Analytical modeling of nuclear power station operator reliability

Annals of Nuclear Energy, Vol. 6. pp. 309 to 325

0306-4549/79/0601-0309S02.00,0

ID Pergamon Press Ltd. 1979. Printed in Great Britain

ANALYTICAL M O D E L I N G OF NUCLEAR POWER STATION OPERATOR RELIABILITY Z. A. SABR1 and A. A. HussEI~ Nuclear Engineering Department and Engineering Research Institute, Iowa State University, Ames, Iowa 50011, U.S.A. (Received 22 September 1978: in revised form 1 December 1978)

Ai~traet--The operator-plant interface is a critical component of power stations which requires the formulation of mathematical models to be applied in plant reliability analysis. The human model introduced here is based on cybernetic interactions and allows for use of available data from psychological experiments, hot and cold training and normal operation. The operator model is identified and integrated in the control and protection systems. The availability and reliability are given for different segments of the operator task and for specific periods of the operator life: namely, training, operation and vigilance or near retirement periods. The results can be easily and directly incorporated in system reliability analysis.

1. I N T R O D U C T I O N

A mathematical model is developed to describe temporal changes in operator reliability taking into account the nature of human response to alarm systems and changes in operator-plant interfaces. Effects of blackout, failure of neuro-motor, and delay in response are considered under different stresses based on verified psychological experiments. The model encompasses several phases of operation including various changes in performance throughout the useful life of an operator; that is from the start of training until retirement. Operator reliability is essential to nuclear power plant safety analysis due to the major role of the operator in plant performance. Thus, incorporation of the operator of a nuclear power plant into the reliability block diagram (RBD) of the plant protection system (PPS) is considered. In an early study the reliability analysis of the liquid-metal fast breeder reactor (LMFBR) PPS has been carried out by Hansen and Husseiny") without accounting for the influence of the operator. However, the operator-plant interfaces during different phases of operation have a significant effect on the overall PPS reliability.~2) The model developed here is applied to a typical reactor shutdown system (RSS) to examine the influence of operator performance on RSS reliability. Unlike other parametric analysis techniques of human-plant interfaces,ca''*)the present method provides a tool to monitor the operator response in different operational tasks. The model also allows the use of existing data on human response.

The assessment of the interrelation between operator and system reliabilities would provide means for corrective actions for preventing operator-induced malfunctions or operation delays and help avoid economic and personnel accidents. Analysis of the operator performance provides the means to measure and predict the influence of the operator on equipment or system performance and the effect of equipment or system performance on the behavior of the operator. The analysis provides a design tool which can be applied in the design of advanced systems since the results can be used to identify principles or guide rules checklist for the design procedure, systematic analysis of interaction between task requirements and operator limitations, and provide a design which is Compatible with operability and maintainability. Current systems are less flexible for introduction of changes since the design is practically frozen. However, the study of operator factors could benefit in many aspects. Manpower characteristics, training programs, and operational procedures could be improved wherever necessary and whenever practicable to maximize the likelihood of effective operator-reactor system performance. Improvement can be based on new data accumulating from the increasing reactor years of operation. Optimal operator replacement time, number of operators per shift, and similar parameters can be determined with a high degree of accuracy. In addition, gaining insight in the nature of operator reliability can help in correcting causes of repetitive errors, alleviating stresses, and improving operational environment since investigation of error frequency will

309

310

Z.A.S.~RI and A. A. HUSSEINY

provide clues for the failure causes and conditions. This will also help in identifying symptomatic and situational errors. In Section 2 a model representing a single operator behavior in conducting a simple task is described. The model is then incorporated in block diagrams of reactor shutdown systems. A numerical example is also given to illustrate for the evaluation of operator performance in connection with systems of that type. The time dependence of operator reliability is then considered in Section 3 and the operator reliability model parameters are defined for an average well-trained operator. The impact of shift duration and stresses are analyzed in Sections 4 and 5, respectively. Operator availability and dependability are defined in Sections 6 and 7, respectively. In Section 8, the change of operator error rate with time is considered. The impact of training and experience are analyzed. The model is then extended in Section 9 to encompass deterioration of performance. In Section 10 combination of the error rate of an operator at various situations is discussed and finally conclusions are given in Section 11. 2. OPERATOR PERFORMANCE

An operator cannot be represented by a simple control element in the reactor control and protection system (C & P). Although the reliability of the operator can be determined in a fashion similar to that used in evaluating reliabilities of components, the human factors cannot be determined with the same precision as the performance parameters of mechanical, electrical, or electronic systems. These systems v/sfi-vis human elements can be tested under uncontrolled conditions and then modified, Operators, on the other hand, are more complex than any piece of equipment. No machine can perform with such human qualities as perception, recognition, and decision making, which are of great importance in operat-

Fig. 1. Operator behavior chain. ing nuclear power plants. These qualities played a significant role in reducing the hazard potential of the Browns Ferry accident3s~ Operation of a nuclear system involves some major elements of uncertainties which may lead to an unexpected course of events requiring decision making and probably reiteration on standing decisions. However, compared to reactor components, the operators are less stable since they are subject to such effects as physiological and psychological conditions, work environment, motivation, learning, boredom, and fatigue. The operator is also influenced by noise, work space, operating console layout, operating procedures under different situations, communications, logistics, and system organization. Psychological methods have been developed to evaluate single human functions such as signal detection and decision making. Nevertheless, more elaborate predictive methods are necessary to evaluate operator performance since in the case of nuclear system operations the interest is in the whole spectrum of operator behavior. If we consider an isolated single event, the operator, like any other component in the system, can be represented according to psychological concepts by the three parameters 16) shown in the chain of Fig. 1. The input, S, is a stimulus; such as position indicator, television camera, source-range monitor, an indicator light flashing or turning red, an audio signal, a pointer showing a reading on a meter, or failure of the system to respond after certain operation action. The internal response, O, represents the operator's perception, recognition of the stimulus, and integration of stimuli. The output, R, is the response of

R

s(

°

CHANGE

Fig. 2. Event tree logic of a simple single operator's mission.

Analytical modeling of nuclear power station operator reliability Table 1. Operator reliabilities of correct use of given stimulus and output response Parameter

Reliability

Stimulus: Red Light Flashing

Diameter: 2.54 cm (1 in.) Number of lights on: 1 Presentation: intermittent (blinking) Product: S

0.9999 0.9998 0.9998 0.9995 0.9990

Internal Response: 0 Output: Push Burton

Size: more than 1.27 cm (½in.) Number of scram push buttons on a console: 1-4 Number of scram push buttons to be pushed on a console: 2 Distance between edges: more than 1.27 cm (½in.) Detent: present Product: R Operator Reliability: Ro = SOR

The failure probability is the sum of all probabilites obtained for the three nodes on the failure bar. Each of these is the product of probabilities on the branches terminating at the corresponding node, that is Qo = I - Ro = S O R + SO + S

= 0.00129805 + 0.0009982 + 0.0005 = 0.OO28.

