ML17333A551

Ltr Rept, Evaluation of Cook Ipe/Hra Matls.

ML17333A551
Person / Time
Site:	Cook
Issue date:	12/04/1994
From:	SWAIN A D AFFILIATION NOT ASSIGNED
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML17333A549	List: ML17333A548 ML17333A550 ML17333A551
References
NUDOCS 9609110071
Download: ML17333A551 (18)

Text

EVALUATIONOFCOOKIPE/HRAMATERIALSLetterReporttoU.S.NuclearRegulatoryCommissionOfficeofNuclearRegulatoryResearchByAlanD.Swain,Ph.D.712SundownPlaceSEAlbuquerque,NM87108(505)265-0098File:ga/NRCQCookHRA.943Submitted:May10,1994Finalized:December5,19944555S.MissionRd.//967Tucson,AZ85746(602)294-17699b09i100719b090bPDR*DOCK050003i5PPDREnclosure3 EVALUATIONOFCOOKIPE/HRAMATERIALS

1.0INTRODUCTION

NRCstaffaskedmetoreviewtheHumanReliabilityAnalysis(HRA)portionsoftheCookNuclearPowerPlant(NPP)IndividualPlantExamination(IPE).IreviewedthedocumentationlistedinAppendixA,visitedNRCstafftwice,andheldnumeroustelephonesessionswiththem.Specifically,astheprimarydeveloperoftheTechniqueforHumanErrorRatePrediction(THERP),IwasaskedtodeterminewhetherCookHRAwasbasedonappropriateuseofTHERPasdescribedintheHRAHandbookbySwainandGuttmann(NUREG/CR-1278)(Ref.1-referencesareatendofthisdocument).TheCookHRAdocumentationstatesthattheHRAisbasedonTHERPandthehumanperformancemodelsanddatatablesintheHRAHandbook,andalsoonNUREG/CR-2254(Ref.2).IwasalsoaskedtojudgewhethertheHRAiscredible(believable),andifnot,whatproblemswerethereintheHRA.Thefirst4pagesofthisdocumentsummarizemyfindingsandconclusions.AppendixApresentsmydetailedreviewoftheCookHRA.Thesefirst4pagesandtheSummaryinAppendixAareverysimilartomypreviouslycompletedevaluationoftheZionNPPHRA(Ref.3)becausetheHRAmethodusedandtheproblemsfoundaresimilar.2.0APPROACHUSEDINTHEHRAThissectionparaphrasessomeofthemainpointsintheapproachusedintheCookHRA,accordingtotheIPEdocumentationprovidedmebyNRCstaff.TheCookHRAisbasedonwhattheanalystscalledastep-by-steptaskanalysisofoperatoractionstobeincludedinsystemeventtrees.Foreachoperatoraction,theanalystsidentifiedActionIdentifier,DescriptionofAction,TimeWindowAvailableforAction,ApplicableProcedures,andIndicationofWhethertheActionwasSimulatedinTraining.Genericmedianhumanerrorprobabilities(HEPs)foreachactionwereobtainedfromvarioustablesintheHRAHandbookandconvertedtogenericmeanHEPsbyusingthehandbook'sassumptionofalog-normaldistributionandestimated5Xand95Xerrorfactors.AssessmentofHEPswasdoneeitherbyfaulttreeanalystsorbyHRAanalysts.Whatweredefinedasplant-specificperformanceshapingfactors(PSFs)werederivedandassignedscalingvalueswhichservedasmultipliersofthegenericHEPs.Themultipliersforstresseffectswere1.0to10.0,andthemultipliersforotherPSFs(e.g.,availabilityofmultiplesupportiveindicators,selectionofwrongcontrols,qualityoftraining,memorizedprocedure)generallywereassignedmultipliersoflessthan1.0,i.e,1or.Ol.Whenestimatesofdependenceeffectswererequired,thepositivedependencemodelfromtheHRAHandbookwasused.Theanalystsemploydafault-treeapproachratherthantheHRAeventtreeapproachdescribedintheHRAHandbook.TheHEPsusedinthesystemeventtreesweregenerallycalculatedusingindividualfaulttrees.Aspartofthequantificationprocess,aplantvisitwasmadetoobtainoperatorreviewandassistanceaboutthemodeledhumanactions. 3.0MAJORPROBLEMS3.1AssumtionsFollowingaresomeofthemoreimportantassumptionsstatedintheCookHRAdocumentationthatarerelatedtotwomajorproblems.ThefirstproblemiswhatIconsidertobeoptimisticassessmentsofthecontributionofhumanerrorstosystem-criticalevents.Thesecondproblemistheacross-the-boardassessmentofarelativelysmallsetofHEPswithoutadequateconsiderationofthespecificsituationsandtheunderlyingspecificPSFsforthosesituations.AmajorassumptionisthattheCookNPPoperatingcrewsaresowelltrainedintheuseofthesymptom-orientedEOPsthatamultiplierofO.lwasappliedtonearlyallofthegenericHEPs.Iftheanalystsjudgedthattheproceduretobeusedwasmemorized,thismultiplierof0.1wasincreasedto0.01.Thus,therelatedHEPwouldbedividedby100.Ifindthisoptimismincredible.Moreover,theuseofthesekindsofgenericerrorreductionfactorsisapparentlynotsupportedbyaspecifictaskanalysisforthetasksinvolved.Atleast,nosuchtaskanalysiswasincludedintheHRAmaterialsIwasgiventoreview.Considerablecreditforrecoveringfromoperatorerrorsisgiventowhatiscalled"checkingthatinvolvesactiveparticipation(STAmonitorsplantparameters)."TheusetheHRAHandbook'sTable20-22"Estimatedprobabilitiesthatacheckerwillfailtodetecterrorsmadebyothers"isinappropriatetoapplytocheckingduringanaccidentsequence.Theconditionsforusingthistablespecificallyincludeastatementthatitshouldbeappliedonlytonormaloperating(pre-accident)conditions.Applicationofthistabletopost-accidentconditions(i.e.,thesituationfollowingsomeinitiatingevent)couldresultineithertoohighortoolowestimatesofHEPs,dependingonthesituationinvolved.Also,themeannominalHEPof1.6E-2thatisbasedonTable20-22isfurtherreducedbyamultiplierof0.5,togiveamodifiedofSE-3.Asthisnumberisusedtomultiplyalltherelevantoperatoractions,itisaquitesizeableerrorrecoveryfactor.UnliketheZionHRA(Ref.3),itwasassumedthatdiagnosiserrorswereimportantintheoperators'esponsestoaccidentsequences.However,thegenericHEPsfromTable20-3intheHRAHandbookweremodifiedupwardsbyafactorof5formoderatelyhighstressandthenreducedbyafactorof0.1fortraining.Table20-3alreadyincludestheeffectsofstress.AlthoughthroughtheappropriateuseofTable12-5intheHRAHandbook,itispossibletoreducediagnosisHEPsbyafactorof10,theconditionsforsuchreductionasstatedinthistablearestated,andfurtheramplifiedandclarifiedinNUREG/CR-4772(Ref.4),whichisamorerecentapplicationofTHERP.Inmyopinion,theCookHRAdocumentationdoesnotprovideanadequaterationalefortheiruseofareductionfactorof10.3.2ModelinofHumanBehaviorForafull-scaleHRA,whichtheCookHRApurportstobe,itisnecessarytomodelthehumanbehaviorcorrectlyforeachtaskorsetoftasksthatcouldhaveamaterialnegativeimpactonthesystemfailurecriteriaofinterest.IntheTHERPapproachtoHRA,thisalwaysmeansathoroughtaskanalysisforeachrelevanttaskinitscontext,asisdescribedinChapter4oftheHRAHandbook.AllofthePSFsthatarelikelytohaveamaterialeffect,onataskshouldbeincluded.Thetaskanalysisbasicallystateswhatleadstowhat,andmovesforwardwithtime. Itisaninductivemethod,ascontrastedwiththefault-treemethodologywhichisadeductivemethodworkingbackwardsinasequenceofevents.WhileitistheoreticallypossibletoperformanHRAusingtheinductivefault-treemethodology,thoseofus'withconsiderableexperienceintheHRAfieldhaveelectedtousethedeductiveevent-treeapproach.Eventtrees,especiallytheHRAeventtreesusedintheTHERPHRAmethodsince1961,makeiteasiertographicallyrepresentthenecessaryunderlyingtaskanalysis,andtorepresentallhumanerrorsandhumansuccessesasconditionalprobabilitiesinwhichdependenceeffectsarerepresenteddirectlyinthetrees.Theinfluenceofimportantplant-specificPSFsisincludedineachbranchingintheeventtree,andisbasedontheparticularcontextinwhichthepotentialerrorcouldoccur.Inshort,theassessmentofconditionalhumanerrorandsuccessprobabilitiesforeachrelevanttask(orstepinatask)is.basedonafullconsiderationofthecontextunderwhichtaskmustbeperformed.ThisapproachcanbecontrastedwiththatusedintheCookHRAinwhicharelativelysmallsetofgenericHEPsandgenericPSFmodifyingfactorswereuseddespiteapparentdifferencesincontext.IfoundnoevidenceofanunderlyingtaskanalysisofthetypethatIwouldfindacceptableforafull-scaleHRA.IwouldcharacterizetheCookHRAasacomputerized,mechanisticapproachthatdoesnothavesufficientflexibilitytofullyincorporatetheeffectsofplant-specificPSFs.3.3AlicationofTHERPTherewereobviousmisapplicationofTHERP.Theseincludeuseintheirpost-accidentHRAoftablesfromtheHRAHandbookintendedonlyforHRAofpre-accidenttasks,useofgenericmultipliersofO.loreven0.01asadjustmentstoHEPstakenfromtheHRAHandbook,andadjustingthehandbook'snominaldiagnosismodelforstresseffectswhenthatmodelalreadyincludestheeffectsofstress.ThemostseriousmisapplicationofTHERPwastheapparentassumptionthathumanbehaviorcanbepartitionedintosmallunitsofactions,theHEPsofwhichcanbeincorporatedintofaulttreesasindependentbasicevents.Ingeneral,itappearstomethattheseveralmisapplicationofthefull-scaleapproachtoHRAdescribedintheHRAHandbookindicatethattheanalystsdidnothavemuchunderstandingoftheTHERPmethodorthehumanperformancemodelsintheHRAHandbook.3.4TraceabilitOneofthemostfrequentcriticismsofrecentHRAsisthatwhattheanalystsdidisnottraceable.IhavespentagooddealoftimetryingtofigureoutexactlyhowtheCookanalystsarrivedattheestimatedHEPsreportedinthedocumentation.Inseveralcases,Ijusthadtogiveup.Eventhoughtheanalystsusedfault-treetechnologyintheHRA,nofaulttreesforspecificanalysesweredisplayed.Onehastolookintotheequationsandinducethefaulttreeinvolvedorconstructonesowneventtree.HRAsshouldbewrittensothatindependentreviewerscanreadilyandaccuratelyevaluatewhatwasdonee

