Human Operating Risk Assessment for Outdoor Terminal Box of Electric Power

The outdoor terminal box is the basic node of the power Internet of Things as an intermediate link between outdoor electrical equipment and indoor equipment, like measurement and control, protection, communication and other equipment. Terminal boxes and terminals need to be regularly checked on site, loop tests, transformations, and equipment replacement. Operator errors have become one of the main factors in outdoor terminal box accidents. In terms of human risk assessment of outdoor terminal boxes, few papers are involved. In order to correctly evaluate the influence of human factors on the failure of outdoor terminal boxes, the paper first analyzes the human behavior factors of outdoor terminal box operators, the common performance conditions of the CREAM (Cognitive Reliability and Error Analysis Method) model is used to analyze the human behavior mechanism and behavior reliability factors during the operation of the terminal box. Then, the SLIM (Success Likelihood Index Method) model is used to calculate the probability of human error. The proportional failure model is used to calculate the failure rate of the outdoor terminal box itself. Finally, taking a circuit breaker terminal box as an example for simulation, the probability of human error is 1.56%, the equipment failure rate is 0.84%, the risk value of the system is 10.7%, and the risk level of the system is 3. From the probabilistic perspective, it shows that human factors have a greater influence on the causes of accidents.


Introduction
In the process of building the power Internet of Things, the outdoor terminal box is the connection basis of the power Internet of Things. Because it can connect a variety of electrical components, such as the construction circuit, mark the branch circuit, and provide convenience for wiring and line inspection. There are many types of outdoor terminal boxes, such as transformer terminal boxes, circuit breaker terminal boxes, terminal boxes, and so on. In order to ensure the safe operation of the power system, outdoor terminal boxes and terminals must be regularly inspected, tested, modified and replaced on site, that is, the inspection equipment is connected to the secondary circuit to test and verify the primary and secondary circuits, such as circuit breakers, transformers and mutual inductor [1]. The circuit operation is sometimes live work, which requires manual handling of the current metal sliding sheet of the current terminal. The on-site operation is complicated and the steps are cumbersome. There have been many safety accidents, such as false touches, misconnection of circuit breakers, short circuit of voltage transformers, open circuits of current transformers, and shutdown of substations, which even caused injuries to operators. For example, on September 12, 2013, a circuit breaker mis-closing incident occurred in Nuozhadu Power Plant. The cause of the accident was that the staff misconnected the external wires of the two-circuit terminals. On May 17, 2016, an accidental bus trip occurred in Qujing Substation. The reason is that the current is too large due to wrong wiring. Therefore, studying the reliability of outdoor terminal box operators is of great significance for reducing the risk of the power system.
There are many HRA methods developed so far, which can be roughly divided into three stages: The first stage: The more typical one is THERP [2]. Its basic idea is to decompose human behavior into sub-tasks, and give the human error probability values to the subtasks to obtain the overall error probability of the system. But it is very complicated in the actual application process.
The second stage is more typical of Straeter's CAHR method [3], a method based on accident sequence analysis. But this method does not take into account the influence of organizational management factors.
The HRA method in the third stage attempts to establish a dynamic HRA method for simulation experiments [4], but it cannot handle all behavior types (skills, rules, knowledge) properly and fails to demonstrate how organizational factors affect human reliability.
At present, most research on the reliability of outdoor terminal box of power system only focuses on the environmental factors, mainly analyzing the influence of damp [5], box rust [6] and foreign matter [7] on the reliability of the terminal box, and designing a device containing monitoring and dehumidification functions [8]. Some scholars have also analyzed the reliability of terminals. Literature [6] studied the relationship between the electrical contact and porosity of the gold coating. In the literature [9], the reliability of the terminal is analyzed from the perspective of the insertion and removal force of the terminal, and it is found that the contact area is the direct cause of the reliability. Literature [10] analyzed the influence of pressure, temperature, lubricant and other factors on the contact performance of terminals. Literature [11] analyzed the influence of vibration stress on the reliability of the terminal and performed simulations. Literature [12] used CREAM method and Bayesian network to study reliability of regulatory human factors. Literature [13] used the S-O-R theory to study the reliability of human factors in pharmaceutical enterprises. However, few researchers have studied the human reliability of the outdoor terminal box operation and the failure risk rating of the terminal box.
In this paper, firstly, SLIM (Success Likelihood Index Method) model is used to calculate the human error probability, and the weight problem is solved by Analytic Hierarchy Process (AHP). Then the Proportional Failure model (PHM) is used to compute the equipment failure rates. Finally, the probability of human error and equipment failure rate are fused into the probability of system failure by functional decomposition method.
The rest of the paper is organized as follows: in the Sect. 2, the human error mechanism and the reliability of the outdoor terminal box during the operation are analyzed; Sect. 3 mainly introduces the calculation of human error probability and equipment failure rate; Sect. 4 simulates and simulates the reasons for the mis-operation of the outdoor terminal box; Sect. 5 summarizes the paper.

