- Email: [email protected]
On The Modelling of The Human Process Operator
Copvrighr
© IFAC Analvsis. Design and
SESSIO['.; 2
I['.;Ol'STRIAL PROC ESS CONTROL
Evaluation of Man-:'vlachine Systcms Baden -Baden. Federal Republ ic of Germany 1 9R~
ON THE MODELLING OF THE HUMAN PROCESS OPERATOR L. Norros,
J.
Ranta and B. Wahlstrom
Technical R esea rch Centre of Finland , Electrical Engin ee ring Laboratory, Otakaan 5 I , 02150 Espoo, Finland
Abstract. The human operator in th e control room of a compl i cated process plant plays a crucial role influe ncing th e sa f ety , availabili t y and economy of the p lant. An understanding of humon be haviour and limitations is therefore essent i al both for th e assessment of the pl ant safe t y and for the design of an optimal man-machine interfac e . In the paper d i fferent models of th e human opera t or and their applicability to process supervision a r e discussed. A qualitative f r amework for opera t or mod e ls of a complicated process such as a nuclear powe r plant is discussed in more de t ail . The implications of th e mod e l in th e control room design , the desi gn process itself and the trainin g of operators ar e indicoted. Finally some general needs for new research are discussed Keywords. Ylan-machine systems, human f acto r s , au t omation systems.
devices , which allow new ways of pr e proc e ssing , structuring and ordering the basic in formation and changing data, e . g. by using computer graphics and interactive display design. This g i ves more fr e edom and new possibili ti es to a system designer, but there are also new risks of misfits and unfeasible sol utions in man-machine interface design .
INTRODUCTIO N The high level of automation, which is common in complex proc ess plants, has brought up the situation in which th e process operators have to make de c isions on a rather abstract l eve l using conceptions concern i ng plant safety , availability and economy. The fast changing t e chnology has raised new questions and problems in structuring and presentation of proc es s data and in aiding th e pr ocess ope r a tor during difficult plant transients. It has be e n realized in practice th a t th e human operator in th e con trol room of a complicated process plant plays a cent ral rol e influencing plant safety, economy and reliability.
To reach a balanced man-machine int e r face we must be able to evaluate different design al t erna tiv es . A necessary precondition for a successful design eva luati on is an und e rstanding of human behaviour both with respect to ahilities and limi tations. The limiting factors of the mental resources of a human operator are then particularly import an t for avoidane of demand-resource conflict. This fac t is of increas ing importanc e , because the new interactive sys t ems emphasize the human information processing activities and problem solving strategies as a part of a man-machine communication.
The recent incidents in th e process plan ts, like TMI-2 inc ident, have focused a tt e ntion to the role of process operator. The investigations of the incidents have shown (IEEE 1979 a, b) that the human er rors comm itt ed both inside and outside th e control room have had a central role during th e incid ent. It was also shown that thos e human e rrors "ere caused by deficiencies in the control room design, operator training, control room procedures and management procedures. Those problems have been pointed out also earlier (Seminara, 1976) and the criticism could be intepreted in such a way that a major misf~t exists between the demands placed on and the resources provided by the human operator.
The a bove mentioned facts require a study and model of human performance in the control room envi ronment. The modelling and understanding of human needs and behaviour allows new design criteria for man-machine interface design, which are the guiding factors of the practical design process. The need for theoretical consideration of man-machine int e rface has also been elaborated elsewhere (NKA/KRU 1981, Rasmussen 1980, Rasmussen and Rouse 1981).
The development of technology has offered increasing flexibility and power for computing
AI1E-C *
55
L. Norros, J. Ranta and B. Wahlstrom
56 ON THE
~10DELLIN G
METHODOLOGIES
The motivation for constructing models of the human operator is the same as for modelling technical, sociological, biological etc . systems. The model dev eloped could serve as an aid for thought, communication, training and instruction, prediction, experimentation e tc. A model is an efficient way for structuring available information and formalizing loos e hypotheses . The us e of the models for prediction is often the main goa l of the modelling work and the predictive power of the model is us ed as a goodness measure. If the model has a good predictive power it could be used to support or even substitute exper ime nts. The main difficulty in modelling an activity of human operator is his versatility and vari ability, which makes it ex tr emely difficult to find any general explanations for his behaviour. This means that th e different roles, functions and capabili ti es of th e human operator have to be modelled separately. The different models will thus reflect the different needs , and the use of th e model will be restricted to th e situation studied . The mathema tical models are a class of th e quantitave models, and th ey have also been applied to man - machine s tudi es. Typical examples are models based on queing theory, optimal control, decision th eory and fuzzy systems th eo ry. Those models include a hypothesis on the human behaviour and can be used for th e t esting of different behavioral hypotheses (Rouse 1977, Rouse 1980, Timonen 1980, Timonen et. al 1980). Instrumen t monitoring is a t yp ical but isolated task in control room env ironmen t, wh i ch has been studied I'/ith ma th ema tical models . As th e operator must scan several instruments, and as we can assume that th e human ope rator concentrates his attention at one item a time, he allocates resources be t ween them and also prioritizes them. The concept of time sharing between different channels is obvious and th e queuing theoretic approach is a natural way to build up th e model of an isolated monitoring task. When failure detection and process state estima tion are essen tial es ti mation theory has been applied . Also optimal control models and decision th eore tic mode ls have been presented to describe resource allocation between dif ferent tasks. Another typical problem, which has been tr ea t ed with mathematical models, is to describe the human operator as a part of a control loop. The models are used to estimate possible instability re gions of the system. Usua ll y linear models wi th a time delay have been accurate enough for th e design purposes . The basic model can, of course, be extended to t ake into account also goal settings, weighting aspects, trajectory tracking and prewiewing aspects. This problem statement
leads to different optimal cont rol mo de ls . The man in the loop problem can also be found in th e control room environmen t. However, usually it is not an isolated task, but a part of diagnosti c a nd prognostic activities. The main applications of th e mathematical models are in the aerospace area. Usually , the modelled tasks have been well defined and structured so that the criterion for the human behaviour has been easy to find . Those models have also been t ested and valida t ed in simplified laboratory or experimental environment . The isolation of well defined tasks is difficult in a r eal process con trol room envi ronment, I,/here problem solving and group dynamic plays an essen ti al role in human behaviour . Yet, it seems that problem solving and strategy finding activities are difficult to put into a rigorous mathematical model. Of course, different decision theoretic and fuzzy system concepts can s e rve as thin k in g aid and help to t es t differ ent hypotheses, but it is appare nt that a stronger framework and qualitative descriptions a r e still needed. This is i mportan t, because the problem of diagnosis and progno sis, as discussed later on, are critical activities in control r oom e nvironment. There are also other probl ems r e lated to the use of mathematical models (Bainbridge 1981, Timonen 1980). For instance, if we like to study human information processing activities the input-output similarity equivalence can be good between the behaviour of the human operator and our mathematical mode l, but the hypothesis and theories behind the mode l do not necessary refl ect th e internal problem solving stra tegies of human operator. The qualitative models can offer a very strong conceptual frame - work to study manmachine interactions. Also the problem solving elemen ts can be included in th e model 1n such a way that th e model can be used as a base for developing design criteria of a process con trol r oom . Qualitative models are usually good aids in deciding th e system concept , in designing dialogue control pr in ciples etc . ~oreover, before we can build a good mathematical model with a good predictive powe r, we need concep tual framework a nd qualitative descrip tion of human behaviour with thenries ass umption behind th e model . Qualitative models are built up with help of cognitive psychology and usu a ll y the y are based on theories about human problem solving and strategy finding activities. Practical expe riences have been gathered from verbal protocols and real control - room (or simulator) experi~ents . Again int erpretation diffi culties rise with expe ri mental results and with the equivalence between model assump tions and the output of verbal protocols (Bainbridge 1979).