4.0CONCLUSION

SMyreviewofmajorportionsofthedocumentationofthehumanreliabilityanalysis(HRA)intheCookIndividualPlantExamination(IPE)revealedseveralmajorproblems.AlthoughtheanalystsstatethattheHRAwasbasedontheHRAHandbook(NUREG/CR-1278)anditscompaniondocument,NUREG/CR-2254,manymisapplicationofdataandmodelsfromthishandbookoccurred.Thereweremanynon-conservatismsintheHRAs,especiallyintheunusuallylargeamountofcreditassessedfortrainingandexperienceandfortheemploymentofsymptom-orientedemergencyoperatingprocedures.Therewasfailuretofullyconsidertheeffectsofwithin-persondependenceinperformingtasks.Manyoftheestimatedhumanerrorprobabilities(HEPs)werenotbasedonsituation-specificperformanceshapingfactorsandcontextofthetasks,especiallytasksthatareperformedmorethanonceinthesameaccidentsequence.ThisproblemisexacerbatedbytheuseofglobalorgenericestimatesofHEPs,whichresultedinarathermechanisticapproachtoHRA.Finally,traceabilityofwhatwasdoneintheHRAwasmademoredifficultbecausethenecessaryinformationwaslacking,notclearlywritten,ormostlydisplayedinequationformonly.MyoverallconclusionisthatmanyoftheestimatedHEPsarenotcredible.IhavenoconfidencethatanoverallsystemsanalysisincorporatingtheresultsofthecurrentCookHRAwouldproperlyassesstheinfluenceofpotentialhumanerrors.