Terminal Box Reliability and Personnel Operation Reliability
The probability that the terminal box will complete the task without error is called the reliability of the terminal box. Whether the terminal box can complete the task normally will be affected by many factors, such as hardware performance, personnel operation and so on.
From the perspective of hardware performance, the reliability of the terminal box can be divided into design reliability, process reliability, inspection reliability, and storage reliability. It is a comprehensive consideration of the reliability of the terminal box before it is put into use. The process reliability is reflected in the manufacturing process of the housing, insulators, contacts, etc., reflecting the reliability of the components. The reliability of the design is mainly reflected in the placement of the internal components of the terminal box and the rationality of the wiring, which reflects the reliability in the assembly process of the terminal box. As for the inspection reliability, it is mainly reflected in the reliability of the inspection results when the terminal box has been assembled. For the storage reliability, it is mainly reflected in the storage temperature, humidity, gas environment, etc., mainly reflected in the transportation process of the reliability.
The reliability of personnel operation refers to the reliability of a series of installation, debugging, maintenance and other operations on the terminal box after the terminal box is put into use. It is related to many factors, such as the arrangement of the personnel training experience in personnel and so on. Due to the relatively large proportion of human accidents, this article does not consider the reliability of the hardware performance, only consider the reliability of the personnel operating.

Outdoor Terminal Box Operation and Maintenance Process and Error Mechanism
Reason [14] believes that human behavior is regulated by a variety of factors, such as external environmental conditions, operator experience and technical means, individual psychological and physical conditions. And human error behavior can be divided into three categories: situational, behavior, concept. Human error behavior in the situation focuses on the triggering conditions of human errors and the external environment, the environment and people interact with each other, as shown in Fig. 1. Human behavior error in behavior is divided based on human action characteristics, which are intuitive and can be observed. The conceptual human behavior error is divided from the level of human cognition level, which requires in-depth analysis.
The following conclusions can be drawn from Fig. 1: (1) Operators' information perception and behavior output are always affected by external factors or their own factors; (2) The formation process of the whole behavior is a feedback process. Operators use the external environment to perceive information to give the operation, which in turn affects the external environment; (3) The formation of the whole behavior is a repetitive process. Operators must constantly perceive the external environment and give operations until the necessary tasks are completed; (4) If there is a problem in any of the links in this repetitive process, it is likely that the final task cannot be completed or it will be completed beyond the given time. For example, the operator cannot obtain the information of the terminal box in a timely and correct manner, resulting in a decision error and finally an operation error, or an operation error due to the inexperience of the operator being unable to make the correct decision.

Quantified Common Performance Conditions
Literature [15] proposed a Cognitive Reliability and Error Analysis Method (CREAM). This model doesn't think that human performance output occurs randomly, but believes that human performance output depends on the situational environment in which the person completes the task. It affects the human cognitive control mode and its effects in different cognitive activities. The final decision is the output of human behavior. The CREAM model considers many influencing factors such as the environment, people, and organization, so it can be more in line with the actual situation. The model proposed 9 types of Common Performance Condition (CPC), as shown in Table 1, they are often used as factors that influence the output of human behavior. Each CPC in the table contains different evaluation levels, and each evaluation level will have a certain impact on human behavior. The Table 1 is represented by expectations. According to the actual scene, evaluate each CPC, and then judge the human behavior patterns (strategy, tactics, opportunity, confusion). Then obtain a reasonable probability interval of human error according to Table 2. This is the general step of using the CREAM model to obtain the probability of human error.
The method to judge the behavior pattern is as follows: according to the actual situation, the number of positive and negative conditions in the 9 types of CPC are obtained respectively �∑ p, ∑ n � (That is, the expectation effect, positive and negative), and then get the behavior control mode according to Fig. 1. This paper use CREAM in the CPC and its quantitative, calculated on the basis of the CPC after quantitative by error probability convenience, adopts the way of questionnaire to obtain the CPC According to the actual scene, consult expert advice, and give the CPC quantitative range is: (0, 100). 0 indicates CPC in the worst case, 50 indicates the general level, 100 is the best compromise situation gives different value, is decided by the actual scene.

