ML031340007
| ML031340007 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 05/13/2003 |
| From: | Marschall C NRC/RGN-IV/DRS/EMB |
| To: | Anderson C Entergy Operations |
| References | |
| EA-03-016, FOIA/PA-2003-0358, IR-01-006 | |
| Download: ML031340007 (139) | |
See also: IR 05000313/2001006
Text
UNITED STATES
NUCLEAR REGULATORY COMMISSION
611 RYAN PLAZA DRIVE, SUITE 400
ARLINGTON, TEXAS 76011-4005
May 13, 2003
Craig G. Anderson, Vice President,
Operations
Arkansas Nuclear One
Entergy Operations, Inc.
1448 S.R. 333
Russellville, Arkansas 72801-0967
SUBJECT: ARKANSAS NUCLEAR ONE - NRC TRIENNIAL FIRE PROTECTION
INSPECTION REPORT 50-313/01-06; 50-368/01-06 - SUPPLEMENTAL
RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION
Dear Mr. Anderson:
In Attachment 1 of your letter dated April 2, 2003, you requested additional information
pertaining to the potentially greater than Green finding identified in the subject NRC inspection
report. In a letter dated April 11, 2003, Region IV provided information addressing your request.
In a subsequent telephone conversation, Mike Cooper of your staff requested a copy of the
reference document used by Troy Pruett of NRC Region IV to evaluate the risk contribution from
human reliability. The enclosure to this document is the document you requested. Please note
that the NRC office of Nuclear Regulatory Research plans to release this same document
shortly to the public, including licensees.
In accordance with 10 CFR 2.790 of the NRCs Rules of Practice, a copy of this letter
and its enclosures will be available electronically for public inspection in the NRC Public
Document Room or from the Publicly Available Records (PARS) component of NRCs document
system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-
rm/adams.html (the Public Electronic Reading Room).
If you have any further questions, you may contact me at 817-860-8185.
Sincerely,
/RA/
Charles S. Marschall, Chief
Engineering and Maintenance Branch
Division of Reactor Safety
Entergy Operations, Inc. 2
Dockets: 50-313; 50-368
Enclosures:
1. Fire Modeling of Fire Zone 98-J, Emergency Diesel Generator Corridor and 99-M, North
Electrical Switchgear Room, Arkansas Nuclear One - Unit 1
2. Phase 3 SDP Analysis: Arkansas Nuclear One, Unit 1
cc w/enclosure:
Executive Vice President
& Chief Operating Officer
Entergy Operations, Inc.
P.O. Box 31995
Jackson, Mississippi 39286-1995
Vice President
Operations Support
Entergy Operations, Inc.
P.O. Box 31995
Jackson, Mississippi 39286-1995
Manager, Washington Nuclear Operations
ABB Combustion Engineering Nuclear
Power
12300 Twinbrook Parkway, Suite 330
Rockville, Maryland 20852
County Judge of Pope County
Pope County Courthouse
100 West Main Street
Russellville, Arkansas 72801
Winston & Strawn
1400 L Street, N.W.
Washington, DC 20005-3502
Bernard Bevill
Radiation Control Team Leader
Division of Radiation Control and
Emergency Management
4815 West Markham Street, Mail Slot 30
Little Rock, Arkansas 72205-3867
Entergy Operations, Inc. 3
Mike Schoppman
Framatome ANP, Inc.
Suite 705
1911 North Fort Myer Drive
Rosslyn, Virginia 22209
Entergy Operations, Inc. 4
Electronic distribution by RIV:
Regional Administrator (EWM)
Deputy Regional Administrator (TPG)
DRP Director (ATH)
DRS Director (DDC)
Deputy Director, DRP (GMG)
Branch Chief, DRP/D (LJS)
Branch Chief, DRS/EMB (CSM)
Senior Resident Inspector (RLB3)
Senior Project Engineer, DRP/D (JAC)
Staff Chief, DRP/TSS (PHH)
RITS Coordinator (NBH)
K. Smith, Region IV (KDS1)
G. Sanborn, D:ACES, Region IV (GFS)
M. Vasquez, ACES, Region IV (GMV)
W. Maier, Region IV (WAM)
S. Morris, OEDO, RIV Coordinator (SAM1)
B. McDermott, OEDO (BJM)
R. Larson, OEDO (RKL)
J. Hannon, NRR (JNH)
L. Dudes, NRR (LAD)
T. Alexion, NRR (TWA)
J. Dixon-Herrity, OE (JLD)
OEMAIL
DOCUMENT: R:\_ano\2001\an0106response-rln.wpd
RIV:DRS/EMB C:DRS/EMB
RLNease/lmb CSMarschall
N/A /RA/
5/13/03
OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax
ENCLOSURE
NUREG/CR-xxxxx
INEEL/EXT-02-10307
SPAR-H Method
Idaho National Engineering and Environmental Laboratory
U.S. Nuclear Regulatory Commission
Office of Nuclear Regulatory Research
Washington, DC 20555-0001
NUREG/CR-XXXX
INEEL/EXT-02-10307
SPAR-H Method
Manuscript Completed: November 2002
Date Published:
Prepared by:
David Gertman, James Byers, Harold Blackman, Lon Haney, Curtis Smith, Julie Marble,
Jen Nadeau
Idaho National Engineering and Environmental Laboratory
Patrick OReilly, NRC Program Manager
Prepared for
Office of Nuclear Regulatory Research
Division of Systems Analysis and Regulatory Effectiveness
U.S. Nuclear Regulatory Commission
Washington, D.C. 20555
NRC Job Code E8238
ABSTRACT
In support of the Accident Sequence Precursor in HRAs, a number of needed improvements to
Program (ASP), the U.S. Nuclear Regulatory definitions, terms, and concepts were identified.
Commission (NRC), in conjunction with the In 2002, to enhance the general utility of the
Idaho National Engineering and Environmental Standardized Plant Analysis Risk Human
Laboratory (INEEL), in 1994 developed the Reliability Analysis (SPAR-H) method, and to
Accident Sequence Precursor Standardized Plant make it more widely available, the method was
Analysis Risk Model (ASP/SPAR) human updated and reviewed for its applicability to low
reliability analysis (HRA) method used in the power and shutdown (LP/SD) applications.
development of plant models. Based on During this review, an approach to uncertainty
experience gained in field-testing, this method representation was outlined based upon the beta
was updated in 1999. Since that time, NRC staff distribution and additional detail for the SPAR-
analysts have been using this method to perform H method regarding human error probability
their risk-informed regulatory activities, such as (HEP) dependency assignment was made
determining the risk significance of inspection available.
findings in Phase 3 of the Significance
Determination Process (SDP), developing an This document presents the current version of
integrated risk-informed performance measure the SPAR-H method, along with guidance,
in support of the reactor oversight process definitions, representing uncertainty, and
(ROP), and screening and analyzing operating instructions regarding dependency assessment
experience data in a systematic manner to for HEP calculations. This report also contains
identify events/conditions that are precursors to comparisons between this and other
severe accident sequences. As a result of contemporary HRA approaches and findings
implementation by staff analysts, and other specific to application of the method to LP/SD
experience at the INEEL in applying the method events.
iii
iv
Contents
ABSTRACT.................................................................................................................................................iii
EXECUTIVE SUMMARY ......................................................................................................................... ix
ACRONYMS.............................................................................................................................................. xv
GLOSSARY ............................................................................................................................................. xvii
1. INTRODUCTION.............................................................................................................................. 1
1.1 Overview.................................................................................................................................. 1
1.2 Background .............................................................................................................................. 1
1.3 HRA Orientation ...................................................................................................................... 2
1.4 Guidance in Performing HRA.................................................................................................. 2
1.5 Organization............................................................................................................................. 3
2. SPAR-H METHOD............................................................................................................................ 5
2.1 Model of Human Performance................................................................................................. 5
2.2 Task Types ............................................................................................................................... 5
2.3 Error Types .............................................................................................................................. 8
2.4 PSFs ......................................................................................................................................... 9
2.4.1 PSF Comparison Findings ............................................................................................. 9
2.4.2 Discussion of PSF Changes ......................................................................................... 15
2.4.3 Relationship of PSFs to HEPs Underlying the SPAR-H Method................................ 15
2.4.4 SPAR-H Method PSF Overview and Definitions ....................................................... 17
2.5 Dependency............................................................................................................................ 21
2.5.1 Approach to Combined HEP Representing Diagnosis and Action within the
Same Task.................................................................................................................... 24
2.6 Uncertainty Analysis Suggestions For Using SPAR-H ......................................................... 25
2.6.1 Overview ..................................................................................................................... 25
2.7 Assumptions........................................................................................................................... 25
2.7.1 Caveats ........................................................................................................................ 26
2.7.2 Human Performance Distributions .............................................................................. 26
2.7.3 Work Shift Effects ....................................................................................................... 29
2.7.4 Human Performance and Complexity ......................................................................... 30
v
2.7.5 The Categorization and Orthogonality of PSFs........................................................... 31
2.7.6 The CNI Distribution................................................................................................... 32
2.7.7 Combining Non-SPAR-H Information with SPAR-H................................................. 34
2.8 Recovery ................................................................................................................................ 35
3. ANALYSIS ...................................................................................................................................... 36
3.1 Base Rate Comparison Among HRA Methods Including the SPAR-H Method ................... 36
3.2 Comparison of PSF Weights for Low Power Versus Full Power .......................................... 39
3.3 Approach to LP/SD Comparison ........................................................................................... 41
3.4 Additional Field Testing ........................................................................................................ 42
3.4.1 Applicability of the SPAR-H Method to External Events........................................... 42
3.5 Range of Uncertainty Associated with HRA Methods .......................................................... 43
3.5.1 Evaluation Against Other Methods ............................................................................. 43
3.5.2 Change of Distribution Due to Truncation .................................................................. 43
3.6 Change in Time PSF .............................................................................................................. 43
4. CONSIDERATIONS WHEN USING THE SPAR-H METHOD for Full Power and LP/SD
APPLICATION................................................................................................................................ 49
4.1 Prerequisites ........................................................................................................................... 49
4.2 Using the SPAR-H Method for a SPAR Base Model ............................................................ 50
4.3 Using the SPAR-H Method for SPAR Event Analysis.......................................................... 51
4.4 Sources of Information for Applying the SPAR-H Method to Events .................................. 51
4.4.1 Completing the SPAR-H Human Error Worksheet..................................................... 52
5. DISCUSSION................................................................................................................................... 55
5.1 Differences between Full Power and LP/SD ......................................................................... 55
5.2 Compliance with ASME Standard on PRA ........................................................................... 56
5.3 NASA Guidelines .................................................................................................................. 59
5.4 Method Assessment ............................................................................................................... 60
5.5 Discussion .............................................................................................................................. 61
6. REFERENCES ................................................................................................................................. 65
vi
Appendixes
Appendix A2002 HRA Worksheets for Full Power ............................................................................. A-1
Appendix B2002 HRA Worksheets for LP/SD .................................................................................... B-1
Appendix C2002 Full Power Worksheets for SGTR Example............................................................. C-1
Appendix DLP/SD Scenario Description and SPAR-H Results for a Hypothetical PWR
LOI with RCS Pressurized ............................................................................................................. D-1
Apppendix ESPAR-H Results for Dry Cask......................................................................................... E-1
Appendix FOperational Examples of SPAR-H Method Assignment of PSF Levels ............................F-1
Appendix GThe Relative Relationship Among SPAR-H PSFs ............................................................ G-1
Appendix HSPAR Development History ............................................................................................. H-1
Figures
EX-1. Human behavior model.................................................................................................................... x
EX-2. Idealized mean HEP as a function of PSF influence. .....................................................................xi
2-1. Human performance model.............................................................................................................. 6
2-2. Idealized mean HEP as a function of PSF influence ..................................................................... 16
2-3 Arousal effect on memory ............................................................................................................. 28
2-4. Influence diagram showing relationships among PSFs ................................................................. 33
2-5. a as a function of mean HEP ...................................................................................................... 33
2-6. CNI distribution for the HEP ......................................................................................................... 34
vii
Tables
2-1. Operational factors in SPAR-H........................................................................................................ 7
2-2. HRA methods used in SPAR-H comparisons................................................................................ 10
2-3. Action PSF comparison matrix. full power (PSFs=8) ................................................................... 10
2-4. SPAR-H dependency rating system............................................................................................... 22
3-1. Action error type base rate comparison. ........................................................................................ 36
3-2. Mixed task base rate comparison................................................................................................... 37
3-3. Diagnosis error type base rate comparison .................................................................................... 37
3-4. SPAR-H (2002) PSFs used in quantifying HEPs........................................................................... 38
3-5. Assumed differences among LP/SD conditions and full power mode .......................................... 40
3-6. Loss of inventory with RCS pressurized HEPs comparison of PSF influence for PSF
weight sets A and B ....................................................................................................................... 42
3-7. Methods, diagnosis and action error factors .................................................................................. 45
3-8. Influence of expansive time on base failure rates .......................................................................... 47
4-1. PSF sources of information for SPAR-H....................................................................................... 52
5.1 SPAR-H method assessment.......................................................................................................... 64
viii
EXECUTIVE SUMMARY
Human performance has been a contributor to the range of rates predicted by other HRA
incidents and accidents in many industries. methods.
Recently, the role of human error was documented
in a number of significant events in the nuclear The SPAR-H method is built upon an explicit
power industry (Gertman et al., 2002). Studies of information-processing model of human
these events included human reliability analysis performance derived from the behavioral
(HRA). Human reliability analysis is an evolving sciences literature that was then interpreted in
field that addresses the need to account for human light of activities at NPPs (Blackman and Byers,
errors when: (i) performing safety studies such as 1996). This human performance model is
probabilistic risk analysis (PRA); (ii) helping to presented in Figure 1. In 1999, further research
risk-inform the oversight inspection process; identified eight performance shaping factors
(iii) reviewing special issues; and (iv) helping to (PSFs) deemed most capable of influencing
risk-inform regulation. HRA has also been used to human performance. These PSFs are accounted
support the development of plant-specific PRA for in the SPAR-H quantification process. These
models. factors include:
This report presents a simplified HRA method * Available time
for predicting the human error associated with * Stress
operator and crew actions and decisions in
response to initiating events at commercial U.S. * Experience and training
nuclear power plants (NPPs). The Standardized
Plant Analysis Risk Human Reliability Analysis * Complexity
(SPAR-H) method was developed to support the
- Ergonomics (human-machine interface)
development of plant-specific PRA models for
the United States Nuclear Regulatory * Procedures
Commission (NRC), Office of Nuclear
Regulatory Research (RES) and recently has * Fitness for Duty and
been used to help support the Office of Nuclear
- Work Processes.
Reactor Regulation (NRR) Reactor Oversight
Process (ROP). The SPAR-H method is also While many contemporary methods address
applicable to pre-initiator events. PSFs in some form, the SPAR-H method is one
Based upon review of first and second- of the few that addresses the potential beneficial
influence of these factors. That is, the positive
generation HRA methods, the SPAR-H method
influence of PSFs can reduce nominal failure
assigns human activity to one of two general
task categories: action or diagnosis. Examples of rates. For example, superior experience and
training can serve to enhance the operators
action tasks include operating equipment,
performing line-ups, starting pumps, conducting understanding of system status beyond the
average or nominal case. This does not mean
calibration or testing, and other activities
performed during the course of following plant that the operator or crews knowledge is
procedures or work orders. Diagnosis tasks necessarily complete, merely that it is better by
some objective measure, and that this improves
consist of reliance upon knowledge and
experience to understand existing conditions, human reliability. Figure 2 shows this
relationship and the influence of the PSF
planning and prioritizing activities, and
determining appropriate courses of action. Base (X-axis) on mean human error probability (HEP)
error rates for the two task types associated with values (the Y-axis).
the SPAR-H method were calibrated against Formerly, the SPAR-H method addressed
other HRA methods. The calibration revealed dependency. Dependency in this case, means
that the SPAR-H human error rates fall within that the influence of one human error on
ix
Human Behavior Model
Perception
Individual Factors
Processing
Response
Inflow of Information Files Short Term Memory/Working Memory
External Memory
Demand characteristics of the task Long Term Memory
Factors which may impact the decision making process
Opportunity Time Goals Beliefs Organization of the perceptual field
Learning Training Demands of the task Physical and Mental Health
Crew Cognitive Skills Complexity of task environment
x
Inflow of Filters Perception Working Memory/ External Processing and Long
Information Short Term Memory Memory Term Memory
Visual Management Vision Attention Environmental cues Associatively organized
Acoustic and Auditory Capacity Job Aids Scripts
Kinesthetic administrative Tactile Time Constraint Procedures Schema
Environmental Selective recall
Sensory Store Serial Processing Hierarchy-based
(prior to STM) Existing Heuristics
Development of new/
Alternative strategies
Response: Implementation of decisions made
Physical strength Sensory acuity Practice/skill Time to reacttime available Existing models for behavior
Figure EX-1. Human behavior model.
Greater human error
probability
1.0
Stronger error
causing effect
of the PSF
Stronger performance
enhancing effect Nominal error rate
of the PSF (1.0 E-2 for diagnosis,
1.0E-3 for actions
Lower human error
probability
Figure EX-2. Idealized mean HEP as a function of PSF influence.
subsequent human explicitly errors is accounted * Close succession of the next action/reaction
for by the model. Although the literature on (from within seconds to a few minutes).
dependency among human errors is limited, the
Various combinations of these factors were
INEEL review concluded that the following
considered and given a rating based on their
combinations of factors contribute to error
combined effect on dependency in error
dependency:
propagation. The ratings of the various
- Same crew (relates to similar mindset, use combinations correspond to zero, low, moderate,
of similar heuristics, tendencies to tunnel high, or complete dependency among tasks. In
vision, recency effects, etc.) integrating this dependency information, the
SPAR-H method uses the underlying THERP
- Same location (the control, display or piece quantification for failure on Task B, given
of equipment must be the same or located failure on Task A provided in NUREG/CR-1278
within the same relatively restricted area, (Swain and Guttman, 1983), but offers
such as the same panel) additional guidance for dependency assignment.
- Lack of additional cues [additional cues Once dependency has been determined to be
exist if there is a specific procedural call present, moderate-to-high dependency can
out or a different procedure is used, or dominate the failure rate obtained when
additional alarm(s) or display(s) are applying the SPAR-H method; however,
present] satisfying the requirements for this level of
xi
dependency is not often met. This occurs informative prior, based upon Atwoods work
because many actions involve different steps in (1996), was selected for its ability to preserve
procedures and provide for relatively long the overall mean value while producing values at
periods of time between actions. In addition, the the upper end of the distribution that more
location of the equipment acted upon is not accurately represent the expected error
similar. Conversely, dependency assignment is probability. Analyses contained in this report
almost always applicable in situations where an also review human performance distributions,
HRA analyst is attempting to model the relate them to performance shaping factors, and
influence of a second or third checker in a discuss issues regarding the relative
recovered error. orthogonality of performance shaping factors
influence upon human performance.
The SPAR-H method may be applied on a task
level (as is the case when developing SPAR A major component of the SPAR-H method
models for low power/shutdown [LP/SD] or full presented in this report is the SPAR-H
power), or on a subtask level when building Worksheet presented in Appendix A. The
HRA event trees, (i.e., performing more detailed method for filling out these worksheets is
analysis). It is possible to apply the method to described below. Note that the process differs
retrospective as well as prospective scenarios. slightly depending upon whether the analyst is
The criterion for applying the SPAR-H method using the method to build SPAR models,
dependency assignment is the same for either perform event analysis, or perform a more
case. However, when building HRA event trees, detailed HRA analysis. The analysis presented
diagnosis and action are not combined in a below refers to the use of the SPAR-H method
single HEP. to support SPAR model development, the major
focus for the HRA method development process.
The application of the SPAR-H method is
relatively straightforward and follows the Overview
guidance for conducting HRA, which is
available in a number of publicly available In most instances, the HRA analyst will review
sources. Such sources include the IEEE Standard SPAR model event trees containing action or
P1082 for HRA (1997), ASME Standard for diagnosis tasks and accompanying contextual
PRA (ASME STD-RA-2002), and the EPRI information for consideration and evaluation. In
Systematic Human Action Reliability Procedure the majority of instances, the event will require
(Hannaman and Spurgin, 1985). When applied analysis on a task level, that is, multiple subtasks
to situations other than SPAR model building or are considered. Event trees and a limited number
screening situations, the comprehensive HRA of fault trees will be available from the PRA
search strategies found in NUREG/CR-1624 analyst. The HRA analyst must decide whether
(Sorester et al., 2000) can be used to aid in the actions specified involve diagnosis or are
identifying and modeling errors leading to purely action-based. There are some instances
unsafe acts and human failure events. where action and diagnosis are intertwined and
indiscernible, and others where a step in SPAR
The SPAR-H method produces a simplified best
events may represent a task with many
estimate for use in plant risk models. The mean
underlying subtasks. In such instances, the basic
is assumed to be the best (i.e., most informative)
event in the PRA model represents both
piece of information available regarding the
diagnosis and action. If a step involves both
human error probability. In addressing
action and diagnosis, two worksheets
uncertainty, error factors were not used and the
corresponding to action and diagnosis are filled
use of a lognormal probability distribution was
out. Guidance is provided for determining the
not assumed. The SPAR-H method employs a
composite failure rate.
beta distribution, which can mimic normal and
lognormal distributions, but has the advantage When developing the basic SPAR model, three
that probabilities calculated with this approach of the eight PSFs are immediately evaluated: the
range from 0 to 1. Use of a constrained non-
xii
time available, stress, and complexity. The representation of omission versus commission is
remaining five PSFs (experience, procedures, an issue left to the analyst and is part of the error
ergonomics, fitness for duty, and work identification and modeling activities of HRA.
processes), are generally rated nominal, because
they are usually event- or personnel-specific. The tendency for omissions or commissions to
These five PSFs are evaluated when a plant- be more important in contributing to an
specific model is being developed. individual human failure event can be modeled
by the analyst using subtask level of
Following determination of task category, the decomposition in building supporting fault trees.
relationship of a failed task to a preceding failed
task (i.e., the task dependency) is assessed The explicit incorporation of work processes in
according to SPAR definitions. This dependency PRA/HRA is relatively new. For an example
among failures is then used to support discussion of organization factors with emphasis
quantification of the final HEP. on work practices, see Apostolakis (1999). The
range of effect used reflects the treatment of the
The positive influence of dependence has not work process PSF in other HRA methods. For
been investigated and therefore is not part of the example, work processes range of effect in
SPAR-H method. SPAR-H is enveloped by identification of a
range of effect for work process PSF in two
Discussion methods, CREAM (Hollnagel, 1998) and
HEART (Williams, 1992). The range in SPAR-
The SPAR-H method was designed to be H is within the bounds suggested by these
straightforward and easy to apply. It is based on methods.
a human information-processing model of
human performance and other results from Traditionally, accounting for the influence of
human performance studies published in the multiple shaping factors with various levels of
behavioral sciences literature. This simplified influence without imposing a high degree of
HRA approach contains a number of significant expert consensus judgment on the HRA process
features, including calibration of its base failure has proven difficult for HRA. SPAR-H attempts
rates and PSFs influence with other HRA to help make the assignment of human error
methods. This version of the SPAR-H method probability a more repeatable function and less a
also contains a revised approach to uncertainty function of the analyst performing the HRA. The
analysis employing a beta distribution that authors feel that analyst expertise comes into
removes problems experienced in earlier play in discovery of the appropriate error and in
versions when applying error factor approaches. assigning the correct level of influence (i.e.,
multiplier for the HEP). The HRA search
The method has been refined as a result of process for determining unsafe acts given a
experience gained during its use in the particular context still remains a challenging
development of over 70 SPAR plant models for task for the HRA analyst, but this is the
the NRC; in limited HRA applications for dry information that is brought to SPAR-H for
cask spent fuel storage, in implementation of quantification. The need to provide sound
risk-informed plant inspection notebooks, and qualitative assessments of factors is amplified as
through third party application to other domains SPAR-H applications expand beyond basic plant
such as aerospace. The method does not PRA model development to include HRA for
differentiate between active and latent failures. event analysis and the evaluation of specific
Identification and modeling of active and latent plant performance issues.
failures is the decision of the analyst. It is
thought that the same PSFs and base failure rates
are generally applicable to both types of error.
References
The base error rates contained in the worksheets
ASME RA-STD-2002, Standard for
for actions and diagnosis include omission and
Probabilistic Risk Assessment for Nuclear
commission types of error. The explicit
xiii
Power Plant Applications, American Society Hollnagel, E., Cognitive Reliability and Error
for Mechanical Engineers, 2002. Analysis Method (CREAM), Elsevier Science
Ltd, Oxford, UK, 1998.
Atwood, C. L., 1996, Constrained
Non-informative Priors in Risk Assessment. IEEE Standard 1082, Guide for Incorporating
Reliability Engineering and System Safety, Human Action Reliability Analysis for Nuclear
Vol. 53, No. 1, pp 37-46. Power Generating Stations, Institute of
Electrical and Electronics Engineers, 1997.
Blackman, H. S., and J. C. Byers, ASP/SPAR-H
Methodology, Internal EG&G report develop for Swain, A. D., and H. E. Guttman, Handbook of
U.S. Nuclear Regulatory Commission, 1994. Human Reliability Analysis with Emphasis on
Nuclear Power Plant Applications (THERP)
Forester, J., et al., Technical Basis and
Final Report, NUREG/CR-1278, Washington,
Implementation Guidelines for A Technique for
DC, 1983.
Human Event Analysis (ATHEANA),
NUREG/CR 1624, Rev 1, U.S. Nuclear Williams, J. C., Toward an Improved
Regulatory Commission Office of Nuclear Evaluation Analysis Tool for Users of HEART
Regulatory Research, May 2000. International Conference on Hazard
Identification and Risk Analysis, Human Factors
Gertman, D. I., et. al., Review of Findings for
and Human Reliability in Process Safety,
Human Performance Contribution to Reactor in
Orlando, FL. January 15-17 1992.
Operating Events, NUREG/CR-6753, U.S.
Nuclear Regulatory Commission, Washington
DC, 2002.
Hannaman, G. W., and A. J. Spurgin, Systematic
Human Action Reliability Procedure (SHARP),
EPRI NP-3583, Palo Alto, CA: Electric Power
Research Institute, 1984.
xiv
AFWD Auxiliary feedwater INEEL Idaho National Engineering and
AIT Augmented Inspection Team Environmental Laboratory
ASEP Accident Sequence Evaluation IPE Individual plant examination
Program LB Lower bound
ASME American Society of Mechanical LCO Limiting condition of operation
Engineers LDST Let down storage tank
ASP Accident sequence precursor LER Licensee event report
ATHEANA A Technique for Human Event LOI Loss of inventory
Analysis LP/SD Low power & shut down
BWR Boiling water reactor LTM Long-term memory
CAHR Connectionism Approach to MERMOS Methode d' Evaluation de' la
Human Reliability Reaslisation des Missions
CAP Corrective action plan Operateur pour la Surete'
CCDP Conditional core damage MMPI Minnesota Multiphasic
probability Personality Inventory
CCP Centrifugal charging pump MOV Motor-operated valve
CN Constrained non-informative MSIV Main steam isolation valve
CNI Constrained non-informative NASA National Aeronautics and Space
prior Administration
CREAM Cognitive Reliability Evaluation NASA JSC National Aeronautics and Space
and Analysis Method Administration Johnson Space
CRO Control room operator Center
CRS Control room supervisor NPP Nuclear power plant
CS Containment sump NRC Nuclear Regulatory Commission
CS Core spray NSO Nuclear service operator
DG Diesel generator PM Plant management
EF Error factor PRA Probabilistic risk assessment
EFC Error forcing context PSF Performance shaping factors
EOC Emergency Operations Center Pw/od Probability (human error)
EOC Error of commission without dependency
EOP Emergency operating procedure PWR Pressurized water reactor
EPRI Electric Power Research Institute RCP Reactor coolant pump
ESF Engineered safety features RCS Reactor coolant system
FLIM Failure Likelihood Index Method RHR (S) Residual heat removal system
FMEA Failure mode and effects analysis RI Resident Inspector
FSAR Final Safety Analysis Report ROP Reactor oversight process
HEART Human Error Analysis and RPV Reactor pressure vessel
Reduction Technique RX Reactor
HEP Human error probability SAPHIRE Systems Analysis Program for
HF Human factors Hands-On Integrated Reliability
HF PFMEA Human factors process failure Evaluation
modes and effects analysis SAR Safety Analysis Report
HFE Human failure events SBCV Safety block control valve
HLR-HE-E High Level Requirements for SCUBA Self-contained underwater
Human Error (ASME def.) breathing apparatus
HMI Human machine interface SD Shutdown
HPI High pressure injection SG Steam generator
HRA Human Reliability Analysis SGTR Steam generator tube rupture
xv
SHARP Systematic Human Action TH Thermal hydraulics
Reliability Procedure THERP Technique for Human Error Rate
SLIM Success Likelihood Index Prediction
Method TLX Task Load Index
SPAR Standardized plant analysis risk TOC Technical Operations Center
SRV Safety relief valve TRC Time-reliability curve
SS Shift supervisor TS Technical Specifications
STD Standard TSC Technical Support Center
SM Secondary memory UA Unsafe acts
STM Short-term memory UB Upper bound
xvi
GLOSSARY
ASP SPAR (1994)Process and diagnostic HEP is the probability of the human failure
task distinction, no uncertainty information event.
beyond adoption of error factors typically used
Human failure event (HFE)a basic event
in other methods, Swain quantification approach
that represents a failure or unavailability of a
to dependency.
component, system or function that is caused by
Basic eventThe term basic event is used in human inaction, or an inappropriate action.
this report to describe a component failure, loss
Initiating EventAn initiating event in the
of function, unavailability or failed human
SPAR model terminology is one of the high-
action in a SPAR model fault tree. An example
level scenarios under study, (e.g., steam
of a basic event might be Operator fails to
generator tube rupture, loss of feed water, loss of
throttle HPI to reduce pressure.
offsite power, etc).
Error modeError type is also referred to as
Low power and shutdown (LP/SD)Refers to
error mode. Major categorization schemes
a set of nuclear power plant (NPP) operating
associated with first generation methods include
modes and is determined by an individual
omission or commission that can occur within
plants technical specifications (TS). However,
the skill-, rule-, and knowledge-based domains.
most plants have adopted or are in the process of
Second generation methods use terminology
adopting the NRC-approved technical
such as slips, lapses, and mistakes, where the
specifications associated with the various plant
latter have a large cognitive component that is
vendors. In PWRs there are 6 operating modes.
accounted for through the analysis of context.
In LP/SD PRA, Modes 4, 5 and 6 (which are
The SPAR-H method uses actions and diagnosis
subcritical) are reviewed. Mode 4 refers to hot
as the major type tasks and various error types
shutdown, Mode 5 refers to cold shutdown, and
are distinguished.
Mode 6 is associated with refueling. In a BWR,
Error typeThe term error type is used in there are 5 operating modes. Modes 3, 4, and 5
this report to refer to categories of human tasks. refer to hot shutdown, cold shutdown and
Other terms that are often used for this purpose refueling, respectively.
are error mode, that is used in this report for
SPAR-H method (1999)Action versus
describing specific HRA methods, and then only
diagnosis task distinction, changes in
when the method specifically uses that term),
performance shaping factor (PSF) definitions,
task type, and error categories.
influence factors and range of influence
EventAn event is a high level generic term determined by review of literature and HRA
encompassing a non-normal occurrence at a methods.
nuclear power plant (or other facility).
SPAR-H method (2002)Action versus
Human errorThe term human error as used diagnosis task distinction preserved, time
in this report refers to an out-of-tolerance action, influencing factor re-defined for low power and
or deviation from the norm, where the limits of shutdown events, dependency refined,
acceptable performance are defined by the uncertainty calculation methods determined,
system. These situations can arise from ASME Standard for PRA requirements
problems in sequencing, timing, knowledge, addressed, clarification on recovery presented,
interfaces, procedures and other sources. full power and LP/SD considerations made
explicit.
Human error probability (HEP)a measure
of the likelihood that plant personnel will fail to SubtaskThe term subtask in this report
initiate the correct, required, or specified action refers to a human action at a level lower than a
or response in a given situation, or by task (i.e., basic event) level.
commission will perform the wrong action. The
xvii
TaskThe word task in this report often encompasses relatively large numbers of human
refers to the human action(s) described in a actions, which might, in other circles, be called
SPAR model basic event (e.g., failure to recover tasks in their own right.