AppendixADETAILEDEVALUATIONOFCOOKIPE/HRAMATERIALS(Draft1)ThisappendixprovidesmoredetailedcommentsrelatedtomyreviewoftheapplicationofTHERP(TechniqueforHumanErrorratePrediction-seeRefs1,2,and4)intheHumanReliabilityAnalysis(HRA)portionsofIndividualPlantExaminations(IPEs)ontheCooknuclearpowerplant(NPP).ThisreviewisrestrictedtotheCookHRAandrelatedmaterialmadeavailabletomeforreview.TableofContentsAcronyms&AbbreviationsI.SummaryII.DetailedCommentsA.CommentsonSection3.3.3HumanFailureDataB.CommentsonSectionI.TimingConsiderationsinHumanReliability9AnalysisC.CommentsonAppendixtotheAttachmenttoAEP:NRC:1082F10References13Acrons&AbbreviationsANNASEPEFEOPFTHEPHRAIPENPPNRCOAPRAPSFRFROSTATHERPVTTAnnunciatorAccidentSequenceEvaluationProgramErrorFactorEmergencyOperatingProcedureFaultTreeHumanErrorProbabilityHumanReliabilityAnalysisIndividualPlantExaminationNuclearPowerPlantNuclearRegulatoryCommissionOperatorActionProbabilisticRiskAssessmentPerformanceShapingFactor[Error]RecoveryFactorReactorOperatorShiftTechnicalAdvisorTechniqueforHumanErrorRatePredictionTechnicalInstituteofFinland A-2~I.Summar1.OneoftheNRCquestionstomewaswhethersomeusesofTHERPintheCookHRAwerenotinagreementwiththeproceduredescribedintheHRAHandbook(NUREG/CR-1278,SwainandGuttmann,1983-Ref.1).TheNRCstaffidentifiedwhattheyjudgedtobe"atypicalapplications"ofTHERP,andfurtherstatedthat"Thestaff...cannotconcludewhetherthepotentialfor'erroneousresults'omesfromtheparticularwayTHERPwasappliedbyanindividualconsultant...orbythelackofunderstandingofTHERPbysomelicensees."AfterreadingthematerialontheCookHRAthatNRCprovidedme,IconcludethattherewereindeedseveralinappropriateapplicationsoftheTHERP/HandbookapproachtoHRA.ItappearstomethattheseveralmisapplicationindicatealackofunderstandingbytheanalystsofTHERPandthehumanperformancemodelsintheHRAHandbook.Thefollowingthreeexamplesandothersnotedlaterillustratethispoint:Thenominaldiagnosismodel(Table20-3oftheHRAHandbook)wasincorrectlyused.Theanalystsdidnotunderstandthatthetableisbasedontimeavailablefordiagnosis,whichisobtainedbysubtractingpost-diagnosisactiontimefromtotaltimeavailableforthehumandiagnosisandactionscombined.b.ThespecialrulesusedtoadjustthejointHEPsfordiagnosisofeventsfoundinthenominaldiagnosismodel(Table20-3oftheHRAHandbook)arenottakenfromtheHRAHandbook,and,asnotedinitem2below,applicationoftheserulesresultinsubstantialand,inmyopinion,optimisticdownwardadjustmentsofdiagnosisHEPs.HRAHandbook'sTable20-22"Estimatedprobabilitiesthatacheckerwillfailtodetecterrorsmadebyothers"isinappropriatetoapplytocheckingduringanaccidentsequence.Theconditionsforusingthistablespecificallyincludeastatementthatitshouldbeappliedonlytonormaloperating(pre-accident)conditions.Applicationofthistabletopost-accidentconditions(i.e.,thesituationfollowingsomeinitiatingevent)couldresultineithertoohighortoolowestimatesofHEPs,dependingonthesituationinvolved.Forexample,inSectionR."OperatorFailstoRestoreControlAirThroughUseofthePlantAirCompressorDuringLossofOffsitePower($672),"errorQ6is"Operatorfailstonoticelackofcompressedairthroughsubsequentactions(i.e.,additionalvalveswillnotopen)."ThemeannominalHEPof1.6E-2isbasedonTable20-22,butthenisfurtherreducedbyamultiplierof0.5,togiveamodifiedQ6of8E-3.Asthisnumberisusedtomultiplyalltherelevantoperatoractions,itisaquitesizeableerrorrecoveryfactor.UnliketheZionHRA,theanalystsintheCookHRAdidattempttoassesstheeffectsofincorrectdiagnosisofvariousaccidentsequences.InthethreecasesIreviewed,theinitialdiagnosisHEPwasselectedfromthenominaldiagnosismodel(Table12-4or20-3)intheHRAHandbookandthenwasreducedbymakingnon-conservativemodifications.TheHEPwasfirstincreasedbyusingamultiplierof5forstress,butthenwasreducedbyamultiplierof0.1oreven0.01fortraining.TheO.lmultiplierwas A-3appliedto"RestoreControlAirinLOOP"andthe0.01multiplierwasappliedto"PBF-PrimaryFeedandBleed"andto"OA5-SteamGeneratorDepressurizationandCondensateFeed."Thus,thecombined"stress"and"training"adjustmentsresultedinmultiplyingthediagnosisHEPfromTable20-3byeitherafactorof0.5or0.05.Thereareseveralproblemswiththeaboveapproach.First,itisnotappropriatetoadjustthenominaldiagnosismodelforstresseffects,astheHEPsinnominaldiagnosismodelalreadyincludesucheffects.Thesecondproblemisthatthefactorof0.01reductionisnotpartoftheHRAHandbook,and,inmyopinion,representsacompletelyunjustifiedreduction.ThereisprovisionintheHRAHandbookfora0.1reductionfactor.ThiscomesfromTable12-5"GuidelinesforAdjustingNominalDiagnosisHEPsfromTable12-4."Table12-5providespossibleadjustmentstothenominaldiagnosismodelasafunctionofpracticebyoperatingcrewsofthespecificeventbeinganalyzed.AdditionalrulesforloweringthenominalHEPsfromTable20-3arepresentedinTable8-1inNUREG/CR-4772(Ref.4).ThethirdproblemisthattheanalystshaveapparentlycompletelymisunderstoodhowTable20-3istobeapplied.TheestimatedHEPsinthetablearenotforestimatedtimestoperformadiagnosis.Instead,asexplainedinChapter12oftheHRAHandbook,theHEPsaretimeavailablefordiagnosisnotactualdiagnosistime.IfanalystsuseTable20-3,theywouldhavetodeterminethetotalamountofactiontimeplusanyoperatorrecoverytimeassessed,andsubtractthisfromthetimewindow(theTminmyterms).ThiswouldbemyTd,orthetimeavailablefordiagnosis.ThenoneentersTable20-3withthistimetogetthediagnosisHEPforthatparticularavailabletime.OneofthebasicanalyticaltoolsofTHERPisthetaskanalysisinwhichthepotentialforhumanerrorisidentifiedbyidentifyingthosePerformanceShapingFactors(PSFs)thatarenotfullycompatiblewiththecapabilities,limitations,andneedsoftaskperformers.IntheCookHRA,itappearsthatHEPsareassignedtotaskswithoutfullconsiderationofthecontextsunderwhichthetasksmustbeperformed.Thus,thesameHEPmaybeassignedtoataskthatisdoneunderdifferentcircumstances.IntheCooksystemeventtrees,thesametaskappearsindifferentlocationsandthesameconditionalHEPisapparentlyassignedwithoutconsiderationofitscontext.TheapproachtakenintheHRAappearstobequitemechanisticandnon-situationspecific.OneofthemaintoolsoftheTHERPHRAmethod(whichtheanalystsstatetheyused)istheHRAeventtree.Thistreeisagraphicformoftaskanalysisthatenablesananalysttoidentifyinteractionsbetweentasksperformedbyonepersonandinteractionsbetweendifferentpersons.Inthiswayconditionalprobabilitiesofsuccessandfailurecanbeassignedtothesuccessandfailurelimbsineachbranchinginthetree.ThisgreatlysimplifiesanHRAandgreatlyincreasesthechangesofcorrectlyconsideringdependenceeffects.Theuseof'equationswithoutsuchtrees,ortheuseoffaulttreesinplaceofHRAeventtrees,greatlyincreasesthechancesofoverlookingorincorrectlyassessingdependenceeffects.