0.9999 0.9997 0.9995 0.9998 0.9998 0.9987 0.9972

the operator to S as a reaction to O; for example, insertion or withdrawal of a control-rod assembly, pushing a button, manipulating a .lever, or flipping a switch. Figure 2 shows an event tree logic of a single simple operator chain. The probabilities that the desired events will take place are represented by S, O, and R for the input, stimulus, output events, respectively. The failure to produce the desired events is represented by the corresponding probabilities ,~, O, and which correspond to the probabilities of the negated events that are not S, not O, and not R, respectively. Probabilites of success and failure may be obtained from Table 1, that is S = 0.9995 O = 0.9990 and R = 0.9987.

(1)

The event tree yields a success probability, Ro, equal to the product of all probabilities assigned to the branches leading to the single success node, that is Ro = S O R = 0,9972.

(2)

(3)

Success can be achieved only if the chain is not broken. Failure takes place if physical change occurs in the reactor but the operator receives no input signal (S or not S) or if the change is not perceived by the operator as S. In a more complicated state of events, the operator may receive several inputs (S's) but fails to discriminate between them. Failure occurs also if S is perceived but misunderstood (O or not O). If S is understood by the operator but R is unknown then there is no output action (R or not R) or possibly a wrong or out-of-sequence action will be taken. The output action cannot be taken if R is known to the operators but it falls beyond their capability. In order for the operator to complete a mission. the operator has to receive a signal indicating that the fight action has been taken by the output response and that the state of the reactor has been changed in a manner that mitigates the cause of the stimulus. This is done through a feedback stimulus F S as shown in Fig. 3 by the broken lines. F r o m here on, broken lines are used to represent the environment. The F S - O - R loop is another chain which involve the same R; that is, repeating the same output response if the first response did not induce the necessary change. There may be no response to FS if the task has been performed in the correct manner. U p o n perceiving the stimulus FS, the operator may respond with a completely different R to assure the correct response of the system. The response to different inputs and feedback stimuli is provided by the operational procedures. In general, the operator performance involves many interwoven chains proceeding concurrently with the

I

I L-

CHANGEJ

s

I

311

o

,

JJT'J

J

[

r--i

I

I " I R~c'roR I

L.._ ? -J

Fig. 3. Representation of operator performance.

I

312

Z.A. SABRIand A. A. HUssEINY

I

t

r'----- -'1 ,1 SENSORj - ~

l I

CONTROL SHUTDOWN / I ] BOX I H A RODS ,8 [-'~1LR I E _A C T O R ___J

Fig. 4. Diagrammatic representation of a single automatic shutdown system (no operator}. elements of Fig. 1 in the same order. For reliable operation of the C & P system, input and feedback stimuli have to be perceivable, visible or audible (displayed), not complex, consistent with needs, and real (not noise or superficial). Since any change in the system requiring operator response may involve many inputs and feedback stimuli, the displayed stimuli must not overload the sensory channels of the operator. As shown in Figs 1 and 3, a single chain includes series elements and hence in any operational task with complicated chain arrangements a broken element is apt to induce failure. For the single, isolated operational task represented by Fig. 1, the reliability of the operator Ro can be determined from either the event tree logic of Fig. 2 as in equation (2) or from the series block diagram of Fig. 3. This is the product of the probabilities S, O and R, that is

Ro = SOR.

(4)

The operator reliability can be defined as: 'the probability that the operator will successfully complete an operation task as intended at any required stage in the nuclear power plant operation stage within a required minimum time.' To examine the role of the operator performance in scramming the reactor, let us consider the simple diagrammatic representation of the generalized reactor shutdown system (RSS) shown in Fig. 4. The system operates automatically only without any operator action. The RSS comprises an input from the senior C which is received by the control box A which consequently supplies a trip signal to the shutdown mechanism B that consists of a number of independent shutdown rods. Actual shutdown systems involve redundancy and diversity and hence Fig. 4 represents only a single train from the.actual system. Excluding the reactor-sensor system (environment), the reliability of the RSS shown in Fig. 4, Re is Re = AB,

default. The reliability of this operator-reactor shutdown system {O-RSS), Ru is

R.~t = RoRR,

t6)

where Ro and R e are given by equations (4) and (5), respectively. This indicates that introduction of the operator affects the reliability of the .system directly. If the reliability of the operator is not included in the reliability analysis of the O-RSS system shown in Fig. 5 this would be tantamount to assuming that the operator performance is optimal; that is, Ro = 1.0, which obviously cannot be the case. We may examine the effect of the operator performance on the system reliability by the following scenario. Assume that a malfunction in the system is displayed by a flashing red light and that the probability of recognition of this stimulus, O = 0.9990. As the operator recognized the light, he pushed a button to scram the reactor. The reliabilities S, O and R are computed as in Table 1. Numbers are obtained from human reliability tables. ~7) The probability values associated with individual controls and displays have been obtained from data collected from 164 psychological studies of control and display utilization into human error rates. The reliability is here defined as 'the probability that the operator wiil use. in the correct manner, a control or display having the indicated dimensions.' The numbers cannot be used except as a guide only since they are obtained under laboratory controlled condition rather than in situ under the actual operational environment. The parameters in Table 1 are selected from available data to represent standard displays and controls and to give high reliabilities. The reliability of using the stimulus becomes less than that given in Table 1 with

(5)

where A and B are reliabilites of A and B, respectively. Introducing the operator element in the circuit gives the arrangement shown in Fig. 5. The diagram represents a case in which the shutdown action is done manually by the operator only and the automatic shutdown system is either bypassed or in

i I

I l

r

I

I

I

I

J FS I'm--- I REACTOR J~i L_-~- --7-- --J

I

i

t

J

I J

Fig. 5. Operation-reactor shutdown system (manual only).

Analytical modeling of nuclear power station operator reliability decrease in the dimensions of the light or with increase in the number of displays. The probability of correct use of push buttons will be lower than the values given if the number of buttons are more than five, if the number to be pushed is more than one, if the size of the push button is miniature, if the distance between edges is less than 1.27cm (l/2in.), or if detent is absent. The operator reliability of the system is obtained by using equation (2) or (4). The failure probability of the control mechanism A may be taken as A = 4 x 10 -4 . To evaluate the reliability of the control rods we need to define a failure criterion. Let us assume that failure occurs if not more than two rods entered the reactor. The shutdown mechanism may be assumed to consist of six identical rods of equal reactivity and of equal failure probability, F,. The probability. Pi that only i rods out of the six rods enter the reactor, given a signal has reached B, is obtained from the binomial distribution as 720 p~ = - F~,6-~(1 - F,)/. (6 - i)!i!