RHR). The level of these tasks often
xviii
1. INTRODUCTION
1.1 Overview models concerned with screening analysis, the
NRC staff analysts decided that further
The Standardized Plant Analysis Risk human refinement of the HRA method was warranted
reliability analysis (SPAR-H) method is a and that this effort should coincide with efforts
simplified human reliability analysis (HRA) underway to refine the SPAR models. As a
approach intended to be used in conjunction result, the Idaho National Engineering &
with the development of SPAR models. The Environmental Laboratory (INEEL) undertook a
language included in this document often refers review in 1994, during which, a number of areas
to aspects of SPAR models such as initiating for improvement were noted. For example, in
events and basic eventsterms common to 1994 the ASP HRA methodology was compared
Probabilistic Risk Assessment (PRA). The on a point-by-point basis to a variety of other
glossary of this report presents general HRA methods and sources. A team of analysts at
definitions for these terms. The SPAR-H method the INEEL evaluated the differences among the
can also be used to support event analysis. This methods. This evaluation led to a revision of the
aspect of the method is reviewed in 1994 ASP HRA methodology to incorporate
Section 4.1.3. desirable aspects of these other methods. In
addition, the revision also focused on addressing
The SPAR-H method contains three user comments.
requirements integral to HRA: error
identification, error modeling (representation), In 1999, the field of HRA changed enough to
and quantification. Guidance for satisfying these cause the NRC to undertake a second revision to
requirements may be formed in IEEE STD the ASP HRA methodology. A revised
P1082 (1997) or ASME STD for practice of methodology named the SPAR-H method was
PRA (ASME RA-STD-2002). It is assumed that developed, and ASP was omitted from the title.
the human error probabilities (HEPs) generated A revised form for applying the SPAR-H
from the SPAR-H method will be used in PRA method, the SPAR Human Error Worksheet,
logic modeling structures, such as event trees was developed and underwent testing by NRC
and fault trees, so that there is a context inspectors. After using the method for a period
regarding how these estimates are to be of time, a number of areas for improvement
combined and their effects interpreted. were identified. These included more refined
Modifying failure probabilities based upon concepts and definitions, and suggestions for
dependency without regard to how the HEPs are enhancing ease of use. At that time, the NRCs
to be combined can result in erroneous Office of Nuclear Regulatory Research
conclusions about their potential contribution to identified two other areas for refinement.
risk.
The first refinement involved better assistance to
1.2 Background the analyst with understanding or estimating the
uncertainty associated with HEP estimates
The HRA approach presented in this document produced with the method. As an artifact of the
has its origin in some of the early U.S. Nuclear methods early reliance upon error factors,
Regulatory Commission (NRC) work in the area analysts could routinely produce upper bound
of accident precursors (NUREG/CR-4674, probabilities greater than 1 when modeling
1992). The PRA models developed under the strongly negative performance shaping factors
NRCs Accident Sequence Precursor (ASP) (PSFs). This problem was not unique to
program included aspects of HRA, however, the performing SPAR-H. Although HRA analysts
HRA involved was not developed fully. This have worked around this problem for 20 years,
specific method was designated the ASP HRA the INEEL was tasked to attempt to develop an
methodology. Although, this original approach easy to use but more suitable approach to
was adequate for a first generation of SPAR representing uncertainty information for use in
1
analysis with the SPAR models employing exclusion of human interactions from more
Systems Analysis Programs for Hands-on detailed and complex HRA analysis. The SPAR-
Integrated Reliability Evaluation (SAPHIRE) H method differs from less detailed HRA in that
software (INEEL, 2000). it requires analysts to consider dependency and a
defined set of PSFs when performing
The second refinement involved the applicability quantification. For example, analysts using
of this approach to support NRC-sponsored techniques such as the Failure Likelihood Index
model development research in the area of low Method (FLIM) or the Success Likelihood Index
power and shutdown (LP/SD) risk analysis. Method (SLIM) are free to include any number
Specifically, inquiry was made regarding of PSFs that they think apply. The SPAR-H
whether the method, as configured, was easily method also differs from some of the earlier
applied to LP/SD scenarios. When the SPAR-H time-reliability curve (TRC) methods in that the
method was first developed, there were no SPAR-H method does not rely upon time as the
SPAR models for LP/SD and, at that time, the primary determinant of performance, but rather
HRA analysts had not considered LP/SD as treats time as one of a number of important
constituting a separate class of events that could shaping factors influencing human performance.
require adjustments to the method.
1.4 Guidance in
1.3 HRA Orientation
Performing HRA
The goal of HRA is to support PRA in
identifying and assessing risks associated with A number of guidance documents are available
that can be used to support the SPAR-H method.
complex systems. PRA in conjunction with
HRA, affords analysts the ability to look at These include IEEE Guide for Incorporating
sequential as well as parallel pathways that Human Action Reliability Analysis for Nuclear
offset risk, including the human contribution. Power Generating Stations (IEEE STD 1082,
Insights are gained by applying event 1997), Systematic Human Action Reliability
Procedure (SHARP) (Hannaman and Spurgin,
frequencies to hardware failure models and
reviewing expected frequencies for various 1984), and ASME Standard for Probabilistic
hazardous end-states by condition assessments. Risk Assessment for Nuclear Power Plant
Applications (ASME RA-STD-2002). The IEEE
From the authors perspective, HRA is recommended practice for conducting HRA
performed as a qualitative and quantitative (IEEE 1574, draft) is under development and
analysis. It helps the analyst to study human when completed will also provide a framework
system interactions and to understand the impact for conducting HRA.
of these interactions upon system performance
and reliability. The SPAR-H method is used to It is assumed that a number of principles
assist analysts in identifying potential suggested in these various references will be
adhered to, including the following:
vulnerabilities. The SPAR-H method can also be
used to characterize pre-initiating actions, * Identify and define the scenario or issue of
initiating event-related actions, and post interest.
initiating event interactions. The SPAR-H
quantification is used because it is an efficient * Review documentation when possible,
and not overly time-consuming approach to including event and near-miss databases,
representing human actions and decisions in the procedures, and the Safety Analysis Report
final SPAR analysis model. Although, the (SAR).
SPAR-H method is used primarily in SPAR * Perform limited task analysis - walk down
model development and as a part of the event systems, conduct interviews, review
analysis process performed by NRC staff, the appropriate training materials, review
method can also be used to support detailed videotape and crew simulator performance.
screening analysis whose goal can be the
2
- Screen and document - build a qualitative approach to dependency and uncertainty factors,
model integrated with systems analysis. including quantification, is also reviewed.
- Quantify. Section 3 presents consideration of PSFs for full
- Perform impact assessment. power and LP/SD scenarios, examines results of
a sample application of full power and LP/SD
- Identify and prioritize modifications to approaches to a loss of inventory (LOI) scenario,
reduce risk. and reviews base error rates for diagnosis and
action tasks.
- Document.
Section 4 presents considerations when using the
1.5 Organization SPAR-H method, reviews application of the
This report is archival, that is, it contains SPAR-H method to event analysis, and
historical information regarding SPAR-H addresses use of the SPAR-H worksheets.
method development as well as provides an Section 5 presents a summary and discussion of
overview, review of technical basis, and sample the approach and compares this HRA method
applications of the method. Section 1 presents against some of the criteria for HRA as defined
the background and general HRA approach. by the new ASME PRA Standard, and the
Section 2 details the information processing- NASA PRA Guide for Managers (Stamatelatos
based model from which the SPAR-H method and Dezfuli, 2002). Last, this report contrasts the
was developed. Summary performance SPARA-H method against criteria developed by
influencing factors are introduced, task and error the authors for review of HRA methods
types are defined, and the relation of SPAR-H (Gertman and Blackman, 1994).
PSFs to other HRA methods is discussed. The
3
4
2. SPAR-H METHOD
2.1 Model of Human in operating events has been recently
highlighted. For example, a review of 37
Performance operating events at U.S. commercial nuclear
Models of human behavior are discussed in a power plants (NPPs) from 1991 through 1999,
variety of behavioral science sources that deal conducted for the NRCs Office of Nuclear
with cognition (see for example Anderson, 1980; Regulatory Research, revealed a number of
Medin and Ross, 1996). The cognitive and instances where work processes affected crew
behavioral response model developed for the demands during operating events
SPAR-H method was developed out of early (NUREG/CR-6753 2002). The errors and
cognitive science approaches and is generally failures that occurred in these events included:
termed an information processing approach to deficiencies related to design and design change
human behavior. The factors comprising the work practices (81%), inadequate maintenance
basic elements of this model also come from the practices and maintenance work controls (76%),
literature surrounding the development and and corrective action program inadequacies
testing of general information processing models (38%).
of human performance. Recently, the root cause analysis report for
Figure 2-1 presents the SPAR-H basic Davis Besse (Gertman et al, 2002) identified a
information-processing model. It shows the key number of work process or organizational
aspects of an information-processing model of factors that may have contributed to a reactor
human performance that reflects psychological pressure vessel head corrosion incident.
research. The purpose of beginning with this Implicated were a flawed boric acid corrosion
model is to account for and integrate the factors control program, and subsequent failures such as
key to human performance when performing lack of written evaluations, inadequate
SPAR-H analysis. implementation of the utility corrective action
program, and lack of safety analysis for
Review of the behavioral sciences literature and identified conditions. The root cause team also
other models suggests eight summary concluded that there was failure to take actions
operational factors, or PSFs, that we considered for identified adverse conditions, failure to
important to nuclear power plant operation. trend, and failure to provide adequate training to
These operational factors can be directly personnel. These factors point toward either
associated with the model of human inadequate work processes or inadequate
performance. In addition, these operational implementation of work processes.
factors can be linked to the portion of the human
information-processing model with which they For a more in-depth review and approach to
are associated. The relation of summary factors work process evaluation, see Weil and
to information processing model parameters is Apostolakis (2001).
presented in Table 2-1. The model is also useful
in terms of presenting the basis for how
2.2 Task Types
operational factors impact performance. The 1994 ASP HRA methodology divided tasks
Definitions of these eight PSFs follow in performed by personnel into two components,
Section 2.4.4.
the processing component and the response
The role of work processes. Work processes are component. Comments received from those
present in the model described above in terms of trying to implement the method indicate this
the organizational parameters of the model and processing and response delineation was
are present in the work processes PSF understood by human factors and HRA
included in the SPAR-H worksheets professionals working on the method, but proved
(Appendix A). The influence of work processes problematic for others.
5
Human Behavior Model
Perception
Individual
Processing
Factors
Response
Inflow of Information Filters Short Term Memory/Working Memory
External Memory
Demand characteristics of the task Long Term Memory
Factors which may impact the decision making process
Opportunity Time Goals Beliefs Organization of the perceptual field
Learning Training Demands of the task Physical and Mental Health
Crew Cognitive Skills Complexity of task environment
6
Inflow of Filters Perception Working Memory/ External Processing and Long
Information Short Term Memory Memory Aids Term Memory
Visual Management Vision Attention Environmental cues Associatively organized
Acoustic and Auditory Capacity Job Aids Scripts
Kinestinetic administrative Tactile Time Constraint Procedures Schema
Environmental Serial Processing Rate Selective recall
Sensory Store Hierarchy-based
(prior to STM) Existing Heuristics
Development of new/
Alternative strategies
Response: Implementation of decisions made
Physical strength Sensory acuity Practice/skill Time to reacttime available Existing models for behavior
Figure 2-1. Human performance model.
Table 2-1. Operational factors in SPAR-H
The numbers after each entry refer to the PSF list at the bottom of the table.
Inflow and Perception Working Term Memory/ Processing and LTM Response
Short Term Memory
4
Human sensory limits2,5,7 Limited capacity5 Training4 (models, problem solving, behaviors) Training (actions)
- serial processing * learning * existing models of behavior
Modality6,5 (verbal, visual, motion) * only good for a short * practice and skill
- echoic time2,3,5,4 (20 seconds) Experience4 (models, problem solving,
- iconic behaviors) Experience4 (actions)
- kinesthetic * learning * practice and skill
- existing models of behavior
Culture 8 (what cues are afforded the most
6,5,4,7
Right amount of attention 2,3,4,5,7 attention) Proper controls available6
Interference (signal to noise ratio)
required * learning
Cultural8 is perceived as immediately important) Human action limits6,7 (physical strength and
Rehearsal 2,3,5,7 Intelligence/cognitive skills3,4,1,5,7 (decision sensory acuity)
Physical and mental health7 making, problem solving)
Ergonomics of controls6,3
Interference factors 6,2,3,7 (distraction) complexity
Available time 1,3 Environmental degradation2,3,6
7 Physical and mental health 7 Time to react versus time available1
Summary Level Factors
1. Available time 5. Procedures(including job aids)
2. Stress 6. Ergonomics
3. Complexity 7. Fitness for Duty
4. Experience and training 8. Work processes
Note Available time, from the operators perspective is influenced by information complexity which can take more processing and reduce the time
available to act.
In 1999, these components were renamed in the In comparing the way the 1994 ASP HRA
SPAR-H method as diagnosis and action. method PSFs, the revised 2002 SPAR-H
Comments received suggested that this method, and other HRA methods treat PSFs, we
separation of task types was more easily considered the differences between mental
understood. This represents a top-level processes and the physical response, and
distinction between tasks that is often used in whether a given PSF specifically addressed one
HRA (most applications also classify actions as or both aspects of these activities.
pre-initiator, initiator-related, or post-initiator).
The result of the PSF comparisons, matched to
Within comments and task description fields of either action or diagnosis, was a list of the 1994
the SPAR-H worksheets, the SPAR-H method ASP HRA method PSFs and a comparable list of
allows analysts to use more complete PSFs from the other methods and sources. If
descriptions for tasks. However, quantification is PSFs from the 1994 ASP HRA method and the
based on the assignment of tasks to one of two comparison method differed, they were noted.
types, diagnosis or action. In some ways, this The team reviewed these differences and used
simple delineation is close to THERP in how it this information to develop the SPAR-H method
assigns tasks to quantification. When using this PSFs and definitions. The objective for the
approach, activities such as planning, intra-team completed version of the SPAR-H method was
communication, or resource allocations during to cover the important shaping factors noted in
event progression are included in diagnosis. these methods. These PSFs are present in the
human performance model presented in
When using SPAR, the analysis team makes
Section 2 (Figure 2-1).
decisions regarding the assignment of a
particular post-initiator activity to either
diagnosis or action.
2.3 Error Types
In general, there are better established HRA data In a manner similar to the PSF matching
and data sources for actions than there are for performed as part of the 2002 SPAR-H method
diagnosis and planning activities. If cognitive development process, the base error types from
activities are modeled and quantified with the the other methods were compared with the 1994
SPAR-H method and determined to pose a ASP HRA method error types. This comparison
significant contribution to risk, then analysts was considerably easier than the PSF matching.
should employ a complete HRA method. Early versions of the ASP HRA method
Complete methods include: a technique for attempted to differentiate between errors of
human event analysis (ATHEANA), (Forester et omission and errors of commission. Experience
al., 2001); cognitive reliability evaluation and demonstrated that this distinction was not useful
analysis method (CREAM), (Hollnagel, 1994); in making more accurate predictions of error.
Methode d' Evaluation del' la Reaslisation des Therefore, for the base failure rates(s) for
Missions Operateur pour la Surete' (MERMOS), diagnosis and action, the SPAR-H method uses a
(Le Bott et al, 1998); or the connectionism composite rate for omissions and commissions.
approach to human reliability, (CAHR) (Strater,
2000). In subsequent sections of this report, Since the first ASP HRA version, the discussion
these methods are discussed briefly and of omission and commission within the HRA
compared with the current SPAR-H method. community for describing error has slowly
moved toward terms such as slips, lapses, and
If the SPAR-H method is being used to evaluate mistakes. This, in part, is due to new
a task consisting of several actions and decisions perspectives, intuitively appealing, that there is
(such as is often the case with SPAR models), an important difference between slips and
both diagnosis and action tasks and their mistakes, the two frequently discussed errors of
respective worksheets apply. Tasks that are commission. The first type of commission is
proceduralized actions not requiring diagnosis termed a slip (right intention, wrong execution)
are evaluated on the action task worksheets. and the second is called a mistake (having a
8
wrong impression of what to do coupled with an * The raters dont understand the
improper action or decision). Most second processing/response dichotomy
generation HRA approaches now emphasize that
context, that is, combinations of PSFs, plant * Most of the other HRA methods recognize
conditions and situational factors, function separate diagnosis and action error types
together as a major determinant of mistakes. The and
PSF emphasis in the SPAR-H method is * Other HRA methods have organizational
intended to reflect incremental progress and factors as a PSF.
direction in contemporary HRA.
In 1999, changes were also made to ensure the
Thus, it is equally important, from a screening SPAR-H method was as broad in coverage as
perspective, to be able to address PSFs that are possible. Once the changes in error types and
assumed to contribute to context, as it is to PSFs were made, new lists were created for error
distinguish among a slip, lapse, or a mistake. types and PSFs. Eight PSFs were identified:
From a methodological perspective it is available time, stress, complexity, experience
important to emphasize that the HRA analysis and training, procedures, ergonomics, fitness for
team needs to follow an approach that duty, and work processes. These same PSFs are
systematically identifies those errors likely to present in the 2002 version; they differ only in
result in unsafe acts, evaluates the influence of terms of their description.
major PSFs, and estimates their probability of
Next, comparison matrices were created (one for
occurrence.
the new diagnosis error type, one for the new
action error type) that showed the comparison of
2.4 PSFs PSFs and their weight multipliers for SPAR-H
Many, if not most, HRA methods use PSF method PSFs versus PSFs and multipliers for
information in the estimation of HEPs. In other contemporary HRA methods. These results
general, the use of PSFs attempts to enhance the are presented in Table 2-2.
degree of realism present in HRA. The extent As part of this process, four contemporary PSF-
and resolution of PSF analysis should only be intensive methods were selected by HRA
specific enough to identify potential influences analysts for comparison. These other methods
and rate them on the corresponding SPAR-H were HEART (Williams, 1992), CREAM
worksheets. Historically, the first use of PSFs in (Hollnagel, 1994), accident sequence evaluation
HRA to modify nominal or base failure rates is program (ASEP) (Swain, 1987), and THERP
documented in THERP. The current generation (Swain and Guttman, 1983). Only one, ASEP,
of HRA methods, often referred to as second approximates a screening level approach. The
generation HRA, also uses PSF information in others may be used to support a detailed HRA
one form or another when calculating HEPs. analysis. The comparison between the SPAR-H
In 1999, changes to the ASP HRA method were method and individual HRA methods is
implemented. The changes made at this stage presented in tabular form in Table 2-3. A
were in error type, PSFs, and in their definitions. discussion of this comparison follows.
For example, the definitions associated with the 2.4.1 PSF Comparison Findings
performance shaping factors became more
expansive in nature to cover aspects of PSFs For available time, the SPAR-H method covers
being recognized in other methods. Also, some the entire influence range accounted for by the
methods distinguished between PSFs that were other methods. For example, only ASEP,
represented by a single PSF in the SPAR-H THERP, and the SPAR-H method assign a
approach. failure probability of 1.0 when there is
inadequate time available for crew response. In
The changes were made based on field-testing
terms of the lower bound, the SPAR-H method
that indicated:
9
Table 2-2. Action PSF comparison matrix. full power (PSFs=8).
SPAR-H SPAR-H HEART CREAM
PSFs SPAR-H PSF Levels Multipliers Multipliers Multipliers ASEP Multipliers THERP Multipliers
Available Inadequate Time P(failure) = 1.0 P(failure) = 1.0 - Table 7.2 P(failure) = 1.0 - Table 20.1
Time
Time available = time 10 11 - EPC 5 - CPC 20 10 - Table 7.2 10 - Table 20.1
required
Nominal time 1 1 1 - CPC 19 1 - Table 7.2 1 - Table 20.1
Time available > 5 x .1
time available
Time available > 50 x 0.01 0.5 - CPC 18 0.01 -Table 7.2 0.01 - Table 20.1
time required
Stress Extreme 5 5 -Table 7.3 5, 25 - Table 20-16
High 2 1.3 - EPC 29 1.2 - CPC 22 2, 5 - Table 20-16
1.15 - EPC 33
10 Nominal 1 1 - CPC 21
Complexity Highly complex 5 5.5 - EPC 10 2 - CPC 17 2.5 or 5 (depending on stress)
Moderately complex 2 1 - CPC 16
Nominal 1 1 - CPC 15
Experience/ Low 3 17 - EPC 1 2 - CPC 25 10 -Table 8.3 2 - Table 20-16
Training
3 - EPC 15
8 - EPC 6
6 - EPC 9
4 - EPC 12
2.5 - EPC 18
2 - EPC 20
1.6 - EPC 24
Table 2-2. (continued).
SPAR-H SPAR-H HEART CREAM
PSFs SPAR-H PSF Levels Multipliers Multipliers Multipliers ASEP Multipliers THERP Multipliers
Nominal 1 1 1 - CPC 24 1 1
High 0.5 0.8 - CPC 23 0.1 - Table 8.3
Procedures Not available 50 P(failure) = 1.0 - Table 7.1, 50 - Table 20.7
Table 8.1
Incomplete 20 5 - EPC 11 2 - CPC 14 10 - Table 20-7
3 - EPC 16,17
1.4 - EPC 28
1.2 - EPC 32
Available, but poor 5 5 - EPC 11 2 - CPC 14 10 - Table 20-7
3 - EPC 16,17
1.4 - EPC 28
1.2 - EPC 32
Nominal 1 1 - CPC 13
11
Ergonomics Missing/Misleading 50 P(failure) = 1.0 - Table 7-1, 100, 1000 - Table 20-12
8-1
Poor 10 10 - EPC 3 5 - CPC 11 6 - Tables 20-9, 11, 12
9 - EPC 4 2 - CPC 7 10 - Tables 20.10, 13, 14
8 - EPC 5, 7
4 - EPC 13, 14
2.5 - EPC 19
1.6 - EPC 23
1.4 - EPC 26
1.2 - EPC 32
Nominal 1 1 - CPC 9, 10, 6
Good 0.5 0.8 - CPC 5
0.5 - CPC 8
Fitness for Unfit P(failure) = 1.0
Duty
Table 2-2. (continued).
SPAR-H SPAR-H HEART CREAM
PSFs SPAR-H PSF Levels Multipliers Multipliers Multipliers ASEP Multipliers THERP Multipliers
Degraded Fitness 5 1.8 - EPC 22
1.2 - EPC 30
1.1 - EPC 35
Nominal 1
Work Poor 2 2 - EPC 21 5 - CPC 29
Processes
1.6 - EPC 25 2 - CPC 4
1.4 - EPC 27 1.2 - CPC 3
1.2 - EPC 31 1 - CPC 28
1.06 - EPC 36
1.03 per addl
man - EPC 37
Nominal 1 1 - CPC 2,27
Good 0.8 0.8 - CPC 1
12 0.5 - CPC 26
Table 2-3. HRA methods used in SPAR-H comparisons.
HRA Method Date Authors Focus - Purpose
Cognitive Reliability 1998 E. Hollnagel Human performance classification based on error modes &
and Error Analysis consequences (phenotypes) & causes (genotypes). Uses simple
(CREAM) Method Contextual Control Model (CoCoM) of cognition that includes
continuous revision and review of goals and intentions. Assesses
cognitive function failures & common performance conditions
(CPCs) to support failure rate estimations.
Human Error Analysis 1988 J. Williams HRA based on 9 generic tasks with nominal error rates. Analysts
and Reduction identify error producing conditions (EPCs). They function as
Technique (HEART) multipliers; their basis is in the behavioral sciences literature.
Technique for Human 1983 A.D. Swain & Developed to provide representational modeling of human actions
Error Rate Prediction H.E. Guttmann (HRA Event Trees) and estimation of HEPs. Emphasis is on nuclear
(NUREG/CR- 1278)
(THERP) power plant applications to support PRA, Provides HEP tables based
[Developed in the 1970s on data gathered from various domains.
and refined in early
13 1980s].
Accident Sequence 1987 A.D. Swain Developed to provide an efficient method for estimation of screening
Evaluation Program HEPs for pre-accident and post-accident human actions. Based on
(ASEP) Human THERP.
Reliability Analysis
Procedure
assigns a multiplier of 0.01 for instances where failure rate is multiplied by a factor of 50. ASEP
the time available is greater than 50 times the assigns a failure probability of 1.0. THERP also
average time required to perform the task. This assigns a multiplier of 50. CREAM and HEART
also is comparable with multipliers used by have no explicit assignment for situations
ASEP and THERP. CREAM allows a reduction wherein procedures are not available. Since
in the failure rate when additional time is there are many instances of personnel
available but only by a factor of 0.5. In addition, performing non-control room activities without
CREAM assigns its weighting factor by procedures, the assignment of 1.0 used in ASEP
selection of one of three common performance seemed severe. Therefore, the SPAR-H method
conditions (CPC) (CPC 18,19, or 20). adopts the THERP assessment for performance
in the absence of procedures.
Extreme stress in the SPAR-H method is
assigned a multiplier of 5. This value is higher For the ergonomics category, missing or
than those suggested by either HEART or misleading indication uses a multiplier of 50
CREAM and precisely the same as ASEP. (SPAR-H method). ASEP and THERP use a
However, it is less than the multiplier of 25 larger adjustment, ranging from a factor of 100
permissible under THERP for instances when or 1,000 (THERP) to complete failure (ASEP).
the cognitive state of the crew is such that they The SPAR-H method assigns a multiplier of 10
believe themselves to be in a life threatening for situations involving poor ergonomic, as do
situation. In the SPAR-H method, it was HEART and THERP (Table 20.10). CREAM
determined that the majority of scenarios to be limits the influence of poor ergonomics to a
reviewed would represent potential situations multiplier of 5, and ASEP does not address it.
where the extent of stress experienced would be
less than life threatening. All five approaches Fitness for Duty only included as a PSF in the
used a lower bound (i.e., multiplier of 1) to SPAR-H method and HEART. Fitness for duty
represent nominal conditions. was included in the SPAR-H method because of
its influence in a number of operating events and
Only the SPAR-H method and CREAM also based upon the uncontested behavioral
differentiate among nominal, moderate, and high sciences research on the negative impact of
complexity situations potential influence upon illness and circadian upset, including sleep
performance. The SPAR-H method assigns a deprivation, upon human performance.
multiplier of 5 for complex situations, whereas
HEART assigns 5.5 and CREAM a 2. Work processes is used as a PSF in the SPAR-H
THERP does not treat complexity as a separate method, HEART and CREAM. Both CREAM
PSF. However, recent methods such as CAHR and the SPAR-H method assign a multiplier of 2
(Strater, 2000) point out the importance of this in instances where work processes are deemed
PSF as a determinant of behavior. poor. HEART has 6 different error producing
conditions in which poor work processes are
Experience and training effects are well included. The highest multiplier available to the
documented in the behavioral sciences and analyst is 2.0. CREAM also has 4 different
training literature. The range of effect for this common performance conditions with which
particular PSF is relatively large ranging from 2 poor work processes are associated. Only
to 10 for instances representing various degrees CREAM and the SPAR-H method assign a 1 for
of training inadequacy. For situations where nominal conditions for work processes. CREAM
above average training has been implemented, (CPC 26) allows for base error probabilities to
the effect of this PSF ranges from 0.8 (CREAM) be reduced by a factor of 0.5 for instances where
to 0.1 (ASEP, Table 8.3). Neither THERP nor work processes are deemed good, SPAR-H
HEART have multipliers for situations where allows for base error rates to be reduced by a
experience and training is highly positive. factor 0.8.
In the SPAR-H method, an absence of Lastly, we note that the SPAR-H PSFs are
procedures has a pronounced effect. The base specified only to single digit precision. Other
14
methods utilized PSF factors with what may be 2.4.3 Relationship of PSFs to
unrealistic levels of implied precision. For HEPs Underlying the
example, some of the HEART multipliers are SPAR-H Method
described via two or three digits (e.g., 1.15 for
high stress), which is unwarranted. The basic human information processing model
and its relation to PSFs has been presented in
2.4.2 Discussion of PSF this report. The second major component in the
Changes SPAR-H method is the relationship of PSFs to
HEPs. The third component, the SPAR-H
PSF changes were driven by several methods approach to uncertainty analysis, is
considerations. The first consideration was presented later in this section.
consonance with the other methods. A second
consideration was a desire to achieve realistic Unlike most HRA methods, the SPAR-H
values; and a third consideration was to reserve method recognizes that a number of PSFs may
as much of the 1994 ASP HRA values as have both a positive and negative effect upon
possible, since they had been at least partially performance. For example, training is well
validated by application review by inspectors, understood to influence performance both
SPAR model analysts, and HRA practitioners. A positively (when training emphasizes the correct
final consideration was to examine differences learned responses), and negatively (e.g., when
between the two error types in PSF weights. training is misleading or absent). In other HRA
Also at this point, consideration was given to methods, positive effects on PSFs are typically
changing the 1994 ASP HRA error type-based limited to the influence of time on task
error rates. However, no changes were made to performance reliability. CREAM does make
these rates. allowance for the positive influence of time,
training, and work processes PSFs upon
Another examination was then made for internal performance. HEART addresses mainly the
and external consistency. The resulting tables detrimental effects of PSFs on performance
were presented at a meeting with the NRC on reliability.
December 2, 1998. Based on comments from
that meeting, final adjustments were made to the The SPAR-H method assumes that most PSFs
PSFs, the PSF weights, and the PSF definitions. have positive effects that should be accounted
for in the estimation of the HEP. As shown in
Following the update to the SPAR-H method, Figure 2-2, error probability increases as the
SPAR-H method base failure rates compared negative influence of the PSF grows.
favorably with base failure rates associated with Conversely, error probabilities diminish as the
the various other HRA methods. A certain positive influence of the PSF grows until some
amount of analyst judgment was required since lower bound is reached. It is important to note
many of the error types in the other methods that PSFs have a significant effect on prediction
incorporated one or more PSFs. For example, of performance reliability. For example, an
the HEART error type, Shift or restore system objective measure of fitness for duty may be the
to a new or original state on a single attempt time (in hours) since last sleep, which has a
without supervision or procedures, incorporates variable influence on the performance of
aspects of the procedures PSF and the work different individuals. This is shown by the
processes PSF. In instances where it was not distributions parallel to the HEP axis. The
possible to easily determine purely a base rate SPAR-H method models the uncertainty of the
from a composite rate, another HEP or base rate HEPs at each objective level of a PSF as a beta
was used. Further discussion of base rate function.
comparison is presented in Section 3 of this
report.
15
Greater human error
probability
1.0
Stronger error
causing effect
of the PSF
Stronger performance
enhancing effect Nominal error rate
of the PSF (1.0 E-2 for diagnosis,
1.0E-3 for actions
Lower human error
probability
Figure 2-2. Idealized mean HEP as a function of PSF influence.
Some knowledge (i.e., limited or imperfect) of to the actual situation, the completeness of our
the actual shape of the individual PSF understanding of the situation, and model
distributions is available, which therefore are uncertainty.
presented as hypothetical distributions to aid the
reader in conceptualizing the model. Composite For simplicity, the effect of each PSF on the
distributions for PSFs are assumed to be the HEP for diagnosis or action-type task used in the
same as that for any individual PSF used in the SPAR-H method is assessed through
method. However, little is known about multiplication. PSF influences are treated
composite influences of PSFs. independently as is the convention in HRA. For
a discussion of the potential relationships among
It is also assumed that the uncertainties PSFs, see Section 2.6.5. Standard HRA also
associated with PSFs affect some portion of the assumes that error can be appropriately modeled
uncertainties of the HEP. Uncertainty of the PSF with a logarithmic function. Although we
means that it is difficult in most instances to demonstrate how successful human performance
objectively establish the level of a particular may be modeled with a logarithmic function,
PSF. In addition, uncertainty associated with this may not be the most appropriate function
interactions among the PSFs influences the HEP. when these data are transformed into failure
Factors that contribute to uncertainty also space.
include the appropriateness of the nominal HEP
16
2.4.4 SPAR-H Method PSF Nominal time - there is some extra time, above
Overview and Definitions what is minimally required, to execute the
appropriate action. This is the best estimate of
This section presents, in order corresponding to the PSF level if you do not have sufficient
the SPAR-H worksheets, general definitions for information to choose among the other
the PSFs. alternatives.
2.4.4.1 Available Time Time available 5 x time required - there is an
extra amount of time to execute the appropriate
Available time refers to the amount of time that action (i.e., the approximate ratio of 5:1).
an operator or a crew has to diagnose and act
upon an abnormal event. A shortage of time can Time available 50 x time required -
affect the operators ability to think clearly and There is an expansive amount of time to execute
consider alternatives. It may also affect the the appropriate action (i.e., the approximate ratio
operators ability to perform. Multipliers differ of 50:1).
somewhat depending on whether the activity is a
diagnosis activity or an action. The application of time available to LP/SD
operation is discussed in other sections of this
2.4.4.2 Diagnosis (Full Power report.
Conditions)
2.4.4.4 Stress
Inadequate time - P (failure) = 1.0. If the
operator cannot diagnose the problem in the Stress refers to the level of undesirable
amount of time available, no matter what s/he conditions and circumstances that impede the
does, then failure is certain. operator from easily completing a task. Stress
can include mental stress, excessive workload,
Barely adequate time (< 20 min) - there is less or physical stress (such as that imposed by
than 20 minutes to diagnose the problem. difficult environmental factors). Environmental
factors such as excessive heat, noise, poor
Nominal time (~ 30 min) - there is sufficient ventilation, or radiation can induce stress and
time (approximately 30 minutes) to diagnose the affect the operators mental or physical
problem. This is the best estimate of the PSF performance. It is important to note that the
level if you do not have sufficient information effect of stress on performance is curvilinear -
to choose among the other alternatives. some small amount of stress can enhance
Extra time (> 60 min) - there is a surplus of time performance, and should be considered nominal,
(60 minutes or more) to diagnose the problem. while high and extreme levels of stress will
negatively affect human performance.
