Cognitive Behavioral Model of an Operation Crew in the Main Control Room of a Nuclear Power Plant Based on a State-Oriented Procedure

Abstract

The team’s cognitive behavior plays a crucial role in dealing with accidents at nuclear power plants. Herein, the main behaviors of reactor operators and coordinators in performing accident management were analyzed in executing a state-oriented procedure. According to these cognitive behavioral characteristics, we established cognitive behavioral models of accident management procedures. After that, a cognitive behavioral model was established for the team in the main control room of the nuclear power plant based on the two models, which is expected to provide support to the optimization of a corresponding Human Reliability Analysis model.

1. Introduction

In the field of nuclear power plant safety, data have been published that indicate that 50–70% of system failures in a nuclear power plant are induced by human error [1,2]. With the continuous increase in the reliability of the equipment (hardware and software), human errors are becoming one of the major accident sources in nuclear power plant systems.

Probabilistic Risk Analysis (PRA) is becoming a more and more important tool in high-risk domains such as nuclear power. As an essential component of PRA, the methodology of Human Reliability Analysis (HRA), which is characterized by limitations and incompleteness, fails to reflect the change in the environment that an operator is subject to [3,4,5,6]. This, in turn, strongly prevents the development and application of PRA. Hence, improving the HRA methodology through research and development so that the reliability of human factors can be better simulated and quantified in PRA has become a common concern and an urgent issue in PRA and even in the risk management field.

Nanoscience breakthroughs in almost every field of science and nanotechnologies make life easier. Nanoscience is one of the most promising technologies and mainly studies structures and molecules on the scale of nanometers [7]. Currently, nanotechnology has made a significant breakthrough involving structures, devices, and systems due to the novel properties and functions of nanomaterials [8]. Generally, nanoscience theory can effectively guide the technology’s application by observing, manipulating, assembling, and manufacturing matter at the nanometer scale, including in a wide range of fields from chemistry, physics, and biology to medicine, engineering, and electronics. HRA originated in the 1950s, and two generations of HRA methodology have been developed [9,10,11,12,13]. The first generation was developed from the 1960s to the early 1980s, mainly including investigations on human error theory and classification, data collection and arrangement for human reliability studies, as well as the development of prediction methods for human error probability statistics analysis based on expert judgments. At this stage, the basis of the HRA model was human behavioral theory, i.e., looking into human output behavior without investigating inner cognitive behavioral processes. In these kinds of models, humans were dealt with similarly to how machines were handled [14,15,16,17].

Since the Three Mile Island accident, it has been realized that the interaction between humans and systems in the operation of nuclear power plants (especially in accident events) is vital to the alleviation or deterioration of the accident’s risk of occurrence. Therefore, the new stage of investigation of HRA is characterized by a research focus on the combination of cognitive psychology and human cognitive reliability models, as well as an emphasis on the significance of the effect of situational environments on human cognitive reliability [18,19,20,21,22]. The second generation of HRA models began to explore the intrinsic processes of human behaviors. However, this consideration focuses on the overall cognitive process instead of cognitive behavioral processes in detail. Moreover, the models are rough and rely excessively on expert judgments, so that the results of the analyses cannot provide practical suggestions on the improvement of power plant safety [23,24,25,26,27,28,29,30,31,32,33,34].

The former two generations of HRA methodology are limited in terms of individual behavior reliability analysis. The team is rarely considered or merely regarded as a performance-shaping factor, which cannot represent the structural features of a team. In addition, after the Three Mile Island accident, state-oriented procedures (SOPs) based on the physical state of the power plant became more prevalent in nuclear power plants. Although SOPs overcome deficits such as dealing with only a single accident and the impossibility of correcting a human error when using EOP, new issues have arisen in practice, such as weaker concentrations on a single expected accident, too many pages for one procedure, and too many directive points that affect the execution efficiency. In the present work, a team cognitive behavioral model based on a SOP is established that provides support for further optimization of HRA based on an analysis of the behavior of staff who adopt SOPs in the main control room of nuclear power plants.

