control room was developed for the advanced boiling water reactor, ABWR (Iwaki,1991). The first ABWR unit will enter commercial operation in 1996 in Japan and the system is now under commissioning test. Similarly, advanced control rooms have been developed in France (Reynes, 1994) and elsewhere.
Several authors have pointed out, by reviewing previous automation experiences in various industries, that the technology-centered automation which has thus far prevailed has caused new types of human error and new categories of system breakdown, and have suggested that human-centred automation should be realized (Woods, 1988).
In view of the recent advances in information technology and cognitive system engineering, it seems promising to pursue the development of intelligent man-machine systems through principle231
232
J. Itoh et
The main features of the latter are: - A human is the leader of plant control instead of being the counterpart of a machine. - A human is the supervisor of an automated plant. - A human is the error discoverer and recoverer, supported by appropriate tools. This means that knowledge-based behavior should be established, when necessary, by appropriate cognitive tools for the operators. The IAEA advisory group on "Balancing Automation and Human Action in Nuclear Power Plants" recommends that a systematic design approach should be adopted in order to improve task allocation between automation and supervisory control (Bastl et al., 1991). This should also be applied to man-machine system design in order to achieve the above. The characteristics of the human cognitive process should be considered to implement this design approach, especially in the case of abnormality in the plant. The cognitive demands which operators would face in such events are due to the complexity of the situations caused by dynamism in the events, integration and interconnections in the plant functional structure, uncertainty with regard to information accuracy, and risk in the situations (Woods, 1987). Thus, the problems are; (1) To determine the best way to present the complexity. (2) To determine the most effective resource for the operators to use in dealing with the complexity. J.Rasmussen (1986) proposed a top-down design approach for man-machine systems based on cognitive work analysis. First, the identification of control requirements and available resources should be carried out. Decision-making tasks, such as plant state identification and priority setting for operational goals, are identified. Then, the information requirement is analyzed based on the tasks, the operator's preferred mental strategies and the cognitive mechanisms brought to bear by the operator. Finally, task allocation should be determined in order to realize human/computer cooperation and resource profile matching. A typical use of computer support derived by the above approach is to provide supports which correspond to the major cognitive decision-making tasks, such as information processing for the state of affairs, decision support, and support for implementing the intention for action. Therefore, the following three main functions were selected for the intelligent man-machine system, namely: (1) an ecological interface (El): support for the operators' direct perception and analytical reasoning (Rasmussen and Vicente, 1989;
al.
Vicente and Rasmussen, 1992), (2) a machine problem solver: support for the operators' cognitive resources, and (3) a robust automatic sequence controller. These functions are expected to realize a joint cognitive system for interoperations between the human and the computer as a cognitive tool for operators to use in order to realize a human-centered design. Figure 1 summarizes the concept for developing an intelligent man-machine system.
~
.usr^oro~r~ lat~-DtAt~n,~
ADVANC'aD |
ItB0OVlag¥~l
I .ID~oF I I I-I ___rrt~__-mt~t~. I [~
I~m~
t~,~slur~li~
[
I '
r ~ISI~YUNDI~STANDA~II PRB..~NTATION
- I IqBOOOI~TIONOF
[sr^r~'a~'aRs lI
Fig. 1 Concept for Developing the Intelligent ManMachine system In the following, the development of the ecological interface for the major operational phases of the BWR plant is discussed, since the system overview, the machine problem solver and the robust automatic sequence controller have already been reported (Monta et al., 1992, Takizawa et al., 1994, Sekimizu et al., 1992).