On the Hodelling of the Human Process Operator SPECIAL FEACTURES OF HONITORING AND SUPERVISING OF COMPLICATED PROCESS PLANTS. - A F~~WORK FOR MODELLING Operator tasks and task demands In designing the process information system we have to remember that this system is basically a tool for the personal in the plant to supervise, control and manage the process. Starting from this point, the problem can be seen to have three main aspects, as Fig 1 presents. First we have the technical production process. Basically the nature of the process sets the main goals and conditions of plant operation as related to safety, availability, economy, and often puts also serious requirements on operation principles. These goals and principles are reflected, e.g. in the process instrumentation and automation system. On the other hand process instrumentation and automation is a tool to realize those principles and also a tool to aid the human operator in his task. Second we have the human operator, who supervises and controls the process with the help of the instrumentation and automation. The operator has experience, training and thus his own view about the process and its operation principles. The operator has an ability to solve problems and formulate strategies and his functioning is influenced and modified by psychophysiological factors. Third we have the social context, where the plant is operating. Each society has its own laws, regulations, authorities, cultural background, habits, attitudes, which all are influencing at least indirectly the functioning of the global system human operator - automation process. Thus it 1S essential to see the role of process operator in two ways. First we must realize that the human operator is acting as a system component and has a crucial role in the overall system. From the point of view of the overall goals it is essential that the human operator function as they have been specified during the design stage can be performed accurately during the process operation. Second the control room is a work environment for the operator. To reach the overall goals of the process operation the control room must provide an appropriate environment for the human operator in giving him necessary support and possibilities to develop himself. \ye can summarize the problems of supervising and control of a complex process plant, like a nuclear power plant, as follows, - complexity, dynamic interactions, feedback paths in the process play an essential role in the understanding and recognizing of the process properties,
57
- slow responding dynamic, or long time constants are usual and cause difficulties; on the other hand fast responses are also some times required, - rare events and multiple failure situations are difficult to supervise, because plant variables develop in an unpredicted way, low activity level during normal operations although operators highly trained into tasks of high intellectual qualities, - manual take-over supposed, although little opportunities 1S given to train manual control. To begin with it is worthful still to emphasize that which we can call critical demands of activity. That is important, because during critical demands drawbacks and misfits in manmachine interface design become overt and are emphasized; individual differences in operator activities and training become apparent. The activity in a normal situation and in a rare event cannot be found very different. Thus the concrete operator activities that carry out these critical demands are not isolated actions or cognitive functions, but rather an integrated cognitive motivational whole. Thus it is apparent that a well-balanced control room in normal situations is a precondition also for successful operation during critical task demands. The basic contradictions in the activity demands arise from the nature of the production process and the required tasks: most of the time the process calls for low activity tasks or mere supervising, but occasionally sudden active operations of high intellectual qualities are demanded. Because of a high grade of automation the change in demands might be very' dramatic, and the risks in case of 31 unsuccessful change are very high; e.g. in nuclear power plant control. The contradictions at the action level that originate from this objective task feature are of motivational and cognitive character: In the long run it is very difficult to be motivated in an underdemanding task, or at least the activity must be motivated through task extern goals. Because of the low variance in the task conditions, the formation of the skills related to critical demands is hindered during the l,Tork. From the actual events the experienced operator creates in his mind candidate chaiffiof events and tries to relate the actual event to a familiar and experienced event. Thus the increasing skills increases the selfsconfidence and then it might be difficult to begin to analyze and diagnose the actual event as a new one, although there would be a need for that. A second task characteristic which makes the activity internally contradictory is the rising role of abstract information
58
L. Norros, J. Ranta and B. hiahlstrom
as a basis of control actions. The cognitive motivational structur e of a working activity is traditionall y forme d in working situations where th e material effec ts of the decisions are close, immediate and affective. To be a bl e to control th e modern proc esse s one needs abstractions that c ontradict this perceptual and co ncr e t e closen es s. This also me a ns that in a conventional working pro cess the orientation basis is fo rme d through empirical gene r aliza ti ons on the basis of th e perceptual information. In the control of modern processes this is no t so apparent, as th e or i entation basis and the int er nal process mode l of th e operator are to be formed through th eore ti ca l and conceptual means, and compr i ce both actual i nformation and memory representations . The role of orientation is perhaps c learest in the d i agnostic demands, i.e. during plant s t ate detection , hypothesis fo rmin g and t es tin g . It is also evident that pred ictive ab iliti es , i.e. evaluat ion of ac tions, planning a nd plan evaluation are important espe cially a t th e decis ion making and act i vi t y c hoosing stage . A particular problem in a predictive ac tivit y is that the operator has to be willing to put his efforts in such an activity, a lth oug h the predictions can bery seldom be verified aga in st the actua l, real r es ults. Together with the d i agnost i c demands we can def ine the predict ive demands as the cr iti cal operator demands. As already stated above the cr itical dema nds can not be supported i: th e control room is not we ll-bal a nc ed during normal situations. An i mportant aspect, which must be added in that respect, is that the operators must, all th e time, relate their decision to th e overall goa ls of plant operation. The goals of the who l e p l an t are ge nerally defined in qualitative t erms using different sub-goals. In th e sub-goals th e r e is a priority which means that th e p lant safety is th e primary concern and the p lant-economics should be optimized only lifhen n ei th e r safety nor availability are endan ge red. The sub-goals co uld be used t o der ive more accurate conditions and objectives for the plant operation. Th e conditions could be g iven, e.g. as - allowed plant variable limits, - co nditions on plant status, - operational restrictions. The required conditions could be assured by the man-machine system through different operational principles and through a p~oper task division between man and machine, i.e. through a proper task allocation between manual, semi-manual, and automatic operation. Thus we can state that the automation and information system is introduced to realize a proper task division between man and machine and also to aid human operators during
diff e rent operational t a sk. From this starting point we must eva luat e the task division with the overall goa ls of th e plant. Considering th e multitudes of systems, tasks and situations, which th e operators should manage , it is clear th a t no singl e mode l, description nor theory would cover them all. We nee d a lar ger framework, which should integrat e different views and descriptions into a global theory and model. The co nstruction of such a framework has been tackled in the Nordic Cooperation project (NKA/KRU 1981) and will shortly be described be l ow . Describing the operator in process supervision The diagnosis of events, predic t ion of consequences and planning of activi ties include typically complex demands , which are not easily cove r e d by models. However, to understand how these demands trans fe r into concrete ac tiviti es , a concept and desc ription of th e control structure of the diagnosis, pro gnosis and planning activi ti es are needed. The activity has th e character of fulfilling tasks, which is r ela t ed to the nature of the working process in question. This means that the activity is characterized thro ug h goals that are organized in a hierarchical way, forming th e hierarchical control structure of th e activity. Th e hierarchy of a particular activity is not pre-defined. Because goa ls can be r eac h ed through different means and the same means can serve differ e nt goals, there exists degr ees of freedom th a t are used in different ways depending on the individual and th e situation. However, th e fundamental rol e of goals holds for eve r y activity. Fulfilling the goals a nd sub-goals can be desc ribed as a sequence of (conscious or unconscious) mental opera ti ons , wh i ch form the sequential structure of the a ctivit y . The components which are defined in many information processing models are principally in agreement. On a rather general level we could say that th e activity is comprised of goal formation, orientation, planning, decisio and control. The orientation function is often analyzed ~n more detail, and several sub-components or functions are being formulated. The hierarchical and sequential structure are integrated through a set of internal models, which are different kinds of memory representations. The models can be differentiated through the contents. They also include programs of varying levels, and they develop and their content can change, e.g. according to training and experience. As mentioned the internal models or memory representations serve in the regulating of activity. Only by postulating the internal models can the fluency and flexibility of human activity be explained. It is usual to separate three levels of regulation, that