2. Experiment

2.1. Introduction to the SOP

Domestically, the Lingdong nuclear power plant was the first one to adopt a SOP. The control flow chart of the SOP is shown in Figure 1. When an accident occurs in a power plant system, an operator in a digital main control room acts upon the alarm and follows the SOP to deal with the accident. After entering the SOP, the operator first confirms automatic actions according to the Document of Orientation and Stabilization (DOS). Then, they monitor key parameters of the power plant to determine the unit’s physical state to determine the proper ECPi (Primary State-Oriented Operation), consisting of ECP1–ECP4, to alleviate the accident’s influence. After that, through the initial guidance of the ECP, the operator enters the run sequence, and the proper operation in the run sequence returns the unit to a stable state.

2.2. Human Cognitive Behavioral Process

The operator in the main control room monitors and controls the system through a human–machine interface. When the system state is in an exception, the exception’s situation is conveyed through sensors and displayed on monitors. The operator may access power plant parameter information via a display system of the human–machine interface and evaluate the system’s current state. Then, based on the evaluation, the exception’s situation can be determined, and the operational procedure and path can be accordingly selected. Finally, a control response task is executed.

Hence, the essence of the cognitive behavioral process of the operator after an accident is characterized by four stages: monitoring, state evaluation, response plan, and operation [35] (Figure 2).

The tasks of the four stages are defined as follows:

Monitoring: the behavior of acquiring information from the environment, including examining whether the system is working correctly and identifying changes. For example, observation of system parameters, graphs and alarms on computer screens, and control panels and acquisition of oral reports from operators of other zones in the power plant.

State evaluation (also known as scenario evaluation): this represents the operator’s behavior evaluating the information acquired by monitoring and judging whether the system’s current state is classified as acceptable or exceptional. State evaluation contains two relevant concepts: the state and mental models. The state model is the operator’s understanding of a specific state and is updated upon receiving new information. The mental model is established through education, system training, and long-term operation experience, remains in long-term memory based on knowledge, and builds up operators’ internal representations of the physics, functional features, and existing operations of the power plant system.

Response plan: the corresponding strategy/scheme about the evaluated state drawn up by the operator. Generally, the response plan contains two sub-stages: the operator’s confirmation of the target state that the system should achieve according to one’s own mental/state model and the selection of the strategy that will achieve the target state. In this respect, the operator evaluates multiple strategy candidates for accident management and chooses the most suitable strategy for the current state model.

Operation: execution of the strategy/action in the response plan. For instance, choosing and controlling devices or coordinating with operators of other zones in the power plant who are in charge of controlling devices.

In this paper, staff behavior in the central control room is modeled based on the staff’s cognitive behavioral process stages.

3. Results and Conclusions

The key members in charge of accident management after an accident occurs are the reactor operator (RO1), the secondary circuit operator (RO2), and the coordinator (US). The two operators execute specific diagnoses and operations for the accident, while the US is the field director of accident management. Therefore, the team in the present work contains these three main members.

3.1. Operator Behavior

In the main control room of nuclear power plants based on a SOP, RO1 is responsible for the diagnosis, decisions, and operation of the relevant systems of primary coolant circuits for the specific accident, while RO2 assists RO1 with control operations. In this section, RO1’s behavior is analyzed.

From Section 2.1, when the operator executes SOP procedures for accident management, prior to the execution of a sequence, the diagnosis for downgrading the state level in the DOS is a must, and a proper ECPi is selected to achieve this operation. At the initial orientation stage of ECPi, the operator decides on the priority classification for functional objectives through an observation process and selects the operation sequence (strategy) for achieving the most preferred functional objectives. After selecting a strategy, the operator needs to execute specific operations in sequence. Upon finishing the operation, the diagnosis of the next round is executed.

Thus, the accident management process of the operator includes three main phases: diagnosis, decision, and operation (Figure 3). Each of the phases is analyzed in Figure 3.

3.1.1. Diagnosis Phase

In the diagnosis phase, the operator needs to continuously acquire information on the main parameters of the power plant to achieve the downgrading of the level of the current functional state. Therefore, the diagnosis phase corresponds to the combination of the two cognitive behavioral processes “monitoring + state evaluation”, where “monitoring” is the external perspective and “state evaluation” is the internal perspective.