3. CONCEPT OF ECOLOGICAL INTERFACE The objective of the ecological interface design (EID) is to realize a direct perception capability, which is the property of a human's very effective and reliable sensory-motor system in a natural environment, for an artefact such as nuclear power plants, as well as to support analytical reasoning. An artefact has specific goals to achieve. For nuclear power plants, the goal is to produce electricity while maintaining public safety (i.e., prevention of the release of radioactive material into the environment beyond a safe limit). The artefact has a definite functional structure utilizing appropriate natural phenomena in order to fulfil the goal. This structure is hierarchical and involves many-to-many interconnections, since one component serves many functions and one function needs several subfunctions or components to achieve its task. This "means-ends" relation and the first principles for the natural phenomena utilized, such as the mass and energy conservation laws for the thermodynamic process, are invariants for the artefact. Accordingly, if these invariants are provided to the
Control of BWR Nuclear Power Plants
233
operators through the interface, a direct perception capability and an analytical reasoning capability are obtainable for the artefact.
correspond to the nodes in the means-ends relationship of the plant as well as to the causal models in the mass and energy conservation principles within them.
A basis for the ecological interface is an abstractionaggregation functional hierarchical structure, where the purpose and goal, the abstract function, the generalized function and the physical function are the abstraction hierarchy levels, while the plant, the subsystem, and the equipment are the aggregation hierarchy levels. That is, the operator's focus of attention moves around in this space according to his cognitive process during the complexity. Therefore, CRT pictures should be designed to provide appropriate information to the operator for appropriate points in this two-dimensional space. Figure 2 shows a part of the abstraction hierarchy for the electricity production goal for BWR nuclear power plants.
This model, called a multilevel flow model (MFM) by Lind (1992), represents an operator's normative mental model for the plant. Operators can reduce their cognitive work load, such as knowledge, memory, computation, and information retrieval during their cognitive processes by externalizing this mental model through the man-machine interface. Operators can infer failure propagations along the means-ends relationship or causal relations within the flow structures, i.e., which flow function is the most probable cause of failure, etc. They can plan an operational strategy based on due considerations regarding multiple, competitive goals or multiple causes, if any.
FUNCTIONAL PURPOS[~
Im~rmcrrY] O~[~,ATION
C~GvJ~ I~itOY DISTIUIUT~N
|~1) (m.Berit~rr+o
H "°' I
ABSTRACT FUNCTION
~I~B~,ATION~
Fig. 2 Abstraction Hierarchy Representation for Electricity Generation Special emphasis is paid to the abstract function level, since plant models in this level are most appropriate to represent the invariants of the plant. At the abstract function level, the mass and energy flows in the plant are modeled by appropriate flow functions, such as source, transport and storage, as shown in Fig. 2. These flow functions are organized to represent a flow structure and are supported by different flow structures (not shown) to maintain their performance. This structure constitutes the hierarchical functional structure of the plant. That is, the flow structures
Another basis for the ecological interface is the concept of the level of cognitive control, i.e., skill-, rule-, and knowledge- based behavior of the operators depending on their familiarity with the situations. That is, operators have different mechanisms for dealing with complexity so that their information usage is also different, i.e., signals, signs, and symbols, respectively for skill, rule, and knowledge, which provides a basis for determining the form of information on the interface (Rasmussen, 1986). The ecological interface goal derived from the level of cognitive control mentioned above is to design interfaces that do not force cognitive control to a higher level than the required demands of the task but that also provide the necessary support for all three levels. Three prescriptive design principles are proposed to support the three levels of cognitive control: (1) Skill-based - To support interaction via time-space signals, the operator should be able to act dkectly on the display, and the structure of the displayed information should be isomorphic to the part-whole structure of control actions. (2) Rule-based - Provide a consistent one-to-one mapping between the process constraints and the cues or signs prodded by the interface. (3) Knowledge-based - The relational structures represented in the abstraction hierarchy should be displayed in the interface to serve as an externalized mental model that will support knowledge.based problem solving. According to the EID goal, the information on the display should be used by operators at their favored level of cognitive control or should support all three levels. Thus, the content of information on the display should be rich, and the operators should be easily able to pick up necessary information from among these contents. Therefore, appropriate pictures in the generalized function and the physical function levelin
J. Itoh et al.
234
Fig. 2, for example, are produced as well as in the abstract function level display based on MFMs. Such a multilevel representation provides an informational basis for dealing with unanticipated events. When a fault occurs, its causes will propagate upward in the abstraction hierarchy, thereby resulting in a mismatch between the current state of affairs and the purposes for which the system was designed. To correctly and consistently diagnose a fault, one must have access to higher-order functional information, since this information provides the reference point defining how the system should be operating.