(7)

The control-rod system B is also subject to common mode failure with a probability Pc, thus B = (i - pc)ll + F,4E-15 + 24Fr - 10F,2"l~,. (8) The value of F, has been estimated as 10 - s based on operation data. ~s~ The c o m m o n mode failure probability may be taken as 5 x 10 -4. Thus, B = 0.9995 and from equation (5) RR = 0.9990. The manual O - R S S reliability is RM ----0.9962 which is obtained from equation (6). The results are summarized in Table 2. The automatic system; Fig. 4, included a sensor C which may have a reliability C -- 0.9999 and consequently the reliability RA of such system is RA = RRC = 0.9989.

(9)

r---L7 ~ J SENSOR ~ C ~ I j~l-----I/l

313

~

~

I Fig.

6. Operator-shutdown system automatic).

Rs = RA + RM(1 -- C).

(manual

and

(10)

Substituting the values obtained above, Rs = 0.999 which indicates; in spite of the approximate evaluation, that the O - R S S of Fig. 6 is more reliable than if the shutdown is left solcly to either the automatic or the manual actions (Figs 4 and 5 respectively). Routine operations and control tasks may involve an operator stand-by situation as shown in Fig. 7

Reliability Control box Shutdown mechanism: common-mode single rod more than 2 rods survived Shutdown system Sensor Operator Manual Automatic Manual-Automatic

J

Thus, the reliability of the manual system is less than the reliability of the automated RSS system. Although the numbers given in this scenario may differ from specific operation situations, the conclusion that Ro < RR and that the reliability of manually operated RSS is lower than that of automatically operated systems applies practically to all nuclear power reactors. Obviously improvement on the reliability of an O - R S S has to involve a great effort to improve an operator performance through eliminating sources of operator errors. Usually, the operator participates in the shutdown of the reactor simultaneously with the self-shutdown mechanism and the O - R S S is represented by the diagram given in Fig. 6. In this case the sensors C and S transmit two different signals, a trip signal with reliability C to B through A and a stimulus input to be perceivcd by the operator as S. Thus,

Table 2. Reliability of reactor shutdown system Element

r--L-~

A ~ g ~--~'IREACTOR I I I I L --i-''

Notation A

Value 0.9996

1 - Pc l - F,

0.9995 0.999

B Ra = AB C Ro RM = RoRR RA = RRC Rs = RA + Ru(l - C)

0.9995 0.999 0.9999 0.9972 0.9962 0.99890 0.999

314

Z.A. SABRI and A. A. HUSSEll,nr

-?

STIMULUS

I OPERATORI

?

OUTPUT NUCLEAR ] POWER PLANT

I CONTROLS]

Fig. 8. Compensatory tracking situation of operator-nuclear power plant with feedback stimuli.

REACTOR I

The reliability of an operator directly conducting routine operation may be represented by ,2~

Fig. 7. Operator in standby situation. or a compensatory tracking activity as shown in Fig. 8 where SS is a sensor-switching circuit to switch from automatic mode and activate the operator stimulus when needed. In both situations feedback stimuli are present. In continuous manual control tasks the operator-reactor system is illustrated in Fig. 9. The system includes representation of reactor dynamics, deterministic and random environmental disturbanccs, and an optimal control model of the operator. The operator model consists of a perceptual component that translates stimulated variables into delayed noisy perceived variables, an estimation and control-command, internal generation process which consists essentially of a Kalman filter, a least-meansquared predictor and a set of optimal gains to model the operator information processing and compensation behavior; a n d . a neuro-motor lag-matrix representing the output response accounting for the operator limitations and inability to generate perfect control responses. This operator model basically consists of the components S-O-R described above. The elements modeling the internal response O have been considered in several human performance analyses.(9- l 1)

Ro = ff-I Ri'

where R~ is the probability that ki independent operations are performed without leading to a class i error, that is R~ = r~'.

l

+•

GAINS H

(12)

Here, k~ is the number of identical operations which may lead to an error of class i and r~ is the probability that a performed operation does not lead to error i and system failure. This is given explicitly by r i --'-- 1 - -

PiQi,

(13)

where P~ is the probability of failure of an operation due to a class i error and Qi is the probability that an error or class i errors will result in system failure. Thus, the operator performance failure probability. Fo = 1 - Ro can be defined as the probability that one or more failure conditions will result from errors in at least one of n classes. If m errors combine to produce an error of class i, then Pi = I?I Pj,,

j=l

DISTURBANCES

NEURO- IJ.j_/\.,~" MOTOR f- z

(11)

i=l

H

PREDICTOR~ - ~ ESTIMATOR KALMAN

NEURO-MOTOR NO ISE

Fig. 9. Operator-reactor control model.

TIMEDELAY OBSERVATION 1 NOISE

(14)

Analytical modeling of nuclear power station operator reliability where Pj~ is the probability of occurrence of error j leading to a class i error. Similarly, Q~ may be a combination of many hardware failure probabilities associated with class i errors. This computation method applies basically to failures resulting from errors committed in repetitive manual operation tasks. To apply this method estimates of Pi for various kinds of errors and estimates of Qi for various kinds of hardware are needed. Most operation tasks, such as reactor startup involve many steps. Thus, a task i involves n independent steps, the failure probability associated with the task, PT~ is

Pri = ( I Prji, j=l

(16)

i=I

for an operation involving m tasks. System, component, or equipment failure rates can be evaluated with acceptable degrees of uncertainty from experimental and field operation data. In contrast, operator failure rates cannot be easily determined with sufficient accuracy since data collection is a rather difficult task. In order to include operator reliability in the overall nuclear power plant or the C & P systems reliability, it is necessary to estimate anticipated individual operator errors which may take place in performing a single operational task or step. Prediction of the most significant and the most frequent errors in a particular operation step or in a particular response output S is necessary. This information is also required before the actual operation to a priori compensate for those errors in system designs and in operation procedures. Once operation tasks are defined and operator errors are evaluated it is also necessary to identify, the operator stress characteristics, to determine the average operator capabilities to perform the operation tasks, and to eliminate stresses or tailor operational procedures around limitations.