Expansive time (> 24 hrs) - there is extensive
time (a day or more) to diagnose the problem Extreme - a level of disruptive stress in which
and act. the performance of most people will deteriorate
drastically. This is likely to occur when the onset
2.4.4.3 Action(Full Power of the stressor is sudden and the stressing
Conditions) situation persists for long periods. This level is
also associated with the feeling of threat to ones
Inadequate time - P (failure) = 1.0. If the physical well being or to ones self-esteem or
operator cannot execute the appropriate action in professional status, and is considered to be
the amount of time available, no matter what qualitatively different from lesser degrees of
s/he does, then failure is certain. high stress (e.g., catastrophic failures can result
in extreme stress for operating personnel
Time available is equal to the time required - because of the potential for radioactive release).
there is just enough time to execute the
appropriate action.
17
High - a level of stress higher than the nominal diagnoses or actions (i.e., evolution performed
level (e.g., multiple instruments and periodically with many steps).
annunciators alarm, unexpectedly, at the same
time; loud, continuous noise impacts ability to Nominal - not difficult to perform. There is little
focus attention on the task, the consequences of ambiguity. Single or few variables are involved.
the task represent a threat to plant safety). This is the best estimate of the PSF level if you
do not have sufficient information to choose
Nominal - the level of stress that is conducive to among the other alternatives.
good performance. This is the best estimate of
the PSF level if you do not have sufficient Obvious diagnosis - diagnosis becomes greatly
information to choose among the other simplified. There are times when a problem
alternatives. becomes so obvious that it would be difficult for
an operator to misdiagnose it. The most common
2.4.4.5 Complexity and usual reason for this is that validating and/or
convergent information becomes available to the
Complexity refers to how difficult the task is to operator. Such information can include
perform in the given context. Complexity automatic actuation indicators, or additional
considers both the task and the environment in sensory information (like smells, sounds,
which it is to be performed. The more difficult vibrations). When such a compelling cue is
the task is to perform, the greater the chance for received, the complexity of the diagnosis for the
human error. Similarly, the more ambiguous the operator is reduced. For example, a radiation
task is, the greater the chance for human error. alarm in the secondary circuit of a PWR,
Complexity also considers the mental effort pressurizer heater activations, and additional
required, such as performing mental fluctuations in feed flow to the affected steam
calculations, memory requirements, generator are compelling cues. They indicate a
understanding the underlying model of how the possible steam generator tube rupture (SGTR).
system works, and relying on knowledge instead
of training or practice. Complexity can also refer 2.4.4.6 Experience and Training
to physical efforts required, such as physical
actions that are difficult because of complicated This PSF refers to the experience and training of
patterns of movements. the operator(s) involved in the task. Included in
this consideration are years of experience of the
A task with greater complexity requires greater individual or crew, and whether or not the
skill and comprehension to successfully operator and crew has been trained on the type
complete. Multiple variables are usually of accident, the amount of time passed since
involved in complex tasks. Concurrent diagnosis training, and the systems involved in the task
of multiple events and execution of multiple and scenario. Another consideration is whether
actions at the same time is more complex than or not the scenario is novel or unique (i.e.,
diagnosing and responding to single events. whether or not the crew or individual has been
involved in a similar scenario, either in a
Highly complex - very difficult to perform. training or an operational setting). Specific
There is much ambiguity in what needs to be examples where training might be deficient are:
diagnosed or executed. Many variables are inadequate guidance for bypassing engineered
involved, with concurrent diagnoses or actions safety functions, or for monitoring reactor
(i.e., unfamiliar maintenance task requiring high conditions during reactivity changes.
skill).
Low - less than 6 months experience or training.
Moderately complex - somewhat difficult to This level of experience and training does not
perform. There is some ambiguity in what needs provide the level of knowledge and deep
to be diagnosed or executed. Several variables understanding required to adequately perform
are involved, perhaps with some concurrent the required tasks; does not provide adequate
18
practice in those tasks; or does not expose Diagnostic/symptom oriented - diagnostic
individuals to various abnormal conditions. procedures assist the operator/crew in correctly
diagnosing the event. Symptom-oriented
Nominal - more than 6 months experience procedures (sometimes called function-oriented
and/or training. This level of experience/training procedures) provide the means to maintain
provides an adequate amount of formal critical safety functions. These procedures allow
schooling and instruction to ensure that operators to maintain the plant in a safe
individuals are proficient in day-to-day condition, without the need to diagnose exactly
operations and have been exposed to abnormal what the event is, and what needs to be done to
conditions. This is the best estimate of the PSF mitigate the event. There will be no catastrophic
level if you do not have sufficient information result (i.e., fuel damage) if critical safety
to choose among the other alternatives. functions are maintained. Therefore, if either
High - extensive experience; performers diagnostic procedures (which assist in
demonstrate mastery. This level of experience/ determining probable cause) or symptom-
training provides operators with extensive oriented procedures (which maintain critical
knowledge and practice in a wide range of safety functions) are used, there is less
potential situations. Good training makes probability that human error will lead to a
operators well prepared for possible situations. negative consequence.
2.4.4.7 Procedures Action:
This PSF refers to the existence and use of Not available -- the procedure needed for a
formal operating procedures for the tasks under particular task or tasks in the event is not
consideration. Common problems seen in event available.
investigations for procedures include situations Incomplete - information is needed that is not
where procedures give wrong or inadequate contained in the procedure; sections or task
information regarding a particular control instructions (or other needed information) are
sequence. Another common problem is the absent.
ambiguity of steps. PSF levels differ somewhat
depending on whether the activity is a diagnosis Available, but poor - a procedure is available,
activity or an action. but it contains wrong, inadequate, ambiguous or
other poor information. An example is a
Diagnosis: procedure that is so difficult to use, because of
Not available - the procedure needed for a factors such as formatting, that it degrades
particular task or tasks in the event is not available. performance.
Incomplete - information is needed that is not Nominal - procedures are available and support
contained in the procedure or procedure effective performance. This is the best estimate
sections; sections or task instructions (or other of the PSF level if you do not have sufficient
needed information) are absent information to choose among the other
alternatives.
Available, but poor - a procedure is available
but is difficult to use because of factors such as 2.4.4.8 Ergonomics
formatting problems, ambiguity, or such a lack
Ergonomics refers to the equipment, displays
in consistency that it impedes performance.
and controls, layout, quality and quantity of
Nominal - procedures are available and support information available from instrumentation, and
effective performance. This is the best estimate the interaction of the operator/crew with the
of the PSF level if you do not have sufficient equipment to carry out tasks. Computer software
information to choose among the other is included in this PSF. Examples of poor
alternatives. ergonomics may be found in panel design
layout, annunciator designs, and labeling.
19
In panel design layout, event investigations have needed information and the ability to carry out
shown that when necessary plant indications are tasks in such a way that lessens the opportunities
not located in one designated place, it is difficult for error (e.g., easy to see, use, and understand
for an operator to monitor all necessary computer interfaces; instrumentation is readable
indications to properly control the plant. from workstation location, with measurements
provided in the appropriate units of measure).
Examples of poor annunciator designs have been
found where only a single acknowledge circuit 2.4.4.9 Fitness for Duty
for all alarms is available, which increases the
probability that an alarm may not be recognized Fitness for duty refers to whether or not the
before it is cleared. Another problem exists individual performing the task is physically and
where annunciators have set points for alarms mentally fit to perform the task at that time.
that are set too near to nominal parameter values
and create a large enough number of false Things that may affect fitness include: fatigue,
alarms that the operator or crew misperceives a sickness, drug use (legal or illegal),
real alarm as a false alarm. overconfidence, personal problems, and
distractions. Fitness for duty includes factors
Examples of poor labeling include instances associated with individuals, but not related to
where labels are temporary, informal, or training, experience, or stress.
illegible. In addition, multiple names may be
given to the same piece of equipment. Unfit - the individual is unable to carry out the
Ergonomics of the plant are also called the required tasks, due to illness or other physical or
human-machine interface or the human mental incapacitation.
engineering aspects. Degraded fitness - the individual is able to carry
Missing/Misleading - the required out the tasks, although performance is negatively
instrumentation fails to support diagnosis or affected. Mental and physical performance can
post-diagnosis behavior, or the instrumentation be affected if an individual is ill, such as having
is inaccurate (i.e., misleading). Required a fever. Individuals can also exhibit degraded
information is not available from any source performance, if they are inappropriately
(e.g., instrumentation is so unreliable that overconfident in their abilities to perform. Other
operators ignore the instrument, even if it is examples of degraded fitness include
registering correctly at that time). experiencing fatigue from long duty hours;
taking cold medicine that leaves an individual
Poor - the design of the plant negatively impacts drowsy and non-alert; or being distracted by
task performance (e.g., poor labeling, needed personal bad news.
instrumentation cant be seen from a work
station where control inputs are made, poor Nominal - the individual is able to carry out
computer interfaces). tasks; no known performance degradation is
observed. This is the best estimate of the PSF
Nominal - the design of the plant supports level if you do not have sufficient information
correct performance, but does not enhance to choose among the other alternatives.
performance or make tasks easier to carry out
than typically expected (e.g., operators are 2.4.4.10 Work Processes
provided useful labels; computer interface is
Work processes refers to aspects of doing work,
adequate and learnable, although not easy to
including inter-organizational, safety culture, work
use). This is the best estimate of the PSF level
planning, communication, and management
if you do not have sufficient information to support and policies. How work is planned,
choose among the other alternatives. communicated, and executed can affect individual
Good - the design of the plant influences and crew performance. If planning and
performance in a positive manner. It provides communication are poor, then individuals may not
fully understand the work requirements. Work
20
processes include coordination, command, and In 2002, the SPAR-H method was again
control. Work processes also include any updated, this time to allow for analysts to
management, organizational, supervisory factors acknowledge additional aspects of context when
that affect performance. Examples seen in event considering dependency.
investigations are problems due to information not
being communicated during shift turnover, as well The approach is meant to highlight those actions
as inadequate communication between or diagnoses that should be further reviewed and
maintenance crews and operators. Measures could for which higher failure rates can be assumed.
include amount of rework, the risk worth of items This treatment is intended to bring a degree of
in the utility corrective action program backlog, standardization to the HRA process. Table 2-4
enforcement actions, and turnover. presents the dependency table that analysts use
to assign a dependency level. The leftmost
The shift supervisor plays an important role in column presents the criteria developed by the
work processes. Instances where the shift INEEL in 1999. The center column, the five
supervisor gets too involved in the details of an levels of dependency, is from NUREG/CR-1278
eventin contrast to maintaining a position of (Swain and Guttman, 1983). The right hand
leadership and overview in the control room column developed in 2002 represents other
may lead to degradation in command and descriptions developed for application with the
control. SPAR-H method to aid the analyst in relating
tasks, PSFs, and other aspects of context to the
Poor - performance is negatively affected by the appropriate dependency level. A brief discussion
work processes at the plant (e.g., shift turnover follows. Readers should note that discretion
does not include adequate communication about should be employed in determining whether or
ongoing maintenance activities; poor command not a dependency calculation is warranted. The
and control by supervisor(s); performance SPAR-H worksheets have a comments section
expectations are not made clear). where analysts indicate whether or not the HEP
Nominal - performance is not significantly in question is influenced by preceding diagnoses
affected by work processes at the plant, or work or actions in that event sequence. When it is not,
processes do not appear to play an important the dependency calculation should be omitted.
role (e.g., crew performance is adequate; The authors believe that dependency between
information is available and communicated). tasks arises from the knowledge or lack of
This is the best estimate of the PSF level if you knowledge of the performer of the second task
do not have sufficient information to choose with respect to the occurrence and effect of the
among the other alternatives. previous task. This dimension of knowledge cuts
Good - work processes employed at the plant across the model of human performance
enhance performance and lead to a more presented in Figure 2-1. Mental models are
successful outcome than would be the case if updated to coincide with experience and,
work processes were not well implemented and therefore, are affected by the same PSFs that are
supportive (e.g., good communication; well- shown in Table 2-3 (available time, complexity,
understood and supportive policies; cohesive stress, work processes, experience and training;
crew). procedures, ergonomics, and fitness for duty).
For example, cues such as alarms, indicators,
2.5 Dependency chart recorders, CRT-based alarm lists, are what
the operators attempt to attach to their model of
A dependency method was developed in 1994 the situation. The more accurate the cues
that yielded a dependency rating from zero to provided during training and subsequently stored
complete dependency. These levels were then by the operator, the greater the tendency that he
matched to the nomenclature in THERP. or she will take the correct action. Prior actions
21
Table 2-4. SPAR-H dependency rating system.
Crew, Time, Location & Cue Assignments SPAR Dependency Level Additional Dependency Considerations and Basis for Interpretation
(INEEL 1999) (Swain and Guttman 1983) (INEEL 2002)
Same crew, close in time, same location, with or without Complete Any of the following: Lack of feedback, misleading feedback or masking of symptoms virtually ensures
additional cues that preceding failure will cause failure on this task as well.
Situation mimics an often-experienced sequence, and sequence triggers a well-rehearsed, well-practiced,
inappropriate response. A lapse, slip, or mistake is virtually ensured.
Time demand, workload, or task complexity is such that failure on a preceding task ensures a lapse, slip,
or mistake on this task.
Same crew, close in time, different location, with or High Any of the following: Lack of feedback, misleading feedback, or masking of symptoms makes it highly
without additional cues likely that preceding failure will cause failure on this task as well.
Situations mimic an often-experienced sequence, sequence triggers a well-rehearsed, well-practiced,
inappropriate response. A lapse, slip, or mistake is highly likely to result.
Time demand, workload, or task complexity is such that failure on a preceding task makes a lapse, slip, or
mistake on this task highly likely.
Same crew not close in time, same location, no High Any of the following: Lack of feedback, misleading feedback or masking of symptoms makes it highly
additional cues likely that preceding failure will cause failure on this task as well.
Situations mimic an often-experienced sequence, sequence triggers a well-rehearsed, well-practiced,
inappropriate response. A lapse, slip, or mistake is highly likely to result.
Time demand, workload, or task complexity is such that failure on a preceding task makes a lapse, slip, or
mistake on this task highly likely.
Same crew, not close in time, same location, additional Moderate Any of the following: Lack of feedback, misleading feedback, or masking of symptoms makes it
22 cues moderately likely that preceding failure will cause failure on this task as well.
Situations mimic an often-experienced sequence, sequence triggers a well-rehearsed, well-practiced,
inappropriate response. A lapse, slip, or mistake is moderately likely to result.
Time demand, workload, or task complexity is such that failure on a preceding task makes a lapse, slip, or
mistake on this task moderately likely
Same crew, not close in time, different location, no Moderate Same as above, except no cues.
additional cues
Same crew, not close in time, different location, Low Any of the following: Lack of feedback, misleading feedback, or masking of symptoms makes it
additional cues somewhat likely that preceding failure will cause failure on this task as well.
Situation mimic an often-experienced sequence, sequence triggers a well-rehearsed, well-practiced,
inappropriate response. A lapse, slip, or mistake is somewhat likely to result.
Time demand, workload, or task complexity is such that failure on a preceding task makes a lapse, slip, or
mistake on this task somewhat likely
Different crew, close in time, same location, with or Moderate Any of the following: Likely that preceding failure will cause failure on this task as well.
without additional cues Situations mimic an often-experienced sequence, sequence triggers a well-rehearsed, well-practiced,
inappropriate response. A lapse, slip, or mistake is moderately likely to result.
Time demand, workload, or task complexity is such that failure on a preceding task makes a lapse, slip, or
mistake on this task moderately likely
Different crew, not close in time, same location, no Low Same as above
additional cues
and errors can act as current cues and establish The right hand column of Table 2-4 reflects
expectancies leading to propensities to look or combinations of factors derived from HRA
not to look for specific pieces of information. In evaluations of operating events, and application
short, previous actions or recently experienced of HRA methods such as ATHEANA (Forester
events create a mindset that guides decision et al., 2000)) that were judged by the authors to
making. relate to different levels of dependency in
THERP and the SPAR-H method.
At the first level, if the operator has no
knowledge of a prior task, then that task has no SPAR-H does not include calculations for the
effect on a subsequent task. Obviously this is influence of success upon subsequent task
meant from a cognitive perspective. For successes or failures. This decision was made
example, if a pump is damaged, this operation for a number of reasons. First, advice available
can make pump re-start impossible. If the in NUREG/CR-1278, Chapter 10, suggests that
operator has knowledge of the prior task, then if conditional probability information/data is
we must consider what that knowledge could available for the number of Failures on Task B,
affect. For example, the relationship between given Success on Task A that this probability
dependency and stress if the prior task has be used to represent the influence of positive
failed, will produce a higher level of stress. This dependency. It is our experience that these data
may influence subsequent task performance. For are, for most situations, not available and
available time, the important factor is whether collection of these data sometime in the future
excessive time required to take one action leaves could serve to make characterizations regarding
less time for the next, thereby influencing the human performance more complete. At a
failure rate. minimum, the range of effect for dependency in
success space is not well established. In practice,
A number of factors can operate to make a series there is more knowledge and agreement
of errors dependent. Some of these include: regarding the potential negative impact of
whether the crew performing the current task is dependency upon performance. For situations
the same or different than for the prior task; where actuarial data are not available and the
whether the current task is being performed in analyst wishes to assess the Failure on Task B,
the same or different system than the prior task; given Failure on Task A, we recommend use of
whether the current task is being performed in a the equations determined from
different location than the prior task; whether or NUREG/CR-1278 that are presented on page 3
not the current task is being performed close in of the SPAR-H worksheets. This approach to
time to the prior task; and whether there are dependency where dependency mechanisms
additional cues available for the performer of the contribute to deleterious effects on subsequent
current task that may serve to influence reaction performance is represented in terms of higher
time, failure rates, and recovery. than nominal failure rates.
The authors considered the following variables: Second, in NUREG/CR-4772 (1987), Swain
crew (same or different), time, location, and chose not to include calculation of the influence
cues to construct a deficiency matrix. These four of positive dependency when considering
parameters were combined into 10 rule post-accident response for either screening or
combinations, yielding a dependency rating the nominal, i.e., detailed case. In part this is due
from low to complete dependence. A eleventh to ASEP representing a simplified analysis
category, zero dependence, exists but does not method. SPAR-H is also a simplified method
appear on Part IV of the SPAR-H worksheet. and for most application modeling positive
These levels match the nomenclature used in dependency is not typically, a large concern.
THERP. Modification factors used in the Further, in supplemental guidance and in
SPAR-H method were taken from the THERP conversations Swain deferred from emphasizing
Tables. The approach was designed to be the use of positive dependency calculations, he
practical and at an appropriate level of detail for felt it more appropriate to model accident
use in a simplified HRA analysis.
23
response from a more conservative perspective. dependency such as a multiplicative approach
However, in recent years, PRA has responded to where the success of diagnosis on Task 1 [i.e.,
the need to have analysis tools that are more (1-HEPd)], is multiplied with the failure of the
realistic than conservative. Therefore, it may be subsequent action (HEPa) to yield a combined
appropriate for the U.S. NRC to examine this HEPda. Readers will note that this is familiar in
issue in more depth at a later time. terms of the approach taken to quantify HRA
event trees. While this multiplicative approach
Notice also that the Swain model presented in may be appropriate when constituting HRA
NUREG/CR-1278, discusses potential event trees, it is not a preferred approach for
differences among direct versus indirect individual HEP estimates. The reason the current
dependency influences. Examples of the former SPAR-H calculation uses a combined HEP
include the activity where an alarm associated approach is predicated on the following
with failure on Task A makes the operator more observations:
careful in his execution of Task B. Example of
the latter includes the role of PSFs such as stress 1. For the majority of applications, the HEPda
on future performance of tasks where high stress can best be conceived as a single HEP as
changes the nature of crew interaction such that opposed to a small HRA event tree
the crew would defer to the advice of the shift containing diagnosis and sub-task failures.
supervisor on all subsequent tasks where before, This type of situation is best exemplified by
they would perform required tasks in a more tasks where the line between diagnosis and
independent manner. For practical purposes, to action is blurred. For example, if in
ease analyst burden and to make SPAR-H more controlling flow an operator must first
tractable, the SPAR-H approach does not decide how much flow is required and then
differentiate between direct and indirect take a control action almost immediately, a
dependency influences. Analysts should discuss combined HEP is appropriate and is used as
dependency mechanisms assumed within the such in the SPAR models. If, on the other
body of the HRA analysis. hand the operator must make a distinct
diagnosis, such as diagnose a steam
Additionally, many of the arguments regarding generator tube rupture, and then begin a
dependency have a strong theoretical basis and series of actions, diagnosis is best modeled
the compilation of HEP dependency information as a separate task with its own HEP
would serve to strengthen all existing HRA followed by an action (or multiple actions)
methods. The field of HRA would benefit from a in response to the initial state diagnosis.
series of focused studies whose aim it was to
validate the parameters and determine 2. NUREG/CR-4772 (p. 8-8) guidance for
sensitivities for various degrees of dependency. combined diagnosis/action HEP uses an
The same is true for PSF studies. This additive approach for combining HEPs that
information could be used to enhance the fidelity represents experience and review on the part
of current HRA methods. of Sandia analysts. In their view, for
post-accident scenarios, both screening and
2.5.1 Approach to Combined nominal modeling were amenable to this
HEP Representing approach when using a simplified HRA
Diagnosis and Action method such as ASEP. Because this is a
within the Same Task standard practice and because the combined
HEP in SPAR-H represents a situation
For situations where the HEP contains elements where a combined HEP has been deemed to
of diagnosis and action, the SPAR-H approach the analyst to be preferred over separate
requires the HRA analyst in straight forward diagnosis/action HEPs, an additive approach
fashion to sum the HEP for diagnosis Hepd to formatting the combined HEP is
with the HEP for action Hepa to yield a appropriate.
combined HEPda. This was decided upon rather
than to use alternative approaches to formulating 3. The combining of diagnosis and action into
24
a single HEP should factor how the HEP is The eight PSFs undoubtedly contain some
to be used. Because we expect the HEPs overlap and are thus non-orthogonal. However,
calculated with the worksheet to represent the SPAR-H method treats these influencing
failure events as opposed to unsafe acts for factors independently. Historically, in
fault tree propagation, the combined HEP quantifying HEPs, HRA practitioners have
approach, i.e., additive, presented in treated these influencing factors as independent.
NUREG/CR-4772 is recommended. In reality, dependence is unknown when
simultaneously considering such a large group
If the combined HEP for action and diagnosis of factors (PSFs). It is unknown how this
relative to a task is to be used in a fault tree, then interrelationship affects the underlying
the HEP should be broken apart and the two probability distribution. However, a complex
HEPs, one depicting diagnosis and one, relationship is currently presumed. The relative
action should be modeled separately. relationship (i.e., correlation) of these factors to
Populating any HRA event tree (or fault tree) one another is discussed separately in this
with combined HEPs based upon the section of the report.
multiplicative approach would double count the
influence of success because of the success In defining multiplicative factors for mean
component within the failure path aB, i.e., the threshold times, a potentially large spectrum of
a portion and those similarly combined would diagnosis types is reflected. The average time
have already been accounted for in combined for diagnosis can, of course, vary as a function
HEP calculation. In addition to separating of plant conditions, PSFs, and other
diagnosis and action when constructing the HRA contributions to context. It is those factors that
event tree, the HEPs constituting the fault tree are used by the analysis team in determining
must be reviewed for dependency. Although, their best estimate of the required diagnosis
two HEP basic events may not be dependent, it time, and the time available to the crew (usually
is very likely that a portion of HEPs within the based upon thermal hydraulic calculations). A
fault tree framework underlying one of the basic number of assumptions underlying human
events will have varying degrees of dependence. performance in conjunction with plant
performance are incorporated in the SPAR-H
2.6 Uncertainty Analysis method and are presented below.
Suggestions For
Using SPAR-H 2.7 Assumptions
- There is a nominal rate associated with
2.6.1 Overview
diagnosis and action-type tasks. This is
The SPAR-H method produces a simplified best consistent with traditional HRA
estimate HEP for use in plant risk models. approaches.
- The nominal rate can be influenced by a
The application of PSF multipliers in the
number of factors as determined through
SPAR-H method follows a threshold
review of the behavioral science literature.
approach, wherein discrete multipliers are used
These factors are the PSFs. Eight such
that are associated with various PSF levels.
factors are used in the SPAR-H method.
Since these are thresholds, the multipliers do not
convey information regarding the uncertainty * For non-initiators the probability associated
associated with the multiplier. For example, a with the HEP ranges from 0 to 1. The
multiplier of 10 from the available time PSF SPAR-H method has not been designed to
does not represent a range of multipliers (e.g., work with initiators, rather analysts should
from 8 to 12). Instead, the multiplier represents a identify frequencies to be used for those
shift in the nominal HEP. Subsequent research applications.
efforts may wish to address the uncertainty
associated with the assignment of thresholds.
25
- The SPAR-H method assumes that the best distribution that dominates the overall
(i.e., the most informative) piece of uncertainty results.
information available regarding the human An artifact of the SPAR-H worksheet is the
error probability is the mean. When situation where, if the majority of PSFs are
multiplying the base failure by the PSF positive, the mean values can be less than
(multiple PSFs), the resultant value is a 1.0E-5. In this situation, a cutoff value of 1.0E-5
mean value with its own range of is suggested. For diagnosis tasks, the base rate
uncertainty. (mean) is approximated as 1.0E-2. This estimate
2.7.1 Caveats is based on our review of the literature of HRA
methods. For action tasks, the mean nominal
Some HRA approaches such as THERP and value is assumed to be 1.0E-3.
ASEP make use of lognormal error factors that
often produce upper bounds for HEPs that are HRA and human factors have not been able to
greater than one. Practitioners were aware of this demonstrate sensitivity between situations where
illogical conclusion and accept it because of failure rates may be in the E-5 versus the E-6
base assumptions regarding lognormal range. Therefore, 1E-5 is a justifiable lower cut-
distributions of human performance and off range.
inabilities to move easily away from these
Recent versions of the ASME Standard on PRA
normal and lognormal distributions as a basis for
(ASME RA-STD-2002) have suggested that
these human performance models.
analysts consider the maximum entropy
The SPAR-H method does not utilize error formulation when calculating uncertainty. This
factors nor does it assume the use of a lognormal approach is similar to that used by the SPAR-H
probability distribution. The SPAR-H method method wherein we use the CNI distribution
ultimately employs a beta distribution, which (which is a special type of maximum entropy
can mimic normal and lognormal distributions distribution). Therefore the following is
(in addition to other types of distributions). presented as a proposal as to how uncertainty
may be calculated using our approach. As a
A so-called constrained non-informative prior matter of convenience, we assume that analysts
(CNI) distribution (Atwood, 1996) is utilized for will have access to SAPHIRE (Smith et al.,
several reasons: 2000) software when performing this
calculation, but availability of this specific
- It takes on the form of a beta distribution software is not necessary.
for probability-type events.
2.7.2 Human Performance
- It uses a non-informative prior distribution
Distributions
as a starting point for the Bayesian
distribution transformation. Basic research in human performance has
- It preserves the overall mean value (after identified a number of models specific to human
multiplication of the PSFs on the nominal performance. Associated with these models are
HEP) which is the focus of the worksheet. distributions of human performance and
distributions of human error. The most
- It does not require extra uncertainty fundamental of these models are presented
parameter information such as standard below. They provide a theoretical basis for PSFs
deviations or upper and lower bounds. in SPAR-H and provide error information
- It can produce small values at the lower end supporting the uncertainty approach which
of the distribution (e.g., <1E-6), but the follows in Section 2.6.6.
upper end of the distribution more properly
Fitts Law (1953). Research by Fitts and Seeger
represents the expected error probability. (1953) is seminal work in the psychological
Note that it is the upper end of the literature examining choice reaction time and is
related to the SPAR-H method action-type. Fitts
26
found that movement time (selection) was equal diagnose, this work may have relevance for the
to the inverse log of two times the distance from SPAR-H method application.
the starting point to the target, divided by the
size of the target. The distance over size function Stevens Power Law. Stevens Power Law
is regarded as the index of difficulty (I) of that (Stevens, 1951) may have relevance for the
movement. The distribution was determined SPAR-H method PSF for training and
over hundreds of measures of hundreds of experience. This law simply states that the
subjects. The equation is provided below: logarithm of the reaction time for a particular
task decreases linearly with the logarithm of the
MT= -log(2*D/W) number of practice trials taken. Qualitatively,
the law simply says only that practice improves
Where D is the distance from the starting point performance. The law has proven applicability
of the motion to the center of the target, and W to a wide variety of different human behaviors
is the width of the target. immediate-response tasks, motor-perceptual
Hicks Law. Hicks Law regarding decision times tasks, recall tests, text editing, and more high-
represents research from the 1940s and 1950s, level, deliberate tasks such as game playing.
refers to subjects performance when presented Therefore this law is applicable to the SPAR-H
with simple choice-type tasks, and is related to method diagnosis and action-type tasks.
the SPAR-H method diagnosis task type. The Stevens Power Law suggests that, if actions are
decision times associated with selecting a choice practiced over a period of time, performance
increase according to the number of binary tends to improve. The result of his work is a
choices where: power function for performance. This could be
T = IcH modeled as the inverse, which would be a
logarithmic function. The function is:
Where Ic = 150[0-157]msec/bit
H is the amount of information required to make RT = aN-b
the decisions and is measured in bits. This
reflects the fact that people dont linearly where a = reaction time (RT) on trial 1, and
consider each alternative in the order presented b can be approximated by 0.4
when making a simple decision. Instead they use N= number of trails
a hierarchical process that classifies the
alternatives into the most likely ones first. For Additional laws for performance are associated
nearly equally probable alternatives: with these fundamental laws. For example
Meyers Law (1988) refers to rapid motions
H = log2(n+1) which may occur in human computer
interaction. This corresponds to one aspect of
When the choices carry different amounts of the SPAR-H method PSF ergonomics.
information, and/or have a different probability
of occurrence, the relationship among choices T = A + B * SQRT(D/W)
and reaction time is still logarithmic, and can be T = time to move to a target
modeled as: D = distance to target
W = width of target
hi= Log2 1/pi A ~ -13 msec
B ~ 108 msec
This formula allows H to increase as the
probability of the event i decreases. Since we Meyers Law. Meyer's Law (Meyer, 1989) is a
use time as a PSF to influence HEPs, and taking refinement of Fitts' Law for predicting the time
longer time to diagnose either due to multiple it takes for rapid aimed movements, such as
choices or to different amounts of information hitting a button on the screen by moving a
available increases the time required to mouse to it. (A and B are constants which may
27
vary with the input device.) This model suggests concentrate on the material); but higher for tasks
that this aspect of human performance can be requiring endurance and persistence (the
modeled with a logarithm function. operators need more motivation).
Meyer's Law is derived from a stochastic This arousal and performance relationship has
optimized-submovement model. This model says significance for the SPAR-H method PSF fitness
that movements consist of a primary for duty, since that PSF covers circadian upset
submovement and a possible corrective and fatigue effects. It also relates to the PSF for
secondary submovement toward a target. Meyer's stress and complexity. As a quadratic function, it
Law can be used to make predictions of how is more properly modeled as a beta than a
much time it will take for a user to accomplish a logarithmic distribution. For a discussion of the
task involving selection of targets on the screen appropriateness of using beta in uncertainty
(such as icons, menus, or hypertext links). analysis, refer to Section 2.6.6.
Another fundamental law that has driven A final example of the available models of
significant research in human performance is human performance which do not necessarily
Yerkes-Dodsons Law (Yerkes and Dodson, require the assumption of a normal distribution
1908). Yerkes-Dodsons Law states that of error is the feature model presented in Nairne,
performance is an inverted U shaped function of (1990). In fact, a variety of distributions were
attention. (See Figure 2-3 below.) In other observed in our review of the performance
words, performance is a quadratic function of literature. The transformations of these various
arousal. distributions to a beta distribution is legitimate
and preferred over ad-hoc, lognormally-based
Arousal level can be thought of as the available techniques.
capacity for work. A certain amount of arousal is
a motivator toward learning. Too much or too The feature model may have relevance for
little change can prevent learning or memory diagnosis or action tasks and is performance-
from forming. A mid-level of arousal provides based. Representations of items in memory are
the optimal level for the formation and retrieval vectors that code the features of an item using
of memories. There are optimal levels of arousal a binary system allowing features to assume the
for each task to be learned. The optimal level of values of +1 or -1. Features are pattern
arousal is lower for more difficult or intellectual elements, which can be semantic or perceptual
(cognitive) tasks (the operators need to and may be coded according to a specific
sensory modality, or modality independent,
coding information that can be conveyed equally
by one or more modalities. Thus, a series of
Optimal level alarms or other indication can come to signify a
particular plant event such as a loss of coolant
Increasing inventory, etc. The goodness of the fit between
Efficiency of memory
Increasing
alertness emotional
arousal
the alarms and signals received by the crew to
what they have been trained to expect
determines whether or not a correct diagnosis or
correct action will be undertaken.