4. DEVELOPMENT OF THE ECOLOGICAL INTERFACE FOR BWR PLANTS First of all, it is appropriate to describe the multilevel flow model (MFM) for BWR plants, since it represents the invariants of the plant. Three MFMs were constructed, corresponding to electricity production, safety, and decay heat removal after a reactor scram. The first two correspond to the two ultimate goals of nuclear power plants, while the third represents an essential goal after reactor scrams by the safety protection system or the normal plant shutdown. The safety goal is relevant at this phase, too. The safety MFM represents many barriers and storages between the fission products in the reactor core and the environment. An example of the abstract function-level display was shown for the topmost flow structure of the safety MFMby Monta et al. (1992). The support relations in this MFM establish the hierarchical means-ends relationship for the plant safety goal. The electricity production MFM represents the energy flow from the nuclear fission energy source to the electric power grid by flow functions. The ecological interface for normal and abnormal operation in the power range has already been explained (Monta et ai., 1992). In the following, the interface for the plant startup phase will be discussed. The decay heat removal MFM represents the built-in alternative decay heat removal paths from the decay heat source in the nuclear reactor core to the environment. The ecological interface based on this MFM will be discussed later.
4.1
Ecological Interface for Plant Startup
The maneuvering of process plants, such as startup, power level change, and shut down, is a process to attain an appropriate plant operational goal from a current operational state. As such, designers can carry through all the decision steps and store the resulting
design in a decision table in a computer, achieving automation. However, during an automatic execution of such long sequences, operators are requested to supervise all the functions, and if some anomalies should appear, they are requested to diagnose the situation and override automation, if necessary. In order to enable such supervisory control, the operators must be supplied with information about the system states and about the designers' intention in order to be able to verify the decisions taken by the computer through use of their own preferred decision strategy. Figure 3 shows an example of E1 for the plant startup phase. The topmost flow structure, i.e., the functional purpose, is shown in the middle part. The support shown in each flow function (FF) represents appropriate functions to establish FF performance and is implemented by other lower-level flow structures. This process is repeated iteratively to represent the plant functional structure hierarchically and in sufficient detail. In the lower part, the causal structure in the energy conversion process is shown, using the energy balance and the Rankine cycle display. The main energy storage in BWR plants is the reactor pressure vessel. The energy balance there determines the pressure in the reactor coolant system. Hence, the energy inventory is indicated along with its time derivative, i.e., the energy balance, by a tilted line. The Rankine cycle display proposed by Beltracchi (1990) is appropriate to show BWR plant performance, since it consists of the Rankine cycle. The rightmost figure shows the turbine heat cycle. It is a regenerative heat cycle, and the cycle efficiency is shown in the figure by the ratio of the area surrounded by the cycle to the area below the line segments a-b-c in the figure. The lower part also represents the mass balance in the plant, which supports the above energy balance. The main mass storages in the plant involve the reactor pressure vessel and the hot well in the condenser. Their inventories, as well as their time derivatives, are shown by appropriate icons with appropriate reference values in the same manner as the energy balance. The above configuration is almost the same as the normal/ abnormal power operation, since the goal of the startup is to attain the power operation. The top part of the figure shows the major steps in the startup processes that correspond to establishing the functions or their supports. "Vacuum up" is the process of establishing the support of the exhaust heat removal, the condenser vacuum, thus establishing the plant heat sink. The reactor criticality is the process of establishing the
Control of BWR Nuclear Power Plants
[
I[
!i "'"'!ii'
I
235
iiiiii"""iiiiiil"iiiiiiii iiii
, r--
I
_
0
i
-
~l l~g'U
OUT XX'
t
Fig. 3 Example of EI for the Plant Startup Phase support of the nuclear energy generation. The reactivity of the reactor core is increased from a negative value in the shutdown condition to nearly zero in order to adjust the fission power for the later steps. The leftmost figure in the lower part represents the process, as explained later. The reactor pressure increase step establishes the support of the energy transport. The reactor fission power is slightly increased to maintain the rate of increase of the reactor pressure and the reactor water temperature. This process is also monitored by the leftmost figure. The D/W inspection step examines whether any abnormality exists in the primary containment (D/W). The reactivity is decreased to protect an operator who enters the D/W. The reactor power increase step restores the reactivity, the fission power and the reactor pressure after the D/ W inspection. The grid in is the process to establish support for the energy conversion and the electricity generation by increasing the turbine rotational speed and synchronizing the generator to the power grid.