On the Modelling of the Human Process Operator are from the higher to the lower, intellectual, perceptive-conceptual, and senso-motor, or knowledge based, rule based and skill based, according to Rasmussen (1980). Within the frame of Nordic projects, an operator activity model is developed that reflects tte general principles of working activity just mentioned. This model has been adapted to the conditions of operator activiti es and serves as a common framework for human reliability control room design and training. A description of this model can be seen in Fig . 2. It conceptualizes the sequential structure of the operator activity in differentating eight functions and corresponding states of knowledge. The r egu lative aspect to the activity is taken into account by pos tulatin g the possible "l eaps" or "short cuts" in th e complete structure. The highest level is knowledge based activity and it is represented in the model as going through the complete sequence of functions. Should th e activity be reduced throu gh associative leaps from the identification or observation function to the target state or other lower states of func tions it can be defined to be rule-based. If the activating phase is immediately followed by executing pre-learned senso-motor patterns, the activity is d efined as skill-based, for more details, see (NKA!KRU 1981). As stated above the model has been proposed to serve as a framework for human reliability, control room design and training studies (NKA!KRU 1981, Rasmussen 1980). HO\vever, there still exist problems and the concept above must still be ex t ended . We try to sketch a concept for the future elabora tions of the model. Concerning the model itself we could state that by emphasizing the sequential aspect we loose easily the dynamics of the activity carried out through th e goal structur e and represented in the internal models. Although an activity is actually controlled mainly by processes of a particular regulation level, it always includes also features from the lower levels crystallized in some concepts, and is also a dependent part of a more general process that is r egulated through higher level processes. This is the only way you could understand the ability to exchange the actual regulating level to another when the conditions are changing. Following the frame of the Rasmussen model we had to postulate another additional principle or mechanism for the changing of the behavioral level. There are many factors, which influen ce the of the regulation level, like emot10nal factors: stress, boredom, etc., interest and attitudes of operators, motivational ~spec~s etc. The chanGe of regulating level 1S st111 an open question and it is also important from the design point of view. Moreover, what is the role of experience and that of the theoretical knowledge, a~d how.c?n.the latter regulate oDe rational act1v1t1es. . e~change
59
A particular technological system is created by man, and th ere exists therefore the principle possibility of knowing its states and functions. But when the system is getting more complex, failures of different components become also complex ; the unambigious definition of the system normal vs. abnormal state is not always possible. Thus the diagnosis of a technical system includes the ability to hadle uncertainty anJ fuzzy relations and probabilistic aspects of different failure mechanisms. Experimental investigations of man ' s reasoning seem to suggest that he mainly r e lies on deterministic and linear hypothesis. The ability to handle uncertainty is particularly difficult to acquire even through extra learning. There are certainly different causes for that, but one is perhaps the most import an t: probability and fuzzines are not evident , they have to be inferred. These examples are only suggestive. Their main message, however, should apply generally: Th e essen tial way in improving the diagnosis is to enhance the conceptual and theoretical level of the process knowledge. This , as such, is a research problem: How to make the necessary th eoretical knowledge and conceptual information operative, that is, regulative? In an optimal situation a process operator is working in a predictive manner . Problems arise Ivhen the complexity of the situation incr eases . If the understanding of the interactions of the process is not sufficien t no basis exists for predictions, and th e operator has to switch only to a feedback and reactive strategy. The major differences of th e strategies concern th e extension of the goa ls: in feedback strategies you can operate on the basis of rather isolated nearby goals, open loop and predictive mode is controlled throu gh distant goals and goal hierarchies. Also the signals used as indicators of necessary actions differ: in feedback strategy th e signals are limit ed and actual, in feedforward e laborat e and more or less "warning" signals which are forecasting possible future events . It is not the question Ivhich one of the working methods is better in most of the cases but rather how to keep the operator also on the predictive mode. It seems that operator aids could be quite helpful, lik e a predictive display system. The computer can operate on the basis of the interactions and count th e values of r e levant parameters, but in order to use this knowledge you still have to understand the interactions. Again we end up with the problem of what is the operatively adequate process knowledge and how it is, and should be represented in the mind of the operator; what is the complete orientation basis? And what are the implication on the automation system design?
60
L.
Norros, J. Ranta and B. Hahlstrbm
A very crucial difficulty in predictive activities is motivational in character. A predictive working method presupposes an active mode in every activity; from active seeking of information to eagerness ir making efforts in thinking. This aspect of the predictive demands should deserve much more attention in the fu ture investigations. The solutions are presumably to be fou nd of the organisational level: There have to be enough degrees of freedom in order to keep th e operator's interest awake and his competence available.
TOHARDS A NE\
The rule-based behaviour could be supported by a special aid system for procedure execution. A compute-based process state identification aid can be used to present different alarming sequences and to present how disturbances are proceeding. A dynamic real-time interrogation system can be r ea lized by the computer, where precondition, interlockings, states of important components, and procedural aid, and interrogation and help systems have to be r eal ized to protect the operators from memory slips and to ensure a rapid information retrieval. It is also apparent that the realization of an advanced procedural aid requires utilization of design data, which sets special demands on th e design process. As pointed out in the discussion of the previous section, the activities during rare events are critical and these activities are based on the knowledge of the process operation. This emphasizes possibilities to test diagnosing hypothesis and to validate strategy choices for predictive purposes. In a real plant complex interactions means that effective diagnosis, prognosis and hypothesis testing are not possible without advanced operation aids. Thus we can conclude that the knowledge-based behaviour requires info rma t ion abou t function principles of process and automation system. A special design data base is needed so that a special interrogation and information retrival system can be realized. The design data bases are needed also in the realization of different operation aids, disturbance analysis system, hypothesis testing system , fast mode simulation and scenario generation system. A difficult problem to solve still exists. As discussed in the previous section, it is important that the information system can give cues so that the operational behaviour can be initiated at the right behavioral level. This empasizes what discussed above and it is a special challenge to design methods and to the flexible use of databases. A diagnosing aid system must utilize of necessity information about design principles also on the system requirement specification level. It is also evident that a good overall view of the process state is one of the best cues for the operator. Besides supporting different data processing levels of an invidual operator, it is important that the display system can take into account the different experience back-ground of different operators and the need of different user groups. This requires that special attention must be paid to the dialogue control design and to the flexibility of system. The problems discussed above require also a new approach to automation system design. The data needed in the realization of operation aid systems must be gathered during the design process. A special matheod must be developed to ensure this data need.
