ML23010A191

IDHEAS-DEP for EPRI HRA Ug Jan 2023

ML23010A191
Person / Time
Issue date:	01/10/2023
From:	Michelle Kichline NRC/NRR/DRA/APOB
To:
References
Download: ML23010A191 (24)

Text

Dependency Analysis Using the Integrated Human Event Analysis System (IDHEAS) HRA Methodology Michelle Kichline Senior Reliability and Risk Analyst U.S. Nuclear Regulatory Commission

=

Background===

• The NRC developed the IDHEAS General Methodology (IDHEAS-G) [1] as a general framework that can be used to create application-specific HRA methods.

• IDHEAS-G includes a new dependency framework that analyzes the dependency between two HFEs by identifying and evaluating how failure of the first human action effects the context of subsequent human actions.

• IDHEAS for Event and Condition Assessment (IDHEAS-ECA) [2] was created for quantifying the HEPs for nuclear power plant PRAs.

• IDHEAS Dependency Model (IDHEAS-DEP) [3] was developed using the new dependency framework in IDHEAS-G and the quantification methodology in IDHEAS-ECA.

2

Development of IDHEAS-DEP

• NRC created a working group (WG) with members from RES, NRR, Region 2, and EPRI.

• RES developed a set of dependency relationships and factors and presented them to the WG.

• 6 WG members analyzed an HFE pair for dependency using IDHEAS-ECA and presented their results to the WG.

• The WG discussed each example and how the dependency impacts could be evaluated using IDHEAS-ECA.

• The WG reviewed the dependency factors created by the project team and the draft guidance document.

3

Process Overview 4

IDHEAS Dependency Types

• Consequential - Occurrence of the preceding HFE (HFE1) changes the context for performing the subsequent HFE (HFE2) from the context that was assumed when the HFE was analyzed without dependency.

• Cognitive - Dependency in the cognitive information for two consecutive HFEs.

• Resource-sharing - The two HFEs share limited resources such as critical tools, staffing, water, or electricity.

5

Dependency Relationships IDHEAS-DEP defines five different dependency relationships:

R1 - Functions or Systems R2 - Time Proximity R3 - Personnel R4 - Location R5 - Procedure 6

Entry Conditions OR HFE1 and HFE2 are in the same PRA event sequence or minimal cutset There are no relevant human action success events between HFE1 and HFE2.

The initiating event is caused by human actions and is analyzed as the first HFE, such that the subsequent HFEs need to be assessed for dependency.

Proceed to Predetermination (Step 1) 7

Predetermination Analysis Dependency Relationship Assessment Guidelines Complete Dependency

1) HFE1 and HFE2 use the same procedure, AND

2) HFE1 is likely to occur because of issues associated with the common procedure (such as having an ambiguous or incorrect procedure), AND

3) There is no opportunity to recover from the issue with the procedure between HFE1 and HFE2.

YES NO R1 -

Functions or Systems

1) HFE1 and HFE2 have the same functions or systems, OR

2) HFE1 and HFE2 have coupled systems or processes that are connected due to automatic responses or resources needed.

YES NO R2 -

Time Proximity

1) HFE1 and HFE2 are performed close in time, OR

2) The cues for HFE1 and HFE2 are presented close in time.

YES NO R3 -

Personnel

1) HFE1 and HFE2 are performed by the same personnel.

YES NO R4 -

Location

1) HFE1 and HFE2 are performed at the same location, OR

2) The workplaces for HFE1 and HFE2 are affected by the same condition (such as low visibility, high temperature, low temperature, or high radiation).

YES NO R5 -

Procedure

1) HFE1 and HFE2 use the same procedure.

YES NO 8

Basis for Screening Process Dependency relationships between HFEs can result in one or more dependency factors.

Each dependency factor potentially impacts some PIFs associated with HFE2.

- The impact of each dependency factor on HFE2 is based on how occurrence of HFE1 changes the context for HFE2.

- If occurrence of HFE1 would not result in any changes to the context associated with HFE2, the dependency factor may be discounted.

- Each undiscounted dependency factor potentially results in new PIFs, new PIF attributes, or worsening of the PIF attributes that were originally assessed in the individual HEP of HFE2.

Some PIF attributes impact HEPs more significantly than others. The screening process focuses on evaluation of the more significant PIF attributes.