Finally, the generator power control increases the generator load by increasing the fission power, the energy transport via steam flow to the turbine and the energy conversion, since all the supports of these FFs have been established. During these steps, the status of the supports and the functions are monitored and the results are displayed by the colors of the corresponding icons in Fig. 3 to show the establishing process of the means-end structure of the plant. The leftmost figure shows the reactivity, the reactor water temperature and the reactor pressure against the ft~sion power, since these variables are the key variables for the most steps. This figure is switched to the corresponding one for the power range EI at the generator power control step (Monta et al., 1992). In this way, the most important internal functional relationship for establishing energy production and conversion in the plant is displayed using a standard format for engineering analysis of the heat engine cycles and easy-to-undersland icons. This display is expected to support operators in plant status perception and in thought experiments for hypothesis and testing, with regard to their knowledge-based behavior.
236
J. Itoh et al.
Fig. 4 Alternative Decay Heat Removal Paths Based on the Corresponding MFM
4.2
EcologicalInterfacefor Decay Heat Removal
Figure 4 shows the alternative decay heat removal paths based on the corresponding MFM. The energy stored in the coolant in the reactor pressure vessel (RPV) is removed to the condenser through a main steam line in the case where an ordinary system is usable. On the other hand, in the case where the primary containment vessel (PCV) is isolated to prevent the release of radioactive material, the energy is transferred into the PCV through the safety/relief valves. Thereafter, the energy is transferred to the heat exhaust through the PCV cooling mode of the residual heat removal (RHR) system. In the above two paths, the energy in the RPV is transferred by means of the steam flow, but in the case where the cooling of the decay heat is sufficiently achieved and the pressure in the RPV is then lowered, the energy is transferred to the heat exhaust by a direct cooling of the RPV by the RHR. Each flow function in the figure has its support, and every functional status of the pair of elements is shown, thus enabling the operators to supervise overall plant status in this operational phase. Figure 5 shows the energy and the mass balance in this phase along with some thermodynamic properties of the working fluid. In the upper part, the causal structure in the decay heat removal paths is shown for the three major energy storages, i.e., the reactor pressure vessel, the primary containment vessel and the condenser. For the reactor pressure vessel, the energy balance is shown using an icon similar to that in Fig. 3, that is, the energy inlet flow due to the core fission decay heat along with the energy carried into the vessel by
coolant injection is shown in the upper bar, while the energy outlet flow due to the steam flow to the PCV or the condenser plus the heat removed by the residual heat removal (RHR) system is shown by the lower bar. The energy balance between the two is indicated by the tilted line and the energy inventory is indicated by a vertical line. The reactor coolant temperature is indicated in the temperature-entropy diagram (the same framework for the Rankine cycle display) along with the temperatures of the coolant in RHR to show the heat transfer in this path when it functions. The same display scheme is applied to the PCV and the condenser where the steam or steam/water mixture flow from the RPV is roughly shown as an isoenthalpy line. In the lower part, the mass balance in the plant, which supports the above energy balance is shown for the condensate storage tank, the RPV, the PCV and the condenser. The leftmost figure in the upper part shows the relation between the energy and the mass inventory pair and the reactor pressure and the water level in the RPV, assuming equilibrium, saturated steam/water condition. This figure is intended to approximately estimate the depressurization effect of steam/water discharge which is necessary when events such as loss of all the feedwater transient without the high pressure emergency core cooling system (ECCS) may occur. In such cases, when operators should activate the safety/ relief valves to lower the reactor pressure to utilize the low-pressure ECCS, their cognitive performance becomes quite important and should, therefore, be supported (Masuda and Kawano, 1991). The line segments in the lower right part of the figure show the direction of the depressurization and water level
Control of BWR Nuclear Power Plants
x~
237
ks/an2
zlO
RPV INLETPLOW
PCV INLRTPLOW
CONDI~SBR lN1,gl"l:~OW
O~I~BT In..OW
O~'I.RT FLOW
:i
:tN¢ olrl'i.~ 1t.1~ i
|
,
I
°
•
°
.