On the Modelling of the Human Process Operator Computer-based design aids, like requirement specification, verification, function testing, and documentation systems, are quite natural candidates to facilitate the integration of design and operation. The training of operators is mainly assosiated with means and methods to give the human operator an internal world model, which is relevant to his job. One other problem is to measure the knowledge and skill of the operator to get some estimation of the state of the internal world model. Considering the different types of internal models discussed earlier, it seems clear that a large variety of methods and aids are needed for th e training and for the measurement of training results.
presenting the process and the task top-down fashion.
61 ~n
a
From th e training point of View if would be interesti~g to inves tigate which abilities makes up a good operator for th e control room work. It could be possible that good opera ~rs have accuired general and specific rules of thumb to p'Crform the different ac tiviti es . Such rules could be diagnosing strategies, set of important parameters, goals a nd restrictions which are imperativ e e tc.
CONCLUSIONS
The models for functional meaning and abstract function could to a large extent be built using classroom training. The building of the functional structure models should be supported with observations and operations e ither in the plant or using a simulator. The models of physical function could not be acquired without operating on the plant or on a suitable simulator. The model of physical forms could again be acquired using classroom exercises, perhaps using also a mock-up of the control room.
The work in the human factors area , which has been done mainly in the aerospace fie l d, pro vides a very good foundation for th e human factors research in process supervision . Owing to differences be tween the two fields more research has, however, to be done to reach the same level of understanding and design practice. Thanks to the massive research effort, wh i ch has been spent , it seems, however, that an understanding is emerging. Th e challenge is then to draw the design implications of that und e rstanding and work toward some standardized practice for th e design of future control rooms .
The data processing activities on the different l evel s could be trained in simulated situations. On the higher level, a talkthrough in the control room could provide a very cost-effective training. For the trainin g of the dataprocessing on the intermediate level, a high fideli t y simulator is perhaps the best train ing tool. The data processing on the lower l evel again could be trained with a part task trainer.
It is also interesting to note th e possibilities which are emerging with the introduction of new hardware and software. It is, how e ve r, a danger that system vendors continue to produce systems on an ad -h oc basis in response to market pressure. This makes it important to spread good practices in man machine interface design to make both the vendors and the vendees aware of the require ments on a con trol room design.
Considering the situation in the control room, it is evident that the emphasis in the training will be on the diagnosis of the very rare abnormal situations. Taking into account that by definition no available internal world model could provide an immediate solution to the diagnosis task, it is clear that the operator should execu te the diagnose on the higher data process ing level. He will, on the other hand, have the tend ency to move the data processing do,m with increased experience. This means, e.g. that to ensure that the operator at an incid en t executes the diagnosing task on the higher level, we will have to restore the suspicion and confusion of th e operator in order to prevent him from falling in the trap of associating the r eadings with some previously experienced incident. Gained experience makes it possible for th e operator to integrate the action performed in the control room during different maneovers into a larger entity. This abstraction ability makes it possible for the operator to intuitively comprehend a set of actions as tasks with defined goals, restrictions, initial state and terminal state. Training of this ability should be supported by
REFERENCES Bainbridge, L., (1979). Verbal r epo rts as evidence of the process operator's knowledge. Int. J. Man-i'1achin e Studies , ~, 411-363. Bainbridge, L., (1981). clathematical equations or process routines. Human detection and diagnosis of system failures Eds. J. Rasmussen, W.B. Rouse, ~ew York 1981, Plenum Press, 259. IEEE, (197921). The Human. The key factor in nuclear safety. Myrtle Beach. Conference Record for 19 79 IEEE standard workshop on human factors and nuclear safety. IEEE, (1979b). Special issue on Three Mil e Island and the future of nuclear power. IEEE Spectrum 16, No 11. NKA!KRU-project on-operator training, control room design and human reliability - Summary report, ~KA!KRU-(81)11, Joint Scandinavian Research Project, The ~ordic Council of Ministers, Ju ne 1981. - Technical Summary Report on Operator Training, NKA!KRU-(81) 12, Joint Scandinavian Research Project, The Nordic Council of Ministers, Jun e 1981.
62
L. Norros, J. Ranta and B. Wahlstrbm Rasmussen, J., Rouse, W. B., (ed) . Human detection and diagnosis of system failures . New York 198 1. Plenum Press . Rouse, H.B. (ed), (1979) . Special issue on app li ca tions of control theory in human factors . Human Factors 19(1977)4. Rouse, W. B., (1980). Systems Engineering Models of Human Machine Interaction. ~orth Holland, New York. Seminara, J.L., ( 1976). Human factors review of nuclear power plant control room design. EPRI NP- 309 S 4, Project 501, Palo Alto. Timonen, J,. (1980). On the control theoretic mode llin g of human process operator . Technical Research Centre of Finland, El ectrica l Engineering Laboratory. Research Report 55, Espoo. Timonen, J . , WahlstrBm, B. , Tuominen, L. (1980). On th e modelling of the tasks of op era tor in a utoma t ed process plant. Proc. IFAC/IFIP Symposium Assopo ' 80, Trondheim 1980, North-Holland, Amsterdam.
- Technical Summary Report on Control Room Des i gn and Human Reliability, NKA/KRU- (81)13 , Joint Scandinavian Research Project, The Nord i c Council of Ministers, Jun e 19 8 1. - Publication List, NKA/KRU-(81) 14, J o int Scandinavian Research Project, The Nordic Council of Ministers, June 1981. - Guidelines for Operator Trainin g , NKA/ KRD - (81)15, Joint Scandinavian Research Project, The Nordic Council of Ministers, June 1981. - Gu idel in es for Man - Machine Interfac e Design, NKA/KRU- (8 1) 16 , Joint Scandinavian Research Project, The Nordic Counci l of Ministers, June 1981. Ranta , J., Tuominen, L ., Uusitalo , M., Rantanen, J. (1982) . Spec i fying man-computer dialogues - the use of guidelines for design of interactive systems . Preprints of I ~IEKO 8th Trien nal World Congress, Berlin-West . Rasmussen, J., ( 1980) . Some t rends in manmachine int erface desi gn for industrial process plants. Proc. IFAC/IFIP Svmp. Assopo ' 80. Trondh e im 1980, ~orth Holland , Amsterd am.
r- - - - - - - - - - - - - - - - ,
externa l
I ~ .,.!' . , .-
t (· !'(! ~ ut'(' n'\!'o#'C
I
~---'-: ~~"< I
l~~~ nr
I
" '!lLl: l ..... n
-._------,---
I
L ---- Tr ----j--
,
:':\~~t--
N
c
..J"
I I
-
~
~L
I
L
Fig. 1.
~,' r.""" '. '1 ' ·:""' I I·~ ._ ___ __
_____
'I
lI'<.."i·".,e'T'{'nt
I
alJt..h')nt.i~~
I
!'oO(" l e t)'
I
_ _ _ _______ _
:
~
...1
o
0010. proc . u ,nq r , ~o!
_ _____
Ox1J"F'flt.s
A general model of the con tr ol room situation
C=J QC
_
- - --:
It
$10.1'" 0 1 w,.,O .... , td~ ",,,,11 ," .. from 0010.