CPC Contains Secondary Influencing Factors
Due to the needs of actual scenes, it is not enough to only rely on CPC to measure the human operation factor influencing factor of a specific problem. It must be subdivided, which not only helps experts to give more accurate judgment, but also lays a good foundation for calculating the probability of human error.
According to the actual scene of outdoor terminal box, several influential CPC and secondary influencing factors are selected here (some secondary factors can be subdivided according to the scene), as shown in Table 3.
Each secondary influencing factor represents a factor that may affect human behavior during the operation of the terminal box. For the following analysis and calculation, only 7 decisive factors are selected here: rules and regulations, equipment status, operation difficulty, personnel arrangement, the physiological condition, experience level, team work. The specific content they contain is shown in Table 4: In different work scenarios, the influence of each secondary influencing factor on people is different. For example, a work scenario requiring multi-person cooperation pays more attention to team cooperation; work scenes where only one person can be accommodated in a work space pay more attention to personal experience level and physiological state. It is obvious that the total influence on people cannot be calculated by a simple sum. Therefore, a weighted method is proposed to calculate the total influence index of these factors on people (hereinafter referred to as the Success Likelihood Index, SLI).

Probability of Human Error
Based on the actual outdoor terminal box scenario, CPC is subdivided into secondary influencing factors: organizational integrity, working conditions, availability of plans, available time, physiological rhythm, adequacy of training and experience, and quality of teamwork. Each secondary influencing factor represents a factor that may affect human behavior during terminal box operation, and seven corresponding decisive factors are selected: rules and regulations, equipment condition, operation difficulty, personnel arrangement, physiological state, experience level and teamwork. In different working scenarios, each secondary influencing factor has a different impact on people. This paper uses a weighted method to calculate the total influence of these factors on people (hereinafter referred to as the Success Likelihood Index, SLI). According to Vestrucci's SLIM model 2 [16], each influencing factor should contain two attributes: weight and value. The success likelihood index SLI, and the relationship between the Probability of failure (Pf) and success likelihood index (SLI) are represented by Eqs. (1), (2): where i is the importance weight of the influential factor in the item i ; r i is the value of the influencing factor in item i , which is determined by the actual situation; N is the number of influencing factors; a and b are constants. When r i is 0, the corresponding influencing factor is in the worst case. Different compromise situations can be endowed with different values, which are determined by the actual scenarios.
Combined with the CPC in the CREAM method, the probability of human error can be obtained by AHP-SLIM method [17]. Specifically, first the appropriate CPC is selected according to the actual work scenario, and then analyze the secondary influencing factors contained therein. Secondly, in the form of expert questionnaire, the value of a certain actual operation's secondary influencing factor value is judged and the discrimination matrix is obtained, and then the weight vector is obtained. Finally, the consistency check is performed. If it is passed, the human error probability is calculated according to Eqs. (1) and (2). Otherwise, the discriminant matrix needs to be adjusted repeatedly until the consistency test is satisfied.