The screening process groups the impact of the most likely affected PIF attributes for each dependency factor into Low, Medium, and High impact categories.

The dependency impact values (Pd) are based on IDHEAS-ECA.

9

Screening Analysis Potential Dependency Factors Basis for Discounting the Potential Dependency Factor Dependency Impact R1.1 Same functions or systems leads to cognitive dependency A.

Occurrence of HFE1 leads to the scenario or parts of the scenario being different from what was typically trained; thus, the scenario associated with HFE2 becomes less familiar. (Note: Occurrence of HFE1 alters the scenario for HFE2; thus, HFE1 causes some level of unfamiliarity with HFE2)

B.

Occurrence of HFE1 leads to an incorrect or biased mental model of the situation associated with HFE2.

A - HFE2 was trained in the scenarios that HFE1 occurs (e.g., Feed & Bleed is the last action after others fail) so there is no unfamiliarity due to HFE1.

B - HFE2 is well trained on in various scenarios such that personnel are unlikely to develop a wrong mental model due to occurrence of HFE1.

A/B - There is no cognitive link (similar thought process) between the two HFEs; thus, occurrence of HFE1 has no impact on scenario familiarity or mental model associated with HFE2.

B - There are opportunities between the HFEs to break the incorrect mental model, such as multiple crews or diverse cues.

This cognitive dependency affects the PIF for scenario familiarity, which addresses the mental model. Scenario familiarity is applicable when there is something wrong with the mental model and there is no diverse method available to correct the wrong mental model.

Low: Pd = 5E-2

Parts of scenario become unfamiliar (e.g., different from what was trained on), OR

HFE1 creates a biased mental model or preference for wrong strategies.

Medium: Pd = 1E-1

Parts of scenario become unfamiliar (e.g., different from what was trained on), AND

HFE1 creates a biased mental model or preference for wrong strategies.

High: Pd = 3E-1

HFE1 creates a mismatched or wrong mental model for HFE2 due to close cognitive links between HFE1 and HFE2 (e.g., thought process).

10

Screening Dependency Impact Calculate the screening dependent HEP of HFE2 by taking the probabilistic sum of the individual HEP of HFE2 (P2) and each of the undiscounted dependency impact values (Pd), as follows:

Dependent HEP of HFE2 = 1 1 1

= 1 1 1 1 NOTE: When the dependency impact values are small, the screening dependent HEP can be approximated by summing the dependency impact values and the individual HEP of HFE2. This approximation should not be used when any High dependency impact values are applicable.

11

Potential Dependency Impacts HFE Relationship Potential Dependency Factors Dependency Impact No Impact Low Medium High R1 Functions or systems R1.1 Same functions or systems leads to cognitive dependency 0.0 5E-2 1E-1 3E-1 R1.2 Same functions or systems leads to consequential dependency 0.0 1E-2 5E-2 2E-1 R1.3 Same functions or systems leads to resource-sharing dependency 0.0 2E-3 1E-2 5E-2 R2 Time proximity R2.1 Close time proximity in performing HFE1 and HFE2 leads to consequential dependency Varies depending on the ratio of time available to time required (Ta/Tr) for performing HFE2

> 4 0.0 3 and 4 1E-3 2 and < 3 1E-2 1 and < 2 1E-1 R2.2 Close time proximity in receiving the cues for HFE1 and HFE2 leads to consequential dependency 0.0 5E-3 5E-2 1E-1 R3 Personnel R3.1 Same personnel leads to cognitive dependency 0.0 5E-2 1E-1 3E-1 R3.2 Same personnel leads to consequential dependency 0.0 2E-3 1E-2 3E-2 R3.3 Same personnel leads to resource-sharing dependency 0.0 2E-3 1E-2 5E-2 R4 Location R4.1 Same location leads to consequential dependency 0.0 2E-3 5E-3 2E-2 R4.2 Same location and time leads to consequential dependency 0.0 2E-3 5E-3 7E-3 R5 Procedure R5.1 Same procedure leads to cognitive dependency 0.0 5E-3 5E-2 3.5E-1 12

Detailed Analysis Potential Dependency Factors Basis for Discounting the Potential Dependency Factor Dependency Impact R1.1 Same functions or systems leads to cognitive dependency A.