~
P'OC ' U'f'g
t-.!"'!""""'i
~I"~ . ~u t IQ
'Itt'OlrP, d
f"0( U~ ~
Fig. 2. Schematic mode l of the sequences of opera t or ' s mental activities ()lKA/KRU 1981)
© IFAC Analvsis. Design and
SESSIO['.; 2
I['.;Ol'STRIAL PROC ESS CONTROL
Evaluation of Man-:'vlachine Systcms Baden -Baden. Federal Republ ic of Germany 1 9R~
ON THE MODELLING OF THE HUMAN PROCESS OPERATOR L. Norros,
J.
Ranta and B. Wahlstrom
Technical R esea rch Centre of Finland , Electrical Engin ee ring Laboratory, Otakaan 5 I , 02150 Espoo, Finland
Abstract. The human operator in th e control room of a compl i cated process plant plays a crucial role influe ncing th e sa f ety , availabili t y and economy of the p lant. An understanding of humon be haviour and limitations is therefore essent i al both for th e assessment of the pl ant safe t y and for the design of an optimal man-machine interfac e . In the paper d i fferent models of th e human opera t or and their applicability to process supervision a r e discussed. A qualitative f r amework for opera t or mod e ls of a complicated process such as a nuclear powe r plant is discussed in more de t ail . The implications of th e mod e l in th e control room design , the desi gn process itself and the trainin g of operators ar e indicoted. Finally some general needs for new research are discussed Keywords. Ylan-machine systems, human f acto r s , au t omation systems.
devices , which allow new ways of pr e proc e ssing , structuring and ordering the basic in formation and changing data, e . g. by using computer graphics and interactive display design. This g i ves more fr e edom and new possibili ti es to a system designer, but there are also new risks of misfits and unfeasible sol utions in man-machine interface design .
INTRODUCTIO N The high level of automation, which is common in complex proc ess plants, has brought up the situation in which th e process operators have to make de c isions on a rather abstract l eve l using conceptions concern i ng plant safety , availability and economy. The fast changing t e chnology has raised new questions and problems in structuring and presentation of proc es s data and in aiding th e pr ocess ope r a tor during difficult plant transients. It has be e n realized in practice th a t th e human operator in th e con trol room of a complicated process plant plays a cent ral rol e influencing plant safety, economy and reliability.
To reach a balanced man-machine int e r face we must be able to evaluate different design al t erna tiv es . A necessary precondition for a successful design eva luati on is an und e rstanding of human behaviour both with respect to ahilities and limi tations. The limiting factors of the mental resources of a human operator are then particularly import an t for avoidane of demand-resource conflict. This fac t is of increas ing importanc e , because the new interactive sys t ems emphasize the human information processing activities and problem solving strategies as a part of a man-machine communication.
The recent incidents in th e process plan ts, like TMI-2 inc ident, have focused a tt e ntion to the role of process operator. The investigations of the incidents have shown (IEEE 1979 a, b) that the human er rors comm itt ed both inside and outside th e control room have had a central role during th e incid ent. It was also shown that thos e human e rrors "ere caused by deficiencies in the control room design, operator training, control room procedures and management procedures. Those problems have been pointed out also earlier (Seminara, 1976) and the criticism could be intepreted in such a way that a major misf~t exists between the demands placed on and the resources provided by the human operator.
The a bove mentioned facts require a study and model of human performance in the control room envi ronment. The modelling and understanding of human needs and behaviour allows new design criteria for man-machine interface design, which are the guiding factors of the practical design process. The need for theoretical consideration of man-machine int e rface has also been elaborated elsewhere (NKA/KRU 1981, Rasmussen 1980, Rasmussen and Rouse 1981).
The development of technology has offered increasing flexibility and power for computing
AI1E-C *
55
L. Norros, J. Ranta and B. Wahlstrom
56 ON THE
~10DELLIN G
METHODOLOGIES
The motivation for constructing models of the human operator is the same as for modelling technical, sociological, biological etc . systems. The model dev eloped could serve as an aid for thought, communication, training and instruction, prediction, experimentation e tc. A model is an efficient way for structuring available information and formalizing loos e hypotheses . The us e of the models for prediction is often the main goa l of the modelling work and the predictive power of the model is us ed as a goodness measure. If the model has a good predictive power it could be used to support or even substitute exper ime nts. The main difficulty in modelling an activity of human operator is his versatility and vari ability, which makes it ex tr emely difficult to find any general explanations for his behaviour. This means that th e different roles, functions and capabili ti es of th e human operator have to be modelled separately. The different models will thus reflect the different needs , and the use of th e model will be restricted to th e situation studied . The mathema tical models are a class of th e quantitave models, and th ey have also been applied to man - machine s tudi es. Typical examples are models based on queing theory, optimal control, decision th eory and fuzzy systems th eo ry. Those models include a hypothesis on the human behaviour and can be used for th e t esting of different behavioral hypotheses (Rouse 1977, Rouse 1980, Timonen 1980, Timonen et. al 1980). Instrumen t monitoring is a t yp ical but isolated task in control room env ironmen t, wh i ch has been studied I'/ith ma th ema tical models . As th e operator must scan several instruments, and as we can assume that th e human ope rator concentrates his attention at one item a time, he allocates resources be t ween them and also prioritizes them. The concept of time sharing between different channels is obvious and th e queuing theoretic approach is a natural way to build up th e model of an isolated monitoring task. When failure detection and process state estima tion are essen tial es ti mation theory has been applied . Also optimal control models and decision th eore tic mode ls have been presented to describe resource allocation between dif ferent tasks. Another typical problem, which has been tr ea t ed with mathematical models, is to describe the human operator as a part of a control loop. The models are used to estimate possible instability re gions of the system. Usua ll y linear models wi th a time delay have been accurate enough for th e design purposes . The basic model can, of course, be extended to t ake into account also goal settings, weighting aspects, trajectory tracking and prewiewing aspects. This problem statement
leads to different optimal cont rol mo de ls . The man in the loop problem can also be found in th e control room environmen t. However, usually it is not an isolated task, but a part of diagnosti c a nd prognostic activities. The main applications of th e mathematical models are in the aerospace area. Usually , the modelled tasks have been well defined and structured so that the criterion for the human behaviour has been easy to find . Those models have also been t ested and valida t ed in simplified laboratory or experimental environment . The isolation of well defined tasks is difficult in a r eal process con trol room envi ronment, I,/here problem solving and group dynamic plays an essen ti al role in human behaviour . Yet, it seems that problem solving and strategy finding activities are difficult to put into a rigorous mathematical model. Of course, different decision theoretic and fuzzy system concepts can s e rve as thin k in g aid and help to t es t differ ent hypotheses, but it is appare nt that a stronger framework and qualitative descriptions a r e still needed. This is i mportan t, because the problem of diagnosis and progno sis, as discussed later on, are critical activities in control r oom e nvironment. There are also other probl ems r e lated to the use of mathematical models (Bainbridge 1981, Timonen 1980). For instance, if we like to study human information processing activities the input-output similarity equivalence can be good between the behaviour of the human operator and our mathematical mode l, but the hypothesis and theories behind the mode l do not necessary refl ect th e internal problem solving stra tegies of human operator. The qualitative models can offer a very strong conceptual frame - work to study manmachine interactions. Also the problem solving elemen ts can be included in th e model 1n such a way that th e model can be used as a base for developing design criteria of a process con trol r oom . Qualitative models are usually good aids in deciding th e system concept , in designing dialogue control pr in ciples etc . ~oreover, before we can build a good mathematical model with a good predictive powe r, we need concep tual framework a nd qualitative descrip tion of human behaviour with thenries ass umption behind th e model . Qualitative models are built up with help of cognitive psychology and usu a ll y the y are based on theories about human problem solving and strategy finding activities. Practical expe riences have been gathered from verbal protocols and real control - room (or simulator) experi~ents . Again int erpretation diffi culties rise with expe ri mental results and with the equivalence between model assump tions and the output of verbal protocols (Bainbridge 1979).