Equipment Failure Rate
Research on equipment failure rate is of great significance for formulating maintenance plans, equipment normal operation, and resource allocation [18]. In this paper, the proportional failure probability model proposed in literature [19] is adopted to analyze the terminal box equipment failure rate. Assuming the time before the equipment failure is denoted as the random variable t , and suppose the distribution of t is F(t) , the probability density function of t is assumed to be f (t) . Then, the reliability function R(t) [20] was defined by the following equation: According to the proportional failure rate model, the calculation formula of the failure rate function was given by: where, h(t)Δt represents the probability of failure within time period Δt under the condition of normal operation before time. Weibull distribution is generally used as the model of failure rate function, is given by: is called the connection function and represents the influence of the state S(t) of the device at time T on the device failure rate. S(t) is the vector, and the dimensions are N . i is the coefficient (or weight) of each state, is the shape parameter, and is the characteristic parameter. They can be understood as constants to be fitted and obtained by simulation. According to Eq. (3) and (4), there are: In practice, maximum likelihood estimation in statistics is often used to obtain , , . For simplicity, this paper believes that a state will affect the circuit breaker equipment. The likelihood function is as follows: The last product term of the Eq. (7) contains integral and state variable, and h(t) contains the state variable S(t) . In order to obtain its specific value, the state S(t) of the equipment must be continuously monitored, but the monitoring is generally non-continuous, so the precise value of the integral cannot be obtained. Assuming that the monitoring time interval does not change, it is denoted as Δt i . And its relative scale to T i is negligible, so it can be considered that there will be no change in h(t) . Then, as long as the sum is obtained: In the Eq. (8), k i is the number of times that the equipment is monitored till the equipment fails at T i . t ij represents the time series for monitoring the equipment till the equipment fails at T i . According to Eq. (8), the logarithm of the result obtained by Eq. (7) is taken and the partial derivative of each parameter is calculated, making it 0. A system of equations containing three equations, including three unknowns, can be solved by Matlab 2020a, or numerical solution can also be obtained by quasi-Newton method.

Failure Risk Assessment Model
In order to consider the terminal box hardware and human factors into the failure risk of the system, the method of function decomposition [21] is adopted to grade the risk level of the outdoor circuit breaker terminal box. Firstly, the system is defined as a collection of entities performing a series of task functions, and the function is defined as the function completed by the circuit breaker terminal box or part of the device. Logical node is defined as the smallest part of data exchange, which is an abstraction of the whole or part of the behavior. The logical connection is defined as the communication line between logical nodes, which is directional. The communication information slice is defined as the information attribute of the communication connection. The function tree is defined as a system function structure diagram formed by taking the function as the bifurcation basis if there are multiple functions in the system, and the functions do not affect each other.
If the definition conditions of the function tree are satisfied, then the total function failure risk level of the system can be calculated according to the failure risk level of subfunctions as the Eq. (9) shown: In the Eq. (9), Risk is the failure risk level of the parent function, risk is the failure risk level of the subfunctions it contains, RISK is the failure risk level of the parent function, risk i is the failure risk level of the sub-functions it contains, and RN is the number of subfunctions it contains, r is the risk transfer weight of each sub-function, indicating the degree of impact of sub-function failure on the total function failure, which can be obtained by the analytic hierarchy process. The hierarchical weighted summation of the function tree can finally obtain the total failure risk level of the system. The calculation method of risk level is described below.
Since the circuit breaker of terminal box needs to be calibrated manually, the failure probability of circuit breaker with human influence factors should be calculated: In the Eq. (10), p(t) is the failure probability of circuit breaker without considering human factors, that is, equipment failure rate. p � (t) is the failure probability of the circuit breaker after considering human factors.
In order to integrate the failure probability of each logical node of the system considering human factors into the total failure probability of the system, it is assumed that there are only two working states of logical nodes and logical connections, namely, effective and failure. Logical nodes are two by two, logical connections are two by two, there is no interaction between logical connections and logical nodes, and they are independent of each other. The communication delay is 0, that is, the speed of information transmission is assumed to be infinite. The function can be considered as a series system of logical nodes and logical connections, and thus the function failure probability can be obtained: In the Eq. (11), p 1i , p 2i are logical nodes, the probability of logical connections error (after correcting with the probability of human error), and n and m are the number of logical nodes and logical connections respectively, p F is the total probability of system failure.
The value of logical nodes should be determined by the value and quantity of the logical connection it outputs, and the value of logical connections should be determined by the security attribute level of the communication information piece. Based on this, define the logical connection, logical node, and the value calculation formula of the system as: In the Eqs. (12), (13) and (14), V 1 , V 2 , V 3 are the quantitative value of logical links, logical nodes, and the system respectively. They have no units and are only used to reflect the severity of functional failure. Superscript n max represents the remaining elements after removing the maximum value of the output logical connection contained in the logical node. s, q is number of logical links and logical nodes respectively. SE, IN, and US are quantification levels of the confidentiality, integrity, availability of the logical link, respectively.
According to the above, the total failure probability and the total value of the system are calculated. The magnitude of the VAR depends on these two terms, and the calculation formula is: Risk value is just a percentage, and it cannot be used to give real guidance. Only the risk level can give people certain psychological hints and improve people's vigilance. In order to use the risk value to determine the risk level, a 9-level evaluation standard and an exponential function model are used, assuming the risk value of 20% (after considering human factors, value at risk is not a bit more before considering human factors), the risk level reaches the maximum. When the value at risk is 0, the minimum risk level is 1. The relationship between risk level and value at risk is: (16) Level = min{round(e 11×R ), 9} Table 5 Interpretation of risk level   Level Description   1 Consequences of loss of 0 ~ 3.6%, acceptable, without any adjustment, can be performed 2 Consequences of loss of 3.6% ~ 8.3%, slightly small, adjustable or not, can be performed 3 The consequence loss is 8.3% ~ 11.3%, which is a little small and needs to be adjusted slightly. It can be operated 4 Consequences of loss of 11.3% ~ 13.6%, medium to small, need small adjustment, can be performed 5 Consequences of loss of 13.6-15.4%, medium, need to be slightly adjusted, can be performed, but be careful 6 The consequence loss is 15.4% ~ 17.0%, moderate slightly larger, need moderate adjustment, can perform the operation, but should be careful 7 The consequence loss is 17.0% ~ 18.3%, which is medium and large, and needs to be adjusted moderately. The operation can be performed but should be carefully 8 The consequence loss is 18.3% ~ 19.4%, which is too large to be carried out and needs to be adjusted substantially 9 The consequential loss is 19.4% ~ 20.4%, which is too serious and requires serious adjustment and cannot be performed In the Eq. (16), Level is the risk level of the system to be evaluated, and round(.) is the rounded function level. The description of each Level is shown in Table 5.
The entire evaluation process is shown in Fig. 2.
(1) Get the actual scene; (2) Calculate the probability of human error according to AHP-SLIM; (3) Proportional fault model is used to obtain the equipment failure rate; (4) The equipment failure probability is corrected by the human as the failure probability to obtain the system failure probability; (5) Carry out value assessment and risk grade assessment according to functional decomposition method.