Point of waking Cues can degrade if they are not stored properly
or if something else is experienced that
overwrites the presence of that cue. Memory
consists of finding the best match to a degraded
cue amongst a set of undegraded feature vectors
Low High
Level of arousal or stress that reside in secondary memory (SM). In other
words, based on the cues present at the time of
Figure 2-3 Arousal effect on memory recall, the operator attempts to rebuild the
28
original item from the available cues (i.e., in our log, and therefore can be modeled within the
example) reach the appropriate diagnosis. This beta distribution.
retrieval and reconstruction process can be
modeled as follows: The difference between the 2.7.3 Work Shift Effects
degraded item and its undegraded secondary
memory representation is calculated by The relationship of human performance to work
summing the number of mismatched features, shift is well documented. This factor can show
M, and dividing by the total number of up in two SPAR-H method PSFs-fitness for duty
compared features, N, as described here: as it relates to circadian and fatigue effects, and
ergonomics for the extent to which it reflects
error tolerant design based upon knowledge of
bk M k workshift effects. Dorel (1996) reviewed the
d ij = a importance of the temporal dimension in
N
influencing human performance. Even within
The value Mk is the number of times feature correct performance, there is a high amplitude
position xjk does not equal feature position xjk. effect; tasks are performed differently within
The parameter a is a scaling parameter that is tolerances dependent upon the time of day.
assumed to correspond to the overall level of Work processes may be carried out differently,
attention, and bk is used to weight particular and supervision may be also be susceptible to
comparisons if the task makes them more these influences.
important than other comparisons. Distance, d, is
then used to calculate the similarity between the Even for the lay person, reduced concentration is
degraded vector and the undegraded secondary acknowledged for different times of the day.
memory representation according to Dorel (1996) reviewed the nuclear power plant
archives in France for the period 1981 through
s (i, j ) = c
- d ij 1989, assembling data for dates and times during
which human failures occurred. Data covered
The probability that a particular secondary periods of both full power and LP/SD, and were
memory trace, SMj will be sampled as a collapsed across task type, location, and the
potential recall response for a particular number and type of operators involved. Shift
degraded memory vector PMi is then given by rotation factors were found to be important;
most failures within morning or afternoon shifts
w ij s(i, j) occur during the first part of the shift, shortly
Ps (SM j PM i ) = after shift changeover and next by failure at the
n
end of the shift. Failures across the night shift
w ik s(i, k ) were distributed evenly. However, relatively
k =1
greater errors occurred during the night shift
where wij and wik are possible response bias than during the afternoon or morning shifts.
weights. In a practical sense, the analyst would
Some 110 failures across three facilities were
review an event, determine whether cues for
documented. There was no significant
which operators were trained on for that event
correlation between facility type and the
type are present, determine whether
temporal variable under investigation; data were
new/extraneous cues yielding alternate states are
collapsed across facilities. Frequencies for
present, and then determine the match between
failure were greatest for the night shift, followed
expectancies and the true state.
by the day shift, and then by the afternoon shift.
In this model, the degree of fit with experience The difference between the morning and the
and expectancy, rather than time available, is afternoon shifts was significant (p = 0.035). The
key. This model explains and is congruent with approximate frequencies were 41.25 (night),
most memory phenomena. As shown by the 33.75 (morning), and 18.75 (afternoon),
similarity function above, this model of respectively. The authors report that rest times
cognitive performance is based upon the natural and slow versus quick alternation for shift
29
change can also influence failure. The relative Various refinements and applications of the
frequency of these effects follows a linear Rasch model have received attention. Wright
progression that can be represented in a beta and Linacre (1987) supplement the original
distribution. Rasch approach by suggesting an objective
method to determine difficulty of a test.
2.7.4 Human Performance and Frequencies are calculated for the following four
Complexity conditions:
Historically, complexity was part of information Person N
theory espoused by Shannon and Weaver (1949) Right Wrong
and others. Over time complexity has taken on Person M Right a c
many different meanings. Complexity, as used Wrong b d
in the SPAR-H method, considers multiple
factors such as difficulty, ambiguity, occurrence Because the cases where person M or person N
of multiple faulted conditions, familiarity, and answers the same is uninformative, the only
availability of job performance aids to reduce informative contrasts come from cells b and c.
and cope with the complexity, etc. The human Therefore, the probability of occurrence in cell b
performance literature has defined complexity in can be expressed as (pni) * (1-pmi)/(1-pni) * (Pmi),
various ways. One of the simpler approaches in where i refers to the test item, and Pni indicates
the early 1960s by Rasch was to define the probability of person N on item i. Thus, 1-Pni
complexity as a function of ability in the is the probability of failure of person N on item
presence of difficulty. This was assessed on an i. Cell c is similar, with the numerator and the
individual basis. This research was first denominator reversed. Through mathematical
performed to determine the relative difficulty of transformation, Wright and Linacre demonstrate
test items. Different raters were to rate the items. that the above equation could be reduced to
Normalization across rater ability was Pni/(1-Pni). This can be further transformed into
determined as part of the approach. Florin cites an equal interval linear scale with a logarithmic
Raschs model in the following manner. function with the following form:
Lni = Bn/Di Log (Pni/(1-Pni)) = Bn - Di
Where Bn is the level of ability of the nth person or
and
Pni = exp(Bn-Di)/(1 + exp(Bn - Di)).
Di is the difficulty of the ith test item.
Thus, the item or test (or task difficulty) is only
The greater the ability of the test taker, the dependent upon the attributes of item i and Bn is
higher the Rasch performance measure. the measure dependent only on the attributes of
Similarly, the greater the item difficulty, the person n, which can be called his or her ability.
lower the score or rating. This can be criticized Review of these two approaches suggests that:
because it implies that a f(Bn) = - f(Di) ability is (1) there may be merit in accounting for
the sole determinant of difficulty. This may not complexity from both a subjective, as well as an
always be the case for real world tasks. For objective measurement perspective;
example, simple tasks can be perceived to be (2) difficulty (complexity) may be more than the
difficult by able persons when there is inverse of ability; and (3) research in complexity
insufficient time available. Also, in the face of should consider the potential influence of
poor ergonomics, capable crew members performance shaping factors. Recent research
maintain their ability even though the task has addresses aspects of these three points.
been made more difficult, whereas less capable
crews do not maintain their ability as well. In Research by Braarud (2002) reports 3 simulator
either case, performance is expected to degrade. experiments in process control that establish a
This is the importance of PSFs. relationship between task complexity and the
30
performance of control room crews. In a performance, while for Study 2 (alarm system
comparison of measures employed, it was design characteristics), they were only present
determined that the mental workload measures for system performance. Highest correlations
covered in the NASA task load index (TLX) were observed for subjective complexity and
workload measures inventory were accounted systems performance. Overall, there was a
for by the concept of complexity. He proposes moderate tendency for high complexity to be
that task complexity is characterized as task associated with reduced performance.
characteristics that make it difficult to reach the
desired end state. Inclusion of difficulty as part Once the distribution of the behavior of human
of the definition is related to early work by activity (e.g., diagnosis, action) is known, this
Rasch and others in their conceptualization of information may be used in the context of
complexity. In all instances, however, the Bayesian analysis to determine HEPs and their
determination of complexity must acknowledge associated uncertainty distributions. An analogy
ability that mediates aspects of difficulty. To this from the hardware-portion of the PRA is related
end, subjective measures of complexity are to time-based component failures. For a
logical. component family that has a constant rate of
failure, the time between failures is
This approach is embraced as part of the Halden exponentially distributed. However, this
work. Complexity data collected were collateral information on the outcome (time to failure) is
to the three studies: review of the impact of combined with the assumption of a Poisson
staffing level on performance (Hallbert et al., process to determine a failure probability and
2000); evaluation of the impact of alarm system associated distribution. For the case of a Poisson
design on crew performance (Brookhaven likelihood, a gamma distribution provides a
National Laboratory, 2000) and the influence of conjugate distribution. Thus, the resulting
automation malfunctions on crew performance distribution on the component failure rate would
(OHara et al., 2000). A thirty-nine-item be gamma distributed.
inventory was designed and administered. The
researchers sought to determine whether a 2.7.5 The Categorization and
refined set of self-report items could be Orthogonality of PSFs
determined.
The majority of well-controlled studies
Three performance measures were identified: involving human performance research are
(1) operator activity against an ideal solution conducted in such a manner as to determine the
path; (2) rated performance across solution path, relationship of important variables two at a time.
control of plant, communication, and confidence Examples of this type of research were presented
as measured by trained observers; and above and are relevant to the use of PSFs in
(3) system performance as measured by general HRA.
and scenario plant specific parameter sets.
Parameter development was performed by There is limited research in the human
experts who ran simulator trials to determine the performance literature defining the simultaneous
ideal parameter set. Experimental controls were interrelationships among groups of factors that
established to minimize differences among are agreed upon to influence performance.
subjects participating in the study and to reduce Factor analysis statistical techniques have been
any differences obtained as a function of employed in behavioral sciences, but mostly to
differences among the experimental scenarios. develop inventories that can be used to assess
Subjective ratings of complexity were psycho-social (i.e., clinically relevant) traits in
significantly related to operator performance individuals as an adjunct to therapy or to aid in
(i.e., solution path, rated performance, and the job selection process. The Minnesota
system performance). For Study 3 (automation Multiphasic Personality Inventory (MMPI) is an
malfunction), significant correlations were example of an inventory that is used to support
determined for all three measures of clinical intervention and therapy as well as the
job selection processes at nuclear installations.
31
Research has also been performed to find * Stress on Complexityhigher levels of
appropriate objective and subjective measures of stress can make tasks appear more complex
PSFs, such as workload, complexity, stress, than they are
training, fatigue, and general personality and
social variables (Proctor and Van Zandt 1993; * Available Time on Stresshaving less time
Hollands and Wickens, 1999). At least one available increases stress on the individual
recent study, Hallbert, Sebok, and Morisseau
- Complexity on Time Availablei.e., the
(2000), in reviewing staffing levels for advanced
complexity of the situation is a major
and current control rooms at nuclear power
determinant of whether or not the time
plants, was able to estimate some degree of
available is perceived to be sufficient.
overlap among these measures.
Further research in HRA could be focused
In an effort to guide analyst thinking regarding
toward developing the correlations that would be
the issue of dependence and to help prevent the
assigned to each of the interaction cells.
analyst from double-counting influences when
assigning PSF threshold values in HEP 2.7.6 The CNI Distribution
quantification, the INEEL produced a table that
assigns a qualitative ranking (low, medium, or As mentioned, the CNI distribution used in the
high) of the degree of correlation among the eight SPAR-H method is a special type of maximum
PSFs. The 64-cell table, presented in Appendix G entropy distribution. Entropy, in the case of
as Table G-1, is only to be used as a guide. HEPs, represents the expectation on the
Dependence among these factors could make the logarithm of the HEP distribution. As Atwood
SPAR-H method calculated HEPs either too (1996) points out, if the HEP distribution has a
conservative or too optimistic. For example, finite range (which it does, bounded between 0
when reviewing the deleterious effects of PSFs and 1), then the function that maximizes entropy
upon performance, correlated factors will make is a uniform distribution. A limitation in
the resulting HEP more conservative than is the unconstrained non-informative distributions is
case. Conversely, when reviewing HEPs where that the mean value of a uniform 0-to-1
strongly positive PSFs are present, it is possible distribution is 0.5. Consequently, the prior
that the final HEP will be overly reduced. distribution, having a mean of 0.5, would tend to
pull the posterior HEP distribution toward a
Figure 2-4 presents an influence diagram of the mean value of 0.5. It was this limitation that
relationship among PSFs that was determined motivated Atwood to develop the CNI
based on Table G-1. The figure presents medium distribution where the constraint is that the prior
and high relationships and direct versus indirect distribution has a user-specified mean rather
influences upon HEPs. than a mean of 0.5.
From Table G-1 and Figure 2-4, a few The CNI is a single parameter distribution,
preliminary conclusions can be drawn. First the which is the mean. Once the mean HEP is
relationship may be one-way, that is PSFi may known, the analyst may use Atwood (1996) to
influence PSFj strongly, whereas PSFj may have determine an approximate distribution based
little or no effect upon PSFi. For example, upon a beta distribution. The beta distribution
available time has a strong influence on stress; requires two parameters, a and b. Atwood
however, stress has a low effect on available time (1996) supplied a table of applicable a
that is often the product of system conditions and parameters (as a function of mean HEP).
equipment unavailability. Second, some PSFs Figure 2-5 shows the numerical value of a as a
share an inverse relationship. That is, as PSFi function of the HEP. For example, using the
increases, PSFj decreases. For example, as job SPAR-H worksheet, if one determines that the
experience increases, workers may have a higher HEP has a value of 0.3, the value of a (from the
tolerance for (i.e., ability to deal effectively with) curve) is 0.42. The second parameter, b, is found
stressful situations. The SPAR-H method PSFs via the equation:
with the strongest degree of relationship are:
32
Successful
HEP performance
Improve or degrades performance
Available Available
Time to Time to
Diagnose Act
Ergonomics Stress
Complexity
Experience/
Training Fitness
Procedures for
Duty
Work
Processes
Figure 2-4. Influence diagram showing relationships among PSFs (solid lines denote high degree of
relationship, dashed lines denote medium degree of relationship), see Table G-1.
Figure 2-5. a as a function of mean HEP.
33
b = a (1 - HEP)/HEP 2.7.7 Combining Non-SPAR-H
Information with SPAR-H
In the case where the HEP is 0.3, b is found to
be 0.98. Now that both a and b are known, any Occasionally, combining disparate sources of
analysis package containing a beta distribution HEP information into a single HEP may be
may be used to determine the uncertainty desirable. For example, combining two THERP-
distribution of the HEP. For example, within based actions, each with their associated
Microsofts EXCEL spreadsheet, the 5th lognormal distribution and error factor (EF), will
percentile for the example HEP would be given result in a single HEP estimate. However, this
by the command: estimate must then be recast into a format
suitable for SPAR-H. Specifically, we would
=BETAINV(0.05, a, b) need to determine an overall mean value and,
possibly, information related to the uncertainty
where the actual cell references to a and b are distribution (e.g., the standard deviation).
supplied in the command. Figure 2-6 plots the
CNI distribution for a variety of mean values, A common method of aggregating parameters
ranging from 1E-3 to 0.8, to illustrate the span of which have uncertainty is to use the Taylor
the uncertainty distribution. For users of the series expansion. The statistical moments (mean,
SAPHIRE software, the only parameter that variance, skewness, etc.) for the overall model
must be specified is the mean value since are calculated by expanding the model equation
SAPHIRE has been programmed to in a Taylor series about the mean. What results
automatically determine the resulting associated from the expansion process is an equation for
beta distribution. the overall statistical moments that is a function
of the variable moments and the partial
derivative of the model equation.
1.E+00
1.E-01
1.E-02
1.E-03
Mean = 8E-1
1.E-04
Mean = 5E-1
Mean = 1E-1
Mean = 1E-2
Mean = 1E-3
1.E-05
1.E-06
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Percentile (x100)
Figure 2-6. CNI distribution for the HEP.
34
Most statistical texts address the Taylor series Alternatively, one may use the method of
expansion. Rather than presenting an inordinate moments to fit the approximate mean and
amount of detail, only the results of the variance to a beta distribution with that same
expansion process will be presented (Ang and mean and variance. For a beta distribution, X,
Tang, 1975). Furthermore, only two cases are we have:
illustrated, when two factors are (1) additive
(e.g., summing two HEPs into a single action), Mean(X) = a/(a + b)
or (2) multiplicative (e.g., multiplying a nominal
Var(X) = a/[(a + b + 1)(a + b)2]
HEP by a PSF).
While the approximate method described above
The approximate expected value and the
is adequate for many cases, analysis tools like
variance of the overall HEP model are (to
SAPHIRE have mechanisms built in to facilitate
second order):
model construction and analysis using Monte
ADDITIVE - HEP = HEP1 + HEP2 Carlo simulation. For example, one could simply
identify individual HEPs as basic events and
Mean(HEP) = Mean(HEP1) + Mean(HEP2) then sum those events using the compound
event feature within SAPHIRE. The
Var(HEP) = Var(HEP1) + Var(HEP2) uncertainty on the individual basic events would
MULTIPLICATIVE - HEP = HEP1 * PSF then automatically be propagated though the
model during the course of an uncertainty
Mean(HEP) = Mean(HEP1) * Mean(PSF) analysis. Nonetheless, the method described
above is a generic applicability and may be used
Var(HEP) = Mean(PSF)2 * Var(HEP1) + when needed.
Mean(HEP1)2 * Var(PSF)
2.8 Recovery
where Mean( ) is the mean value, Var( ) is the
variance (recall that the variance is the square of Recovery as used in PRA, generally describes
the standard deviation). These derivations restoration and reparation acts required to
assume that the individual parameters are change the initial or current state of a system or
statistically independent. component into a position or condition needed to
accomplish a desired function for a given plant
The mean (or expected value) of the HEP
state (ASME RA-STD-2002). In the SPAR-H
equation is a function of only two terms (to
method, recovery is modeled in the fault tree or
second order accuracy). Additional HEPs may
event tree logic structure used by the analyst.
be included in the overall HEP, but the general
Therefore, the burden to account for recovery
form of the mean remains a summation of the
within fault tree logic structure lies with the
individual means. The variance of the HEP
analyst. This is in contrast to THERP where
equation is a function of only the variance (to
review by second checkers, supervisors, or
second order accuracy) for the additive model
appearance of a second crew has a discrete value
and both the mean and the variance for the
and can be used to modify a nominal HEP.
multiplicative model.
The current approach allows the analyst to
These approximate mean and variance equations account for as many recovery combinations or
may be used to determine the aggregate opportunities as warranted, and forces this
distribution characteristics when combining consideration to be explicitly modeled in the
SPAR-H method and non-SPAR-H method logic structures.
information. Once the overall mean and the
variance are known, one may simply utilize the
mean value and select the CNI distribution, as
advocated in Section 2.6.6.
35
3. ANALYSIS
3.1 Base Rate mentioned previously in this report, was
developed for NASA primarily as a qualitative
Comparison Among human error analysis method dependent upon
HRA Methods analyst characterization of a large number of
Including the SPAR-H PSFs. The method allows for quantification and
Method a number of values from this source were
included in this broad characterization of mixed
To calibrate the SPAR-H method against other base rates available from HRA methods.
HRA methods, the base failure rates associated
The SPAR-H method base rates for diagnosis
with a number of contemporary HRAs were
and action were not changed. Since the various
compared. Table 3-1 shows the comparison of
methods compared use different base rates, with
error rates for operator or crew actions. Here the
different PSFs, with different levels of influence,
SPAR-H method base rate is toward the lower
direct comparison of method rates is difficult.
end of the rates associated with other methods.
The difficulties of comparison due to PSF Table 3-3 presents diagnosis error type base rate
entanglement in the descriptions may be even comparisons, which compare the SPAR-H
more of a problem in this comparison. Because method diagnosis base rate to the base rates for
of this difficulty, the 1994 ASP validation, and diagnosis in other HRA methods.
the firm belief of the analysts that the difference
between the diagnosis and action base rates These comparisons are still difficult due to the
needs to be maintained, no change in this base differences in definition and the incorporation of
rate was made at this time. Future full scale PSFs into many of the descriptions (e.g, ASEP,
benchmarking of HRA methods may resolve this HEART). As in contemplating base rate
issue but, resources may be better directed comparisons for operator actions as a function of
toward HRA data collections so that a better HRA methods, a more robust comparison of the
basis for rates underlying HEPs might be base rates could take place via a benchmarking
determined. exercise.
Table 3-2 shows the comparison for mixed rates. It is important to note that the SPAR-H method
That is, the table shows rates for error types diagnosis base rate of 0.01 is within the same
whose descriptions partake of both diagnosis general range encompassed by the rates for each
and action (or where a distinction cant be of the other methods. Given this and the
made.) The difficulties in making comparisons difficulty of comparison, and the fact that the
among these rates make this primarily an base rate had some initial validation in the 1994
information table included for completeness. SPAR-H method, no change in the diagnosis
One method, FRANCIE (Haney, 2002), not base rate was made.
Table 3-1. Action error type base rate comparison.
Base Rate
(5th - 95th percentile
Method Error Type Description bounds)
SPAR Action Task 0.001
HEART D. Fairly simple task performed rapidly or given scant attention 0.09
F. Restore or shift a system to original or new state following procedures, with some 0.003
checking
CREAM Tactical 0.001-0.1
ASEP Table 7-3. Screening critical action, assuming moderate stress, and no recovery. 0.05
THERP Table 20-2 Rule based actions of control room personnel after diagnosis, with recovery. 0.025
EF=10
36
Table 3-2. Mixed task base rate comparison.
Method Error Type Description Base Rate
SPAR Task involving both diagnosis and action 0.011
HEART A. Totally unfamiliar, performed at speed with no real idea of likely consequences 0.55
B. Shift or restore system to a new or original state on a single attempt without supervision or 0.26
procedures
C. Complex task requiring high level of comprehension and skill 0.16
E. Routine, highly-practiced, rapid task involving relatively low level of skill 0.02
G. Completely familiar, well-designed, highly practiced, routine task occurring several times 0.0004
per hour, performed to highest possible standards by highly-motivated, highly-trained and
experienced person, totally aware of implications of failure, with time to correct potential
error, but without the benefit of significant job aids
H. Respond correctly to system command even when there is an augmented or automated 0.00002
supervisory system providing accurate interpretation of system state
M. Miscellaneous task for which no description can be found (Nominal 5th to 95th percentile 0.03
data spreads were chosen on the basis of experience available suggesting log normality)
FRANCIE 1. Procedural Omission 0.0059
2. Error of Intent 0.085
percentile%)
3. Selection Error 0.015
4. Awareness & Task Execution Related to Hazards/Damage 0.016
5. Cognitive Complexity or Task Complexity Related 0.033
6. Inspection/ Verification 0.097
7. Values/Units/Scales/Indicators Related 0.022
8. Maintenance/Repair Execution 0.041
Table 3-3. Diagnosis error type base rate comparison.
Method Error Type Description Base Rate
SPAR Diagnosis Task 0.01
CREAM Tactical Control Mode 0.001-0.1
Opportunistic Control Mode 0.01-0.5
ASEP Table 7-2. Screening diagnosis, assumed to be under moderate stress, given 30 minutes. EF=10. 0.01
THERP Table 20.1 Screening diagnosis. EF=10. 0.01
HEART Miscellaneous task category M, no description in other tasks (A-H) fits diagnosis tasking as 0.03
well.
INTENT Misdiagnose given like symptoms. Capture sequence based on stimuli. 0.057
Competing goal states lead to wrong conclusion. 0.048
Symptoms noticed, but wrong interpretation. 0.026
37
As a result of the PSF comparison detailed in of the SPAR-H method PSFs could be defined.
Section 3, as well as additional reviews The HPED contains human factors analysis and
conducted, the following PSFs, presented in identification of PSFs culled from review of
Table 3-4, require assessment as part of the 2002 licensee event reports (LERs) and augmented
SPAR-H method quantification process. Note inspection team (AIT) reports. Also included in
that the number of levels associated within a the HPED are information about the data source,
particular PSF is, for the most part, the same for general event information, description of
action or diagnostic tasks. The exception is contributing factors, personnel and personnel
complexity, where, in the case of diagnosis, response during the event, and coding of factors
complex scenarios were more challenging for such as communication and command and
analysts to evaluate and the addition of a level control influences. A total of 196 records are
was found to allow them greater flexibility and contained in the database; 66 of those are from
confidence in their estimate(s). AIT sources, and 42 are from LERs that
correspond to ASP events. In instances where
Section 3.2 presents general definitions used to information was too incomplete for assigning
assist analysts evaluation of PSFs. Applications different PSF levels, the authors reviewed the
to operating events demonstrating the original LER or AIT sources.
assignment of PSFs are contained in Appendix F
of this report. A brief discussion of the Thirty-six event summaries were coded using
occurrence of SPAR-H method PSFs in events the eight SPAR-H PSFs and their levels of
follows. influence. Most levels of influence were present
in one or more of the events contained in the
Validation of PSFs against operating events. The HPED database. Others were simply not
PSFs in the SPAR-H method are addressed in reported. For example, LERs typically would
the behavioral sciences literature, and fit with not report that nominal time was available, or
the information processing model of human that expansive time was available. This does not
behavior presented in earlier sections of this mean that these levels of available time PSF do
report, and are present in other HRA methods. not occur, but rather, on average, PSF
As an additional check on the validity of these information tends to be reported when negative.
PSFs, the INEEL reviewed operating event Another example of this is stress. Moderate or
analyses present in the NRC Human normal stress is not explicitly called out in
Performance Event Data Base (HPED) and reports. The negative influence associated with
attempted to identify instances in which effects high stress in personnel performance tends be
Table 3-4. SPAR (2002) PSFs used in quantifying HEPs.
PSF Diagnosis Levels Action Levels Range of Influence
Available time 5 5 .01 to failure
Stress 3 3 1 to 5
Complexity 3(4)a 3 0.1 to 5
Experience/Training 3 3 0.5 to 3
Procedures 4 4 0.5 to 50
Ergonomics 4 4 0.5 to 50
Fitness for Duty 3 3 1 to failure
Work Processes 3 3 0.8 to 5
a. The number in parentheses = the number of levels associated with LP/SD
38
addressed. For example, the report for the Zion * A greater face validity and corresponding
Nuclear Station (NRC Augmented Inspection analyst confidence when compared to the
Team, 1997) shutdown event identified: a large HRA worksheets developed for full power.
number of people in the vicinity of the control
room, combined with high ambient noise, and An analysis team, consisting of an HRA
concurrent attempts at pump restoration all specialist and two operations specialists,
contributed to a high level of stress. This stress, conducted an application to an LP/SD scenario.
in turn, contributed to improper reactivity HEPs were calculated and comparisons were
control via poorly coordinated control rod made when applying the two types of
movements. This analysis, which provides worksheets. Based upon field test findings, the
evidence of SPAR-H method PSFs in high assignment of an additional PSF level for
profile events, is presented in Appendix F. procedures was made to both the full power and
the LP/SD worksheets. Also, based upon these
3.2 Comparison of PSF findings, actions for both worksheets used the
same multiples of available time ( >5 x nominal,
Weights for Low
>50 times nominal) as a result of assigning PSF
Power Versus Full influence. Therefore, the worksheets used in the
Power evaluation differed primarily in one category,
the way that time available was expressed for
LP/SD and full power conditions are generally diagnosis. Diagnostic tasks are more time
recognized to be different (more variable in the sensitive and the range and level of effect are
case of low power, for example). Therefore, therefore different between action and diagnosis.
reviews were conducted to characterize, evaluate For example, the amount of time available
the potential influence of LP/SD upon human during LP/SD for activities including diagnosis
performance, and determine whether different varies widely and generally may be less uniform
PSFs were required to characterize LP/SD, or if than the typical response time associated with
PSFs with a different range of influence or conditions guided by emergency operating
different weights were required. An additional procedures (EOPs) during full power.
level of influence for procedures was identified
and the definitions for PSF levels associated Often, tasks may not be fully proceduralized
with available time were revised. Some of the during LP/SD or, in some instances only partially
more important differences noted during this complete procedures are available. Since this may
review are presented in Table 3-5. be more prevalent during LP/SD, and workers
often can complete their assignments without
As a result of this review, changes to two PSF unduly high error rates, the SPAR-H method
influence categories, procedures and time approach to procedures was re-examined. As a
available, were implemented. No basis for result, an additional level for the procedures PSF
change in definition or range of effects for the was generated for LP/SD. Formerly, if procedures
other PSFs was identified. did not exist, the SPAR-H method would assign a
multiplier of 50 to the base failure rate. Another
After the review, an assessment was made level corresponding to limited or incomplete
whether the changes suggested in the revision procedures with a multiplier of 20 has been added
would result in: to give HRA analysts additional flexibility to
- Different values when both set of weights more accurately determine HEP estimates. Also,
were applied to the same scenario. the influence and or availability of procedures as
conceptualized in THERP and other methods did
- Analysts finding the revised LP/SD not fully include characterization of LP/SD
worksheets easier to apply to LP/SD situations, or other situations where skill of the
conditions. craft is such that it routinely overcomes the
effects of limited or partial procedures. Making it
easier for analysts to determine the range of
39
influence of procedures effect was so successful also adopted for use in the full power HRA
that this additional level for procedures effect was worksheets.
Table 3-5 Assumed differences between LP/SD and Full Power.
Full Power Mode LP/SD Conditions Comments
More safety systems available. Fewer safety systems available.
Refueling operations, mid-loop operations,
and draindown are different and performed
less frequently.
Transients are consistent in Transients are less consistent; operators in
nature and operators more control room and others do less simulator
practiced in their response. training for LP/SD activities.
Stricter limits for required Limits are less strict, greater number of
operable safety systems (how systems are down for maintenance and
many systems can be down for repair.
maintenance and repair)
Lower diversity of equipment Higher diversity of equipment Keeping track of conditions
configurations and operability. configurations and conditions for much more demanding for
operability. LP/SD.
Only 1-2 train(s) of ECCS Only 2 trains are required to be operable Varies from plant to plant, set
allowed to be inoperable. (4 allowed to be inoperable). forth in Technical
Specifications.
Fewer work activities Greater amount of work activities being Greater complexity may be
performed. performed such as tests, maintenance, and present during normally
repairs. conducted operations.
Expected equipment Abnormal equipment configurations are
configurations the norm. often times the norm.
Breached containment not Breached containment allowed under Restrictions may conflict with
allowed. certain restrictions. other desired shutdown
evolutions, such as fuel
movement.
Predictable workload during Variable, perhaps unexpected, workload
normal full power conditions. shifts during normally occurring shutdown
conditions
Most activities are formally Many of the procedures being followed Example, leak in section of PCS
practiced and are heavily consist of work orders, are more custom, sampling system, but no
proceduralized. are more diverse, and in many cases have procedure for every mile of pipe
not been tested. and elbows exists. Procedure
Use of mock-ups and practice of major must specify order of opening
activities, especially in radiation areas is and closing valves to isolate
often performed. Not as clear for non- before welders can come in. All
radiation areas. testing and equipment lineups
including what systems must be
in place to conduct tests, etc.
This will be specific to the area
being evaluated. Installation of
temporary bypasses or
modifications are specified in
the work order. None of this will
be highly practiced, compared to
startup and shutdown procedures
on which operators are tested
40
Full Power Mode LP/SD Conditions Comments
and trained.
The information contained in Table 3-5 suggests sequence and then applied the set of PSF
how to redefine or renormalize the PSFs when weights (referred to as Weight Set A)
evaluating the departure of conditions from the used when calculating HEPs for full
nominal case. That is, evaluation of deviation for power operations.
LP/SD PSFs should be conducted against what
is expected for LP/SD conditions and not 2) They subsequently performed the same
necessarily for what would represent nominal review and applied the forms revised for
conditions for full power. This is the primary LP/SD scenarios, which included LP/SD-
reason two sets of the SPAR-H method specific weights (Weight Set B).
worksheets were developed. 3) The analysts then determined the
Limited field-testing at NASA and interviews differences between the two resulting sets
with human factor analysts also indicated that of HEPs. These results are shown below
for normal operations in other domains, the in Table 3-6.
inclusion of an additional level of procedures Weights. Using the full power PSF weights
made assignment of PSF weights less difficult resulted in three of the nine HEPs associated
for analysts. As a result, an additional level was with the loss of inventory (LOI) scenario
added to the procedures PSF for both the Full receiving a higher failure rate when compared
Power and LP/SD HRA worksheets. The with HEPs estimated using LP/SD weighting
influence for the procedures PSF was not factors. The analysis team indicated that they
changed, and falls within the range of influence were more comfortable with the LP/SD weights
implied by other HRA methods. and that they believed the LP/SD resultant
values were more consistent with operating
3.3 Approach to LP/SD experience.
Comparison
Categories. In all instances, the improvements to
Table 3-5 suggested a number of differences the categories associated with time enabled
between LP/SD and full power. It was assumed analysts to assign influences that better reflected
that this might go beyond conceptualizing a their experience. The values assigned were
generally different set of conditions and lead to within the range of influence as determined by
separate SPAR-H method worksheets with review of HRA methods. Operator performance
possibly different levels of PSFs or different in the three tasks (failure to initiate reactor
PSF ranges. coolant system, failure to perform secondary
cooling, and failure to establish recirculation) all
LP/SD HRA worksheets were developed and are benefited from the extended time horizon
presented in Appendix A. available to crews.