3. O P E R A T O R

trials by the operator to complete a given operation task and s is the number of successful completions of the task, the probability estimate,/~o, that an operator performs the same operational task successfully is I~o = s /n

(17)

based on data at band. The function Ro is not equal to Ro, the actual true but u n k n o w n reliability of the operator. The confidence interval on Ro based on s/n can be obtained from

(15)

where Prj~ is the probability of failure in performing stepj in task i. The total operational failure probability is then

Fo = (-I Pri,

315

RELIABILITY

Most of the human reliability models developed and used in human factor engineering are discrete point probability functions due to mathematical complexities concomitant with molecularization of human tasks. ~la~ Thus, for example, if n is the number of

where r is the lower bound on Ro, f = 1 - r, and ct is the confidence that the interval r to 1 contains the true reliability Ro ."4) This model and other isomorphic models provide useful estimates in describing time-space discrete operation tasks, such as performing a one-shot operation. However, practically all normal nuclear power plant operation tasks are continuous in time and space domains. Examples of these tasks are vigilance, stabilizing, and tracking tasks. In this case, the operator performance reliability may be stochastically defined as "~)

Ro(t) = Pr [errorless operation task performance in (to, t)[stress]

(19)

or

Ro(t ) = exp -

O(t')dt' ,

(20)

o

where #(t) is the instantaneous error rate at time t, and t - to is the duration of performing the specific task or act of interest. Representing the operator by the chain shown in Fig. 1 can be used to break the error rate into three components: gs{t), a 'blackout' rate, that is the frequency of the operator inability to perceive a stimulus providing the stimulus can be perceived; go(t) the rate of the operator failure to internally respond to a stimulus in the proper time where the failure may include faulty integration of stimuli, unrecognized output response, or jammed sensory perception; and O~¢(t) the failure of the operator to output a response in the proper time for a given stimulus providing that the internal response is functioning properly and for an isolated operational task which involves single S, 0 and R without significant interference or overlap between the three functions.

316

Z.A. SABR!and A. A. HUSSEIh~

The reliability of the operator to perform the single specific task i f i ~ atime period t3 - to is obtained from equation (20) as

(f;

Ro(t ) = exp --

task. "6~ The rule in this case is to apply the following relationships to calculate the error rate of the x-response.

+

f,,

(24)

gx(t) = ~ gxi(t)

o gs(t)dt , g o ( t ) d t 4-

)

f,,

, gR(t)dt ,

i=1

(21)

where t t - to, t 2 - tt, and t 3 - - t 2 are the time periods associated with stimulus, internal response, and output response, respectively. In practice, the events S, O and R may overlap or interfere especially in the presence of multi-stimulus or multi-output situations. The time limits between S and O or O and R are often hard to discriminate. However, the three functions can be fairly represented by the distinctive three elements shown in Fig. 1. In this case, equations (4) and (20) give the value of the error rate as g(t) = gs(t) + go(t) + ga(t).

(22)

The time integral of each component is zero outside the range of time allocated for activation of each function. If the isolated task involved a series of n chains of stimuli, internal processes, and output responses then n

g(t) = ~ (gs~(t) + gel(t) + gsj(t)).

(23)

1=1

Often a task may involve more than one stimulus which are activated simultaneously to assure the induction of proper operator's response; such as using simultaneous audible and visual signals in case of emergency. Similarly the completion of the task may require two parallel or several series output responses. A skilled operator may use two-handed motions in parallel to replace two one-handed motions in series or may use a combination of motions in a multi-step

if the response involves n events in series or in sequence, since Re = exp -

(25)

~ gxi(t . i=1

If gx is time-independent, then gx =

Ro(t)dt

(261

for sequential or simultaneous events or a combination of both, and Ro(t ) = exp(-g~t).

(27)

Using available occurrence data, constant operator rates have been verified for light water reactors. ~17~s~ Detailed evaluation of gs, go and ga requires specific in-field observations. Methods for quantification of operator errors have been developed. °91 An example of a multi-step situation is illustrated in the chains shown.in Fig. 10. The reliability is gwen by equation (20) where gs,gs~(gs, + gs:) + go +

gR,gR:(gs, + gR2)

gR,gss(gs, + gRs)

(28)

+ gR~ + g~, + g~s + gR.gss

if g is time-independent, as can be shown using equations (4) and (25). If all blackout rates are equal to gs and the error rates of performing steps 1 through 5 are equal to gs, equation (28) reduces to g = ~gs + go + ~gR.

(29)

/

"

///~J

AUDIBLE S1

s21

I_.~,J

-,I

~

i

1 -

Fig. 10. Example of multi-S, multi-R operation.

I

Analytical modeling of nuclear power station operator reliability Using these quantitative representations of an operator reliability function in reactor operation is tantamount to assuming that all operator errors are random in nature and only occur by change. Thus, equation (27) cannot be applied in situations where either the operator is under training or near retirement age. It cannot be applied also to operators involved in surveillance testing of new operational procedures or of a new system and hence equation (27) will be assigned to the reliability of an operator in performing tasks and only committing random errors. Other components of the reliability will be considered below. Evaluation of error rates require extensive analysis of operation reports to determine the frequency and type of operator errors. The frequency of a given type or class of errors is determined in percentage of failure as function of particular reactor component subject to operator interface during operation; such as coutrol or protection systems. The error rate is also a function of the type of tasks in the operation procedure and time delay in performing particular operation tasks. It is often convenient to express the operation data in terms of mean time between errors (MTBE) which is generally a function of time and is given in terms of the instantaneous error rate as MTBE =

Ro(t)dt = 1/g.

(30)

317

ing his work shifts throughout the span of his operation life under the same environment, such as being in the same plant under the same stresses. If we assume that the operator starts re-performing the task fresh-as-new each time, then the reliability of a specific operator in performing a given task repeatedly during an operation life t, is

R(t.) = exp - ~ \

i=0

O(t)dt ,

where n = m ! + I, m is the number of the operator's work shifts during his operation life in the same environment, and I is the number of shifts in which the operator is idle or at rest. The rest time may be called out-of-shift time. Actually, the value of g(t) is zero when the operator is in the out-of-shift mode since he could not affect the performance of the task when he is not in charge of operation. If the task is part of a routine operation and the operator is well trained, g(t) may be assumed constant, that is R(t.)

=

exIM-n(n - I)gt).

fo(t) = - d R o ( t ) / d t

(31)

(34)

If the task is performed continuously and one operator is replaced by an identical operator (who commits the same number of errors in the same period of time), then for the given task

R(t) = e x p ( - g t ) This is similar to the relation between the M T B F for a component and the hazard function characteristic of that component. The M T B E is also related to the failure density function, fo defined as

(33)

,

(35)

which may be identified as the 'continuous operatortask model'. Equations (34) and (35) strictly apply to situations where operators are replaced in a relatively short time before being subjected to fatigue or other physical or physiological stresses developing from intensive long periods of operation. In this case

by the relation MTBE = 1/9. MTBE(t) = Ro(t)/fo(t).

(36)

(32)

We may drop the subscript O for simplicity and distinguish between operator parameters and reactor or system parameters when necessary.

4. S H I F T D U R A T I O N

Equation (20) applies to a specific task performed by a specific operator during a task duration rr = t-tl; which is limited by the length of the operation shift, z~; that is Zr < ~s or z~ = / z r + T,. where t is the number of tasks of class T performed during one operation shift s and z~ is the time spent by the same operator doing other different tasks characterized by different error rates. The same operator may perform the same task over and over again dur-

The parameters M T B E and 9 for a single isolated task involving the simple chain of Fig. 1 may also be taken as constant on the ground that the components of g(t) are practically impulses which may be represented by very sharp Gaussian distributions with very narrow spread over time or by f-functions; that is gs(t) = Osf(t), for example, and hence,

gs =

f"

gs6(t) dt

(37)

o

if the impulse duration is much smaller than tl - to. When the operator performs several isolated tasks in one shift+ the operator performance may be represented by different blocks with each block representing the appropriate chain (S-O-R) of the operator

318

Z. A. SAeal and A. A. Htrssen, tv

OfF

UNEXPECTED OPERATIONPII3| LF . . M ~

TiME Fig. 12. Change of OIF.