A-44.TheestimatedvaluesforadjustedHEPsareoftenverysmalland,inmyopinion,unjustifiablyso.Forexample,theuseofamultiplierof0.1,orinsomecaseseven0.01,toapplytoHEPsbecauseof"goodtraining"isnotjustifiedinthedocumentation.ThisisaprimeexampleofoptimisminassessmentoffinalHEPs,anditisoneoftheseveralmisusesoftheHRAHandbook.IhavealwayssaidinmyHRAtrainingcoursesthatthetablesofestimatedHEPsinthedatatablesintheHRAHandbookarenotsetinconcrete.Asthedesignofman-machineinterfacesimprove(includingimprovementsinwrittenprocedures),theseHEPscouldbereduced.(TheconcludingchapterintheHRAHandbooksaysthesamething.)ButreductionsintheseHEPsbyafactorof10(andcertainlybyafactorof100)inmyopinionrepresentagrossmisapplicationof,thedatatablesandshowahighdegreeofunsubstantiatedoptimism.5.Onthepositiveside,theconsiderableuseofsubject-'matterexperts(e.g.,reactoroperators)intheHRAsprovidesagoodmeasureoffacevaliditytotheunderlyingtaskanalysis.However,theanalystsapparentlyhaveacceptedtheusualoptimismofhighlytrainedspecialistswithoutquestion.Ireferespeciallytooptimisticstatementsabouttheirbeingnodebilitatingstresseffectsoncopingwithhypothesizedaccidentsequences.

A-5II.DetailedCommentsontheD.C.CookHRACommentsaremadeonthevarioussectionsoftheD.C..CookHRAdocumentationlistedbelow.SomeofthecommentsreflectthedifficultyIhadintryingtodeterminewhatwasdone.Provisionsforeasytraceabilityofwhattheanalystsdidandassumedwerelessthanadequate.Becauseofmytimelimitations,IwasunabletomakeasthoroughanevaluationoftheD.C.CookHRAasIdidfortheZionHRA.A.CommentsonSection3.3.3HumanFailureDatapp3-145to3-1591.AsintheZionHRA,theD.C.CookHRAestimatesofconditionalHEPsstartoutwithmedianHEPsandEFsfromtheHRAHandbook(NUREG/CR-1278,whichisReference22intheD.C.Cookdocument).ThesemedianHEPsandEFsareconvertedtonominalmeanHEPsandvariancesfoundinTable3.3-2(p3-148).SubsequentlythesemeanHEPsaremodifiedbyotherfactorssuchasoperatortraining,existenceofprocedures,operatorstresslevel,etc.TheseotherfactorswereusedtocalculateacompositePSFwhichwasusedasamultiplieronthenominalmeanHEPtocalculate"aplant-specificvalue."AlthoughtheHEPsmaybeplane-specific,manyofthemdonotappeartobesituation-specific.NRCstafftransformedsomeofthesystemfaulttreesintosystemeventtrees,andnotedthateventhoughagiventaskappearedmorethanonceinatree,thesameHEPwouldbeassignedtoit.Thisisnotappropriatebecauseforagiventask,theprecedingeventstoeachlocationofthetaskinthetreewerenotsame.Insomecases,theprecedingeventsmightincludeapresumedfailureofsomeequipmentthatoperatorsdependon.Inothercases,theprecedingeventsmightincludeapreviousoperatorerrorinthesequenceofoperatoractions.ThisoversightcanleadtooptimisticassessmentsofHEPs.p3-145,3.3.3.1,lastsentence:"TheHEPassociatedwiththegeneraloperatoractionwasquantifiedusingengineeringcalculationsorfaulttreemodels(providesthesamecalculationalresultsasTHERPtrees),asappropriate."Theoretically,thisisatruestatement.However,thisstatementoverlooksoneofthefundamentaladvantagesoftheTHERPHRAeventtreesoverfaulttrees.Useoffaulttreesrequiresanassumptionofindependenceamongthebasiceventsleadingtoatopevent.IntheHRAeventtree,alltheprobabilitiesassignedtoeachbinarybranchinginthetreeareconditionalprobabilities.Thus,forproperapplicationoftheTHERPmethodusingtheHRAeventtreesitisnotassumedthatsequentialactionsdepictedinanHRAeventtreeareindependent.Generally,somenon-zerolevelofdependenceisassessed.AnothermajordifferencebetweentheTHERPandfaulttreeapproachtoHRAisthattheformerisadeductiveapproachtoanalysiswhereasthelatteremploysadeductiveapproach.TheHRAeventtreeusedinTHERPisagraphicrepresentationoftheresultofataskanalysis,whichisthebasictoolforacompleteHRA.Taskanalysisisaninductivemethodusedtoidentifyhumanbehaviorsandunderlyingperformanceshapingfactors(PSFs).TaskanalysisanditsrelatedHRAeventtreesanalyzehuman A-6ac'tivitiesandrelatedsystemeventsandcontextsinaforwardmovingtimeframe.Botharealsohighlyflexibleintheirstructureandmoreamenabletoanalyzingthecomplexitiesinvolvedinhumanbehaviorinasystemcontext.Finally,anunpublishedstudybytheTechnicalInstituteofFinland(VTT)identifiederrorsmadebyanalystsperforminganHRAwhenusingfaulttrees,HRAeventtrees,andcause-consequencediagrams.ByfarthemosterrorsweremadewhenusingfaulttreesforHRAandthefewestwhenusingHRAeventtrees.Oneofthemostseriouserrorsinusingfaulttreesisthefailuretoadequatelyrepresentdependenciesamongdifferenthumantasks.Therefore,Imustconcludethat.thefailuretouseHRAeventtrees(oratleastsomeformofeventtree)fortheHRAdetailsislikelytohaveresultedintypeoferrorsdescribedabove.p3-146,topofpage:"GuidelinesusedincalculatingPSFsareidentifiedinReference22andinTable3.3-3."ThisstatementincorrectlyimpliesthatthevaluesforthePSFscomefromtheHRAHandbook;itsaysnothingabouttheuseofmodifiersnotintheHRAHandbookwhichwereusedtomateriallyreducetheHEPsusedintheHRA.Table3.3-3(p3-152)liststhe"DescriptiveHRAScalingGuides."SeveralofthemarenottakenfromtheHRAHandbook,andIcannotdeterminetheirbasisinthatdocument.Followingaresomedetailedcommentsonthattable:a.PSFof10forExtremelyHighStress:Ifanydynamicaspectsordiagnosisordecision-makingisinvolved,Table20-16itemjj7listsabasicHEPof.25.Ifthetaskcanbeclassifiedasstep-by-step,themultiplierof5isusedperitemjj6inthetable.Dependingontheaccidentsequenceandthetaskinvolved,themultiplierof10couldbeeitherconservativeornon-conservative.Butwhenananalystusesgenericfactorsratherthanasituation-specificanalysis,someinconsistencyisunavoidable.Theabbreviationw.r.t.isused.Ihavenoideawhatthatmeans.b.PSFof5foraStep-by-StepTaskUnderModeratelyHighStressfora"TypicalTransient":Againthew.r.t.isstated,andavalueof2isrecommended.Butapparentlytheanalystsusedthemoreconservativemultiplierof5.Buteventhisfactorcouldbenon-conservativefordiagnosticactivitieslaterinatransientifthisdiagnosismusttakeplaceunderthedisruptionofmany,manyannunciatorscompetingfortheoperator'sattention.c.PSFof0.1asa"Generalvalueforresponseforoperatorswhoarewell-trainedintheappropriateprocedures:Asageneralacross-the-boardrule,Ijudgethistobetoooptimistic.IntheHRAHandbook,thereisallowanceforusingthelowerboundofanominalHEPgivenunusualpositiveinfluences.ThelowerboundformostofthetabledHEPsintheHRAHandbookisthemedianHEPdividedby3.Butinmyexperience,eventhisdownwardadjustmenthasseldombeenused.