To determine if there was a difference in HEP Although the HEPs obtained when using
results when analysts used the LP/SD HRA different PSF weights are obvious, the impact of
worksheets (i.e., PSF weights versus using the the differences upon plant risk estimates cannot
full power worksheets), a comparison of the two be determined without accounting for the
types of worksheets was made. This difference contribution of these failures in terms of
is based on a true need for a different HEP and subsequent changes in the conditional core
not just an artifact of using the SPAR-H method. damage probability (CCDP). Other samples of
This comparison was performed in the following tasks taken from different scenarios may result
manner: in different reduction ratios or similar ratios with
1) Operations and human factors analysts different impacts depending upon the initiating
separately reviewed a LP/SD event event sequence.
41
Table 3-6. Loss of inventory with RCS pressurized HEPs Comparison of PSF influence for PSF Weight
Sets A and B.
HEP # and Description HEPpsfa HEPpsfb Change Ratio
1.Failure to diagnose loss of inventory 0.05 0.05 1
2. Failure to Initiate RCS inventory makeup 0.005 0.0005 10 to 1
3. Failure to terminate loss of inventory 1.0 1.0 1
4. Failure to recover RHR 0.00025 0.00025 1
5. Failure to re-establish RCS flow 0.003 0.003 1
6. Failure to perform secondary cooling 0.002 0.002 10 to 1
7. Failure to force feed 0.004 0.004 1
8. Failure to perform feed and bleed 0.001 0.001 1
9. Failure to establish long term re-circulation 0.002 0.00002 10 to 1
3.4 Additional Field were testing concurrently. They also reported
that conceptualizing factors such as error type,
Testing PSFs, recovery and dependency, helped them to
SPAR-H method 2002 Full Power HRA develop insights regarding performance that they
worksheets were subject to limited field testing were able to convey to operations personnel.
at the NASA Johnson Space Center (JSC). In 3.4.1 Applicability of the SPAR-H
conjunction with implementation of human Method to External Events
performance assessments, including human
factors process failure modes and effects While the focus of this report was the SPAR-H
analysis (HF PFMEA), three JSC processes were method as specifically applied to full power and
selected, and a subset of tasks from each process LP/SD HEP determination, the heuristics
was subjected to a SPAR-H method evaluation. described herein may be applicable to other
The selected processes were the J-85 engine situations. For example, the SPAR-H method
refurbishment task, self-contained breathing may be applicable to external events such as fire,
apparatus (SCUBA) tank refilling operations, flood, seismic, and other special failure events
and assembly of exercise equipment required for such as partial failures, containment impacts,
the international space station. and plant physical security.
The SPAR-H method produced HEPs whose When applying the SPAR-H method to potential
likelihood followed the same general pattern of scenarios representative of a variety of
that determined as part of process FMEA. The situations, one should consider features specific
analysts were four human factors professionals to these additional situations. For example, an
who had a brief training session devoted to the external event may occur during either full
SPAR-H method during INEEL visits to JSC power or LP/SD operations and may occur
under another project. The JSC analysts found during a transition of plant operational modes.
the screening process to be easy to use. They Furthermore, the PSF impacts for an external
stated that, while the range associated with the event scenario may vary dramatically from one
procedures influence category was sufficient, an case to another (e.g., a flooding event may have
additional level for negative influences would a long-term duration, while a fire event may
make the assigned PSF weight more realistic. have a very short duration). While there is no
They also reported some subjectivity in the reason to believe that base failure rates or the set
approach, but noted that it probably was more of PSFs used in the SPAR-H method would
objective than the FMEA approach that they
42
need to be changed for such analysis, it is The analysis team had postulated that additional
possible that the PSF multipliers are not uncertainty is present in LP/SD conditions. This
applicable for these additional situations due to is because of more direct human-system
their unique character and infrequent realization. interaction, less developed procedures, changing
To better reflect an applicable HEP, it may be plant configurations, unique combinations of
necessary to investigate the driving mechanisms unusual plant vulnerabilities, and the increased
within situations such as external events. While probability of mistakes and errors of
this work is outside the current scope, the commission (see NUREG/CR-6093, 1994).
authors believe that it would be possible to
address the applicability of the SPAR-H method However, even though it was possible to create
to external events and special failure events as a error factors consistent with other HRA
part of future development activities. methods, situations still resulted where the upper
bound associated with HEPs could exceed 1.
3.5 Range of Uncertainty The analysis team decided to adopt a Beta
distribution as discussed in Section 2.6.4. The
Associated with HRA information in 3.5.1 is presented for archival
Methods purposes and to inform readers regarding
uncertainty as expressed in other HRA methods.
3.5.1 Evaluation Against Other
Methods 3.5.2 Change of Distribution Due
to Truncation
The INEEL examined other HRA methods and
bound the range of uncertainties employed by The earlier versions of the SPAR-H method
those methods. The other methods examined truncated point estimates of HEPs at 1.
(THERP, ASEP, HEART, CREAM, CAHR, and However, in the use of uncertainty distributions,
the Surry Low Power and Shutdown PRA good practice may dictate that, if the uncertainty
[Brookhaven National Laboratory, 1995]) results in a portion of the distribution being
actually set forth HEPs and uncertainty bounds greater than 1.0 or less than 0.0, modification of
(as opposed to methods that call for expert the distribution is appropriate. (Revision to
judgment of uncertainty bounds). Although distributions is considered in Section 2.6.4 of
HEART and CREAM set forth uncertainty this report.)
bounds rather than error factors, we converted
these bounds to approximate error factors for The lognormal distribution is a poor choice for
convenience of comparison. probabilities near 1.0 because it is skewed with a
long tail on the right. An alternative approach
These other methods were examined for error using beta distributions is presented, and readers
uncertainties in both diagnosis and action are encouraged to use this method.
tasksthe two error types that the SPAR-H
method uses. For example, only two HEART 3.6 Change in Time PSF
tasks were deemed by the analysis team to be
purely action tasks, whereas the rest of the Based on reviews, a major change was made to
HEART tasks were determined to be a mix of the approach used previously (1994) to estimate
diagnosis and action. the influence of time upon operator diagnosis
and action. Briefly, this entails a change to the
Table 3-7 shows the error factors from the other time horizon, where it was determined that for
methods compared to the SPAR-H (1999) Actions, minutes were not as appropriate a
method error factors. Overall, we observed measure as was a multiple beyond the nominal
convergence in error factors. (The authors time. For five times the nominal time required,
postulate that this convergence represents the HEPs are reduced by 0.1. For situations in which
seminal influence of THERP). the time available is 50 times the nominal time
required, HEPs are multiplied by a factor
ranging from 0.1 to 0.01. Selection of the
43
multiplier (e.g., 0.01) is up to the analysts
discretion. This is true for both LP/SD and full
power scenarios.
44
Table 3-7. Diagnosis and Action Error Factors for Various HRA Methods.
Mixed
Diagnosis Error Action Error Factors Uncertainty and
Methodology Factors [HEPs] [HEPs] Associated HEPs Comments
THERP 5(0.5), 10(0.05, 0.025) Screening Diagnosis - 5 for 10, 10 for
Screening 10(0.1, 0.01, 60 and under, 30 for 1 day.
0.001) Screening actions - 10.
30(0.0001)
THERP 10 (0.1, 0.01, 3(0.001 to 0.01), Larger EFs are used for HEPs smaller
0.001) 5(0.003 to 0.5) than 0.001 to reflect the greater
30 (0.0001, 10(0.0005 to 0.005) uncertainties associated with
0.00001) infrequently occurring events.
Nominal diagnosis - 10 for 30 and
under - 30 for 60 and above
3 for skipping a step, for recalling
oral instruction, reading and
recording, check reading, 10 for using
procedures in abnormal operating
condition.
ASEP Post 5(0.5) 5(0.01, 0.05, 0.25)
Screening 10(0.1, 0.01,
0.001) to 30
(0.0001)
ASEP Post 10(0.1, 0.01, 5(0.02, 0.05, 0.25, 0.2,
0.001) 0.5)
30(0.0001, 10(0.001)
0.00001)
CREAM Mostly 10 (one 3 Mostly 3 (one 10 for Approximate, since actually given as
for higher HEP) lower HEP) lower bound (LB) and upper bound
(UB), expert judgment uncertainty
bounds given for specific cognitive
function failures given in Table 9,
Chapter 9. Unspecified established
data sources for proceduralized
behaviors such as observation and
execution, mostly expert judgment
for interpretation and planning.
Error factors from 1.3 to 10
Expert judgments in Fujita and
Hollnagel (2002).
HEART 1.5 to 3 1.5 to 45 (Very Approximate, since actually given as
asymmetric for LB and UB data based 5th and 95th
very low HEPs) percentiles are defined for the generic
tasks and used in the normal HEART
calculation to produce bounds.
CAHR Similar to THERP Similar to THERP Per personal communication from O.
Strter (2002). Applied Bayesean
update to data from incident data base
and then transferred into HEPs using
Rasch model. Coincidentally, these
values are in the same range as
NUREG/CR 20 ( x > 0.000001; 5(x < 0.001) For Action (A), Recovery (R), and
6144 < 0.0001) 3(0.001 < x < 0.1) Diagnosis (D) events, uncertainty
(0.1< x) follows a lognormal distribution.
SPAR-H 10 3 Beta distribution adopted (2002).
SPAR-H Beta distribution adopted (2002).
LP/SD
45
For diagnosis, time is considered differently. For situations where, unlike full power scenarios,
full power, extra time is assigned a multiplier of time has such a wide range that it is more logical
0.1, expansive time (i.e., greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) to speak of multiples of this time than to try to
is assigned a multiplier of 0.01. For LP/SD assign a single estimate. In estimating the
conditions, extra time is defined as less than or influence of expansive time, analysts should
equal to 2 x nominal; expansive time is defined make use of structured expert estimation
as greater than 2 x nominal. This reflects: methods such as those referenced in ATHEANA
(1) analysts greater uncertainty in assessing (Forester et al., 2000). The new structure for this
time available during LP/SD, and (2) LP/SD PSF for diagnosis and actions is listed below.
Diagnosis Available Time influence for LP/SD is now structured as:
Available Inadequate time P(failure) = 1.0
Time Barely adequate time (approximately 10
2/3 x nominal)
Nominal time 1
Extra time (<2 x nominal) 0.1
Expansive time (>2 x nominal) 0.1 to 0.01*
- analyst's choice depending on complexity of diagnosis including multiple factors such as available help, and likelihood of
additional cues
Action Available Time for both LP/SD and full power is now structured as:
Available Inadequate time P(failure) = 1.0
Time Time available is approximately 10
equal to time required
Nominal time 1
Time available is > 5x the time 0.1
required
Time available is > 50x the time 0.01*
required
- analyst's choice depending on complexity, PPE, work environment, and ease of checking and recovery
By eliminating the assessment of specific times, Technical Support Center (TSC), and
which is difficult for LP/SD situations, the Emergency Operations Center (EOC).
analysts are allowed to estimate a range rather
than a specific value. Table 3-8 presents Further Assumption(s). It is further assumed that
hypothetical examples of how using the range infrequently performed, difficult diagnoses (of a
for expansive time can be applied to address the problem) will benefit more greatly from
influence of time for different situations additional time than will routinely performed
surrounding two basic events associated with diagnoses. Complex, infrequently performed
LP/SD. The other two examples address the actions such as unique evolutions may also
influence of time upon diagnosis during an benefit from additional time. However, previous
LP/SD event. HRA approaches have narrowed the definition
of time for diagnosis by use of minutes. This
Time Advantage. Having 3 times the amount of may correspond to expected crew performance
time it normally takes the operators to place the under full power conditions. Use of a nominal
system in service gives the operators more time estimate, given the context, appears to be more
to recover from their own errors, to troubleshoot, meaningful. In general, additional time may be
realign misalignments, and communicate with expected to be beneficial in complicated
others outside the control room, such as shutdown situations involving diagnosis. The
auxiliary equipment operators that may be four events represent basic events that could
required to perform local manipulations, and, occur in various LP/SD sequences. In general,
during emergencies, personnel staffing, the increased pressure will result in increased loss of
46
Table 3-8. Influence of expansive time on base failure rates.*
Influence of HEP reduction
Item Event Description Complicating Conditions Expansive Time factor**
1 Diagnose Loss of Inventory Small leak with concurrent High 0.01
loss of 125 volt
instrumentation power
complicates diagnosis.
2 Diagnose Loss of Inventory Small leak, no adverse or Very low No reduction,
complicating conditions. Nominal rate
applied
3 Establish Residual Heat Loss of bus leading to loss of High 0.01
Removal Recovery power to shutdown cooling. (Additional time allows for
jumpering of leads, etc)
4 Establish bleed Loss of bus leading to loss of Low 0. 1
power to shutdown cooling. (Bleed can be performed
across multiple systems,
single bus assumed not to cut
across a great number of these
systems)
- As applied to potential basic events for a pressurized water reactor (PWR) LP/SD Scenario, loss of inventory (LOI) with RCS
pressurized
- Value multiplied against the base error rate for available time PSF.
inventory over situations where the reactor loss of power to shutdown cooling. In this
coolant system (RCS) is not pressurized. Two situation, the influence of expansive time is
events correspond to diagnosis of this loss of thought to be relatively low. Bleed can be
inventory (LOI) sequence. In the first instance, a performed across multiple systems, and a single
small leak with concurrent loss of 125V bus failure will most likely not affect a great
instrumentation is postulated. The concurrent number of these systems.
instrumentation fault increases complexity for
the crew and complicates the diagnosis. Additional Discussion. Most PSFs were easily
Expansive time in this situation is likely to allow assigned across domains (i.e., LP/SD and full
for the crew to achieve the proper diagnosis. power). In general, bad procedures are bad
procedures, high stress is high stress, and their
In the second diagnosis basic event, there are no influence can be assessed for any domain of
complications and in most situations, the crew interest. The context may influence whether or
will have ample time to make the correct not a certain level of stress has been reached and
diagnosis. In this instance having expansive time the extent of the influence for stress or other
will not appreciably change the outcome. PSFs remains influenced by other PSFs as well.
The HRA worksheets are similar enough that
In the third basic event, as part of response to there may be merit in determining whether the
LOI, the crew must establish residual heat available time domain for full power diagnosis
removal (RHR). This is made more difficult by should be reconsidered.
the occurrence of a second fault, loss of bus
leading to loss of power to shutdown cooling. The traditional HRA approach used in the 1999
The advantage of expansive time is that it allows SPAR-H method worksheets that guided
for additional activities such as jumpering of analysts to evaluate available time in terms of
leads inside of cabinets, coordination between minutes in order to assign a multiplier is better
auxiliary operators and the control room, etc. suited for some situations than others. For
example, the SPAR-H method assigns a
In the final example, the crew must establish multiplier of 10 in instances where only
bleed after LOI with the additional complication 20 minutes may be available for diagnosis. For
presented in basic event 3, loss of bus leading to some situations, this may be enough time. For
47
particularly difficult diagnostic situations having Similarly, our approach to complexity ratings for
one hour available may not be enough (the diagnosis tasks executed during LP/SD employed
associated SPAR-H method multiplier for one an additional level of complexity that refers to
hour is 0.01, which reduces the base failure rate situations where the diagnosis is obvious. The
by a factor of 100). Much of the technical basis multiplier associated with obvious diagnosis is 0.1
for the multipliers associated with available time and was determined after reviews with systems
used in HRA methods comes from diagnosis analysts and license examiners at the INEEL. The
curves present in older human cognitive comparison of HEPs for the two worksheets did
reliability (HCR) methods. not detect any difference between the two coding
systems for the complexity PSF, but this is a likely
The use of multiples of nominal time as a basis function of the LP/SD loss of inventory scenario
for assigning diagnosis multipliers for full selected for review. According to operator and
power, as is done for LP/SD in the SPAR-H HRA analyst evaluation, the diagnosis task
method, may be a better approach. As a starting reviewed was not highly obvious. If this level of
point, the same PSF definitions used in LP/SD complexity and multiplier were determined to be
for diagnosis (i.e., inadequate time available; 2/3 applicable to full power scenarios, then a single
nominal; nominal, < 2 x nominal; and > 2 x worksheet approach would be possible.
nominal) could be used to assist in formulating
estimates. If this were done, one worksheet
could be used for both HRA applications.
48
4. CONSIDERATIONS WHEN USING THE SPAR-H
METHOD FOR FULL POWER AND LP/SD
APPLICATION
4.1 Prerequisites largely absent, ATHEANA provides an expert
elicitation process for determining those
Before using the SPAR-H method, the analyst conditional likelihood estimates. ATHEANA
needs considerable knowledge of the tasks and therefore offers a detailed process for
contexts to be rated. To this end, part of the uncovering errors of commission and associated
ATHEANA (Forester et al., 2000) HRA process is error-producing conditions.
described below, as an example of a structured
method to obtain the kind of knowledge needed The ATHEANA method makes use of HFEs that
before the SPAR-H method may be used. The represent actions or decisions represented in the
process described is the ideal situation. In building PRA event tree, and unsafe acts (UAs) that are
SPAR models, resource limitations, including modeled in fault trees. Multiple UAs can result
access to utility trainers and operators, will often in either similar or different HFEs. The process
preclude complete ATHEANA-like applications. is iterative in nature and has been applied to a
ATHEANA has the following advantages: its number of PRA issues such as pressurized
search process is rigorous, it differentiates among thermal shock, steam generator tube rupture, and
unsafe acts and human failure events (HFEs), and fire analysis. It has also been applied
it acknowledges the importance of PSFs and retrospectively to a number of high profile
context. Unsafe acts are usually modeled in fault events at U.S. commercial nuclear power plants.
trees and support the refinement and quantification The ten-step process is outlined briefly below. It
of HFEs. Human failure events often correspond to is assumed that the team has already been
basic events in the PRA model. Other HRA assembled and trained.
approaches include SHARP (Hannaman and
1. Select the issue. Define the issue, interpret
Spurgin, 1984), IEEE 1082 (1997), and ASME
what needs to be done, list objectives and
RA-STD-2002, all of which can provide an
human performance concerns.
overview of the HRA process.
2. Define the scope. Select the initiating
ATHEANA Search Process. The ATHEANA
event classes and initiating events for
HRA offers a ten-step search process compatible
analysis, and set priorities on
with PRA. This approach deviates from most
characteristics of event sequences.
first generation HRA approaches (such as
THERP, ASEP, HCR) in that ATHEANA 3. Describe the base case scenario. For a
explicitly requires the PRA analyst to identify given initiator, identify the nominal
deviations from base case scenarios normally operator and plant behavior. Begin with
considered in PRA. The HRA analyst must then operationally well-defined scenario(s) and
assess the vulnerabilities in the operators well understood physics. Understand the
knowledge base (Step 5) in concert with trajectories of main parameters which
complicating factors (Step 7) for the scenarios. provide a basis from which to identify and
For non-deviation base case scenarios, there are define deviations. Information sources
various methods and data that apply. However, include the Final Safety Analysis Report,
the HRA process associated with ATHEANA parameter plots, thermal-hydraulic
also involves estimating the error-forcing analysis, procedures, and operator training
context for base case deviations and the requirements.
conditional likelihood of an HFE given that
context. Since HRA data for complex, 4. Define HFEs and UAs. Review critical
infrequently observed or considered contexts functions required to mitigate event,
with potential to challenge operators are often identify operator actions and decisions
49
that could degrade critical functions, and 9. Quantify.
produce a list of key actions of concern.
10. Document.
5. Identify potential vulnerabilities in
operator and crew knowledge base. 4.2 Using the SPAR-H
Identify tendencies and informal rules, Method for a SPAR
and evaluate combinations of information Base Model
rules and emergency operating procedure
(EOP)s for vulnerabilities. Sources of The analyst creating a SPAR base model for a
information include plant procedures, plant uses the SPAR-H method to assign failure
human-machine interface, and training probabilities to human actions or diagnosis that
that lead to operator rules, and available correspond to (or are contained by) basic events
EOPs. in the SPAR-H method event trees for the plant.
6. Search for Deviation from the base case Given that a human action has been selected for
scenario. ATHEANA has advanced a evaluation, the analyst should complete a SPAR-
non-traditional discovery process for H Human Error Worksheet. The specific
determining new context(s) for operating information the analyst needs at this point is:
events. This is more applicable to event * The SPAR-H method event tree(s) or PRA
reconstruction or plant specific event tree containing the action, and an
prospective analysis. It is less common understanding of the context in which the
for development of basic plant models. As action is taking place.
part of this process, identify physical
deviations from the base case, as well as * Whether or not the human action involves
how initiators can be different. At this diagnosis or is entirely action.
stage, the analyst identifies key PSFs and
- The available time, as defined in the SPAR-
associated error mechanisms, develop
H method, for the human action.
system and support dependency matrices,
and review the potential dependent effects * The level of stress, as defined in the SPAR-
of pre-initiator human actions. H method, affecting the human performers
of the action given the context.
Analysts also identify operator tendency
and error types and match various UAs * The complexity, as defined in the SPAR-H
and HFEs. The deviations from the base method, of the human action.
case, when defined, help to establish the * The relationship of the task to proceeding
error- forcing context (EFC).
failed tasks in terms of crew, time, location,
7. Identify complicating factors and links to and cuesall as defined in the SPAR-H
various PSFs. This step includes method.
determination of additional physical * Additional PSF information corresponding
conditions, hardware failures, to the PSFs used in application of the
configuration problems, unavailability method.
problems, missing or misleading
indication, and confusing plant The above information should enable the analyst
conditions. In addition, this step serves, in to rate on the first three PSFs (Available Time,
general, to expand the definition of error Stress, and Complexity) on the SPAR-H Human
forcing context. Error Worksheet. The ratings of the last five
PSFs (Experience/Training, Procedures,
8. Evaluate recovery factors. The analyst Ergonomics, Fitness for Duty, and Work
completes EFC and HFE definitions by Processes) on the SPAR-H Human Error
considering the opportunities for Worksheet should be marked on the nominal
recovering from initial errors. rating. This is because these five PSFs are event-
50
or plant-, or even personnel-specific and thus * The quality of the ergonomics, as defined in
should not be considered at other than a nominal the SPAR-H method, of the plant controls
level for the SPAR-H method base model, which and displays used in performing the action.
is applied across events, plants, and personnel.
The opposite is true when using this method in * The fitness for duty, as defined in the
event analysis. In that case, plant operating SPAR-H method, of the personnel
experience, NRC notices, enforcement actions, performing the action.
root cause corrective efforts, etc., can be used as * The quality of the plant and personnel work
forms of evidence when assigning a value to processes, as defined by the SPAR-H
these five PSFs. This is explained in detail in the definitions used in the performance of the
following sections action.
Typically, dependency is refined as a part of In summary, to use the SPAR-H method for
plant-specific analysis. This is because plant operating event analysis, the analyst examines
specifics may increase or lessen levels of the changed context of a given human action and
dependency as a result of equipment choice, decisions during the event, and decides whether
configuration, or work practices. or not to change any of the eight PSFs or
dependency factors on the base models SPAR-
4.3 Using the SPAR-H H Human Error Worksheet. A new SPAR-H
Method for SPAR Human Error Worksheet should be completed if
Event Analysis any changes are warranted. Practically speaking,
few event reports contain the kind of detail that
The starting point for using the SPAR-H method will allow an analyst to make extensive changes
for event analysis is the SPAR base model of the from the base model. However, these reports do
plant to be analyzed. To analyze a selected human provide an understanding of a degraded situation
action of interest in an event analysis, the analyst that can provide the basis for updating PSFs in
first refers to the SPAR-H Human Error the existing model. Much more likely, only a
Worksheet completed for that human action in few specific facts will be contained in the event
support of the SPAR base model for the plant. reports that will provide evidence for differences
The analyst then goes through the SPAR-H between the base model and the event.
Human Error Worksheet point-by-point, deciding
whether the context of the event being analyzed 4.4 Sources of
requires that changes be made to the base model Information for
analysis. Event analysis is event-specific. Applying the SPAR-H
In addition to reviewing equipment availability Method to Events
associated with the event, the analyst must now
consider in detail, information about the five The analyst can probably never have too much
PSFs that were automatically rated nominal on information on which to base SPAR-H method
the base models SPAR-H Human Error ratings. Generally, the problem is just the
Worksheet. Additional information that the opposite. Primary sources of event information
analyst normally receives at this point is: are licensee event reports, augmented inspection
team reports, and the NRCs Resident Inspector
- The quality of the experience/training, as (RI). In recent events (such as the degraded
defined in the SPAR-H method, of the plant condition of the reactor vessel head discovered
personnel performing the action. by Davis Besse) a root cause analysis team
report also maybe available as a source of PSF
- The quality of the plant procedures, as
information. Table 4-1 presents some
defined in the SPAR-H method, used in
suggestions on where the analyst may acquire
performing the action.
the needed information for the eight PSFs and
four dependency factors used on the SPAR-H
51
Human Error Worksheet. The nominal ratings average and the case where insufficient
on the SPAR-H Human Error Worksheet are information is available to assign a rating.
intended for use where ratings actually are
Table 4-1. PSF sources of information for SPAR-H
Needed Information Source(s)
Available Time Is nearly always available in both LERs and AIT reports.
Stress More likely to find information about stress in an AIT report than an
LER, but in either case it will most likely require some inference on
the part of the analyst. More likely to find physical and environmental
stressors reported directly. Resident Inspector (RI ) and Plant
Management (PM) sources. NRC operator examiners if available.
Complexity RI and NRC operator examiners if available.
Experience/Training AIT report may list for an individual and may comment on
shortcomings of training programs. Less likely to find in an LER.
Operator examiners if available.
Procedures May be able to request procedures used and evaluate personally.
Otherwise LERs sometimes and AITs almost always contain
procedures review.
Ergonomics Explicit only in some AIT reports where ergonomics were a concern
and a human factors expert was part of the team. However, can often
infer, even from LER.
Fitness for duty Only available in an AIT report, LERs almost never contain this
information. RI and PM are other sources.
Work processes May be able to infer from an LER. Deficiencies generally detailed
explicitly in AIT reports. RI and PM are other sources.
Dependency factor Crew Usually in LERs and AIT reports. RI is another source.
Dependency factor Time Usually in LERs and AIT reports.
Dependency factor Location Generally in LERs and AIT reports.
Dependency factor Cues Much more likely to find in an AIT report than in an LER.
Other sources of information that may be of use * Event reports from other plants on similar
to the SPAR analyst include: events.
- Morning report for the event. * Inspection recommendations.
- Plant procedures. 4.4.1 Completing the SPAR-H
Human Error Worksheet
- Other inspection team reports about the
plant. The steps below describe the mechanics of
- Plant layout diagrams and control room completing the SPAR-H Human Error
Worksheet. This applies to full power and
panel diagrams or pictures.
LP/SD for base models and events.
- Operator exam results.
1. Enter header information at the top of the
- Plant training materials. first page of the SPAR-H Human Error
52
Worksheet, whether the sequence * Rate the eight PSFs for the action portion of
evaluated is full power or LP/SD: the basic event human action by marking
one checkbox for each PSF. Note that any
- The name of the plant being rated (e.g., time a non-nominal rating is made, the rater
Peach Bottom 2). should document the reason for the rating
- The name of the particular SPAR initiating in the block to the right. When there is
event being rated (e.g., Loss Of Off-Site insufficient information on which to make a
Power). rating, use the nominal rating.
- The basic event code for the basic event * Transfer the multipliers next to the marked
being rated. This code is present as part of checkboxes to the blanks in Section B(2) at
the PRA model. the bottom of the second page of the
worksheet. Multiply the string of
- The context of the basic event being rated multipliers by 1.0E-3 to calculate the action
(e.g., the previous basic events in this failure probability.
particular sequence on the SPAR event
tree). 6. Enter abbreviated header information
from first page at the top of the third page
- The description of the basic event being of the SPAR-H Human Error Worksheet.
rated (e.g., operator fails to throttle high
pressure injection to reduce pressure). 7. Complete Part III Calculate the Task
Failure Probability Without Formal
2. Decide if the basic event human action Dependence
involves diagnosis and, if so, mark the
proper checkbox. Use the Why? line * Transfer the diagnosis failure probability
below the checkboxes to describe why from page 1 (if diagnosis is involved) and
diagnosis is or is not involved. If the action failure probability from page 2 to
diagnosis is not involved, skip Step 3 and the blanks in Part III on page 3.
proceed with Step 4.
- Calculate the task failure probability
3. Complete Part I Diagnosis. without formal dependence by adding the
diagnosis failure probability to the action
- Rate the eight PSFs for the diagnosis failure probability.
portion of the basic event human action by
marking one checkbox for each PSF. Note 8. If the basic event being rated is the first
that any time a non-nominal rating is made basic event in the sequence, stop here. If
the rater should document the reason for the the basic event is not the first basic event,
rating in the block to the right. When there proceed to Step 9.
is insufficient information on which to 9. Decide if there is a reason why failure on
make a rating, use the nominal rating. previous basic events should not be
- Transfer the multipliers next to the marked considered in the rating of the present basic
checkboxes to the blanks in Section B(2) at event. If, for example, different personnel
the bottom of the first page of the are involved and have no knowledge of
worksheet. Multiply the string of previous tasks, and there are new cues for
multipliers by 1.0E-2 to calculate the their tasks, this may make some proportion
diagnosis failure probability. of their actions independent from these
tasks. In other cases, previous tasks may
4. Enter header information from first page increase or decrease subsequent difficulty,
(see Step 1 above) at the top of the second and thus, some degree of dependency may
page of the SPAR-H Human Error be present. If there is a reason for not
Worksheet. considering HRA dependency
5. Complete Part II. Action. quantification, then document the reason(s)
53
on the line at the top of Part IV and stop * Adjust the level of dependency if a second,
here. If not, continue with Step 10. third, or fourth checker is being modeled as
part of recovery. For example If the event is
10. Complete Part IV Dependency the third basic event (second checker) in the
sequence, dependency must be no less than
- Decide whether the crew performing the
moderate; if it is the fourth event (third or
basic event is the same crew that failed the
fourth checker), the dependency must be no
previous basic event in the sequence.
less than high. If there is a compelling
- Decide whether the basic event is close in reason for less dependence, do not apply
time to the previous failed basic event in the rule, but document the reason in the
the sequence. This range extends from a block above the rule.
few seconds to a few minutes. * Calculate the task failure probability with
formal dependence by transferring the task
- Decide whether the basic event takes place failure probability without formal
in the same location as the previous failed dependence from Part III into the equation
basic event in the sequence. for the proper level of dependence.
- Decide (if not close in time) whether
additional cues were available following
the previous failed basic event in the
sequence. These cues can be additional
parameter displays, alarms or procedures
and procedural steps providing guidance to
the operator.
- Follow the choices on the four bullets
above through the dependency condition
table to arrive at a level of dependency (low
to complete).
54
5. DISCUSSION
5.1 Differences between The data collection efforts of this endeavor have
resulted in the identification of several important
Full Power and LP/SD influences on human performance during
A number of significant differences between the LP/SD. The evaluation of reports, event-based
human actions, errors, and influences important data sources, and interviews identified
to full power operations and those important to procedures, human engineering, training,
LP/SD operations have been identified. organization factors, and communications as
significant contributors to human error and
Aspects of the following features are identified actions. This is consistent with the set of PSFs
as unique and important to LP/SD operations: used in the SPAR-H method. Complexity was
the kinds of human interaction and events; the not explicitly referenced in these reports, but
classes, modes, and types of human errors (and was thought to be implicitly evident by the
actions); influences on human performance; and members of the analysis team. This was verified
plant conditions and configurations. Unlike full by discussions with formerly licensed operators.
power operations, all classes of human actions
and errors (i.e., initiator, pre-accident, and Procedures are important in modeling human
recovery) seem to play a significant role in errors in full-power PRAs. However, just as with
LP/SD operations and events. In particular, LP/SD, communications, complexity, and
human-initiated events usually are not explicitly influences such as situation awareness are not
treated in full power PRAs. It is typically always explicitly incorporated as influences on
assumed that human-initiated events while at human performance at full power. The event-
full power can be captured in data collected at based data evaluations strongly indicated that
the component, system, or plant level and have contributions from multiple influences are
no detrimental impact on response following the common for human actions and errors during
initiator. For LP/SD events, however, human- LP/SD and full power events. Also, the available
induced initiators both inside and outside the time for event response, frequently an important
control room constitute a significant portion of fact in human performance at full power, does
observed errors. In addition, dependencies not appear to be as critical during LP/SD.
frequently exist between the activities leading to (Exceptions are likely for events initiated shortly
the initiating event and those required for after shutdown when decay heat is high, and for
recovery. events that can progress unnoticed for extended
periods of time).