I

I

I

Fig. 11. A multi-operator simultaneous steps task.

performance of each task. The operator overall reliability during the shift can be obtained using formal methods of combining series, standby, and parallel reliability block diagrams. ~2°) In more complicated situations, one may resort to the Bayes' probability theorem. The same methods can be applied in the case of multi-operator tasks or operation over any length of time. As an example, let us consider a situation of two simultaneous tasks to, operate the redundant components A and B as shown in Fig. 11. Success of the operation can be achieved if at least one of three operators 1, 2 and 3 succeeded in giving the right output response at the appropriate time and either A or B or both A and B are independently activated. Each operator is identified by a different error rate; that is 0t, g2 and 03 for operators 1, 2 and 3, respectively. Using Bayes" theorem, the probability that the operation will be performed in time as planned, Rs is

Rs = (RA + RB -- RARsXRI + R2 + R3 - RtR2 - RtR3 - R2R3 + RIR2R3). (38) If all three operators are identical and components A and B have the same hazard function, h(t), the operation reliability in time t is

Many of the operator errors are not detrimental to either the operation or to the component reliability. As a matter of fact most of the frequently occurring errors produce no malfunction or are instantaneously recovered by taking the proper corrective action. Consequently, the error rate and MTBE must be divided into two distinct components: errors leading to failure and errors having no consequence. Operator induced failures (OIF) are those irreversible errors which affect task completion or initiate component and/or system failure. Although O I F are rare events, the reliability of the plant control and protection system is very sensitive to their frequency. In contrast, non-malfunction-producing operator errors (NMOE) are frequent but reversible. Their occurrence may lengthen the duration of completing a task or cause a delay in performance of a certain operation step or procedure without inducing a malfunction in any part of the plant. Although the N M O E are of little significance from an overall safety viewpoint, the increase in N M O E frequency in a given operational task could be a symptom of a potential OIF. Also, frequent N M O E can increase down-time and reduce plant availability. However, the main contribution to the mean-time-between-failures (MTBF) of any component is from OIF. Occasionally, there is no basis for identifying O I F when compared to N M O E and system errors, and hence more than one analyst has to review the operational data. Disputable occurrences may be reviewed or properly ruled out as nonOIF. Typically, O I F data can be represented by Fig. 12, wherein the time scale represents increased familiarity with the operation. Deviation from this pattern would indicate the need for retraining or may reveal a potentially unreliable situation. 5. STRESSES

xexp(-fo[O(t',+h,t',]dt').

,39)

The effect of stresses can be evaluated by examining the frequency distributions f(S), f(O) and f ( R ) of an average operator for the ability to perceive stimuli, S; the adequacy of internal response, O; and the capability to make an output at an allocated time, R. re-

Analytical modeling of nuclear power statmn operator reliability spectively. These spectra can be evaluated in controlled or actual environments during training or operation. Similar distributions can be found from statistical data on different known stresses. Psychological stresses usually affect the internal response while procedural stresses tend to affect R and to some extent reduce S. Procedural stresses; such as the case when a problem arises for which there is no defined procedure, are localized. In this situation, the stresses, X~ have a distribution of the form f ( X s ) = uo(X~ - X~o) where Uo represents an impulse at X , o and hence /--

Ro(t) = x/n " ~ exp( - gt)erfc(x/~so)

(40)

providing that f ( O ) is normal. In contrast, psychological stresses, Xp, are expected to assume normal distributions mid the reliability is given by Ro(t)=

e x p ( - gt

)[f~ fx~f(xp)f(s)dsdxp] p

1.

,4,,

The integrals can be evaluated if the distributions are known.

6. A V A I L A B I L I T Y

A rather critical parameter in operation of safety systems is the operator availability especially when the operator is in a standby mode or carrying out a vigilance operation routine. In a vigilance routine, the sensory channels of the operator are expected to be available for proper perception when called upon by an input stimulus and are ready to respond by an output at a random instant of time. Thus, operator availability may be defined as the segment of time during which the operator is in an alert mode. In contrast to reliability, operator availability is timeinvariant. It accounts for failure due to lapse of attention or loss of perception and for operator replacement. Since such failures are not usually self-annunciating they can be replaced by periodic testing of the operator under operation environment. Mathematically, the operator availability may be expressed as A = za/z~,

(42)

where ~,~ is the average time during which the operator is in alert (perception) state per shift duration, zs- The shift duration may be replaced by zr if interest is in defining the operator availability to perform a certain operational task. Equation (42) may be related

319

to operator reliability by A =

R(t)dt

(43)

providing that the type of error committed during performance of a task for which the operator reliability is R(t) results from the same cause affecting availability, such as lapse of attention. This is not at all restrictive since delay and most of NMOE's can be regarded of this type. Equations (42) and (43) may be generalized to describe the availability of an average operator relative to routine operation involving identical tasks. Thus, if we assume that an average operator starts performing an average operational task fresh-as-new, the error rate is constant during an operation period, and the product gr, << 1, which should be the case for reliable operations; equation (43) gives A = I - g~J2.

(44)

In fact, equations (43) and (44) are based on the assumption that if the operator failure is detected, he will be replaced instantaneously by another operator in a good state or another standby operator will perform the task. Alternatively, the operation task may be placed in a state not requiring protection. Since most of the instantaneous failures of the interhal response of the operator are not self-annunciating~ redundancy in operators is necessary in critical operational tasks. Operator replacement does not necessarily involve the end of his operational task but it may involve short renewal time, z, during a task duration or a shift to repair his internal response parameters. An operator involved in lengthy operational duration usually needs very short periods of rest and recovery such as coffee breaks, providing that the main operation is not interrupted. If the renewal time r, << r~, which is usually the case, the availability of an operator j in a redundant chain of operators is Aj = 1 - 0f,/2,

(45)

where gj is the error rate by the jth operator. Comparison of equations (36), (42) and (44) shows that

Studies of causal personal factors of human errors show that there is a daily and monthly cycle of a person performing a given task and each cycle contains a down portion. (21-23) Performing a task when the operator is in the down portion of his cycle has a relatively important impact on the operator reliabi-

320

Z.A. SABRI and A. A. HussEIsY

lity to perform the task. (2'*~ H u m a n errors are likely to be reduced if provisions are made for regular rest periods, especially from routine and monotonous jobs. ~24"'25) Discouragement of overtime or extended performance intervals in addition to the short renewal periods are likely to increase the availability. This is because fatigue results in lowered tolerance to enviroumental distractions ~26) and hence decreases the alert mode duration of the operator. A possible strategy for shif~ scheduling is to only change half the team of operators each time and to double the number of changes for a given shift duration. This allows newcomers to warm up and regain momentum while the rest of the team is at the peak of their performance. The operator availability concept is useful in determining optimal shift duration or effective operational periods per operator, optimal number of operators per operational task, measure for operator replacement schemes, and a measure of operator useful operational life. The effective operation period, re, per operator can be expressed in terms of an effective operation factor or operator utilization factor defined

as U =

Te

re + To'

To-T, 7",+ T o + r e

D = 1

(48)

To To + z ~

or l

D = - I+E

(49)

(50)

where ¢ is the off-schedule recuperating clock hours per one hour of effective operation.