On the Hodelling of the Human Process Operator SPECIAL FEACTURES OF HONITORING AND SUPERVISING OF COMPLICATED PROCESS PLANTS. - A F~~WORK FOR MODELLING Operator tasks and task demands In designing the process information system we have to remember that this system is basically a tool for the personal in the plant to supervise, control and manage the process. Starting from this point, the problem can be seen to have three main aspects, as Fig 1 presents. First we have the technical production process. Basically the nature of the process sets the main goals and conditions of plant operation as related to safety, availability, economy, and often puts also serious requirements on operation principles. These goals and principles are reflected, e.g. in the process instrumentation and automation system. On the other hand process instrumentation and automation is a tool to realize those principles and also a tool to aid the human operator in his task. Second we have the human operator, who supervises and controls the process with the help of the instrumentation and automation. The operator has experience, training and thus his own view about the process and its operation principles. The operator has an ability to solve problems and formulate strategies and his functioning is influenced and modified by psychophysiological factors. Third we have the social context, where the plant is operating. Each society has its own laws, regulations, authorities, cultural background, habits, attitudes, which all are influencing at least indirectly the functioning of the global system human operator - automation process. Thus it 1S essential to see the role of process operator in two ways. First we must realize that the human operator is acting as a system component and has a crucial role in the overall system. From the point of view of the overall goals it is essential that the human operator function as they have been specified during the design stage can be performed accurately during the process operation. Second the control room is a work environment for the operator. To reach the overall goals of the process operation the control room must provide an appropriate environment for the human operator in giving him necessary support and possibilities to develop himself. \ye can summarize the problems of supervising and control of a complex process plant, like a nuclear power plant, as follows, - complexity, dynamic interactions, feedback paths in the process play an essential role in the understanding and recognizing of the process properties,
57
- slow responding dynamic, or long time constants are usual and cause difficulties; on the other hand fast responses are also some times required, - rare events and multiple failure situations are difficult to supervise, because plant variables develop in an unpredicted way, low activity level during normal operations although operators highly trained into tasks of high intellectual qualities, - manual take-over supposed, although little opportunities 1S given to train manual control. To begin with it is worthful still to emphasize that which we can call critical demands of activity. That is important, because during critical demands drawbacks and misfits in manmachine interface design become overt and are emphasized; individual differences in operator activities and training become apparent. The activity in a normal situation and in a rare event cannot be found very different. Thus the concrete operator activities that carry out these critical demands are not isolated actions or cognitive functions, but rather an integrated cognitive motivational whole. Thus it is apparent that a well-balanced control room in normal situations is a precondition also for successful operation during critical task demands. The basic contradictions in the activity demands arise from the nature of the production process and the required tasks: most of the time the process calls for low activity tasks or mere supervising, but occasionally sudden active operations of high intellectual qualities are demanded. Because of a high grade of automation the change in demands might be very' dramatic, and the risks in case of 31 unsuccessful change are very high; e.g. in nuclear power plant control. The contradictions at the action level that originate from this objective task feature are of motivational and cognitive character: In the long run it is very difficult to be motivated in an underdemanding task, or at least the activity must be motivated through task extern goals. Because of the low variance in the task conditions, the formation of the skills related to critical demands is hindered during the l,Tork. From the actual events the experienced operator creates in his mind candidate chaiffiof events and tries to relate the actual event to a familiar and experienced event. Thus the increasing skills increases the selfsconfidence and then it might be difficult to begin to analyze and diagnose the actual event as a new one, although there would be a need for that. A second task characteristic which makes the activity internally contradictory is the rising role of abstract information
58
L. Norros, J. Ranta and B. hiahlstrom
as a basis of control actions. The cognitive motivational structur e of a working activity is traditionall y forme d in working situations where th e material effec ts of the decisions are close, immediate and affective. To be a bl e to control th e modern proc esse s one needs abstractions that c ontradict this perceptual and co ncr e t e closen es s. This also me a ns that in a conventional working pro cess the orientation basis is fo rme d through empirical gene r aliza ti ons on the basis of th e perceptual information. In the control of modern processes this is no t so apparent, as th e or i entation basis and the int er nal process mode l of th e operator are to be formed through th eore ti ca l and conceptual means, and compr i ce both actual i nformation and memory representations . The role of orientation is perhaps c learest in the d i agnostic demands, i.e. during plant s t ate detection , hypothesis fo rmin g and t es tin g . It is also evident that pred ictive ab iliti es , i.e. evaluat ion of ac tions, planning a nd plan evaluation are important espe cially a t th e decis ion making and act i vi t y c hoosing stage . A particular problem in a predictive ac tivit y is that the operator has to be willing to put his efforts in such an activity, a lth oug h the predictions can bery seldom be verified aga in st the actua l, real r es ults. Together with the d i agnost i c demands we can def ine the predict ive demands as the cr iti cal operator demands. As already stated above the cr itical dema nds can not be supported i: th e control room is not we ll-bal a nc ed during normal situations. An i mportant aspect, which must be added in that respect, is that the operators must, all th e time, relate their decision to th e overall goa ls of plant operation. The goals of the who l e p l an t are ge nerally defined in qualitative t erms using different sub-goals. In th e sub-goals th e r e is a priority which means that th e p lant safety is th e primary concern and the p lant-economics should be optimized only lifhen n ei th e r safety nor availability are endan ge red. The sub-goals co uld be used t o der ive more accurate conditions and objectives for the plant operation. Th e conditions could be g iven, e.g. as - allowed plant variable limits, - co nditions on plant status, - operational restrictions. The required conditions could be assured by the man-machine system through different operational principles and through a p~oper task division between man and machine, i.e. through a proper task allocation between manual, semi-manual, and automatic operation. Thus we can state that the automation and information system is introduced to realize a proper task division between man and machine and also to aid human operators during
diff e rent operational t a sk. From this starting point we must eva luat e the task division with the overall goa ls of th e plant. Considering th e multitudes of systems, tasks and situations, which th e operators should manage , it is clear th a t no singl e mode l, description nor theory would cover them all. We nee d a lar ger framework, which should integrat e different views and descriptions into a global theory and model. The co nstruction of such a framework has been tackled in the Nordic Cooperation project (NKA/KRU 1981) and will shortly be described be l ow . Describing the operator in process supervision The diagnosis of events, predic t ion of consequences and planning of activi ties include typically complex demands , which are not easily cove r e d by models. However, to understand how these demands trans fe r into concrete ac tiviti es , a concept and desc ription of th e control structure of the diagnosis, pro gnosis and planning activi ti es are needed. The activity has th e character of fulfilling tasks, which is r ela t ed to the nature of the working process in question. This means that the activity is characterized thro ug h goals that are organized in a hierarchical way, forming th e hierarchical control structure of th e activity. Th e hierarchy of a particular activity is not pre-defined. Because goa ls can be r eac h ed through different means and the same means can serve differ e nt goals, there exists degr ees of freedom th a t are used in different ways depending on the individual and th e situation. However, th e fundamental rol e of goals holds for eve r y activity. Fulfilling the goals a nd sub-goals can be desc ribed as a sequence of (conscious or unconscious) mental opera ti ons , wh i ch form the sequential structure of the a ctivit y . The components which are defined in many information processing models are principally in agreement. On a rather general level we could say that th e activity is comprised of goal formation, orientation, planning, decisio and control. The orientation function is often analyzed ~n more detail, and several sub-components or functions are being formulated. The hierarchical and sequential structure are integrated through a set of internal models, which are different kinds of memory representations. The models can be differentiated through the contents. They also include programs of varying levels, and they develop and their content can change, e.g. according to training and experience. As mentioned the internal models or memory representations serve in the regulating of activity. Only by postulating the internal models can the fluency and flexibility of human activity be explained. It is usual to separate three levels of regulation, that