Data evaluations indicate that the mistakes
versus slips subset of commission dominates the In the context of nuclear power plant operations,
types and modes of human errors, which occur workload and stress are often closely related.
during LP/SD. In addition, mistakes occur both Increased workload and stress were often cited
inside and outside the control room during in the literature as potential contributors to
LP/SD. The more direct human-system human error during LP/SD. The presence of a
interactions characteristic of LP/SD operations much larger staff, including less-experienced
can result in mistakes, which in turn, lead to personnel at the plant, as well as the influence of
unwelcome consequences. In contrast, the extended work periods, can play significant roles
human errors explicitly modeled in full-power in increasing the workload of operators.
PRAs are typically errors of omission (for However, plant staff interviews indicated that
example, the NRC Generic Letter 88-20 does high workload and stress, while potentially
not require errors of commission to be modeled significant during LP/SD, did not appear to be at
in licensee individual plant examinations), and detrimental levels at the plant. It was stated that
when mistakes are included, only in control during an outage, the size of the operations crew
room errors are typically modeled. is expanded and the shift organization is
changed to minimize the impact of the increased
55
workload and to reduce the stress of outage of Despite these differences in uncertainty
operations. These measures were cited by the regarding day-to-day operations and in
staff as effective in minimizing the impact of personnel availability, the SPAR-H method has
outage operations on workload and stress. kept the same PSF grouping used for full-power
Therefore, the authors believe that the addition operations. Many influences such as shift work
of personnel may serve to increase effects, time of day, and other personnel factors
organizational load as opposed to individual are captured under the fitness for duty PSF.
load. Increased organizational load can result in Reliance upon work orders as opposed to more
unsafe acts leading to human failure events. formalized procedures is captured under work
Perhaps future research will evaluate staffing processes. Until progress in determining the key
and organization factors more directly. aspects of work process factors such as safety
culture upon risk can be placed in a qualitative
Unlike full-power operations, LP/SD operations framework, they are best handled as PSFs whose
are routinely performed under complicated effects are multiplied against base failure rates.
conditions. For example, much greater emphasis
is placed on manual control actions. Also, 5.2 Compliance with
personnel not normally at the plant (e.g.,
headquarters engineers and contractors) and
ASME Standard on
others not as familiar with the plants day-to-day PRA
work practices and normal operating procedures
may be performing tasks that can affect safety. While the current version of the SPAR-H
In addition, problems can exist in terms of the method was being completed, the American
operators ability to observe the state of the plant Society of Mechanical Engineers (ASME)
and the configuration of its equipment. standard for the conduct of PRA was released.
The following indicates areas where the SPAR-
Finally, operators face continuously changing H method is in compliance and where it is not,
plant conditions and configurations. Frequent and not, why. Just those sections emphasizing
changes in the plant situation result in changes HRA are discussed in this report.
in the potential consequences of events and the
availability of backup (and, in some cases, front- ASME Compliance HRA ASME Section 4.5.5.1
line) equipment in event responses. Objectives
Additionally, the changing plant environment
- Pre-initiator human failure events:
during LP/SD increases the importance of
maintenance, test, calibration.
communications to safely perform outage
activities and to appropriately respond to LP/SD * Post-initiator human failure events: human
events. Also, equipment is more frequently actions performed to prevent or mitigate
operated manually during LP/SD operations. core damage.
Responses to LP/SD events are typically
- Need to model (capture) issues of
achieved through manual human actions rather
dependency.
than automatic equipment response.
The SPAR-H method can be applied to any of
These differences from full power operations the actions cited above. The dependency
help create a situation where errors may be more calculation suggested in the SPAR-H method
likely and their consequences less observable. also meets the concern raised in ASME RA-
However, a significant mitigating factor is that, STD-2002. In general, most high level
after the first few days of an outage, the time requirements for HRA, as put forth by the
required for fuel uncovery to occur following ASME standard, are met by application of the
loss of cooling, for example, is sufficiently appropriate, standardized search strategies
extended so that delays in recovering from errors recommended for practice by the SPAR-H
may have less impact on risk. method.
56
The SPAR-H method also meets ASME RA- * Identify work practices that could introduce
STD-2002 suggestion (page 48) that assessment a mechanism that simultaneously impacts
of the probabilities of the post initiator HFEs the failure probability of multiple systems.
shall be performed using a well-defined and self-
consistent process that addresses the plant- * Establish rules for screening classes of
specific and scenario -specific influences on activities. For Capability Category I, II, or
human performance and between human failure III, consider whether plant procedures are
events within the same sequence. The SPAR-H structured to include independent checking
method process is internally consistent, of restoration of equipment (Cat I), whether
relatively easy to apply, and simple. Two base equipment is automatically realigned on
rates are proposed, the same eight PSFs are system demand, or post-maintenance
required for evaluation. Defaults are included for function test is performed that can reveal
situations where no influence by the PSF is misalignments (Cat II & III). Also,
expected or where the influence of that PSF is equipment position is indicated in the
unknown. Assessment of task dependency is control room, status is routinely checked,
straightforward and allows for consideration of and realignment can be affected from the
elements of context. Quantification follows control room.
THERP guidelines. * Define human failure events at a level of
detail consistent with that of the system and
ASME Section 4.5.5.1 also requires systematic accident sequence models.
review of relevant procedures. The review of
procedure information, coupled with walk * The SPAR-H method does not call out the
downs, interviews and review of event above elements directly, however, they are
databases, is called out in Section 1 of this part of the SPAR-H method search strategy.
report. For those performing these searches, the
SPAR-H method suggests use of ASME
For both pre- and post-initiator activities STD or ATHENA strategies to ensure that
modeling and quantification, the ASME actions and decisions are properly
standard requires that the documentation represented and analyzed.
describes the processes used and details of
assumptions made. The SPAR-H method calls Pre-initiator HFEs:
for this information and, additionally, requires Estimate the probabilities of HFEs using a
documentation on the HRA worksheets of systematic process. Acceptable methods include
assumptions made when assigning PSF values THERP and ASEP. The SPAR-H method is
that are different than the nominal case. compatible with and shares a technical basis
Supporting requirements for HRA with THERP and ASEP.
The SPAR-H method is compatible with the Use detailed assessments for pre-initiator HEPs
following elements (supporting requirements for dominant system contributors. The SPAR-H
called forth in the HRA portion of the ASME method recommends detailed (i.e., complete)
standard for PRA for nuclear power plant HRA for dominant contributors.
applications)
The ASME standard requires pre-initiator
- Evaluate test and maintenance activities evaluation of quality of written procedures,
that require realignment of equipment administrative controls, or human-machine
outside its normal operation or standby interface for Capability Category I.
status. Requirements for Capability Category II or III.
- Review of calibration activities. The SPAR-H method requires consideration of
procedures, administration controls (work
practices) and human-machine interfaces (HMI)
57
(ergonomics) for the quantification of every not captured in procedural guidance, such as
HEP considered for either actions or diagnosis. might be the case during unusual transients,
severe accidents, or complex accidents during
The ASME standard specifies a number of LP/SD scenarios.
considerations for recovery, self-recovery, or
recovery by other crews, and lists a number of For screening analysis (CAT I), the ASME
conditions. The SPAR-H method is much more standard suggests the use of conservative
brief and only advises that recovery be estimates or detailed analysis of HEP estimation
considered in the logic structure of fault tree in dominant accident sequences. The SPAR-H
models used by analysts and refers them to method is compatible with this suggestion,
SHARP or the ASME standard for guidance. although the SPAR-H method attempts to be
The SPAR-H method does not go into specifics more realistic than a pure screening by offering
regarding credit for use of written checkoff lists, a relatively large dynamic range and mixture of
work shift or daily checks of component, etc. PSFs for consideration in the quantification
process.
The ASME standard requires that some
assessment of the uncertainty in HEPs be The ASME standard suggests that an HRA
conducted. The SPAR-H method provides an approach be used to estimate HEPs that address
approach by which uncertainty associated with failure in cognition as well as failure to
HEPs can be determined. execute. The SPAR-H method addresses
cognition through diagnosis tasks and action
The ASME standard suggests that the analyst tasks and also allows the analysts to combine
check the reasonableness of HEPs in light of the rates for tasks having elements of both. The
plants operating history, procedures, SPAR-H method also allows for PSFs with a
operational practices, and experience. SPAR-H cognitive loading, that affect cognition, such as
provides similar guidance. complexity or fitness for duty, to be considered
The ASME standard specifically directs analysts when quantifying actions.
to define a set of HFEs as unavailabilities of Earlier versions of the ASME standard specified
functions, systems or components at the values for screening. That feature has been
appropriate level of detail. The SPAR-H method removed from the standard. Many of the values
calls for the definition of HFEs in the same prescribed were not consistent with approaches
language but recommends fault tree and event used in shutdown HRA, such as that included in
tree structure congruent with the concepts of NUREG/CR-6144 (Brookhaven National
HFE and context expressed in ATHEANA and Laboratory, 1995). It also called for relatively
other second generation methods. high HEPs, on the order of 0.50, for post-
The ASME standard specifies the accident initiator screening values. This feature was also
sequence specific timing of cues and time removed. For a detailed screening technique,
window for completion. The SPAR-H method such as the SPAR-H method, use of such coarse
assigns weighting factors based upon available HEP values bypasses the utility of the current
time windows. Timing and appearance of cues is approach.
noted in the ergonomics PSF and assumptions Finally, the ASME standard recommends
for PSF column of the SPAR-H method consideration of the following PSFs:
worksheets.
- Operator training or experience.
The ASME standard specifies that the definition
of HFEs should coincide with accident specific * Procedures and administrative controls
procedural guidance. The SPAR-H method * Availability of instrumentation needed to
leaves the determination of HFEs up to the take corrective actions.
analysis team. This guidance seems questionable
for situations where response is required, but is * Clarity of cues or indications.
58
- Human-machine interface. The SPAR-H method is capable of providing
estimates for HI-A and HI-C and suggests that
- Time available and time required. frequencies for initiating events be used from
- Complexity. operations or industry data where possible. The
NASA guide and the SPAR-H method break
- Environment light, heat, radiation, etc. down HI- C, ( post initiator responses) into
- Accessibility of equipment requiring cognitive responses and action responses.
manipulation. This bears a direct similarity to the overarching
diagnosis/action task taxonomy used by the
- Necessity, adequacy, and availability of SPAR-H method.
special tools, parts, clothing, etc.
The NASA guide distinguishes between skill,
Although not mentioned in this list, the ASME rule and knowledge-based (SRK) behavior
standard also calls for review of work practices; (Rasmussen 1979) and omission- and
at least how they apply to pre-initiator activities. commission-based errors. These are not
The SPAR-H method covers all of these factors inconsistent with the SPAR-H method. SPAR
within individual definitions of PSFs plus analysts should be taking the knowledge
others, such as fitness for duty and work process domains used by operators in conjunction with
factors, in explicit ratings for each HEP. their training into account when identifying
Task characteristics to consider, that are spelled errors for consideration in their analysis.
out in the ASME standard, that fit within the For approaches focusing on errors of
SPAR-H method framework include: commission see Pyy (2000), Le Bott et al (2000)
- Number of subtasks. or Forester (2000). The SPAR-H method doesnt
attempt to identify or quantify errors of
- Complexity and difficulty of required commission separate from errors of omission.
actions. This is thought to be sufficient for model
- Task performed inside or outside of control building and for most other SPAR model
room. applications. Just as in the case of SRK, use of
omission and commission is not explicitly called
- Address both diagnosis and execution for out in our approach. However, it should be
each post-initiator. present as part of the mindset of the HRA
- Diagnosis - detecting and evaluating and analyst as he/she considers possible errors.
deciding response. Consistent with most HRA approaches, the
- Execution - performing activities indicated NASA guide suggests that task analysis be used
by diagnosis. in support of HRA. This is part of the SPAR-H
method and many other HRA approaches
5.3 NASA Guidelines beginning with THERP.
The SPAR-H method is also consistent with a In terms of similarities, more remarkable
number of the elements outlined in the NASA perhaps is the degree to which PSFs suggested
PRA Procedures Guidelines (Stamatelatos and by the NASA guide and those included in the
Dezfuli, 2002). The NASA guide reviews SPAR-H method overlap. For example, typical
different human interaction (HI) classification PSFs suggested by both the NASA guide and the
strategies in contemporary HRA. The system SPAR-H method for consideration include:
most widely used employs the nomenclature HI- procedures, quality of human-machine interface
A,-B and -C, which correspond to pre-initiating (ergonomics in SPAR nomenclature); training
event interactions, initiating event related and practice (training and experience in the
interactions, and post initiating event actions, SPAR-H method); task complexity (complexity
respectively. in the SPAR-H method); stress level, (stress in
the SPAR-H method); time available or time
59
urgency (available time and stress in the SPAR- 5.4 Method Assessment
H method); environmental conditions (part of
ergonomics in the SPAR-H method); In addition to the specific ASME and NASA
communication (not directly covered in the HRA criteria pertaining to conducting HRA that
SPAR-H method) and previous actions (covered is reviewed above, the utility of an HRA
by dependency in the SPAR-H method). method, arguably, is also related to its utility to
analysts and the risk community in terms of
The separation of environmental conditions from
generic acceptance criteria. The evaluation of
ergonomics reflects the high degree of
SPAR-H against generic acceptance criteria is
consideration given to the effects of
presented in Table 5-1. These criteria include the
microgravity on task performance. Also,
following: objectivity, consistency, temporal
communications between mission specialists and
reliability, face and construct validity,
ground control operations or among crew, many
documentation and field-testing. Additional
of whom might be using English as a second
criteria include consistency with HRA practice
language, emphasizes the importance of
and operating experience, applicability across
communication for that domain. The authors of
domains, subject to peer review, compatibility
the NASA guide also note that organizational
with PRA input requirements, ease of
and management factors can be important, but
application, and accessible, i.e., easy to obtain.
are not usually explicitly modeled in HRA.
Human factors and HRA analysts reviewed
However, they can be inferred by their impact
SPAR-H and assigned a consensus rating of
on procedures, interface, training and other
either: undetermined, limited, moderate, or high
variables.
for each of these criteria. Explanations for the
The SPAR-H method considers a subset of rating assignments is contained in the last
organizational factors and work processes, in column of the table.
explicit fashion for the impact upon human
performance and allows for quantification based SPAR-H was rated high for the following
upon this information. The SPAR-H method criteria: producing consistent results, possessing
also directly calls out fitness for duty as an face and construct validity, consistency with
influential variable regarding human response. HRA practice and operating experience,
Aspects of fitness for duty are more implicitly produces output compatible with PRA, and easy
dealt with in the NASA guide. The NASA guide to apply. Predefined PSFs, levels of PSF,
also reviews approaches to screening analysis established base failure rates and the use of
versus detailed analysis. The SPAR-H method is worksheets helps to make the method objective
already a simplified approach, but could be used and consistent from analyst to analyst given the
to assist in either qualitative or quantitative same input. SPAR-H is consistent with human
screening analysis. Because of the mandatory behavior models, information processing theory,
consideration of PSFs within the SPAR-H and accounts for key elements of contemporary
method, the approach it uses in support of the HRA. The output obtained from SPAR-H is
screening analysis process would have to be consistent with analysis of unsafe acts, human
considered detailed HRA screening analysis. failure events and/or basic events supporting
The NASA guide also refers the reader to the PRA analysis. The range of PSFs included in
Swain and Guttman (1983) quantification model SPAR-H envelopes the PSFs found in operating
and five levels of dependency. The SPAR-H experience as well as in other HRA methods.
method uses a similar approach to the suggested SPAR worksheets were designed to produce
quantification from THERP but provides results that are easily transferred to PRA
supplemental qualitative information needed to methods. There is extensive experience in
assign the level of dependency prior to building SPAR models to support this. The use
quantification. In terms of uncertainty, the of predefined fields, and range of effect for PSFs
reasons for use of beta distribution have been including calculation fields and guidance for
summarized earlier in this report. calculation of dependency make this method
easy to apply. Uncertainty calculations are more
60
involved and SPAR-H guidance is to use the performance studies. This simplified HRA
SAPPHIRE workstation software to make this approach contains a number of enhancements
particular task easier. including calibration of its base failure rates and
range of PSFs influence against other HRA
SPAR-H was rated moderate for the following methods. This version of the SPAR-H method
three criteria: field testing and documentation, also contains a revised approach to uncertainty
applicability across domains, and ease with analysis employing a beta distribution that
which the method can be obtained. Field testing obviates problems experienced in earlier
of the method has been going on for over five versions when applying error factor approaches.
years and the use of SPAR-H in model
development is on the order of eight years. The SPAR-H method has been refined as a
Documentation for implementing the method result of experience gained during its use in the
has existed but has been limited to NRC staff development of over 70 SPAR plant models for
and a few NRC contractors. Information the NRC; in limited HRA applications for dry
regarding the method has been formally cask, spent fuel storage; in implementation of
available to industry through NRC workshops risk-informed plant inspection notebooks; and
and conferences sponsored jointly with various through third party application to other domains
national or international bodies such as the such as aerospace. The method does not
IEEE, World Association of Nuclear Operators differentiate between active and latent failures;
(WANO) or the Organization for Economic their identification and modeling is the decision
Cooperation and Development (OECD). of the analyst. It is thought that the same PSFs
SPAR-H has been applied to ground operations and base failure rates are applicable to either
for aerospace, and spent fuel storage activities type of error. The base error rates contained in
but experience in applying SPAR-H across the worksheets for actions and diagnosis include
additional domains is still needed. With omission and commission types of errors. The
publication of this NUREG/CR, the method tendency for an omission or commission to be
should be relatively easy to obtain. more important in contributing to an individual
human failure event can be modeled by the
SPAR-H was rated limited in terms of peer analyst using subtask level of decomposition in
review and undetermined with regard to building supporting fault trees.
temporal stability (consistency) of the method.
SPAR-H definitions and approach have been Although recognition that work processes is
refined over the years as a result of comments important is not new in HRA, the explicit
received from NRC staff. This constitutes a form incorporation of work processes is relatively
of peer review. However, peer review will be new. In instances where the effects of particular
completed to coincide with publication and PSFs, such as work processes are difficult to
receipt of comments from HRA practitioners in determine, the range of effect used in the SPAR-
NRC and industry over the long term. In the H method reflects the treatment of the work
behavioral sciences, a coefficient for temporal process PSF in other HRA methods. For
stability is determined by having HRA analysts example, the work processes range of effect in
reapply a method such as SPAR-H to the same the SPAR-H method is enveloped by
scenario at a later date and comparing the identification of a range of effect for work
findings. This analysis has not been conducted process PSF in two methods, CREAM
by may be performed at a later date. (Hollnagel, 1998) and HEART (Williams,
1992). The range in the SPAR-H method is
5.5 Discussion within the bounds suggested by these methods.
The SPAR-H method has been developed to be Other recent efforts related to work process
straightforward, easy to apply, and based on analysis include that of Weil and Apostolakis
both a human information-processing model of (2001). Dynamic approaches to work process
human performance and results from human analysis at nuclear facilities is presented in
Shukri and Mosleh (1998). They treat crew
61
performance factors, including aspects of work factors in addition to time that may influence
processes influence, in conjunction with crew diagnosis and response. Theory and model
dynamic plant response determined by plant building have continued with general
thermal-hydraulic calculations. See also Chang recognition of the importance of special issues
and Mosleh (1998) for an overall description of such as errors of commission, cognitive control,
the integration of RELAP-5 thermal-hydraulic and work processes. In the last ten years, the
computer code with the Analyzer of Dynamic importance of errors of cognition has been
Systems Information, Decision, Action (ADS- recognized. It is likely that some time in the
IDA) crew performance model. future there will be a uniform treatment of
uncertainty in HRA.
It may take time to reach consensus as a
community regarding how to model and Human interaction with advanced technologies
quantify the effect of work processes upon is a frontier for which data is needed. Task
performance because work processes have an sharing between human and intelligent systems
indirect and pervasive influence upon in robotic environments is now becoming
performance. The extent to which work process commonplace. Much of it proceeds because the
elements, such as poor configuration control, technology has become available. A time is
work order discrepancies, the amount of re- envisioned in the future where this technology
work, infractions, risk worth of corrective action will be introduced into the control room or
backlog and more objective elements, can be perhaps balance of plant activities. For example,
measured will help us to formulate a manner for consider self maintaining, self regulating
including work processes in PRA through HRA. systems. In fact, the importance of advancing or
extending the experimental techniques now
Traditionally, accounting for the influence of available to collect HRA data cannot be
multiple shaping factors with multiple levels of overemphasized. More is probably known about
influence without imposing a high degree of the factors that cause crews to fail than to
expert consensus judgment on the HRA process succeed. For example, complexity is
has proven difficult. The SPAR-H method acknowledged as an influence on performance.
attempts to make the assignment of human error Complexity may impact the searches that crews
probability more objective. The HRA search conduct to support hypothesis generation. Does
process for determining unsafe acts, given a it cause a narrowing of the search space or just a
particular context, still remains a challenging diminished capacity to perform? If so, how?
task for the PRA/HRA analyst, but this is the And if so, are serial searches or parallel searches
information that is brought to the SPAR-H more susceptible to disruption? How can the
method for quantification. The need to provide impact of this phenomenon be reduced? One
sound qualitative assessments of PSFs is approach is to simplify the work environment to
amplified as the SPAR-H method applications reduce workload. But if everything except
move from basic plant PRA model development emergency situations is simplified, is the
to event analysis and HRA analysis for specific workload reduced to the point that we are now
issues. more, rather than less, vulnerable? How are
HRA has become a central topic to PRA, in part skills and alertness maintained so that they dont
due to the compelling notion regarding the have a negative impact on safety significant
importance of psychology, action, and mental situations? What role should designing multi-
activities in everyday life. In the 25 years since modal systems (vision, audition, touch), play in
WASH 1400 was issued (Reference 2), building cognitive support systems for future
appreciation of the importance of human error in generation plants or backfits to existing plants?
nuclear power plants has increased considerably. It is apparent that HRA data collection must be
Starting with a crude diagnosis model based sponsored to meet the needs of the future while
upon time, HRA practitioners now look more applying the resources available to risk in
systematically at complexity, context, situation forming current decision-making.
awareness, and complicating conditions as
62
Once the answers to some of these issues are
found, the character of HRA will be further
improved.
63
Table 5-1 SPAR-H method assessment.
HRA Method Criterion SPAR-H Explanation
Method Rating
The method should be High The use of defined levels of influence, base rates,
objective and produce worksheets serves to produce consistent results,
consistent results. given the same input.
It should possess Undetermined An existing analysis would have to be re-visited at
temporal stability. a later date and analysts would have to evaluate the
same HEPs after which the extent to which the first
and second evaluations matched would have to be
determined.
It should possess face and High The method is consistent with models of human
construct validity. behavior, and appears to capture the majority of
elements considered in HRA. The relationship to
human performance at NPPs is obvious.
It should be documented Moderate The method has been field tested for some years
and field-tested and has been in use as part of SPAR model
development but the documentation is only now
becoming widely available.
It should produce High The rates and range of influence have been
estimates consistent with calibrated against existing methods and offers the
the practice of HRA and analyst the range of PSFs that would make
with operating application findings consistent with operating
experience. experience
It should be applicable Moderate The method has been extended to ground
across domains. operations for aerospace with some degree of
success; application to additional domains is
needed to further establish robustness of the
method.
It should be subject to Limited The method is not yet widely distributed nor
peer review. reviewed.
Output from the method High The method was designed to produce output
should be compatible suitable for use in PRA event or fault tree logic
with existing or emerging structures.
PRA logic structures.
The method should be High The method employs predefined fields, including
easy to apply. PSFs, basic error rates and method for dependency
assignment and quantification. Determining the
final HEP is relatively easy.
The method should be Moderate Publication in NUREG/CR format and availability
easy to obtain. on the web and in conference proceedings,
information about the method is easily obtained.
64
6. REFERENCES
Anderson, J. C., 1980, Cognitive Psychology 4th International Conference on Prabalistic
and Its Implications, San Francisco: Safety and Management, New York, New York,
W. H. Freeman and Company. Springer-Verlas Publishers, September 13-18,
1998, pp. 2468-2474.
Ang, A., and W. H. Tang, Probability Concepts
in Engineering Planning and Design, Volume 1, Dorel, M., Human Failure in the Control of
New York: John Wiley & Sons, 1975, Power Systems: Temporal Logic of Occurrence
pp. 198-199. and Alternating Work Times, Human Factors
in Nuclear Safety, Taylor Francis and Neville
Apostolakis, G. E., Organizational Factors and Stanton, Editors, London, 1996.
Nuclear Power Plant Safety. Nuclear Safety,
J. Misumi, B. Wilper and R. Miller, Editors, Fitts, P. M., and C. M. Seeger, S-R
Philadelphia, PA: Taylor & Francis, 1999. Compatibility: Spatial Characteristics of
Stimulus and Response Codes, Journal of
ASME RA-STD-2002, Standard for Experimental Psychology, Vol. 46, 1953,
Probabilistic Risk Assessment for Nuclear pp. 199-210.
Power Plant Applications, American Society
for Mechanical Engineers, 2002. Forester, J., et al., Technical Basis and
Implementation Guidelines for A Technique for
Atwood, C. L., Constrained Non-informative Human Event Analysis (ATHEANA).
Priors in Risk Assessment, Reliability NUREG/CR-1624, Rev. 1., U.S. Nuclear
Engineering and System Safety, Vol. 53, No. 1, Regulatory Commission Office of Nuclear
1996, pp. 37-46. Regulatory Research, May 2000.
Blackman, H. S., and J. C. Byers, ASP/SPAR-H Fujita, Y., and E. Hollnagel, Error Probabilities
Methodology, Internal EG&G report developed to Control Modes: Quantification of Context
for U.S. Nuclear Regulatory Commission, 1994. Effects on Performance, Proceedings of the
Braarud, P. O., Simulator Experiments as OECD/NEA/CSNI Workshop, Building the New
Empirical Basis for Performing Shaping Factors HRA: Strengthening the Link Between
in HRA, Probabilistic Safety Assessment and Experience and HRA, Munich, Germany, 2002.
Management (PSAM 6), E. J. Bonano, Generic Letter 88-20, Individual Plant
A. L. Camp, M. J. Majors, and R. A. Thompson, Evaluation for External Events for Severe
Editors, Elsevier Science Ltd., 2002, Accident Vulnerabilities, 10 CFR 50.54(f),
pp. 327-332. United States Nuclear Regulatory Commission,
Brookhaven National Laboratory, Surry Low Washington, DC, 1988.
Power and Shutdown PRA, NUREG/CR-6144, Gertman, D. I., et al., INTENT: A Method for
U.S. Nuclear Regulatory Commission, Estimating Human Error Probabilities for
Washington, DC, 1995. Decision Based Errors, Reliability Engineering
Brookhaven National Laboratory, The Effects of & System Safety, Vol. 35, 1992, pp. 127-136.
Alarm Display, Processing, and Availability on Gertman, D. I., and H. S. Blackman, Human
Crew Performance, NUREG/CR-6691 prepared Reliability and Safety Analysis Data Handbook,
for the US Nuclear Regulatory Commission, New York: John Wiley Interscience, 1994.
Office of Nuclear Regulatory Research,
Washington DC, November 2000. Gertman, D. I., et al., Human Performance
Characterization in the Reactor Oversight
Chang, Y. H., and A. A. Mosleh, Dynamic Process, NUREG/CR-6775,
PRA using ADS with RELAP5 Code as its INEEL/EXT-01-01167, U.S. Nuclear
Thermal Hydraulic Module, Proceedings of the
65
Regulatory Commission, Washington DC, LaChance, J. L., et al., Handbook of Parameter
October 2002. Estimation for Probabilistic Risk Assessment
(HOPE-PRA Draft), (NUREG/CR- in press),
Gertman, D. I., et al., Review of Findings for Sandia National Laboratory, ALB.
Human Performance Contribution to Risk in
Operating Events, NUREG/CR-6753, LeBott, C. B., F. Cara, and J. L. Bonnet,
Washington, DC, 2002. MERMOS, an EDF project to update Human
Reliability Assessment Methodologies,
Hallbert, B. P., A. Sebok, and D. Moriseau, A ESREL 98, Vol. 2, p. 767.
Study of Control Room Staffing Levels for
Advanced Reactors, NUREG/IA-0137, LeBott, P., Contribution from France:
U.S. NRC Office of Nuclear Regulatory MERMOS, NEA/CSNI/ R Errors of
Research, Washington, DC, November 2000. Commission in Probabilistic Safety Assessment,
published by Organization for Economic
Haney, L. N., Framework for Assessing Cooperation and Development (OECD),
Notorious Contributing Influences for Error Nuclear Energy Agency, Paris, France,
(FRANCIE): Overview and Generic User June 2000.
Guidance, INEEL/EXT-01-01014, 2002.
Medin, D. L., and B. H. Ross. Cognitive
Hannaman, G. W., and A. J. Spurgin, Systematic Psychology, 2nd Edition. Harcourt Brace, New
Human Action Reliability Procedure (SHARP). York, 1996.
EPRI NP-3583, Palo Alto, CA: Electric Power
Research Institute, 1984b. Meyer, D. E., et al., Optimality in Human
Motor Performance: Ideal Control of Rapid
Hathaway, S. R., and J. C. McKinley, The Aimed Movements. Psychological Review,
Minnesota Multiphasic Personality Inventory, Vol. 95, No. 3, 1988, pp. 340-370.
University of Minnesota Press, Minneapolis,
1942. Nairne, J. S., A Feature Model of Immediate
Model, Memory and Cognition, Vol. 18, 1990,
Hick, W. E., On the Rate of Gain of pp. 251-269.
Information, Quarterly Journal of
Experimental Psychology, Vol. 4, 1952, Newell, A., and H. A. Simon, Human Problem
pp. 11-26. Solving, New Jersey: Prentice-Hall, Inc., 1972.
Hollands, J., and C. D. Wickens, Engineering Oak Ridge National Laboratory (ORNL),
Psychology and Human Performance, 3rd Precursors to Potential Severe Core Damage
edition, Prentice-Hall Publishers, 1999. Accidents: 1992, A Status Report,
NUREG/CR-4674-V17-26, U.S. Nuclear
Hollnagel, E., Cognitive Reliability Error Regulatory Commission, Washington DC, 1992.
Analysis Method (CREAM) Oxford, UK:
Elsevier, 1998. OECD NEA 98 (1), Critical Operator Actions -
Human Reliability Modeling and Data Issues,
IEEE Standard 1082, Guide for Incorporating Volume 1 and Appendix F (Questionnaire
Human Action Reliability Analysis for Nuclear Responses), Organization for Economic
Power Generating Stations, Institute of Cooperation and Development (OECD) Nuclear
Electrical and Electronic Engineers, 1997. Energy Agency (NEA) Final Task Report,
IEEE Draft Standard 1574, Best Practices for Principal Working Group No. 5, Task 94-1,
Conducting Human Reliability Analysis Paris, France, February 1998.
(HRA), in review, expected June 2004. Proctor, R. W., T. Van Zandt, and A. Ehrenstein,
INEEL, Validation and Verification for Human Factors in Simple and Complex Systems,
SAPHIRE Version 6.0 and 7.0, NUREG/CR Allyn-Bacon publishers, Chicago, Ill, 1993.
6618, October 2000.
66
Pyy, P., Contribution from Finland: Framework Development, Nuclear Energy Agency, Paris,
for Analyzing Commission Errors, NEA/CSNI/ France, July 2000.
R Errors of Commission in Probabilistic Safety
Assessment. Organization for Economic Swain, A. D., Accident Sequence Evaluation
Cooperation and Development (OECD), Nuclear Program (ASEP) Human Reliability Analysis
Energy Agency, Paris, France, June 2000. Procedure, NUREG/CR-4772, Washington,
DC, 1987.
Rasch, G., Studies in Mathematical Psychology:
I. Probabilistic Models for Some Intelligence Swain, A. D., and H. E. Guttman, Handbook of
and Attainment Tests, Oxford, England: Nielsen Human Reliability Analysis with Emphasis on
and Lydiche, 1960. Nuclear Power Plant Applications (THERP)
Final Report, NUREG/CR-1278, Washington,
Root Cause Analysis Report for Davis Besse, DC, 1983.
First Energy Corporation Utility Root Cause
Analysis Team Report, Oakwood, OH, 2002. U.S. Nuclear Regulatory Commission, An
Analysis of Operational Experience During Low
Russell, K. D., et al., Reliability and Availability Power and Shutdown and a Plan for Addressing
Data System (RADS) Version 1.0. Critical Human Reliability Assessment Issues,
Design Review Document, February 1999. NUREG/CR-6093, Washington, DC, 1994.
Shannon, C. E., and W. Weaver, The Weil, R., and G. E. Apostolakis, A
Mathematical Theory of Communication, Methodology for the Prioritization of Operating
Champaign, IL: University of Illinois Press, Experience in Nuclear Power Plants, Reliability
1949. Engineering and Systems Safety, Vol. 74, 2001,
pp. 23-42.