8. IMPROVEMENTERRORRATES The failure rates and the reliability of an operator in performing a novel operation task need special consideration. Evaluation of rate of improvement is necessary to devise optimal training programs and to assure minimum error rates during actual operation. Early failures usually occur at the start of training, of testing operation procedures and of operating a new type of nuclear power plant for which no operation experience has been gained. In studying improvement in the human performance of complex tasks, it has been found 127) that the performance, p(t) can be described by an exponential model of the general form

(47)

where Ta is the operator down-time. This includes a scheduled break time for renewal of sensory channels, 7",; an idle or non-functional time, TI; and an off-schedule renewal time or break, To; which may occur due to sudden fatigue, exhaustion, or loss of coordination. A maximum effective operation factor per operator can be obtained by setting TI = 0 and minimizing T, + To by providing a proper job environment and eliminating many of the stresses whenever practicable and thus increasing the MTBE per operator. Equation (47) with Tt = 0 is identical to equation (42) for the availability. Actually (To - Tt)/(To + z~ - Tt) is a measure of unavailability of operators, thus A = 1

renewal periods, that is

p(t) = pi + p~ {1 - e x p ( - t / r ) } .

(51)

In applying this model to the operator performance, the parameters may be defined as follows: t is the duration of training, z is the time constant of the learning curve for the particular operational task, ~29) p~ is the initial performance at commencement of training which may be taken as p~ = 0, p~ + Pl is the final performance, and p(t) is the performance at time t (Fig. 13). The parameters ~ and Pl may be estimated from historical data. If the training effort can be represented by a unit step function the improvement curve may be regarded as the output of the dynamic system shown in Fig. 14. This interpretation is useful in estimating the Pl ÷ PF [

~

which gives operator availability in terms of various time increments.

7. DEPENDABILITY The operator dependability, D may be similarly defined as the probability that the operator will be available for performing an operational task at a random instant of time between any two scheduled

TIME

Fig. 13. Improvement curve, (p~ ~_ initial performance and p/ ~- final performance).

321

Analytical modeling of nuclear power station operator reliability INITIAL [ • PERFORMANC E , ~ - - ~ - - - ~

,,

LEARNING LAG

[ pf/tl+~s)

p(t)

]

Fig. 14. Dynamic trainin t system representation,

necessary parameters since the transfer function and the parameters can he determined by series expansion involving impulse response moments. (29) The parameters ~ and py need to be updated as more observations are made available so that better training supervision, retraining, or on-line Operation procedural changes can he done. This is particularly important in the early stages of training and in the surveillance testing operations. An algorithm has been devised (a°) to minimize the sum of error squares defined by

i

J

E] =

"

-

p)2

(52)

J

in nonrecursive fashion for r observations; where p is the a priori estimate, pj is the new estimated performance from new data with an error Ej. Typical plots of updating proceeding from a priori estimates are shown in Fig. 15 where," is used to refer to estimated values, + refers to estimates made immediately after new data is available, and ~ refers to asymptotic values. Another model for the improvement curve is shown in Fig. 16 and is based on Crossman's hypothesis of the speed-skill acquisition. (31) This hypothesizes that the operator experiments with alternate methods, rejects the inferior and retains the better ones until he develops the ability to select exactly the right operational method, choosing the right source of signals and making the right movements precisely. In this case, the exponential model of equation (51) holds

Pi TIME, t

Fig. 16. Crossman improvement curve. except near the origin since at the beginning of training the initial probabilities of choosing any of the available alternate operational methods are equal. However, the exponential model (equation (51)) is more appropriate for nuclear power plant operation since standardized operation methods are used. In some situations the improvement curve indicates a false asymptotic value which may appear as the ultimate improved performance.¢a2) The false asymptote or plateau is subsequently followed by a recovery curve which can be fitted by an exponential model (aa) as shown in Fig. 17. Example of this phenomenon is poor training followed by improvement in training procedures. The recovery phase curve may be time shittod to pass through the point Pi to provide a measure of performance improvement with reference to initial performance. (3'*) However, this requires determination of steady-state achievement and the time duration of the false plateau preceding rocovery. The false plateau phenomenon is described by the sequential exponential models wherein the initial phase is represented by p(t) = pil + P f l [1 - e x p ( - t / z l ) l , tl <- t <_ T

and the recovery phase model is p(t) = Pi2 + Pj'2 I1 - e x p ( - t / z 2 ) l , T <_ t <_ oo. (54)

/7,

/1

/t v"~-T-711 I

// "/ TIME

Fig. 15. Updating a priori estimates of Pl and ~. ,,,.N,i~ 6 6---I~

(53)

Fig. 17. Sequential exponential model.

322

Z.A. SABRI and A. A. HUSSEIS,t

When the recovery curve is advanced by plateau length, T, then p(t) = Pi2 + pf2'~l - exp[ - (t + T ) / r 2 ] ~j,

tl < t <

oc

(55)

where subscripts 1 and 2 are assigned to parameters of initial curve and recovery curve, respectively. From equations (53) and (55) and for tl = 0 Pit = Pi2 + Py_, I 1 - e x p ( - T/T2) I.