~S
.4b
Fig. 5 Energy and Mass Balance in the Plant Startup Phase decrease. Applying these segments to the current status point, the decrease of the water level resulting from the needed depressurization can be estimated. According to the above figures, the energy/mass flow and the energy/mass balance condition in the whole plant at the decay heat removal phase can be easily grasped. At the same time, since the main process variables representing the heat transfer characteristics of the respective paths can also be easily grasped as patterns, the recognition of the abnormalities and the countermeasures for these can be improved. 5. ANALYTICAL EVALUATION OF THE PROTOTYPE EID Evaluation of the man-machine interface, especially for new designs such as EID, is one of the most important issues, since it should guarantee that the design objectives have been completely achieved before interface usage. Its importance as well as its difficulty increases for the present case because the main objective is to support the operator's knowledgebased behavior to cope with unanticipated events. There will be numerous scenarios corresponding to these events, and the evaluation will not be possible solely by empirical methods. Rasmussen (1985) has argued that analytical evaluations based on the use of quantitative or qualitative models of man-machine interaction should be considered rather than data collection in empirical evaluations. Analytical evaluations are useful for evaluating the effectiveness of a man-machine interface, i.e., the degree to which an interface supports the achievement
of the design objectives of the system. This is because they should reveal the functionality of the system achieving the objectives based on the engineering analysis of the work domain, and then, based on that, should identify the necessary information content and structure of the man-machine interface (Vicente, 1990). The abstraction hierarchy that the EID is based on is such a useful framework for the engineering analysis of the work domain that it can be used as a useful criterion for the analytical evaluations of the EID. That is, the third prescriptive principle of EID, i.e., the one for knowledge-based support, should lead to the following criterion: all levels in the abstraction hierarchy need to be presented in an interface. Regarding the above, a flow structure in the MFM should be considered as a nucleus to assemble the needed information from other abstraction levels based on the analytical evaluation. As described before, individual abstraction levels should have corresponding CRT picture elements. This process should be performed in a top-down fashion following the abstraction-aggregation relation. An analytical evaluation of the production goal display was done using Fig. 2 (Itoh et al., 1993). From this study, the abstraction hierarchy showed its feasibility to clearly evaluate the necessary information content and structure for the manmachine interface supporting the operator's knowledge-based behavior. Starting from the top-level flow structures, the CRT picture hierarchies can be evaluated systematically. The information identified
238
J. Itoh et aL
as necessary outside the current picture should be treated in the same way as the current picture. That is, based on the corresponding nucleus flow structure, the information content should be evaluated according to the abstraction hierarchy including the nucleus flow structure.
criteria for information content and structure of the interface. The empirical evaluation of the advantages of EID is an important issue.
Such an analytical evaluation can confirm the information content and structure, i.e., the effectiveness of the interface. However, the form of information also contributes to a fit between the representation in the interface and the operator's mental model of the domain that supports the knowledge-based behavior. Empirical evaluation should be considered for the above to complement analytical evaluation. Some preliminary results have been reported by Takizawa et al. (1994).
Basil, W., et al. (1991). Balance between automation and human actions in NPP operation - Results of international co-operation. In Balancing Automation and Human Action in Nuclear Power Plants. IAEA, Vienna. pp. 11-32.
A typical comment of the test subjects was as follows: EID display would suit the novice operator training to build up his/her plant mental model. However, it is too crowded with information to easily understand the situation. This comment can be interpreted as indicating that the EID display is at least full of information, but that it takes a long time to pick up necessary information as "affordance" (Rasmussen et al., 1989). This means that it takes time for operators to become accustomed to the EID display, since humankind has required a long time to acquire affordance from the natural environment. Besides the formal training, operators have ample time to get accustomed to the EID during on-the-job training during the normal operation.