Shukri, T., and A. Mosleh, A Dynamic PRA
Model: DS-IDA, Its Advantages and Possible Williams, J. C., A Data-Based Method for
Applications, Proceedings of the 4th Assessing and Reducing Human Error to
International Conference on Prabalistic Safety Improve Operational Performance,
and Management, New York, New York, Proceedings of the IEEE 4th Conference on
September 13-18,1998, Springer-Verlas Human Factors in Power Plants, Monterey,
Publishers, pp. 2667-2672. California, June 6-9, 1988, New York: Institute
of Electronic and Electrical Engineers, 1988.
Smith, C. L., et al., Testing, Verifying, and
Validating SAPHIRE Versions 6.0 and 7.0, Williams, J. C., Toward an Improved
(http://saphire.inel.gov/pdf/NUREG-CR- Evaluation Analysis Tool for Users of HEART,
6688.pdf), NUREG/CR-6688, October 2000. International Conference on Hazard
Identification and Risk Analysis, Human Factors
Stamatelatos, M., and H. Dezfuli, Probabilistic and Human Reliability in Process Safety,
Risk Assessment Guide for NASA Managers and January 15-17, Orlando, FL.
Practitioners, Version 1, National Aeronautic
and Space Administration (NASA), Washington, Wright, B. D. and J. M. Linacre, Rasch Model
DC, 2002. derived from Objectivity, in Rasch
Measurement Transactions, The American
Stevens, S. S., Mathematics, Measurement, and Educational Research Association (AERA),
Psychophysics, Handbook of Experimental Special Interest Group (SIG) on Objectivity in
Psychology, S. S. Stevens, Ed., New York: John measurement, 1:1. p 5-6. 1987.
Wiley& Sons, 1951
Yerkes, R. M., and J. D. Dodson, The Relation
Strater, O., The CAHR Method, of Strength of Stimulus to Rapidity of Habit
NEA/CSNI/R(2000)17: Errors of Commission Formation, Journal of Comparative Neurology
in Probabilistic Safety Assessment, and Psychology, Vol. 18, 1908, pp 459-482.
Organization for Economic Cooperation and
67
68
Appendix A
2002 HRA Worksheets for Full Power
SPAR HUMAN ERROR WORKSHEET FULL POWER OPERATIONS (PAGE 1 OF 3)
Plant: Initiating Event: Basic Event :
Basic Event Context:
Basic Event Description:
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I - Diagnosis (p.1); start with Part II - Action (p.2)) Why?
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0
Barely adequate time (<20 min) 10
Nominal time (>20 but <60 min) 1
Extra time (> 60 min) 0.1
Expansive time (> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) 0.01
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Obvious diagnosis 0.1
Experience/Training Low 10
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability.
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, Diagnosis is: 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x
Ergonomics x Fitness for Duty x Processes = Diagnosis Failure Probability
Diagnosis: 1.0E-2 x x x x x x x x = Diagnosis Failure Probability
A-1
SPAR Human Error Worksheet Full Power Operations (Page 2 of 3)
Plant: Initiating Event: Basic Event :
Basic Event Context:
Basic Event Description:
Part II. ACTION
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0
Time available is the 10
time required
Nominal time 1
Time available 5x the 0.1
time required
Time available is 50x the 0.01
time required
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Experience/Training Low 3
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 5
Nominal 1
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action: 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x
Fitness for Duty x Processes = Action Probability
Action: 1.0E-3 x x x x x x x x = Action Failure Probability
A-2
SPAR-H Human Error Worksheet Full Power Operations (Page 3 of 3)
Plant: Initiating Event: Basic Event :
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure
Probability (from Part I, p.1) and the Action Failure Probability (from Part II, p. 2). In instances where an action is
required without a diagnosis and there is no dependency then this step is omitted.
Task Failure Without Formal Dependence (Pw/od) = ______
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, such as it is impossible to take the current action
unless the previous action has been properly performed, explain here:
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or not - Not Applicable.
different) not close in different) additional) Why?_________________
time)
Same Close Same * complete When considering recovery in a series e.g., 2nd,
Different * high 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
- Cue status not a determining feature for the combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p.3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Additional criteria for levels of dependence are contained elsewhere in this document.
Calculate Pw/od using the appropriate values:
(1 + ( * ))/ = Task Failure Probability With Formal Dependence (Pw/od)
A-3
A-4
Appendix B
2002 HRA Worksheets for LP/SD
SPAR Human Error Worksheet LP/SD Operations (Page 1 of 3)
Plant: Initiating Event: Basic Event :
Basic Event Context:
Basic Event Description:
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I - Diagnosis (p.1); start with Part II - Action (p.2)) Why?
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0
Barely adequate time (@2/3 x 10
nominal)
Nominal time 1
Extra time £2 x nominal 0.1
Expansive time > 2 x nominal 0.1 to 0.01
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Obvious diagnosis 0.1
Experience/Training Low 10
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability.
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, Diagnosis is: 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x
Ergonomics x Fitness for Duty x Processes = Diagnosis Failure Probability
Diagnosis: 1.0E-2x x x x x x x x = Diagnosis Failure Probability
B-1
SPAR Human Error Worksheet LP/SD Operations (Page 2 of 3)
Plant: Initiating Event: Basic Event :
Basic Event Context:
Basic Event Description:
Part II. ACTION
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0
Time available is the 10
time required
Nominal time 1
Extra time 2-3x nominal 0.1
Expansive time >3x 0.01
nominal
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Experience/Training Low 3
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 5
Nominal 1
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is: 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x
Fitness for Duty x Processes = Action Failure Probability
Action: 1.0E-3 x x x x x x x x = Action Failure Probability
B-2
SPAR-H Human Error Worksheet LP/SD Operations (Page 3 of 3)
Plant: Initiating Event: Basic Event :
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure
Probability (from Part I, p.1) and the Action Failure Probability (from Part II, p.2). In instances where an action is
required without a diagnosis and there is no dependency then this step is omitted.
Task Failure Without Formal Dependence (Pw/od) = ______
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, such as it is impossible to take the current action
unless the previous action has been properly performed, explain here:______________________
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or not - Not Applicable.
different) not close in different) additional) Why?_________________
time
Same Close Same * complete When considering recovery in a series e.g., 2nd,
Different * high 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
- Cue status not a determining feature for the combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p.3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Additional criteria for levels of dependence are contained elsewhere in this document.
Calculate Pw/od d using the appropriate values:
(1 + ))/ )= Task Failure Probability With Formal Dependence (Pw/od)
B-3
B-4
Appendix C
2002 Full Power Worksheets for SGTR Example
It is assumed that the reactor is at 100% power when the steam generator tube rupture (SGTR) occurs. Given an
SGTR, secondary cooling is required for decay heat removal provided a successful reactor trip has occurred. Early
core decay heat removal is required for a SGTR event. Successful operation of secondary cooling will start
depressurizing the RCS in order to isolate the ruptured steam generator. HPI is used to provide makeup flow to
replenish the lost RCS inventory. With HPI and secondary cooling operating, the RCS pressure needs to be reduced
below the steam generator relief valve pressure and the steam generator is isolated, then the plant is placed in a
stable condition using secondary cooling. If the ruptured steam generator cannot be isolated, then RCS pressure
must continue to be lowered in order for shutdown cooling (SDC) to be place din operation for long-term cooling.
Plant stabilization given HPI failed can also be accomplished provided the RCS is depressurized and the steam
generator is rapidly isolated.
Feed and bleed cooling could be used to remove decay heat if secondary cooling (i.e., AFW and MFW) is
unavailable. For feed and bleed cooling, both PORVs are required to open and remove the decay heat and HPI is
required to provide the makeup flow. An operator is required to open the PORVs and PORV block valves if they
are closed. The operator controls the flow from the HPI pumps in order to slowly depressurize the RCS. Given the
successful operation of feed and bleed, long-term cooling using high-pressure recirculation (HPR) and containment
sump recirculation (CSR) is required. These success criteria are consistent within the PWR class G plants.
C-1
SPAR-H Human Error Worksheet Full Power Operations (Page 1 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Basic Event : RCS-XHE-DIAG
Basic Event Context:
Basic Event Description: Operator Fails to Diagnose SGTR
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I, p. 1; start with Part II, p. 2) Why? Operator must evaluate a set of parameters (e.g., pressure
differences between SGs, rates of increase (or decrease) of level, etc.). Indications can be masked
PART I. DIAGNOSIS
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0
Barely adequate time 10
(<20 min)
Nominal time 1
Extra time (>60 min) 0.1
Expansive time (>24 hrs) 0.01
Stress Extreme 5 It is assumed that stress will be higher than normal.
High 2
Nominal 1
Complexity Highly complex 5 Medium tube rupture is moderately complex,
Moderately complex 2 competing systems (feed versus trying to maintain
Nominal 1 level control).
Experience/Training Low 3 Simulator training emphasizing diagnosis of SGTR
Nominal 1 is provided.
High 0.5
Procedures Not available 50 The EOPs are symptom-based.
Incomplete 20
Available, but poor 5
Nominal 1
Diagnostic/symptom 0.5
oriented
Ergonomics Missing/Misleading 50 Plant-specific, SGTR diagnosis simplified by
Poor 10 having SG level indication and associated gages
Nominal 1 available for comparison.
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2 Based upon license examining or review, this plant
Nominal 1 has good work processes.
Good 0.8
B. Calculate the Diagnosis Failure Probability
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, Diagnosis is 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x
Ergonomics x Fitness for Duty x Work Processes
Diagnosis: 1.0E-2x 1 x 2 x 2 x 0.5 x 0.5 x 1 x 1 x 0.8 =0.008 Diagnosis Failure Probability
C-2
SPAR-H Human Error Worksheet Full Power Operations (Page 2 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Basic Event :
Basic Event Context:
Basic Event Description: Operator fails to diagnose SGTR
Part II. ACTION
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0
Time available is the 10
time required
Nominal time 1
Time available 5x the 0.1
time required
Time available is 50x the 0.01
time required
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Experience/Training Low 3
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics
x Fitness for Duty x Work Processes
Action: 1.0E-3 x ___x ___x ___x ___x ___x ___x ___x ___=______ Action Failure Probability
C-3
SPAR-H Human Error Worksheet Full Power Operations (Page 3 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Basic Event : XHE
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure
Probability (from Part I, p.1) and the Action Failure Probability (from Part II, p. 2).
Task Failure Without Formal Dependence (Pw/od) = __0.008____
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, explain here: First task in Sequence
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or - Not Applicable.
different) not close in different) not additional) Why?____________________________
time
Same Close Same * complete When considering recovery in a series e.g.,
Different * high 2nd, 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
.
- Cue status not a determining feature for this combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p. 3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Calculate Pw/od using the appropriate values:
(1 + ( * ))/ = Task Failure Probability With Formal Dependence (Pw/od)
C-4
SPAR-H Human Error Worksheet for Full Power Operations (Page 1 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Basic Event : HPI-XHE-XM-THRTL
Basic Event Context: HEP 2
Basic Event Description: Operator Fails to Throttle HPI to Reduce RCS Pressure
Does this task contain a significant amount of diagnosis activity? YES (start with Part I, p. 1) NO (skip
Part I, p. 1; start with Part II, p. 2) Why? Task directed by procedure. Involves turning off some pumps or
closing down on throttle valve.
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column
Available Time Inadequate time P(failure) = 1.0
Barely adequate time <20 min 10
Nominal time (>20 but 1
<60 min)
Extra time >60 min 0.1
Expansive time >24 hrs 0.01
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Obvious diagnosis 0.1
Experience/Training Low 10
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability.
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, Diagnosis is 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x
Ergonomics x Fitness for Duty x Work Processes
Diagnosis: 1.0E-2x x x x x x x x = Diagnosis Failure
Probability
C-5
SPAR-H Human Error Worksheet for Full Power Operations (Page 2 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Sequence Number: Basic Event : HPI-XHE-XM-
THRTL
Basic Event Context: 2nd HEP
Basic Event Description: Operator fails to throttle HPI to reduce RCS pressure
Part II. ACTION
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific reasons
in this column
Available Time Inadequate time P(failure) = 1.0 For a medium break approximately 4-5 minutes or less
Time available the time 10 is expected to be the time available, but the action only
required takes a minute to perform.
Nominal time 1
Time available 5x the 0.1
time required
Time available>50 x time 0.01
required
Stress Extreme 5 You know what the problem is now, but the situation
High 2 remains stressful. Taking action reduces some of the
Nominal 1 stress you had under diagnosis.
Complexity Highly complex 5 More than one pump in more than one train. May also
Moderately complex 2 have to bypass interlocks.
Nominal 1
Experience/Training Low 3 You seem to get SI with almost every event and the
Nominal 1 crew must deal with it. You do it all the time.
High 0.5
Procedures Not available 50 Expected and trained to do it from memory and then
Incomplete 20 check against procedure.
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50 Mimics are good for this. Controls are well labeled.
Poor 10 The presentation of the two trains is well layed out.
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0 Event and personnel specific.
Degraded Fitness 5
Nominal 1
Work Processes Poor 5 Determined on the basis of analyst evaluation of plant-
Nominal 1 specific information.
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is 1.0 E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics
x Fitness for Duty x Work Processes
Action: 1.0E-3x1x2x2x0.5x1x0.5x1x0.5=0.0005 Action Failure Probability
C-6
SPAR-H Human Error Worksheet for Full Power Operations (Page 3 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Basic Event : HPI-XHE-XM-THRTL
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure
Probability (from Part I, p.1) and the Action Failure Probability (from Part II, p. 2).
Task Failure Without Formal Dependence (Pw/od) = __0.0005____
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pwd).
If there is a reason why failure on previous tasks should not be considered, explain here: First HEP is failure to
diagnose a SCTR. It is not necessary to diagnose SGTR to reach the need to throttle HPI. You will be
directed to throttle HPI from some other emergency operating procedures (EOP) if not the SGTR EOP.
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or - Not Applicable.
different) not close in different) not additional) Why?_____________________________
time
Same Close Same * complete When considering recovery in a series e.g.,
Different * high 2nd, 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
.
- Cue status not a determining feature for this combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p. 3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Calculate Pw/od using the appropriate values:
(1 + ( * ))/ = Task Failure Probability With Formal Dependence (Pw/od)
C-7
SPAR-H Human Error Worksheet for Full Power Operations (Page 1 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Basic Event : RCS-XHE-XM-SG
Basic Event Context: Preceded by failure to throttle HPI
Basic Event Description: Failure to initiate RCS depressurization
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I, p. 1; start with Part II, p. 2) Why? This task involves careful control rather than diagnosis.
Elements of diagnosis may be present within individual operator actions as the procedure is followed, but the
procedure is prescriptive.
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column
Available Time Inadequate time P(failure) = 1.0
Barely adequate time <20 min 10
Nominal time 30 min 1
Extra time >60 min 0.1
Expansive time >24 hrs 0.01
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Obvious diagnosis 0.1
Experience/Training Low 10
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x Fitness
for Duty x Work Processes
Diagnosis: 1.0E-2x x x x x x x x = Diagnosis Failure
Probability
C-8
SPAR-H Human Error Worksheet for Full Power Operations (Page 2 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Basic Event : RCS-XHE-XM-SG
Basic Event Context: Preceded by failure to throttle HPI
Basic Event Description: Operator fails to initiate RCS depressurization
Part II. ACTION
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific
reasons in this column
Available Time Inadequate time P(failure) = 1.0 Any leak that will pop a relief valve is time critical.
Time available the time 10
required
Nominal time 1
Time available 5x the 0.1
time required
Time available 50 x the 0.01
time required
Stress Extreme 5 Youve breached one containment barrier and are
High 2 concerned about a second barrier (relief valves).
Nominal 1
Complexity Highly complex 5 Not a 1 man evolution - 1 in charge and 2 workers is
Moderately complex 2 barely adequate - often failed on exam - always failed
Nominal 1 the first time a team of 3 attempts it.
Experience/Training Low 3 Lots of training on this.
Nominal 1
High 0.5
Procedures Not available 50 Pretty good. Sufficient guidelines exist.
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50 Task takes place all over control room - requires time
Poor 10 sharing between tasks.
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0 Event and Personnel specific.
Degraded Fitness 5
Nominal 1
Work Processes Poor 5 Plant specific, for this facility as determined by
Nominal 1 review by license examiners.
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics
x Fitness for Duty x Work Processes
Action: 1.0E-3x10x5x5x0.5x1x1x1x0.5=0.0625 Action Failure Probability
C-9
SPAR-H Human Error Worksheet for Full Power Operations (Page 3 of 3)
Plant: Calvert Cliffs Initiating Event: SGTR Basic Event : RCS-XHE-XM-SG
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure
Probability (from Part I, p.1) and the Action Failure Probability (from Part II, p. 2).
If all PSFs are nominal, then Otherwise;
Task Failure Without Formal Dependence (Pw/od) = __0.0625_
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, explain here:
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or - Not Applicable.
different) not close in different) not additional) Why?_________________
time ______________________________________
Same Close Same * complete When considering recovery in a series e.g., 2nd,
Different * high 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
- Cue status no a determining feature for this combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p. 3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Calculate Pw/od using the appropriate values:
(1 + (6*0.0625))/ 7= 0.196 Task Failure Probability With Formal Dependence (Pw/od ))
C-10
Appendix D
LP/SD Scenario Description and SPAR-H Results for a
Hypothetical PWR LOI with RCS Pressurized
LP/SD Scenario
Loss of Inventory with RCS Pressurized
The scenario evaluated in Appendix D makes use of a low power and shutdown (LP/SD) standardized
plant analysis risk model for a U.S. PWR nuclear plant. Specifically, the model was derived from
NUREG/CR-6144 (1994) and the Revision 3i full power operation model for the corresponding plant.
The model is organized around a number of plant operating states (POSs) likely to occur during either (1)
refueling, (2) plant maintenance with drained reactor coolant system, (3) non-drained maintenance that
uses the RHR system for removal of decay heat, or (4) non-drained maintenance without using the RHR
system. Event trees, fault trees, and basic event data were compiled but are not part of this report. The
SPAR application in the following appendices corresponds to HEPs that would be included as part of the
SPAR basic events.
The scenario selected refers to a loss of inventory initiating event that leads to a reduction in RCS
inventory that in turn, leads to a loss of RHR. A loss of inventory event tree will be presented in the final
NUREG version. During the formal analysis, the loss of inventory event tree was broken into two
separate event trees because of differences in the initiating events. One tree uses a demand-related
initiating event, the other an hourly initiating event. The demand tree refers to over draining events when
the RCS inventory is being reduced to mid-loop. The event tree reviewed for purposes of SPAR-H
refinement and application was from the hourly group, where loss of inventory occurs with the RCS
pressurized. One of the prominent events is the success or failure of RCS make-up by the operators.
Success implies that make-up water is being provided to the RCS by either one train of HPSI, both trains
of CVCS, or one train of the low-pressure injection (LPI). These trains include operator failures as well as
component unavailability information, and time window (TW) information usually represented at this
level of analysis. Success requires an operator to start and align the suction of the injection pumps to the
RWST and to align the discharge to the RCS cold legs. Similar considerations were made when
determining the HEPs for all basic events. As with any event analysis, the HEP determined by the
SPAR-H screening method only identifies the human error contribution to the basic event frequency.
D-1
SPAR Human Error Worksheet for LP/SD Operations (Page 1 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: RHR-XHE-DIAP2
Basic Event Context: Loss of inventory with RCS Pressurized
Basic Event Description: Operator Diagnoses Loss of Inventory (1st event)
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I - Diagnosis (p.1); start with Part II - Action (p.2)) Why?
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0 Given that an isolable leak rate is occurring.
Barely adequate time (@2/3 x 10
nominal)
Nominal time 1
Extra time (< 2 x nominal) 0.1
Expansive time > 2x nominal 0.1 to 0.01
Stress Extreme 5 Extreme stress is too dramatic for shutdown
High 2 activity.
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Obvious diagnosis 0.1
Experience/Training Low 10 Extensive training and experience.
Nominal 1
High 0.5
Procedures Not available 50 Emergency Operating Procedures (EOPs) are
Incomplete 20 symptom-based.
Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
Ergonomics Missing/Misleading 50 Less well-designed for LP/SD activities.
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability.
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, Diagnosis is: 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x
Fitness for Duty x Processes = Diagnosis Failure Probability
Diagnosis: 1.0E-2 x 1 x 2 x 1 x 0.5 x 0.5 x 10 x 1 x 1 = 0.05 Diagnosis Failure Probability
D-2
SPAR Human Error Worksheet for LP/SD Operations (Page 2 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: RHR-XHE-DIAP2
Basic Event Context: Loss of inventory with RCS Pressurized
Basic Event Description: Operator Diagnoses Loss of Inventory (1st event)
Part II. ACTION
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific
reasons in this column
Available Time Inadequate time P(failure) = 1.0
Time available is the 10
time required
Nominal time 1
Extra time available is 0.1
2-3x nominal
Expansive time available is 0.01
>3x nominal
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Experience/Training Low 3
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 5
Nominal 1
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is: 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x
Fitness for Duty x Processes = Action Failure Probability
Action: 1.0E-3 x ____x ____x ____x ____x ____x ____x ____x ____= _______ Action Failure Probability
D-3
SPAR-H Human Error Worksheet for LP/SD Operations (Page 3 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: RHR-XHE-DIAP2
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure Probability
(from Part I, p.1) and the Action Failure Probability (from Part II, p.2). In instances where an action is required without
a diagnosis and there is no dependency then this step is omitted.
Task Failure Without Formal Dependence (Pw/od) = __0.05__
____________________________________________________________________________________________
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, such as it is impossible to take the current
action unless the previous action has been properly performed, explain here: This task is first in the event tree, no
previous human actions considered.
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or not - Not Applicable.
different) not close in different) additional) Why?___________________________
time
Same Close Same * complete When considering recovery in a series e.g., 2nd,
Different * high 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
- Cue status not a determining feature for this combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p.3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Additional criteria for levels of dependence are contained elsewhere in this document.
Calculate Pw/od using the appropriate values:
Task Failure Probability With Formal Dependence (Pw/od) = (1+(___x___))/x
D-4
SPAR Human Error Worksheet for LP/SD Operations (Page 1 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: RHR-XHE-XX-LOI123
Basic Event Context: Loss of inventory with RCS Pressurized
Basic Event Description: Failure to Recover RHR
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I - Diagnosis (p.1); start with Part II - Action (p.2)) Why?
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0 Given that an isolable leak rate is occurring.
Barely adequate time (@2/3 x 10
nominal)
Nominal time 1
Extra time (< 2 x nominal) 0.1
Expansive time > 2x nominal 0.1 to 0.01
Stress Extreme 5 Extreme stress is too dramatic for shutdown
High 2 activity.
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Obvious diagnosis 0.1
Experience/Training Low 10 Extensive training and experience.
Nominal 1
High 0.5
Procedures Not available 50 EOPs are system-based.
Incomplete 20
Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
Ergonomics Missing/Misleading 50 Less well-designed for LP/SD activities.
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability.
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, Diagnosis is: 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x
Fitness for Duty x Processes = Diagnosis Failure Probability
Diagnosis: 1.0E-2 x 1 x 2 x 1 x 0.5 x 0.5 x 10 x 1 x 1 = 0.05 Diagnosis Failure Probability
D-5
SPAR Human Error Worksheet for LP/SD Operations (Page 2 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: RHR-XHE-XX-LOI123
Basic Event Context: Loss of inventory with RCS Pressurized
Basic Event Description: Failure to Recover RHR
Part II. ACTION
A. Evaluate PSFs For the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0 The time window afforded by plant operating state
Barely adequate time (@2/3 10 may affect new response but by a factor of no more
x nominal) than 1 to 2.
Nominal time 1
Extra time 2-3 x nominal 0.5
Expansive Time > 3 x 0.1 to 0.01
nominal
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Experience/Training Low 3 Crew is well trained on residual heat removal
Nominal 1 (RHR) for full power context.
High 0.5
Procedures Not available 50 Not as well developed for shutdown activities.
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 5
Nominal 1
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is: 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x
Fitness for Duty x Processes = Action Failure Probability
Action: 1.0E-3 x 1 x 1 x 1 x 0.5 x 5 x 0.5 x 1 x 1 = 0. 00125 Action Failure Probability
D-6
SPAR-H Human Error Worksheet for LP/SD Operations (Page 3 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: RHR-XHE-XX-LOI123
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure Probability
(from Part I, p.1) and the Action Failure Probability (from Part II, p.2). In instances where an action is required without
a diagnosis and there is no dependency then this step is omitted.
Task Failure Without Formal Dependence (Pw/od) = __0.05125____
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, such as it is impossible to take the current action unless
the previous action has been properly performed, explain here: pathway is reached from success on previous tasks.
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or not - Not Applicable.
different) not close in different) additional) Why?_________________
time
Same Close Same * complete When considering recovery in a series e.g., 2nd,
Different * high 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
.
- Cue status not a determining feature for this combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p.3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Additional criteria for levels of dependence are contained elsewhere in this document.
Calculate Pw/od using the appropriate values:
(1 + (__ * __))/__ = ____) Task Failure Probability With Formal Dependence
D-7
SPAR Human Error Worksheet for LP/SD Operations (Page 1 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: HPI-XHE-XM-FB
Basic Event Context: Loss of inventory with RCS Pressurized, Failure to start pump & align system
Basic Event Description: Failure To Force Feed
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I - Diagnosis (p.1); start with Part II - Action (p.2)) Why?
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0 Given that an isolable leak rate is occurring.
Barely adequate time (@2/3 x 10
nominal)
Nominal time 1
Extra time (< 2 x nominal) 0.1
Expansive time > 2x nominal 0.1 to 0.01
Stress Extreme 5 Stress is present, however, extreme stress is too
High 2 dramatic for shutdown activity.
Nominal 1
Complexity Highly complex 5
Moderately complex 2
Nominal 1
Obvious diagnosis 0.1
Experience/Training Low 10 Extensive training and experience for this type of
Nominal 1 task.
High 0.5
Procedures Not available 50 EOPs are symptom-based.
Incomplete 20
Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
Ergonomics Missing/Misleading 50 Less well-designed for LP/SD activities.
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability.
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, Diagnosis is: 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x
Fitness for Duty x Processes = Diagnosis Failure Probability
Diagnosis: 1.0E-2 x 1 x 2 x 1 x 0.5 x 0.5 x 10 x 1 x 1 = 0.05 Diagnosis Failure Probability
D-8
SPAR Human Error Worksheet for LP/SD Operations (Page 2 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: HPI-XHE-XM-FB
Basic Event Context: Loss of inventory with RCS Pressurized, Failure to start pump & align system
Basic Event Description: Failure To Force Feed
Part II. ACTION
A. Evaluate PSFs For the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Action selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0
Barely adequate time (@2/3 10
x nominal)
Nominal time 1
Extra time 2-3 x nominal 0.5
Expansive Time >3 x 0.1 to 0.01
nominal
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5 .
Moderately complex 2
Nominal 1
Experience/Training Low 3
Nominal 1
High 0.5
Procedures Not available 50
Incomplete 20
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 5
Nominal 1
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is: 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x
Fitness for Duty x Processes = Action Failure Probability
Action: 1.0E-3 x .1 x 1 x 2 x 0.5 x 1 x 1 x 1 x 1 = 0.001 Action Failure Probability
D-9
SPAR-H Human Error Worksheet for LP/SD Operations (Page 3 of 3)
Plant: Plant A Initiating Event: LOI Basic Event: HPI-XHE-XM-FB
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure Probability
(from Part I, p.1) and the Action Failure Probability (from Part II, p.2). In instances where an action is required without
a diagnosis and there is no dependency then this step is omitted.
Task Failure Without Formal Dependence (Pw/od) = ___0.051___
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, such as it is impossible to take the current action unless
the previous action has been properly performed, explain here: ______________________
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or not - Not Applicable.
different) not close in different) additional) Why?_________________
time
Same Close Same complete When considering recovery in a series e.g., 2nd,
Different * high 3rd, or 4th checker
Not Close Same No Additional high If this error is the 3rd error in the sequence,
Additional moderate then the dependency is at least moderate.
Different No Additional moderate
Additional low If this error is the 4th error in the sequence,
Different Close Same No Additional moderate then the dependency is at least high.
Not Close Different Additional low .
- Cue status not a determining feature in this combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p.3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Additional criteria for levels of dependence are contained elsewhere in this document.
Calculate Pw/od using the appropriate values:
For complete dependency the Task Failure Probability With Formal Dependence (Pw/od) = (1+(1X0.051)/2))=0.5255
D-10
Appendix E
Spent Fuel Storage Description and SPAR-H Results for Dry
Cask
Dry Cask Spent Reactor Fuel Storage Examples
The following two examples are SPAR-H applications for a screening HRA performed on dry cask
storage operations for spent commercial reactor fuel. The dry cask storage operation includes loading
spent fuel assemblies into a canister contained in a cement cask under water in the spent fuel pool, placing
the lid with drain pipe assembly on the canister, removing the cask from the pool, sealing the canister,
drying and inserting the canister, closing the cask, drying the cask annulus, and moving the cask to an
outdoor storage pad.
The first example is the SPAR-H worksheets for the task of loading the fuel assemblies into the canister.
The potential error modeled is improper loading by placing a fuel assembly into a wrong location in the
canister. A loading map is provided to the crew. The map indicates specific spent fuel assemblies by
serial number and the specific placement location of each in the canister. The fuel crane operator selects,
moves, and places each assembly into the cask using a video image at his workstation on the crane from
an underwater camera attached to the cranes grapple assembly. Each fuel assemblys serial number is
stamped onto the top of the assembly. Worksheet ratings that are other than nominal are moderate
complexity and poor ergonomics for both the diagnosis and action component of the task. Note that
the worksheets do not account for latent errors related to the production of the fuel loading map.
The second example is the SPAR-H worksheets for operators failing to properly perform vacuum drying
system connections and set-up to enable drying of the cask annulus during the close cask phase of the
operation. The worksheet rating of complexity is moderate complexity for both the diagnosis and action
components of the activity. This reflects the multiple steps, components, connections, and manipulations
required. The rating for procedures is available, but poor for both the diagnosis and action components
of the activity. This rating reflects that the procedure refers to an attachment showing connections for the
canister rather than the cask (which employs different valve connections), and that the attachment has
inconsistent or missing symbols.
E-1
SPAR-H Human Error Worksheet for LP/SD Operations (Page 1 of 3)
Plant: Plant X Initiating Event: Basic Event : XHE
Basic Event Context: Load fuel into the canister
Basic Event Description: Failure to properly load fuel assemblies
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I, p. 1; start with Part II, p. 2) Why? Multiple assemblies/serial number/specific placement
locations/verifications.
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column
Available Time Inadequate time P(failure) = 1.0
Barely adequate time <20 min 10
Nominal time 30 min 1
Extra time (< 2 x nominal) 0.1
Expansive time (> 2 x nominal) 0.1 to 0.01
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5 Multiple fuel assemblies, serial numbers stamped on
Moderately complex 2 the top of each assembly, specific placement
Nominal 1 locations in the canister.
Obvious diagnosis 0.1
Experience/Training Low 10
Nominal 1
High 0.5
Procedures Not available 50
Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
Ergonomics Missing/Misleading 50 Performed by remote control under water using
Poor 10 video camera view. (Assembly selection, placement,
Nominal 1 and verification.)
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x Fitness
for Duty x Work Processes
Diagnosis: 1.0E-2x 1 x 1 x 2 x 1 x 1 x 10 x 1 x 1 = 0.2 Diagnosis Failure Probability
E-2
SPAR-H Human Error Worksheet for LP/SD Operations (Page 2 of 3)
Plant: Plant X Initiating Event: Basic Event : XHE
Basic Event Context: Load fuel into the canister
Basic Event Description: Failure to properly load fuel assemblies
Part II. ACTION
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are selected,
Action please note specific reasons in this
column.
Available Time Inadequate time P(failure) = 1.0
Time available time 10
required
Nominal time 1
Extra time 2-3 x nominal 0.5
Expansive Time > 3 x 0.1 to 0.01
nominal
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5 Multiple assemblies with specific placements in canister.
Moderately complex 2
Nominal 1
Experience/Training Low 3 Training is available for this task.
Nominal 1
High 0.5
Procedures Not available 50
Available, but poor 5
Nominal 1
Ergonomics Missing/Misleading 50 Performed by remote control under water using video
Poor 10 camera view. Assembly selection, placement, and
Nominal 1 verification viewing serial number stamps with
Good 0.5 underwater camera.
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 5
Nominal 1
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics
x Fitness for Duty x Work Processes
Action: 1.0E-3x 1 x 1 x 2 x 1 x 1 x 10 x 1 x 1 = 0.02 Action Failure Probability
E-3
SPAR-H Human Error Worksheet for LP/SD Operations (Page 3 of 3)
Plant: Plant X Initiating Event: Basic Event : XHE
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure
Probability (from Part I, p.1) and the Action Failure Probability (from Part II, p. 2).
