Questioning, exploring, narrating and playing in the control room to maintain system safety

Systems whose design is primarily aimed at ensuring efficient, effective and safe working, such as control rooms, have traditionally been evaluated in terms of criteria that correspond directly to those values: functional correctness, time to complete tasks, etc. This paper reports on a study of control room working that identified other factors that contributed directly to overall system safety. These factors included the ability of staff to manage uncertainty, to learn in an exploratory way, to reflect on their actions, and to engage in problem-solving that has many of the hallmarks of playing puzzles which, in turn, supports exploratory learning. These factors, while currently difficult to measure or explicitly design for, must be recognized and valued in design

Verification-guided modelling of salience and cognitive load

Well-designed interfaces use procedural and sensory cues to increase the cognitive salience of appropriate actions. However, empirical studies suggest that cognitive load can influence the strength of those cues. We formalise the relationship between salience and cognitive load revealed by empirical data. We add these rules to our abstract cognitive architecture, based on higher-order logic and developed for the formal verification of usability properties. The interface of a fire engine dispatch task from the empirical studies is then formally modelled and verified. The outcomes of this verification and their comparison with the empirical data provide a way of assessing our salience and load rules. They also guide further iterative refinements of these rules. Furthermore, the juxtaposition of the outcomes of formal analysis and empirical studies suggests new experimental hypotheses, thus providing input to researchers in cognitive science

Resilience markers for safer systems and organisations

If computer systems are to be designed to foster resilient performance it is important to be able to identify contributors to resilience. The emerging practice of Resilience Engineering has identified that people are still a primary source of resilience, and that the design of distributed systems should provide ways of helping people and organisations to cope with complexity. Although resilience has been identified as a desired property, researchers and practitioners do not have a clear understanding of what manifestations of resilience look like. This paper discusses some examples of strategies that people can adopt that improve the resilience of a system. Critically, analysis reveals that the generation of these strategies is only possible if the system facilitates them. As an example, this paper discusses practices, such as reflection, that are known to encourage resilient behavior in people. Reflection allows systems to better prepare for oncoming demands. We show that contributors to the practice of reflection manifest themselves at different levels of abstraction: from individual strategies to practices in, for example, control room environments. The analysis of interaction at these levels enables resilient properties of a system to be ‘seen’, so that systems can be designed to explicitly support them. We then present an analysis of resilience at an organisational level within the nuclear domain. This highlights some of the challenges facing the Resilience Engineering approach and the need for using a collective language to articulate knowledge of resilient practices across domains

Exploring the importance of reflection in the control room

While currently difficult to measure or explicitly design for, evidence suggests that providing people with opportunities to reflect on experience must be recognized and valued during safety-critical work. We provide an insight into reflection as a mechanism that can help to maintain both individual and team goals. In the control room, reflection can be task-based, critical for the 'smooth' day-to-day operational performance of a socio-technical system, or can foster learning and organisational change by enabling new understandings gained from experience. In this position paper we argue that technology should be designed to support the reflective capacity of people. There are many interaction designs and artefacts that aim to support problem-solving, but very few that support self-reflection and group reflection. Traditional paradigms for safety-critical systems have focussed on ensuring the functional correctness of designs, minimising the time to complete tasks, etc. Work in the area of user experience design may be of increasing relevance when generating artefacts that aim to encourage reflection

The roles of conceptual device models and user goals in avoiding device initialization errors

While mistakes, and approaches to design and training that reduce them, have been studied extensively, relatively little work in HCI studies 'slip' errors, which occur when one intends to do a certain action during a skilled task but unintentionally does another. In this article we examine approaches to training that might reduce the occurrence of a slip error referred to as a 'device initialization error'. This error occurs when skilled users of a device forget to perform some initialization action, such as positioning the cursor in a text entry box or setting the device into the correct mode, before entering data or performing some other significant activity. We report on an experiment studying the effects of two training interventions on this error, which aim to manipulate the salience of the error-prone action without making any physical changes to the device. In the first intervention participants were given a particular conceptual model of the device's operation, to evaluate whether having an improved understanding of the effect of each action would lead to fewer errors. In the second, participants were given a new device operation goal requiring them to 'test' the device, to evaluate whether attending to the outcome of initialization actions would lead to fewer errors. Only participants who were asked to 'test' the device and also given enhanced instructions to enter dummy data after completing initialization actions showed a statistically significant improvement in performance. Post-test interviews and evidence from existing literature suggest that when participants forgot the initialization step it was because they were attending to the subsequent data entry steps. This study highlights the central roles that user goals and attention play in the occurrence (or avoidance) of slip errors. (C) 2010 Elsevier B.V. All rights reserved

On the use of projectors for Hamiltonian systems and their relationship with Dirac brackets

The role of projectors associated with Poisson brackets of constrained Hamiltonian systems is analyzed. Projectors act in two instances in a bracket: in the explicit dependence on the variables and in the computation of the functional derivatives. The role of these projectors is investigated by using Dirac's theory of constrained Hamiltonian systems. Results are illustrated by three examples taken from plasma physics: magnetohydrodynamics, the Vlasov-Maxwell system, and the linear two-species Vlasov system with quasineutrality

Implementation of a local principal curves algorithm for neutrino interaction reconstruction in a liquid argon volume

A local principal curve algorithm has been implemented in three dimensions for automated track and shower reconstruction of neutrino interactions in a liquid argon time projection chamber. We present details of the algorithm and characterise its performance on simulated data sets.Comment: 14 pages, 17 figures; typing correction to Eq 5, the definition of the local covariance matri

Specifying the Caltech asynchronous microprocessor

The action systems framework for modelling parallel programs is used to formally specify a microprocessor. First the microprocessor is specified as a sequential program. The sequential specification is then decomposed and refined into a concurrent program using correctness-preserving program transformations. Previously this microprocessor has been specified at Caltech, where an asynchronous circuit for the microprocessor was derived from the specification. We propose a specification strategy that is based on the idea of spatial decomposition of the program variable space