Simulation Analysis
Taking a circuit breaker terminal box as the object, a simulation experiment is carried out. The specification documents indicate the components included: 1 current terminal, 1 voltage terminal, 1 common terminal, 3 circuit breakers, 1 temperature and humidity controller, 1 heater, and 1 in-box floodlight. In order to highlight the main content of the algorithm for simple analysis, this paper assumes that both voltage terminals and current terminals are considered as common terminals with the same properties and are collectively referred to as terminals. The same terminal box contains the same breaker nature (such as material, aging degree, etc.). Auxiliary equipment, such as temperature and humidity controller, heater and floodlight, have the same failure probability, and humans don't interfere with its operation. Therefore, they can be regarded as a whole, which is collectively referred to as auxiliary equipment. Only information is transmitted between terminals, circuit breakers, and auxiliary equipment, and no other interaction or influence occurs.

Failure Consequence Loss Analysis
Based on the above assumptions, the properties of logical connections in the terminal box of a circuit breaker are shown in Table 6. According to Eqs. (12), (13) and (14), the value of each logical connection, logical node and system can be respectively calculated as respectively represent the value of the three logical connections of circuit breaker to terminal, terminal to auxiliary equipment and circuit breaker to auxiliary equipment.The V 1 2 and V 2 2 respectively represent the value of the circuit breaker and the terminal (since the auxiliary equipment has no output logical connection, there is no value of the logic node). The V 3 represents the total value of the system.