Task Failure Without Formal Dependence (Pw/od)= 0.22 P(w/od)= 1.1E-2
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, explain here:
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or - Not Applicable.
different) not close in different) not additional) Why?____________________________
time
Same Close Same * complete When considering recovery in a series e.g.,
Different * high 2nd, 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
.
- Cue status not a determining feature for this combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p. 3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Calculate Pw/od using the appropriate values:
(1 + ( * ))/ = 1.0 Task Failure Probability With Formal Dependence (Pw/od)
E-4
SPAR-H Human Error Worksheet for LP/SD Operations (Page 1 of 3)
Plant: Plant X Initiating Event: Basic Event : XHE
Basic Event Context: Cask closure
Basic Event Description: Operators fail to properly perform vacuum drying system connections
and setup.
Does this task contain a significant amount of diagnosis activity? YES (start with Part I-Diagnosis (p.1) NO
(skip Part I, p. 1; start with Part II, p. 2) Why? Multiple steps, multiple components, connections,
manipulations.
PART I. DIAGNOSIS
A. Evaluate PSFs for the Diagnosis Portion of the Task.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are
Diagnosis selected, please note specific
reasons in this column.
Available Time Inadequate time P(failure) = 1.0
Barely adequate time <20 min 10
Nominal time 30 min 1
Extra time (< 2 x nominal) 0.1
Expansive time (> 2 x nominal) 0.1 to 0.01
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5 Multiple steps, multiple components, connections,
Moderately complex 2 and manipulations.
Nominal 1
Obvious diagnosis 0.1
Experience/Training Low 10
Nominal 1
High 0.5
Procedures Not available 50 Attachment refers to canister rather than cask,
Available, but poor 5 which employs different valve connections and
Nominal 1 contains inconsistent or missing symbols.
Diagnostic/symptom oriented 0.5
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 2
Nominal 1
Good 0.8
B. Calculate the Diagnosis Failure Probability
(1) If all PSF ratings are nominal, then the Diagnosis Failure Probability = 1.0E-2
(2) Otherwise, 1.0E-2 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics x Fitness
for Duty x Work Processes
Diagnosis: 1.0E-2x 1 x 1 x 2 x 1 x 5 x 1 x 1 x 1 = 0.1 Diagnosis Failure Probability
E-5
SPAR-H Human Error Worksheet for LP/SD Operations (Page 2 of 3)
Plant: Plant X Initiating Event: Basic Event : XHE
Basic Event Context: Cask Closure
Basic Event Description: Operators fail to properly perform vacuum drying system connections
and setup.
Part II. ACTION
A. Evaluate PSFs for the Action Portion of the Task, If Any.
PSFs PSF Levels Multiplier for If non-nominal PSF levels are selected,
Action please note specific reasons in this
column
Available Time Inadequate time P(failure) = 1.0
Time available time 10
required
Nominal time 1
Extra time 2-3 x nominal 0.5
Expansive Time > 3 x 0.1 to 0.01
nominal
Stress Extreme 5
High 2
Nominal 1
Complexity Highly complex 5 Observations of this task suggest moderate complexity
Moderately complex 2 for operators.
Nominal 1
Experience/Training Low 3
Nominal 1
High 0.5
Procedures Not available 50 Attachment refers to canister rather than cask, which
Available, but poor 5 employs different valve connections and contains
Nominal 1 inconsistent or missing symbols.
Ergonomics Missing/Misleading 50
Poor 10
Nominal 1
Good 0.5
Fitness for Duty Unfit P(failure) = 1.0
Degraded Fitness 5
Nominal 1
Work Processes Poor 5
Nominal 1
Good 0.5
B. Calculate the Action Failure Probability.
(1) If all PSF ratings are nominal, then the Action Failure Probability = 1.0E-3
(2) Otherwise, Action is 1.0E-3 x Time x Stress x Complexity x Experience/Training x Procedures x Ergonomics
x Fitness for Duty x Work Processes
Action: 1.0E-3x 1 x 1 x 2 x 1 x 5 x 1 x 1 x 1 = 0.01 Action Failure Probability
E-6
SPAR-H Human Error Worksheet for LP/SD Operations (Page 3 of 3)
Plant: Plant X Initiating Event: Basic Event : XHE
PART III. CALCULATE THE TASK FAILURE PROBABILITY WITHOUT FORMAL
DEPENDENCE (PW/OD)
Calculate the Task Failure Probability Without Formal Dependence (Pw/od) by adding the Diagnosis Failure
Probability (from Part I, p.1) and the Action Failure Probability (from Part II, p. 2).
Task Failure Without Formal Dependence (Pw/od)= 0.11 P(w/od)= 1.1x10E-1
Part IV. DEPENDENCY
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure
Probability With Formal Dependence (Pw/od).
If there is a reason why failure on previous tasks should not be considered, explain here:
Dependency Condition Table
Crew Time Location Cues Dependency Number of Human Action Failures Rule
(same or (close in time or (same or (additional or - Not Applicable. Why?________________
different) not close in different) not additional)
time
Same Close Same * complete When considering recovery in a series e.g., 2nd,
Different * high 3rd, or 4th checker
Not Close Same No Additional high
Additional moderate If this error is the 3rd error in the sequence,
Different No Additional moderate then the dependency is at least moderate.
Additional low
Different Close Same No Additional moderate If this error is the 4th error in the sequence,
Not Close Different Additional low then the dependency is at least high.
- Cue status not a determining feature in this combination of factors.
Using Pw/od = Probability of Task Failure Without Formal Dependence (calculated in Part III, p. 3):
For Complete Dependence the probability of failure is 1.
For High Dependence the probability of failure is (1+ Pw/od)/2
For Moderate Dependence the probability of failure is (1+6 x Pw/od)/7
For Low Dependence the probability of failure is (1+19 x Pw/od)/20
For Zero Dependence the probability of failure is Pw/od
Calculate Pw/od using the appropriate values:
(1 + ( * ))/ = 1.0 Task Failure Probability With Formal Dependence (Pw/od)
E-7
E-8
Appendix F
Operational Examples of SPAR-H Method Assignment of PSF Levels
Available Time - Time available >> time required
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
HNP1 06/27/93 AIT 3 events occurred (06/22-06/27) while conducting tests. 6/22 & 6/26: total Shift supervisor felt he was under
loss of offsite power from wiring error & blown fuse respectively. 6/27: time pressure to process the
temporary loss of motor-control-center-5, which provides power to ECCS. notification within the 12 minutes
Erroneous alert changed to unusual. required by the procedure (takes 10
minutes to input the data) and did
so at the expense of assuring
information accuracy.
Stress - High
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
ZIS1 02/21/97 AIT Following 48 hr limiting condition of operation (LCO) and 4 hr technical 39 people in control room envelope
specification (TS) shutdown statement, Nuclear Station Operator (NSO) with 15 people in immediate
initiates improper control rod manipulations during unit 1 shutdown, inserts vicinity of the primary NSO
rods for 3'43, then rods withdrawn for 1'45 without estimated critical operating rods and the US, high
position calculation while reactor (RX) substantially subcritical. RX tripped ambient noise level, attempts to
for containment sump (CS) pump problem prior to criticality. Inadequate restore the 1CS pump was the most
reactivity management. intrusive activity during the event.
NMP2 08/13/91 IIT Internal failure in main transformer caused turbine trip and RX scram. Stress and time pressure were high.
Degraded voltage resulted in simultaneous common-mode loss of 5 Event occurred just before shift
uninterruptible power supplies to important control room instrumentation change. Operators had confidence
and other plant equipment. Brought to safe shutdown in their training.
NAS2 04/16/93 HPS Control problem in main generator voltage regulator led to overexcited Stress due to unfamiliar crew
condition and reactor trip. Auxiliary feedwater(AFW) pumps disabled for composition. Sense of less
eighteen minutes during reactor trip recovery. communication/feedback than
usual. Operator broke glass cover
on control board indicator. Feeling
of urgency.
EFP2 08/13/93 HPS Spurious reactor scram, loss of gland seal steam and condenser vacuum Numerous failures and the smell of
resulted in main steam isolation valve (MSIV) closure and steam relief valve smoke during the initial stages of
(SRV) pressure control. recovery diverted or consumed
operator attention. Stress from
unexpected alarms, trips,
uncertainty of cause, and the first
RX trip at high power for the crew.
Complexity - Moderately complex
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
NEE3 07/03/91 ASPLER Operator left demineralizer bypass valves shut in manual. Later, instrument Control room operator (CRO) was
air to condensate demineralizer valve controller became blocked. All performing multiple, concurrent
automatic valves shut, bypass could not respond. Condensate booster pumps tasks. Operator was interrupted by
tripped. Main feed pumps tripped. Reactor tripped. phone call related to second task
and forgot to place the bypass
valve control in AUTO status after
interruption.
F-1
Experience/Training - Low
Event ID Event Summary PSF Description
(Plant/Date /
Report Type)
DCC1 09/12/95 ASPLER In Mode 6 and defueled, West Centrifugal Charging Pump (CPP) tripped Root cause was lack of
after 7 min. of a surveillance test. Pump had tripped due to incorrect setting requalification training, which
for overcurrent relay. Later determined pump had been inoperable for 6 mo., resulted in the calibration error
since last calibration. Personnel had used wrong technique resulting in made by the technicians. Although
miscalibration. adequately trained initially, a
significant amount of time had
elapsed since training and a lack of
requalification training led to the
personnel error.
MGS1 06/26/90 ASPLER Diesel generator 1A failed to reach required voltage in required time during Root cause of inappropriate action
operability test. Subsequent start attempt resulted in valid failure due to by maintenance personnel of
unsuccessful loading attempt. Paint overspray was found on the commutator painting area above fuel racks was
ring and fuel racks of diesel generator (DG) 1A and 1B. Both DGs were unauthorized; maintenance
declared inoperable. Paint removed from D/Gs and operability tests were personnel relied on their own
successful. experience as to what to paint.
Also Operations support person in
charge of D/Gs believed (wrongly)
specific guidance about what to
paint was not necessary because
the same personnel had previously
painted the Unit 2 D/Gs.
BRF2 05/11/93 HPS Isolation of valve associated with indicator used to monitor & control No training: crew had little
pressure resulted in actions causing high pressure in reactor coolant system experience with the tests because
(RCS) & an ARI/RPT engineered safety features (ESF) actuation during test they were performed infrequently.
No simulator training on test.
WGS3 06/10/95 AIT RX trip resulted from offsite electrical disturbance (lightning arrester Inadequate training of operators to
failure). Fire in turbine building switchgear room resulted from auto load respond to initial indications of
transfer problems. Shutdown cooling delayed by failure of isolation valves potentially significant fire. Fire
for both shutdown cooling trains. brigade training weakness resulted
in reluctance to use water to
extinguish fire when other fire
suppression methods failed.
PAV3 05/04/92 AIT Loss of non-safety related annunciator and computer alarm systems Not provided for loss of all non-
following a circuit breaker trip alarm verification that created an inadvertent safety related annunciators during
short circuit. normal or abnormal operating
conditions because of perceived
low probability of such an event.
EFP2 08/13/93 HPS Spurious reactor scram, loss of gland seal steam and condenser vacuum No training: simulator training was
resulted in MSIV closure and SRV pressure control. not updated to reflect manual
control of the gland seal steam
system. No training on how extra
RO should assist during event. No
multiple operator training.
F-2
Experience/Training - Nominal
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
WGS3 06/24/91 HPS After RX trip & power cutback, operator stabilized plant and while reducing Timely response of control room
power, startup feedwater regulating valve failed open and caused increased operators due to knowledge and
level in steam generator (SG)2. Operator scrammed RX & initiated MSIV training in procedures and
trip to prevent excess cooldown from failed open safety block control valve operating principles. Crew had just
(SBCV). completed ten days refresher
training.
WCS1 09/23/91 AIT Loss of spent fuel pool level and cooling, loss of gate boot seals. Breaker Operators' training and familiarity
trip and associated loss of bus pao1.RCS transient induced by loss of 2 of 4 with the plant were assets in coping
operating reactor coolant pumps (RCP)'s during solid plant operations gave with the event.
rapid decrease in RCS pressure & RHR heat sink.
Experience/Training - High
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
FCS1 07/03/92 HPS Loss of non-safety-related electrical converter led to a high pressure RX trip Plant specific simulator training
followed by a partially failed open safety relief valve. Similar event had helped in ability to respond.
occurred here 6 years before. Trained on LOCA's and loss of
inverter scenarios. Also trained on
implementing emergency plan.
Could be improved to include
actions for degradation or failure of
computer system.
FCS1 07/03/92 AIT Loss of load event occurred resulting in RX trip & loss of coolant event. Simulator training received was a
Turbine control valves shut and pressure increased resulting in pressurizer significant factor in event
code safety valve and uncontrolled loss of coolant. mitigation. Loss of coolant events
included in simulator training. Site
specific simulator has provided
increased training time &
procedure confidence. Emergency
planning practiced weekly.
PAV3 02/04/93 HPS A main feedwater pump high vibration annunciator alarmed while operating Combined crew experience and
at 100% power. Safety injection initiated. RX automatically tripped on low training were above the industry
steam generator levels one minute later. norm and contributed to successful
performance, however there was no
training on conditions of this event.
Previous training included
command and control. Simulator
training was useful.
F-3
Procedures - Not Available
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
CAY1 10/17/92 AIT Loss of main control room annunciators following power supply loss. Procedures not available for loss of
annunciators. Loss of Plant
Computer procedures not used.
No list of which alarms were on
which power supplies.
MNS3 12/31/90 AIT Catastrophic failure of two 6-in diameter pipes associated with the plant No administrative procedure for
moisture separator drain system allowed a significant amount of hot evaluating through-wall leaks in
condensate system water and steam to be released into the turbine building. the failed system.
Plant process computer lost.
Procedures - Available, but poor
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
NEE3 05/03/97 AIT Degradation of the high pressure injection system during unit cooldown. Shutdown/cooldown procedure
Potential damage occurred to 2 of 3 high pressure injection pumps. Letdown didn't guide sensitivity to RCS &
storage tank level and related suction head failed to be maintained. Let down systems inventory balancing during
storage tank (LDST) erroneously indicated normal level, while actual cooldown. Procedures provided
inventory decreasing. limited assistance because of non-
awareness that letdown storage
tank indications were inaccurate.
Operations Management Procedure
sent mixed messages that perhaps
procedures were weak and
compliance not required.
IPS3 10/04/90 AIT Two fuel assemblies were inadvertently lifted out of the core with the Procedure for fuel movement
reactor upper internals during preparations for defueling. AIT concluded that deficient. Did not contain detailed
guide pins were bent during may 1989 refueling. information needed on video
inspection of assemblies and
positioning. Problems with
complicated measuring
requirements. Format used notes
inappropriately; directions in notes
& note in wrong place.
Procedures - Nominal
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
LSC2 08/27/92 AIT Main turbine trip and subsequent scram due to thrust bearing failure Good use of procedures assisted in
indication numerous equipment problems followed scram. prioritization and addressing
individual equipment problems.
PNP1 03/26/93 AIT Non-safety related 30-inch service water pipe break and subsequent flooding Good use of procedures assisted in
in some plant areas required a rapid reactor shutdown, including a manual prioritization and combating of
scram, and consequent activation of safety equipment. Cause of small leak, individual equipment problems.
enlarged by erosion, unknown.
F-4
Ergonomics - Missing/Misleading
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
SGS2 12/13/92 AIT Loss of control room overhead annunciator system for 1-1/2 hours without Operators not aware that computer
knowledge of or response by operating staff. locked up and annunciators were
not working. Failure mode not
readily detectable and alternate
alert not provided. No human
factors review of remote
configuration workstation, which
lacked human factors features.
PIN2 02/20/92 AIT Residual heat removal system interruption due to overdraining of RX Design of the electronic level
coolant system while attempting to establish stable mid-loop operation measurement instruments was
conditions, shutting off inservice RHR pump and interrupting heat removal. incompatible with the nitrogen
pressures specified in the
draindown procedure. Instruments
were essentially unavailable.
Ergonomics - Poor
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
FCS1 07/03/92 HPS Loss of nonsafety-related electrical converter led to a high pressure RX trip Arrangement/placement: related
followed by a partially failed open safety relief valve. Similar event had displays & controls were located at
occurred here 6 years before. some distance from each other.
Difficulty in obtaining info for
failed computer displays. HPSI
valve did not have consistent linear
controls.
NEE3 03/08/91 LER Rev 0. While shutdown during refueling, spilled 14,000 g of water from Incorrect handwritten label in RX
RCS & borated water storage to RX building during valve test. Blank flange building emergency sump
installed on wrong suction train. Not on isolation valve tested. Interrupted identifying wrong low pressure
decay heat removal for 18.5 min. injection suction pipe. No formal
labeling.
Ergonomics - Nominal
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
PAV3 02/04/93 LER Rev 0. RX trip due to SG2 water level reaching low RPS trip set point No unusual characteristics of the
following loss of main feedwater pump A, followed by multiple ESF work location (e.g., noise, heat,
actuations. Event diagnosed as an uncomplicated RX trip. poor lighting) directly contributed
to this event.
F-5
Fitness for Duty - Degraded Fitness
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
HBR2 11/14/93 AIT Mismatch between actual power and power range nuclear instrumentation Long vendor shifts and personnel
during startup, due to fuel assembly error by vendor and operators lack of illness contributed to breaking or
understanding of core geometry. Power increase caused violation of tech failing to notice damage to a fuel
specs, flux tilt & power level anomalies. inspection tool, resulting in loose
parts in control rod guide tube.
Work Processes - Poor
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
PAV3 05/04/92 AIT Loss of non-safety related annunciator and computer alarm systems Problems with work order control
following a circuit breaker trip alarm verification that created an inadvertent & personnel safety (electricians
short circuit. failed to use safety equipment,
adequate safety precautions not
taken). Program barriers not in
place for engineering review of
modified work orders. Inconsistent
with mgmt expectations.
ZIS1 02/21/97 AIT Following 48 hr LCO and 4 hr TS shutdown statement, Nuclear Station Breakdown in command and
Operator (NSO) initiates improper control rod manipulations during Unit 1 control, failure of ops supervision
shutdown, inserts rods for 3'43, then rods withdrawn for 1'45 without to properly exercise oversight
estimated critical position calculation while RX substantially subcritical. RX responsibilities for ensuring shift
tripped for core spray (CS) pump problem prior to criticality. Inadequate activities conducted in controlled
reactivity management. manner. Shutdown (SD) briefing
informal, poorly planned,
ineffective. Event was primarily
the result of breakdown in
command and control.
WNP2 04/09/95 AIT Reactor water cleanup valve was operated in violation of procedure cautions Inadequate communications
and requirements (prohibiting opening of the valve above 125 psig) while between control room supervisor
attempting to control reactor water level during hot shutdown. (CRS) and shift manager. CRS
didn't pay attention to operator
concerns, communication was
informal and directions were
vague. Relief CRO was not
informed of valve position. Valve
position not recorded in control
room log.
Inadequate organizational culture.
Poor personal work standards were
root causes of the event.
Management response to prior
interpersonal problems of the
effected crew was slow.
F-6
Work Processes - Nominal
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
PBS3 01/28/90 HPS Loss of electro hydraulic control (ECH) and resultant rapid shutdown due to Competent and constructive
o-ring failure in main turbine control valve. communications. Furthered crew
ability to function effectively under
trying circumstances.
PAV3 05/04/92 AIT Loss of non-safety related annunciator and computer alarm systems Lack of intrusive supervisory
following a circuit breaker trip alarm verification that created an inadvertent involvement in the initiation and
short circuit. performance of routine balance-of-
plant electrical work. Successful
coordination of short-term
corrective actions. Effectively
avoided challenges to plant safety
systems.
Work Processes - Good
Event ID Event Summary PSF Description
(Plant / Date /
Report Type)
PAV3 02/04/93 HPS A main feed water pump high vibration annunciator alarmed while operating Command & control good. Shift
at 100% power. Safety injection initiated. RX automatically tripped on low supervisor (SS) moved people out
steam generator levels one minute later. of control room, had good
overview, and was out of
operators way, yet readily
available to crew. Emergency
coordinator duties transferred to
available qualified person,
enhancing SS oversight ability.
NMP2 03/23/92 AIT 1 of 2 lines supplying off site power to Unit 2 inadvertently tripped, causing SSS exhibited good command and
loss of control room annunciators. Second trip (power line) led to total loss control while conducting plant
of offsite power. One of two running emergency diesel generators tripped restoration.
due to loss of cool water.
F-7
F-8
Appendix G
The Relationship Among SPAR PSFs
Table G-1. The relationship among SPAR PSFs.
Does X affect Y Available time Stress Complexity Experience/Training Procedures Ergonomics Fitness for Duty Work Processes
Available time 1.0 Low (amount Medium to high Medium Medium to Medium Low to medium Low to moderate
of stress does (high complexity (greater experience high (complex (poor layout (illness or drug (poor shift turn over of
not change can make the time means that less time is or poorly can result in abuse may information can reduce time
the available available required for actions and conceived increased require available)
time) insufficient; lower decisions; shifts the procedures reaction time, increased time
complexity can margin in the available determine how lessening the to decide or act)
reduce memory time in either direction) much time one available time
burdens and make needs to act) to respond)
available time
sufficient)
Stress High (less time 1.0 Medium to high Medium Low to Low to medium Low Low
may increase (greater (more experienced medium (poor (illness can (inadequate work process
stress) complexity results workers may experience (procedure ergonomics can lower the can be cumbersome, cause
in higher less stress or maybe completeness contribute to threshold stress rework, and raise the level
information better able to handle the or quality can increased effects upon of stress for workers)
demands that can stress they do feel) increase workload and performance)
G-1 interact with stress) physical and
physical or mental stress)
mental stressors)
Complexity Medium to high High 1.0 Medium to high Medium Medium Medium Medium (cumbersome work
(little time makes (stress can (experience can mitigate (better (poor (diminished processes and supervision
the task more make the the effects of complex procedures ergonomics can capacity can can increase the complexity
complex, situation decisions through reduce require more result in simple associated with maintaining
simultaneous acts appear more heuristics and well- complexity) actions per task situations equipment,; increasing
more difficult to complex, rehearsed actions) or that the experienced as uncertainty through poor or
perform) subjects dont operator complex or miscommunication can
perceive perform more overwhelming, heighten complexity.)
information computations i.e., exceeding
or perceive and channel
less calculations by capacity)
information) hand or
mentally)
Does X affect Y Available time Stress Complexity Experience/Training Procedures Ergonomics Fitness for Duty Work Processes
Experience/Training Low Medium Low 1.0 Low Low Low Low
(time pressure (affects (complexity does (procedures (in the best (tracking rest or (poor work processes may
may cause ability to not influence can case good irregular work somewhat reduce the
training sessions recall experience, complement ergonomics cycles for duty effectiveness of prior
to be shorter, training) experience and the experience may serve to can reduce the training or experience)
smaller amounts training can help level) assist less well positive effects
of time may have to mitigate the training of training and
smaller impact on effect of individuals) experience)
the less complexity)
experienced)
Procedures Medium Medium Medium Medium 1.0 Low Low Medium (particularly
(small amount of (stress affects (high complexity (greater experience can (ergonomics (procedures important for procedure
time available information may cause overcome poor for situations following may design review and
may cause processing procedures to be procedures as well as can make it be reduced with implementation)
personnel to take capacity) more difficult to make the crew doubt difficult to lower levels of
shortcuts and implement) them) follow fitness for duty)
make errors) procedures)
Ergonomics Low Low Low to medium Low Low 1.0 Low Low
(in general, time (no known (high complexity (greater experience can (procedures do (no known (under bad work processes,
does not affect the relationship) may make mitigate the effects of not generally relationship) ergonomics may be
ergonomics of the marginal marginal ergonomics influence neglected)
scenario) ergonomics have but cannot override) ergonomics)
G-2 a greater impact)
Fitness for duty Low Medium to Medium (high Low Low Low (poor 1.0 Low to medium (there is
(any affects are high complexity may (for a short while only; (robust ergonomics some evidence that a poor
indirect and are (in unfit induce fatigue or high levels of procedures can such as lifting safety culture can result in
accounted for individuals amplify circadian experience can aid the requirements, general lowering of fitness
under other PSFs) increased effects) compensate for lower performance can interact for duty for an entire work
stress further levels of fitness; lack of in cases of with medical group)
compromises experience can amplify lowered conditions or
performance) poor fitness) fitness for circadian
duty) effects)
Work Processes Medium Medium Medium (multi- Medium Medium Low Low to medium 1.0
(time may (stress will agent complex (experience can help to (procedures (poor (illness and
influence crew affect how the tasks require ease communication, can influence ergonomics in substance abuse
interaction and the crew greater streamline process; less the computer or irregular
quality of the communicates coordination) experienced individuals effectiveness interface can work cycles can
interaction) and can challenge or occurrence result in affect crew
understands established work of work mistakes while dynamics and
information processes) processes) executing the effectiveness
presented, various parts of of work
may also work processes that
designate a processes; are in place)
positive work databases,
culture) maintenance,
etc.)
- Relationship is defined as either low, medium or high.
Appendix H
SPAR Development History
Original Development (1994) into the model but would have made it difficult
to use and interpret. It is acknowledged that
Efforts directed toward development of the there was a need for a method that was good
SPAR-H method focused upon producing a enough to support the HRA process that could
simple, general, and easy-to-apply method, be improved upon as the state-of-the-art in HRA
which considers or accounts for actuation, improves.
recovery (to the extent that it is present in the
PRA model) and dependency through a The existing ASP HRA methodology was
consistent model of human behavior. A general developed in 1994 (Blackman and Byers, 1995)
criticism of HRA methods is the inability to tie and, for clarity and convenience, is hereafter
these methods back to first principles in human referred to herein as the 1994 ASP HRA
behavior. Generally, methods identify a set of methodology. The enhanced and revised version
factors believed to be related to performance of the methodology, with minor exception is the
(e.g., stress, training, procedure quality), or basis for the SPAR 2002 Version presented in
focus on classes of human error (omission, this report. The 1999 Version is referred to as
commission, mistakes, slips) or even general the simplified plant analysis risk (SPAR) HRA
classifications of human behavior (rule, skill, method.
and knowledge) and then manipulate those
factors to arrive at a failure rate. The obvious The 1994 ASP HRA methodology was
problem with these approaches is completeness. developed to make an order of magnitude
How do we know that the set of identified improvement in the HRA practice of the
factors is, in fact, complete? In developing accident sequence precursor (ASP) program (the
SPAR we began with a model of human previous method had been limited to four human
behavior and went to operating events and error probability (HEP) values). The 1994 ASP
behavioral sciences literature to determine HRA methodology made use of a two-page
whether the model and its associated elements worksheet to rate a series of performance
covered the basics. shaping factors (PSFs) and dependency factors
to arrive at a screening level human error
To the authors knowledge, no single HRA probability (HEP) for a given task.
method begins with a theory of human behavior,
to ensure that all relevant factors are addressed Noteworthy features of the 1994 methodology
and accounted for, and then works forward to were a derivation of PSFs from a psychological
identify demonstrated, underlying mechanisms model of human behavior, and an explicit
that are known to influence and be predictive of dependency model. However, when compared to
behavior. To avoid this basic flaw in method the open literature and individual plant
development, time was spent in identifying an examination (IPE) HRA data, the dynamic range
underlying model of human behavior from for HEPs in the 1994 ASP HRA methodology
which to develop a clearly supportable and was limited. The taxonomy for distinguishing
complete HRA method for SPAR. the processing (cognition) portion of a task from
the response (action) portion of the task proved
Because there was a need for simplicity and somewhat difficult to apply by collaborators
usability, SPAR does not consider detail on a who were non-human factors and HRA
finer level than it does. For example, more professionals. In addition, a more obvious link to
refined aspects of work processes or of human performance literature and human
information processing and decision-making performance distributions was needed beyond
such as situation awareness and parallel versus the top-level model. This was addressed in the
serial search strategies could have been brought current version.
H-1
1999 Revision the BWR models were modified to include
interdependencies among the power conversion
The 1999 revision attempted to enhance the and the condensate and feed water systems. The
existing accident sequence precursor (ASP) models were revised to accommodate the
human reliability analysis (HRA) methodology comments generated from a quality assurance
to make it more accessible for the SPAR review and are now designated as the Revision
modeler to apply. Although it may serve to 2QA SPAR models. Since some plants have
support other modeling efforts and been shut down while model development was
characterizations of human performance for the underway, there were 72 Revision 2QA models,
risk analyst, the primary function of the revised which were made available for use by mid-1998.
SPAR-H methodology will still be to support the (Holahan et al.,(1998)).
SPAR models. We believe that the SPAR-H
method can serve other functions such as Scope. The work to revise the ASP HRA
screening for most HRA applications and that method was cast as four subtasks:
when placed in appropriate logic modeling
structures, SPAR-H can help identify 1. Review other current and emerging HRA
contributions to risk associated with human methods for similarities and differences;
performance. However, readers are still 2. Adjust PSFs and/or influence weights
cautioned that this is a screening analysis tool based on the review results and user
and not meant to replace complete HRA comments,
methods. This being said, analysts must still
apply a reasonable standard of investigation and 3. Review and adjust dependency
evaluation of scenarios provided by PRA to calculations based on the review results
provide an accurate analysis. and user comments; and
Standardized Plant Analysis Risk (SPAR) 4. Adjust base HEPs based on the review
models have been developed by the NRC for use results.
in accident sequence precursor analyses for
operating plants. These level 1 SPAR models are The revision of the 1994 ASP HRA
used to evaluate the estimated conditional core methodology was completed in 1999 by the
damage probability, given a specific initiating INEEL and remained in draft form. It was field
event or the existence of a specific condition at a tested by NRC inspectors, SPAR model
plant. These models were developed initially as developers and HRA analysts. Comments and
simplified models, i.e., restricted number of experiences with the method were collected and
initiating events [only those that were the method was addressed again in 2002 with
considered most common (transients and loss of expansion of the screening method to LP/SD
offsite power) or bounding for safety-related scenarios. This report documents the latest
systems not challenged by the common events]; version of the SPAR-H method.
support systems when not modeled explicitly
(only impact on frontline systems modeled); and 2002 Revision
basic events rolled-up into super components, Uncertainty
resulting in smaller fault trees.
The SPAR-H method as revised in 1999 only
Subsequent to the development of the first determined point estimates for HEPs. It was
version of 75 plant-specific SPAR models, desirable, for purposes of PRA, to develop a
changes and additions to the models were method whereby uncertainties in the HEP
identified and implemented in Revision 2. estimates could be propagated in the PRA.
Revision 2 models consisted of the following: Therefore, we set out to determine the
treatment of emergency ac power was expanded; uncertainty distributions for SPAR-H HEPs.
plant specific features impacting station blackout
were added, in addition to certain plant features
identified in the licensees IPE submittals; and
H-2
Distribution of HEPs Analysts are therefore encouraged to use the
CNI approach to uncertainty calculation
Previous Approaches to HRA Uncertainty. Since discussed in Section 2.6 of this report.
the publication of THERP, the lognormal
distribution has become an accepted distribution Sources of Uncertainty
for skilled performance. Strter (2000) has
added further weight to the argument for using a Unsurprisingly, the estimation of HEPs has
lognormal distribution as set forth in THERP for uncertainty associated with it. It is obvious that
HEPs. our industry has done a much better job in
collecting, collating, and analyzing equipment
THERP postulates a lognormal probability failure data than human errors. As Swain and
density function (PDF) with a standard deviation Guttmann (1983) point out, uncertainty in HRA
of 0.42. A SD of 0.42 was obtained by assuming comes from such sources as:
a 4:1 range ratio between the 95th and 5th
percentiles for tasks performed under routine * Dearth of the type of human performance
conditions. However, it then goes on to say that data useful to PRA/HRA
the range ratios used in reliability analyses of * Inexactness of models of human
NPP tasks are considerably wider than the performance
nominal 4:1 ratio. Thus calling into question that
approach. * Inadequate identification of PSFs and their
interactions and effects
Our review of the human performance literature
suggests that human performance may often * Analyst skill and knowledge limitations
follow a normal log distribution but that it also * Variability in performance (both within the
may follow a quadratic, or cubic distribution. individual and between individuals)
Also, the transformation from success space to
failure probability is not so straightforward. We All of the above, except the last, fall mainly into
believe that the mean value should be preserved. the category of epistemic uncertainty. On the
Also, we advocate the use of a beta distribution other hand, the innate variability in performance,
to model HEPs. Specifically, we utilize the particularly within individuals, appears to be so
constrained non-informative distribution, which intractable that it may as well be regarded as
maximizes uncertainty about the mean HEP random.
value. This distribution provides an adequate
representation of the upper bound and does not
exceed a value of one.