On the Modelling of the Human Process Operator are from the higher to the lower, intellectual, perceptive-conceptual, and senso-motor, or knowledge based, rule based and skill based, according to Rasmussen (1980). Within the frame of Nordic projects, an operator activity model is developed that reflects tte general principles of working activity just mentioned. This model has been adapted to the conditions of operator activiti es and serves as a common framework for human reliability control room design and training. A description of this model can be seen in Fig . 2. It conceptualizes the sequential structure of the operator activity in differentating eight functions and corresponding states of knowledge. The r egu lative aspect to the activity is taken into account by pos tulatin g the possible "l eaps" or "short cuts" in th e complete structure. The highest level is knowledge based activity and it is represented in the model as going through the complete sequence of functions. Should th e activity be reduced throu gh associative leaps from the identification or observation function to the target state or other lower states of func tions it can be defined to be rule-based. If the activating phase is immediately followed by executing pre-learned senso-motor patterns, the activity is d efined as skill-based, for more details, see (NKA!KRU 1981). As stated above the model has been proposed to serve as a framework for human reliability, control room design and training studies (NKA!KRU 1981, Rasmussen 1980). HO\vever, there still exist problems and the concept above must still be ex t ended . We try to sketch a concept for the future elabora tions of the model. Concerning the model itself we could state that by emphasizing the sequential aspect we loose easily the dynamics of the activity carried out through th e goal structur e and represented in the internal models. Although an activity is actually controlled mainly by processes of a particular regulation level, it always includes also features from the lower levels crystallized in some concepts, and is also a dependent part of a more general process that is r egulated through higher level processes. This is the only way you could understand the ability to exchange the actual regulating level to another when the conditions are changing. Following the frame of the Rasmussen model we had to postulate another additional principle or mechanism for the changing of the behavioral level. There are many factors, which influen ce the of the regulation level, like emot10nal factors: stress, boredom, etc., interest and attitudes of operators, motivational ~spec~s etc. The chanGe of regulating level 1S st111 an open question and it is also important from the design point of view. Moreover, what is the role of experience and that of the theoretical knowledge, a~d how.c?n.the latter regulate oDe rational act1v1t1es. . e~change
59
A particular technological system is created by man, and th ere exists therefore the principle possibility of knowing its states and functions. But when the system is getting more complex, failures of different components become also complex ; the unambigious definition of the system normal vs. abnormal state is not always possible. Thus the diagnosis of a technical system includes the ability to hadle uncertainty anJ fuzzy relations and probabilistic aspects of different failure mechanisms. Experimental investigations of man ' s reasoning seem to suggest that he mainly r e lies on deterministic and linear hypothesis. The ability to handle uncertainty is particularly difficult to acquire even through extra learning. There are certainly different causes for that, but one is perhaps the most import an t: probability and fuzzines are not evident , they have to be inferred. These examples are only suggestive. Their main message, however, should apply generally: Th e essen tial way in improving the diagnosis is to enhance the conceptual and theoretical level of the process knowledge. This , as such, is a research problem: How to make the necessary th eoretical knowledge and conceptual information operative, that is, regulative? In an optimal situation a process operator is working in a predictive manner . Problems arise Ivhen the complexity of the situation incr eases . If the understanding of the interactions of the process is not sufficien t no basis exists for predictions, and th e operator has to switch only to a feedback and reactive strategy. The major differences of th e strategies concern th e extension of the goa ls: in feedback strategies you can operate on the basis of rather isolated nearby goals, open loop and predictive mode is controlled throu gh distant goals and goal hierarchies. Also the signals used as indicators of necessary actions differ: in feedback strategy th e signals are limit ed and actual, in feedforward e laborat e and more or less "warning" signals which are forecasting possible future events . It is not the question Ivhich one of the working methods is better in most of the cases but rather how to keep the operator also on the predictive mode. It seems that operator aids could be quite helpful, lik e a predictive display system. The computer can operate on the basis of the interactions and count th e values of r e levant parameters, but in order to use this knowledge you still have to understand the interactions. Again we end up with the problem of what is the operatively adequate process knowledge and how it is, and should be represented in the mind of the operator; what is the complete orientation basis? And what are the implication on the automation system design?
60
L.
Norros, J. Ranta and B. Hahlstrbm
A very crucial difficulty in predictive activities is motivational in character. A predictive working method presupposes an active mode in every activity; from active seeking of information to eagerness ir making efforts in thinking. This aspect of the predictive demands should deserve much more attention in the fu ture investigations. The solutions are presumably to be fou nd of the organisational level: There have to be enough degrees of freedom in order to keep th e operator's interest awake and his competence available.
TOHARDS A NE\
The rule-based behaviour could be supported by a special aid system for procedure execution. A compute-based process state identification aid can be used to present different alarming sequences and to present how disturbances are proceeding. A dynamic real-time interrogation system can be r ea lized by the computer, where precondition, interlockings, states of important components, and procedural aid, and interrogation and help systems have to be r eal ized to protect the operators from memory slips and to ensure a rapid information retrieval. It is also apparent that the realization of an advanced procedural aid requires utilization of design data, which sets special demands on th e design process. As pointed out in the discussion of the previous section, the activities during rare events are critical and these activities are based on the knowledge of the process operation. This emphasizes possibilities to test diagnosing hypothesis and to validate strategy choices for predictive purposes. In a real plant complex interactions means that effective diagnosis, prognosis and hypothesis testing are not possible without advanced operation aids. Thus we can conclude that the knowledge-based behaviour requires info rma t ion abou t function principles of process and automation system. A special design data base is needed so that a special interrogation and information retrival system can be realized. The design data bases are needed also in the realization of different operation aids, disturbance analysis system, hypothesis testing system , fast mode simulation and scenario generation system. A difficult problem to solve still exists. As discussed in the previous section, it is important that the information system can give cues so that the operational behaviour can be initiated at the right behavioral level. This empasizes what discussed above and it is a special challenge to design methods and to the flexible use of databases. A diagnosing aid system must utilize of necessity information about design principles also on the system requirement specification level. It is also evident that a good overall view of the process state is one of the best cues for the operator. Besides supporting different data processing levels of an invidual operator, it is important that the display system can take into account the different experience back-ground of different operators and the need of different user groups. This requires that special attention must be paid to the dialogue control design and to the flexibility of system. The problems discussed above require also a new approach to automation system design. The data needed in the realization of operation aid systems must be gathered during the design process. A special matheod must be developed to ensure this data need.