(56)

The plateau length is estimated as

• ( t~,__Z+ ~s2 + t~,l )

~' = t2 -- T2 ln~/~12 "It" # f 2 ~" # t 2

'

(57)

where/~, and/~tz are estimated values of the performance at tt and tz, respectively. The steady-state value can be detected when the difference between two successive values of performance is small and constant. Based on a linear difference equation derived from equation (51) a recursive Kalman filter algorithm is developed to investigate the learning process when the model parameters are nonstationary. "9'3.~ The technique facilitates the incorporation of all available a priori data. Compared to other algorithms, the technique requires smaller computer capacity. The error rate of the operator in the training stage can be predicted from the improvement model. Considering the exponential improvement model given in equation (51), the error rate in the case of a good training may be expressed as g(t) = g f + (g~ - g f ) e x p ( - t / E ( ~ ) } ,

(58)

where E(z) is the mean time for an operator performing a task with an initial error rate g~ to improve his performance so that he can on the most err in a rate, 0f- The time constant, E(,) may also be defined as the time measured from training commencement until the operator acquires expertise. According to Crossman's model, expertise is the ability to select exactly the right method after choosing the right method and the right source of signals. In this sense, if there are nE inferior methods to perform a task, then tie E ( z ) = ~ (gEi(t)/i), i=l

Figure 18 shows the failure rate as function of time t for a good training program, and relatively nonperfect programs. If the program involves trial and error schemes or if the type of operation is novel in nature, the nonperfect training operator error rate may assume an oscillatory characteristic. If the number of inferior methods used in performing a task, nE is such that n~ << no, where no is the number of good methods and if the failure rate using inferior methods, g~. is such that gE >> go, where go is the failure rate of the good method; the error rate stabilizes in a damped fashion as shown in Fig. 18. Ultimately gG ---' gf. The plateau phenomenon also appears in the error rate in Fig. 18 and this should not be confused with the real steady state when g(t)---* gl. The time constant E(z) or ~ depends on the operator abilities, however, an average person may be assumed and a screening test may be used to exclude unfit personnel. The recursive Kalman filter technique can be applied in predicting operator error rates even in the case where the model parameters are time varying and especially since prediction of future error rates depends on the nature and magnitude of the noise present. Large variances in the initial estimates of the parameters can be rapidly reduced as data become available from improved training procedures and further improvement in estimation can be made by parameter smoothing. Equations (51) and (58) can be used to determine the cumulative reliability of one operator in doing a specific task. If we assume that g r, g~ and r are time independent, then R(t) = exp[ - g f t - (gi - gf)r I 1 - exp( - tlr)'~] (60)

which includes random errors.

g!

~

as well as improvement

ON-PERFECT TRAINING

,.=,

(59)

where ge~(t) is the operator error rate in performing the task using the ith method. The value of E(r) may be taken approximately as the learning time, ~. In equation (58) as t approaches zero 9(t)--"9~ and as t - - , ~: y(t)----,Of which is the error rate to be used in equation (27) for the operator reliability in performing a task and only committing random errors.

o

[ gf TIME

Fig. 18. Operator error rate for perfect training and nonperfect training (damped oscillatory, undetected non-perfect training, and false plateau with recovery model.

Analytical modeling of nuclear power station operator reliability

323

9. R E T I R E M E N T SYNDROME ERROR R(T) 1

RATES

The third type of error is identified with increase in error rate. This could occur at the end of effective operating life of the operator and hence it may be called the 'retirement syndrome' error rate. However, such increase in error rate is not necessarily due to old age but it may occur because of, for example, over confidence produced by basically not erring over a long period of time. After the improvement during training the performance of the operator does reach a constant rate and then declines due to effect of aging, deterioration of internal response, defects in the sensory channels, and other factors which may develop near the retirement age or near the time limit where retraining becomes essential. The operator retirement syndrome failure rate depends on the 'performance age', T, which varies from one individual to another. This may often differ from the actual retirement age and is not equal to the natural age of the operator although this limits the value of T. According to this hypothesis, the retirement syndrome failure density, f ( T ) can be well represented by the Gaussian distribution shown in Fig. 19 f(T)

1 = ~exp[-(T ox/2n

- M)2/2tr2-1

(61)

where M is the mean operational life of the operator and tr2 is the standard deviation in the operation life of the operator, that is N

o.5

i

M T Fig. 20. Retirement syndrome reliability of operator. This is shown in Fig. 20. The corresponding error rate is function of age and is given as

g(T) = f ( T ) / R

(T).

(64)

To prevent errors associated with retirement syndrome the operator has to be released from active operation duties and replaced by another at a time t < M so that the cumulative probability of performing an operational task with minimum errors under given stresses is within acceptable levels. This depends on the particular operational task. The cumulative operation error probability for a replacement time M-3o is 0.00135 while that for M - 5 t r is 0.000000287. The replacement time is also the time after which the operator must be returned to sharpen his skills. The retirement syndrome reliability model introduced here may be replaced by a log-normal distribution to avoid the difficulties associated with normalizing the Gaussian distribution.

(62)

~2 = ~, (T~ - M i ) 2 / N , i=1

where N is the number of errors committed by the operator. The retirement syndrome failures cluster around the mean life. By definition, the operator reliability as function of age is R(t) =-~--~-- JT [exp - (T' - M ) 2 / 2 t r Z ] d T '. (63)

I0. C O M B I N A T I O N OF ERROR RATES

Both the improvement and retirement syndrome errors can be combined with random errors. Figure 21 shows the operator error rate as function of age where the three periods of operating life are identified. Period I is the improvement or training period which ends at age Tx where a steady-state learning rate is

fir)

TI M

AGE, T

Fig. 19. Model for failure density as function of age.

=

L III - - ~

TU

M

OPERATING LIFE '

Fig. 21. Error rate during combined periods of operating life.

324

Z.A. SAaRI and A. A. Huss~.x~rt

achieved. This is the commencement of the useful operator life II in which error rate occurs only by chance. In period III error rates are a combination of random errors and retirement syndrome errors. In some operations the recommended upper limit to the operator's age is 40 years.(2'*) However, this is based on operation of systems much less complex than nuclear reactor operation which often require less experience. Operation of nuclear power plants requires an intensive training and learning program, in addition to careful selection of operators with high intellectual and perception qualities. The fact that the time required for improvement and experience is usually long compared to the time needed in other operations, makes it necessary at least from the economical point of view to extend the useful operational life of the operator to a limit higher than 40 years. This can be achieved by careful a priori selection of operators; for example, the operator must be less sensitive to causal factor conditions, such as environmental and source data (procedures) factors. (3s) The operator must have an above average short term memory capacity.(36) Other causal factors may be optimized to provide high motivation level and maximum job satisfaction. These factors include relegating responsibility for the ultimate safety and efficiency of the nuclear plant to each operator, (37'aa) setting accuracy objectives above operator's typical performance,(ag) and incorporating an operation fail-safe measure wherever possible. For a given operator, error rates may deviate from the pattern described above; Fig. 21. For example, operator incapacitation; if occasional, and not terminal can cause an increase in random errors. Motivational errors can result in distortion in the error rate pattern if not detected and their causes are not corrected or eliminated. Considering random error rates only in continuous vigilance task, experimental operator reliability data has been collected for short periods of time.t4s) The data were fitted by Weibull, gamma and log-normal distributions rather than exponential or normal distributions. However, the operator reliability in performing continuous vigilance tasks greatly depends on the type of the task and often cannot be generalized for different systems and operations. Thus, the exponential distribution can be considered an adequate approximation until data fits are made available. Similarly, other mathematical models have been introduced for purely cognitive tasks. These models may be used in the course of analysis of typical operation situations.

il. CONCLUSIONS Point estimates of operator reliability may be evaluated by representing the operator by a chain of block diagrams. The reliability block diagram (RBD) of a single operator performing a simple task is a series diagram. The reliability of each element in the RBD can be obtained from the specification of the control panel. Using such model in representing the RBD of the reactor shutdown system (RSS) shows that the reliability of manual-automatic R S S is better than both the manual and the fully automatic systems. The time-dependence of the operator reliability can be represented by an exponential function of the instantaneous error rate. This rate exhibits an exponential decline with training and experience until it reaches an asymptotic value which prevails throughout the useful life of the operator. Deviation from such pattern may be observed under peculiar stresses or change in task procedures. The exponential operator model allows for computing quantities such as mean time between errors, availability and dependability. Also, the model can accommodate for changes in shift duration and multiple task operations. An increase in the instantaneous error rate may be exhibited in situations wherein the operator becomes over-confident or loses his capability due to psychological or physical deterioration. REFERENCES

I. Hansen Ann H. and Husseiny A. A. (1974) Reliability

2.