6. CONCLUSION Systematic design approaches are needed for developing intelligent man-machine systems for nuclear power plants and an approach based on plant functional knowledge, knowledge of the cognitive processes of the operators, and advanced information technology has been studied. The ecological interface design is a seemingly unique existing methodology to systematically design intelligent man-machine interfaces supporting the operator's knowledge-based behavior. In order to cope with unanticipated events, its abstraction hierarchy can identify, a priori, the necessary information, based on a set of goal-relevant constraints governing the operation of the controlled system. A prototype application of EID to the major operational phases of BWR nuclear plants has shown that an improvement in the total plant overview and hierarchical plant monitoring is realized. EID also seems to be a valuable tool for the analytical evaluation of intelligent man-machine interfaces, because the abstraction hierarchy defines very useful
REFERENCES
Beltracchi, L. (1990). A direct manipulation systemprocess interface. In ANS Topical Mtg. on Advances in Human Factors Research on Man Computer Interactions. American Nuclear Society, Chicago. pp. 286-292. Itoh, J., et al. (1993). An ecological interface design for intelligent man-machine systems for BWR plants, In Topical Mtg. on Nuclear Plant Instrumentation, Control, and Man-Machine Interface Technologies, American Nuclear Society, Oak Ridge, pp. 97-103. Iwaki, K. (1991). Control room design and automation in the advanced BWR (ABWR). In Balancing Automation and Human Action in Nuclear Power Plants, IAEA, Vienna, pp. 399-412. Lind, M., et al., (1992). Applications of multilevel flow modeling. In ANP'92 -Infl ConL on Design and Safety of Advanced Nuclear Power Plants, Atomic Energy Society of Japan, Tokyo, pp. 42.3-1 - 42.3-10. Masuda, F., and R. Kawano (1991). The effect of human factors on plant safety. In ANS Intl Topical Mtg. on Thermal Reactor Safety. American Nuclear Society, Portland, pp. 631638. Monta, K. et al. (1992). Human reliability in process control during malfunctioning - A survey of the nuclear industry with a case study of man machine system development. In Analysis, Design and Evaluation of Man-Machine Systems, 1992 IFAC, The Hague, pp. 31-42. Rasmussen, J. (1985). Conceptual Models in ManMachine Design Verification, RISO-M-2520. Rasmussen, J. (1986) Information Processing and Human-Machine Interaction - An Approach to Cognitive Engineering. Elsevier Publishing, New York. Rasmussen, J., and K.J. Vicente (1989). Coping with human error through system design:
Control of BWR Nuclear Power Plants Implications for ecological interface design. Int'l. J. Man-Machine Studies, 31, pp. 517-534.
239
Reason, J. (1990). Haman Error. Cambridge University Press, Cambridge.
Vicente, K.J. (1990). Ecological interface design as an analytical evaluation tool. In ANS Topical Mtg. on Advances in Human Factors Research on Man/Computer Interactions. American Nuclear Society, Chicago. pp. 259-265.
Reynes, L. (1994). France's approach to I & C. Nuclear Engineering International, July, pp. 32-35.
Vicente, KJ., and J.Rasmussen (1992). Ecological Interface Design: Theoretical Foundation. IEEE Trans. SMC, 22, pp. 589-606.
Sekimizu, K. et al. (1992). Knowledge representation for automated boiling water reactor plant startup. Nuclear Technology, 100, pp. 295-309.
Woods, D.D. (1987). Commentary: Cognitive engineering in a complex and dynamic world. Int'l. J. Man-Machine Studies, 27, pp. 571-585.
Takizawa, Y. et al. (1994). An intelligent man machine system for future nuclear power plants. Nuclear Technology, 107, pp. 72-82.
Woods, D.D. (1988). Invited lecture. In Flight Deck Automations: Promises and Realities. NASA Conf. Report No. 10036.