After an accident, RO1 enters the DOS diagnosis program based on the DOS alarm signal or other criteria, monitors the states of the main devices of the unit in the DOS, determines the downgraded level of the state corresponding to the main parameters related to the six state functions, and follows the guidance of the corresponding accident management program ECPi based on the desirable downgraded level of state (or directly decides the DOS).

By analyzing the cognitive process of the operator, it can be seen that when the state of the system changes, the operator needs to observe/monitor the state of/change some system parameters to determine the current state level of the system. Let us assume that at time t, N parameters are provided by the system to indicate the state/change of the system. The operator observes/monitors these parameters according to the order established by the SOP and updates his/her respective state model based on the meaning of the parameters observed. For instance, when the operator observes parameter 1 at time t1, state model 1 is obtained by explaining its meaning using their mental model, which drives the operator to transition to parameter 2 at time t2. Similarly, state model 2 is obtained and drives the operator to parameter 3 at time t3; hence, state model 3 is obtained, and so on, and at time ti, parameter i is observed and state model i is obtained. As parameter observation progresses and the state model updates, the system state cognition of the operator gradually approaches the actual state of the system (or that which is regarded as actual by the operator). Finally, at time tn, the final decision on the system state is reached, based on which the operator formulates their “response plan” (Figure 4).

Hence, based upon the analysis mentioned above and the description of the cognitive process of the operator, monitoring and state evaluation are not regarded as being independent of each other. However, at the end of the interactive sequential process is the system state confirmed by the operator. Furthermore, the “response plan” is formed according to the final “state evaluation”, i.e., the “state evaluation” is followed by the “response plan”.

By monitoring parameters and updating the state model, the system state cognition of the operator gradually approaches what the operator regards as the actual system state. At time tn, the final judgment on the system state is made. What the operator regards as the actual system state may be the real system state or a false one—not real, but a misunderstanding of the operator. Therefore, an operator fault in “state evaluation” is possible. This fault has two main causes: a monitoring failure and the operator’s mental model. In monitoring, the reliability of information acquisition directly influences the state model. The mental model affects how newly acquired information influences the state model.

3.1.2. Decision Phase

In the decision phase, the operator continuously acquires information on the parameters of the power plant. The priority of functional objectives is decided, the corresponding strategy is selected, and a proper response plan is established for a specific execution. Thus, the decision phase corresponds to a combination of the two cognitive behavioral processes “monitoring + response plan”. Similarly, “monitoring” is the external perspective, and “response plan” is the internal perspective.

Similar to the diagnosis phase, the operator needs to continuously acquire information to support him/herself in establishing a proper response plan in the decision phase. The difference is that the diagnosis phase mainly investigates “what event has already been induced”, i.e., the operator evaluates the current state level of the power plant according to all information on the parameters, while the decision phase investigates “what is going to be induced by the plan”.

As mentioned previously, ECP1/2/3/4 denote different downgrading levels of the state of a unit. At different downgrading levels, the priorities of functional objectives are different. Thus, when in ECPi, the operator needs to determine the priority sequence of the current functional objectives in the initial orientation program, based on which the most preferred strategy corresponding to the current state level is selected, i.e., the sequence to be executed first is selected. The optimal strategy leads to the best effect for the subsequent operation.

The cognitive process of the decision phase is similar to that of the diagnosis phase, so a detailed analysis is not presented.

3.1.3. Operation Phase

In the operation phase, the operator executes specific operational actions according to the established strategy and procedural requirements, which is the external perspective. Monitoring, state evaluation, and establishment of the response plan are done in preparation for the final response’s execution. The first three stages have no direct consequence, and only the response’s execution results in direct consequences. However, a fault in the first three stages may cause a fault in the following stage.

After decision-making, the operator enters a sequence in ECPi and implements actions according to the procedure’s instructions. Because an operation can induce a fluctuation in key parameters of the core, the relevant parameter information needs to be evaluated prior to the operation so that system fluctuations are limited when the operation achieves the state objective. For example, when high-pressure injection changes to charging, the water level of the pressurizer and the degree of subcooling of the core must be kept within a certain safety range to ensure that the pressurizer will not be emptied and a sufficiently safe degree of subcooling takes place in the core after an operation.