3. 4.

5. 6. 7. 8. 9.

analysis of LMFBR plant protection system, Trans. Am. nucl. Soc. 19, 234. Joos D. W. (1976) An evaluation of human error rates in commercial light water reactors, M.S. Thesis, Nuclear Engineering, Iowa State University, Ames, Iowa. Emon D. E. and Becar N. J. (1975) A reliability assessment method including human factors, Trans. Am. nucl. Soc. 21, 211. U.S. Nuclear Regulatory Commission (1975) Reactor safety study--An assessment of accident risks in U.S. commercial nuclear power plants, Report WASH-1400 (NUREG-75/OI4), October. How Browns Ferry skirted disaster. Business Weeks 105, November 15, 1975. Meister D. (1966) Human factors in reliability, Reliability Handbook (Ed. Ireson W. G.). Section 12. McGraw-Hill, New York. Munger S. et al. (1962) An index of electronic equipment operability (data store), American Institute for Research Report. No. AIR-C43-1/62-RP(1), January. Duma D. A. and Saxe F. R. (1973) An analysis o¢ control-rod-system malfunctions in nuclear power reactors. Nucl. Safety 14, 315. Baron S. and Kleinman D. L. (1969) The human as an optimal controller and information processor, IEEE Trans. Man--Machine Systems MMS-10, 101.

Analytical modeling of nuclear power station operator reliability 10. Livison W. H., Baron D. and Kleinman D. L. (1969) A model for human controller remnant, IEEE Trans. Man-Machine Systems MMS-10, 101. 11. Baron S. (1973) Applications of the optimal control model for the human operator to reliability assessmerit, IEEE Trans. Reliability R-22, 157. 12. Rook L. W. (1962) A method for evaluating the human error contribution to system degradation, Syrup. Human-Error Quantification, Sixth Annual Meeting Human Factors Society, New York. 13. Regulinski T. L. (1973) On modeling human performance reliability, IEEE Trans. Reliability R-22, 114. 14. Kaufman R. A., Oehrlein T. F. and Kaufman M. L. (1961) Predicting human reliability--Implications for operations and maintenance in space, National IAS-RAS Joint Meeting, Los Angeles, California, June 13-16. 15. Regulinski T. L. and Askren W. (1969) Mathematical modeling of human performance reliability, Proc. 1969 Ann. Syrup. Reliability, p. 5, January. 16. Dejong J. R. (1961) The effects of increasing skill and methods-time measurement, Time and Motion Study 10, 17. 17. Joos D. W. and Sabri Z. A., Evaluation of human errors in commercial light water reactors, Trans. Am. nucl. Soc. 18. Joos D. W. (1976) An evaluation of human error rates in commercial light water reactors, M.S. Thesis, Nuclear Engineering, Iowa State University, Ames, Iowa. 19. Husseiny A. A., Sabri Z. A. and Danofsky R. A. (1976) Quantification of operation experience and incident reports for reliability analysis and improvement of task performance, Trans. Am. nucl. Soc. 23, 484. 20. Bazovsky 1. (1961) Reliability Theory and Practice, Prentice-Hall, Englewood Cliffs, New Jersey. 21. Alluisi E. A. and Chiles W. D. (1967) Sustained performance work-rest scheduling and diurnal rhythms in man, Acta Psychol. 27, 436. 22. Thommen G. (1968) Is This Your Day?, University Publishing and Distribution Corp., New York. 23. Blake M. J. (1969) Time of day effects on performance in a range of tasks, Med. Res. Council Report No. AD-734526, NTIS, Arlington, VA, October. 24. Bailey R. W,, Derners S. T. and Lebowitz A. I. (1973) Human reliability in computer-based business information systems, IEEE Trans. Reliability R-22, 140.

325

25. Wang W. L. (1971) The prediction of individual dilferences in monitoring performance, Med. Rcs. Council Report No. AD-730374, NTIS, Arlington, VA, August. 26. Plait F. N. (1964) A new method of evaluating the effects of fatigue on driver performance, Human Factors 6, 351. 27. Bevis F. W. (1970) An exploratory study into industrial learning with special reference to work study standards, M.Sc. Thesis, University of Wales Institute of Science and Technology, Cardiff, U.K. 28. Towill D. R. and Bevis F. W. (1973) Managerial control systems based on learning curve models, Inst. J. Prod. Res. II, 3. 29. Towill D. R. (1973) A direct method for the determination of learning curve parameters from historical data, Int. J. Prod. Res. l l , 97. 30. Bevis F. W., Finniear C. and Towill D. R. (1969) Prediction of operator performance during learning of repetitive tasks, lm. J. Prod. Res. 8, 293. 31. Grossman E. R. (1959) A theory of the acquisition of speed-skill, Ergonomics 12, 153. 32. Glower J. H. (1966) Selection of trainees and control of their progress, Int. J. Prod. Res. 5, 43. 33. Towill D. R. (1972) Cusum monitoring of operator performance during learning, 14,brk Study and Managemerit Services, Vol. 16, January. 34. Sriyananda H. and Towill D. R. (1973) Prediction of human operator performance, IEEE Trans. Reliability R-22, 148. 35. Klemmer E. T. and Lockhead G. R. (1962) Productivity and errors in two keying tasks: a field study, J. appl. Psychol. 46, 401. 36. Conrad R. (1966) Short-term memory factor in the design of data entry keyboards: an interface between short-term memory and S-R compatibility, J. appl. Psychol. 50, 353. 37. Hackman J. R. and Lawler E. E., III. (1971) Employee reactions to job characteristics. J. appl. Psycho/. Monograph 55, 259. 38. Jordan N. (1962) Motivational probiems in humancomputer operations, Human Factors 4, 171. 39. Locke E. A. and Bryan J. F. (1966) Cognitive aspects of psychomotor performance: the effects of performance goals on level of performance, J. appl. Psychol. 50, 286. 40. Askren W. B. and Rignlinski T. L. (1969) Quantifying human performance for reliability analysis of systems, Human Factors 11, 393.