Occurrence of HFE1 leads to the scenario or parts of the scenario being different from what was typically trained; thus, the scenario associated with HFE2 becomes less familiar. (Note: Occurrence of HFE1 alters the scenario for HFE2; thus, HFE1 causes some level of unfamiliarity with HFE2)

B.

Occurrence of HFE1 leads to an incorrect or biased mental model of the situation associated with HFE2.

A - HFE2 was trained in the scenarios that HFE1 occurs (e.g., Feed & Bleed is the last action after others fail) so there is no unfamiliarity due to HFE1.

B - HFE2 is well trained on in various scenarios such that personnel are unlikely to develop a wrong mental model due to occurrence of HFE1.

A/B - There is no cognitive link (similar thought process) between the two HFEs; thus, occurrence of HFE1 has no impact on scenario familiarity or mental model associated with HFE2.

B - There are opportunities between the HFEs to break the incorrect mental model, such as multiple crews or diverse cues.

Potentially affected CFMs:

All CFMs Potentially impacted PIFs:

SF - Scenario Familiarity PIF attributes that are most likely impacted by the dependency factor:

SF1 - Unpredictable dynamics in known scenarios

SF2 - Unfamiliar elements in the scenario

SF3 - Scenarios trained on but infrequently performed

SF4 - Bias or preference for wrong strategies exists, mismatched mental models 13

Simplified Example

• Inadvertent safety injection (SI) actuation due to a stuck open pressurizer spray valve at power.

• SI triggers a reactor trip. All automatic actions occur as expected.

14

Human Failure Events

• HFE 1: Terminate SI

- Performed using procedure ES-1.1 and takes 15 min to complete.

- E-0 is entered due to the reactor trip. E-0 directs entering ES-1.1 to terminate SI flow if RCS pressure is stable or rising and other parameters are within criteria.

• HFE 2: Start high pressure recirculation (HPR)

- Performed using procedure ES-1.3 and takes 12 min to complete.

- E-0 directs entering ES-1.3 when RWST level reaches 30%. ES-1.3 directs operators to start HPR once RWST level drops to 20%.

15

Timeline

• 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> available to terminate SI.

• 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to start high pressure recirculation.

16 T = 0 SI Actuation Reactor Trip T = 30 min Pressurizer filled with water T = 5.5 hrs RWST at 30%

T = 6.5 hrs RWST at 20%

T = 8 hrs Core Damage

Step 1:

Predetermination Analysis 17 Relationship Assessment Guidelines Complete Dependency HFE1 and HFE2 use the same procedure, AND HFE1 is likely to occur because of issues associated with the common procedure (such as having an ambiguous or incorrect procedure), AND There is no opportunity to recover from the issue with the procedure between HFE1 and HFE2.

Justification: (1) HFE1 uses procedures E-0 and ES-1.1.

HFE2 uses procedures E-0 and ES-1.3, or E-1 and ES-1.3. E-0 is the shared procedure. (2) The cues of HFE1 and HEF2 are different. The common procedure is not a likely cause of dependency.

YES NO R1 Functions or Systems HFE1 and HFE2 have the same functions or systems, OR HFE1 and HFE2 have coupled systems or processes that are connected due to automatic responses or resources needed.

Justification: HFE1 and HFE2 use the same system (ECCS) for different functions. HFE1s function is to control RCS inventory. HFE2 provides core cooling.

YES NO R2 Time Proximity HFE1 and HFE2 are performed close in time, OR The cues for HFE1 and HFE2 are presented close in time.

YES NO R3 Personnel HFE1 and HFE2 are performed by the same personnel.

Justification: HFE1 and HFE2 are assumed to be performed by the same crew.

YES NO R4 Location HFE1 and HFE2 are performed at the same location, OR The workplaces for HFE1 and HFE2 are affected by the same condition (such as low visibility, high temperature, low temperature, or high radiation).

Justification: HFE1 and HFE2 are performed in the main control room. No environmental factors are expected to affect the reliability of HFE1 and HFE2.

YES NO R5 Procedure HFE1 and HFE2 use the same procedure.

Justification: HFE1 and HFE2 could share the same procedure (E-0).