adA-7d.PSFofO.lforMedianTimeFrameforResponse:Ihavefoundnodefinitionofwhatismeantbya"mediantimeframe."AndIthinkthatthistypeofgenericmultiplierwithoutconsideringtheunderlyingPSFsforeachtaskinquestioncanleadtooptimism.However,Idounderstandthedesireofanalyststodevelopgenericfactorstoreduceanalysistimeandeffort.e.PSFofO.lforAvailabilityofMultipleSupportiveIndicators:"MultipleSupportiveIndicators"donotnecessarilyhelpanoperator.Icanenvisioncasesinwhichmultipleindicatorsmightwelldefineaheavytaskload(i.e.,moderatelyhighstress)foranoperator.SoratherthandividethenominalHEPby10,insuchcasesamultiplierofsomewholenumber>1.0mightbeappropriate.Also,thereisastrongtendencyonthepartofoperatorstolookatonlyoneoftwoormoreindicatorsthatprovidebasicallythesameinformation.Thismaynotbeagoodpractice,butitistheall-too-commonmodeofoperation.f.ThePSFsonpage3-153:IcanfindnobasisfortheseintheHRAHandbook.Amultiplierof0.01ismostoptimistic.5.p3-147,Section3.3.3.2,paragraph2:Itisnotedthatforsomeoperatoractions,"nodetailedproceduresareavailable,andonlygeneraldirectionisprovidedtotheoperator.Insuchcases,thesuccessoftheoperatoractiondependslargelyonthetrainingandmemoryoftheoperator,andthecalculatedHEPmaybeunreasonablyhigh.Interviewswiththeoperatorswereconductedtodetermineiftheoperatorshadtheknowledgeandtrainingtodealwiththesesituations."Myconcernherewouldbethattheanalystscouldbemotivatedtogivetoomuchcreditfor"trainingandmemory."However,onp62ofAttachmenttoAEP:NRC1082F,discussionofasensitivityanalysisofsomerecoveryactionsdonewithoutawrittenprocedureindicatestomethatthecreditfor"trainingandmemory"isnotunreasonable.AmedianHEPof.05(fromTable20-7item/j5)wasassessedforseveralsimple,routinerecoveryactionsnotcoveredindetailintherecoveryprocedures.Theanalystsreportthattheresultantincreaseintheprobabilityoffailingtherecoveryactionofaboutafactorof5hadanegligibleeffectintheoverallsystemsanalysis.6.p3-154,Table3.3-4DependenceLevelDefinitions:TheequationsforthefailureequationsaretakenfromTable20-17intheHRAHandbook.Theseequationsrepresenttheconditionalprobabilityofhumanerrorgivenfailureontheprevioustask.Butthesuccessequationsfromthistablehavebeenchangedtofailureequations,givensuccessontheprevioustask.Mathematically,thesechangesarecorrect,butIamuncertainastohowtheseequationsareused.Typically,thesuccessequationsinTable20-17wouldbeappliedtosuccessivetasksinaseriessystem,asdefinedintheHRAHandbook.AndthefailureequationsinTable20-17wouldbeappliedtosuccessivetasksinaparallelsystem.