With a digital control system, the operator’s actions include not only the first-level tasks (opening/shutting valves, starting/stopping pumps, etc.), but also the second-level tasks (configuration of screen frames, navigation, etc.). The operator needs to complete the first-level tasks with the execution of the second-level tasks.

After executing the operations, the operator enters the next cognitive cycle round. During reorientation, the question of whether further downgrading applies to the six state functions is determined by the RANGE of ECPi (diagnosis). Then, new functional objectives for the current state are generated according to the state level of the unit after the first-round operation, new priorities are determined (decision), and the next operation is executed.

Through the above analyses, it is evident that operators’ specific and intrinsic cognitive behavioral processes for accident management are correlated to each other. This relationship forms the basis on which the behavior of operators is modeled using a cognitive process (Figure 5).

3.2. Coordinator Behavior

The coordinator is no longer a procedure executor. A power plant needs a coordinator to actively make cognitive judgments, whereas coordinator procedures (ECT) play a subsidiary role. The behavior is mainly based on the procedure for an operator, i.e., “if x then y”. In regular-type behaviors, “if x” is usually presumed by the operator, and then “y” is implemented. Then, the operator will not carefully justify the condition’s existence, which may lead to a procedure-based fault. Hence, the coordinator has to display independent thinking, as he/she does not operate based on the procedure.

The structure of the coordinator’s procedure is consistent with RO1’s procedure, i.e., the coordinator must be in the same sequence as RO1 at all times and never enter the next procedure sequence before the operator does so that a possible fault induced by RO1 can be corrected.

From Figure 6, it is clear that the behavioral process of the coordinator is also divided into three phases: diagnosis, decision, and operation monitoring. The difference is that the coordinator has no specific operations compared with the operator but only monitors the results of the operator’s actions. Therefore, the whole cognitive process of the coordinator is continuous monitoring combined with intrinsic cognition, and thus the behavior of the coordinator is modeled by the cognitive process shown in Figure 6.

3.3. Team Cognitive Behavioral Model

Due to the information sharing that has been realized in the main control room since its digitalization, the operator can implement accident management independently from the other main control staff after an accident. The coordinator acts as an independent barrier monitoring and warding the accident management process conducted by the operator. The advantage of the division of labor of the team in Lingdong’s digital main control room is that when new information appears, the division of labor enables simultaneous analysis of existing issues and monitoring of the system by the US so that significant information is not overlooked and thus the new situation can be identified in time.

From on-location interviews, the analysis of procedures, and the monitoring and warding of the RO by the US, the following three points can be made:

(1)

Upon finishing diagnosis in the DOS, the RO needs to report to the US. For instance, when the operator completes diagnosis and enters an ECPi, the coordinator matches the result of the execution of the procedure to it. If the coordinator enters a different ECPi, either of the two could be subject to a diagnosis fault. Therefore, diagnosis for the accident needs to be conducted again to ensure a more reliable team response.

(2)

Upon reaching an ECPi decision, the RO must report to the US. The monitoring and warding process is the same as the above-mentioned one.

(3)

After the RO’s operations finish, the US monitors the results of these operations. The coordinator examines whether the required operations have been completed. Such an examination is usually carried out by checking whether the relevant controls are in the state of post-operation in the operator’s workstation.

Thereby, the cognitive behavioral processes of both the RO and the US can be combined to establish the team cognitive behavioral model shown in Figure 7.

4. Conclusions

By analyzing team members’ behaviors in the main control room, the present work modeled the complex team accident management process using basic cognitive units to lay the groundwork for a new HRA methodology based on this cognitive process.

In the present work, staff behaviors in the main control room based on a SOP are modeled. However, in order to form a new HRA methodology, numerous studies need to be conducted in the following respects: acquisition of relevant fundamental data; the mechanism of interactions between cognitive stages; the relevance of RO1 to US; and the factors that influence the situational environment.

Based upon the HRA methodology of this model, weak spots in the cognition of members of the team or the team itself can be determined, and an optimized design of the power plant and operator training can be provided, with the end results being better technical support.