Used in accident investigation to identify the path of events and contributing factors leading to an accident Systematically explore all possible scenarios leading to the accident based on a formal system model According to information provided by Events and Causal Factors Analysis.
A marking tree can be used to identify the set of reachable states provided that some information is given about the initial status or ‘marking’ of the system. This technique helps to produce what can be thought of as a form of state transition diagram. Several tools are currently available to support this analysis. However, this style of analysis can impose considerable overheads when considering complex systems such as those involved in our case study.
Next Generation control rooms and even near term advanced control rooms will incorporate changes that will push the paradigm of current reactor plant operations. PBMR is shown because it is probabaly the closest nearterm example of a truly advanced control room. The V HTR illustrates one concept that ties hydroden production to advanced reactors. It is not the only such ecample. These changes include: - the migration / upgrade from hybrid control systems to purely digital controls. - The incorporation of hydrogen production with or instead of electricity productions. - Increased levels of automation to permit the controlling of multiple reactors by one crew. This paper and presentation are the result of a workshop held in April of this year that looked at human performance issues for advanced control rooms.
It was necessary for the purposes of our approach to have an overall perspective of how different factors and conditions, such as pressure, temperature and different system states evolved throughout time towards leading to this accident. Events and Causal Factors Analysis (ECFA), does exactly the above; in a chronologically sequential representation of events, ECFA can provide the analyst an overall picture of how different factors relate to one another and how they contributed to an accident. In brief events are represented as rectangles and conditions as ovals. Events are connected with arrows, while conditions with dashed arrows. If an event or condition is an assumption, then it is represented with a dashed rectangle or oval accordingly. Finally, based on chronological sequence, events are connected moving from left to right, keeping the main events on a primary horizontal line, and contributing or secondary events and conditions, above or below. Due to space constraints, we cannot present the ECFA diagram, however it can be found at http://liihs.irit.fr/basnyat/miningecfa.htm.
A seal on the north grinder overheated. The kiln control operator and supervisor decided to switch waste fuel delivery systems from north to south. The worker switched delivery systems; however fuel did not flow to the plant kilns as planned. The personnel believed the problem was due to air being trapped in the south fuel pipes. They, therefore, bled the valves of the south system while the motors were running. In the meantime, due to the low pressure being sensed in the fuel lines, the automatic step increase program was increasing the speed of the motors on the south pumps in an attempt to increase pressure in the fuel line. These various factors combined to create a ‘fuel hammer effect’ in the pipe feeding the south pump. The hammer effect is caused by rebound waves created in a pipe full of liquid when the valve is closed too quickly. The waves of pressure converged on the south grinder.
Testing Interactive Software: A Challenge for Usability and Reliability Special Interest Group – CHI 2006 – Montréal – 22nd April 2006 Philippe Palanque LIIHS-IRIT, University Toulouse 3, 31062 Toulouse, France [email_address] Regina Bernhaupt ICT&S-Center, Universität Salzburg 5020 Salzburg, Austria Regina.Bernhaupt@sbg.ac.at Ronald Boring Idaho National Laboratory Idaho Falls 83415, Idaho, USA [email_address] Chris Johnson Dept. of Computing Science, University of Glasgow, Glasgow, G12 8QQ, Scotland [email_address] Sandra Basnyat LIIHS-IRIT, University Toulouse 3, 31062 Toulouse, France [email_address]
Interactive application idle waiting for input from the users
Code is sliced
Execution influenced by internal and external states
Nothing new but …
Classical Behavior Read Input Exit ? End Read Input Process Input Process Input Exit ?
Event-based Functioning Application Window Manager States At startup Get next event Dispatch event Register Event Handlers Call Window Manager Finished Event Handler 1 Event Handler 2 Event Handler n EH Registration Event Queue At runtime Ack received Wait for next event
Increasingly, human reliability needs to go beyond being a
diagnostic tool to become a prescriptive tool
NRC and nuclear industry are looking at new designs for control rooms and want plants designed with human reliability in mind, not simply verified after the design is completed
NASA has issued strict Human-Rating Requirements (NPR 8705.2) that all space systems designed to come in contact with humans must demonstrate that they impose minimal risk, they are safe for humans, and they maximize human reliability in the operation of that system
How do we make reliable human systems?
} “classic” human factors } human reliability analysis
Address the issue of system redesign after the occurrence of an incident or accident
Events and Causal Factors Analysis
Marking Graphs extracted from a system model
Ensure current system model accurately models the sequence of events that led to the accident
Reveal further scenarios that could eventually lead to similar adverse outcomes
The Approach (2/2) Incident & accident investigation part Part of the whole process System design part Accident Report Safety - Case Analysis Model The System ECF Analysis Re - model The System Formal ICO System Model Including Erroneous Events Marking Graph Analysis Re - Design System Model to make Accident Torlerant Extraction of Relevant Scenarios
Advanced Control Room Design Transitioning to new domains of Human System Interaction Problem: Next generation nuclear power plants coupled with advanced instrumentation and controls (I&C), increased levels of automation and onboard intelligence all coupled with large-scale hydrogen production present unique operational challenges. PBMR Conceptual design Typical Design Hybrid Controls
Example 10 1 1 1 10 .1 1 1 1 0.1 UCC = 0.1 x 2 = 0.2
Listing of issues and solutions for new interaction techniques testing
Automated autonomous Real-Time Systems (VAL, TCAS) B (Atelier B), Z, … No Interaction Technique WIMP - hierarchical Direct Manipulation All Types of Applications Web Applications Business Applications UML, E/R, … Mobile phones Roadmap on Testing Interactive Systems Target Applications, Domains - context Software Engineering Issues Notations and Tools User Interface Interaction Technique No more usability problems ? No more bugs ? Augmented Reality Command and Control Systems Tangible User Interface 2006 2020 TODAY 2009 Multimodal Interaction
Compliance with applicable standards and best practices documents
E.g., NASA NPR 8705.5, Probabilistic Risk Assessment (PRA) Procedures for NASA Programs and Projects or NRC NUREG-1792, Good Practices for Implementing Human Reliability Analysis
Use of established modeling techniques
It is better to use an existing, vetted method than to make use of novel techniques and methods that have not been established
Validation of models to available operational data
To ensure a realistic modeling representation, models must be baselined to data obtained from empirical testing or actual operational data
Such validation increases the veracity of model extrapolations to novel domains
Completeness of modeling scenarios at the correct level of granularity
A thorough task analysis, a review of relevant past operating experience, and a review by subject matter experts help to ensure the completeness of the model
The appropriate level of task decomposition or granularity should be determined according to the modeling method’s requirement, the fidelity required to model success and failure outcomes, and specific requirements of the system that is being designed
Realistic model end states
E nd states should reflect reasonable and realistic outcomes across the range of operating scenarios