A-87.p3-155,Table3.3-5SummaryofHumanErrorProbabilities:SomeofthesemeanHEPsseemverysmalltome,e.g.,"manualvalverestorationaftertestandmaintenance"of2.1E-5,and"airormotor-operatedvalverestorationaftertestandmaintenance"of4.2E-7.ApparentlytheseHEPsandtheothersinthetableareappliedwithoutregardtosituation-specificPSFs.

A-9B.CommentsonSect~onI.TiminConsiderationsinHumanReliabilitAnalsis5unnumberedpages1.p1,paragraphon"SuccessTime":BasedoninterviewsoftheanalystsbyNRCstaff,theinitiationofanabnormaleventbysomecompellingsignalsuchasanannunciatordefinesthestarttime.ThiscorrespondstotheTOintheASEPHRAProcedure(Ref.4).Thetotaltimeavailable,Tminmyterminology,consistsofdiagnosistimeandpost-diagnosisactiontime.2.p1,paragraphon"DiagnosisTime":ItisstatedthattheuseofanydiagnosisHEPprovides"addedconservatism"becausesymptom-orientedEOPsareused.Itisfurthersaidthat"ThediagnosiserrorratefoundintheHRAHandbook...isbasedonthediagnosisofbasicinitiatingeventswithlittleformalguidanceavailable.totheoperators."Apparently,theanalystsdonotunderstandthattheNominalDiagnosisModel(Table20-3)isbasedontimeavailablefordiagnosis,notactualdiagnosistime.IfanalystsuseTable20-3,theywouldhavetodeterminethetotalamountofactiontimeplusanyoperatorrecoverytimeassessed,andsubtractthisfromthetimewindow(theTminmyterms).ThiswouldbemyTd,orthetimeavailablefordiagnosis.ThenoneentersTable20-3withthistimetogetthediagnosisHEPforthatparticularavailabletime.It.istruethatforthe1983HRAHandbook,Table20-3wasdevelopedwithevent-basedEOPsinmind.ButTable12-5(seelastfootnoteinTable20-3)canbeusedtoassessalowerboundHEPasthenominalmedianHEPiftheproperconditionsaremet.IntheASEPHRAProcedure(Ref.4),Table8-1item9.dpermitsthelowerboundtobeassessedasthediagnosisHEPifcertainconditionsaremetinthedesignanduseofsymptom-orientedEOPs.Foravailablediagnosistimesupto30minutes,theuseofthelowerboundwouldbetantamounttoassessingthenominaldiagnosisHEPdividedby10.Thisis,ofcourse,amultiplierofO.l,asissometimeusedintheCookHRA.3.p1,paragraphon"ActionTime":Itisstatedthatthetimerequiredtoremotelyopenafewvalvescanbeignoredintheanalysis.Therearetwoproblemswiththisstatement.First,itmayrequireamaterialamountoftimeforanauxiliaryoperatortobetold(byphone)togotosomelocation,andthentraveltothatlocation.InsomeHRAsIhaveperformedorreviewed,thistimecouldnotbeignored.Second,asnotedinmycommentsontheparagraphon"SuccessTime,"correctuseofthenominaldiagnosismodel,Table20-3,fromtheHRAHandbookrequiresthatactiontimebeestimated.4.p2:InotethattheHRAassumestheShiftTechnicalAdvisor(STA)willnotbeavailableuntil10minutesintoanabnormalevent.Thisappearstobeaconservativeassumption.