YES NO

Step 2:

Screening Analysis -

Same Personnel

• Individual HEP = 3.5E-3

• Pd(R3.2) = 2E-3

• Screening dependent HEP = 5.5E-3 18

Step 3:

Detailed Analysis -

Same Personnel Individual HEP = 3.5E-3 The dependency impact was accounted for in the original analysis of the individual HEP.

HEP with dependency = 3.5E-3 HEP without dependency applied = 2.6E-3 Pd(R3.2) = = 9E-4 19 Potential Dependency Factors Dependency Impact R3.2 Use of the same personnel leads to consequential dependency A. Mental fatigue, time pressure, or stress level increase due to the same personnel performing HFE1 and HFE2 (e.g.,

HFE1 could cause high stress or mental fatigue because several layers of defense in depth have failed, such as in situations beyond the EOPs).

B. Personnel need to perform HFE1 and HFE2 at the same time (i.e., personnel must switch between tasks).

Potentially affected CFMs:

All CFMs Potentially impacted PIFs:

MFMental fatigue, stress, and time pressure MTMultitasking, interruptions, and distractions PIF attributes that are most likely impacted by the dependency factor:

MF1Sustained (> 30 minutes), highly demanding cognitive activities requiring continuous attention (e.g., procedure-situation mismatches demand constant problem-solving and decisionmaking; information changes over time and requires sustained attention to monitor or frequent checking)

MF2Time pressure due to perceived time urgency MF3Lack of self-verification due to rushing task completion (speed-accuracy tradeoff)

MF5Long working hours (> 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) with highly cognitively demanding tasks Note: The analyst added MF5 to the list.

MT3Concurrent visual detection and other tasks MT4Concurrent auditory detection and other tasks MT5Concurrent diagnosis and other tasks MT8Concurrently executing action sequence and performing another attention/working memory task MT9Concurrently executing intermingled or interdependent action plans

Example Results

• Original individual HEP = 3.5E-3

• Screening dependent HEP = 5.5E-3

- Screening consequential dependency impact due to use of same personnel: Pd(R3.2) = 2E-3

• Detailed dependent HEP = 3.5E-3

- Detailed consequential dependency impact due to use of same personnel: Pd(R3.2) = = 9E-4

- Individual HEP without dependency impact = 2.6E-3 20

Conclusion

• IDHEAS-DEP leverages the IDHEAS-ECA quantification method to develop screening dependency values that can be applied to HEPs for HFEs modeled using any HRA method.

• Both the screening analysis and detailed analysis provide a dependent HEP for HFE2 and identify the dependency relationships, dependency factors, and PIFs impacted by the occurrence of HFE1

• In general, the dependent HEPs calculated using IDHEAS-DEP are lower than those calculated using THERP.

• In some cases, the independent HEP may already account for the dependency impacts (such as for feed and bleed or initiating high pressure recirculation).

21

Questions?

22

Acronyms

• CFM - Cognitive Failure Mode

• EPRI - Electric Power Research Institute

• HEP - Human Error Probability

• HFE - Human Failure Event

• HRA - Human Reliability Analysis

• HPR - High Pressure Recirculation

• IDHEAS - Integrated Human Event Analysis System

• IDHEAS-DEP - IDHEAS Dependency Analysis

• IDHEAS-ECA - IDHEAS for Event and Condition Assessment

• IDHEAS-G - IDHEAS General Methodology

• NRC - Nuclear Regulatory Commission

• NRR - Office of Nuclear Reactor Regulation

• PIF - Performance Influencing Factor

• PRA - Probabilistic Risk Analysis

• RCS - Reactor Coolant System

• RES - Office of Nuclear Regulatory Research

• SI - Safety Injection

• WG - Working Group 23

References

1. U.S. Nuclear Regulatory Commission, NUREG-2198, The General Methodology of an Integrated Human Event Analysis System (IDHEAS-G),

May 2021, ADAMS Accession No. ML21127A272.

2. U.S. Nuclear Regulatory Commission, NUREG-2256, Integrated Human Event Analysis System for Event and Condition Assessment (IDHEAS-ECA), October 2022, ADAMS Accession No. ML22300A117.

3. U.S. Nuclear Regulatory Commission, Research Information Letter 2021-14, Integrated Human Event Analysis System Dependency Analysis Guidance (IDHEAS-DEP), November 2021, ADAMS Accession No. ML21316A107. (Will be NUREG-2258) 24