On the Modelling of the Human Process Operator Computer-based design aids, like requirement specification, verification, function testing, and documentation systems, are quite natural candidates to facilitate the integration of design and operation. The training of operators is mainly assosiated with means and methods to give the human operator an internal world model, which is relevant to his job. One other problem is to measure the knowledge and skill of the operator to get some estimation of the state of the internal world model. Considering the different types of internal models discussed earlier, it seems clear that a large variety of methods and aids are needed for th e training and for the measurement of training results.
presenting the process and the task top-down fashion.
61 ~n
a
From th e training point of View if would be interesti~g to inves tigate which abilities makes up a good operator for th e control room work. It could be possible that good opera ~rs have accuired general and specific rules of thumb to p'Crform the different ac tiviti es . Such rules could be diagnosing strategies, set of important parameters, goals a nd restrictions which are imperativ e e tc.
CONCLUSIONS
The models for functional meaning and abstract function could to a large extent be built using classroom training. The building of the functional structure models should be supported with observations and operations e ither in the plant or using a simulator. The models of physical function could not be acquired without operating on the plant or on a suitable simulator. The model of physical forms could again be acquired using classroom exercises, perhaps using also a mock-up of the control room.
The work in the human factors area , which has been done mainly in the aerospace fie l d, pro vides a very good foundation for th e human factors research in process supervision . Owing to differences be tween the two fields more research has, however, to be done to reach the same level of understanding and design practice. Thanks to the massive research effort, wh i ch has been spent , it seems, however, that an understanding is emerging. Th e challenge is then to draw the design implications of that und e rstanding and work toward some standardized practice for th e design of future control rooms .
The data processing activities on the different l evel s could be trained in simulated situations. On the higher level, a talkthrough in the control room could provide a very cost-effective training. For the trainin g of the dataprocessing on the intermediate level, a high fideli t y simulator is perhaps the best train ing tool. The data processing on the lower l evel again could be trained with a part task trainer.
It is also interesting to note th e possibilities which are emerging with the introduction of new hardware and software. It is, how e ve r, a danger that system vendors continue to produce systems on an ad -h oc basis in response to market pressure. This makes it important to spread good practices in man machine interface design to make both the vendors and the vendees aware of the require ments on a con trol room design.
Considering the situation in the control room, it is evident that the emphasis in the training will be on the diagnosis of the very rare abnormal situations. Taking into account that by definition no available internal world model could provide an immediate solution to the diagnosis task, it is clear that the operator should execu te the diagnose on the higher data process ing level. He will, on the other hand, have the tend ency to move the data processing do,m with increased experience. This means, e.g. that to ensure that the operator at an incid en t executes the diagnosing task on the higher level, we will have to restore the suspicion and confusion of th e operator in order to prevent him from falling in the trap of associating the r eadings with some previously experienced incident. Gained experience makes it possible for th e operator to integrate the action performed in the control room during different maneovers into a larger entity. This abstraction ability makes it possible for the operator to intuitively comprehend a set of actions as tasks with defined goals, restrictions, initial state and terminal state. Training of this ability should be supported by
REFERENCES Bainbridge, L., (1979). Verbal r epo rts as evidence of the process operator's knowledge. Int. J. Man-i'1achin e Studies , ~, 411-363. Bainbridge, L., (1981). clathematical equations or process routines. Human detection and diagnosis of system failures Eds. J. Rasmussen, W.B. Rouse, ~ew York 1981, Plenum Press, 259. IEEE, (197921). The Human. The key factor in nuclear safety. Myrtle Beach. Conference Record for 19 79 IEEE standard workshop on human factors and nuclear safety. IEEE, (1979b). Special issue on Three Mil e Island and the future of nuclear power. IEEE Spectrum 16, No 11. NKA!KRU-project on-operator training, control room design and human reliability - Summary report, ~KA!KRU-(81)11, Joint Scandinavian Research Project, The ~ordic Council of Ministers, Ju ne 1981. - Technical Summary Report on Operator Training, NKA!KRU-(81) 12, Joint Scandinavian Research Project, The Nordic Council of Ministers, Jun e 1981.
62
L. Norros, J. Ranta and B. Wahlstrbm Rasmussen, J., Rouse, W. B., (ed) . Human detection and diagnosis of system failures . New York 198 1. Plenum Press . Rouse, H.B. (ed), (1979) . Special issue on app li ca tions of control theory in human factors . Human Factors 19(1977)4. Rouse, W. B., (1980). Systems Engineering Models of Human Machine Interaction. ~orth Holland, New York. Seminara, J.L., ( 1976). Human factors review of nuclear power plant control room design. EPRI NP- 309 S 4, Project 501, Palo Alto. Timonen, J,. (1980). On the control theoretic mode llin g of human process operator . Technical Research Centre of Finland, El ectrica l Engineering Laboratory. Research Report 55, Espoo. Timonen, J . , WahlstrBm, B. , Tuominen, L. (1980). On th e modelling of the tasks of op era tor in a utoma t ed process plant. Proc. IFAC/IFIP Symposium Assopo ' 80, Trondheim 1980, North-Holland, Amsterdam.
- Technical Summary Report on Control Room Des i gn and Human Reliability, NKA/KRU- (81)13 , Joint Scandinavian Research Project, The Nord i c Council of Ministers, Jun e 19 8 1. - Publication List, NKA/KRU-(81) 14, J o int Scandinavian Research Project, The Nordic Council of Ministers, June 1981. - Guidelines for Operator Trainin g , NKA/ KRD - (81)15, Joint Scandinavian Research Project, The Nordic Council of Ministers, June 1981. - Gu idel in es for Man - Machine Interfac e Design, NKA/KRU- (8 1) 16 , Joint Scandinavian Research Project, The Nordic Counci l of Ministers, June 1981. Ranta , J., Tuominen, L ., Uusitalo , M., Rantanen, J. (1982) . Spec i fying man-computer dialogues - the use of guidelines for design of interactive systems . Preprints of I ~IEKO 8th Trien nal World Congress, Berlin-West . Rasmussen, J., ( 1980) . Some t rends in manmachine int erface desi gn for industrial process plants. Proc. IFAC/IFIP Svmp. Assopo ' 80. Trondh e im 1980, ~orth Holland , Amsterd am.
r- - - - - - - - - - - - - - - - ,
externa l
I ~ .,.!' . , .-
t (· !'(! ~ ut'(' n'\!'o#'C
I
~---'-: ~~"< I
l~~~ nr
I
" '!lLl: l ..... n
-._------,---
I
L ---- Tr ----j--
,
:':\~~t--
N
c
..J"
I I
-
~
~L
I
L
Fig. 1.
~,' r.""" '. '1 ' ·:""' I I·~ ._ ___ __
_____
'I
lI'<.."i·".,e'T'{'nt
I
alJt..h')nt.i~~
I
!'oO(" l e t)'
I
_ _ _ _______ _
:
~
...1
o
0010. proc . u ,nq r , ~o!
_ _____
Ox1J"F'flt.s
A general model of the con tr ol room situation
C=J QC
_
- - --:
It
$10.1'" 0 1 w,.,O .... , td~ ",,,,11 ," .. from 0010.
~
P'OC ' U'f'g
t-.!"'!""""'i
~I"~ . ~u t IQ
'Itt'OlrP, d
f"0( U~ ~
Fig. 2. Schematic mode l of the sequences of opera t or ' s mental activities ()lKA/KRU 1981)