C.CommentsonAendixtotheAttachmenttoAEP1NRC:1082Fpp41-43;78-1011.pp41-43,R.OperatorFailstoRestoreControlAirThroughUseofthePlantAirCompressorDuringLossofOffsitePower:ItisdifficulttoenvisionthehumanactionsintheequationfortheHEP.Itwouldbemucheasierforareviewer,especiallyonewithahumanfactorsbackgroundoroneusedtotheTHERPHRAmethod,toemployanHRAeventtree.FollowingisasketchofanapproximateHRAeventtreeinwhichonlythefailurelimbsarecompletelydrawn.Onecannotethateachfailurepaththroughthisseriessystemendswithapotenterrorrecoveryfactor(RFHEP8E-3).TheQ6erroris:"Operatorfailstonoticelackofcompressedairthroughsubsequentmitigatingactions(i.e.,additionalvalveswillnotopen)."Idon'thavesufficientinformationtoevaluatethisRF,butitdoesresultinasubstantialreductioninFT,thetotalfailureprobabilityforthisevent.NotethatwereitnotforthisRFHEPbeingANDedwithQlinthefirstfailurepaththroughtheHRAeventtree,the.135HEPforQlfordiagnosiserrorwouldresultinatotalfailureprobability,FTforthiseventbeingafactorof125higher.01.135FailtorespondtoANN05.00SFailtonoticelackoiconpzessedairthzu<<subsedzuentinitiatingactions.Fl.00108~Or,00065Failtostart+plantaircospzessozd+dtdttdttttiftdt<<ttcontzolaizilov/pzessuze+Ol.0065Failtonanuallyloadair06.Ooscorpzessoz/Xdt.dtit06.OOO65Failtoreopencontrolairisolationvalves05~0019Fl<<61'~06.000~.F4-6 A-11c.ThereareseveralmisapplicationoftheHRAHandbookinthisevent:Qlisamodificationofitemjj4inTable20-3(theNominalDiagnosisModel),butthenominalHEPismodifiedfortheeffectsofstress.Thistablealreadyincludestheeffectsofstress.Finally,IfindthemultiplierofO.lneedstohavebelievablejustification.(Seeespeciallythediscussioninitem9.dinTable8-1ofRef.4)2)Q2usesthecorrecttabledHEPfromtheHRAHandbook,butthe0.1multiplierfor"trained"isquestionable.Normally,ifoneallowsextracreditforacombinationoffamiliarityandhighskill,thelowerboundofthemedianHEPwouldbeused.Inthiscase,itwouldbe.001/3<<3E-4.Well,thatseemstoworkoutOK,assumingtheuseofthelowerboundcanbejustified.ThemeanHEPwouldthenprobablybearoundthe6.4E-4assessed.3)Q3soundslikeanECOM,butTable20-7isusedasthestartingpoint,andthistableisforEOMs.Icouldn'ttellifthisactionisdoneinthecontrolroomorisitdoneoutsidethecontrolroom.4)Q4seemsOKexceptforthe0.1multiplierfortraining.5)Q5seemsOKexceptforthe0.1trainingmultiplier.Butwhatdirectstheoperatortoperformthisstep26)Q6likealltheothertermsismultipliedby0.1for"trained."ThisiscertainlyaconvenientwayofreducingestimatedHEPs,buttheuseofsucha"correctionfactor"acrosstheboardisquestionable.AlsoIwonderhowmuchtimeisavailableforthisgenericRF.7)Nodependenceisassessedamonganyoftheoperatoractions.ThismaybeOK;Idon'tknowenoughaboutthedetailstojudgewhetheritisOKornot.ButtypicallyananalystwillassessindependencebetweenEOMsforwrittenstepsinaprocedure.Thereareexceptions,however.NRCstaffdrewasystemeventtreetobetterindicatethesequenceofoperatoractions.Thistreealsocallsintoquestiontheassessmentofa1.9E-3HEPforQ5regardlessofwherethetaskisperformed.ThislimitationillustratesmyearlierpointthatwhiletheHRAmaybeplant-specific,itcertainlyisnotsituation-specific.Italsoillustratesthepoint(asdoesmyHRAeventtree)thattheuseoffaulttreesfortheHRAoftenresultsinfailuretoconsidertheeffectsofdifferentPSFs,includingdependence.2.pp7888,2.3PBF-PrimaryBleedandFeed:a~ThisHRAincludesamultiplierof0.01foranoperatorfailingtoentertheappropriateEOP,andtheusual0.1fortraining.BasicallythesamemisapplicationoftheHRAHandbookdescribedinitem1abovewerealsofoundintheHRAforthisevent.NRCstaffdrewasystemeventtreewhichillustratedtheassessmentofoneHEPtothesametaskregardlessofwherethattaskoccurredintheaccidentsequence.

A-12pp89-101,2.4OA5-SteamDepressurizationandCondensateFeed:ThisHRAisalmostidenticaltothePrimaryBleedandFeedHRAabove,includingmisapplicationoftheHRAHandbook.Itcanbenotedthat"FollowsProcedures"occursseveraltimesinthefaulttree.Thereisnoexplanationofwhatismeantbythesewords.Wastheerrorthefailuretouseavailablewrittenproceduresor,morelikely,thefailuretodowhatwasinthewrittenprocedure.Inanyevent,whydoesthisappearseveraltimesintheerrorsequences?ItmaybethatthismeansverificationbytheSTA,butthiswouldimplythattheSTAverifiesdetailedoperatoractions,afunctionnotappropriatetotheSTA.

References1.Swain,A.D.andH.E.Guttmann,Handbookof'umanReliabilityAnalysisVithEmphasisonNuclearPowerPlantApplications,NUREG/CR-1278,U.S.NuclearRegulatoryCommission,WashingtonDC,August1983,128pp.2.Bell,B.J.andA.D.Swain,AProcedureforConductingaHumanRe'liabilityAnalysisforNuclearPowerPlants,NUREG/CR-2254,U.S.NuclearRegulatoryCommission,WashingtonDC,May1983,700pp.3.Swain,A.D.,EvaluationofZionIPE/HRAMaterials,U.S.NuclearRegulatoryCommission,WashingtonDC,June$994,33pp.4.Swain,A.D.,AccidentSequenceEvaluationProgramHumanReliabilityAnalysisProcedure,NUREG/CR-4772,U.S.NuclearRegulatoryCommission,WashingtonDC,February1987,152pp.