Human Error Probability Analysis
The influencing factors in this scenario include: rules and regulations, equipment condition, difficulty of operation, personnel arrangement, physiological status, experience level, and teamwork, which are respectively expressed as: U1, U2, U3, U4, U5, U6 and U7. For a practical scenario, the judgment matrix constructed by the judgment given by experts is shown in Table 7: According to the discriminant matrix, the weight vector is: T = 0.0420 0.0719 0.0719 0.0420 0.2290 0.1230 0.4202 . The matrix passes the consistency test and the weight vector obtained can be directly used to calculate the probability of human error.
The value vector in a practical scenario is r T = 85 30 45 65 73 77 52 . Based on the weight and value of each influencing factor, the proportion of each factor in the success likelihood index is 5.98%, 3.61%, 5.42%, 4.57%, 28.0%, 15.8%, 36.5%, respectively. And the value of a and b are -0.07 and 0.02. According to Eq. (1) and (2), the Pf is calculated and the result was 1.56%.
Therefore, in the case of good rules and regulations, poor equipment condition, medium operation difficulty, reasonable personnel arrangement, good physiological status, rich experience level, and general teamwork, the probability of human error is 1.56%. In fact, the following order of importance is first used to construct the above discriminant matrix: The order of weight vector size also accords with the above importance order, which explains the rationality of using AHP from this perspective.

Analysis of Equipment Failure Rate
A reference result obtained in this paper is as: = 2.665 , = 6.697 , = 4500 . The expression for the failure rate is as follows, where the unit of t is all days.
After analyzing the failure rate expression, it can be concluded that the failure rate is very low in the case of a short time, and the change rate of failure rate can be ignored  whenever the unit time is changed. However, when the time is longer, such as more than 5,000 days, the change of failure probability is very obvious. The failure rate reflects the aging and current status of the equipment. The longer the equipment is used, the higher the degree of natural aging and the higher the probability of failure. The values of the above state variables are 1,2,3,4. These four values indicate when the device is in a good, careful, serious, and extremely bad state.

Classification of System Risk Levels
Assuming that a department is overhauled every 1500 days, and the equipment is in a serious state, and the failure rates of the auxiliary equipment of the circuit breaker terminal are the same, then the failure rate of the equipment can be obtained as h(1500) = 0.84% . Since the department mainly repairs the circuit breaker, the fault rate of the circuit breaker must be corrected by using the probability of failure, which can be obtained according to Eq. (10), p � 1 = 2.39%。By using the steady-state failure probability of the equipment of SAS (Substation Automation System), it is assumed that the failure probability of logical connections in the example is 0.19%, and the failure probability of each logical connection is the same. According to Eq. (11), the overall failure probability of the system is p F = 11.6% . Therefore, the risk value of the system is 10.7%, and the current risk level of the system is 3, and operations can be performed. That is, under the current situation, the management can make slight adjustments to the personnel to perform maintenance on the outdoor terminal box.
It can be seen from the above scenario that the probability of human error is higher than the rate of equipment failure, so the management department should focus on increasing the training of personnel, improving the management system and rationally selecting working hours to reduce the risk level.

Conclusion
(1) This paper combines cream, slim, and proportional fault models in the field of human reliability evaluation of outdoor terminal boxes for the first time. The CPC quantified in the CREAM model is applied to the actual working scene of the terminal box, and is subdivided into secondary influencing factors based on the specific scene; (2) The SLIM model 2 is adopted for quantitatively calculation of the probability of human error Pf, and the analytic hierarchy process is used to determine the factor index's weight in the SLIM model 2; (3) As for the issue about the failure rate of outdoor terminal boxes that do not consider human error, the proportional failure model is adopted in this research, which considered the aging condition of the equipment and the influence of the existing state on the failure rate of the equipment. At the same time, the failure probability of the system considering human factors is also calculated. The equipment in the terminal box is divided into logical nodes and logical connections, and the failure rate of the equipment is corrected by using the probability of human error, and then the failure probability of the system as a whole is worked out; (4) In order to better judge the consequence loss, the method of information assets is adopted to combine the consequence loss and the overall failure probability of the system to obtain the overall risk level of the system, and to explain risk level of the whole system one by one, which is advantageous to the management and scheduling department to make better decisions in human maintenance, such as adhering to the principle of early found and maintenance, to give you adjust the work time of personnel training.